<p>I am trying to setup Kuberentes for my company.  In that process I am trying to learn Helm.</p>
<p>One of the tasks I have is to setup automation to take a supplied namespace <em>name</em> parameter, and create a namespace and setup the correct permissions in that namespace for the deployment user account.</p>
<p>I can do this simply with a script that uses <code>kubectl apply</code> like this:</p>
<pre><code>kubectl create namespace $namespaceName
kubectl create rolebinding deployer-edit --clusterrole edit --user deployer --namespace $namespaceName
</code></pre>
<p>But I am wondering if I should set up things like this using Helm charts.  As I look at Helm charts, it seems that everything is a deployment.  I am not sure that this fits the model of &quot;deploying&quot; things.  It is more just a general setup of a namespace that will then allow deployments into it.  But I want to try it out as a Helm chart if it is possible.</p>
<p>How can I create a Kubernetes namespace and rolebinding using Helm?</p>

Vaccano
<p>Almost <a href="https://github.com/nginxinc/kubernetes-ingress/blob/v1.10.0/deployments/helm-chart/templates/rbac.yaml#L2" rel="nofollow noreferrer">any chart</a> for an install that needs to interact with kubernetes itself will include RBAC resources, so it is for sure not just Deployments</p>
<pre class="lang-yaml prettyprint-override"><code># templates/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: {{ .Release.Namespace }}
  name: {{ .Values.bindingName }}
roleRef:
  apiGroup: &quot;&quot;
  kind: ClusterRole
  name: {{ .Values.clusterRole }}
subjects:
- apiGroup: &quot;&quot;
  kind: User
  name: {{ .Values.user }}
</code></pre>
<p>then a <code>values.yaml</code> isn't strictly required, but helps folks know what values could be provided:</p>
<pre class="lang-yaml prettyprint-override"><code># values.yaml
bindingName: deployment-edit
clusterRole: edit
user: deployer
</code></pre>
<p>Helm v3 <a href="https://helm.sh/docs/helm/helm_install/#options" rel="nofollow noreferrer">has <code>--create-namespace</code></a> which will create the provided <code>--namespace</code> if it doesn't already exist, which isn't very declarative but does achieve the end result just like the <code>kubectl</code> version</p>
<p>It's also theoretically possible to have the chart create the <code>Namespace</code> but I would not guess that <code>helm remove the-namespaced-rolebinding</code> will do the right thing, since the order of item removal matters a lot:</p>
<pre class="lang-yaml prettyprint-override"><code># templates/00namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .Values.theNamespace }}
</code></pre>
<p>and then run <code>helm --namespace kube-system ...</code> or any NS other than the real one, since it doesn't yet exist</p>
