Namespace transformer

[marpi82]

I would like to ask about a simple example with two files:

# roleBinding.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cert-manager:leaderelection
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager:leaderelection
subjects:
  - kind: ServiceAccount
    name: cert-manager
    namespace: default

# kustomization.yaml
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cert-manager
resources:
  - ./roleBinding.yaml

the result of kustomize build . (v5.3.0) is:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cert-manager:leaderelection
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager:leaderelection
subjects:
  - kind: ServiceAccount
    name: cert-manager
    namespace: cert-manager

and the result of reconciliation by FluxCD (v2.5.1) is:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cert-manager:leaderelection
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager:leaderelection
subjects:
  - kind: ServiceAccount
    name: cert-manager
    namespace: cert-manager

Why during reconciliation via FluxCD also non-default namespaces are changed if the default kustomize behavior is different?

[marpi82]

Is there any way to force the reconciliation result to be the same as via kustomize?

[marpi82]

Can I get an answer here?

[matheuscscp]

Flux 2.5.1 uses Kustomize 5.6: https://github.com/fluxcd/kustomize-controller/blob/v1.5.0/CHANGELOG.md#150

Can you please try kustomize build . with Kustomize 5.6?