Stéphane Tailland
9eebd5f190
Dropping it from resources: was the same accident by a different door — Flux prunes anything that disappears from a Kustomization's rendered inventory, so the live Kustomization's next reconcile would have deleted the namespace itself. Caught before it fired by suspending that Kustomization. kustomize.toolkit.fluxcd.io/prune: disabled on the object is the documented way to keep Flux creating/updating a resource while never deleting it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
30 lines
1.5 KiB
YAML
30 lines
1.5 KiB
YAML
# The `agents` namespace is shared by three agents from three repos. Kept in
|
|
# this Kustomization's inventory — Flux must be able to *create* it on a first
|
|
# apply — but marked so Flux will never *prune* it.
|
|
#
|
|
# Without the annotation below, deleting or renaming this repo's Kustomization
|
|
# (which is exactly what a rename like catalog-agent -> catalogue-agent does —
|
|
# the old Kustomization object goes away) prunes everything in that
|
|
# Kustomization's inventory, the Namespace included, taking every other agent
|
|
# in it down too. Learned the hard way on 2026-08-31: removing the resource
|
|
# from `resources:` looked like the fix and is actually the same accident by a
|
|
# different door — the next reconcile of the *live* Kustomization sees the
|
|
# object vanish from its rendered inventory and prunes it right then.
|
|
#
|
|
# kustomize.toolkit.fluxcd.io/prune: disabled is the documented way to opt one
|
|
# resource out of pruning while Flux keeps managing (creating/updating) it.
|
|
#
|
|
# kubectl apply -f k8s/namespace.yaml # once, before anything else
|
|
#
|
|
# One namespace for the whole agent estate rather than one per agent. The agents
|
|
# share nothing but a trust boundary — no data, no storage, no service mesh
|
|
# policy — and splitting them would multiply the CA ConfigMap and the
|
|
# ExternalSecret without isolating anything that matters. What isolates them is
|
|
# their Keycloak client and the audiences it may request, not the namespace.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: agents
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/prune: disabled
|