#6533 [BUG] Full support for Namespace-Scoped Installation Issue created by diranged ### Flyte & Flytekit version Flyte Version:

v1.15.3

### Describe the bug I work within our cloud/kubernetes engineering team and we're working with our ML/Data team to help them get Flyte running. Our team runs dozens of Kubernetes clusters for the organization, and we provide developers with tightly managed Namespaces to deploy their applications. I am running into some challenges though with the way the

flyte-core

chart is setup - it has several places where it manages cluster-level resources such as

ClusterRoles

,

ClusterRoleBindings

and

CustomResourceDefinitions

. To put it simply - we do not allow developer applications to install any Cluster-scoped resources - so resources like

ClusterRoles

,

ClusterRoleBindings

,

CustomResourceDefinitions

are all prohibited. In the event that we need to install a cluster-scoped resource to support a developer application, that is done from a privileged resource out-of-band from the developer application. ### Expected behavior I expect that the

flyte-core

chart can be configured easily to operate inside of a single

Namespace

and with only Namespace-scoped resources. Specifically: ### Flyte Propeller "Webhook" Service The flyte-core/templates/propeller/webhook.yaml has hard-coded and non-configurable

ClusterRole

and

ClusterRoleBinding

resources. These should be configurable so that they can either be a

ClusterRole/ClusteRoleBinding

or

Role/RoleBinding

resources with the flip of a switch. Additionally, the RBAC permissions should be defined in

values.yaml

so that they can be overridden. In particular the `mutatingwebhookconfigurations` permission would need to be removed for a namespace-scoped installation. #### Flyte Propeller RBAC Resources The main Propeller resources flyte-core/templates/propeller/rbac.yaml hard-coded and non-configurable

ClusterRole

and

ClusterRoleBinding

resources. These should be configurable so that they can either be a

ClusterRole/ClusteRoleBinding

or

Role/RoleBinding

resources with the flip of a switch. Additionally, the RBAC permissions should be defined in

values.yaml

- in particular, we would need to remove the management of CRDs from the permission set in a namespace-scoped installation. ### Additional context to reproduce No response ### Screenshots No response ### Are you sure this issue hasn't been raised already? • Yes ### Have you read the Code of Conduct? • Yes flyteorg/flyte