Unexpected bahaviour in combination of Acorn with Capsule and Flux

[kaotika]

Hi,

I'am investigating the usage of Acorn in combination with Capsule for better multi-tennancy and Flux. Capsule defines a tenant CRD. Normally a tenant owns some namespaces and capsule grants the preconfigured permissions to these namespace. The tenants namespaces are owned by the capsule-operator.

For the example I build the following resource structure:

• capsule tenant: dev-team (system:serviceaccount:acorn-system:acorn-system is one owner)
• namespace: dev-team, labels as acorn.io/project=true (Cause a tenant namespace is owned by capsule, the acorn project call does not create the namespace.)
• acorn project: dev-team
• installed some acorn app into dev-team

So far everything works.

The problem comes into account when I try to create the acorn projects by flux, what causes an update to the project resource.
by cli: acorn project update dev-team --supported-region local --default-region local

This leads to

✗  ERROR:  Project.api.acorn.io "dev-team" is invalid: spec.supportedRegions: Invalid value: []string{"local"}: cannot remove regions [] while in use by the following apps: [dev-team-js-demo]

There is a fixed bug #1542 with the same error but not the same setup. Without acorn the exception is not throwen. Even just with Capsule the exception is not reproducable.
Before I put together an full example, does anybody has a quick solution?