Module namespace_scope 

Operator namespace scoping.

Controls the set of namespaces the operator watches and manages, driven by the BINDY_WATCH_NAMESPACES environment variable. This is the foundation of the least-privilege deployment model that closes audit findings C2 (operator can create workloads cluster-wide) and H3 (operator can read all Secrets cluster-wide): when the scope is restricted to specific namespaces, the operator builds its watches with Api::namespaced and only needs per-namespace RBAC (RoleBindings) instead of a cluster-wide ClusterRoleBinding.

The default is NamespaceScope::All (cluster-wide) so existing single cluster-wide installs keep working unchanged.

Enums

NamespaceScope

The set of namespaces the operator watches and manages.

Constants

WATCH_NAMESPACES_ENV

Environment variable naming the namespaces the operator should watch.