leigh capili

> Understood on the scope. I think the root of my worry here is on any change done outside of MP that would cause a breakage (which very well might...

I think it's super reasonable for the library to treat this as a typed error. Perhaps the examples could be updated with that type-check/init logic, so that this behavior doesn't...

xref fluxcd/flux2#582 WRT security-model and multi-tenancy

I feel the sharing annotation is unnecessary. The owner of the config/secret Namespace has full control of any RoleBinding that grants access for the configs to other Users/Groups from different...

> This choice was made because you can not reliably restore the cluster state from Git repositories if the configuration of a service relies on some URL being available. We...

> having the optional param ... Do we already support optional vs. required `valueRefs`? I don't see it in the current API. I was thinking we could basically take the...

`optional` valueRefs would allow helmReleases to change config based on the live state of the cluster. This could be useful for allowing a users to extend behavior at a later...

In this example, the HelmRelease is dependent on some other in-namespace resources. (default SA) The issue is that an entire Namespace is being deleted before helm-controller has the ability to...

It's worth reading this comment if you're parsing this thread: https://github.com/fluxcd/kustomize-controller/issues/301#issuecomment-871597112

Succinctly, I think the logic here is: On delete, in the Kustomization finalizer, check the in-controller dependency graph to see if I have any children. If so, block/requeue indefinitely until...