feat(chart): allow the platform namespaces to be created out-of-band

[aweingarten]

📌 Summary

Fixes #3418.

The chart renders apl-operator, otomi and apl-secrets from a bare 00-namespace.yaml. When any of them already exists, the install fails outright:

Error: rendered manifests contain a resource that already exists.
Unable to continue with install: Namespace "<ns>" ... exists and cannot be
imported into the current release: invalid ownership metadata; ... missing key
"app.kubernetes.io/managed-by"; missing key "meta.helm.sh/release-name" ...

That's a common position to be in: bootstrap tooling frequently has to create a namespace before the operator installs, to land CRDs, StorageClasses or NetworkPolicies first.

Adds installation.createNamespaces (default true, so nothing changes for existing installs). Set it to false and the chart leaves the namespaces alone.

🔍 Reviewer Notes

• This is deliberately not "add helm ownership metadata to the manifest", which is what the issue originally asked for. Helm validates ownership against the live object, so annotating the template can't make an already-existing namespace adoptable — it would only label namespaces the chart created itself, which were never the problem. Gating creation is what actually unblocks the integrator. Worth correcting in the issue too.
• The values comment spells out the labels an out-of-band creator has to set (kubernetes.io/metadata.name, name), because the platform's NetworkPolicies select namespaces by the name label — dropping it fails in a way that's hard to trace back here.
• Placed under installation. alongside skipOperatorDeployment, which is the same shape of knob. installation is additionalProperties: true in values-schema, so the new key validates; I confirmed helm lint passes against the generated values.schema.json both with the flag set and unset.
• Verified helm template renders 3 Namespaces by default and 0 with --set installation.createNamespaces=false.

🧹 Checklist

• Code is readable, maintainable, and robust.
• Unit tests added/updated — n/a, chart-template change; covered by helm lint/helm template in lint:apl-chart

[CasLubbers]

The flag is good, if you could only change the comment.

[CasLubbers]

This comment is way to verbose. This is more clear and concise:
## Create namespaces (apl-operator, otomi, apl-secrets). Disable if creating them yourself.

[Copilot]

Pull request overview

This PR makes the apl Helm chart tolerant of platform namespaces that are created out-of-band (e.g., by bootstrap tooling), by allowing chart-driven Namespace creation to be disabled so installs don’t fail on Helm ownership conflicts.

Changes:

• Adds installation.createNamespaces (default true) to control whether the chart renders the platform namespaces.
• Wraps the 00-namespace.yaml template in a conditional so it renders 0 Namespace objects when the flag is disabled.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
chart/apl/values.yaml	Documents and defaults the new installation.createNamespaces flag.
chart/apl/templates/00-namespace.yaml	Conditionally renders the 3 platform Namespace manifests based on the new flag.

Suppressed comments (1)

chart/apl/templates/00-namespace.yaml:26

• 00-namespace.yaml currently leaves a trailing whitespace-only line outside the if block (line 26). When installation.createNamespaces is false this template will still render whitespace, which is best avoided to prevent any chance of Helm treating it as an (invalid) manifest fragment.

{{- end }}

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

chart/apl/templates/00-namespace.yaml:5

• With the current top-level if, switching installation.createNamespaces from true (default) to false on an existing release will remove these Namespace objects from the rendered manifests. During helm upgrade, Helm will treat them as deleted resources and attempt to delete the Namespaces, which can cascade-delete everything in apl-operator, otomi, and apl-secrets. Consider keeping the Namespaces rendered when they are already owned by this release (so toggling the flag can’t accidentally trigger deletion).

{{- if .Values.installation.createNamespaces }}
apiVersion: v1
kind: Namespace
metadata:
  name: apl-operator