Deploying Flux resources outside of flux-system

[mattw59]

I've noticed what seems to be a subtle design decision within the Flux CLI that I was curious about. It seems like the expected default is for all Flux-managed resources to be deployed to the flux-system namespace. If I run flux get or really any other command, the command is run in flux-system, regardless of my current context per kubectl.

My question is this: is there a reason why it might be preferable to keep all resources within the flux-system namespace? I'm building out a multi-tenant cluster with reasonably strong RBAC around namespaces, and I'm trying to find the correct balance between self-service and sensible constraints. I don't think I want Flux resources scattered about, but I'm wondering if there's a reason why it might help to be strict about this.

As an added wrinkle, we're trying to use namespaces as the means of separating environments for a given app, so we're going to see production, non-production, and even experimental deployments on the same cluster (though isolated from one another at a node level).

[stefanprodan]

We're defaulting to flux-system to avoid people putting all things into default ns. You should be creating Flux resources in other namespaces, you can't do multi-tenancy with Flux either wise. Only the root Flux GitRepository and Flux Kustomization must be in flux-system. Please see the example repos for more details:

• https://github.com/fluxcd/flux2-kustomize-helm-example
• https://github.com/fluxcd/flux2-multi-tenancy

[mattw59]

Thank you! I appreciate the context. Our multi-tenancy is on the softer side for now with a number of smaller teams who are all part of the same unit. We might be expanding that to other teams in the future, so I'll definitely want to be more familiar with the example repos.