From ddc429c8672ccc3ce6c6bced7feeb3bfbf9207ff Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Tue, 28 Apr 2026 13:47:02 +0500
Subject: [PATCH] test(e2e): pre-apply cozy-system namespace before helm
 install

The chart fix (3a87485c, be0a6687) removes the chart-defined Namespace
without replacing it. On the Talos E2E cluster the apiserver enforces
PodSecurity baseline-by-default on bare namespaces, so the cozystack-
operator pod (hostNetwork=true) is rejected if cozy-system is created
without enforce=privileged.

Apply the namespace from the bats with the labels the operator depends
on, then run helm install without --create-namespace. Mirrors the
documented production install procedure for the new chart shape.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 hack/e2e-install-cozystack.bats | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index ebc4a5b4..1593c437 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -8,13 +8,30 @@
 }
 
 @test "Install Cozystack" {
+  # Pre-create the cozy-system namespace with the labels the operator pod needs.
+  # The chart no longer ships a Namespace resource (helm v3's --create-namespace
+  # collides with chart-defined Namespace). On Talos clusters that enforce PSA
+  # baseline-by-default, the cozystack-operator pod (hostNetwork=true) is
+  # rejected unless the namespace is labelled enforce=privileged BEFORE the
+  # pod is scheduled. A pre-install hook can't bootstrap that label because
+  # the hook itself runs in the same namespace and faces the same PSA gate.
+  # So apply the namespace from the caller (this bats / production install docs)
+  # — same pattern as kube-prometheus-stack, argo-cd, cert-manager.
+  kubectl apply -f - <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cozy-system
+  labels:
+    cozystack.io/system: "true"
+    cozystack.io/deletion-protected: "true"
+    pod-security.kubernetes.io/enforce: privileged
+EOF
+
   # Install cozy-installer chart (operator installs CRDs on startup via --install-crds).
-  # The chart's pre-install hook patches PSA + cozystack labels onto cozy-system
-  # after --create-namespace bootstraps it.
   helm upgrade installer packages/core/installer \
     --install \
     --namespace cozy-system \
-    --create-namespace \
     --set cozystackOperator.helmReleaseInterval=30s \
     --wait \
     --timeout 2m