From 824671bbf099a4d9fc24734320d6d89b3a73a230 Mon Sep 17 00:00:00 2001
From: Brandon Squizzato <bsquizza@redhat.com>
Date: Tue, 25 Aug 2026 21:37:11 -0400
Subject: [PATCH 1/2] feat(helm): scope ClusterRole/ClusterRoleBinding names by
 release namespace

The chart creates cluster-scoped ClusterRole and ClusterRoleBinding
resources with a fixed name derived from the release name. When
multiple Helm releases coexist on the same cluster (multi-tenant),
only one release can own these resources due to Helm ownership
annotations -- the second install fails with a conflict.

Append .Release.Namespace to the ClusterRole and ClusterRoleBinding
names so each release gets its own cluster-scoped resources. The
duplication is harmless (the rules are identical and small) and
eliminates multi-tenant conflicts entirely without requiring external
RBAC management.

Signed-off-by: Brandon Squizzato <bsquizza@redhat.com>
---
 deploy/helm/openshell/templates/clusterrole.yaml        | 2 +-
 deploy/helm/openshell/templates/clusterrolebinding.yaml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/helm/openshell/templates/clusterrole.yaml b/deploy/helm/openshell/templates/clusterrole.yaml
index eb1ed8e1d0..5d328a1261 100644
--- a/deploy/helm/openshell/templates/clusterrole.yaml
+++ b/deploy/helm/openshell/templates/clusterrole.yaml
@@ -5,7 +5,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
   labels:
     {{- include "openshell.labels" . | nindent 4 }}
 rules:
diff --git a/deploy/helm/openshell/templates/clusterrolebinding.yaml b/deploy/helm/openshell/templates/clusterrolebinding.yaml
index 685a73bf91..9b3b254586 100644
--- a/deploy/helm/openshell/templates/clusterrolebinding.yaml
+++ b/deploy/helm/openshell/templates/clusterrolebinding.yaml
@@ -4,13 +4,13 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
   labels:
     {{- include "openshell.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "openshell.serviceAccountName" . }}

From 4edb5cd27d350bf1a48d62b99afa0ca2f942803c Mon Sep 17 00:00:00 2001
From: Brandon Squizzato <bsquizza@redhat.com>
Date: Wed, 26 Aug 2026 17:11:06 -0400
Subject: [PATCH 2/2] test(helm): add regression tests for namespace-scoped
 ClusterRole names

Assert the generated ClusterRole name, ClusterRoleBinding name, and
roleRef all include the release namespace suffix so multi-namespace
installations cannot silently regress to conflicting fixed names.

Signed-off-by: Brandon Squizzato <bsquizza@redhat.com>
---
 .../openshell/tests/clusterrole_test.yaml     |  6 ++++
 .../tests/clusterrolebinding_test.yaml        | 31 +++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 deploy/helm/openshell/tests/clusterrolebinding_test.yaml

diff --git a/deploy/helm/openshell/tests/clusterrole_test.yaml b/deploy/helm/openshell/tests/clusterrole_test.yaml
index afecada9b6..8f16aef584 100644
--- a/deploy/helm/openshell/tests/clusterrole_test.yaml
+++ b/deploy/helm/openshell/tests/clusterrole_test.yaml
@@ -9,6 +9,12 @@ release:
   namespace: my-namespace
 
 tests:
+  - it: includes the release namespace in the ClusterRole name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: openshell-node-reader-my-namespace
+
   - it: grants managed namespace NetworkPolicy apply permissions
     set:
       server.drivers.kubernetes.workspaceMode: managed
diff --git a/deploy/helm/openshell/tests/clusterrolebinding_test.yaml b/deploy/helm/openshell/tests/clusterrolebinding_test.yaml
new file mode 100644
index 0000000000..5b9a83c04c
--- /dev/null
+++ b/deploy/helm/openshell/tests/clusterrolebinding_test.yaml
@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+suite: ClusterRoleBinding RBAC
+templates:
+  - templates/clusterrolebinding.yaml
+release:
+  name: openshell
+  namespace: my-namespace
+
+tests:
+  - it: includes the release namespace in the ClusterRoleBinding name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: openshell-node-reader-my-namespace
+
+  - it: references the namespace-scoped ClusterRole in roleRef
+    asserts:
+      - equal:
+          path: roleRef.name
+          value: openshell-node-reader-my-namespace
+
+  - it: binds the service account in the release namespace
+    asserts:
+      - contains:
+          path: subjects
+          content:
+            kind: ServiceAccount
+            name: openshell
+            namespace: my-namespace