controller

const (
	// OperatorFieldManager is the Server-Side Apply field-manager name
	// stamped on every operator-emitted apply (applySSA). All
	// `ensure*` functions across the engine, instance, gateway, metadata,
	// postgres, and RBAC paths converge on this single identifier so
	// `kubectl get <resource> -o yaml` shows one consistent owner under
	// `metadata.managedFields[].manager` for everything the operator
	// produces. Changing the value is a breaking change: existing
	// resources would be left half-owned by the old manager name until
	// the operator next applies them with ForceOwnership.
	OperatorFieldManager = "firebolt-operator"

	// LabelEngine identifies the engine a resource belongs to.
	LabelEngine = "firebolt.io/engine"
	// LabelGeneration identifies the generation of a resource.
	LabelGeneration = "firebolt.io/generation"
	// LabelInstance identifies the instance a resource belongs to.
	LabelInstance = "firebolt.io/instance"
	// LabelComponent identifies the component type (metadata, gateway, etc.).
	LabelComponent = "firebolt.io/component"

	// AnnotationMetadataOverride records the MetadataEndpointOverride used
	// to build the engine ConfigMap. stsMatchesSpec compares against this to
	// detect changes that require a new generation.
	AnnotationMetadataOverride = "firebolt.io/metadata-override"

	// AnnotationEngineClassHash records a content-hash of the resolved
	// FireboltEngineClass.spec.template merged into the engine pod spec.
	// Absent when spec.engineClassRef is nil. stsMatchesSpec compares the
	// annotation to the freshly resolved class hash and rolls a new
	// blue-green generation on any mismatch — covers both
	// engineClassRef changes and in-place edits to the referenced class.
	AnnotationEngineClassHash = "firebolt.io/engine-class-hash"

	// AnnotationCustomEngineConfigHash records a content-hash of the
	// spec.customEngineConfig payload baked into the engine ConfigMap.
	// stsMatchesSpec compares against this to detect changes that require
	// a new generation, since ConfigMap content drift is not checked
	// independently.
	AnnotationCustomEngineConfigHash = "firebolt.io/custom-engine-config-hash"

	// AnnotationConfigHash carries a content-hash of the rendered config
	// for the gateway and metadata Deployments. It is set on the pod
	// template and serves two purposes: (1) any config change propagates
	// here and triggers a rollout via the resulting template-spec diff,
	// (2) deploymentSpecEqual uses it as the single pod-template equality
	// signal, avoiding a DeepEqual on server-defaulted PodSpec fields.
	AnnotationConfigHash = "firebolt.io/config-hash"

	// AnnotationWakeRequested is the contract between the gateway and the
	// engine autoStop: the gateway patches this annotation with an
	// RFC 3339 timestamp when it observes a request for an engine that is
	// currently scaled to zero. The engine autoStop treats a fresh value
	// (within DefaultAutoStopWakeTTL of now) as a request to immediately
	// scale up to spec.autoStop.activeReplicas, bypassing the idle-timeout
	// check. Stale values are ignored, so the gateway must keep stamping
	// the annotation while it has buffered queries waiting for the engine.
	//
	// The annotation is honored only when spec.autoStop.enabled=true:
	// without an autoStop policy the operator has no ActiveReplicas to
	// scale to, and respecting the wake from a non-policy actor would
	// silently override the user's spec.replicas==0 intent.
	AnnotationWakeRequested = "firebolt.io/wake-requested"

	// SuffixService is appended to form the cluster Service name.
	SuffixService = "-service"
	// SuffixGen is appended to form generation-scoped resource names.
	SuffixGen = "-g"
	// SuffixHL is appended to form headless Service names.
	SuffixHL = "-hl"
	// SuffixConfig is appended to form ConfigMap names.
	SuffixConfig = "-config"
	// SuffixMetadataService is appended to form metadata Deployment/Service names.
	SuffixMetadataService = "-metadata"
	// SuffixMetadataPG is appended to form the internal PostgreSQL resource names.
	SuffixMetadataPG = "-metadata-pg"
	// SuffixMetadataPostgresCreds is appended to form the PG credentials Secret name.
	SuffixMetadataPostgresCreds = "-metadata-postgres-creds" //nolint:gosec // resource name suffix, not a credential
	// SuffixGateway is appended to form gateway Deployment/Service names.
	SuffixGateway = "-gateway"

	// MetadataServicePort is the gRPC port the metadata service listens on.
	MetadataServicePort = 7000
	// PostgresPort is the default PostgreSQL port.
	PostgresPort = 5432
	// PostgresDBName is the database name for the internal PostgreSQL instance.
	PostgresDBName = "firebolt_metadata"
	// PostgresDefaultSchema is the schema used by the metadata service when
	// the user does not specify spec.metadata.postgres.schema (and always for
	// the internal Postgres deployment, which is created with this schema).
	PostgresDefaultSchema = "public"
	// PostgresUser is the database user for the internal PostgreSQL instance.
	PostgresUser = "firebolt"
	// PostgresPVCSize is the default PVC size for the internal PostgreSQL instance.
	PostgresPVCSize = "10Gi"
	// PostgresUID is the numeric UID/GID of the built-in `postgres` user in
	// the `postgres:16-alpine` image. We pin RunAsUser/RunAsGroup/FSGroup to
	// this value so the pod-level SecurityContext can enforce RunAsNonRoot=true
	// and the kubelet chowns the per-pod data PVC to a UID the postgres
	// process actually runs as. The Debian-flavored `postgres` images use
	// UID 999 instead; if PostgresImage is ever switched off Alpine this
	// constant must be revisited.
	PostgresUID int64 = 70

	// MetadataUID is the numeric UID/GID of the built-in `dedicated-pensieve`
	// user in the metadata image. The Dockerfile creates the user with this
	// fixed UID and sets `USER dedicated-pensieve`, so pinning
	// RunAsUser/RunAsGroup here just locks in the image's own default and
	// lets the pod-level SecurityContext assert RunAsNonRoot=true. Revisit
	// if the metadata image's user is ever renumbered.
	MetadataUID int64 = 1111

	// DefaultDrainCheckInterval is how often the operator polls draining pods.
	DefaultDrainCheckInterval = 5 * time.Second

	// HealthReadyPath is the HTTP path for readiness probes on engine pods.
	HealthReadyPath = "/health/ready"
	// HealthLivePath is the HTTP path for liveness probes on engine pods.
	HealthLivePath = "/health/live"
	// HealthPort is the port exposing health endpoints on engine pods.
	HealthPort = 8122
	// MetricsPort is the port exposing Prometheus metrics on engine pods.
	// The operator scrapes firebolt_running_queries and firebolt_suspended_queries
	// here via the Kubernetes pod-proxy subresource to drive the drain check.
	MetricsPort = 9090
	// MetricsPath is the HTTP path exposing Prometheus metrics on engine pods.
	MetricsPath = "/metrics"
	// MetricRunningQueries is the Prometheus metric name for in-flight queries.
	MetricRunningQueries = "firebolt_running_queries"
	// MetricSuspendedQueries is the Prometheus metric name for suspended queries.
	MetricSuspendedQueries = "firebolt_suspended_queries"

	// ConfigMountPath is where the engine config.yaml is mounted in the container.
	// FireboltCoreServer reads <root>/config.yaml from its --data-dir when present,
	// so the file must land at this path inside the container.
	ConfigMountPath = "/firebolt-core/volume/config.yaml"

	// DataMountPath is where the engine's per-pod PVC is mounted. Matches the
	// path the engine binary uses for its working data.
	DataMountPath = "/firebolt-core/volume"
	// DataVolumeName is the name of the data volume inside the StatefulSet's
	// VolumeClaimTemplates and the corresponding container VolumeMount.
	DataVolumeName = "data"
	// DefaultEngineStorageSize is the PVC size applied when
	// FireboltEngineSpec.Storage.Size is unset. Mirrors the kubebuilder default
	// so unit tests building specs as Go literals see the same value as
	// CRD-loaded specs.
	DefaultEngineStorageSize = "1Gi"

	// DefaultTerminationGracePeriodSeconds is the default value applied to the
	// engine pod's terminationGracePeriodSeconds when FireboltEngine.spec leaves
	// it unset. 60s gives in-flight queries up to 55s (TGPS − EngineShutdownMarginSeconds)
	// to complete after SIGTERM before SIGKILL is sent.
	DefaultTerminationGracePeriodSeconds = 60
	// DefaultEngineFSGroup is the pod-level fsGroup applied to engine pods
	// when spec.podSecurityContext.fsGroup is unset. Matches the engine
	// container's listening port (3473) as a memorable shared GID; the
	// kernel uses it to chown the per-pod data PVC so the (non-root) engine
	// process can read and write its own volume.
	DefaultEngineFSGroup int64 = 3473
	// DefaultEngineWebD is the non-root UID the engine container runs
	// under when FireboltEngine.spec.securityContext does not override
	// it. 3473 matches DefaultEngineFSGroup so the process's primary
	// GID, the volume-mount fsGroup, and the port mnemonic all line up
	// — and matches the sibling firebolt-instance-helm chart's engine
	// StatefulSet, so engines moved between deployment paths keep their
	// on-disk ownership.
	DefaultEngineWebD int64 = 3473
	// DefaultEngineGID is the non-root GID the engine container runs
	// under. Pinned to the same value as DefaultEngineWebD and
	// DefaultEngineFSGroup; see DefaultEngineWebD.
	DefaultEngineGID int64 = 3473
	// EngineShutdownMarginSeconds is subtracted from terminationGracePeriodSeconds
	// to compute shutdown_wait_unfinished. The remaining margin covers container
	// runtime teardown and pod API deletion after the engine process exits.
	EngineShutdownMarginSeconds = 5
)

const (
	// EngineWebPortName / EngineWebPort are the name and number of the container
	// port the engine web UI listens on.
	EngineWebPortName       = "web-ui"
	EngineWebPort     int32 = 9100
	// EngineWebWritableVolumeName is the emptyDir mounted into the UI container
	// at nginx's writable paths, since it runs with a read-only root FS. It is
	// listed in operatorOwnedPodVolumeNames so a user volume of this name is
	// dropped at render and cannot collide with the operator's.
	EngineWebWritableVolumeName = "nginx-writable-dir"
	// EngineWebBackendURL is the local engine endpoint the UI talks to: the
	// engine's http-query port (3473) on loopback within the same pod.
	EngineWebBackendURL = "http://localhost:3473"
)

const (
	DefaultAutoStopIdleTimeout  = 30 * time.Minute
	DefaultAutoStopPollInterval = 1 * time.Minute
	DefaultAutoStopIdleReplicas = int32(0)
	// DefaultAutoStopWakeTTL bounds how long an unrefreshed
	// AnnotationWakeRequested value still triggers a scale-up. Generous
	// enough to cover engine cold-start (image pull on a fresh node, blue-
	// green creating phase) while short enough that an abandoned request
	// does not pin the engine indefinitely after the gateway gives up.
	DefaultAutoStopWakeTTL = 5 * time.Minute
)

const (
	AutoStopReasonDisabled       = "Disabled"
	AutoStopReasonScheduleActive = "ScheduleActive"
	AutoStopReasonStopped        = "Stopped"
	AutoStopReasonActivity       = "ActivityObserved"
	AutoStopReasonScrapeFailed   = "ScrapeFailed"
	AutoStopReasonIdle           = "Idle"
	AutoStopReasonWakeRequested  = "WakeRequested"
	// AutoStopReasonInitializing covers the first quiet observation on
	// an engine that has no LastActivityTime yet: there is nothing to
	// measure idleFor against, so the decision is "anchor the timestamp
	// and observe again". Distinct from ActivityObserved, which carries
	// the stronger claim that the most recent scrape saw running queries.
	AutoStopReasonInitializing = "Initializing"
)

const ConfigFileName = "config.yaml"

const EngineConfigSchemaVersion = "1.0"

const EngineStartupScript = `` /* 174-byte string literal not displayed */

const MetricScrapeModeDefault = computev1alpha1.MetricScrapeModePodIP

const (
	// SuffixGatewayWakeRole is appended to the instance name to form the
	// per-instance RoleBinding name that binds the chart-managed
	// gateway-wake ClusterRole to the gateway ServiceAccount.
	SuffixGatewayWakeRole = "-gateway-wake"
)