feat(helm): allow Release.Namespace global var in watchNamespaces

dist/chart/templates/manager/manager.yaml

@@ -109,9 +109,13 @@ spec:
           value: {{ .Values.controller.pdbManagement.enabled | quote }}
         - name: ENABLE_NETWORK_POLICY
           value: {{ .Values.controller.networkPolicyManagement.enabled | quote }}
-        {{- if not (empty .Values.controller.watchNamespaces) }}
+        {{- $watchNamespaces := list }}
+        {{- range .Values.controller.watchNamespaces }}
+        {{- $watchNamespaces = append $watchNamespaces (tpl . $) }}
+        {{- end }}
+        {{- with $watchNamespaces | uniq }}
         - name: WATCH_NAMESPACE
-          value: {{ join "," .Values.controller.watchNamespaces | quote }}
+          value: {{ join "," . | quote }}
         {{- end }}
         {{- range $k, $v := .Values.manager.envOverrides }}
         - name: {{ $k }}

dist/chart/values.yaml

@@ -20,7 +20,10 @@ global:
 ## Configure the controller manager settings
 ##
 controller:
-  ## List of namespaces to watch for resources.
+  ## List of namespaces to watch for resources. Empty watches all namespaces.
+  ## Entries are rendered with `tpl`, so they may reference the release, e.g.
+  ## the operator's own namespace next to static ones:
+  ##   watchNamespaces: ["{{ .Release.Namespace }}", "team-a"]
   ##
   watchNamespaces: [ ]
   ## Controls whether the operator creates and manages PodDisruptionBudgets

docs/install/helm.mdx

@@ -66,5 +66,34 @@ cd clickhouse-operator
 helm install clickhouse-operator ./dist/chart
 ```
 
+### Watch specific namespaces {#watch-namespaces}
+
+By default the operator watches all namespaces. Set `controller.watchNamespaces` to limit it.
+Entries are rendered as templates, so `{{ .Release.Namespace }}` resolves to the release namespace
+and can be combined with static namespaces:
+
+```yaml
+controller:
+  watchNamespaces:
+    - "{{ .Release.Namespace }}"
+    - team-a
+```
+
+On the command line, `--set` parses braces as list syntax, so use `--set-json` (Helm v3.10 or later):
+`--set-json 'controller.watchNamespaces=["{{ .Release.Namespace }}"]'`.
+
+To watch only the release namespace with namespace-scoped RBAC:
+
+```yaml
+controller:
+  watchNamespaces:
+    - "{{ .Release.Namespace }}"
+rbac:
+  namespaced: true
+```
+
+With `rbac.namespaced: true` the manager's permissions become a Role/RoleBinding in the release namespace,
+so watching other namespaces requires cluster-scoped RBAC (the default).
+
 ### Configuration options {#configuration-options}
 For advanced configuration options, refer to the [values.yaml](https://github.com/ClickHouse/clickhouse-operator/blob/main/dist/chart/values.yaml) file in the Helm chart

test/deploy/deploy_test.go

@@ -249,7 +249,9 @@ var _ = Describe("Helm deployment", Ordered, ContinueOnFailure, Label("helm"), f
 		namespace := "clickhouse-operator-" + name
 		BeforeAll(func(ctx context.Context) {
 			currentTestNamespace = namespace
-			values["watchNamespaces"] = []string{namespace}
+			values["controller"] = map[string]any{
+				"watchNamespaces": []string{"{{ .Release.Namespace }}"},
+			}
 			values["crd"] = map[string]any{
 				"enable": true,
 				"keep":   false,