From 2d94648b1a99c9542387d5509d258f94d8e46e5c Mon Sep 17 00:00:00 2001
From: Raul Gherman <raul.gherman@modaoperandi.com>
Date: Fri, 4 Sep 2026 15:13:11 +0300
Subject: [PATCH 1/4] DEVOPS-3406 - helm: namespace resouces

---
 packaging/helm/openwork-ee/README.md          | 25 +++++++++++
 .../helm/openwork-ee/templates/NOTES.txt      |  3 ++
 .../helm/openwork-ee/templates/_helpers.tpl   |  4 ++
 .../helm/openwork-ee/templates/configmap.yaml |  1 +
 .../helm/openwork-ee/templates/den-api.yaml   |  2 +
 .../helm/openwork-ee/templates/den-web.yaml   |  2 +
 .../helm/openwork-ee/templates/inference.yaml |  2 +
 .../helm/openwork-ee/templates/ingress.yaml   |  1 +
 .../openwork-ee/templates/migration-job.yaml  |  1 +
 .../helm/openwork-ee/templates/secret.yaml    |  1 +
 .../templates/tests/env-probe-job.yaml        |  1 +
 packaging/helm/openwork-ee/tests/namespace.sh | 45 +++++++++++++++++++
 packaging/helm/openwork-ee/values.yaml        |  7 +++
 13 files changed, 95 insertions(+)
 create mode 100755 packaging/helm/openwork-ee/tests/namespace.sh

diff --git a/packaging/helm/openwork-ee/README.md b/packaging/helm/openwork-ee/README.md
index 626c627bb4..e3315ac6b8 100644
--- a/packaging/helm/openwork-ee/README.md
+++ b/packaging/helm/openwork-ee/README.md
@@ -85,6 +85,31 @@ ingress:
     host: api.openwork.example.com
 ```
 
+### Namespace
+
+The chart sets `metadata.namespace` on every namespaced resource (Deployments,
+Services, ConfigMap, Secret, Ingress, migration Job) from the `namespace` value,
+which defaults to `openwork`:
+
+```yaml
+namespace: openwork
+```
+
+This keeps `helm template ... | kubectl apply -f -` pipelines from falling back
+to the kubectl context namespace (e.g. `kube-system`). When installing with
+Helm, keep `namespace` aligned with the release namespace:
+
+```bash
+helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
+  --namespace openwork \
+  --create-namespace \
+  -f values.prod.yaml
+```
+
+When applying rendered manifests directly, create the namespace first
+(`kubectl create namespace openwork`) since Helm does not create it for you in
+that flow.
+
 ### Upgrade note: public URL values
 
 Current chart versions make `config.public.webOrigin` the primary public URL.
diff --git a/packaging/helm/openwork-ee/templates/NOTES.txt b/packaging/helm/openwork-ee/templates/NOTES.txt
index 5d00df2144..e1d9f89789 100644
--- a/packaging/helm/openwork-ee/templates/NOTES.txt
+++ b/packaging/helm/openwork-ee/templates/NOTES.txt
@@ -1,6 +1,9 @@
 OpenWork EE has been rendered with:
 
   DEN_BASE_URL={{ .Values.config.public.webOrigin }}
+  namespace={{ include "openwork-ee.namespace" . }}
+
+All namespaced resources target the namespace above (values: namespace).
 
 DEN_BASE_URL is now the primary public Den URL. den-api derives Better Auth,
 CORS/trusted origins, web-app hosts, API defaults, and MCP resource defaults
diff --git a/packaging/helm/openwork-ee/templates/_helpers.tpl b/packaging/helm/openwork-ee/templates/_helpers.tpl
index 3568217c67..c0795943ce 100644
--- a/packaging/helm/openwork-ee/templates/_helpers.tpl
+++ b/packaging/helm/openwork-ee/templates/_helpers.tpl
@@ -15,6 +15,10 @@
 {{- end -}}
 {{- end -}}
 
+{{- define "openwork-ee.namespace" -}}
+{{- .Values.namespace | default .Release.Namespace -}}
+{{- end -}}
+
 {{- define "openwork-ee.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
diff --git a/packaging/helm/openwork-ee/templates/configmap.yaml b/packaging/helm/openwork-ee/templates/configmap.yaml
index 7dd882993f..01c51ef30d 100644
--- a/packaging/helm/openwork-ee/templates/configmap.yaml
+++ b/packaging/helm/openwork-ee/templates/configmap.yaml
@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "openwork-ee.configName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.labels" . | nindent 4 }}
 data:
diff --git a/packaging/helm/openwork-ee/templates/den-api.yaml b/packaging/helm/openwork-ee/templates/den-api.yaml
index cab054f451..3d3e693f00 100644
--- a/packaging/helm/openwork-ee/templates/den-api.yaml
+++ b/packaging/helm/openwork-ee/templates/den-api.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "openwork-ee.denApiServiceName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "den-api") | nindent 4 }}
   {{- with .Values.denApi.service.annotations }}
@@ -29,6 +30,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-den-api
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "den-api") | nindent 4 }}
 spec:
diff --git a/packaging/helm/openwork-ee/templates/den-web.yaml b/packaging/helm/openwork-ee/templates/den-web.yaml
index cac39aaf35..11158f5f34 100644
--- a/packaging/helm/openwork-ee/templates/den-web.yaml
+++ b/packaging/helm/openwork-ee/templates/den-web.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "openwork-ee.denWebServiceName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "den-web") | nindent 4 }}
   {{- with .Values.denWeb.service.annotations }}
@@ -29,6 +30,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-den-web
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "den-web") | nindent 4 }}
 spec:
diff --git a/packaging/helm/openwork-ee/templates/inference.yaml b/packaging/helm/openwork-ee/templates/inference.yaml
index bd07ed97df..cd9023a93f 100644
--- a/packaging/helm/openwork-ee/templates/inference.yaml
+++ b/packaging/helm/openwork-ee/templates/inference.yaml
@@ -4,6 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "openwork-ee.inferenceServiceName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "inference") | nindent 4 }}
   {{- with .Values.inference.service.annotations }}
@@ -30,6 +31,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-inference
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "inference") | nindent 4 }}
 spec:
diff --git a/packaging/helm/openwork-ee/templates/ingress.yaml b/packaging/helm/openwork-ee/templates/ingress.yaml
index 6521d6a760..a1a01855b8 100644
--- a/packaging/helm/openwork-ee/templates/ingress.yaml
+++ b/packaging/helm/openwork-ee/templates/ingress.yaml
@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ include "openwork-ee.fullname" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}
diff --git a/packaging/helm/openwork-ee/templates/migration-job.yaml b/packaging/helm/openwork-ee/templates/migration-job.yaml
index d27cd64d64..ef26df86f1 100644
--- a/packaging/helm/openwork-ee/templates/migration-job.yaml
+++ b/packaging/helm/openwork-ee/templates/migration-job.yaml
@@ -4,6 +4,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-migrate
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "migration") | nindent 4 }}
   {{- if .Values.migrations.hook }}
diff --git a/packaging/helm/openwork-ee/templates/secret.yaml b/packaging/helm/openwork-ee/templates/secret.yaml
index 77a38b318a..aba5d68cff 100644
--- a/packaging/helm/openwork-ee/templates/secret.yaml
+++ b/packaging/helm/openwork-ee/templates/secret.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "openwork-ee.secretName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.labels" . | nindent 4 }}
 type: Opaque
diff --git a/packaging/helm/openwork-ee/templates/tests/env-probe-job.yaml b/packaging/helm/openwork-ee/templates/tests/env-probe-job.yaml
index 310dd53ad5..6afc058258 100644
--- a/packaging/helm/openwork-ee/templates/tests/env-probe-job.yaml
+++ b/packaging/helm/openwork-ee/templates/tests/env-probe-job.yaml
@@ -3,6 +3,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-env-probe
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "env-probe") | nindent 4 }}
   annotations:
diff --git a/packaging/helm/openwork-ee/tests/namespace.sh b/packaging/helm/openwork-ee/tests/namespace.sh
new file mode 100755
index 0000000000..d6e1f53aff
--- /dev/null
+++ b/packaging/helm/openwork-ee/tests/namespace.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_count() {
+  local file="$1"
+  local needle="$2"
+  local expected="$3"
+  local count
+  count="$(grep -F -c -- "$needle" "$file" || true)"
+  if [[ "$count" != "$expected" ]]; then
+    printf 'Expected %s occurrences of %s, found %s\n' "$expected" "$needle" "$count" >&2
+    return 1
+  fi
+}
+
+# Default render: every namespaced resource lands in "openwork".
+# 8 resources: Secret, ConfigMap, den-api/den-web Services+Deployments,
+# migration Job, env-probe test Job.
+default_rendered="$tmp_dir/default.yaml"
+helm template openwork-ee "$chart_dir" > "$default_rendered"
+assert_count "$default_rendered" '  namespace: openwork' 8
+assert_count "$default_rendered" '  namespace: kube-system' 0
+
+# Full render (ingress + inference enabled): 11 namespaced resources.
+full_rendered="$tmp_dir/full.yaml"
+helm template openwork-ee "$chart_dir" \
+  --set ingress.enabled=true --set inference.enabled=true > "$full_rendered"
+assert_count "$full_rendered" '  namespace: openwork' 11
+
+# Explicit override wins on every resource.
+override_rendered="$tmp_dir/override.yaml"
+helm template openwork-ee "$chart_dir" --set namespace=platform > "$override_rendered"
+assert_count "$override_rendered" '  namespace: platform' 8
+assert_count "$override_rendered" '  namespace: openwork' 0
+
+# Cleared value falls back to the release namespace.
+fallback_rendered="$tmp_dir/fallback.yaml"
+helm template openwork-ee "$chart_dir" --namespace rel-ns --set namespace= > "$fallback_rendered"
+assert_count "$fallback_rendered" '  namespace: rel-ns' 8
+
+printf 'namespace chart checks passed\n'
diff --git a/packaging/helm/openwork-ee/values.yaml b/packaging/helm/openwork-ee/values.yaml
index 6342ddb805..8ca0a7e519 100644
--- a/packaging/helm/openwork-ee/values.yaml
+++ b/packaging/helm/openwork-ee/values.yaml
@@ -1,6 +1,13 @@
 nameOverride: ""
 fullnameOverride: ""
 
+# Kubernetes namespace where every namespaced resource (Deployments, Services,
+# ConfigMap, Secret, Ingress, migration Job, ...) is deployed. The chart sets
+# metadata.namespace explicitly so `helm template | kubectl apply` pipelines do
+# not fall back to the kubectl context namespace (e.g. kube-system). When using
+# `helm install`, keep this aligned with `--namespace` / the release namespace.
+namespace: openwork
+
 image:
   tag: latest
   pullPolicy: IfNotPresent

From d6298dd12e1e59abdce0e6e470d6ffaf311eb8aa Mon Sep 17 00:00:00 2001
From: Raul Gherman
 <68240333+raul-gherman-modaoperandi@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:22:34 +0300
Subject: [PATCH 2/4] DEVOPS-3406 - Update README with namespace usage
 instructions

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 packaging/helm/openwork-ee/README.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packaging/helm/openwork-ee/README.md b/packaging/helm/openwork-ee/README.md
index e3315ac6b8..97d7419ff8 100644
--- a/packaging/helm/openwork-ee/README.md
+++ b/packaging/helm/openwork-ee/README.md
@@ -91,9 +91,11 @@ The chart sets `metadata.namespace` on every namespaced resource (Deployments,
 Services, ConfigMap, Secret, Ingress, migration Job) from the `namespace` value,
 which defaults to `openwork`:
 
-```yaml
+~~~yaml
 namespace: openwork
-```
+~~~
+
+To use the Helm release namespace instead, set `namespace: ""` (or `--set namespace=`).
 
 This keeps `helm template ... | kubectl apply -f -` pipelines from falling back
 to the kubectl context namespace (e.g. `kube-system`). When installing with

From da2c9eb04803d68e38dad5e9ecd8579baed0303d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 4 Sep 2026 12:22:41 +0000
Subject: [PATCH 3/4] DEVOPS-3406 - helm: quote namespace helper

Co-authored-by: raul-gherman-modaoperandi <68240333+raul-gherman-modaoperandi@users.noreply.github.com>
---
 .../helm/openwork-ee/templates/_helpers.tpl     |  2 +-
 packaging/helm/openwork-ee/tests/namespace.sh   | 17 +++++++++++------
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/packaging/helm/openwork-ee/templates/_helpers.tpl b/packaging/helm/openwork-ee/templates/_helpers.tpl
index c0795943ce..13e6eccd53 100644
--- a/packaging/helm/openwork-ee/templates/_helpers.tpl
+++ b/packaging/helm/openwork-ee/templates/_helpers.tpl
@@ -16,7 +16,7 @@
 {{- end -}}
 
 {{- define "openwork-ee.namespace" -}}
-{{- .Values.namespace | default .Release.Namespace -}}
+{{- .Values.namespace | default .Release.Namespace | quote -}}
 {{- end -}}
 
 {{- define "openwork-ee.chart" -}}
diff --git a/packaging/helm/openwork-ee/tests/namespace.sh b/packaging/helm/openwork-ee/tests/namespace.sh
index d6e1f53aff..c8af384b69 100755
--- a/packaging/helm/openwork-ee/tests/namespace.sh
+++ b/packaging/helm/openwork-ee/tests/namespace.sh
@@ -22,24 +22,29 @@ assert_count() {
 # migration Job, env-probe test Job.
 default_rendered="$tmp_dir/default.yaml"
 helm template openwork-ee "$chart_dir" > "$default_rendered"
-assert_count "$default_rendered" '  namespace: openwork' 8
-assert_count "$default_rendered" '  namespace: kube-system' 0
+assert_count "$default_rendered" '  namespace: "openwork"' 8
+assert_count "$default_rendered" '  namespace: "kube-system"' 0
 
 # Full render (ingress + inference enabled): 11 namespaced resources.
 full_rendered="$tmp_dir/full.yaml"
 helm template openwork-ee "$chart_dir" \
   --set ingress.enabled=true --set inference.enabled=true > "$full_rendered"
-assert_count "$full_rendered" '  namespace: openwork' 11
+assert_count "$full_rendered" '  namespace: "openwork"' 11
 
 # Explicit override wins on every resource.
 override_rendered="$tmp_dir/override.yaml"
 helm template openwork-ee "$chart_dir" --set namespace=platform > "$override_rendered"
-assert_count "$override_rendered" '  namespace: platform' 8
-assert_count "$override_rendered" '  namespace: openwork' 0
+assert_count "$override_rendered" '  namespace: "platform"' 8
+assert_count "$override_rendered" '  namespace: "openwork"' 0
 
 # Cleared value falls back to the release namespace.
 fallback_rendered="$tmp_dir/fallback.yaml"
 helm template openwork-ee "$chart_dir" --namespace rel-ns --set namespace= > "$fallback_rendered"
-assert_count "$fallback_rendered" '  namespace: rel-ns' 8
+assert_count "$fallback_rendered" '  namespace: "rel-ns"' 8
+
+# Numeric override remains a YAML string after rendering.
+numeric_rendered="$tmp_dir/numeric.yaml"
+helm template openwork-ee "$chart_dir" --set namespace=123 > "$numeric_rendered"
+assert_count "$numeric_rendered" '  namespace: "123"' 8
 
 printf 'namespace chart checks passed\n'

From 19d085ca0317f207bf393decd2936aa7d3a8bfda Mon Sep 17 00:00:00 2001
From: Raul Gherman <raul.gherman@modaoperandi.com>
Date: Fri, 4 Sep 2026 15:40:14 +0300
Subject: [PATCH 4/4] DEVOPS- ensure namespace values are quoted in templates
 and tests

---
 packaging/helm/openwork-ee/templates/_helpers.tpl | 2 +-
 packaging/helm/openwork-ee/tests/namespace.sh     | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/packaging/helm/openwork-ee/templates/_helpers.tpl b/packaging/helm/openwork-ee/templates/_helpers.tpl
index 13e6eccd53..a90fc818b0 100644
--- a/packaging/helm/openwork-ee/templates/_helpers.tpl
+++ b/packaging/helm/openwork-ee/templates/_helpers.tpl
@@ -16,7 +16,7 @@
 {{- end -}}
 
 {{- define "openwork-ee.namespace" -}}
-{{- .Values.namespace | default .Release.Namespace | quote -}}
+{{- .Values.namespace | default .Release.Namespace | toString | quote -}}
 {{- end -}}
 
 {{- define "openwork-ee.chart" -}}
diff --git a/packaging/helm/openwork-ee/tests/namespace.sh b/packaging/helm/openwork-ee/tests/namespace.sh
index c8af384b69..8d2133d7aa 100755
--- a/packaging/helm/openwork-ee/tests/namespace.sh
+++ b/packaging/helm/openwork-ee/tests/namespace.sh
@@ -42,9 +42,16 @@ fallback_rendered="$tmp_dir/fallback.yaml"
 helm template openwork-ee "$chart_dir" --namespace rel-ns --set namespace= > "$fallback_rendered"
 assert_count "$fallback_rendered" '  namespace: "rel-ns"' 8
 
-# Numeric override remains a YAML string after rendering.
+# Numeric and YAML-keyword overrides stay quoted strings: --set types these as
+# number/bool, and metadata.namespace must render as a quoted string.
 numeric_rendered="$tmp_dir/numeric.yaml"
 helm template openwork-ee "$chart_dir" --set namespace=123 > "$numeric_rendered"
 assert_count "$numeric_rendered" '  namespace: "123"' 8
+assert_count "$numeric_rendered" '  namespace: 123' 0
+
+keyword_rendered="$tmp_dir/keyword.yaml"
+helm template openwork-ee "$chart_dir" --set namespace=yes > "$keyword_rendered"
+assert_count "$keyword_rendered" '  namespace: "yes"' 8
+assert_count "$keyword_rendered" '  namespace: yes' 0
 
 printf 'namespace chart checks passed\n'