constants

const (
	EnvNameSSHAuthSock   = "SSH_AUTH_SOCK"
	EnvNameSSHKnownHosts = "SSH_KNOWN_HOSTS"

	EnvNameAWSAccessKey            = "AWS_ACCESS_KEY_ID"
	EnvNameAWSSecretKey            = "AWS_SECRET_ACCESS_KEY"
	EnvNameAWSSessionToken         = "AWS_SESSION_TOKEN"
	EnvNameAWSRegion               = "AWS_REGION"
	EnvNameAWSB64EcodedCredentials = "AWS_B64ENCODED_CREDENTIALS"

	EnvNameHCloudToken   = "HCLOUD_TOKEN"
	EnvNameRobotUser     = "ROBOT_USER"
	EnvNameRobotPassword = "ROBOT_PASSWORD"

	EnvNameKubeconfig = "KUBECONFIG"
)

const (
	FlagNameDebug = "debug"

	FlagNameKubeAidVersion = "kubeaid-version"

	FlagNameManagementClusterName             = "management-cluster-name"
	FlagNameManagementClusterNameDefaultValue = "kubeaid-bootstrapper"

	FlagNameConfigsDirectory             = "configs-directory"
	FlagNameConfigsDirectoryDefaultValue = "outputs/configs"

	FlagNameSkipMonitoringSetup = "skip-monitoring-setup"
	FlagNameSkipPRWorkflow      = "skip-pr-workflow"
	FlagNameSkipClusterctlMove  = "skip-clusterctl-move"

	FlagNameAWSAccessKeyID     = "aws-access-key-id"
	FlagNameAWSSecretAccessKey = "aws-secret-access-key"
	FlagNameAWSSessionToken    = "aws-session-token"
	FlagNameAWSRegion          = "aws-region"
	FlagNameAMIID              = "ami-id"

	FlagNameAzureClientSecret = "azure-client-secret"
	FlagNameNewImageOffer     = "new-image-offer"

	FlagNameHetznerAPIToken      = "hetzner-cloud-api-token"
	FlagNameHetznerRobotUsername = "hetzner-robot-username"
	FlagNameHetznerRobotPassword = "hetzner-robot-password"
	FlagNameNewImageName         = "new-image-name"
	FlagNameNewImagePath         = "new-image-path"

	FlagNameNewK8sVersion = "new-k8s-version"

	FlagNameOSSize      = "os-size"
	FlagNameZFSPoolSize = "zfs-pool-size"
)

const (
	KubeAPIServerFlagAuditPolicyFile = "audit-policy-file"
	KubeAPIServerFlagAuditLogPath    = "audit-log-path"

	// AuthenticationConfiguration delivery (k8s 1.30+). The OIDC
	// block in cluster.apiServer.oidc is rendered into this YAML
	// file and kube-apiserver is pointed at it via the
	// --authentication-config flag. The legacy --oidc-* flags are
	// no longer emitted.
	KubeAPIServerFlagAuthenticationConfig = "authentication-config"
	KubeAPIServerAuthenticationConfigPath = "/etc/kubernetes/auth-config.yaml"

	// Obmondo's central Keycloak for SRE access. Trust is added
	// to customer kube-apiservers as a SECOND jwt: entry in the
	// AuthenticationConfiguration when obmondo.monitoring is on,
	// so Obmondo SRE users can kubectl into a customer cluster
	// without the customer issuing them an account in their own
	// Keycloak. One-way: customer's Keycloak is unaware of
	// Obmondo's, no IdP federation.
	ObmondoKeycloakIssuerURL = "https://keycloak.obmondo.com/realms/obmondo"
)

const (
	CloudProviderAWS       = "aws"
	CloudProviderHetzner   = "hetzner"
	CloudProviderAzure     = "azure"
	CloudProviderBareMetal = "bare-metal"
	CloudProviderLocal     = "local"
)

const (
	DiskTypeHDD  = "HDD"
	DiskTypeSSD  = "SSD"
	DiskTypeNVMe = "NVMe"

	DiskTypeUnknown = "Unknown"
)

const (
	ZFSPoolDefaultSize = (ZFSVolumeSizeContainerImages + ZFSVolumeSizePodLogs + ZFSVolumeSizePodEphemeralVolumes) + 20 // = 220 GB.

	ZFSVolumeSizeContainerImages     = 100
	ZFSVolumeSizePodLogs             = 50
	ZFSVolumeSizePodEphemeralVolumes = 50
)

const (
	ReleaseNameArgoCD = "argocd"

	ArgoCDProjectKubeAid   = "kubeaid"
	ArgoCDRoleKubeAidAgent = "kubeaid-agent"

	// Apps.
	ArgoCDAppArgoCD             = "argocd"
	ArgoCDAppRoot               = "root"
	ArgoCDAppSealedSecrets      = "sealed-secrets"
	ArgoCDAppCapiCluster        = "capi-cluster"
	ArgoCDAppHetznerRobot       = "hetzner-robot"
	ArgoCDAppClusterAutoscaler  = "cluster-autoscaler"
	ArgoCDAppVelero             = "velero"
	ArgoCDAppKubePrometheus     = "kube-prometheus"
	ArgoCDExternalSnapshotter   = "external-snapshotter"
	ArgoCDAppCilium             = "cilium"
	ArgoCDAppAzureDiskCSIDriver = "azuredisk-csi-driver"
	ArgoCDAppHCloudCSIDriver    = "hcloud-csi-driver"
	ArgoCDAppRookCeph           = "rook-ceph"
	ArgoCDAppLocalPVProvisioner = "localpv-provisioner"
	ArgoCDAppCCMHCloud          = "ccm-hcloud"
	ArgoCDAppCCMHetzner         = "ccm-hetzner"
	ArgoCDAppTraefik            = "traefik"

	ArgoCDProjectRolePolicyFmt = "p, proj:%s:%s, %s, %s, %s/*, %s" // Inputs: project-name, role-name, resource, action, project-name, effect
	ArgoCDLabelKeyManagedBy    = "kubeaid.io/managed-by"

	ArgoCDRBACEffectAllow = "allow"
	ArgoCDRBACEffectDeny  = "deny"

	ArgoCDProjectRoleSecretName = "argocd-project-role-kubeaid-agent"
)

const (
	ReleaseNameSealedSecrets    = "sealed-secrets"
	SealedSecretsControllerName = ReleaseNameSealedSecrets + "-controller"

	CRONJobNameBackupSealedSecrets = "backup-sealed-secrets"
)

const (
	BlobContainerNameOIDCProvider = "oidc-provider"

	AzureBlobNameOpenIDConfiguration = ".well-known/openid-configuration"
	AzureBlobNameJWKSDocument        = "openid/v1/jwks"

	// Grants full access to manage all resources, but does not allow you to assign roles in Azure
	// RBAC, manage assignments in Azure Blueprints, or share image galleries.
	AzureRoleIDContributor = "b24988ac-6180-42a0-ab88-20f7382dd24c"
	// Provides full access to Azure Storage blob containers and data, including assigning POSIX
	// access control.
	AzureRoleIDStorageBlobDataOwner = "b7e6dc6d-f1e8-4753-8033-0f276bb0955b"

	AzureResponseStatusCodeResourceAlreadyExists = 409
)

const (
	HetznerModeBareMetal = "bare-metal"
	HetznerModeHCloud    = "hcloud"
	HetznerModeHybrid    = "hybrid"

	HetznerRobotWebServiceAPI = "https://robot-ws.your-server.de"

	HetznerNetworkCIDR       = "10.0.0.0/16"
	HCloudServersSubnetCIDR  = "10.0.0.0/24"
	HetznerVSwitchSubnetCIDR = "10.0.1.0/24"
	HetznerVSwitchGatewayIP  = "10.0.1.0"

	HCloudServerTypeCAX11 = "cax11"

	HCloudServerImageUbuntu2404 = "ubuntu-24.04"

	HCloudLocationHel1 = "hel1"
	HCloudLocationFsn1 = "fsn1"
	HCloudLocationNbg1 = "nbg1"
	HCloudLocationAsh  = "ash"

	HCloudLBTypeLB11 = "lb11"

	// Hetzner Bare Metal Server (HBMS) OS installation via Hetzner Robot (HRobot).
	HRobotResetTypeHardware = "hw"
	// Pinned to the latest Ubuntu LTS so that every new HBMS receives current security patches.
	// Bump this constant when a newer LTS becomes available in the HRobot catalogue.
	HBMSInstallDistributionLatestUbuntu = "Ubuntu 24.04 LTS base"
	HBMSOSInstallationPollInterval      = 20 * time.Second
	HBMSOSInstallationMaxWaitTime       = 12 * time.Minute
)

const (
	// Namespaces.
	NamespaceArgoCD        = "argocd"
	NamespaceObmondo       = "obmondo"
	NamespaceVelero        = "velero"
	NamespaceSealedSecrets = "sealed-secrets"
	NamespaceCrossPlane    = "crossplane"
	NamespaceCilium        = "cilium"
	NamespaceCiliumTest    = "cilium-test"
	NamespaceKeycloak      = "keycloakx"
	NamespaceCloudNativePG = "cnpg-operator"
	NamespaceNetBird       = "netbird"
	NamespaceTraefik       = "traefik"
	NamespaceKubeSystem    = "kube-system"

	// SecretNameCloudCredentials is the Secret the HCloud Cloud
	// Controller Manager, HCloud CSI driver, and Cluster Autoscaler
	// all read for their Hetzner API token. kubeaid-cli pre-creates it
	// directly on the main cluster during bootstrap so the CCM can
	// start before sealed-secrets-controller is up — see
	// pkg/core/hcloud_credentials.go for the chicken-and-egg this
	// breaks. The same SealedSecret is also rendered into
	// kubeaid-config so the cluster state remains declaratively
	// captured for DR.
	SecretNameCloudCredentials = "cloud-credentials"

	// keycloakx Service inside NamespaceKeycloak. kubeaid-cli
	// port-forwards to this Service during bootstrap to call the
	// admin API, mirroring the existing argocd-server pattern.
	ServiceNameKeycloakx = "keycloakx-http"
	ServicePortKeycloakx = 80

	// ArgoCDAppKeycloakx is the name of the keycloakx ArgoCD App
	// kubeaid-cli waits for Healthy before calling the admin API.
	ArgoCDAppKeycloakx = "keycloakx"

	// ArgoCDAppNetbird is the name of the netbird ArgoCD App.
	ArgoCDAppNetbird = "netbird"

	// ArgoCDAppCertManager is the name of the cert-manager ArgoCD App.
	ArgoCDAppCertManager = "cert-manager"

	// ArgoCDAppCloudNativePG is the name of the cloudnative-pg
	// (CNPG) ArgoCD App. It installs the operator + the
	// postgresql.cnpg.io/v1 Cluster/Pooler CRDs that keycloakx
	// (in managed mode, for keycloak-pgsql) and netbird (for
	// netbird-pgsql) both instantiate during their own sync, so
	// the bootstrap syncs it ahead of those apps.
	ArgoCDAppCloudNativePG = "cloudnative-pg"

	// Keycloak admin Secret keys. Names match what the keycloakx
	// chart's pre-install hook reads.
	SecretNameKeycloakAdmin   = "keycloak-admin"
	SecretKeyKeycloakUsername = "username"
	SecretKeyKeycloakPassword = "KEYCLOAK_PASSWORD"
	KeycloakAdminUsername     = "admin"

	// netbird Secret. Holds every plaintext credential the NetBird
	// Helm chart envFroms: the OIDC client ID/secret pair pointing
	// at the netbird-backend Keycloak client, the symmetric AES key
	// the Mgmt server uses to encrypt its datastore, the Relay
	// shared secret, and the static turn user/password Coturn and
	// Mgmt agree on. kubeaid-cli read-or-generates each random key
	// against the cluster-side Secret so re-runs don't drift.
	SecretNameNetBird             = "netbird"
	SecretKeyNetBirdIDPClientID   = "idpClientID"
	SecretKeyNetBirdIDPMgmtID     = "idpClientMgmtID"
	SecretKeyNetBirdIDPMgmtSecret = "idpClientMgmtSecret"
	SecretKeyNetBirdIDPSAUser     = "idpServiceAccountUser"
	SecretKeyNetBirdDatastoreKey  = "datastoreEncryptionKey"
	SecretKeyNetBirdRelayPassword = "relayPassword"
	SecretKeyNetBirdStunServer    = "stunServer"
	SecretKeyNetBirdTurnServer    = "turnServer"
	SecretKeyNetBirdTurnUser      = "turnServerUser"
	SecretKeyNetBirdTurnPassword  = "turnServerPassword"
	SecretKeyNetBirdPostgresDSN   = "postgresDSN"
	NetBirdClientID               = "netbird-client"
	NetBirdBackendClientID        = "netbird-backend"

	// netbird-turn-credentials Secret. Coturn server reads this for
	// its own TURN auth via existingSecret in the chart values; the
	// password must match SecretKeyNetBirdTurnPassword above so
	// Mgmt's hand-back to clients lines up with what Coturn actually
	// authenticates against.
	SecretNameNetBirdTurnCredentials = "netbird-turn-credentials"
	SecretKeyNetBirdTurnCredsUser    = "username"
	SecretKeyNetBirdTurnCredsPwd     = "password"

	// 32 bytes -> 256-bit AES key after base64 decode. Matches the
	// length of NetBird Mgmt's datastoreEncryptionKey field.
	NetBirdDatastoreKeyByteLen = 32

	// Service Accounts.
	ServiceAccountCAPZ          = "capz-manager"
	ServiceAccountASO           = "azureserviceoperator-default"
	ServiceAccountVelero        = "velero"
	ServiceAccountSealedSecrets = "sealed-secrets"
)

const (
	ClusterTypeManagement = "management"
	ClusterTypeMain       = "main"

	ClusterTypeVPN      = "vpn"
	ClusterTypeWorkload = "workload"

	// Keycloak modes for cluster.type=vpn clusters.
	//   managed:  kubeaid-cli installs Keycloak via the keycloakx
	//             chart on this cluster, generates the admin
	//             password, and runs the gocloak realm reconciler.
	//   external: operator's existing Keycloak; kubeaid-cli only
	//             configures kube-apiserver / NetBird Mgmt to trust
	//             it. The realm + clients must be set up by hand
	//             (see argocd-helm-charts/netbird/README.md, "Keycloak
	//             realm prerequisites") before bootstrap.
	KeycloakModeManaged  = "managed"
	KeycloakModeExternal = "external"
)

const (
	RepoURLObmondoKubeAid = "https://github.com/Obmondo/KubeAid"

	// Public HTTPS URL for KubeAid — used by ArgoCD (read-only, no deploy key needed).
	KubeAidPublicHTTPSURL = "https://github.com/Obmondo/KubeAid.git"

	// GitHub API URL for listing KubeAid releases (used to pick latest-1).
	KubeAidReleasesAPIURL = "https://api.github.com/repos/Obmondo/KubeAid/releases"

	// Local docker image tag kubeaid-cli builds on first
	// buildKubePrometheus invocation. Holds the small jsonnet
	// toolchain (jsonnet, jb, gojsontoyaml) that runs build.sh
	// without requiring those binaries on the host. Tag is
	// stable; the image is built from the embedded Dockerfile in
	// pkg/core, so docker layer caching makes repeat builds free.
	KubePromBuilderImage = "kubeaid-cli/kube-prom-builder:latest"

	GzippedFilenameSuffix = ".gz"
)

const (
	OneDay   = 24 * time.Hour
	OneMonth = 30 * OneDay
)

const (
	CommitAuthorName  = "KubeAid CLI"
	CommitAuthorEmail = "info@obmondo.com"
)

const (
	DockerSocketPath         = "/var/run/docker.sock"
	DockerDefaultNetworkName = "default"
)

const (
	K3sReleasesAPIURL = "https://api.github.com/repos/k3s-io/k3s/releases/latest"

	// CGroup v1 support has been dropped from K8s version v1.35.
	// REFER : https://www.sysdig.com/blog/kubernetes-1-35-whats-new#changes-in-kubernetes-135-that-may-break-things.
	MaxCGroupV1CompatibleK3sVersion = "v1.34.5-k3s1"
)

const (
	MinSupportedK8sVersion = "v1.30"
	//
	// Whatever is the latest K8s version, that becomes the max supported K8s version.
	// We get the latest K8s version from the K8s release API.
	K8sReleaseAPIURL = "https://dl.k8s.io/release/stable.txt"

	// URL pattern for fetching the latest patch of a specific minor version.
	// Use fmt.Sprintf with the minor version number, e.g. fmt.Sprintf(K8sStableMinorURLFmt, 34)
	// yields "https://dl.k8s.io/release/stable-1.34.txt".
	K8sStableMinorURLFmt = "https://dl.k8s.io/release/stable-1.%d.txt"

	// CGroup v1 support has been dropped from K8s version v1.35.
	// REFER : https://www.sysdig.com/blog/kubernetes-1-35-whats-new#changes-in-kubernetes-135-that-may-break-things.
	MaxCGroupV1CompatibleK8sVersion = "v1.34"

	// For the Bare Metal provider though, the story is a bit different.
	// We're using KubeOne v1.12. And you can see the K8s versions officially supported by KubeOne
	// here : https://docs.kubermatic.com/kubeone/v1.12/architecture/compatibility/supported-versions.
	// That range becomes the range of K8s version supported by KubeAid CLI.
	// NOTE : We need update this range manually, when upgrading KubeOne.
	MinKubeOneSupportedK8sVersion = "v1.32"
	MaxKubeOneSupportedK8sVersion = "v1.34"
)

const (
	TemplateNameKubePrometheusArgoCDApp = "argocd-apps/templates/kube-prometheus.yaml.tmpl"
	TemplateNameKubePrometheusVars      = "cluster-vars.jsonnet.tmpl"
)

const CEPHNodeMinSize = 50 // GB.

const HighSpeedNICThreshold = 5000 // GBPS.

const KubeOneConfigTemlateName = "kubeone/kubeone-cluster.yaml.tmpl"

const OSDefaultSize = 50 // GB.

const PEMBlockTypeOpenSSHPrivateKey = "OPENSSH PRIVATE KEY"

const TempDirectory = "/tmp/kubeaid-core"

const TemplateNameK3DConfig = "templates/k3d.config.yaml.tmpl"

const TemplateNameStoragePlanExecutor = "templates/storage-plan-executor.sh.tmpl"