Revisiting ClusterProfile scope: duplicate logical clusters across namespaces

[kahirokunn]

Hi all,

We'd like input on a question from https://github.com/kubernetes-sigs/cluster-inventory-api/issues/75, also discussed at the June 23 SIG-MC call.

ClusterProfile is namespace-scoped, so producers like OCM can project the same managed cluster into multiple namespaces (`set-a/managed1`, `set-b/managed1`). Consumers that watch multiple namespaces (e.g. the Argo CD ClusterProfile controller) then select the same logical cluster twice, and since the duplicated objects can diverge in labels/status/accessProviders, there is no way to tell which one is authoritative.

Options discussed so far:

1. Document that consumers should watch exactly one namespace (blocks multi-ClusterSet / multi-producer use cases)
2. Document that producers must keep one logical cluster in one namespace, and consumers should stop and report an error if duplicates are detected
3. Add a stable global cluster identity for dedup (detects duplicates, but doesn't say which object wins)
4. Make ClusterProfile cluster-scoped (structurally solves it, though some related specs would need adjusting)

I wasn't part of the original discussions that settled on namespace scope, so I may well be missing context behind that decision. But given the concrete problems we're now seeing with the namespaced model, I'd like to propose moving ClusterProfile to cluster scope (option 4). If you were involved in the original scoping decision or remember the reasoning, your input would be especially valuable, and the sooner we decide, the easier any change will be for API stability.

Any thoughts or feedback would be much appreciated.

Thanks,
Kahiro Okina (@kahirokunn)