fix(manifests): explicit namespaces per resource, drop overlay namespace transformer

Remove namespace: ambient-code--runtime-int from kustomization.yaml and set it
explicitly on each resource file instead. This allows cross-namespace resources
(Role/RoleBindings in ambient-code--config) to coexist in the same overlay without
being overwritten by the Kustomize namespace transformer.

Per-sector RoleBindings for tenantnamespaces.tenant.paas.redhat.com:
- ambient-control-plane-rbac-runtime-int.yaml: binds ambient-code--runtime-int SA
- ambient-control-plane-rbac-s0.yaml: binds ambient-code--ambient-s0 SA
Both grant get/list/watch/create/delete on tenantnamespaces in ambient-code--config.

Adding ambient-code--s1 in future requires only a new ambient-control-plane-rbac-s1.yaml.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Ambient Code Bot

components/manifests/overlays/mpp-openshift/ambient-api-server-db.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: ambient-api-server-db
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: database
@@ -20,6 +21,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ambient-api-server-db
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: database

components/manifests/overlays/mpp-openshift/ambient-api-server-route.yaml

@@ -2,6 +2,7 @@ apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
   name: ambient-api-server
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: api

components/manifests/overlays/mpp-openshift/ambient-api-server.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: ambient-api-server-auth
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: auth
@@ -16,13 +17,15 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ambient-api-server
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ambient-api-server
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: api
@@ -145,6 +148,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: ambient-api-server
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: api

components/manifests/overlays/mpp-openshift/ambient-control-plane-rbac.yaml

@@ -2,13 +2,15 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ambient-control-plane
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-control-plane
 ---
 apiVersion: v1
 kind: Secret
 metadata:
   name: ambient-control-plane-token
+  namespace: ambient-code--runtime-int
   annotations:
     kubernetes.io/service-account.name: ambient-control-plane
 type: kubernetes.io/service-account-token

components/manifests/overlays/mpp-openshift/ambient-control-plane-sa.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ambient-control-plane
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-control-plane
 spec:

components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml

@@ -4,29 +4,15 @@ kind: Kustomization
 metadata:
   name: ambient-mpp-openshift
 
-namespace: ambient-code--runtime-int
-
 resources:
 - ambient-api-server-db.yaml
 - ambient-api-server.yaml
 - ambient-control-plane.yaml
 - ambient-api-server-route.yaml
 - ambient-control-plane-sa.yaml
-- ambient-control-plane-rbac.yaml
+- tenant-rbac/
 - ambient-tenant-ingress-netpol.yaml
 
-replacements:
-- source:
-    kind: ServiceAccount
-    name: ambient-control-plane
-    fieldPath: metadata.namespace
-  targets:
-  - select:
-      kind: RoleBinding
-      name: ambient-control-plane-tenant-namespaces
-    fieldPaths:
-    - subjects.0.namespace
-
 patches:
 - path: ambient-api-server-args-patch.yaml
   target:

components/manifests/overlays/mpp-openshift/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ambient-control-plane-tenant-namespaces-runtime-int
+  namespace: ambient-code--config
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ambient-control-plane-tenant-namespaces
+subjects:
+  - kind: ServiceAccount
+    name: ambient-control-plane
+    namespace: ambient-code--runtime-int

components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-runtime-int.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ambient-control-plane-tenant-namespaces-s0
+  namespace: ambient-code--config
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ambient-control-plane-tenant-namespaces
+subjects:
+  - kind: ServiceAccount
+    name: ambient-control-plane
+    namespace: ambient-code--ambient-s0

components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-s0.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ambient-control-plane-tenant-namespaces
+  namespace: ambient-code--config
+rules:
+  - apiGroups: ["tenant.paas.redhat.com"]
+    resources: ["tenantnamespaces"]
+    verbs: ["get", "list", "watch", "create", "delete"]