From 1eb31bcaa2103554773335b0f377fe1a005119ec Mon Sep 17 00:00:00 2001
From: Adam Weingarten <6517820+aweingarten@users.noreply.github.com>
Date: Tue, 28 Jul 2026 10:10:19 -0400
Subject: [PATCH 1/2] feat(chart): allow the platform namespaces to be created
 out-of-band

The chart renders apl-operator, otomi and apl-secrets from a bare
00-namespace.yaml. When one of them already exists, helm refuses the
install outright:

    Error: rendered manifests contain a resource that already exists.
    Unable to continue with install: Namespace "..." exists and cannot
    be imported into the current release: invalid ownership metadata

This is common: bootstrap tooling frequently has to create a namespace
before the operator installs, to land CRDs, StorageClasses or
NetworkPolicies first. Today the only way through is to manage the
collision downstream.

Add `installation.createNamespaces` (default true, so existing installs
are unchanged) to skip rendering the namespaces when an integrator
creates them out-of-band.

Note this is deliberately not "add helm ownership metadata to the
manifest": helm validates ownership against the *live* object, so
annotating the template cannot make an already-existing namespace
adoptable. Gating creation is what actually unblocks the integrator.

Refs #3418
---
 chart/apl/templates/00-namespace.yaml | 2 ++
 chart/apl/values.yaml                 | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/chart/apl/templates/00-namespace.yaml b/chart/apl/templates/00-namespace.yaml
index cd7b86836a..f5d8fdbf4f 100644
--- a/chart/apl/templates/00-namespace.yaml
+++ b/chart/apl/templates/00-namespace.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.installation.createNamespaces }}
 apiVersion: v1
 kind: Namespace
 metadata:
@@ -21,3 +22,4 @@ metadata:
   labels:
     kubernetes.io/metadata.name: apl-secrets
     name: apl-secrets
+{{- end }}
diff --git a/chart/apl/values.yaml b/chart/apl/values.yaml
index 25932348b6..4bf06a478c 100644
--- a/chart/apl/values.yaml
+++ b/chart/apl/values.yaml
@@ -136,3 +136,12 @@ installation:
   mode: standard
   # Skip deployment of the operator
   skipOperatorDeployment: false
+  ## Create the namespaces the platform needs (apl-operator, otomi, apl-secrets).
+  ## Set to false when they are created out-of-band — bootstrap tooling often has to create them
+  ## first to land CRDs, StorageClasses or NetworkPolicies ahead of the operator, and helm refuses
+  ## to adopt a namespace it does not already own ("invalid ownership metadata").
+  ## When disabling this, create the namespaces with the labels this chart would have set:
+  ##   kubernetes.io/metadata.name: <name>
+  ##   name: <name>
+  ## The platform's NetworkPolicies select namespaces by the `name` label.
+  createNamespaces: true

From f6078a63cdb657ab3ad2ebd93ce4b2a991c78b98 Mon Sep 17 00:00:00 2001
From: Adam Weingarten <6517820+aweingarten@users.noreply.github.com>
Date: Fri, 7 Aug 2026 08:04:30 -0400
Subject: [PATCH 2/2] docs(chart): cut the createNamespaces comment down to
 what matters

---
 chart/apl/values.yaml | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/chart/apl/values.yaml b/chart/apl/values.yaml
index 4bf06a478c..b831d6b132 100644
--- a/chart/apl/values.yaml
+++ b/chart/apl/values.yaml
@@ -136,12 +136,7 @@ installation:
   mode: standard
   # Skip deployment of the operator
   skipOperatorDeployment: false
-  ## Create the namespaces the platform needs (apl-operator, otomi, apl-secrets).
-  ## Set to false when they are created out-of-band — bootstrap tooling often has to create them
-  ## first to land CRDs, StorageClasses or NetworkPolicies ahead of the operator, and helm refuses
-  ## to adopt a namespace it does not already own ("invalid ownership metadata").
-  ## When disabling this, create the namespaces with the labels this chart would have set:
-  ##   kubernetes.io/metadata.name: <name>
-  ##   name: <name>
-  ## The platform's NetworkPolicies select namespaces by the `name` label.
+  ## Create namespaces (apl-operator, otomi, apl-secrets). Disable if creating them yourself.
+  ## Label them `kubernetes.io/metadata.name: <name>` and `name: <name>` — NetworkPolicies match on `name`.
+  ## Set this at install time; flipping it to false later makes helm delete the namespaces.
   createNamespaces: true