I can't create resources in a child namespace while authenticating to a parent namespace, since I can specify a single namespace only:
apiVersion: redhatcop.redhat.io/v1alpha1
kind: <Any Resource>
metadata:
name: kubernetes-cluster-<name> # mount name
spec:
namespace: "<CHILD-NAMESPACE>"
path: "..."
type: kubernetes
authentication:
path: kubernetes-cluster-mgmt # can't specify an auth moun in the parent namespace!
role: <name>
This requires us to replicate the auth engine from the parent to the child namespaces. In our multi-tenancy model, this requires us to create an entity with aliases for each auth mount to limit client costs.