Use Helm hook to add labels to a namespace before chart installation

label-ns.yaml

# This hook depends on helm creating the target namespace if it doesn't exist
# before the hook is called. This is the case on Helm v2.9.1
apiVersion: batch/v1
kind: Job
metadata:
  name: label-ns
  namespace: kube-system
  labels:
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  annotations:
    helm.sh/hook: pre-install
    helm.sh/hook-delete-policy: hook-succeeded
spec:
  template:
    spec:
      containers:
      - name: labeler
        image: gcr.io/google_containers/hyperkube:v1.9.7
        command:
        - kubectl
        - label
        - ns
        - {{ .Release.Namespace }}
        - istio-injection=enabled
      restartPolicy: Never
      # use tiller service account since it should have permissions to do namespace labeling
      serviceAccountName: tiller

That tiller account doesn't exist in helm 3. I posted a complete example here: https://stackoverflow.com/a/76276158/115635