controllers

const (
	// RepoSyncClusterScopeClusterRoleName is the name of the ClusterRole with
	// cluster-scoped read permissions for the namespace reconciler.
	// e.g. configsync.gke.io:ns-reconciler:cluster-scope
	RepoSyncClusterScopeClusterRoleName = configsync.GroupName + ":" + core.NsReconcilerPrefix + ":cluster-scope"
	// RepoSyncBaseClusterRoleName is the namespace reconciler permissions name.
	// e.g. configsync.gke.io:ns-reconciler
	RepoSyncBaseClusterRoleName = configsync.GroupName + ":" + core.NsReconcilerPrefix
	// RootSyncBaseClusterRoleName is the root reconciler base ClusterRole name.
	// e.g. configsync.gke.io:root-reconciler
	RootSyncBaseClusterRoleName = configsync.GroupName + ":" + core.RootReconcilerPrefix
	// RepoSyncClusterScopeClusterRoleBindingName is the name of the default
	// ClusterRoleBinding created for RepoSync objects. This contains basic
	// cluster-scoped permissions for RepoSync reconcilers
	// (e.g. CustomResourceDefinition watch).
	RepoSyncClusterScopeClusterRoleBindingName = RepoSyncClusterScopeClusterRoleName
	// RepoSyncBaseRoleBindingName is the name of the default RoleBinding created
	// for RepoSync objects. This contains basic namespace-scoped permissions
	// for RepoSync reconcilers
	// (e.g. RepoSync status update).
	RepoSyncBaseRoleBindingName = RepoSyncBaseClusterRoleName
	// RootSyncLegacyClusterRoleBindingName is the name of the legacy ClusterRoleBinding created
	// for RootSync objects. It is always bound to cluster-admin.
	RootSyncLegacyClusterRoleBindingName = RootSyncBaseClusterRoleName
	// RootSyncBaseClusterRoleBindingName is the name of the default ClusterRoleBinding created
	// for RootSync objects. This contains basic permissions for RootSync reconcilers
	// (e.g. RootSync status update).
	RootSyncBaseClusterRoleBindingName = RootSyncBaseClusterRoleName + "-base"
)

const (
	// GitSecretConfigKeySSH is the key at which an ssh cert is stored
	GitSecretConfigKeySSH = "ssh"
	// GitSecretConfigKeyCookieFile is the key at which the git cookiefile is stored
	GitSecretConfigKeyCookieFile = "cookie_file"
	// GitSecretConfigKeyToken is the key at which a token's value is stored
	GitSecretConfigKeyToken = "token"
	// GitSecretConfigKeyTokenUsername is the key at which a token's username is stored
	GitSecretConfigKeyTokenUsername = "username"

	// GitSecretGithubAppPrivateKey is the key at which the githubapp private key is stored
	GitSecretGithubAppPrivateKey = "github-app-private-key"
	// GitSecretGithubAppInstallationID is the key at which the githubapp installation id is stored
	GitSecretGithubAppInstallationID = "github-app-installation-id"
	// GitSecretGithubAppApplicationID is the key at which the githubapp app id is stored
	GitSecretGithubAppApplicationID = reconcilermanager.GitSecretGithubAppApplicationID
	// GitSecretGithubAppClientID is the key at which the githubapp client id is stored
	GitSecretGithubAppClientID = reconcilermanager.GitSecretGithubAppClientID
	// GitSecretGithubAppBaseURL is the key at which the optional githubapp base url is stored
	GitSecretGithubAppBaseURL = "github-app-base-url"
)

const (
	// HelmSecretKeyPassword is the key at which a token's value is stored
	HelmSecretKeyPassword = "password"
	// HelmSecretKeyUsername is the key at which a token's username is stored
	HelmSecretKeyUsername = "username"
)

const (
	// OperationCreate is the create operation
	OperationCreate = Operation("create")
	// OperationUpdate is the update operation
	OperationUpdate = Operation("update")
	// OperationPatch is the patch operation
	OperationPatch = Operation("patch")
	// OperationDelete is the delete operation
	OperationDelete = Operation("delete")
	// OperationGet is the get operation
	OperationGet = Operation("get")
	// OperationList is the list operation
	OperationList = Operation("list")
	// OperationWatch is the watch operation
	OperationWatch = Operation("watch")
)

const (

	// GitSyncRepo represents the environment variable key for specifying the Git repository to sync.
	GitSyncRepo = "GITSYNC_REPO"

	// GitSyncDepth represents the environment variable key for setting the depth of the Git clone, truncating history to a specific number of commits.
	GitSyncDepth = "GITSYNC_DEPTH"

	// GitSSLCAInfo represents the environment variable key for SSL certificates.
	GitSSLCAInfo = "GIT_SSL_CAINFO"

	// GitSyncKnownHosts represents the environment variable key for GIT_KNOWN_HOSTS.
	GitSyncKnownHosts = "GITSYNC_SSH_KNOWN_HOSTS"
	// GitSSLNoVerify represents the environment variable key for GIT_SSL_NO_VERIFY.
	GitSSLNoVerify = "GIT_SSL_NO_VERIFY"

	// GithubAppBaseURL is an optional parameter to override the GitHub api endpoint
	GithubAppBaseURL = "GITSYNC_GITHUB_BASE_URL"
	// GithubAppPrivateKey is the private key used for GitHub App authentication
	GithubAppPrivateKey = "GITSYNC_GITHUB_APP_PRIVATE_KEY"
	// GithubAppClientID is the client id used for GitHub App authentication
	GithubAppClientID = "GITSYNC_GITHUB_APP_CLIENT_ID"
	// GithubAppApplicationID is the app id used for GitHub App authentication
	GithubAppApplicationID = "GITSYNC_GITHUB_APP_APPLICATION_ID"
	// GithubAppInstallationID is the installation id used for GitHub App authentication
	GithubAppInstallationID = "GITSYNC_GITHUB_APP_INSTALLATION_ID"

	// DefaultSyncRev is the default git revision.
	DefaultSyncRev = "HEAD"
	// DefaultSyncBranch is the default git branch.
	DefaultSyncBranch = "master"
	// DefaultSyncDir is the default sync directory.
	DefaultSyncDir = "."
	// DefaultSyncWaitSecs is the default wait seconds.
	DefaultSyncWaitSecs = 15
	// SyncDepthNoRev is the default git depth if syncing with default sync revision (`HEAD`).
	SyncDepthNoRev = "1"
	// SyncDepthRev is the default git depth if syncing with a specific sync revision (tag or hash).
	SyncDepthRev = "500"
	// KnownHostsKey is the key for known_hosts information
	KnownHostsKey = "known_hosts"
)

const (
	// ReconcilerTemplateConfigMapKey is the key used to specify the reconciler
	// deployment template in the "reconciler-manager-cm" ConfigMap.
	// Defined in configmap manifests/templates/reconciler-manager-configmap.yaml
	ReconcilerTemplateConfigMapKey = "deployment.yaml"

	// ReconcilerTemplateConfigMapName is the name of the ConfigMap used to
	// specify the reconciler deployment template.
	// Defined in configmap manifests/templates/reconciler-manager-configmap.yaml
	ReconcilerTemplateConfigMapName = "reconciler-manager-cm"
)

const (
	// RootReconcilerType defines the type for a root reconciler
	RootReconcilerType = ReconcilerType("root")
	// NamespaceReconcilerType defines the type for a namespace reconciler
	NamespaceReconcilerType = ReconcilerType("namespace")
)

const CACertPath = "/etc/ca-cert"

const CACertSecretKey = "cert"

const CACertVolume = "ca-cert"

const (
	// GCPSAAnnotationKey is used to annotate the following service accounts:
	// 1) the RepoSync/RootSync controller SA when
	// spec.git.auth: gcpserviceaccount is used with Workload Identity enabled on a
	// GKE cluster.
	// https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
	// 2) the `default` SA in the `config-management-monitoring` namespace, which
	// is used by the `otel-collector` Deployment. Adding this annotation allows
	// the `otel-collector` Deployment to impersonate GCP service accounts to
	// export metrics to Cloud Monitoring and Cloud Monarch on a GKE cluster with
	// Workload Identity eanbled.
	GCPSAAnnotationKey = "iam.gke.io/gcp-service-account"
)

const GitCredentialVolume = "git-creds"

const HelmCredentialVolume = "helm-creds"

const (

	// OtelSALoggerName defines the logger name for OtelSAReconciler
	OtelSALoggerName = "OtelSA"
)