Flux service accounts on multi-tenant clusters #5256
-
|
Hi @stefanprodan, I'm working on multi-cluster, multi-platform (bare metal, EKS, ...) flux repositories organisation and using your ControlPlane "D1" architecture for reference and have a question. I see that each component (e.g. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
You can't reference service accounts from other namespaces, so it's a must to have a SA in each namespace where a cluster-addon is deployed, otherwise helm-controller will error out. |
Beta Was this translation helpful? Give feedback.
-
|
Ah, I'm just starting to look into multitenancy. I assume having these separate SAs only makes sense when flux is configured for multitenancy in line with the docs - with default SA being |
Beta Was this translation helpful? Give feedback.
-
|
Yes the dedicated SA per namespace is a multitenancy requirement, once enabled, you need to set the SA in each Flux Kustomization and HelmRelease. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much! |
Beta Was this translation helpful? Give feedback.
You can't reference service accounts from other namespaces, so it's a must to have a SA in each namespace where a cluster-addon is deployed, otherwise helm-controller will error out.