Last modified July 2, 2026

Configure an app's target namespace via its App CR

Deprecated: This feature (spec.namespaceConfig) is specific to the Giant Swarm App custom resource, which is being phased out in favor of Flux HelmRelease. HelmRelease has no direct equivalent for managing target-namespace metadata. For new deployments, choose one of these alternatives: set the labels and annotations from inside the Helm chart’s templates, apply a post-renderer Kustomize patch on the HelmRelease, or use a separate policy tool such as Kyverno. See App management for the conceptual overview.

When installation apps through the app platform, you might want to add specific labels or annotations to an app’s target namespace (for example to allow loki to scrape logs from a specific namespace).

The App custom resource allows you to configure the target namespace via the spec.

Configuring labels and annotations

You can use .spec.namespaceConfig to configure the namespace metadata. When setting .spec.namespaceConfig.annotations or spec.namespaceConfig.labels you provide the values as a key/value map. Later the app platform will ensure the namespace is updated with the provided metadata.

For example, to enable logs in your namespace you set the annotation ownership.my-org.com/responsible: my-team in the App custom resource.

apiVersion: application.giantswarm.io/v1alpha1
kind: App
metadata:
  name: loki-app
  namespace: loki0
spec:
  catalog: giantswarm
  name: loki
  namespace: loki
  namespaceConfig:
    annotations:
      ownership.my-org.com/responsible: my-team

Now you can check the namespace and it will be the same as below.

apiVersion: v1
kind: Namespace
metadata:
  annotations:
    ownership.my-org.com/responsible: my-team
  name: loki

If you want to set labels on the namespace, use spec.namespaceConfig.labels.

apiVersion: application.giantswarm.io/v1alpha1
kind: App
metadata:
  name: kiam-app
  namespace: kiam0
spec:
  catalog: giantswarm
  name: kiam
  namespace: kiam
  namespaceConfig:
    labels:
      monitoring: "enabled"

Validation

The validation logic in app admission controller checks whether multiple App resources are updating the same namespace with different values. The validation webhook will prevent the conflicting value from being added.