Rbac

• Manager unavailable

  The controller process is running, but its manager cannot start, so no StageSet is being reconciled

• Multi-cluster and tenancy

  Impersonation, watch scoping, single-tenant cluster-admin, and remote clusters.

• RBACDenied

  An apiserver call the controller made — resolving a source, an impersonated apply, or a tenant get — failed with Forbidden or referenced a kind the apiserver does not know.

• Security & multi-tenancy

  Run the controller safely — SOPS decryption, tenant impersonation, remote clusters, admission validation, network policy, and service mesh.