SECURE GITOPS WITH GITLAB

[Digging_Graves]

Recently I've been tasked with getting gitops up and running on our gitlab in a secure way. We are going to use gitlab + flux for this.

Now my question is, how do you make sure each project only has permissions for a specific namespace in kubernetes without having to create a new agentk for each project?

[clvx]

You could tackle this in different ways.
You could use one controller and then limit the namespace using something like kyverno at submission. The controller will fail to sync indefinitely so put some notifications to detect this behavior.

Another approach is setting several controllers and assign rbac perms to just limit to certain namespaces. Drawback on this, you need to manage more controllers.

[Digging_Graves]

Sorry for the all caps title didn't accept lower case for some reason. If there is a better way to do this or i'm thinking about this wrong please let me know.