namespace override while running make deploy

[AlirezaPourchali]

What broke? What's expected?

There is an issue when calling make deploy, the issue is that the config/default/kustomization.yaml file.
it includes:

# Adds namespace to all resources.
namespace: xxxx

when you run make deploy it overrides all the namespaces as expected but it will cause issues when you are using some namespace based resources like the rbac.

Reproducing this issue

i have these markers in my controller

// +kubebuilder:rbac:groups=apps,namespace=infrastructure,resources=deployments,verbs=get;list;watch;update;patch
// +kubebuilder:rbac:groups="",namespace=users,resources=secrets,verbs=get;

the rbac files that get generated via make manifests are fine too, but when you run make deploy this happens:

/home/alireza/playground/authelia/osiris/bin/kustomize build config/default
Error: namespace transformation produces ID conflict: [{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{"internal.config.kubernetes.io/previousKinds":"Role","internal.config.kubernetes.io/previousNames":"manager-role","internal.config.kubernetes.io/previousNamespaces":"infrastructure"},"name":"manager-role","namespace":"users"},"rules":[{"apiGroups":["apps"],"resources":["deployments"],"verbs":["get","list","patch","update","watch"]}]} {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"name":"manager-role","namespace":"users"},"rules":[{"apiGroups":[""],"resources":["secrets"],"verbs":["get"]}]}]

it happens because of the override and the other role for infrastructure namespace goes to the users namespace.
some work arounds are:

1. remove the namespace override in the config/default/kustomization.yaml and apply namespace to everything manually or make a transformers file that transforms the namespaces for specific resources
2. change every role name to be unique (still goes to the wrong namespace)

or any other solution that im missing, i would be happy to work on a solution.

KubeBuilder (CLI) Version

4.9.0

PROJECT version

3

Plugin versions

layout:
- go.kubebuilder.io/v4

Other versions

No response

Extra Labels

/kind documentation

[camilamacedo86]

Thank you a lot for raising this.
We should definitely consider this use case.

We need to check if we can fix it while keeping # Adds namespace to all resources. centralized.
If not, it might introduce a larger breaking change, and we’ll need to see if we can maintain backward compatibility.

Ideally, we should start by defining what the best approach and best practices are for the Kustomize configuration. Once we have that clear, we can proceed with implementing the solution.

If it turns out to be a breaking change, we might need to consider introducing a new plugin version.
But first and foremost, we must ensure that we’re following the best Kustomize configuration approach.
Release and versioning can be addressed afterward.

[ashishkpathak-connect]

/assign

[AlirezaPourchali]

/assign

Hi — thanks for taking this issue. I’m happy to help with testing or to prepare a patch if needed. Is there any portion you’d like me to pick up?

[ashishkpathak-connect]

Thank you @AlirezaPourchali I found this interesting and thought of reviewing it carefully, replicate and figure out a solution.
If you've a solution ready, pls feel to raise a PR, since you've faced this issue and must be more familiar :-)

[ashishkpathak-connect]

/unassign