compute

var (
	MachinePoolRequiredUsages = sets.New[certificatesv1.KeyUsage](
		certificatesv1.UsageDigitalSignature,
		certificatesv1.UsageKeyEncipherment,
		certificatesv1.UsageClientAuth,
	)

	// MachinePoolRequiredUsagesNoEncipherment is the usage set for EC keys,
	// which cannot perform key encipherment. Poollets generate ECDSA keys,
	// so their CSRs always carry this usage set.
	MachinePoolRequiredUsagesNoEncipherment = sets.New[certificatesv1.KeyUsage](
		certificatesv1.UsageDigitalSignature,
		certificatesv1.UsageClientAuth,
	)
)

var (
	MachinePoolRecognizer = generic.NewCertificateSigningRequestRecognizer(
		IsMachinePoolClientCert,
		authorizationv1.ResourceAttributes{
			Group:       certificatesv1.GroupName,
			Resource:    "certificatesigningrequests",
			Verb:        "create",
			Subresource: "machinepoolclient",
		},
		"Auto approving machine pool client certificate after SubjectAccessReview.",
	)
)

var (
	PoolLifecycleControllerRecognizer = generic.NewCertificateSigningRequestRecognizer(
		IsPoolLifecycleControllerClientCert,
		authorizationv1.ResourceAttributes{
			Group:       certificatesv1.GroupName,
			Resource:    "certificatesigningrequests",
			Verb:        "create",
			Subresource: "poollifecycleclient",
		},
		"Auto approving pool-lifecycle-controller client certificate after SubjectAccessReview.",
	)
)

var PoolLifecycleControllerRequiredUsages = sets.New[certificatesv1.KeyUsage](
	certificatesv1.UsageDigitalSignature,
	certificatesv1.UsageKeyEncipherment,
	certificatesv1.UsageClientAuth,
)

var PoolLifecycleControllerRequiredUsagesNoEncipherment = sets.New[certificatesv1.KeyUsage](
	certificatesv1.UsageDigitalSignature,
	certificatesv1.UsageClientAuth,
)

var Recognizers []generic.CertificateSigningRequestRecognizer