<p>In my CI I'm running a <code>helm upgrade</code> command to release an app.
But if it is a non existing app, I have to create the namespace, a secret and patch the serviceaccount. So I come up with this:</p>
<pre><code>kubectl create namespace ${namespace} --dry-run=client -o yaml | kubectl apply -f -
kubectl create secret docker-registry gitlab-registry --namespace ${namespace} --docker-server=&quot;\${CI_REGISTRY}&quot; --docker-username=&quot;\${CI_DEPLOY_USER}&quot; --docker-password=&quot;\${CI_DEPLOY_PASSWORD}&quot; --docker-email=&quot;\${GITLAB_USER_EMAIL}&quot; -o yaml --dry-run=client | kubectl apply -f -
kubectl patch serviceaccount default -p '{&quot;imagePullSecrets&quot;:[{&quot;name&quot;:&quot;gitlab-registry&quot;}]}' --namespace ${namespace}
</code></pre>
<p>This is working, but I think it is not the perfect way as these three steps should only be done once.
: Only if app/namespace/secret is not existing</p>

user3142695
<p>Helm provides the <code>--create-namespace</code> switch that will create the namespace of the release if it does not already exist.</p>
<p>The secret can be added in your helm chart and you can pass the variables (<code>CI_REGISTRY</code>, <code>CI_DEPLOY_USER</code>, etc.) in as helm chart values either as <code>--set</code> values or via the <code>values.yaml</code> file and using <code>--values</code></p>
<p>The service account patching you can do as a post-install and/or a post-upgrade job (<a href="https://helm.sh/docs/topics/charts_hooks/" rel="nofollow noreferrer">https://helm.sh/docs/topics/charts_hooks/</a>)</p>
