{{- /*
Auto-create the `sme` namespace on Sovereigns where the marketplace is
enabled.

Why: every other template under templates/sme-services/* (billing.yaml,
auth.yaml, ferretdb.yaml, valkey-cross-ns-secret.yaml, sme-secrets.yaml,
provisioning-github-token.yaml, ...) emits resources with
`namespace: sme`. On Catalyst-Zero (contabo) the `sme` namespace is
pre-provisioned by clusters/contabo-mkt/apps/sme/* — so the chart never
needed to create it. On a freshly franchised Sovereign nothing else
provisions the `sme` namespace, so without this template Helm install
fails 23 times with `failed to create resource: namespaces "sme" not
found` (live blocker on otech105 — 2026-05-05).

Kustomize-mode contabo build is unaffected: this template is
excluded from `templates/sme-services/kustomization.yaml`'s
`resources:` list (the contabo build manages the `sme` namespace
via clusters/contabo-mkt/apps/sme/namespace.yaml).

helm.sh/resource-policy: keep — never delete the namespace on a
chart uninstall (would cascade-delete every SME workload + tenant).

Issue #1943 (TBD-A51, 2026-05-19): the marketplace.enabled gate
removed here so `sme-secrets` (sibling template) has a namespace
to land in on every fresh prov. The SME microservice mesh
(billing.yaml, auth.yaml, gateway.yaml, ...) remains gated behind
`ingress.marketplace.enabled` (operator opt-in); only the
namespace + reflector-source Secret materialise unconditionally,
which is what catalyst-api's CATALYST_SME_JWT_SECRET secretKeyRef
mirror needs.
*/ -}}
apiVersion: v1
kind: Namespace
metadata:
  name: sme
  labels:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: catalyst-platform
    catalyst.openova.io/sovereign: {{ .Values.global.sovereignFQDN | quote }}
  annotations:
    helm.sh/resource-policy: keep
    catalyst.openova.io/created-by: bp-catalyst-platform
