constants

const DefaultAKSOIDCClientID = "80faf920-1908-4b52-b5ef-a8e7bedfc67a"

DefaultAKSOIDCClientID is the standard Azure AKS OIDC client ID used for all AKS clusters.

const DefaultAKSOIDCServerID = "6dae42f8-4368-4678-94ff-3960e28e3630"

DefaultAKSOIDCServerID is the standard Azure AKS OIDC server ID (application ID of the Microsoft-managed enterprise application "Azure Kubernetes Service AAD Server"). This is the same for all AKS clusters with AKS-managed Azure AD enabled.

const DefaultAPIServerPort = 6443

DefaultAPIServerPort is the standard Kubernetes API server port.

const DefaultAPIServerReadyTimeout = 5 * time.Minute

DefaultAPIServerReadyTimeout caps how long UpgradeNode waits for the kube-apiserver on a control-plane node to accept connections after a reboot.

const DefaultAWSLocalstackImage = "localstack/localstack:4.14.0"

renovate: datasource=docker depName=localstack/localstack

const DefaultAWSLocalstackProImage = "localstack/localstack-pro:4.14.0"

renovate: datasource=docker depName=localstack/localstack-pro

const DefaultControlPlaneCPUDedicated = 4

const DefaultControlPlaneCPUSchedulable = 8

const DefaultControlPlaneMemoryDedicated = 4

const DefaultControlPlaneMemorySchedulable = 12

const DefaultConvergeTimeout = 5 * time.Minute

DefaultConvergeTimeout bounds the best-effort convergence pass an apply/up/bootstrap runs after placing secrets: it actively nudges not-ready kustomizations and forces stalled HelmReleases, returning early once everything is Ready. It is bounded (not the full install timeout) so an unwaited apply pushes the cluster along without blocking indefinitely; --wait paths still gate on the full Wait afterward.

const DefaultDNSImage = "coredns/coredns:1.14.6"

renovate: datasource=docker depName=coredns/coredns

const DefaultFluxKustomizationForce = false

const DefaultFluxKustomizationInstallTimeout = 10 * time.Minute

DefaultFluxKustomizationInstallTimeout is the timeout for a flux system's install tier when the facet sets none; install tiers install controllers and need more headroom than plain resources.

const DefaultFluxKustomizationInterval = 1 * time.Hour

DefaultFluxKustomizationInterval is the reconciliation interval for Kustomizations. Flux content here is pinned and explicitly triggered (the notifier re-fetches sources on every apply/up/bootstrap) rather than continuously tracked, so this is an eventual-consistency backstop, not the primary propagation path. A Kustomization that genuinely wants fast, continuously-polled GitOps behavior should set its own interval override.

const DefaultFluxKustomizationPrune = true

const DefaultFluxKustomizationRetryInterval = 2 * time.Minute

const DefaultFluxKustomizationTimeout = 5 * time.Minute

const DefaultFluxKustomizationWait = true

const DefaultFluxPrimaryKustomizationInterval = 5 * time.Minute

DefaultFluxPrimaryKustomizationInterval is the reconciliation interval for a Kustomization that resolves, explicitly or by default, to the blueprint's own repository rather than a named vendor source. Unlike the Source object itself (DefaultFluxPrimaryRepositoryInterval), a Kustomization's own poll is not the propagation path: kustomize-controller reconciles dependent Kustomizations via a watch on the Source's revision, which the notifier keeps fresh on every apply/up/bootstrap regardless of this interval — so this is purely a backstop for drift correction, retrying failed reconciliations, and dependency-readiness rechecks. A short interval here mainly causes needless churn: Flux's dependency-readiness check is a point-in-time Ready read with no hysteresis, so a Kustomization on a 1m interval briefly flipping to Reconciling can cascade DependencyNotReady retries through everything that depends on it, directly or transitively.

const DefaultFluxPrimaryRepositoryInterval = 1 * time.Minute

DefaultFluxPrimaryRepositoryInterval is the reconciliation interval for the blueprint's own repository (the top-level "repository:" field) as a flux Source. Unlike a named vendor source, the primary repository is typically a live, actively-pushed branch rather than a pinned release, and a change can land there without any windsor command running (a teammate's push, a CI merge) — so flux's own Source poll is the propagation path here, not just a backstop. See DefaultFluxPrimaryKustomizationInterval for why a Kustomization that resolves to this same repository doesn't need the same cadence.

const DefaultFluxSourceInterval = 1 * time.Hour

DefaultFluxSourceInterval is the reconciliation interval for flux Sources. Same rationale as DefaultFluxKustomizationInterval: sources are pinned and explicitly re-fetched by the notifier, so this is a backstop rather than the propagation path.

const DefaultFluxSourceTimeout = 2 * time.Minute

const DefaultGitLiveReloadImage = "ghcr.io/windsorcli/git-livereload:v0.2.1"

renovate: datasource=docker depName=ghcr.io/windsorcli/git-livereload-server

const DefaultGitLiveReloadPassword = "local"

const DefaultGitLiveReloadRsyncExclude = ".windsor,.terraform,.volumes,.venv"

const DefaultGitLiveReloadRsyncInclude = "kustomize"

const DefaultGitLiveReloadRsyncProtect = "flux-system"

const DefaultGitLiveReloadUsername = "local"

const DefaultGitLiveReloadWebhookLBPort = 9292

DefaultGitLiveReloadWebhookLBPort is the LoadBalancer port for the Flux webhook receiver.

const DefaultGitLiveReloadWebhookNodePort = 30292

DefaultGitLiveReloadWebhookNodePort is the NodePort for the Flux webhook receiver (docker-desktop mode).

const DefaultGitLiveReloadWebhookPath = "/hook/5dc88e45e809fb0872b749c0969067e2c1fd142e17aed07573fad20553cc0c59"

DefaultGitLiveReloadWebhookPath is the webhook path with token. Hook path corresponds to the webhook token "abcdef123456". see: https://fluxcd.io/flux/components/notification/receivers/

const DefaultGitopsNamespace = "system-gitops"

const DefaultKubernetesReachabilityCheckTimeout = 30 * time.Second

Bounds the pre-destroy Kubernetes reachability preflight.

const DefaultKustomizationWaitMaxFailures = 5

Maximum number of consecutive failures before giving up

const DefaultKustomizationWaitPollInterval = 5 * time.Second

Poll interval for CLI WaitForKustomizations

const DefaultKustomizationWaitTotalTimeout = 10 * time.Minute

Used for aggregate CLI wait (not per-resource)

const DefaultNetworkCIDR = "10.5.0.0/16"

const DefaultNodeHealthCheckPollInterval = 10 * time.Second

const DefaultNodeHealthCheckTimeout = 5 * time.Minute

const DefaultNodeOfflineTimeout = 3 * time.Minute

const DefaultNodeUpgradeTimeout = 10 * time.Minute

const DefaultOCIBlueprintURL = "oci://ghcr.io/windsorcli/core:latest"

const DefaultTalosAPIPort = 50000

const DefaultTalosImage = "ghcr.io/siderolabs/talos:v1.13.7"

renovate: datasource=github-releases depName=siderolabs/talos

const DefaultTerraformDestroyTimeout = 30 * time.Minute

Bounds a single `terraform destroy` invocation so a hung provider call fails, not blocks forever.

const DefaultWorkerCPU = 4

const DefaultWorkerMemory = 8

const KubernetesShortTimeout = 200 * time.Millisecond

const MinimumVersion1Password = "2.15.0"

const MinimumVersionAWS = "2.0.0"

const MinimumVersionAzure = "2.50.0"

const MinimumVersionColima = "0.9.0"

const MinimumVersionDocker = "23.0.0"

const MinimumVersionKubectl = "1.27.0"

const MinimumVersionKubelogin = "0.1.7"

const MinimumVersionLima = "1.0.0"

const MinimumVersionLimaIncus = "2.0.3"

MinimumVersionLimaIncus is the minimum limactl version when using colima with platform incus. Lima 1.x can hang after "Terminal is not available"; 2.0.3+ is required for reliable colima+incus startup.

const MinimumVersionSOPS = "3.10.0"

const MinimumVersionTerraform = "1.12.2"

const RegistryDefaultHostPort = 5001

const RegistryDefaultImage = "registry:3.1.1"

renovate: datasource=docker depName=registry