Namespace transformer

[marpi82]

I would like to ask about a simple example with two files:

# roleBinding.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cert-manager:leaderelection
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager:leaderelection
subjects:
  - kind: ServiceAccount
    name: cert-manager
    namespace: default

# kustomization.yaml
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cert-manager
resources:
  - ./roleBinding.yaml

the result of kustomize build . (v5.3.0) is:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cert-manager:leaderelection
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager:leaderelection
subjects:
  - kind: ServiceAccount
    name: cert-manager
    namespace: cert-manager

and the result of reconciliation by FluxCD (v2.5.1) is:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cert-manager:leaderelection
  namespace: cert-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cert-manager:leaderelection
subjects:
  - kind: ServiceAccount
    name: cert-manager
    namespace: cert-manager

Why during reconciliation via FluxCD also non-default namespaces are changed if the default kustomize behavior is different?