pub const PLEME_LABEL_PREFIX: &str = "pleme.pleme.io";Expand description
Canonical pleme-io label namespace prefix. Every cluster object
emitted by any caixa-side renderer that needs to carry the
pleme-io workload identity uses this prefix; runtime label
injectors (lareira-fleet-programs chart’s pod template,
pleme-computeunit library chart’s identity sidecar, the
caixa-operator’s pod-mutating webhook) and runtime label
consumers (Cilium identity-based policy, Hubble flow attribution,
caixa-mesh’s policy / Gateway emission, future
observability/tracing renderers) all spell the same prefix
exactly the same way — drift between any of those = a
CiliumNetworkPolicy that matches no pods, a Hubble flow that
can’t be correlated to its workload, an OpenTelemetry resource
attribute that doesn’t join to its caixa lacre.
Lifted to a const so a future top-level rebrand or multi-tenant label-namespace migration is a one-line edit, not a search-and- replace across every renderer crate.