projectcapsule / capsule-addon-fluxcd Goto Github PK

After #3 in order to add the namespace to the tenant it requires permission to deal with namespaces.

W0209 14:05:10.079210 1 reflector.go:535] pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:229: failed to list *v1.Namespace: namespaces is forbidden: User "system:serviceaccount:capsule-system:capsule-flux-addon-capsule-addon-fluxcd" cannot list resource "namespaces" in API group "" at the cluster scope: Azure does not have opinion for this user.

The clusterrole created for the addon need to add permissions to read and modify namespaces.

I see in the docs the previous GitHub user referenced, such as maxgio92.

Since the project has been moved to the Project Capsule organization, all references must be updated.

Background

With the actual setup, the initial namespace created for the tenant is not part of the tenant

---
apiVersion: v1
kind: Namespace
metadata:
  name: oil-system

Causing the tenant owners not being able to list this namespace and manage resources within that namespace. In the flux example, tenant owners wont be able to handle the kustomization/gitrepository which is the root of their workloads.

Proposal

Make the flux addon capable of modifying the owners reference of the namespace based in a label/annotation, ie: capsule.clastix.io/tenant: oil. Making this namespace part of the tenant so tenant owners can work with it.