<p>I am trying to setup Kuberentes for my company.  In that process I am trying to learn Helm.</p>
<p>One of the tasks I have is to setup automation to take a supplied namespace <em>name</em> parameter, and create a namespace and setup the correct permissions in that namespace for the deployment user account.</p>
<p>I can do this simply with a script that uses <code>kubectl apply</code> like this:</p>
<pre><code>kubectl create namespace $namespaceName
kubectl create rolebinding deployer-edit --clusterrole edit --user deployer --namespace $namespaceName
</code></pre>
<p>But I am wondering if I should set up things like this using Helm charts.  As I look at Helm charts, it seems that everything is a deployment.  I am not sure that this fits the model of &quot;deploying&quot; things.  It is more just a general setup of a namespace that will then allow deployments into it.  But I want to try it out as a Helm chart if it is possible.</p>
<p>How can I create a Kubernetes namespace and rolebinding using Helm?</p>

Vaccano
<p>A Namespace is a Kubernetes object and it can be described in YAML, so Helm can create one.  <a href="https://stackoverflow.com/a/66288397/10008173">@mdaniel's answer</a> describes the syntax for doing it for a single Namespace and the corresponding RoleBinding.</p>
<p>There is a chicken-and-egg problem if you are trying to use this syntax to create the Helm installation namespace, though.  In Helm 3, metadata about the installation is stored in Kubernetes objects, usually in the same namespace you're installing into</p>
<pre class="lang-sh prettyprint-override"><code>helm install release-name ./a-chart-that-creates-a-namespace --namespace ns
</code></pre>
<p>If the namespace doesn't already exist, then Helm can't retrieve the installation metadata; or, if it does, then the declaration of the Namespace object in the chart will conflict with an existing object in the cluster.  You can create other objects this way (like RoleBindings) but Namespaces themselves are a problem.</p>
<p>But!  You can create <em>other</em> namespaces safely.  You can also use Helm's templating constructs to create multiple objects based on what's present in the <code>.Values</code> configuration.  So if your <code>values.yaml</code> file (possibly environment-specific) has</p>
<pre class="lang-yaml prettyprint-override"><code>namespaces: [service-a, service-b]
clusterRole: edit
user: deploy
</code></pre>
<p>Then you can write a template file like</p>
<pre class="lang-yaml prettyprint-override"><code>{{- $top := . }}
{{- range $namespace := .Values.namespaces -}}
---
apiVersion: v1
kind: Namespace
metadata:
  name: {{ $namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: {{ $namespace }}
  name: deployer-edit
roleRef:
  apiGroup: &quot;&quot;
  kind: ClusterRole
  name: {{ $top.Values.clusterRole }}
subjects:
- apiGroup: &quot;&quot;
  kind: User
  name: {{ $top.Values.user }}
{{ end -}}
</code></pre>
<p>This will create two YAML documents for each item in <code>.Values.namespaces</code>.  Since the <code>range</code> looping construct overwrites the <code>.</code> special variable, we save its value in a <code>$top</code> local variable before we start, and then use <code>$top.Values</code> where we'd otherwise need to reference <code>.Values</code>.  We also need to make sure to explicitly name the <code>metadata: { namespace: }</code> of each object we create, since we're not using the default installation namespace.</p>
<p>You need to make sure the <code>helm install --namespace</code> name isn't any of the namespaces you're managing with this chart.</p>
<p>This would let you have a single chart that manages all of the per-service namespaces.  If you needed to change the set of services, you can just update the chart values and <code>helm update</code>.  The one other caution is that this will happily delete namespaces with no warning if you remove a value from the <code>.Values.namespaces</code> list, and also take everything in that namespace with it (notably, any PersistentVolumeClaims that have data you might need).</p>
