Adds namespace-scoped RBAC for reduced permissions mode.

[YossiMarzuk]

Previously, reducedPermissions mode granted cluster-wide access to Flux CRs (gitrepositories, kustomizations). This moves those permissions to be namespace-scoped via the new wizFluxNamespace option, along with secrets and configmaps access needed for Helm release management.

Changes:

• Removed gitrepositories and kustomizations from ClusterRole
• Added templates/outpostController.fluxNamespace.rbac.yaml with Role and RoleBinding for the wizFluxNamespace
• Added wizFluxNamespace option to outpostController in values.yaml

When reducedPermissions is true, and wizFluxNamespace is set, the controller gets:

• Cluster-wide: nodes (read)
• Release namespace: full admin
• wizFluxNamespace: secrets, configmaps, gitrepositories, kustomizations

[YossiMarzuk]

Following my last discussion with @eyal-moscovici
Applied the following:

Replace fluxRbacEnabled with wizFluxNamespace

Changes:

• Replaced boolean fluxRbacEnabled with explicit wizFluxNamespace string parameter
• Default value is wiz-flux-system
• When wizFluxNamespace is set, creates Role and RoleBinding in the specified namespace
• When wizFluxNamespace is empty, auto-derives namespace from release namespace prefix (e.g., wiz-default -> wiz-flux-system, coco-default -> coco-flux-system, default -> flux-system)
• Bumped chart version to 2026.02.19

Files changed:

• values.yaml
• templates/outpostController.fluxNamespace.rbac.yaml
• Chart.yaml

Permissions:

reducedPermissions: false

• ClusterRoleBinding to cluster-admin (full cluster access)

reducedPermissions: true

• ClusterRole: nodes (get, list, watch)
• Role in release namespace (e.g., wiz-default): full namespace admin (*, *, *)
• Role in flux namespace (e.g., wiz-flux-system):
  • secrets, configmaps: get, list, watch, create, update, delete
  • gitrepositories (source.toolkit.fluxcd.io): create, delete, get, list, patch, update, watch
  • kustomizations (kustomize.toolkit.fluxcd.io): create, delete, get, list, patch, update, watch

Tested:

• helm template with default wizFluxNamespace (wiz-flux-system) - verified Role/RoleBinding created in wiz-flux-system
• helm template with empty wizFluxNamespace in wiz-default namespace - verified auto-derived to wiz-flux-system
• helm template with empty wizFluxNamespace in default namespace - verified auto-derived to flux-system
• helm template with empty wizFluxNamespace in coco-default namespace - verified auto-derived to coco-flux-system
• helm template with custom wizFluxNamespace (my-custom-ns) - verified Role/RoleBinding created in my-custom-ns
• Deployed to AKS cluster in wiz-default namespace with reducedPermissions=true, verified Flux RBAC created in wiz-flux-system