How to narrow down rbac/installation to one namespace only?

[pragmaticivan]

Hi there. How do you usually handle the installation of flux2 in only one namespace. The current set of permissions is pretty broad and Is very likely I will not be able to leverage ClusterRoleBinding.

[stefanprodan]

Generate the manifests with flux install --watch-all-namespaces=false > gotk-components.yaml, then replace the ClusterRoles and ClusterRoleBindings with Roles and RoleBindings. Note that Flux without a cluster role is little to no use, as it's meant to reconcile your whole cluster state from Git as in namespaces, CRDs, etc.

[pragmaticivan]

For my scenario that's expected. I'm dealing with environments in different clusters/namespaces where access is limited. I only need it to reconcile resources for only one namespace.

Still getting familiar but you mean without ClusterRoleBindings I would not be able to install CRDs in a namespace?

[stefanprodan]

CRDs are not namespaced objects but global like ClusterRoles and ClusterRoleBindings.

[stefanprodan]

To limits access to a single namespace per team/app see https://github.com/fluxcd/flux2-multi-tenancy