Unable to create an infinispan cluster in another namespace

[smutel]

Hello,

I installed infinispan-operator using kustomize and https://github.com/infinispan/infinispan-operator/blob/main/config/default/kustomization.yaml.
The operator is running in namespace infinispan-operator-system.
I create a Infinispan cluster in another namespace:

---                                                                                                 
  apiVersion: infinispan.org/v1
  kind: Infinispan
  metadata:
    name: kc-infinispan
    namespace: test
  spec:

In the operator logs I have only these messages but nothing is created in the test namespace:

2024-05-29T07:54:48.521Z	DEBUG	controller-runtime.webhook.webhooks	received request	{"webhook": "/mutate-infinispan-org-v1-infinispan", "UID": "d5b3f3e0-6604-4032-8b05-49f6612befef", "kind": "infinispan.org/v1, Kind=Infinispan", "resource": {"group":"infinispan.org","version":"v1","resource":"infinispans"}}
2024-05-29T07:54:48.523Z	DEBUG	controller-runtime.webhook.webhooks	wrote response	{"webhook": "/mutate-infinispan-org-v1-infinispan", "code": 200, "reason": "", "UID": "d5b3f3e0-6604-4032-8b05-49f6612befef", "allowed": true}
2024-05-29T07:54:48.536Z	DEBUG	controller-runtime.webhook.webhooks	received request	{"webhook": "/validate-infinispan-org-v1-infinispan", "UID": "dea4b63e-997f-4442-83af-201b204109f5", "kind": "infinispan.org/v1, Kind=Infinispan", "resource": {"group":"infinispan.org","version":"v1","resource":"infinispans"}}
2024-05-29T07:54:48.536Z	DEBUG	controller-runtime.webhook.webhooks	wrote response	{"webhook": "/validate-infinispan-org-v1-infinispan", "code": 200, "reason": "", "UID": "dea4b63e-997f-4442-83af-201b204109f5", "allowed": true}

Thanks.

[ryanemerson]

@smutel When installing using Kustomize and config/default the Operator will only be able to reconcile CRs in the same namespace that the Operator is deployed. This is due to the following reasons:

1. A RoleBinding, not a ClusterRoleBinding, is created for the various permissions required by the Operator
2. The WATCH_NAMESPACE variabke in config/manager/manager.yaml is set to the Operator namespace.

The simplest way to deploy the Operator for multi-namespace deployments is via an OLM Subscription. OLM will handle the necessary mapping of roles etc, to ensure that the Operator is able to reconcile either all namespaces or a select subset, depending on the OperatorGroup configuration.

https://infinispan.org/docs/infinispan-operator/main/operator.html#install-operatorhub_install
https://olm.operatorframework.io/docs/concepts/crds/operatorgroup/