fix: Remove sourceNamespaces from AppProjects synced to managed agents

Signed-off-by: Mike Ng <[email protected]>

Author: mikeshng

docs/user-guide/appprojects.md

@@ -64,12 +64,9 @@ When an AppProject is sent to an agent, it undergoes transformation to make it a
      namespace: "guestbook"  # Preserves original namespace restrictions
 ```
 
-2. **Source Namespaces**: Limited to only the agent's namespace:
+2. **Source Namespaces**: Removed completely since they're only used on the control plane for routing
 
-```yaml
-   sourceNamespaces:
-   - agent-production  # The specific agent namespace
-```
+   The `sourceNamespaces` field is used on the control plane to determine which agents should receive the AppProject. Once the AppProject arrives at the agent cluster, this field is removed as it's no longer needed.
 
 3. **Roles**: Removed since they're not relevant on the workload cluster
 
@@ -174,7 +171,7 @@ The transformation logic differs significantly between managed and autonomous ag
 - **Direction**: AppProject flows from principal to agent
 - **Selection**: Uses glob pattern matching on `sourceNamespaces` and `destinations` to determine which agents receive the project
 - **Destinations**: Filtered to only include destinations matching the agent, then transformed to `in-cluster`
-- **Source Namespaces**: Replaced with the single agent namespace
+- **Source Namespaces**: Removed completely since they're only used on the control plane for routing
 - **Name**: Remains unchanged
 
 ### Autonomous Agents (Agent → Principal)

internal/manager/appproject/appproject.go

@@ -482,8 +482,9 @@ func AgentSpecificAppProject(appProject v1alpha1.AppProject, agent string) v1alp
 	}
 	appProject.Spec.Destinations = filteredDst
 
-	// Only allow Applications to be managed from the agent namespace
-	appProject.Spec.SourceNamespaces = []string{agent}
+	// Remove sourceNamespaces since they are not relevant on the workload cluster
+	// They are only used on the control plane to determine which agents should receive the AppProject
+	appProject.Spec.SourceNamespaces = nil
 
 	// Remove the roles since they are not relevant on the workload cluster
 	appProject.Spec.Roles = []v1alpha1.ProjectRole{}

internal/manager/appproject/appproject_test.go

@@ -561,7 +561,7 @@ func TestAgentSpecificAppProject(t *testing.T) {
 							Server:    "https://kubernetes.default.svc",
 						},
 					},
-					SourceNamespaces: []string{"cluster-prod"},
+					SourceNamespaces: nil,
 					Roles:            []v1alpha1.ProjectRole{},
 				},
 			},
@@ -617,7 +617,7 @@ func TestAgentSpecificAppProject(t *testing.T) {
 							Server:    "https://kubernetes.default.svc",
 						},
 					},
-					SourceNamespaces: []string{"prod-cluster-1"},
+					SourceNamespaces: nil,
 					Roles:            []v1alpha1.ProjectRole{},
 				},
 			},
@@ -661,7 +661,7 @@ func TestAgentSpecificAppProject(t *testing.T) {
 				},
 				Spec: v1alpha1.AppProjectSpec{
 					Destinations:     []v1alpha1.ApplicationDestination{},
-					SourceNamespaces: []string{"prod-cluster"},
+					SourceNamespaces: nil,
 					Roles:            []v1alpha1.ProjectRole{},
 				},
 			},
@@ -687,7 +687,7 @@ func TestAgentSpecificAppProject(t *testing.T) {
 				},
 				Spec: v1alpha1.AppProjectSpec{
 					Destinations:     []v1alpha1.ApplicationDestination{},
-					SourceNamespaces: []string{"test-agent"},
+					SourceNamespaces: nil,
 					Roles:            []v1alpha1.ProjectRole{},
 				},
 			},
@@ -724,7 +724,7 @@ func TestAgentSpecificAppProject(t *testing.T) {
 							Namespace: "default",
 						},
 					},
-					SourceNamespaces: []string{"test-agent"},
+					SourceNamespaces: nil,
 					Roles:            []v1alpha1.ProjectRole{},
 				},
 			},

test/e2e/appproject_test.go

@@ -73,8 +73,7 @@ func (suite *AppProjectTestSuite) Test_AppProject_Managed() {
 	requires.Equal("in-cluster", mappProject.Spec.Destinations[0].Name)
 	requires.Equal("https://kubernetes.default.svc", mappProject.Spec.Destinations[0].Server)
 
-	requires.Len(mappProject.Spec.SourceNamespaces, 1)
-	requires.Equal("agent-managed", mappProject.Spec.SourceNamespaces[0])
+	requires.Nil(mappProject.Spec.SourceNamespaces)
 
 	// Modify the appProject on the principal and ensure the change is propagated
 	// to the managed-agent