Repository navigation
fix: leave the namespace to the environment in a restricted render - #58
Merged
antoinetoussaint-byte merged 1 commit intoSep 23, 2026
Merged
Conversation
The base kustomization always listed namespace.yaml, so a restricted render (what codefly deploy gitops render produces) carried a cluster-scoped Namespace. The CLI refuses one outside an AppProject contract, so every composition rendering a python-fastapi service without --app-project failed, while the same composition rendered go-grpc services, which already omit it when .Restricted. Template the base kustomization the way go-grpc does: the Namespace is created only by the ephemeral local apply. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
antoinetoussaint-byte
deleted the
fix/restricted-render-omits-namespace
branch
September 23, 2026 18:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A restricted render of a python-fastapi service always included a cluster-scoped
Namespace.codefly deploy gitops renderthen refused it:That happens for every composition that renders without
--app-project. The same composition renders go-grpc services without trouble, because go-grpc's basekustomization.yaml.tmplhas listednamespace.yamlonly{{- if not .Restricted }}since #52. Herebase/kustomization.yamlwas a plain file, so the namespace was always listed.This change makes the base kustomization a template with that same condition. The ephemeral local apply still creates the namespace. A restricted render leaves it to the environment that owns it, so two owners no longer compete over one Namespace's labels.
Classification: a fix, in the agent that renders the object. No CLI or core change.
How it was found
The model gateway module (obin-ai/module-model-gateway) is the first python-fastapi service a composition renders for a hosted cell.
codefly deploy gitops render model --env local(CLI 0.1.160, this agent at 0.0.106) built and pushed the image and then refused the Namespace. With--app-projectthe render completed. It emittedbase/namespace.yamlbeside the CLI-projected ServiceAccount and the restrictedsecretKeyRefenvironment.Test plan
TestRestrictedDeploymentLeavesTheNamespaceToTheEnvironment: renders through core'sKustomizeDeploy. A restricted profile lists nonamespace.yamland an ephemeral local apply still does. The test fails against the previous template.go test ./ -run 'TestOwnedManifestsAreTransportNeutral|TestRestricted|TestDeployment|TestGRPC': pass. The template comment is kept free of delivery vocabulary, which the conformance test enforces.gofmt -l .andgo vet ./: clean.go test ./: every test passes exceptTestImageSBOMInventoriesTheBuiltImage. It fails on this host because syft cannot reach the Docker daemon ("docker not available"). That is environmental and unrelated. Nothing here touches the image or the SBOM path.Not verified
codefly deploy gitops renderagainst a locally built agent with this change. The claim that the render passes without--app-projectis inferred from the render error and from the go-grpc precedent.0.0.107). A consuming service then moves itsagent.versionto it.🤖 Generated with Claude Code