storage

var (
	BucketPoolRequiredUsages = sets.New[certificatesv1.KeyUsage](
		certificatesv1.UsageDigitalSignature,
		certificatesv1.UsageKeyEncipherment,
		certificatesv1.UsageClientAuth,
	)

	// BucketPoolRequiredUsagesNoEncipherment is the usage set for EC keys,
	// which cannot perform key encipherment. Poollets generate ECDSA keys,
	// so their CSRs always carry this usage set.
	BucketPoolRequiredUsagesNoEncipherment = sets.New[certificatesv1.KeyUsage](
		certificatesv1.UsageDigitalSignature,
		certificatesv1.UsageClientAuth,
	)
)

var (
	VolumePoolRequiredUsages = sets.New[certificatesv1.KeyUsage](
		certificatesv1.UsageDigitalSignature,
		certificatesv1.UsageKeyEncipherment,
		certificatesv1.UsageClientAuth,
	)

	// VolumePoolRequiredUsagesNoEncipherment is the usage set for EC keys,
	// which cannot perform key encipherment. Poollets generate ECDSA keys,
	// so their CSRs always carry this usage set.
	VolumePoolRequiredUsagesNoEncipherment = sets.New[certificatesv1.KeyUsage](
		certificatesv1.UsageDigitalSignature,
		certificatesv1.UsageClientAuth,
	)
)

var (
	BucketPoolRecognizer = generic.NewCertificateSigningRequestRecognizer(
		IsBucketPoolClientCert,
		authorizationv1.ResourceAttributes{
			Group:       certificatesv1.GroupName,
			Resource:    "certificatesigningrequests",
			Verb:        "create",
			Subresource: "bucketpoolclient",
		},
		"Auto approving bucket pool client certificate after SubjectAccessReview.",
	)
)

var Recognizers []generic.CertificateSigningRequestRecognizer

var (
	VolumePoolRecognizer = generic.NewCertificateSigningRequestRecognizer(
		IsVolumePoolClientCert,
		authorizationv1.ResourceAttributes{
			Group:       certificatesv1.GroupName,
			Resource:    "certificatesigningrequests",
			Verb:        "create",
			Subresource: "volumepoolclient",
		},
		"Auto approving volume pool client certificate after SubjectAccessReview.",
	)
)