render

const (
	APIServerPort       = 5443
	APIServerPortName   = "apiserver"
	APIServerPolicyName = networkpolicy.CalicoComponentPolicyPrefix + "apiserver-access"

	TieredPolicyPassthruClusterRoleName = "calico-tiered-policy-passthrough"

	// APIServiceName is the aggregated APIService that fronts the projectcalico.org/v3 API group.
	APIServiceName = "v3.projectcalico.org"
)

const (
	APIServerResourceName  = "apiserver"
	APIServerNamespace     = common.CalicoNamespace
	QueryServerPort        = 8080
	QueryServerPortName    = "queryserver"
	QueryserverNamespace   = "calico-system"
	QueryserverServiceName = "calico-api"

	// Use the same API server container name for both OSS and Enterprise.
	APIServerName                           = "calico-apiserver"
	APIServerContainerName                  = "calico-apiserver"
	TigeraAPIServerQueryServerContainerName = "tigera-queryserver"

	CalicoAPIServerTLSSecretName = "calico-apiserver-certs"
	APIServerServiceName         = "calico-api"
	APIServerServiceAccountName  = "calico-apiserver"

	APIServerSecretsRBACName                        = "calico-extension-apiserver-secrets-access"
	MultiTenantManagedClustersAccessClusterRoleName = "calico-managed-cluster-access"
	ManagedClustersWatchClusterRoleName             = "calico-managed-cluster-watch"
	L7AdmissionControllerContainerName              = "calico-l7-admission-controller"
	L7AdmissionControllerPort                       = 6443
	L7AdmissionControllerPortName                   = "l7admctrl"
)

const (
	ComponentNameNode = "node"

	// ComponentNameCNIPlugins keys the upstream CNI plugins image. The node
	// component renders the cni-plugins init container, so the image resolves
	// through its own override key.
	ComponentNameCNIPlugins = "cni-plugins"

	// The two windows images get their own keys, since one component renders both.
	ComponentNameWindowsNodeImg = "windows-node-image"
	ComponentNameWindowsCNIImg  = "windows-cni-image"

	ComponentNameKubeControllers = "kube-controllers"
)

const (
	CSIDriverName             = "csi.tigera.io"
	CSIDaemonSetName          = "csi-node-driver"
	CSIDaemonSetNamespace     = "calico-system"
	CSIContainerName          = "calico-csi"
	CSIRegistrarContainerName = "csi-node-driver-registrar"
)

const (
	DexNamespace     = "tigera-dex"
	DexObjectName    = "tigera-dex"
	DexPort          = 5556
	DexTLSSecretName = "tigera-dex-tls"
	DexClientId      = "tigera-manager"
	DexPolicyName    = networkpolicy.CalicoComponentPolicyPrefix + "dex"

	// TigeraCAPublicSecretName holds a copy of the operator's CA certificate (from tigera-ca-private)
	// in calico-system. It exists so that an OpenShift Ingress fronting the manager can reference it
	// via the destination-CA-certificate annotation on a reencrypt route. Only rendered when the
	// Authentication CR is configured to use the OpenShift IDP.
	TigeraCAPublicSecretName = "tigera-ca-public"
)

const (
	ClientSecretSecretField = "clientSecret"

	RootCASecretField           = "rootCA"
	OIDCSecretName              = "tigera-oidc-credentials"
	OIDCSecretProviderClassName = "tigera-oidc-credentials"
	OpenshiftSecretName         = "tigera-openshift-credentials"
	LDAPSecretName              = "tigera-ldap-credentials"

	ClientIDSecretField = "clientID"
	BindDNSecretField   = "bindDN"
	BindPWSecretField   = "bindPW"

	// Default claims to use to data from a JWT.
	DefaultGroupsClaim = "groups"
)

const (
	// OperatorCompleteFinalizer is applied by the core controller as part of Installation defaulting to ensure it can
	// clean up resources if the Installation is ever deleted. This Finalizer is only removed after all operator
	// finalization logic has completed.
	OperatorCompleteFinalizer = "tigera.io/operator-cleanup"

	// APIServerFinalizer is added to the Installation by the API server controller when installing the API server so that
	// Calico CNI resources are not removed until the API server controller has had time to properly tear down pods.
	APIServerFinalizer = "operator.tigera.io/apiserver-controller"

	// InstallationControllerFinalizer is added to the Installation by the core Installation controller when installing Calico
	// so that Calico CNI resources are not removed until calico-kube-controllers has had time to properly be torn down.
	InstallationControllerFinalizer = "operator.tigera.io/installation-controller"

	// WhiskerFinalizer is added to the Installation by the whisker controller when the whisker CR is created so that
	// Calico CNI resources are not removed until the whisker controller has had time to properly delete the whisker deployment.
	WhiskerFinalizer = "operator.tigera.io/whisker-controller"

	// GuardianFinalizer is added to the Installation by the cluster connection controller when the management cluster connection CR
	//  is created so that Calico CNI resources are not removed until the controller has had time to properly delete the guardian deployment.
	GuardianFinalizer = "operator.tigera.io/guardian-controller"

	// GoldmaneFinalizer is added to the Installation by the goldmane controller when the goldmane CR is created so that
	// Calico CNI resources are not removed until the goldmane controller has had time to properly delete the goldmane deployment.
	GoldmaneFinalizer = "operator.tigera.io/goldmane-controller"

	// GatewayAPIFinalizer is added to the Installation by the GatewayAPI controller when installing the Gateway API so that
	// Calico CNI resources are not removed until the GatewayAPI Deployment has had time to properly tear down pods.
	GatewayAPIFinalizer = "operator.tigera.io/gatewayapi-controller"
)

const (
	GuardianName                   = "guardian"
	GuardianNamespace              = common.CalicoNamespace
	GuardianServiceAccountName     = GuardianName
	GuardianClusterRoleName        = "calico-guardian"
	GuardianClusterRoleBindingName = "calico-guardian"
	GuardianDeploymentName         = GuardianName

	// GuardianContainerName name is the name of the container running guardian. It's named `tigera-guardian`, instead
	// of `guardian` so that the API for the container overrides don't have to change (`tigera-guardian` is a legacy name).
	GuardianContainerName = "tigera-guardian"
	GuardianServiceName   = "guardian"
	GuardianVolumeName    = "guardian-certs"
	GuardianSecretName    = "tigera-managed-cluster-connection"
	GuardianTargetPort    = 8080
	GuardianPolicyName    = networkpolicy.CalicoComponentPolicyPrefix + "guardian-access"
	GuardianKeyPairSecret = "guardian-key-pair"

	GoldmaneDeploymentName         = "goldmane"
	GuardianSecretsRole            = "calico-guardian-secrets"
	GuardianSecretsRoleBindingName = "calico-guardian-secrets"
)

const (
	IntrusionDetectionNamespace = "tigera-intrusion-detection"
	IntrusionDetectionName      = "intrusion-detection-controller"

	ElasticsearchIntrusionDetectionUserSecret    = "tigera-ee-intrusion-detection-elasticsearch-access"
	ElasticsearchIntrusionDetectionJobUserSecret = "tigera-ee-installer-elasticsearch-access"
	ElasticsearchPerformanceHotspotsUserSecret   = "tigera-ee-performance-hotspots-elasticsearch-access"

	IntrusionDetectionInstallerJobName                     = "intrusion-detection-es-job-installer"
	IntrusionDetectionControllerName                       = "intrusion-detection-controller"
	IntrusionDetectionControllerPolicyName                 = networkpolicy.CalicoComponentPolicyPrefix + IntrusionDetectionControllerName
	IntrusionDetectionInstallerPolicyName                  = networkpolicy.CalicoComponentPolicyPrefix + "intrusion-detection-elastic"
	MultiTenantManagedClustersAccessClusterRoleBindingName = "tigera-intrusion-detection-managed-cluster-access"
	IntrusionDetectionManagedClustersWatchRoleBindingName  = "tigera-intrusion-detection-managed-cluster-watch"

	ADAPIObjectName                 = "anomaly-detection-api"
	IntrusionDetectionTLSSecretName = "intrusion-detection-tls"
	DPITLSSecretName                = "deep-packet-inspection-tls"
	ADAPIPolicyName                 = networkpolicy.CalicoComponentPolicyPrefix + ADAPIObjectName

	ADPersistentVolumeClaimName = "tigera-anomaly-detection"
	ADJobPodTemplateBaseName    = "tigera.io.detectors"

	ADDetectorPolicyName = networkpolicy.CalicoComponentPolicyPrefix + adDetectorName
)

const (
	LogCollectorNamespace = "calico-system"

	// FluentBitNodeName / FluentBitNodeWindowsName are the k8s-app label values of the
	// fluent-bit DaemonSet pods, used to select them as a NetworkPolicy source.
	FluentBitNodeName        = "calico-fluent-bit"
	FluentBitNodeWindowsName = "calico-fluent-bit-windows"

	// FluentBitInputService is the Service fronting fluent-bit's HTTP input, which
	// Manager/Voltron egresses to when forwarding non-cluster-host logs.
	FluentBitInputService = "calico-fluent-bit-http-input"

	EKSLogForwarderName = "eks-log-forwarder"

	// SplunkFluentBitSecretCertificateKey is the key under which the Splunk CA cert is
	// mounted; the shared TrustedBundleVolume below also exposes the trusted bundle at
	// this path, so it lives here alongside that helper.
	SplunkFluentBitSecretCertificateKey = "ca.pem"

	// Linseed token volume mounting constants, shared by several components
	// (compliance, apiserver, intrusion detection, policy recommendation, fluent-bit).
	LinseedTokenVolumeName = "linseed-token"
	LinseedTokenKey        = "token"
	LinseedTokenSubPath    = "token"
	LinseedTokenSecret     = "%s-tigera-linseed-token"
	LinseedVolumeMountPath = "/var/run/secrets/tigera.io/linseed/"
	LinseedTokenPath       = "/var/run/secrets/tigera.io/linseed/token"
)

const (
	ElasticsearchObjectName = "tigera-elasticsearch"
	ElasticsearchNamespace  = ElasticsearchObjectName

	// TigeraLinseedSecret is the name of the secret that holds the TLS key pair mounted into Linseed.
	// The secret contains server key and certificate.
	TigeraLinseedSecret = "tigera-secure-linseed-cert"

	// TigeraLinseedSecretsClusterRole is the name of the ClusterRole used to make RoleBindings in namespaces where Linseed
	// needs to be able to manipulate secrets
	TigeraLinseedSecretsClusterRole = "tigera-linseed-secrets"

	// TigeraLinseedTokenSecret is the name of the secret that holds the access token signing key for Linseed.
	TigeraLinseedTokenSecret = "tigera-secure-linseed-token-tls"

	// TigeraElasticsearchGatewaySecret is the TLS key pair that is mounted by Elasticsearch gateway.
	TigeraElasticsearchGatewaySecret = "tigera-secure-elasticsearch-cert"

	// TigeraElasticsearchInternalCertSecret is the TLS key pair that is mounted by the Elasticsearch pods.
	TigeraElasticsearchInternalCertSecret = "tigera-secure-internal-elasticsearch-cert"

	// Linseed vars.
	LinseedServiceName = "tigera-linseed"

	ElasticsearchName               = "tigera-secure"
	ElasticsearchServiceName        = "tigera-secure-es-http"
	ESGatewayServiceName            = "tigera-secure-es-gateway-http"
	ElasticsearchDefaultPort        = 9200
	ElasticsearchInternalPort       = 9300
	ElasticsearchAdminUserSecret    = "tigera-secure-es-elastic-user"
	ElasticsearchLinseedUserSecret  = "tigera-ee-linseed-elasticsearch-user-secret"
	ElasticsearchPolicyName         = networkpolicy.CalicoComponentPolicyPrefix + "elasticsearch-access"
	ElasticsearchInternalPolicyName = networkpolicy.CalicoComponentPolicyPrefix + "elasticsearch-internal"

	KibanaBasePath = "tigera-kibana"

	DefaultElasticsearchClusterName = "cluster"
	DefaultElasticsearchReplicas    = 0
	DefaultElasticStorageGi         = 10

	ESCuratorName                  = "elastic-curator"
	EsCuratorServiceAccount        = "tigera-elastic-curator"
	EsCuratorPolicyName            = networkpolicy.CalicoComponentPolicyPrefix + "allow-elastic-curator"
	ElasticsearchCuratorUserSecret = "tigera-ee-curator-elasticsearch-access"

	OIDCUsersConfigMapName = "tigera-known-oidc-users"
	OIDCUsersESSecretName  = "tigera-oidc-users-elasticsearch-credentials"

	ElasticsearchLicenseTypeBasic           ElasticsearchLicenseType = "basic"
	ElasticsearchLicenseTypeEnterprise      ElasticsearchLicenseType = "enterprise"
	ElasticsearchLicenseTypeEnterpriseTrial ElasticsearchLicenseType = "enterprise_trial"
	ElasticsearchLicenseTypeUnknown         ElasticsearchLicenseType = ""

	EsManagerRole        = "es-manager"
	EsManagerRoleBinding = "es-manager"

	CalicoKubeControllerSecret = "calico-kube-controller-secrets"

	ElasticsearchTLSHashAnnotation = "hash.operator.tigera.io/es-secrets"
)

const (
	// Volume that is added by ECK and is overridden if certificate management is used.
	CSRVolumeNameHTTP = "elastic-internal-http-certificates"
	// Volume that is added by ECK and is overridden if certificate management is used.
	CSRVolumeNameTransport = "elastic-internal-transport-certificates"
	// Volume name that is added by ECK for the purpose of mounting certs.
	CAVolumeName = "elasticsearch-certs"
)

const (
	ManagerPort = 9443

	ManagerServiceName          = "calico-manager"
	LegacyManagerServiceName    = "tigera-manager"
	ManagerDeploymentName       = "calico-manager"
	LegacyManagerDeploymentName = "tigera-manager"
	ManagerNamespace            = common.CalicoNamespace
	LegacyManagerNamespace      = "tigera-manager"
	ManagerServiceAccount       = "calico-manager"
	LegacyManagerServiceAccount = "tigera-manager"

	// Default manager RBAC resources.
	ManagerClusterRole              = "calico-manager-role"
	LegacyManagerClusterRole        = "tigera-manager-role"
	ManagerClusterRoleBinding       = "calico-manager-binding"
	LegacyManagerClusterRoleBinding = "tigera-manager-binding"

	// Manager RBAC resources for Calico managed clusters.
	ManagerManagedCalicoClusterRole              = "calico-manager-managed-calico"
	LegacyManagerManagedCalicoClusterRole        = "tigera-manager-managed-calico"
	ManagerManagedCalicoClusterRoleBinding       = "calico-manager-managed-calico"
	LegacyManagerManagedCalicoClusterRoleBinding = "tigera-manager-managed-calico"

	ManagerTLSSecretName         = "manager-tls"
	ManagerInternalTLSSecretName = "internal-manager-tls"
	ManagerPolicyName            = networkpolicy.CalicoComponentPolicyPrefix + "manager-access"
	ManagerPortName              = "https"

	// The name of the TLS certificate used by Voltron to authenticate connections from managed
	// cluster clients talking to Linseed.
	VoltronLinseedTLS              = "calico-voltron-linseed-tls"
	VoltronLinseedPublicCert       = "calico-voltron-linseed-certs-public"
	LegacyVoltronLinseedPublicCert = "tigera-voltron-linseed-certs-public"

	ManagerClusterSettings            = "cluster-settings"
	ManagerUserSettings               = "user-settings"
	ManagerClusterSettingsLayerTigera = "cluster-settings.layer.tigera-infrastructure"
	ManagerClusterSettingsViewDefault = "cluster-settings.view.default"

	ElasticsearchUserHashAnnotation                                     = "hash.operator.tigera.io/elasticsearch-user"
	ManagerMultiTenantManagedClustersAccessClusterRoleBindingName       = "calico-manager-managed-cluster-access"
	LegacyManagerMultiTenantManagedClustersAccessClusterRoleBindingName = "tigera-manager-managed-cluster-access"
	ManagerManagedClustersWatchRoleBindingName                          = "calico-manager-managed-cluster-watch"
	LegacyManagerManagedClustersWatchRoleBindingName                    = "tigera-manager-managed-cluster-watch"
	ManagerManagedClustersUpdateRBACName                                = "calico-manager-managed-cluster-write-access"
	LegacyManagerManagedClustersUpdateRBACName                          = "tigera-manager-managed-cluster-write-access"
)

const (
	ManagerName             = "calico-manager"
	UIAPIsName              = "calico-ui-apis"
	VoltronName             = "calico-voltron"
	VoltronTunnelSecretName = "calico-management-cluster-connection"

	DashboardAPIPort       = "8444"
	DashboardAPIHealthPort = "8090"
	DashboardAPIName       = "calico-dashboard-api"

	// VoltronAdditionalTunnelSecretName is the name of an optional, pre-provisioned secret
	// in the truth namespace that holds an additional CA used by Voltron for tunnel server
	// certificates. When the secret is present the manager controller wires it into the
	// Voltron deployment. It is managed out-of-band; the operator only consumes it.
	VoltronAdditionalTunnelSecretName = "calico-management-additional-cluster-connection"
)

const (
	PSSPrivileged = "privileged"
	PSSBaseline   = "baseline"
	PSSRestricted = "restricted"
)

const (
	BirdTemplatesConfigMapName = "bird-templates"

	BPFOperatorAnnotation = "operator.tigera.io/bpfEnabled"

	DisableKubeProxyKey = "operator.tigera.io/disable-kube-proxy"

	BGPLayoutConfigMapName      = "bgp-layout"
	BGPLayoutConfigMapKey       = "earlyNetworkConfiguration"
	BGPLayoutVolumeName         = "bgp-layout"
	BGPLayoutPath               = "/etc/calico/early-networking.yaml"
	K8sSvcEndpointConfigMapName = "kubernetes-services-endpoint"

	CNIFinalizer = "tigera.io/cni-protector"

	CalicoNodeMetricsService      = "calico-node-metrics"
	NodePrometheusTLSServerSecret = "calico-node-prometheus-server-tls"
	CalicoNodeObjectName          = "calico-node"
	CalicoCNIPluginObjectName     = "calico-cni-plugin"
	BPFVolumeName                 = "bpffs"

	InstallCNIContainerName = "install-cni"
)

const (
	PacketCaptureContainerName          = "tigera-packetcapture-server"
	PacketCaptureName                   = "tigera-packetcapture"
	PacketCaptureNamespace              = PacketCaptureName
	PacketCaptureServiceAccountName     = PacketCaptureName
	PacketCaptureClusterRoleName        = PacketCaptureName
	PacketCaptureClusterRoleBindingName = PacketCaptureName
	// PacketCapturePodExecRole/Binding grant the PacketCapture API pod/exec
	// access in the calico-system namespace. These keep their historical names
	// (previously rendered by the log-collector component) so the move to this
	// component adopts the existing objects in place.
	PacketCapturePodExecRoleName        = "packetcapture-api-role"
	PacketCapturePodExecRoleBindingName = "packetcapture-api-role-binding"
	PacketCaptureDeploymentName         = PacketCaptureName
	PacketCaptureServiceName            = PacketCaptureName
	PacketCapturePolicyName             = networkpolicy.CalicoComponentPolicyPrefix + PacketCaptureName
	PacketCapturePort                   = 8444
	PacketCaptureServerCert             = "tigera-packetcapture-server-tls"
)

const (
	ElasticsearchPolicyRecommendationUserSecret = "tigera-ee-policy-recommendation-elasticsearch-access"

	PolicyRecommendationName       = "tigera-policy-recommendation"
	PolicyRecommendationNamespace  = common.CalicoNamespace
	PolicyRecommendationPolicyName = networkpolicy.CalicoComponentPolicyPrefix + PolicyRecommendationName

	PolicyRecommendationTLSSecretName                                   = "policy-recommendation-tls"
	PolicyRecommendationMultiTenantManagedClustersAccessRoleBindingName = "tigera-policy-recommendation-managed-cluster-access"
	PolicyRecommendationManagedClustersWatchRoleBindingName             = "tigera-policy-recommendation-managed-cluster-watch"
)

const (
	TyphaServiceName              = "calico-typha"
	TyphaPortName                 = "calico-typha"
	TyphaK8sAppName               = "calico-typha"
	TyphaServiceAccountName       = "calico-typha"
	AppLabelName                  = "k8s-app"
	TyphaPort               int32 = 5473
	TyphaMetricsName              = "calico-typha-metrics"

	TyphaContainerName = "calico-typha"

	TyphaClusterRoleName = "calico-typha"

	TyphaNonClusterHostSuffix            = "-noncluster-host"
	TyphaNonClusterHostNetworkPolicyName = networkpolicy.CalicoComponentPolicyPrefix + "typha-noncluster-host-access"
)

const (
	WindowsNodeObjectName     = "calico-node-windows"
	WindowsNodeMetricsService = "calico-node-metrics-windows"

	WindowsInstallCNIContainerName = "install-cni"
	WindowsNodeContainerName       = "node"
	WindowsFelixContainerName      = "felix"
	WindowsConfdContainerName      = "confd"
)

const TigeraAWSSGSetupName = "tigera-aws-security-group-setup"

const (
	TigeraOperatorSecrets = "tigera-operator-secrets"
)