metadata

const (
	OwningClusterIndex                 = "owning-cluster"
	OwningClusterDatastoreURIIndex     = "owning-cluster-datastore-uri"
	OwningClusterPresharedKeyIndex     = "owning-cluster-preshared-key"
	OwningClusterMigrationSecretsIndex = "owning-cluster-migration-secrets"

	// CredentialType* are the internal credential-role identifiers. They are
	// used to derive per-role label keys and index names; they are not stored
	// directly on Kubernetes objects.
	CredentialTypeDatastoreURI     = "datastore-uri"     // nolint: gosec
	CredentialTypePresharedKey     = "preshared-key"     // nolint: gosec
	CredentialTypeMigrationSecrets = "migration-secrets" // nolint: gosec

	// Per-role label keys. A secret carries exactly the keys for the roles it
	// serves. Key presence (not value) is what the index functions check, so a
	// shared secret can carry all applicable keys simultaneously.
	CredentialTypeDatastoreURILabelKey     = "authzed.com/credential-type-datastore-uri"     // nolint: gosec
	CredentialTypePresharedKeyLabelKey     = "authzed.com/credential-type-preshared-key"     // nolint: gosec
	CredentialTypeMigrationSecretsLabelKey = "authzed.com/credential-type-migration-secrets" // nolint: gosec

	OperatorManagedLabelKey         = "authzed.com/managed-by"
	OperatorManagedLabelValue       = "operator"
	OwnerLabelKey                   = "authzed.com/cluster"
	OwnerAnnotationKeyPrefix        = "authzed.com.cluster-owner/"
	ComponentLabelKey               = "authzed.com/cluster-component"
	ComponentSpiceDBLabelValue      = "spicedb"
	ComponentMigrationJobLabelValue = "migration-job"
	ComponentServiceAccountLabel    = "spicedb-serviceaccount"
	ComponentRoleLabel              = "spicedb-role"
	ComponentServiceLabel           = "spicedb-service"
	ComponentRoleBindingLabel       = "spicedb-rolebinding"
	ComponentPDBLabel               = "spicedb-pdb"
	SpiceDBMigrationRequirementsKey = "authzed.com/spicedb-migration"
	SpiceDBTargetMigrationKey       = "authzed.com/spicedb-target-migration"
	SpiceDBSecretRequirementsKey    = "authzed.com/spicedb-secret" // nolint: gosec
	SpiceDBConfigKey                = "authzed.com/spicedb-configuration"
	FieldManager                    = "spicedb-operator"

	KubernetesNameLabelKey      = "app.kubernetes.io/name"
	KubernetesInstanceLabelKey  = "app.kubernetes.io/instance"
	KubernetesComponentLabelKey = "app.kubernetes.io/component"
	KubernetesVersionLabelKey   = "app.kubernetes.io/version"
)

const PausedControllerSelectorKey = "authzed.com/controller-paused"