OpenShell/deploy/helm/openshell/templates/credential-secrets-namespace.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

{{- $credentialSecrets := .Values.server.credentialDrivers.kubernetesSecrets -}}
{{- if and (eq (include "openshell.credentialDriverEnabled" (list . "kubernetes-secrets")) "true") $credentialSecrets.createNamespace }}
{{- $namespace := include "openshell.credentialKubernetesSecretsNamespace" . -}}
{{- if eq $namespace .Release.Namespace -}}
{{- fail "server.credentialDrivers.kubernetesSecrets.createNamespace requires server.credentialDrivers.kubernetesSecrets.namespace to name a namespace other than the release namespace" -}}
{{- end -}}
{{- $existing := lookup "v1" "Namespace" "" $namespace -}}
{{- $releaseName := dig "metadata" "annotations" "meta.helm.sh/release-name" "" $existing -}}
{{- $releaseNamespace := dig "metadata" "annotations" "meta.helm.sh/release-namespace" "" $existing -}}
{{- if or (not $existing) (and (eq $releaseName .Release.Name) (eq $releaseNamespace .Release.Namespace)) }}
# Retained on uninstall so removing the gateway cannot delete stored
# credentials. A retained Namespace keeps its Helm ownership annotations, so a
# reinstall of the same release adopts it; a Namespace owned by anything else
# is left alone.
apiVersion: v1
kind: Namespace
metadata:
  name: {{ $namespace }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
  annotations:
    helm.sh/resource-policy: keep
{{- end }}
{{- end }}