When a Kustomization or HelmRelease is being reconciled in a namespace other than the namespace where flux is installed, the reconciliation will run under the gotk:<NAMESPACE>:reconciler user. If the user doesn't exists or if the objects being reconciled don't belong to that namespace, the reconcilers will not be able to apply the tenant's sources on the cluster.