fix(chart): gate namespace creation behind createNamespace value

CHANGELOG.md

@@ -16,6 +16,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Helm chart: the chart-templated Namespace no longer conflicts with
+  `helm install --create-namespace` or gets deleted on uninstall**
+  With Helm(4) server-side apply silently adopted the namespace and a
+  `helm uninstall` then deleted the namespace and everything in it.
+  The Namespace template is now gated behind a new `createNamespace`
+  value (default `false`), so the documented `--create-namespace`
+  flow works on both Helm major versions.
 - **Redirect port now derives from the Gateway listener, not the `Host`
   header.** A `RequestRedirect` filter with no `scheme` and no `port` was
   building the `Location` port from the client's `Host` header, so a request

charts/varnish-gateway/README.md

@@ -20,6 +20,21 @@ helm install varnish-gateway oci://ghcr.io/varnish/charts/varnish-gateway \
   --create-namespace
 ```
 
+### Namespace management
+
+If instead you want the chart to own the namespace (e.g. rendering with
+`helm template | kubectl apply`) set `createNamespace=true`
+
+```bash
+helm install varnish-gateway oci://ghcr.io/varnish/charts/varnish-gateway \
+  --version 0.x.y \
+  --set namespace=varnish-gateway-system \
+  --set createNamespace=true
+```
+
+The chart-created namespace carries `helm.sh/resource-policy: keep`, so
+uninstalling the release leaves the namespace (and anything in it) intact.
+
 ## Configuration
 
 The following table lists the configurable parameters of the Varnish Gateway chart and their default values.
@@ -84,6 +99,7 @@ Requires the prometheus-operator CRDs (`monitoring.coreos.com`) — e.g. from
 | Parameter | Description | Default |
 |-----------|-------------|---------|
 | `namespace` | Namespace for operator deployment | `varnish-gateway-system` |
+| `createNamespace` | Let the chart create the namespace itself | `false` |
 | `rbac.create` | Create RBAC resources | `true` |
 | `serviceAccount.create` | Create service account | `true` |
 | `commonLabels` | Extra labels added to all resources | `{}` |

charts/varnish-gateway/templates/namespace.yaml

@@ -1,10 +1,13 @@
+{{- if .Values.createNamespace }}
 apiVersion: v1
 kind: Namespace
 metadata:
   name: {{ include "varnish-gateway.namespace" . }}
   labels:
     {{- include "varnish-gateway.labels" . | nindent 4 }}
-  {{- with .Values.commonAnnotations }}
   annotations:
+    helm.sh/resource-policy: keep
+    {{- with .Values.commonAnnotations }}
     {{- toYaml . | nindent 4 }}
-  {{- end }}
+    {{- end }}
+{{- end }}

charts/varnish-gateway/test/fixtures/values-create-namespace.yaml

@@ -0,0 +1,7 @@
+# Exercises the opt-in chart-managed Namespace (createNamespace=true),
+# which is gated off by default so `helm install --create-namespace` and
+# pre-existing namespaces don't conflict with a templated Namespace.
+createNamespace: true
+namespace: custom-gateway-ns
+commonAnnotations:
+  team: platform

charts/varnish-gateway/values.schema.json

@@ -5,6 +5,7 @@
   "additionalProperties": true,
   "properties": {
     "namespace": { "type": "string", "minLength": 1 },
+    "createNamespace": { "type": "boolean" },
     "operator": {
       "type": "object",
       "additionalProperties": true,

charts/varnish-gateway/values.yaml

@@ -5,6 +5,10 @@
 # Namespace where the operator will be installed
 namespace: varnish-gateway-system
 
+# Set true for flows where nothing else creates the namespace
+# example: helm template | kubectl apply
+createNamespace: false
+
 # Operator configuration
 operator:
   # Number of operator replicas