version

var (
	StratumVersion = "v0.0.0-dev"
	// BuildID is the source this binary was built from (tools/build-id.sh):
	// the commit, plus a hash of any uncommitted change. Unlike StratumVersion,
	// which every untagged commit before a release shares, it tells two builds
	// apart -- and unlike a content hash it is the same on every architecture.
	BuildID     = "unknown"
	K8sVersion  = "unknown"
	EtcdVersion = "unknown"

	// The five payload component versions `version --components` reports. They
	// are stamped here, not as main-package vars handed to pkg/cli through
	// WithComponentVersions, so the report does not depend on main-package
	// wiring a downstream build does not have; WithComponentVersions remains
	// the (deprecated) per-field override. Unstamped builds report "unknown",
	// like every stamp above.
	ContainerdVersion = "unknown"
	RuncVersion       = "unknown"
	KubeVipVersion    = "unknown"
	CiliumVersion     = "unknown"
	CorednsVersion    = "unknown"

	// NsenterImage is the image for the node Jobs that nsenter into PID 1 to do
	// host-side work (CA rotation, cluster upgrade). It MUST be an image the
	// airgap payload carries — those Jobs run on clusters with no registry, so
	// anything not in build/images.txt is an ImagePullBackOff mid-rotation. It is
	// stamped rather than written here so a Renovate bump to the pin can't leave
	// a stale tag behind in Go. The name is the mirrored one (tools/mirror-images.sh),
	// which is what `make images` registers in the payload. Unstamped builds get
	// an unresolvable tag on purpose, matching addons.CorednsVersion.
	NsenterImage = "ghcr.io/ctrliq/stratum/busybox:unknown"

	// Control-plane static pod images. Same stamping contract as
	// NsenterImage: mirrored names from the payload, tags derived from the pin
	// manifest at link time, unresolvable on purpose in unstamped builds.
	EtcdImage                  = "ghcr.io/ctrliq/stratum/etcd:unknown"
	KubeAPIServerImage         = "ghcr.io/ctrliq/stratum/kube-apiserver:unknown"
	KubeControllerManagerImage = "ghcr.io/ctrliq/stratum/kube-controller-manager:unknown"
	KubeSchedulerImage         = "ghcr.io/ctrliq/stratum/kube-scheduler:unknown"
	KubeVipImage               = "ghcr.io/ctrliq/stratum/kube-vip:unknown"
)

var (
	ConfDir             = "/etc/stratum"
	DataDir             = "/var/lib/stratum"
	RunDir              = "/run/stratum"
	StartLockPath       string
	NodeUpgradeLockPath string
	PKIDir              string
	KubeconfigDir       string
	// UpgradeStageDir is where an operator stages upgrade binaries. A cluster
	// upgrade started through MCP runs only a binary staged here.
	UpgradeStageDir string
	// DefaultRoot is where the payload is staged: binaries land in
	// DefaultRoot/bin, images in DefaultRoot/images. It is the data root
	// itself; internal/assets.DefaultRoot is the same path under its earlier
	// name, kept for its existing callers.
	DefaultRoot string
	// StageDir is where a node upgrade stages the incoming payload before the
	// swap, under the upgrade staging dir. It is the one home of that path:
	// internal/upgrade resolves it at each extract, and a test redirects it
	// through SetRoots like any other derived path.
	StageDir            string
	BootstrapKubeconfig string
	K8sConfDir          string
	// CoreDNSUpstreamDir holds the resolv.conf CoreDNS forwards through,
	// mounted into its pods.
	CoreDNSUpstreamDir string
	AdminConf          string
	BinDir             string
	// StratumInstallPath is where the stratum binary itself is installed: the
	// documented install location, where an upgrade installs it, and the one
	// path every node is known to have. BinDir holds the payload's binaries
	// (kubelet, containerd, ...), never stratum, so a node Job must not exec
	// stratum from there. It sits outside the three roots — it is not
	// stratum's data — so uninstall removes it as its own special target and
	// SetRoots never moves it.
	StratumInstallPath = "/usr/local/bin/stratum"
	LogDir             string
	ControlSocket      string
	EtcdDataDir        string
	// ManifestsDir holds cluster manifests the stratum operator watches (HelmChart
	// CRs etc.); HelmCacheDir is the operator's Helm repo/chart cache.
	ManifestsDir string
	HelmCacheDir string
	// LegacyHelmCacheDir is where releases before the data-dir layout kept the
	// operator's helm cache: the administrator-owned repositories.yaml (named
	// repositories, credentials, TLS file paths) and the cached repo indexes a
	// named-repository fetch consults. Nothing writes it anymore: the operator
	// migrates it into HelmCacheDir on first use, and uninstall removes the
	// leftover on a node brought up by such a release.
	LegacyHelmCacheDir = "/var/lib/stratum-helm"

	// ContainerdConfig is stratum's own containerd config. It lives under the
	// stratum data dir (K8sConfDir) rather than the host's
	// /etc/containerd/config.toml: writing the host path clobbered a distro
	// containerd's config with a version=4 file its older (<=v2.2) containerd
	// could not parse, crash-looping it — and Docker with it — after a reboot,
	// and uninstall never restored it. A stratum-owned path leaves
	// /etc/containerd alone and is removed automatically with DataDir.
	ContainerdConfig string
	// ContainerdRootDir / ContainerdStateDir are where stratum points containerd's
	// root and state (away from the distro defaults, onto the stratum layout so a
	// distro containerd on the same host does not collide). These are the SINGLE
	// source for the two values that both ensureConfig writes and isStratumConfig
	// matches on: the legacy-config heal deletes /etc/containerd/config.toml only when a
	// file carries both, so producer and matcher must never drift apart.
	ContainerdRootDir  string
	ContainerdStateDir string

	// A hardened node profile's config files (written by internal/profilefiles,
	// the shared secret by internal/cluster).
	// EncryptionConfig is 0600 (holds the at-rest key) and is shared across CPs
	// via the stratum-certs channel. The audit log paths are the CIS-adjacent
	// paths OUTSIDE the roots — /var/log/stratum is host log territory — so
	// uninstall removes them as its own special targets and SetRoots never
	// moves them.
	AuditPolicyPath     string
	AuditLogDir         = "/var/log/stratum"
	AuditLogPath        = "/var/log/stratum/audit.log"
	AdmissionConfigPath string
	// The admission file every apiserver reads — which the render derives
	// from AdmissionConfigPath on every write — has no var here on purpose,
	// unlike its authoring config above. Its location is K8sConfDir's, so it
	// resolves at each call through AdmissionWebhookConfig below, exactly as
	// the render resolves the file it writes; an init-frozen copy beside the
	// CIS paths would name a file the render never wrote whenever the
	// directory differs — and it is used (the upgrade's profile config
	// backup, upgrade.profileConfigPaths, names this location),
	// so one resolution must serve writer, argv and rollback set. The config
	// directory redirects here already carry the derived files with it.
	// EncryptionConfigPath lives UNDER PKIDir (it holds the at-rest key) so it
	// rides the existing PKIDir-relative shared-cert channel to every HA CP.
	EncryptionConfigPath string

	// Registry mirroring (internal/registry): a per-node RKE2-compatible
	// registries.yaml is translated into containerd's certs.d. ContainerdConfD
	// sets config_path via containerd's default conf.d import; CertsDir holds the
	// per-registry hosts.toml (some 0600 when they embed a credential header).
	RegistriesConfig string
	CertsDir         = "/etc/containerd/certs.d"
	ContainerdConfD  = "/etc/containerd/conf.d/stratum-registry.toml"

	// NetConfigPath persists the cluster's effective pod/service CIDRs (chosen at
	// cluster-init) so HA joins and cert rotation inherit the exact same values
	// (incl. IPv6 families under dual-stack). Lives UNDER PKIDir so it rides the
	// existing PKIDir-relative stratum-certs channel to every HA CP (as
	// encryption-config.yaml does); it is not a secret.
	NetConfigPath string

	// CiliumSettingsPath holds the cluster's spec.network.cilium settings when
	// they differ from the shipped ones. Like NetConfigPath it lives under
	// PKIDir so it rides the stratum-certs channel to a joining control plane,
	// which refuses to join with different settings; it is not a secret.
	CiliumSettingsPath string

	// The host files bring-up writes outside the three roots:
	// ModulesLoadFile persists the kernel module list (overlay, br_netfilter)
	// across reboots, SysctlConf is the pod-networking and inotify sysctl
	// file written on every node, and SysctlCISConf is the CIS node-sysctl
	// file written under --cis. Like SystemdUnitPath they are host state, not
	// stratum's data: they sit outside the three roots, SetRoots never moves
	// them, and uninstall removes them as its own special targets. This is
	// the one home — internal/host writes and loads them through these
	// variables, host.Footprint returns them, and the owning-package record
	// keys internal/host's entries through them — so the writer, the sysctl
	// loader and uninstall's delete list cannot drift apart. They live here,
	// not in internal/host, because the owning-package record lives here and
	// internal/host imports this package, never the reverse.
	ModulesLoadFile = "/etc/modules-load.d/k8s.conf"
	SysctlConf      = "/etc/sysctl.d/99-stratum.conf"
	SysctlCISConf   = "/etc/sysctl.d/99-stratum-cis.conf"

	// SystemdUnitPath is the reboot-persistence unit `stratum up` installs on
	// every bring-up and `stratum uninstall` removes: the layer the
	// in-process supervisor never covered, because nothing else restarted the
	// supervisor's OWN process after a reboot. Like the other literals above
	// it sits outside the three roots and never moves with them.
	SystemdUnitPath = "/etc/systemd/system/stratum.service"
)

var ControllerManagerManifest string

var NodeFileOwners map[string]string