Merge pull request #2885 from Infisical/misc/consolidated-missing-helm-conditions-for-namespace-installation

misc: added missing helm configs for namespace installation

docs/integrations/platforms/kubernetes.mdx

@@ -43,13 +43,28 @@ The operator can be install via [Helm](https://helm.sh) or [kubectl](https://git
 
     **Namespace-scoped Installation**
 
-    The operator can be configured to watch and manage secrets in a specific namespace instead of having cluster-wide access.
+    The operator can be configured to watch and manage secrets in a specific namespace instead of having cluster-wide access. This is useful for:
+
+    - **Enhanced Security**: Limit the operator's permissions to only specific namespaces instead of cluster-wide access
+    - **Multi-tenant Clusters**: Run separate operator instances for different teams or applications
+    - **Resource Isolation**: Ensure operators in different namespaces don't interfere with each other
+    - **Development & Testing**: Run development and production operators side by side in isolated namespaces
+
+    **Note**: For multiple namespace-scoped installations, only the first installation should install CRDs. Subsequent installations should set `installCRDs: false` to avoid conflicts.
 
     ```bash
-    helm install operator infisical-helm-charts/secrets-operator \
-      --namespace your-namespace \
-      --set scopedNamespace=your-namespace \
+    # First namespace installation (with CRDs)
+    helm install operator-namespace1 infisical-helm-charts/secrets-operator \
+      --namespace first-namespace \
+      --set scopedNamespace=first-namespace \
       --set scopedRBAC=true
+
+    # Subsequent namespace installations
+    helm install operator-namespace2 infisical-helm-charts/secrets-operator \
+      --namespace another-namespace \
+      --set scopedNamespace=another-namespace \
+      --set scopedRBAC=true \
+      --set installCRDs=false
     ```
 
     When scoped to a namespace, the operator will:
@@ -61,14 +76,19 @@ The operator can be install via [Helm](https://helm.sh) or [kubectl](https://git
     The default configuration gives cluster-wide access:
 
     ```yaml
+    installCRDs: true # Install CRDs (set to false for additional namespace installations)
     scopedNamespace: "" # Empty for cluster-wide access
     scopedRBAC: false # Cluster-wide permissions
     ```
 
+    If you want to install operators in multiple namespaces simultaneously:
+    - Make sure to set `installCRDs: false` for all but one of the installations to avoid conflicts, as CRDs are cluster-wide resources.
+    - Use unique release names for each installation (e.g., operator-namespace1, operator-namespace2).
+
    </Tab>
-	 <Tab title="Kubectl">
-   For production deployments, it is highly recommended to set the version of the Kubernetes operator manually instead of pointing to the latest version.
-   Doing so will help you avoid accidental updates to the newest release which may introduce unintended breaking changes. View all application versions [here](https://hub.docker.com/r/infisical/kubernetes-operator/tags).
+  <Tab title="Kubectl">
+  For production deployments, it is highly recommended to set the version of the Kubernetes operator manually instead of pointing to the latest version.
+  Doing so will help you avoid accidental updates to the newest release which may introduce unintended breaking changes. View all application versions [here](https://hub.docker.com/r/infisical/kubernetes-operator/tags).
 
 The command below will install the most recent version of the Kubernetes operator.
 However, to set the version manually, download the manifest and set the image tag version of `infisical/kubernetes-operator` according to your desired version.
@@ -714,6 +734,7 @@ Define secret keys and their corresponding templates.
 Each data value uses a Golang template with access to all secrets retrieved from the specified scope.
 
 Secrets are structured as follows:
+
 ```golang
 type TemplateSecret struct {
     Value      string `json:"value"`
@@ -722,6 +743,7 @@ type TemplateSecret struct {
 ```
 
 #### Example template configuration:
+
 ```golang
   managedSecretReference:
     secretName: managed-secret
@@ -733,19 +755,23 @@ type TemplateSecret struct {
 ```
 
 When you run the following command:
+
 ```bash
 kubectl get secret managed-secret -o jsonpath='{.data}'
 ```
 
 You'll receive Kubernetes secrets output that includes the NEW_KEY:
+
 ```bash
 {... "KEY":"d29ybGQ=","NEW_KEY":"LyBoZWxsbw=="}
 ```
 
 When you set `includeAllSecrets` as `false` the Kubernetes secrets outputs will be:
+
 ```bash
 {"NEW_KEY":"LyBoZWxsbw=="}
 ```
+
 </Accordion>
 <Accordion title="managedSecretReference.creationPolicy">
 Creation polices allow you to control whether or not owner references should be added to the managed Kubernetes secret that is generated by the Infisical operator.