Fix: gke-deploy now applies namespace updates (labels, annotations)

[64johnlee]

Summary

gke-deploy had a bug where it would only apply Namespace objects if they didn't exist in the cluster. After initial creation, any updates to namespace labels, annotations, or other metadata were silently ignored. This broke GitOps workflows where namespace metadata evolves over time.

Root Cause

The kubectl apply call for namespaces was inside an if !exists conditional block (lines 409-418 in deployer.go). This meant:

1. If namespace doesn't exist → apply it (create)
2. If namespace already exists → skip apply (no updates)
3. Subsequent changes to labels/annotations are never reflected

Solution

Unindent the kubectl apply call outside the if !exists block, so namespace manifests are always applied. This allows kubectl apply's idempotent behavior and strategic merge patching to:

• Create missing namespaces (warning still shown)
• Update labels/annotations on existing namespaces
• Preserve other namespace fields (quotas, network policies, etc.)

Changes

• gke-deploy/deployer/deployer.go — unindent lines 411-417 outside the if !exists block
• No new code, no behavior changes except now applying all namespace manifests

Example

Before (broken):

# First deploy: creates namespace
apiVersion: v1
kind: Namespace
metadata:
  name: prod
  labels:
    environment: production

# Update manifest to add more labels
apiVersion: v1
kind: Namespace
metadata:
  name: prod
  labels:
    environment: production
    team: platform  # <-- This update was silently ignored

After (fixed):

All namespace metadata updates are now applied via kubectl apply's strategic merge patching

Verification

• Fixes issue [BUG] gke-deploy does not update namespaces with new labels if the namespace already exists #873 (namespace label updates not applied)
• Related to but independent of PR gke-deploy: apply existing Namespace configs #1102
• Uses standard kubectl apply mechanisms (safe, idempotent)
• Backward compatible: namespace filtering and warnings preserved

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.