{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
{{- $bundleName := index $cozyConfig.data "bundle-name" }}
{{- $bundle := tpl (.Files.Get (printf "bundles/%s.yaml" $bundleName)) . | fromYaml }}
{{- $namespaces := dict }}

{{/* collect namespaces from releases */}}
{{- range $x := $bundle.releases }}
{{- if not (hasKey $namespaces $x.namespace) }}
{{- $_ := set $namespaces $x.namespace false }}
{{- end }}
{{/* if at least one release requires a privileged namespace, then it should be privileged */}}
{{- if or $x.privileged (index $namespaces $x.namespace) }}
{{- $_ := set $namespaces $x.namespace true }}
{{- end }}
{{- end }}

{{/* Add extra namespaces */}}
{{- $_ := set $namespaces "cozy-public" false }}
{{- $_ := set $namespaces "cozy-fluxcd" false }}

{{- range $namespace, $privileged := $namespaces }}
---
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  {{- if $privileged }}
  labels:
    pod-security.kubernetes.io/enforce: privileged
  {{- end }}
  name: {{ $namespace }}
{{- end }}
