controller/

clusternamespaceresources package is responsible for managing RBAC resources that grant those with access to an organization namespace access to namespaces belonging to the organizations clusters

rbaccleaner exists to clean up ClusterRoleBindings and ClusterRoles deployed by legacy app-operators to cluster namespaces.

crossplane package is responsible for setting up RBAC required by crossplane's rbac-manager.

bootstrap exists to reconcile cluster roles and bindings created at the start

externalresources package is responsible for managing RBAC resources that grant those with access to an organization namespace access to namespaces belonging to the organizations clusters

fluxauth package is responsible for setting up RBAC required by customer-facing Flux, operating in flux-system namespace.