kubecontrollers

const (
	KubeController                  = "calico-kube-controllers"
	KubeControllerServiceAccount    = "calico-kube-controllers"
	KubeControllerRole              = "calico-kube-controllers"
	KubeControllerRoleBinding       = "calico-kube-controllers"
	KubeControllerMetrics           = "calico-kube-controllers-metrics"
	KubeControllerNetworkPolicyName = networkpolicy.CalicoComponentPolicyPrefix + "kube-controller-access"

	// WASMPullSecretName is the dedicated image-pull Secret (a renamed copy of
	// the install pull secret) that the WAF reconciler replicates into tenant
	// namespaces for the Coraza wasm OCI pull. A dedicated name avoids clashing
	// with the operator-managed tigera-pull-secret the GatewayAPI render also
	// copies into those namespaces (EV-6386).
	WASMPullSecretName = "tigera-waf-pull-secret"

	// WASMCACertName is the dedicated CA-bundle ConfigMap (in the controller
	// namespace) the WAF reconciler replicates into tenant namespaces for the
	// Coraza wasm OCI registry TLS check — a dedicated name avoids clashing with
	// the operator-managed tigera-ca-bundle ConfigMap the GatewayAPI render also
	// copies there (EV-6386). The source copy is a renamed copy of the trusted
	// bundle, provisioned by the core controller and passed in as WASMCACert.
	WASMCACertName = "tigera-waf-ca-bundle"

	EsKubeController                    = "es-calico-kube-controllers"
	EsKubeControllerRole                = "es-calico-kube-controllers"
	EsKubeControllerRoleBinding         = "es-calico-kube-controllers"
	EsKubeControllerMetrics             = "es-calico-kube-controllers-metrics"
	EsKubeControllerNetworkPolicyName   = networkpolicy.CalicoComponentPolicyPrefix + "es-kube-controller-access"
	ManagedClustersWatchRoleBindingName = "es-calico-kube-controllers-managed-cluster-watch"

	ElasticsearchKubeControllersUserSecret             = "tigera-ee-kube-controllers-elasticsearch-access"
	ElasticsearchKubeControllersUserName               = "tigera-ee-kube-controllers"
	ElasticsearchKubeControllersSecureUserSecret       = "tigera-ee-kube-controllers-elasticsearch-access-gateway"
	ElasticsearchKubeControllersVerificationUserSecret = "tigera-ee-kube-controllers-gateway-verification-credentials"
	KubeControllerPrometheusTLSSecret                  = "calico-kube-controllers-metrics-tls"

	// KubeControllersHealthPort is the port the kube-controllers HealthAggregator listens on when run from the
	// combined calico binary. The legacy per-component image uses file-based health checks instead.
	KubeControllersHealthPort = 9440
)

const (
	MigrationClusterRoleName = "calico-kube-controllers-migration"
)