Use Helm hook to add labels to a namespace before chart installation

label-ns.yaml

# This hook depends on helm creating the target namespace if it doesn't exist
# before the hook is called. This is the case on Helm v2.9.1
apiVersion: batch/v1
kind: Job
metadata:
  name: label-ns
  namespace: kube-system
  labels:
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  annotations:
    helm.sh/hook: pre-install
    helm.sh/hook-delete-policy: hook-succeeded
spec:
  template:
    spec:
      containers:
      - name: labeler
        image: gcr.io/google_containers/hyperkube:v1.9.7
        command:
        - kubectl
        - label
        - ns
        - {{ .Release.Namespace }}
        - istio-injection=enabled
      restartPolicy: Never
      # use tiller service account since it should have permissions to do namespace labeling
      serviceAccountName: tiller

i can't believe we have to do this! that there is no way to mutate the namespace via helm.

Thank you for sharing this!

Great workaround, thanks.

if exist, how to handle in yaml?

That tiller account doesn't exist in helm 3. I posted a complete example here: https://stackoverflow.com/a/76276158/115635