[API server] Auto create skypilot-system ns on helm install (#5079)

* [API server] Auto create skypilot-system ns on helm install

Signed-off-by: Aylei <[email protected]>

* More comments

Signed-off-by: Aylei <[email protected]>

* Add comment

Signed-off-by: Aylei <[email protected]>

* Add comment

Signed-off-by: Aylei <[email protected]>

---------

Signed-off-by: Aylei <[email protected]>

Author: aylei

charts/skypilot/templates/rbac.yaml

@@ -34,6 +34,18 @@ roleRef:
 {{- end }}
 {{- $namespaces = append $namespaces .Release.Namespace | uniq }}
 {{- range $namespaces }}
+{{/* Create namespaces in advance to enable RBAC rules, filter out the release namespace in case user accidentally added it to grantedNamespaces*/}}
+{{- if and (ne . $.Release.Namespace) (not (lookup "v1" "Namespace" "" .)) }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ . }}
+  annotations:
+    {{/* Keep the namespace when uninstalling the chart, so that the deployed sky resources (if any) can still work even if the API server get uninstalled */}}
+    helm.sh/resource-policy: keep
+{{- end }}
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:

values.yaml

@@ -0,0 +1,24 @@
+USER-SUPPLIED VALUES: null
+apiService:
+  image: berkeleyskypilot/skypilot-api-test:20250313104114
+  resources:
+    limits:
+      cpu: 4000m
+      memory: 8Gi
+    requests:
+      cpu: 4000m
+      memory: 8Gi
+  skypilotDev: true
+awsCredentials:
+  enabled: true
+gcpCredentials:
+  enabled: true
+  projectId: sky-dev-465
+ingress:
+  authCredentials: skypilot:$apr1$zPI303sa$eOrIDmadoynRwR2ICZIrJ.
+  path: /aylei
+ingress-nginx:
+  enabled: false
+kubernetesCredentials:
+  useApiServerCluster: true
+  useKubeconfig: false