Stéphane Tailland
023a89bf71
catalog-agent was one rename too aggressive: 'catalogue' is accepted, and the Keycloak client, its audience scope and the Vault key that names it were never renamed to match — leaving an inconsistency between what Kubernetes and Keycloak call the same agent. Keycloak carries more weight to move, so this side moves back. k8s/namespace.yaml is out of this Kustomization's inventory. It was in 2026-08-31 when renaming the Kustomization pruned the old one — which owned the namespace three agents share — and took all three down. A namespace shared across repos should not be owned by any one of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
18 lines
922 B
YAML
18 lines
922 B
YAML
# The `agents` namespace is shared by three agents from three repos.
|
|
# Applied once, by hand, and deliberately NOT in this repo's Kustomization
|
|
# inventory: a namespace owned by one repo's self-managing Kustomization gets
|
|
# deleted — and every other agent in it with it — the moment that repo renames
|
|
# its Kustomization or GitRepository, which prunes the old one. Learned the hard
|
|
# way on 2026-08-31.
|
|
#
|
|
# kubectl apply -f k8s/namespace.yaml # once, before anything else
|
|
# One namespace for the whole agent estate rather than one per agent. The agents
|
|
# share nothing but a trust boundary — no data, no storage, no service mesh
|
|
# policy — and splitting them would multiply the CA ConfigMap and the
|
|
# ExternalSecret without isolating anything that matters. What isolates them is
|
|
# their Keycloak client and the audiences it may request, not the namespace.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: agents
|