Flux CD
Medium
Security
What does the --no-cross-namespace-refs=true flag on the Flux controllers do?
Select your answer:
Show answer and explanation
Answer: Stops Flux objects from referring to sources or objects in other namespaces
Explanation
Without the flag, a Kustomization in a tenant namespace can point at a GitRepository in another namespace. With it, references must stay in the object's own namespace, which is a key step in locking down a multi-tenant cluster.
More medium Flux CD questions
- How can a Kustomization apply resources with a tenant's limited permissions instead of kustomize-controller's own?
- What does 'flux diff kustomization my-app --path ./apps/my-app' show?
- How can a HelmRelease take its Helm values from a ConfigMap or Secret?
- Which HelmRelease setting makes helm-controller retry a failed first install?
- What does driftDetection.mode: enabled do on a HelmRelease?
- Which Flux objects work together to update an image tag in Git when a new version is pushed to a registry?