Namespaces

Where namespaces are declared, and what their labels decide. Read this before adding a component or a node app, because a namespace declared in the wrong place deadlocks and a namespace labelled wrongly reads the wrong tier’s secrets.

Every Namespace CR lives in infra/namespaces/app/namespaces.yaml, owned by the namespaces Kustomization, which depends on nothing. Components do not declare their own. A controller whose chart writes into a namespace it does not own would otherwise deadlock against the component that does. See Startup ordering.

What stays per-namespace is the policy attached to it: infra/policies/namespaces/<namespace>/ holds that namespace’s NetworkPolicy and RBAC, not its Namespace.

Every non-control-plane namespace carries futk.eu/tier: infra or futk.eu/tier: node, and node namespaces add futk.eu/node: <hostname>.

Those labels are load-bearing, not documentation. The ValidatingAdmissionPolicy in infra/infisical-operator/config/ reads them to decide which Infisical path a namespace may pull from, so a namespace with the wrong label reads the wrong tier’s secrets, and one with no label cannot host an InfisicalStaticSecret at all. See Secrets.