# Future tasks

Deferred work, newest first. When a task is picked up it gets a plan in `docs/plans/`; then tick
it here and link the plan.

## - [ ] Namespace per workload cluster (`lab1` out of `default`)

**Added:** 2026-09-28 09:29 CEST · **Why deferred:** keep phase 1 moving; `default` works for now.

**Problem.** cluster-autoscaler has to run in the same namespace as the Cluster. The chart mounts
`clusterAPIKubeconfigSecret` as a Secret volume, which only works within the pod's namespace, and
`lab1-kubeconfig` lives in the Cluster's namespace. `lab1` is in `default`, so CA would be installed
into `default` too. That mixes things in `default`, and with more clusters (phase 3) you'd get one
CA per cluster sitting side by side in `default`.

**Options compared:**

| Option | Verdict |
| --- | --- |
| CA in `default` (current Step 6) | works; poor hygiene, doesn't scale to more clusters |
| CA in its own namespace with a copy of the kubeconfig Secret | rejected: CAPI rewrites `lab1-kubeconfig` when it rotates the client cert, so the copy goes stale and CA silently loses the workload cluster |
| **One namespace per cluster** (`lab1` holds the CAPI objects, `InClusterIPPool`, kubeconfig Secret and CA) | preferred: the usual CAPI multi-cluster layout, one CA per workload cluster, RBAC and cleanup per namespace, matches phase 3 |

**Cost.** Namespace is immutable on CAPI objects, so `lab1` has to be deleted and recreated. That
means about 15 minutes of provisioning plus reinstalling Cilium. `clusterctl move` is not an option,
since it's forbidden with cluster-api-operator. CAPMOX credentials come from the controller's
global Secret, so a new namespace needs no extra credentials. The cost grows once workloads and
autoscaler state exist on `lab1`, so do it before the Step 7 results matter, or when creating the
next cluster.

**Changes:**

- `configs/capi/lab1.yaml`: a `Namespace lab1` object and `metadata.namespace: lab1` on every
  object, including `InClusterIPPool`.
- `configs/cluster-autoscaler/values.yaml`: `autoDiscovery.namespace: lab1`; install with `-n lab1`
  (`helm uninstall ca -n default` first if it was installed in `default`).
- `ansible/group_vars/all.yml`: `inspector_workload_clusters` entry `{ name: lab1, namespace: lab1 }`.
- `docs/phase-1-proxmox-capi.md`: Steps 3, 5 and 6 (namespace in commands and log expectations,
  `MachineDeployment/lab1/lab1-workers`).
- `.claude/agents/cluster-inspector.md`: the "Where things live" table says CA runs in `default`.
- `docs/decisions.md`: new row (namespace per workload cluster).

**Run by the owner:** `kubectl delete -f configs/capi/lab1.yaml` (old namespace), wait until the
VMs are gone, `kubectl apply` the new manifest, Cilium `helm upgrade --install`,
`ansible-playbook mgmt.yml --tags inspector`, then the CA install into `lab1`.