Summary

Multiple opencode devspace deployments fail with a Helm ownership conflict on the shared opencode-build namespace, because every make devspace-deploy-existing-openshift run unconditionally tries to own the same Namespace, ImageStream, BuildConfig, and RoleBinding resources. This PR adds auto-detection to the Makefile so 2nd+ developers never hit the conflict, hardens the template against accidental deletion, and fixes a hardcoded personal namespace in the existing-OpenShift values file.

Related Issues / Tickets

N/A

Type of Change

• New feature
• Bug fix
• Refactor (no functional change)
• Configuration / infrastructure change
• Documentation only

Changes

• Makefile — Before the helm upgrade --install call in devspace-deploy-existing-openshift, detect whether opencode-build already exists on the cluster. If it does and TYPE=opencode, automatically inject --set opencodeBuild.enabled=false so the new release does not attempt to own the shared build infrastructure.
• charts/pca-devspaces/templates/opencode-image-build.yaml — Add helm.sh/resource-policy: keep to the opencode-build Namespace so that uninstalling the owning release does not delete the namespace and built image, which would break all other running OpenCode workspaces.
• deploy_existing_openshift/README.md — Add --set opencodeBuild.enabled=false to the Common HELM_ARGS table and a callout in the multi-developer section explaining the singleton build infrastructure and the Makefile auto-detection.
• deploy_existing_openshift/values-platform-config.yaml — Replace hardcoded personal namespace hacohen-ai-coder with the chart default ai-serving in pca-guardrails.namespace.

Quality Gates

• Pre-commit hooks pass (yamllint, yamlfmt, secret scan)
• Helm chart renders without errors (helm template)
• Deployed and verified on a live cluster
• No hardcoded credentials, namespaces, or usernames

Verification

Environment: api-ai-dev02.kni.syseng.devcluster.openshift.com, context hacohen-pca

Bug reproduced before fix:

helm upgrade --install test-fix-devspaces charts/pca-devspaces \
  -f deploy_existing_openshift/values-devspaces.yaml \
  --namespace test-fix-devspaces --create-namespace \
  --set 'devspaces[0].user=dev-user1'
# Error: Namespace "opencode-build" exists and cannot be imported: invalid ownership metadata

Fix verified:

# Deploy dev-user1 (2nd opencode devspace — opencode-build already owned by dev-user2)
make devspace-deploy-existing-openshift DEV_NAMESPACE=dev-user1-devspaces DEV_USER=dev-user1 \
  AI_NAMESPACE=hacohen-pca HELM_ARGS='--set devspacesGlobalConfig.enabled=false'
# Makefile auto-injects --set opencodeBuild.enabled=false → deploys successfully

# Deploy dev-user3 (3rd opencode devspace)
make devspace-deploy-existing-openshift DEV_NAMESPACE=dev-user3-devspaces DEV_USER=dev-user3 \
  AI_NAMESPACE=hacohen-pca HELM_ARGS='--set devspacesGlobalConfig.enabled=false'
# Also succeeds — opencode-build ownership unchanged (still dev-user2-devspaces-devspaces)

• Deployed on a RHOAI cluster — AI serving in hacohen-pca, 3 OpenCode devspaces (dev-user1/2/3) all deployed and working; OpenCode chat verified end-to-end
• No secrets, API keys, or credentials committed