bootstrap exists to reconcile cluster roles and bindings created at the start.

fluxauth package is responsible for setting up RBAC required by customer-facing Flux, operating in flux-system namespace.