const (
    // KubernetesDir is the directory Kubernetes owns for storing various configuration files
    KubernetesDir = "/etc/kubernetes"
    // ManifestsSubDirName defines directory name to store manifests
    ManifestsSubDirName = "manifests"
    // TempDirForKubeadm defines temporary directory for kubeadm
    // should be joined with KubernetesDir.
    TempDirForKubeadm = "tmp"

    // CertificateValidity defines the validity for all the signed certificates generated by kubeadm
    CertificateValidity = time.Hour * 24 * 365

    // CACertAndKeyBaseName defines certificate authority base name
    CACertAndKeyBaseName = "ca"
    // CACertName defines certificate name
    CACertName = "ca.crt"
    // CAKeyName defines certificate name
    CAKeyName = "ca.key"

    // APIServerCertAndKeyBaseName defines API's server certificate and key base name
    APIServerCertAndKeyBaseName = "apiserver"
    // APIServerCertName defines API's server certificate name
    APIServerCertName = "apiserver.crt"
    // APIServerKeyName defines API's server key name
    APIServerKeyName = "apiserver.key"
    // APIServerCertCommonName defines API's server certificate common name (CN)
    APIServerCertCommonName = "kube-apiserver"

    // APIServerKubeletClientCertAndKeyBaseName defines kubelet client certificate and key base name
    APIServerKubeletClientCertAndKeyBaseName = "apiserver-kubelet-client"
    // APIServerKubeletClientCertName defines kubelet client certificate name
    APIServerKubeletClientCertName = "apiserver-kubelet-client.crt"
    // APIServerKubeletClientKeyName defines kubelet client key name
    APIServerKubeletClientKeyName = "apiserver-kubelet-client.key"
    // APIServerKubeletClientCertCommonName defines kubelet client certificate common name (CN)
    APIServerKubeletClientCertCommonName = "kube-apiserver-kubelet-client"

    // EtcdCACertAndKeyBaseName defines etcd's CA certificate and key base name
    EtcdCACertAndKeyBaseName = "etcd/ca"
    // EtcdCACertName defines etcd's CA certificate name
    EtcdCACertName = "etcd/ca.crt"
    // EtcdCAKeyName defines etcd's CA key name
    EtcdCAKeyName = "etcd/ca.key"

    // EtcdServerCertAndKeyBaseName defines etcd's server certificate and key base name
    EtcdServerCertAndKeyBaseName = "etcd/server"
    // EtcdServerCertName defines etcd's server certificate name
    EtcdServerCertName = "etcd/server.crt"
    // EtcdServerKeyName defines etcd's server key name
    EtcdServerKeyName = "etcd/server.key"

    // EtcdListenClientPort defines the port etcd listen on for client traffic
    EtcdListenClientPort = 2379
    // EtcdMetricsPort is the port at which to obtain etcd metrics and health status
    EtcdMetricsPort = 2381

    // EtcdPeerCertAndKeyBaseName defines etcd's peer certificate and key base name
    EtcdPeerCertAndKeyBaseName = "etcd/peer"
    // EtcdPeerCertName defines etcd's peer certificate name
    EtcdPeerCertName = "etcd/peer.crt"
    // EtcdPeerKeyName defines etcd's peer key name
    EtcdPeerKeyName = "etcd/peer.key"

    // EtcdListenPeerPort defines the port etcd listen on for peer traffic
    EtcdListenPeerPort = 2380

    // EtcdHealthcheckClientCertAndKeyBaseName defines etcd's healthcheck client certificate and key base name
    EtcdHealthcheckClientCertAndKeyBaseName = "etcd/healthcheck-client"
    // EtcdHealthcheckClientCertName defines etcd's healthcheck client certificate name
    EtcdHealthcheckClientCertName = "etcd/healthcheck-client.crt"
    // EtcdHealthcheckClientKeyName defines etcd's healthcheck client key name
    EtcdHealthcheckClientKeyName = "etcd/healthcheck-client.key"
    // EtcdHealthcheckClientCertCommonName defines etcd's healthcheck client certificate common name (CN)
    EtcdHealthcheckClientCertCommonName = "kube-etcd-healthcheck-client"

    // APIServerEtcdClientCertAndKeyBaseName defines apiserver's etcd client certificate and key base name
    APIServerEtcdClientCertAndKeyBaseName = "apiserver-etcd-client"
    // APIServerEtcdClientCertName defines apiserver's etcd client certificate name
    APIServerEtcdClientCertName = "apiserver-etcd-client.crt"
    // APIServerEtcdClientKeyName defines apiserver's etcd client key name
    APIServerEtcdClientKeyName = "apiserver-etcd-client.key"
    // APIServerEtcdClientCertCommonName defines apiserver's etcd client certificate common name (CN)
    APIServerEtcdClientCertCommonName = "kube-apiserver-etcd-client"

    // ServiceAccountKeyBaseName defines SA key base name
    ServiceAccountKeyBaseName = "sa"
    // ServiceAccountPublicKeyName defines SA public key base name
    ServiceAccountPublicKeyName = "sa.pub"
    // ServiceAccountPrivateKeyName defines SA private key base name
    ServiceAccountPrivateKeyName = "sa.key"

    // FrontProxyCACertAndKeyBaseName defines front proxy CA certificate and key base name
    FrontProxyCACertAndKeyBaseName = "front-proxy-ca"
    // FrontProxyCACertName defines front proxy CA certificate name
    FrontProxyCACertName = "front-proxy-ca.crt"
    // FrontProxyCAKeyName defines front proxy CA key name
    FrontProxyCAKeyName = "front-proxy-ca.key"

    // FrontProxyClientCertAndKeyBaseName defines front proxy certificate and key base name
    FrontProxyClientCertAndKeyBaseName = "front-proxy-client"
    // FrontProxyClientCertName defines front proxy certificate name
    FrontProxyClientCertName = "front-proxy-client.crt"
    // FrontProxyClientKeyName defines front proxy key name
    FrontProxyClientKeyName = "front-proxy-client.key"
    // FrontProxyClientCertCommonName defines front proxy certificate common name
    FrontProxyClientCertCommonName = "front-proxy-client" //used as subject.commonname attribute (CN)

    // AdminKubeConfigFileName defines name for the kubeconfig aimed to be used by the superuser/admin of the cluster
    AdminKubeConfigFileName = "admin.conf"
    // KubeletBootstrapKubeConfigFileName defines the file name for the kubeconfig that the kubelet will use to do
    // the TLS bootstrap to get itself an unique credential
    KubeletBootstrapKubeConfigFileName = "bootstrap-kubelet.conf"

    // KubeletKubeConfigFileName defines the file name for the kubeconfig that the control-plane kubelet will use for talking
    // to the API server
    KubeletKubeConfigFileName = "kubelet.conf"
    // ControllerManagerKubeConfigFileName defines the file name for the controller manager's kubeconfig file
    ControllerManagerKubeConfigFileName = "controller-manager.conf"
    // SchedulerKubeConfigFileName defines the file name for the scheduler's kubeconfig file
    SchedulerKubeConfigFileName = "scheduler.conf"

    // ControllerManagerUser defines the well-known user the controller-manager should be authenticated as
    ControllerManagerUser = "system:kube-controller-manager"
    // SchedulerUser defines the well-known user the scheduler should be authenticated as
    SchedulerUser = "system:kube-scheduler"
    // SystemPrivilegedGroup defines the well-known group for the apiservers. This group is also superuser by default
    // (i.e. bound to the cluster-admin ClusterRole)
    SystemPrivilegedGroup = "system:masters"
    // NodesGroup defines the well-known group for all nodes.
    NodesGroup = "system:nodes"
    // NodesUserPrefix defines the user name prefix as requested by the Node authorizer.
    NodesUserPrefix = "system:node:"
    // NodesClusterRoleBinding defines the well-known ClusterRoleBinding which binds the too permissive system:node
    // ClusterRole to the system:nodes group. Since kubeadm is using the Node Authorizer, this ClusterRoleBinding's
    // system:nodes group subject is removed if present.
    NodesClusterRoleBinding = "system:node"

    // APICallRetryInterval defines how long kubeadm should wait before retrying a failed API operation
    APICallRetryInterval = 500 * time.Millisecond
    // DiscoveryRetryInterval specifies how long kubeadm should wait before retrying to connect to the control-plane when doing discovery
    DiscoveryRetryInterval = 5 * time.Second
    // PatchNodeTimeout specifies how long kubeadm should wait for applying the label and taint on the control-plane before timing out
    PatchNodeTimeout = 2 * time.Minute
    // TLSBootstrapTimeout specifies how long kubeadm should wait for the kubelet to perform the TLS Bootstrap
    TLSBootstrapTimeout = 5 * time.Minute
    // TLSBootstrapRetryInterval specifies how long kubeadm should wait before retrying the TLS Bootstrap check
    TLSBootstrapRetryInterval = 5 * time.Second
    // APICallWithWriteTimeout specifies how long kubeadm should wait for api calls with at least one write
    APICallWithWriteTimeout = 40 * time.Second
    // APICallWithReadTimeout specifies how long kubeadm should wait for api calls with only reads
    APICallWithReadTimeout = 15 * time.Second
    // PullImageRetry specifies how many times ContainerRuntime retries when pulling image failed
    PullImageRetry = 5

    // DefaultControlPlaneTimeout specifies the default control plane (actually API Server) timeout for use by kubeadm
    DefaultControlPlaneTimeout = 4 * time.Minute

    // MinimumAddressesInServiceSubnet defines minimum amount of nodes the Service subnet should allow.
    // We need at least ten, because the DNS service is always at the tenth cluster clusterIP
    MinimumAddressesInServiceSubnet = 10

    // MaximumBitsForServiceSubnet defines maximum possible size of the service subnet in terms of bits.
    // For example, if the value is 20, then the largest supported service subnet is /12 for IPv4 and /108 for IPv6.
    // Note however that anything in between /108 and /112 will be clamped to /112 due to the limitations of the underlying allocation logic.
    // TODO: https://github.com/kubernetes/enhancements/pull/1881
    MaximumBitsForServiceSubnet = 20

    // MinimumAddressesInPodSubnet defines minimum amount of pods in the cluster.
    // We need at least more than services, an IPv4 /28 or IPv6 /128 subnet means 14 util addresses
    MinimumAddressesInPodSubnet = 14

    // PodSubnetNodeMaskMaxDiff is limited to 16 due to an issue with uncompressed IP bitmap in core:
    // xref: #44918
    // The node subnet mask size must be no more than the pod subnet mask size + 16
    PodSubnetNodeMaskMaxDiff = 16

    // DefaultTokenDuration specifies the default amount of time that a bootstrap token will be valid
    // Default behaviour is 24 hours
    DefaultTokenDuration = 24 * time.Hour

    // DefaultCertTokenDuration specifies the default amount of time that the token used by upload certs will be valid
    // Default behaviour is 2 hours
    DefaultCertTokenDuration = 2 * time.Hour

    // CertificateKeySize specifies the size of the key used to encrypt certificates on uploadcerts phase
    CertificateKeySize = 32

    // LabelNodeRoleOldControlPlane specifies that a node hosts control-plane components
    // DEPRECATED: https://github.com/kubernetes/kubeadm/issues/2200
    LabelNodeRoleOldControlPlane = "node-role.kubernetes.io/master"

    // LabelNodeRoleControlPlane specifies that a node hosts control-plane components
    LabelNodeRoleControlPlane = "node-role.kubernetes.io/control-plane"

    // AnnotationKubeadmCRISocket specifies the annotation kubeadm uses to preserve the crisocket information given to kubeadm at
    // init/join time for use later. kubeadm annotates the node object with this information
    AnnotationKubeadmCRISocket = "kubeadm.alpha.kubernetes.io/cri-socket"

    // UnknownCRISocket defines the undetected or unknown CRI socket
    UnknownCRISocket = "/var/run/unknown.sock"

    // KubeadmConfigConfigMap specifies in what ConfigMap in the kube-system namespace the `kubeadm init` configuration should be stored
    KubeadmConfigConfigMap = "kubeadm-config"

    // ClusterConfigurationConfigMapKey specifies in what ConfigMap key the cluster configuration should be stored
    ClusterConfigurationConfigMapKey = "ClusterConfiguration"

    // ClusterStatusConfigMapKey specifies in what ConfigMap key the cluster status should be stored
    ClusterStatusConfigMapKey = "ClusterStatus"

    // KubeProxyConfigMap specifies in what ConfigMap in the kube-system namespace the kube-proxy configuration should be stored
    KubeProxyConfigMap = "kube-proxy"

    // KubeProxyConfigMapKey specifies in what ConfigMap key the component config of kube-proxy should be stored
    KubeProxyConfigMapKey = "config.conf"

    // KubeletBaseConfigurationConfigMapPrefix specifies in what ConfigMap in the kube-system namespace the initial remote configuration of kubelet should be stored
    KubeletBaseConfigurationConfigMapPrefix = "kubelet-config-"

    // KubeletBaseConfigurationConfigMapKey specifies in what ConfigMap key the initial remote configuration of kubelet should be stored
    KubeletBaseConfigurationConfigMapKey = "kubelet"

    // KubeletBaseConfigMapRolePrefix defines the base kubelet configuration ConfigMap.
    KubeletBaseConfigMapRolePrefix = "kubeadm:kubelet-config-"

    // KubeletRunDirectory specifies the directory where the kubelet runtime information is stored.
    KubeletRunDirectory = "/var/lib/kubelet"

    // KubeletConfigurationFileName specifies the file name on the node which stores initial remote configuration of kubelet
    // This file should exist under KubeletRunDirectory
    KubeletConfigurationFileName = "config.yaml"

    // KubeletEnvFileName is a file "kubeadm init" writes at runtime. Using that interface, kubeadm can customize certain
    // kubelet flags conditionally based on the environment at runtime. Also, parameters given to the configuration file
    // might be passed through this file. "kubeadm init" writes one variable, with the name ${KubeletEnvFileVariableName}.
    // This file should exist under KubeletRunDirectory
    KubeletEnvFileName = "kubeadm-flags.env"

    // KubeletEnvFileVariableName specifies the shell script variable name "kubeadm init" should write a value to in KubeletEnvFile
    KubeletEnvFileVariableName = "KUBELET_KUBEADM_ARGS"

    // KubeletHealthzPort is the port of the kubelet healthz endpoint
    KubeletHealthzPort = 10248

    // MinExternalEtcdVersion indicates minimum external etcd version which kubeadm supports
    MinExternalEtcdVersion = "3.2.18"

    // DefaultEtcdVersion indicates the default etcd version that kubeadm uses
    DefaultEtcdVersion = "3.4.13-0"

    // Etcd defines variable used internally when referring to etcd component
    Etcd = "etcd"
    // KubeAPIServer defines variable used internally when referring to kube-apiserver component
    KubeAPIServer = "kube-apiserver"
    // KubeControllerManager defines variable used internally when referring to kube-controller-manager component
    KubeControllerManager = "kube-controller-manager"
    // KubeScheduler defines variable used internally when referring to kube-scheduler component
    KubeScheduler = "kube-scheduler"
    // KubeProxy defines variable used internally when referring to kube-proxy component
    KubeProxy = "kube-proxy"
    // HyperKube defines variable used internally when referring to the hyperkube image
    HyperKube = "hyperkube"
    // CoreDNS defines variable used internally when referring to the CoreDNS component
    CoreDNS = "CoreDNS"
    // KubeDNS defines variable used internally when referring to the KubeDNS component
    KubeDNS = "kube-dns"
    // Kubelet defines variable used internally when referring to the Kubelet
    Kubelet = "kubelet"

    // KubeCertificatesVolumeName specifies the name for the Volume that is used for injecting certificates to control plane components (can be both a hostPath volume or a projected, all-in-one volume)
    KubeCertificatesVolumeName = "k8s-certs"

    // KubeConfigVolumeName specifies the name for the Volume that is used for injecting the kubeconfig to talk securely to the api server for a control plane component if applicable
    KubeConfigVolumeName = "kubeconfig"

    // NodeBootstrapTokenAuthGroup specifies which group a Node Bootstrap Token should be authenticated in
    NodeBootstrapTokenAuthGroup = "system:bootstrappers:kubeadm:default-node-token"

    // DefaultCIImageRepository points to image registry where CI uploads images from ci-cross build job
    DefaultCIImageRepository = "gcr.io/k8s-staging-ci-images"

    // CoreDNSConfigMap specifies in what ConfigMap in the kube-system namespace the CoreDNS config should be stored
    CoreDNSConfigMap = "coredns"

    // CoreDNSDeploymentName specifies the name of the Deployment for CoreDNS add-on
    CoreDNSDeploymentName = "coredns"

    // CoreDNSImageName specifies the name of the image for CoreDNS add-on
    CoreDNSImageName = "coredns/coredns"

    // KubeDNSConfigMap specifies in what ConfigMap in the kube-system namespace the kube-dns config should be stored
    KubeDNSConfigMap = "kube-dns"

    // KubeDNSDeploymentName specifies the name of the Deployment for kube-dns add-on
    KubeDNSDeploymentName = "kube-dns"

    // KubeDNSKubeDNSImageName specifies the name of the image for the kubedns container in the kube-dns add-on
    KubeDNSKubeDNSImageName = "k8s-dns-kube-dns"

    // KubeDNSSidecarImageName specifies the name of the image for the sidecar container in the kube-dns add-on
    KubeDNSSidecarImageName = "k8s-dns-sidecar"

    // KubeDNSDnsMasqNannyImageName specifies the name of the image for the dnsmasq container in the kube-dns add-on
    KubeDNSDnsMasqNannyImageName = "k8s-dns-dnsmasq-nanny"

    // KubeDNSVersion is the version of kube-dns to be deployed if it is used
    KubeDNSVersion = "1.14.13"

    // CoreDNSVersion is the version of CoreDNS to be deployed if it is used
    CoreDNSVersion = "v1.8.0"

    // ClusterConfigurationKind is the string kind value for the ClusterConfiguration struct
    ClusterConfigurationKind = "ClusterConfiguration"

    // InitConfigurationKind is the string kind value for the InitConfiguration struct
    InitConfigurationKind = "InitConfiguration"

    // JoinConfigurationKind is the string kind value for the JoinConfiguration struct
    JoinConfigurationKind = "JoinConfiguration"

    // YAMLDocumentSeparator is the separator for YAML documents
    // TODO: Find a better place for this constant
    YAMLDocumentSeparator = "---\n"

    // DefaultAPIServerBindAddress is the default bind address for the API Server
    DefaultAPIServerBindAddress = "0.0.0.0"

    // ControlPlaneNumCPU is the number of CPUs required on control-plane
    ControlPlaneNumCPU = 2

    // ControlPlaneMem is the number of megabytes of memory required on the control-plane
    // Below that amount of RAM running a stable control plane would be difficult.
    ControlPlaneMem = 1700

    // KubeadmCertsSecret specifies in what Secret in the kube-system namespace the certificates should be stored
    KubeadmCertsSecret = "kubeadm-certs"

    // KubeletPort is the default port for the kubelet server on each host machine.
    // May be overridden by a flag at startup.
    KubeletPort = 10250
    // KubeSchedulerPort is the default port for the scheduler status server.
    // May be overridden by a flag at startup.
    KubeSchedulerPort = 10259
    // KubeControllerManagerPort is the default port for the controller manager status server.
    // May be overridden by a flag at startup.
    KubeControllerManagerPort = 10257

    // EtcdAdvertiseClientUrlsAnnotationKey is the annotation key on every etcd pod, describing the
    // advertise client URLs
    EtcdAdvertiseClientUrlsAnnotationKey = "kubeadm.kubernetes.io/etcd.advertise-client-urls"
    // KubeAPIServerAdvertiseAddressEndpointAnnotationKey is the annotation key on every apiserver pod,
    // describing the API endpoint (advertise address and bind port of the api server)
    KubeAPIServerAdvertiseAddressEndpointAnnotationKey = "kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint"
    // ComponentConfigHashAnnotationKey holds the config map annotation key that kubeadm uses to store
    // a SHA256 sum to check for user changes
    ComponentConfigHashAnnotationKey = "kubeadm.kubernetes.io/component-config.hash"

    // ControlPlaneTier is the value used in the tier label to identify control plane components
    ControlPlaneTier = "control-plane"

    // ModeAlwaysAllow is the mode to set all requests as authorized
    ModeAlwaysAllow string = "AlwaysAllow"
    // ModeAlwaysDeny is the mode to set no requests as authorized
    ModeAlwaysDeny string = "AlwaysDeny"
    // ModeABAC is the mode to use Attribute Based Access Control to authorize
    ModeABAC string = "ABAC"
    // ModeWebhook is the mode to make an external webhook call to authorize
    ModeWebhook string = "Webhook"
    // ModeRBAC is the mode to use Role Based Access Control to authorize
    ModeRBAC string = "RBAC"
    // ModeNode is an authorization mode that authorizes API requests made by kubelets.
    ModeNode string = "Node"
)

const (
    // DefaultDockerCRISocket defines the default Docker CRI socket
    DefaultDockerCRISocket = "/var/run/dockershim.sock"

    // PauseVersion indicates the default pause image version for kubeadm
    PauseVersion = "3.2"
)

var (
    // OldControlPlaneTaint is the taint to apply on the PodSpec for being able to run that Pod on the control-plane
    // DEPRECATED: https://github.com/kubernetes/kubeadm/issues/2200
    OldControlPlaneTaint = v1.Taint{
        Key:    LabelNodeRoleOldControlPlane,
        Effect: v1.TaintEffectNoSchedule,
    }

    // OldControlPlaneToleration is the toleration to apply on the PodSpec for being able to run that Pod on the control-plane
    // DEPRECATED: https://github.com/kubernetes/kubeadm/issues/2200
    OldControlPlaneToleration = v1.Toleration{
        Key:    LabelNodeRoleOldControlPlane,
        Effect: v1.TaintEffectNoSchedule,
    }

    // ControlPlaneTaint is the taint to apply on the PodSpec for being able to run that Pod on the control-plane
    ControlPlaneTaint = v1.Taint{
        Key:    LabelNodeRoleControlPlane,
        Effect: v1.TaintEffectNoSchedule,
    }

    // ControlPlaneToleration is the toleration to apply on the PodSpec for being able to run that Pod on the control-plane
    ControlPlaneToleration = v1.Toleration{
        Key:    LabelNodeRoleControlPlane,
        Effect: v1.TaintEffectNoSchedule,
    }

    // DefaultTokenUsages specifies the default functions a token will get
    DefaultTokenUsages = bootstrapapi.KnownTokenUsages

    // DefaultTokenGroups specifies the default groups that this token will authenticate as when used for authentication
    DefaultTokenGroups = []string{NodeBootstrapTokenAuthGroup}

    // ControlPlaneComponents defines the control-plane component names
    ControlPlaneComponents = []string{KubeAPIServer, KubeControllerManager, KubeScheduler}

    // MinimumControlPlaneVersion specifies the minimum control plane version kubeadm can deploy
    MinimumControlPlaneVersion = version.MustParseSemantic("v1.20.0")

    // MinimumKubeletVersion specifies the minimum version of kubelet which kubeadm supports
    MinimumKubeletVersion = version.MustParseSemantic("v1.20.0")

    // CurrentKubernetesVersion specifies current Kubernetes version supported by kubeadm
    CurrentKubernetesVersion = version.MustParseSemantic("v1.21.0")

    // SupportedEtcdVersion lists officially supported etcd versions with corresponding Kubernetes releases
    SupportedEtcdVersion = map[uint8]string{
        13: "3.2.24",
        14: "3.3.10",
        15: "3.3.10",
        16: "3.3.17-0",
        17: "3.4.3-0",
        18: "3.4.3-0",
        19: "3.4.13-0",
        20: "3.4.13-0",
        21: "3.4.13-0",
        22: "3.4.13-0",
    }

    // KubeadmCertsClusterRoleName sets the name for the ClusterRole that allows
    // the bootstrap tokens to access the kubeadm-certs Secret during the join of a new control-plane
    KubeadmCertsClusterRoleName = fmt.Sprintf("kubeadm:%s", KubeadmCertsSecret)

    // StaticPodMirroringDefaultRetry is used a backoff strategy for
    // waiting for static pods to be mirrored to the apiserver.
    StaticPodMirroringDefaultRetry = wait.Backoff{
        Steps:    30,
        Duration: 1 * time.Second,
        Factor:   1.0,
        Jitter:   0.1,
    }
)