Repository: istio/istio
File: cni/pkg/constants/constants.go (Go)

Code before:
	AmbientDisableSafeUpgrade         = "ambient-disable-safe-upgrade"
	AmbientReconcilePodRulesOnStartup = "ambient-reconcile-pod-rules-on-startup"
	EnableAmbientDetectionRetry       = "enable-ambient-detection-retry"

	NativeNftables = "native-nftables"

	// Repair
	RepairEnabled            = "repair-enabled"
	RepairDeletePods         = "repair-delete-pods"
	RepairRepairPods         = "repair-repair-pods"
	RepairLabelPods          = "repair-label-pods"
	RepairLabelKey           = "repair-broken-pod-label-key"
	RepairLabelValue         = "repair-broken-pod-label-value"
	RepairNodeName           = "repair-node-name"
	RepairSidecarAnnotation  = "repair-sidecar-annotation"
	RepairInitContainerName  = "repair-init-container-name"
	RepairInitTerminationMsg = "repair-init-container-termination-message"
	RepairInitExitCode       = "repair-init-container-exit-code"
	RepairLabelSelectors     = "repair-label-selectors"
	RepairFieldSelectors     = "repair-field-selectors"
)

// Internal constants
const (
	DefaultKubeconfigMode = 0o600
	DefaultCNIConfMode    = 0o600
	CNIAgentLogScope      = "cni-agent"
	CNIPluginLogScope     = "cni-plugin"
	CNIAddEventPath       = "/cmdadd"
	UDSLogPath            = "/log"
	CNIEventSocketName    = "pluginevent.sock"
	LogUDSSocketName      = "log.sock"
	LocalRollingLogName   = "istio-cni.log"
	RollingLogMaxSizeMB   = 10
	CNIPluginKubeconfName = "istio-cni-kubeconfig"
	// K8s liveness and readiness endpoints
	LivenessEndpoint                   = "/healthz"
	ReadinessEndpoint                  = "/readyz"
	ReadinessPort                      = "8000"
	ServiceAccountPath                 = "/var/run/secrets/kubernetes.io/serviceaccount"
	SelfNetNSPath                      = "/proc/self/ns/net"
	DefaultIstioOwnedCNIConfigFilename = "02-istio-cni.conflist"
)

// Exposed for testing "constants"
var (
	CNIBinDir     = "/opt/cni/bin"
	HostCNIBinDir = "/host/opt/cni/bin"
	// Well-known subpath we will mount any needed host-mounts under,
	// to preclude shadowing or breaking any pod-internal mounts
	HostMountsPath = "/host"

Review comment (suggestion):
I don't think we should allow configuring the specific mode; that's too much customization and allows for insecure configurations. I was thinking the flag would be more like "enableGroupReadWrite" or something 

Code after:
	AmbientDisableSafeUpgrade         = "ambient-disable-safe-upgrade"
	AmbientReconcilePodRulesOnStartup = "ambient-reconcile-pod-rules-on-startup"
	EnableAmbientDetectionRetry       = "enable-ambient-detection-retry"

	NativeNftables = "native-nftables"

	// Repair
	RepairEnabled            = "repair-enabled"
	RepairDeletePods         = "repair-delete-pods"
	RepairRepairPods         = "repair-repair-pods"
	RepairLabelPods          = "repair-label-pods"
	RepairLabelKey           = "repair-broken-pod-label-key"
	RepairLabelValue         = "repair-broken-pod-label-value"
	RepairNodeName           = "repair-node-name"
	RepairSidecarAnnotation  = "repair-sidecar-annotation"
	RepairInitContainerName  = "repair-init-container-name"
	RepairInitTerminationMsg = "repair-init-container-termination-message"
	RepairInitExitCode       = "repair-init-container-exit-code"
	RepairLabelSelectors     = "repair-label-selectors"
	RepairFieldSelectors     = "repair-field-selectors"
)

// Internal constants
const (
	DefaultKubeconfigMode = 0o600
	CNIConfModeDefault    = 0o600
	CNIConfModeGroupRead  = 0o640
	CNIAgentLogScope      = "cni-agent"
	CNIPluginLogScope     = "cni-plugin"
	CNIAddEventPath       = "/cmdadd"
	UDSLogPath            = "/log"
	CNIEventSocketName    = "pluginevent.sock"
	LogUDSSocketName      = "log.sock"
	LocalRollingLogName   = "istio-cni.log"
	RollingLogMaxSizeMB   = 10
	CNIPluginKubeconfName = "istio-cni-kubeconfig"
	// K8s liveness and readiness endpoints
	LivenessEndpoint                   = "/healthz"
	ReadinessEndpoint                  = "/readyz"
	ReadinessPort                      = "8000"
	ServiceAccountPath                 = "/var/run/secrets/kubernetes.io/serviceaccount"
	SelfNetNSPath                      = "/proc/self/ns/net"
	DefaultIstioOwnedCNIConfigFilename = "02-istio-cni.conflist"
)

// Exposed for testing "constants"
var (
	CNIBinDir     = "/opt/cni/bin"
	HostCNIBinDir = "/host/opt/cni/bin"
	// Well-known subpath we will mount any needed host-mounts under,
	// to preclude shadowing or breaking any pod-internal mounts