[SURE-5906] set labels on namespaces created via fleet as part of the helm install / create namespace part to support Pod Security Admission

[kkaempf]

SURE-5906

Request description:

When we install apps via fleet using the helm install way - this automatically creates the namespace for it. BUT it does not allow to set labels required for PSAs on the namespace created by fleet.

-> we must be able to add labels i.e. to set the PSA enforced to priviledged in case the PODs need that.

Actual behavior:

Not possible

Expected behavior:

Need to be able to specify the namespace labels as part of the helm install /  create namespace part as otherwise the PODs will not start if they need to have priviledged rights.

Workaround:

Is workararound available and implemented? no
What is the workaround: There is an idea to create the namespace "first" via a proper namespace yaml and then set dependencies between different bundles. But one of the problems here is the dependency management and the order - especially when having multiple fleet deployments going to the same target namespace.

[kkaempf]

See also

• Fleet namespace creation and integration with Rancher Projects #304
• [SURE-6997] Unable to add annotations to Kubernetes namespaces #1461
• annotations (especially with namespaces) #285
• Add ability to specify/target downstream Rancher "Projects" with Bundles #633

[WeAreHadock]

Hey, is there a way to disable the namespace creation when installing a helm chart using fleet ?
I'm trying the workaround described in this issue, a bundle creating the namespace and a bundle deploying my helm chart but there is a conflict as both bundles try to create the namespace.

[manno]

I believe this is fixed by #1553