DEVOPS-3406 - helm: namespace resouces

packaging/helm/openwork-ee/README.md

@@ -85,6 +85,33 @@ ingress:
     host: api.openwork.example.com
 ```
 
+### Namespace
+
+The chart sets `metadata.namespace` on every namespaced resource (Deployments,
+Services, ConfigMap, Secret, Ingress, migration Job) from the `namespace` value,
+which defaults to `openwork`:
+
+~~~yaml
+namespace: openwork
+~~~
+
+To use the Helm release namespace instead, set `namespace: ""` (or `--set namespace=`).
+
+This keeps `helm template ... | kubectl apply -f -` pipelines from falling back
+to the kubectl context namespace (e.g. `kube-system`). When installing with
+Helm, keep `namespace` aligned with the release namespace:
+
+```bash
+helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
+  --namespace openwork \
+  --create-namespace \
+  -f values.prod.yaml
+```
+
+When applying rendered manifests directly, create the namespace first
+(`kubectl create namespace openwork`) since Helm does not create it for you in
+that flow.
+
 ### Upgrade note: public URL values
 
 Current chart versions make `config.public.webOrigin` the primary public URL.

packaging/helm/openwork-ee/templates/NOTES.txt

@@ -1,6 +1,9 @@
 OpenWork EE has been rendered with:
 
   DEN_BASE_URL={{ .Values.config.public.webOrigin }}
+  namespace={{ include "openwork-ee.namespace" . }}
+
+All namespaced resources target the namespace above (values: namespace).
 
 DEN_BASE_URL is now the primary public Den URL. den-api derives Better Auth,
 CORS/trusted origins, web-app hosts, API defaults, and MCP resource defaults

packaging/helm/openwork-ee/templates/_helpers.tpl

@@ -15,6 +15,10 @@
 {{- end -}}
 {{- end -}}
 
+{{- define "openwork-ee.namespace" -}}
+{{- .Values.namespace | default .Release.Namespace | toString | quote -}}
+{{- end -}}
+
 {{- define "openwork-ee.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}

packaging/helm/openwork-ee/templates/configmap.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "openwork-ee.configName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.labels" . | nindent 4 }}
 data:

packaging/helm/openwork-ee/templates/den-api.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "openwork-ee.denApiServiceName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "den-api") | nindent 4 }}
   {{- with .Values.denApi.service.annotations }}
@@ -29,6 +30,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-den-api
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "den-api") | nindent 4 }}
 spec:

packaging/helm/openwork-ee/templates/den-web.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "openwork-ee.denWebServiceName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "den-web") | nindent 4 }}
   {{- with .Values.denWeb.service.annotations }}
@@ -29,6 +30,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-den-web
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "den-web") | nindent 4 }}
 spec:

packaging/helm/openwork-ee/templates/inference.yaml

@@ -4,6 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "openwork-ee.inferenceServiceName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "inference") | nindent 4 }}
   {{- with .Values.inference.service.annotations }}
@@ -30,6 +31,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-inference
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "inference") | nindent 4 }}
 spec:

packaging/helm/openwork-ee/templates/ingress.yaml

@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ include "openwork-ee.fullname" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}

packaging/helm/openwork-ee/templates/migration-job.yaml

@@ -4,6 +4,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-migrate
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "migration") | nindent 4 }}
   {{- if .Values.migrations.hook }}

packaging/helm/openwork-ee/templates/secret.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "openwork-ee.secretName" . }}
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.labels" . | nindent 4 }}
 type: Opaque

packaging/helm/openwork-ee/templates/tests/env-probe-job.yaml

@@ -3,6 +3,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: {{ include "openwork-ee.fullname" . }}-env-probe
+  namespace: {{ include "openwork-ee.namespace" . }}
   labels:
     {{- include "openwork-ee.componentLabels" (dict "root" . "component" "env-probe") | nindent 4 }}
   annotations:

packaging/helm/openwork-ee/tests/namespace.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_count() {
+  local file="$1"
+  local needle="$2"
+  local expected="$3"
+  local count
+  count="$(grep -F -c -- "$needle" "$file" || true)"
+  if [[ "$count" != "$expected" ]]; then
+    printf 'Expected %s occurrences of %s, found %s\n' "$expected" "$needle" "$count" >&2
+    return 1
+  fi
+}
+
+# Default render: every namespaced resource lands in "openwork".
+# 8 resources: Secret, ConfigMap, den-api/den-web Services+Deployments,
+# migration Job, env-probe test Job.
+default_rendered="$tmp_dir/default.yaml"
+helm template openwork-ee "$chart_dir" > "$default_rendered"
+assert_count "$default_rendered" '  namespace: "openwork"' 8
+assert_count "$default_rendered" '  namespace: "kube-system"' 0
+
+# Full render (ingress + inference enabled): 11 namespaced resources.
+full_rendered="$tmp_dir/full.yaml"
+helm template openwork-ee "$chart_dir" \
+  --set ingress.enabled=true --set inference.enabled=true > "$full_rendered"
+assert_count "$full_rendered" '  namespace: "openwork"' 11
+
+# Explicit override wins on every resource.
+override_rendered="$tmp_dir/override.yaml"
+helm template openwork-ee "$chart_dir" --set namespace=platform > "$override_rendered"
+assert_count "$override_rendered" '  namespace: "platform"' 8
+assert_count "$override_rendered" '  namespace: "openwork"' 0
+
+# Cleared value falls back to the release namespace.
+fallback_rendered="$tmp_dir/fallback.yaml"
+helm template openwork-ee "$chart_dir" --namespace rel-ns --set namespace= > "$fallback_rendered"
+assert_count "$fallback_rendered" '  namespace: "rel-ns"' 8
+
+# Numeric and YAML-keyword overrides stay quoted strings: --set types these as
+# number/bool, and metadata.namespace must render as a quoted string.
+numeric_rendered="$tmp_dir/numeric.yaml"
+helm template openwork-ee "$chart_dir" --set namespace=123 > "$numeric_rendered"
+assert_count "$numeric_rendered" '  namespace: "123"' 8
+assert_count "$numeric_rendered" '  namespace: 123' 0
+
+keyword_rendered="$tmp_dir/keyword.yaml"
+helm template openwork-ee "$chart_dir" --set namespace=yes > "$keyword_rendered"
+assert_count "$keyword_rendered" '  namespace: "yes"' 8
+assert_count "$keyword_rendered" '  namespace: yes' 0
+
+printf 'namespace chart checks passed\n'

packaging/helm/openwork-ee/values.yaml

@@ -1,6 +1,13 @@
 nameOverride: ""
 fullnameOverride: ""
 
+# Kubernetes namespace where every namespaced resource (Deployments, Services,
+# ConfigMap, Secret, Ingress, migration Job, ...) is deployed. The chart sets
+# metadata.namespace explicitly so `helm template | kubectl apply` pipelines do
+# not fall back to the kubectl context namespace (e.g. kube-system). When using
+# `helm install`, keep this aligned with `--namespace` / the release namespace.
+namespace: openwork
+
 image:
   tag: latest
   pullPolicy: IfNotPresent