More documentation for installing tenant-namespace RBAC in multi-namespace mode
- Dominant language
- Go
- Stars
- 927
- Forks
- 387
- Avg merge
- 15h 5m
- Merged PRs (30d)
- 36
Description
## Environment
- Camel K version: **`2.11.0-nightly`** (`pkg/util/defaults/defaults.go`)
This is a documentation question about the **v2.11.0-nightly** codebase.
### Summary
In multi-namespace mode the operator runs in its own namespace and watches a list of tenant namespaces (`WATCH_NAMESPACE=tenant-a,tenant-b`, `pkg/cmd/operator/operator.go:242-260`). It does **not** provision RBAC into watched namespaces at runtime — `install.OperatorStartupOptionalTools` (`pkg/install/optional.go:29-52`) creates no Roles/RoleBindings, and the CLI installer was removed (commits `07f476d80`, `38aa87044`).
The intended flow appears to be applying the Kustomize overlay `install/overlays/multi-namespace/`, whose `tenant-*-ns-rbac` components render `install/base/config/rbac/namespaced/` (Role + RoleBinding) into each tenant namespace and repoint the RoleBinding subject to the operator's ServiceAccount in the operator namespace (`install/overlays/multi-namespace/tenant-a-ns-rbac/patch-rolebinding-subjects.yaml`).
However, `docs/modules/ROOT/pages/installation/installation.adoc:58` only states that the user must "provide the RBACs which are expected by the operator" and points at the overlay examples; there is no step-by-step guide. `docs/modules/ROOT/pages/installation/advanced/multi.adoc` covers the (deprecated) *multiple-operators* scenario, not one operator watching multiple tenant namespaces.
### Questions
1. Is there existing documentation that walks through installing the namespaced RBAC into each tenant namespace for multi-namespace mode (beyond the raw Kustomize overlay)?
2. If not, would a dedicated docs section be welcome, based on the `install/overlays/multi-namespace/` overlay?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with docs/modules/ROOT/pages/installation/installation.adoc and install/overlays/multi-namespace/, then compare the tenant-a-ns-rbac component with docs/modules/ROOT/pages/installation/advanced/multi.adoc. Done means the installation page explains how to apply the overlay or equivalent RBAC for each tenant namespace and distinguishes this mode from multiple operators.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- devops, documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100