fix(manifests): explicit namespaces per resource, drop overlay namespace transformer (#1171)

## Summary

- Removes `namespace: ambient-code--runtime-int` from
`kustomization.yaml` — the overlay namespace transformer was overwriting
`ambient-code--config` on the tenant RBAC resources
- Adds `namespace: ambient-code--runtime-int` explicitly to each
resource file that needs it
- Moves tenant RBAC into `tenant-rbac/` sub-kustomization so it can live
in `ambient-code--config` cleanly
- Adds per-sector RoleBindings for
`tenantnamespaces.tenant.paas.redhat.com`:
- `ambient-control-plane-rbac-runtime-int.yaml` — binds
`ambient-code--runtime-int:ambient-control-plane`
- `ambient-control-plane-rbac-s0.yaml` — binds
`ambient-code--ambient-s0:ambient-control-plane`
- Adding s1 (or any future sector) requires only a new
`ambient-control-plane-rbac-s1.yaml`

## Verification

```
kustomize build components/manifests/overlays/mpp-openshift/
# Role + RoleBindings → namespace: ambient-code--config ✓
# s0 subject → namespace: ambient-code--ambient-s0 ✓
# runtime-int subject → namespace: ambient-code--runtime-int ✓
# All other resources → namespace: ambient-code--runtime-int ✓
```

## Test plan
- [ ] Apply to MPP cluster — CP pod in `ambient-code--ambient-s0` can
get/create/delete `tenantnamespaces` in `ambient-code--config`

🤖 Generated with [Claude Code](https://claude.ai/code)

Author: markturansky

components/manifests/overlays/mpp-openshift/ambient-api-server-db.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: ambient-api-server-db
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: database
@@ -20,6 +21,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ambient-api-server-db
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: database

components/manifests/overlays/mpp-openshift/ambient-api-server-route.yaml

@@ -2,6 +2,7 @@ apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
   name: ambient-api-server
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: api

components/manifests/overlays/mpp-openshift/ambient-api-server.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: ambient-api-server-auth
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: auth
@@ -16,13 +17,15 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ambient-api-server
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ambient-api-server
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: api
@@ -145,6 +148,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: ambient-api-server
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-api-server
     component: api

components/manifests/overlays/mpp-openshift/ambient-control-plane-rbac.yaml

@@ -2,13 +2,15 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ambient-control-plane
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-control-plane
 ---
 apiVersion: v1
 kind: Secret
 metadata:
   name: ambient-control-plane-token
+  namespace: ambient-code--runtime-int
   annotations:
     kubernetes.io/service-account.name: ambient-control-plane
 type: kubernetes.io/service-account-token

components/manifests/overlays/mpp-openshift/ambient-control-plane-sa.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ambient-control-plane
+  namespace: ambient-code--runtime-int
   labels:
     app: ambient-control-plane
 spec:

components/manifests/overlays/mpp-openshift/ambient-control-plane.yaml

@@ -4,29 +4,15 @@ kind: Kustomization
 metadata:
   name: ambient-mpp-openshift
 
-namespace: ambient-code--runtime-int
-
 resources:
 - ambient-api-server-db.yaml
 - ambient-api-server.yaml
 - ambient-control-plane.yaml
 - ambient-api-server-route.yaml
 - ambient-control-plane-sa.yaml
-- ambient-control-plane-rbac.yaml
+- tenant-rbac/
 - ambient-tenant-ingress-netpol.yaml
 
-replacements:
-- source:
-    kind: ServiceAccount
-    name: ambient-control-plane
-    fieldPath: metadata.namespace
-  targets:
-  - select:
-      kind: RoleBinding
-      name: ambient-control-plane-tenant-namespaces
-    fieldPaths:
-    - subjects.0.namespace
-
 patches:
 - path: ambient-api-server-args-patch.yaml
   target:

components/manifests/overlays/mpp-openshift/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ambient-control-plane-tenant-namespaces-runtime-int
+  namespace: ambient-code--config
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ambient-control-plane-tenant-namespaces
+subjects:
+  - kind: ServiceAccount
+    name: ambient-control-plane
+    namespace: ambient-code--runtime-int

components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-runtime-int.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ambient-control-plane-tenant-namespaces-s0
+  namespace: ambient-code--config
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ambient-control-plane-tenant-namespaces
+subjects:
+  - kind: ServiceAccount
+    name: ambient-control-plane
+    namespace: ambient-code--ambient-s0

components/manifests/overlays/mpp-openshift/tenant-rbac/ambient-control-plane-rbac-s0.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ambient-control-plane-tenant-namespaces
+  namespace: ambient-code--config
+rules:
+  - apiGroups: ["tenant.paas.redhat.com"]
+    resources: ["tenantnamespaces"]
+    verbs: ["get", "list", "watch", "create", "delete"]