From 865a6b3d02f9d4759b069ab4fbd26e5294f5a651 Mon Sep 17 00:00:00 2001 From: stephan48 Date: Thu, 20 Apr 2023 20:23:36 +0200 Subject: [PATCH] --- ...-20-fluxcd2-kustomization-delegation-caveats.mdwn | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 posts/2023-04-20-fluxcd2-kustomization-delegation-caveats.mdwn diff --git a/posts/2023-04-20-fluxcd2-kustomization-delegation-caveats.mdwn b/posts/2023-04-20-fluxcd2-kustomization-delegation-caveats.mdwn new file mode 100644 index 0000000..3bb6d24 --- /dev/null +++ b/posts/2023-04-20-fluxcd2-kustomization-delegation-caveats.mdwn @@ -0,0 +1,12 @@ +Hi, + +when you use fluxcd2 to allow teams/apps to be seperated into namesapces and wanna use PLOP/limit to the target namespace, be carefull with the following: + +- Errors around secrets are masked as "error: data values must be of type string" as per (this discussion)[https://github.com/fluxcd/flux2/discussions/2355] - disable/remove them for testing, otherwhise you can't debug, this is a gross UX issue. +- You apply the kustomization(kustomize.toolkit.fluxcd.io/v1beta1) referencing the remote repo/stuff the following mess of namespaces apply: + - the resource itself goes into namespace A + - targetNamespace - should place stuff into namespace B + - telling it to use a "serviceAccountName" -> needs to exist in namespace A but needs to have permission in namespace B + - use decryption -> secretRef for that needs to be in namespace A + +More to be followed :) -- 2.30.2