fix(preview): the namespace outlived the PR

[nicacioliveira]

Found tearing down #6205 by removing its label.

The cascade worked for everything inside the namespace — pods, Services, HTTPRoute, ExternalSecret, ConfigMaps, and the Postgres and MinIO holding the data. attachedRoutes went back to 0 and the URL returned 404.

The namespace itself stayed:

$ kubectl get ns studio-pr-6205
studio-pr-6205   Active   5h6m

ownerReferences: (none)
argocd tracking: (none)

Why

CreateNamespace=true creates a namespace but does not adopt it. The object gets no tracking annotation and never joins the Application's resource tree, so a cascading delete cannot reach it. This is documented Argo behaviour, not a bug in the sync.

The effect is one empty namespace per pull request that ever had a preview, accumulating with nothing to clean them up. Cheap individually, unbounded over time — and three files already promised the opposite:

• deploy/preview/README.md: "its own namespace… all three are destroyed"
• apps/studio-preview/README.md in the CD repo: "the Application, its namespace, its database and its bucket all go away"
• the description of test: smoke-check the per-PR preview pipeline #6205 itself

Fix

The chart renders the Namespace at wave -40 — ahead of the ExternalSecret at -30, since everything else lives inside it. It is then owned like every other resource and deleted with them.

Second failure this removes

The namespace now carries the Gateway's selector label from the manifest. Route attachment previously depended on whoever creates the Application setting managedNamespaceMetadata correctly — which the troubleshooting guide names as the most likely cause of a silent 404 with a green Argo:

Almost always the namespace label. The Gateway's allowedRoutes.namespaces.from: Selector matches on namespace labels, and Argo's CreateNamespace=true does not label namespaces unless syncPolicy.managedNamespaceMetadata sets them.

The ApplicationSet still sets managedNamespaceMetadata as well, so the namespace is labelled on the very first sync, before the chart's own object is applied.

Assertion

helm-test.yml now checks that the preview render contains exactly one Namespace, at a wave earlier than -30, carrying a preview label. Verified against the pre-fix chart: it fails there and passes here.

Verification

• Default render outside preview: 0 lines of difference against main.
• helm lint clean.
• preview.manageNamespace defaults to true but is gated on preview.enabled, so nothing outside previews renders a Namespace.

Cleanup

studio-pr-6205 is still around from the run that found this. Safe to delete by hand; the README now documents that, and any future one goes with its PR.

Chart 0.14.2 → 0.14.3.

---

Summary by cubic

Make preview namespaces part of the chart so they are created and deleted with the preview. Previously CreateNamespace=true created an unmanaged namespace that outlived the PR; now the chart renders and owns it. The namespace also carries the Gateway selector label, removing reliance on managedNamespaceMetadata and preventing silent 404s.

• Adds a Namespace manifest rendered at sync wave -40 with preview labels; gated by preview.enabled and preview.manageNamespace (default true).
• ApplicationSet injects preview.namespaceLabels from the Gateway selector and still sets managedNamespaceMetadata for the first sync.
• CI asserts exactly one Namespace in the preview render, at wave < -30, with a preview label.
• No changes outside previews; chart version 0.14.3.
• Action: delete any existing orphan preview namespaces manually (older ones were not owned).

^{Written for commit aba4aa7. Summary will update on new commits.}