Jean-Gabriel Gill-Couture c18aa5d178 refactor(k8s): centralize namespace creation in K8sClient::ensure_namespace ...

Add K8sClient::ensure_namespace(ns): a GET decides — no-op if the namespace
already exists (e.g. provisioned by platform onboarding), create only when
genuinely missing. Never patches the cluster-scoped Namespace object, so a
namespace-scoped tenant deployer doesn't need cluster RBAC.

Route the tenant-deploy path through it and stop helm from patching the
namespace:
- postgresql K8sPostgreSQLScore: use ensure_namespace (was inline).
- zitadel: use ensure_namespace; HelmChartScore create_namespace=false.
- app ComposeAppScore: ensure_namespace before install; create_namespace=false.

Fixes the prod deploy 403 "cannot patch resource namespaces" under a
namespace-scoped service account.

2026-06-26 15:14:27 -04:00

..

src

refactor(k8s): centralize namespace creation in K8sClient::ensure_namespace

2026-06-26 15:14:27 -04:00

Cargo.toml

feat: Refactor K8sClient into separate, publishable crate, and add zitadel example

2026-03-06 14:21:15 -05:00