flux

const (
	// ChartOCI is ControlPlane's Flux Operator chart. The operator installs
	// Flux itself from the FluxInstance riding the chart.
	ChartOCI = "oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator"
	// ChartVersion is the pinned operator chart version (appVersion
	// v<ChartVersion>; the image is pinned by digest in kcl/lib/flux.k).
	ChartVersion = "0.62.1"
	// FluxVersion is the Flux minor the FluxInstance pins; the operator picks
	// the newest patch of it that its pinned image embeds.
	FluxVersion = "2.9.x"
	// InstanceName is the FluxInstance's name: the operator reconciles only
	// `flux`, in its own namespace.
	InstanceName = "flux"
	// ChartName is the `--target` selector forge's own install uses. A
	// consumer may name its chart anything, which is exactly why detection
	// is by reference and not by this.
	ChartName = "flux-operator"
	// Namespace is Flux's namespace, and where the pointer is written. Not
	// configurable: a second spelling would only let the writer and the
	// controller disagree about where the OCIRepository lives.
	Namespace = "flux-system"
	// ReconcilerRole / SourceRole are the ClusterRoles of the
	// per-namespace RBAC model (kcl/lib/flux.k, `rbac = "namespaced"`): they
	// grant nothing until a RoleBinding in a namespace names them. A writer
	// of a namespace that holds Flux objects binds kustomize-controller to
	// the first and source-controller to the second. Same names as KCL's
	// FLUX_RECONCILER_ROLE / FLUX_SOURCE_ROLE, pinned by
	// kcl/tests/positive_flux_chart_hardened.k and TestKCLRoleNamesAgree: a
	// RoleBinding naming a ClusterRole that is not declared is accepted by
	// the apiserver and grants nothing, so drift would fail late.
	ReconcilerRole = "flux-tenant-reconciler"
	SourceRole     = "flux-tenant-source"
	// DeployServiceAccount is the ServiceAccount the controller impersonates
	// by default and is pinned to.
	DeployServiceAccount = "reliant-deploy-tenant"
	// ShardLabel / ConnectedShard are Flux's sharding label and the value that
	// routes a Kustomization to the connected-cluster controller
	// (`flux_chart(connected_shard = True)`, a FluxInstance shard). A writer of a Kustomization with
	// spec.kubeConfig MUST set it: the admission policy refuses the object
	// otherwise. Same spellings as KCL's FLUX_SHARD_LABEL / FLUX_CONNECTED_SHARD.
	ShardLabel     = "sharding.fluxcd.io/key"
	ConnectedShard = "connected"
	// ConnectedController is the shard's Deployment and ServiceAccount;
	// ConnectedReconcilerRole is the ClusterRole a namespace RoleBinding gives
	// it (Secret reads only, never impersonate).
	ConnectedController     = "kustomize-controller-connected"
	ConnectedReconcilerRole = "flux-connected-reconciler"
)