Assignments

An assignment is one sentence an Owner writes: this environment, on that registered cluster, in this namespace. The cluster's operator learns of it within seconds — it keeps one open question, "what is assigned to me?" — and materialises the projection itself: a managed KyvltSync, the Secret beside it, no terminal involved. Removing the assignment removes both.

Owner assigns          operator asks            namespace
Kubify / Staging  ──►  "assigned to me?"  ──►   kubify/
→ bluepaw, kubify      (held open, seconds)       KyvltSync  (managed)
                                                  Secret     (beside it)

What it needs

• A registered cluster — identity route only. Managed projections authenticate as the cluster, so no kyvlt.sh credential is ever stored for any of them, however many environments one registration serves.
• The chart installed with managed.enabled=true (which requires kyvlt.apiBaseUrl). Off — the default — the operator behaves exactly as before and nothing here applies.
• The namespace served. The fence does not move: servedNamespaces remains the administrator's install-time grant, and an assignment naming a namespace outside it lands nowhere — it shows Blocked, with the exact helm upgrade remedy, until the administrator widens the fence in the cluster. Nothing in kyvlt.sh can widen it.

States

Each assignment carries the cluster's own account of it, labelled as reported: projecting, pending (no report yet), blocked (the fence, or a namespace that does not exist), unauthorised (the registration was removed). The interface never invents health.

The same environment, many places

One environment may be assigned to any number of namespaces and clusters — each assignment its own row, its own Secret, its own audit record. Only the exact duplicate (same environment, same cluster, same namespace) is refused.

Hand-authored wiring is untouched

The operator manages only resources carrying its managed label. A KyvltSync you applied yourself — token-based or identity-based — is invisible to assignments: never adopted, never edited, never removed. A managed resource edited by hand is restored to its assignment's declaration, with an event saying so; values drift stays reported and never corrected, exactly as everywhere else.

Removing things, precisely

| Act | Projection | Secret | |---|---|---| | Remove an assignment | removed | removed (it follows its resource) | | Remove the registration | stops (Unauthorised) | remains | | Uninstall the operator | stops | remains |

Rebuilt a cluster? Register the new identity and use Transfer assignments to… on the stale registration's card — assignments are Owner decisions and survive a rebuild explicitly, never by silent reattachment.