Why do Kargo require write and delete on namespaces?

[akselleirv]

Hello!

I was looking at the permissions that Kargo requires and in the Helm chart it requires write and delete on namespace resources: https://github.com/akuity/kargo/blob/main/charts/kargo/templates/api/cluster-role.yaml#L19-L21

Why is this needed? Especially deleting namespaces.

[krancour]

Kargo uses specially labeled namespaces as units of tenancy. So "project" creation is namespace creation. Project deletion is namespace deletion.

[akselleirv]

I see, thanks for the quick answer.

[akselleirv]

But the project creation is also possible by labelling a namespace? If I don’t need to create projects with the CLI.

[gdsoumya]

You can manually tag a namespace with the proper label and it will indeed be considered a project by kargo.