cmd

type ControllerConfig struct {
	manager.Config

	// MeshConfigMapName is the name of the ConfigMap the reconciler projects each
	// namespace's MeshConfig into. The namespace is the MeshConfig CR's own namespace
	// (co-located), so there is no namespace setting.
	MeshConfigMapName string

	// SpireEnabled serves the validating webhook with a SPIRE-issued X.509 SVID
	// (via the Workload API) instead of the Helm self-signed cert, and injects the
	// SPIRE trust bundle into the webhook's caBundle. The SPIRE registration entry
	// for the controller must carry the webhook Service DNS name as a DNS SAN.
	SpireEnabled bool
	// SpireWorkloadSocketPath is the SPIRE Workload API UDS socket path.
	SpireWorkloadSocketPath string

	// WebhookConfigName is the ValidatingWebhookConfiguration whose caBundle the
	// controller patches with the SPIRE trust bundle (SPIRE mode only).
	WebhookConfigName string
	// MutatingWebhookConfigName is the MutatingWebhookConfiguration (pod ndots
	// injection) whose caBundle the controller patches with the SPIRE trust bundle
	// (SPIRE mode only). Empty disables that patch.
	MutatingWebhookConfigName string

	// MeshDomain is the DNS-style domain mesh authorities live under. The
	// pod-mutating webhook derives the dnsConfig ndots it injects into managed
	// pods from it (= the domain's label count; 2 for aether.internal), so mesh
	// FQDNs resolve absolute-first and musl clients stop tripping on the
	// cluster.local search list. Deriving replaces the old --pod-ndots flag,
	// which could drift from the domain it described.
	MeshDomain string
}