From a9771147697f5e74c5f8f242fe5edbecf4c31cbb Mon Sep 17 00:00:00 2001 From: Fredrik Steen Date: Wed, 26 Aug 2026 16:14:37 +0200 Subject: [PATCH 1/2] fix(chart): gate namespace creation behind createNamespace value - Namespace template now gated behind createNamespace value (default false) - Added helm.sh/resource-policy: keep annotation to preserve namespace on deletion - Fixes conflicts with helm install --create-namespace on both Helm 3 and 4 Fixes namespace deletion: helm install -n varnish-gateway varnish/varnish-gateway --create-namespace kubectl -n varnish-gateway run keepme --image=busybox -- sleep 36000 helm delete -n varnish-gateway varnish-gateway # <-- Also deletes the keepme pod Also fixes adopting a namespace: kubectl create namespace varnish-gateway-system helm install varnish-gateway oci://ghcr.io/varnish/charts/varnish-gateway --namespace varnish-gateway-system # Fails --- CHANGELOG.md | 7 +++++++ charts/varnish-gateway/README.md | 16 ++++++++++++++++ charts/varnish-gateway/templates/namespace.yaml | 7 +++++-- charts/varnish-gateway/values.yaml | 4 ++++ 4 files changed, 32 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5d9bca4a..62b10daf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed +- **Helm chart: the chart-templated Namespace no longer conflicts with + `helm install --create-namespace` or gets deleted on uninstall** + With Helm(4) server-side apply silently adopted the namespace and a + `helm uninstall` then deleted the namespace and everything in it. + The Namespace template is now gated behind a new `createNamespace` + value (default `false`), so the documented `--create-namespace` + flow works on both Helm major versions. - **Redirect port now derives from the Gateway listener, not the `Host` header.** A `RequestRedirect` filter with no `scheme` and no `port` was building the `Location` port from the client's `Host` header, so a request diff --git a/charts/varnish-gateway/README.md b/charts/varnish-gateway/README.md index 2239b75e..b052a849 100644 --- a/charts/varnish-gateway/README.md +++ b/charts/varnish-gateway/README.md @@ -20,6 +20,21 @@ helm install varnish-gateway oci://ghcr.io/varnish/charts/varnish-gateway \ --create-namespace ``` +### Namespace management + +If instead you want the chart to own the namespace (e.g. rendering with +`helm template | kubectl apply`) set `createNamespace=true` + +```bash +helm install varnish-gateway oci://ghcr.io/varnish/charts/varnish-gateway \ + --version 0.x.y \ + --set namespace=varnish-gateway-system \ + --set createNamespace=true +``` + +The chart-created namespace carries `helm.sh/resource-policy: keep`, so +uninstalling the release leaves the namespace (and anything in it) intact. + ## Configuration The following table lists the configurable parameters of the Varnish Gateway chart and their default values. @@ -84,6 +99,7 @@ Requires the prometheus-operator CRDs (`monitoring.coreos.com`) — e.g. from | Parameter | Description | Default | |-----------|-------------|---------| | `namespace` | Namespace for operator deployment | `varnish-gateway-system` | +| `createNamespace` | Let the chart create the namespace itself | `false` | | `rbac.create` | Create RBAC resources | `true` | | `serviceAccount.create` | Create service account | `true` | | `commonLabels` | Extra labels added to all resources | `{}` | diff --git a/charts/varnish-gateway/templates/namespace.yaml b/charts/varnish-gateway/templates/namespace.yaml index 37d0e56c..16f7eff8 100644 --- a/charts/varnish-gateway/templates/namespace.yaml +++ b/charts/varnish-gateway/templates/namespace.yaml @@ -1,10 +1,13 @@ +{{- if .Values.createNamespace }} apiVersion: v1 kind: Namespace metadata: name: {{ include "varnish-gateway.namespace" . }} labels: {{- include "varnish-gateway.labels" . | nindent 4 }} - {{- with .Values.commonAnnotations }} annotations: + helm.sh/resource-policy: keep + {{- with .Values.commonAnnotations }} {{- toYaml . | nindent 4 }} - {{- end }} + {{- end }} +{{- end }} diff --git a/charts/varnish-gateway/values.yaml b/charts/varnish-gateway/values.yaml index 331897fc..5fdfa6d3 100644 --- a/charts/varnish-gateway/values.yaml +++ b/charts/varnish-gateway/values.yaml @@ -5,6 +5,10 @@ # Namespace where the operator will be installed namespace: varnish-gateway-system +# Set true for flows where nothing else creates the namespace +# example: helm template | kubectl apply +createNamespace: false + # Operator configuration operator: # Number of operator replicas From efd8af3c43538c26f66bb73e6d08323206bdea6a Mon Sep 17 00:00:00 2001 From: Fredrik Steen Date: Wed, 26 Aug 2026 16:47:39 +0200 Subject: [PATCH 2/2] test(chart): add createNamespace fixture and schema - Add test fixture exercising namespace creation - Update values.schema.json with createNamespace --- .../test/fixtures/values-create-namespace.yaml | 7 +++++++ charts/varnish-gateway/values.schema.json | 1 + 2 files changed, 8 insertions(+) create mode 100644 charts/varnish-gateway/test/fixtures/values-create-namespace.yaml diff --git a/charts/varnish-gateway/test/fixtures/values-create-namespace.yaml b/charts/varnish-gateway/test/fixtures/values-create-namespace.yaml new file mode 100644 index 00000000..91b11057 --- /dev/null +++ b/charts/varnish-gateway/test/fixtures/values-create-namespace.yaml @@ -0,0 +1,7 @@ +# Exercises the opt-in chart-managed Namespace (createNamespace=true), +# which is gated off by default so `helm install --create-namespace` and +# pre-existing namespaces don't conflict with a templated Namespace. +createNamespace: true +namespace: custom-gateway-ns +commonAnnotations: + team: platform diff --git a/charts/varnish-gateway/values.schema.json b/charts/varnish-gateway/values.schema.json index eb75afca..0ac9142a 100644 --- a/charts/varnish-gateway/values.schema.json +++ b/charts/varnish-gateway/values.schema.json @@ -5,6 +5,7 @@ "additionalProperties": true, "properties": { "namespace": { "type": "string", "minLength": 1 }, + "createNamespace": { "type": "boolean" }, "operator": { "type": "object", "additionalProperties": true,