flux

const (
	// ChartOCI is the community flux2 chart. There is no fluxcd-published
	// chart; this is the canonical install path.
	ChartOCI = "oci://ghcr.io/fluxcd-community/charts/flux2"
	// ChartVersion is the pinned CHART version. Chart 2.19.1 is appVersion
	// v2.9.5 (source-controller and kustomize-controller v1.9.5). The two
	// numbers are unrelated lineages — re-derive with
	// `helm show chart <ChartOCI> --version <v> | grep appVersion` on a
	// bump, never increment.
	ChartVersion = "2.19.1"
	// ChartName is the `--target` selector forge's own install uses. A
	// consumer may name its chart anything, which is exactly why detection
	// is by reference and not by this.
	ChartName = "flux"
	// Namespace is Flux's namespace, and where the pointer is written. Not
	// configurable: a second spelling would only let the writer and the
	// controller disagree about where the OCIRepository lives.
	Namespace = "flux-system"
	// ReconcilerRole / SourceRole are the ClusterRoles of the
	// per-namespace RBAC model (kcl/lib/flux.k, `rbac = "namespaced"`): they
	// grant nothing until a RoleBinding in a namespace names them. A writer
	// of a namespace that holds Flux objects binds kustomize-controller to
	// the first and source-controller to the second. Same names as KCL's
	// FLUX_RECONCILER_ROLE / FLUX_SOURCE_ROLE, pinned by
	// kcl/tests/positive_flux_chart_hardened.k and TestKCLRoleNamesAgree: a
	// RoleBinding naming a ClusterRole that is not declared is accepted by
	// the apiserver and grants nothing, so drift would fail late.
	ReconcilerRole = "flux-tenant-reconciler"
	SourceRole     = "flux-tenant-source"
	// DeployServiceAccount is the ServiceAccount the controller impersonates
	// by default and is pinned to.
	DeployServiceAccount = "reliant-deploy-tenant"
	// ShardLabel / ConnectedShard are Flux's sharding label and the value that
	// routes a Kustomization to the connected-cluster controller
	// (`flux_chart(connected_shard = True)`). A writer of a Kustomization with
	// spec.kubeConfig MUST set it: the admission policy refuses the object
	// otherwise. Same spellings as KCL's FLUX_SHARD_LABEL / FLUX_CONNECTED_SHARD.
	ShardLabel     = "sharding.fluxcd.io/key"
	ConnectedShard = "connected"
	// ConnectedController is the shard's Deployment and ServiceAccount;
	// ConnectedReconcilerRole is the ClusterRole a namespace RoleBinding gives
	// it (Secret reads only, never impersonate).
	ConnectedController     = "kustomize-controller-connected"
	ConnectedReconcilerRole = "flux-connected-reconciler"
)