feat(helm): scope ClusterRole/ClusterRoleBinding names by release namespace

deploy/helm/openshell/templates/clusterrole.yaml

@@ -5,7 +5,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
   labels:
     {{- include "openshell.labels" . | nindent 4 }}
 rules:

deploy/helm/openshell/templates/clusterrolebinding.yaml

@@ -4,13 +4,13 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
   labels:
     {{- include "openshell.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "openshell.fullname" . }}-node-reader
+  name: {{ include "openshell.fullname" . }}-node-reader-{{ .Release.Namespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "openshell.serviceAccountName" . }}

deploy/helm/openshell/tests/clusterrole_test.yaml

@@ -9,6 +9,12 @@ release:
   namespace: my-namespace
 
 tests:
+  - it: includes the release namespace in the ClusterRole name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: openshell-node-reader-my-namespace
+
   - it: grants managed namespace NetworkPolicy apply permissions
     set:
       server.drivers.kubernetes.workspaceMode: managed

deploy/helm/openshell/tests/clusterrolebinding_test.yaml

@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+suite: ClusterRoleBinding RBAC
+templates:
+  - templates/clusterrolebinding.yaml
+release:
+  name: openshell
+  namespace: my-namespace
+
+tests:
+  - it: includes the release namespace in the ClusterRoleBinding name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: openshell-node-reader-my-namespace
+
+  - it: references the namespace-scoped ClusterRole in roleRef
+    asserts:
+      - equal:
+          path: roleRef.name
+          value: openshell-node-reader-my-namespace
+
+  - it: binds the service account in the release namespace
+    asserts:
+      - contains:
+          path: subjects
+          content:
+            kind: ServiceAccount
+            name: openshell
+            namespace: my-namespace