consts

const (
	// AIGatewayDataPlaneManagedByLabelValue is the managed-by label value for AI Gateway DataPlane owned resources.
	// Distinct from the gateway-operator DataPlaneManagedLabelValue ("dataplane") to avoid cross-query
	// collisions when listing Secrets by label selector.
	AIGatewayDataPlaneManagedByLabelValue = "aigateway-dataplane"

	// AIGatewayDataPlanePrefix is the GenerateName prefix used when creating mTLS certificate Secrets
	// for AI Gateway DataPlane instances.
	AIGatewayDataPlanePrefix = "aigw-dp"

	// SecretAIGatewayDataPlaneCertificateLabel marks a Secret as the mTLS certificate for an AI Gateway DataPlane.
	SecretAIGatewayDataPlaneCertificateLabel = "konghq.com/aigw-dp-cert" //nolint:gosec
)

const (
	// AIGatewayDataPlaneContainerName is the name of the AI Gateway container in the DataPlane Deployment.
	AIGatewayDataPlaneContainerName = "aigw"

	// RelatedImageAIGatewayDataPlaneEnvVar is the environment variable name for the AI Gateway container image,
	// following the operator-framework convention for related images.
	RelatedImageAIGatewayDataPlaneEnvVar = "RELATED_IMAGE_AIGW"

	// DefaultAIGatewayDataPlaneBaseImage is the base image name for the AI Gateway container.
	DefaultAIGatewayDataPlaneBaseImage = "kong/kong-ai-gateway"
	// DefaultAIGatewayDataPlaneTag is the default image tag for the AI Gateway container.
	DefaultAIGatewayDataPlaneTag = "2.0.3" // renovate: datasource=docker depName=kong/kong-ai-gateway
	// DefaultAIGatewayDataPlaneImage is the full default image reference for the AI Gateway container.
	DefaultAIGatewayDataPlaneImage = DefaultAIGatewayDataPlaneBaseImage + ":" + DefaultAIGatewayDataPlaneTag
)

const (
	// OperatorLabelPrefix is the common label prefix used by the operator.
	OperatorLabelPrefix = "gateway-operator.konghq.com/"

	// OperatorAnnotationPrefix is the common annotation prefix used by the operator.
	OperatorAnnotationPrefix = OperatorLabelPrefix

	// GatewayOperatorManagedByLabel is the label that is used for objects which
	// were created by this operator.
	// The value associated with this label indicated what component is controlling
	// the resource that has this label set, e.g. controlplane.
	GatewayOperatorManagedByLabel = OperatorLabelPrefix + "managed-by"

	// GatewayOperatorManagedByNameLabel is the label that is used for objects which
	// were created by this operator.
	// The value set for this label is the name of the object that is controlling
	// the resource that has this label set.
	// This can be used e.g. as a link between a managing object and the managed object
	// specifying when there's a cross namespace reference which is disallowed by the
	// Kubernetes API.
	GatewayOperatorManagedByNameLabel = OperatorLabelPrefix + "managed-by-name"

	// GatewayOperatorManagedByNamespaceLabel is the label that is used for objects which
	// were created by this operator.
	// The value set for this label is the namespace of the object that is controlling
	// the resource that has this label set.
	// This can be used e.g. as a link between a managing object and the managed object
	// specifying when there's a cross namespace reference which is disallowed by the
	// Kubernetes API.
	GatewayOperatorManagedByNamespaceLabel = OperatorLabelPrefix + "managed-by-namespace"

	// GatewayOperatorKongPluginTypeLabel is the label set on KongPlugin instances
	// to indicate the type of the plugin.
	// It is used to filter KongPlugin instances that are managed by the ControlPlane.
	GatewayOperatorKongPluginTypeLabel = OperatorLabelPrefix + "kong-plugin-type"

	// GatewayOperatorOwnerUIDControlPlane is the label that is used for objects
	// to indicate a ControlPlane resource is the owner of the object.
	// The value set for this label is the UID of the ControlPlane resource that
	// owns the object.
	GatewayOperatorOwnerUIDControlPlane = OperatorLabelPrefix + "controlplane-owner-uid"

	// GatewayManagedLabelValue indicates that the object's lifecycle is managed by
	// the gateway controller.
	GatewayManagedLabelValue = "gateway"

	// GatewayNameLabel is the label key defined by GEP-1762 that must be present
	// on all resources generated in response to a Gateway. The value is set to
	// the Gateway's name.
	GatewayNameLabel = "gateway.networking.k8s.io/gateway-name"

	// ServiceSecretLabel is a label that is added to operator related Service
	// Secrets to designate which Service this particular Secret it used by.
	ServiceSecretLabel = OperatorLabelPrefix + "service-secret"

	// OperatorLabelSelector is a label name that is used for operator resources
	// as a label selector key.
	// Used with e.g. DataPlane's status.selector field.
	OperatorLabelSelector = OperatorLabelPrefix + "selector"

	// ControlPlaneServiceLabel is a Service's label that is used to indicate which kind of Service it is.
	ControlPlaneServiceLabel = OperatorLabelPrefix + "service"

	// SecretUsedByServiceLabel is a Secret's label that is used to indicate which Service kind is using the Secret.
	SecretUsedByServiceLabel = OperatorLabelPrefix + "secret-used-by-service"

	// ControlPlaneServiceKindAdmin is the value for SecretUsedByServiceLabel or ControlPlaneServiceLabel that
	// is used to indicate that a Service is an admin service.
	ControlPlaneServiceKindAdmin = "admin"

	// ControlPlaneServiceKindWebhook is the value for the SecretUsedByServiceLabel or ControlPlaneServiceLabel
	// that is used to indicate that a Service is a webhook service.
	ControlPlaneServiceKindWebhook = "webhook"

	// CertPurposeLabel indicates the purpose of a certificate.
	CertPurposeLabel = OperatorLabelPrefix + "cert-purpose"

	// GatewayStaticNamingAnnotation indicates that the gateway uses static naming for its resources.
	// This means that the DataPlane, ControlPlane and KonnectGatewayControlPlane resources
	// are named as the Gateway resource.
	GatewayStaticNamingAnnotation = OperatorAnnotationPrefix + "static-naming"

	// CertExpiresAtAnnotation is the annotation used to store the certificate expiration time
	// in RFC3339 format as an annotation on the Secret containing the certificate.
	CertExpiresAtAnnotation = "konghq.com/cert-expires-at"
)

const (
	// ClusterCertificateVolume is the name of the volume that holds the certificate
	// and keys which are used for serving traffic and  ControlPlane and DataPlane communication.
	ClusterCertificateVolume = "cluster-certificate"

	// ClusterCertificateVolumeMountPath holds the path where cluster certificate
	// volume will be mounted.
	ClusterCertificateVolumeMountPath = "/var/cluster-certificate"

	// TLSCRT is the filename for the tls.crt.
	TLSCRT = "tls.crt"

	// TLSKey is the filename for the tls.key.
	TLSKey = "tls.key"

	// CACRT is the filename for the ca.crt.
	CACRT = "ca.crt"

	// TLSCRTPath is the full path for the tls.crt file.
	TLSCRTPath = ClusterCertificateVolumeMountPath + "/" + TLSCRT

	// TLSKeyPath is the full path for the tls.key file.
	TLSKeyPath = ClusterCertificateVolumeMountPath + "/" + TLSKey

	// TLSCACRTPath is the full path for the ca.crt file.
	TLSCACRTPath = ClusterCertificateVolumeMountPath + "/" + CACRT

	// CertFieldSecret is the field name in Kubernetes secret - WebhookCertificateConfigSecretName.
	CertFieldSecret = "cert"

	// KeyFieldSecret is the field name in Kubernetes secret - WebhookCertificateConfigSecretName.
	KeyFieldSecret = "key"

	// CAFieldSecret is the field name in Kubernetes secret - WebhookCertificateConfigSecretName.
	CAFieldSecret = "ca"

	// KongClusterCertVolume is the name of the volume that holds the certificate the enables
	// communication between Kong and Konnect.
	KongClusterCertVolume = "kong-cluster-cert"

	// KongClusterCertVolumeMountPath holds the path where the Kong Cluster certificate
	// volume will be mounted.
	KongClusterCertVolumeMountPath = "/etc/secrets/kong-cluster-cert"
)

const (
	// ClusterCertEnvKey is the environment variable name for the cluster certificate.
	ClusterCertEnvKey = "KONG_CLUSTER_CERT"
	// ClusterCertKeyEnvKey is the environment variable name for the cluster certificate key.
	ClusterCertKeyEnvKey = "KONG_CLUSTER_CERT_KEY"
	// RouterFlavorEnvKey is the environment variable name for the Kong router flavor.
	RouterFlavorEnvKey = "KONG_ROUTER_FLAVOR"
)

const (
	// DefaultKonnectSyncPeriod is the default sync period for Konnect entities.
	DefaultKonnectSyncPeriod = time.Minute

	// DefaultKonnectRequestTimeout is the default timeout for requests to Konnect API.
	DefaultKonnectRequestTimeout = 10 * time.Second

	// DefaultMaxConcurrentReconcilesKonnect is the default max concurrent
	// reconciles for Konnect entities controllers.
	DefaultMaxConcurrentReconcilesKonnect = uint(8)

	// DefaultMaxConcurrentReconcilesDataPlane is the default max concurrent
	// reconciles for the DataPlane controllers.
	DefaultMaxConcurrentReconcilesDataPlane = uint(1)

	// DefaultMaxConcurrentReconcilesControlPlane is the default max concurrent
	// reconciles for the ControlPlane controllers.
	DefaultMaxConcurrentReconcilesControlPlane = uint(1)

	// DefaultMaxConcurrentReconcilesGateway is the default max concurrent
	// reconciles for the Gateway controllers.
	DefaultMaxConcurrentReconcilesGateway = uint(1)
)

const (
	// DefaultCertTTL is the default time-to-live for certificates issued by the operator.
	// Set to 10 years to be as it used to be in the past, but it can be overridden by user.
	DefaultCertTTL = 10 * 365 * 24 * time.Hour
	// DefaultCertExpirationMargin is the default duration before certificate
	// expiration at which the operator will trigger certificate renewal.
	// Set to 7 days to ensure certificates are renewed well before they expire.
	DefaultCertExpirationMargin = 7 * 24 * time.Hour
)

const (
	// KongIngressControllerPluginsAnnotation is the name of the annotation set on Services
	// which indicates to ControlPlane which KongPlugin instances to enable
	// for the Service.
	//
	// Ref: https://docs.konghq.com/kubernetes-ingress-controller/latest/reference/custom-resources/#kongplugin
	KongIngressControllerPluginsAnnotation = "konghq.com/plugins"

	// KongPluginNamePrometheus is the name of the KongPlugin for the Prometheus plugin.
	KongPluginNamePrometheus = "prometheus"
)

const (
	// DataPlaneManagedLabelValue indicates that an object's lifecycle is managed
	// by the dataplane controller.
	DataPlaneManagedLabelValue = "dataplane"

	// DataPlaneServiceTypeLabel is the label that is used for the services created by
	// the DataPlane controller to expose the DataPlane deployment.
	DataPlaneServiceTypeLabel = "gateway-operator.konghq.com/dataplane-service-type"

	// DataPlaneServiceStateLabel indicates the state of a DataPlane service.
	// Useful for progressive rollouts.
	DataPlaneServiceStateLabel = "gateway-operator.konghq.com/dataplane-service-state"

	// DataPlaneDeploymentStateLabel indicates the state of a DataPlane deployment.
	// Useful for progressive rollouts.
	DataPlaneDeploymentStateLabel = "gateway-operator.konghq.com/dataplane-deployment-state"

	// AnnotationLastAppliedAnnotations is the annotation key to store the last annotations
	// of a DataPlane-owned object (e.g. Ingress `Service`) applied by the DataPlane controller.
	// It allows the controller to decide which annotations are outdated compared to the DataPlane spec and
	// shall be removed. This guarantees no interference with annotations from other sources (e.g. users).
	AnnotationLastAppliedAnnotations = "gateway-operator.konghq.com/last-applied-annotations"

	// DataPlanePodStateLabel indicates the state of a DataPlane Pod.
	// Useful for progressive rollouts.
	DataPlanePodStateLabel = "gateway-operator.konghq.com/dataplane-pod-state"

	// DataPlaneStateLabelValuePreview indicates that a DataPlane resource is
	// a "preview" resource.
	// This is used in:
	// - the "preview" Service that is available to access the "preview" DataPlane Pods.
	// - the "preview" Deployment wraps the "preview" DataPlane Pods.
	DataPlaneStateLabelValuePreview = "preview"

	// DataPlaneStateLabelValueLive indicates that a DataPlane resource is
	// a "live" resource.
	// This is used in:
	// - the "live" Service that is available to access the "live" DataPlane Pods.
	// - the "live" Deployment wraps the "live" DataPlane Pods.
	DataPlaneStateLabelValueLive = "live"

	// DataPlaneAdminServiceLabelValue indicates that the service is intended to expose the
	// DataPlane admin API.
	DataPlaneAdminServiceLabelValue ServiceType = "admin"

	// DataPlaneIngressServiceLabelValue indicates that the service is intended to expose the
	// DataPlane proxy.
	DataPlaneIngressServiceLabelValue ServiceType = "ingress"
)

const (
	// DefaultDataPlaneBaseImage is the base container image that can be used
	// by default for a DataPlane resource if all other attempts to dynamically
	// decide an image fail.
	DefaultDataPlaneBaseImage = "kong"

	// DefaultDataPlaneBaseEnterpriseImage is the enterprise base container image.
	DefaultDataPlaneBaseEnterpriseImage = "kong/kong-gateway"

	// DefaultDataPlaneTag is the base container image tag that can be used
	// by default for a DataPlane resource if all other attempts to dynamically
	// decide an image tag fail.
	DefaultDataPlaneTag = "3.15" // renovate: datasource=docker depName=kong/kong-gateway

	// DefaultDataPlaneImage is the default container image that can be used if
	// all other attempts to dynamically decide the default image fail.
	DefaultDataPlaneImage = DefaultDataPlaneBaseEnterpriseImage + ":" + DefaultDataPlaneTag

	// ServiceSelectorOverrideAnnotation is used on the dataplane to override the Selector
	// of both the admin and proxy services.
	// The value of such an annotation is to be intended as a comma-separated list of
	// key=value selectors, so that it is possible to add multiple selectors to the same
	// service.
	//
	// Example:
	// gateway-operator.konghq.com/service-selector-override: "key1=value,key2=value2".
	ServiceSelectorOverrideAnnotation = "gateway-operator.konghq.com/service-selector-override"

	// DataPlaneProxyContainerName is the name of the Kong proxy container.
	DataPlaneProxyContainerName = "proxy"

	// DataPlaneStatusEndpoint is the endpoint to use for DataPlane readiness probe.
	DataPlaneStatusEndpoint = "/status"

	// DataPlaneStatusReadyEndpoint is the endpoint to use for DataPlane readiness probe
	// in the context of managed gateways.
	DataPlaneStatusReadyEndpoint = "/status/ready"
)

const (
	// DefaultHTTPPort is the default port used for HTTP ingress network traffic
	// from outside clusters.
	DefaultHTTPPort = 80

	// DefaultHTTPSPort is the default port used for HTTPS ingress network traffic
	// from outside clusters.
	DefaultHTTPSPort = 443

	// DataPlaneAdminAPIPort is the port that the dataplane uses for Admin API.
	DataPlaneAdminAPIPort = 8444

	// DataPlaneProxyPort is the port that the dataplane uses for HTTP.
	DataPlaneProxyPort = 8000

	// DataPlaneProxySSLPort is the port that the dataplane uses for HTTPS.
	DataPlaneProxySSLPort = 8443

	// DataPlaneMetricsPort is the port that the dataplane uses for metrics.
	DataPlaneMetricsPort = 8100

	// DataPlaneStatusPort is the port that the dataplane uses for status.
	DataPlaneStatusPort = 8100

	// DataPlaneAssignedPortStart is the port to assign when desired port is already occupied for other usage.
	DataPlaneAssignedPortStart = 16384
)

const (
	// DataPlaneAdminServicePortName is the port name of the DataPlane admin service.
	DataPlaneAdminServicePortName = "admin"

	// DataPlaneServiceDNSDiscoveryStrategy is DNS strategy to use when creating Gateway's Admin API addresses.
	DataPlaneServiceDNSDiscoveryStrategy = "service"
)

const (
	// DataPlaneManagedByLabelValue indicates that an object's lifecycle is managed
	// by the eventgatewaydataplane controller.
	DataPlaneManagedByLabelValue = "dataplane"

	// KEGDataPlaneManagedByLabelValue is the managed-by label value for KEG DataPlane owned resources.
	// Distinct from the gateway-operator DataPlaneManagedLabelValue ("dataplane") to avoid cross-query
	// collisions when listing Secrets by label selector.
	KEGDataPlaneManagedByLabelValue = "keg-dataplane"

	// KEGDataPlanePrefix is the GenerateName prefix used when creating mTLS certificate Secrets
	// for KEG DataPlane instances.
	KEGDataPlanePrefix = "keg-dp"

	// SecretKEGDataPlaneCertificateLabel marks a Secret as the mTLS certificate for a KEG DataPlane.
	SecretKEGDataPlaneCertificateLabel = "konghq.com/keg-dp-cert" //nolint:gosec
)

const (
	// KEGContainerName is the name of the KEG container in the DataPlane Deployment.
	KEGContainerName = "keg"

	// RelatedImageKEGEnvVar is the environment variable name for the KEG container image,
	// following the operator-framework convention for related images.
	RelatedImageKEGEnvVar = "RELATED_IMAGE_KEG"

	// DefaultKEGBaseImage is the base image name for the KEG container.
	DefaultKEGBaseImage = "kong/kong-event-gateway"
	// DefaultKEGTag is the default image tag for the KEG container.
	DefaultKEGTag = "1.2.1" // renovate: datasource=docker depName=kong/kong-event-gateway
	// DefaultKEGImage is the full default image reference for the KEG container.
	DefaultKEGImage = DefaultKEGBaseImage + ":" + DefaultKEGTag
)

const (
	// ServiceManagedByLabel indicates that an object's lifecycle is managed
	// by the Service controller.
	ServiceManagedByLabel = "service"

	// HTTPRouteManagedByLabel indicates that an object's lifecycle is managed
	// by the HTTPRoute controller.
	HTTPRouteManagedByLabel = "httproute"

	// HashSpecValueLabel is the label's suffix used to indicate the hash of an object's spec.
	HashSpecValueLabel = "hash-spec"

	// GatewayOperatorHashSpecLabel is the label used to indicate the hash of an object's spec.
	GatewayOperatorHashSpecLabel = OperatorLabelPrefix + HashSpecValueLabel
)

const (
	// HybridGatewaysAnnotation is used to annotate resources created for hybrid gateways,
	// indicating which gateways are associated with the resource.
	HybridGatewaysAnnotation = "hybrid-gateways"

	// GatewayOperatorHybridGatewaysAnnotation is the fully qualified annotation key
	// used to annotate resources created for hybrid gateways, indicating which gateways
	// are associated with the resource.
	GatewayOperatorHybridGatewaysAnnotation = OperatorAnnotationPrefix + HybridGatewaysAnnotation

	// HybridRouteHTTPRouteAnnotation is used to annotate resources created for hybrid gateways,
	// indicating which HTTPRoute is associated with the resource.
	HybridRouteHTTPRouteAnnotation = "hybrid-routes"

	// HybridRouteGRPCRouteAnnotation is used to annotate resources created for hybrid gateways,
	// indicating which GRPCRoutes are associated with the resource.
	HybridRouteGRPCRouteAnnotation = "hybrid-routes-GRPCRoute"

	// HybridRouteTLSRouteAnnotation is used to annotate resources created for hybrid gateways,
	// indicating which TLSRoutes are associated with the resource.
	HybridRouteTLSRouteAnnotation = "hybrid-routes-TLSRoute"

	// HybridRouteTCPRouteAnnotation is used to annotate resources created for hybrid gateways,
	// indicating which TCPRoutes are associated with the resource.
	HybridRouteTCPRouteAnnotation = "hybrid-routes-TCPRoute"

	// GatewayOperatorHybridRoutesHTTPRouteAnnotation is the fully qualified annotation key
	// used to annotate resources created for hybrid gateways, indicating which HTTPRoute
	// is associated with the resource.
	GatewayOperatorHybridRoutesHTTPRouteAnnotation = OperatorAnnotationPrefix + HybridRouteHTTPRouteAnnotation

	// GatewayOperatorHybridRoutesGRPCRouteAnnotation is the fully qualified annotation key
	// used to annotate resources created for hybrid gateways, indicating which GRPCRoute
	// is associated with the resource.
	GatewayOperatorHybridRoutesGRPCRouteAnnotation = OperatorAnnotationPrefix + HybridRouteGRPCRouteAnnotation

	// GatewayOperatorHybridRoutesTLSRouteAnnotation is the fully qualified annotation key
	// used to annotate resources created for hybrid gateways, indicating which TLSRoute
	// is associated with the resource.
	GatewayOperatorHybridRoutesTLSRouteAnnotation = OperatorAnnotationPrefix + HybridRouteTLSRouteAnnotation

	// GatewayOperatorHybridRoutesTCPRouteAnnotation is the fully qualified annotation key
	// used to annotate resources created for hybrid gateways, indicating which TCPRoute
	// is associated with the resource.
	GatewayOperatorHybridRoutesTCPRouteAnnotation = OperatorAnnotationPrefix + HybridRouteTCPRouteAnnotation

	// HybridRouteUDPRouteAnnotation is used to annotate resources created for hybrid gateways,
	// indicating which UDPRoutes are associated with the resource.
	HybridRouteUDPRouteAnnotation = "hybrid-routes-UDPRoute"

	// GatewayOperatorHybridRoutesUDPRouteAnnotation is the fully qualified annotation key
	// used to annotate resources created for hybrid gateways, indicating which UDPRoute
	// is associated with the resource.
	GatewayOperatorHybridRoutesUDPRouteAnnotation = OperatorAnnotationPrefix + HybridRouteUDPRouteAnnotation

	// GatewayOperatorHybridListenerPortLabel is the fully qualified label key
	// used to label resources created for hybrid gateways, indicating the listener port
	// associated with the resource.
	GatewayOperatorHybridListenerPortLabel = OperatorAnnotationPrefix + "listener-port"
)

const (
	// KongPluginInstallationManagedLabelValue indicates that an object's lifecycle is managed by the
	// KongPluginInstallation controller.
	KongPluginInstallationManagedLabelValue = "kong-plugin-installation"

	// AnnotationMappedToKongPluginInstallation is the annotation key used to store the name of the KongPluginInstallation
	// that maps to particular ConfigMap.
	AnnotationMappedToKongPluginInstallation = OperatorLabelPrefix + "mapped-to-kong-plugin-installation"

	// AnnotationKongPluginInstallationGenerationInternal is the annotation key used to store KongPluginInstallation
	// and its generation, internal usage to re-trigger deployment when KongPluginInstallation changes.
	AnnotationKongPluginInstallationGenerationInternal = OperatorLabelPrefix + "kong-plugin-installation-generation"
)

const (
	// KonnectExtensionPrefix is used as a name prefix to generate KonnectExtension-owned objects' name.
	KonnectExtensionPrefix = "konnect-extension"

	// MCPServerPrefix is used as a name prefix to generate MCPServer-owned objects' name.
	MCPServerPrefix = "mcpserver"

	// MCPServerDefaultPort is the default port exposed by MCP server containers.
	MCPServerDefaultPort = 8080

	// MCPServerDataPlaneContainerName is the name of the main MCP server
	// container in the Deployment managed by the MCPServerDataPlane controller.
	MCPServerDataPlaneContainerName = "mcp-server"

	// MCPServerDataPlaneInitContainerName is the name of the init container
	// that fetches the MCP server code in the Deployment managed by the
	// MCPServerDataPlane controller.
	MCPServerDataPlaneInitContainerName = "init-mcp-server"
)

const (
	// KonnectGatewayControlPlaneFinalizer is the finalizer added to KonnectGatewayControlPlane
	// resources when created by the Gateway controller.
	KonnectGatewayControlPlaneFinalizer = "gateway.operator.konghq.com/konnect-gateway-controlplane"

	// CleanupPluginBindingFinalizer is the finalizer that is attached to entities that
	// are referenced as targets by managed KongPluginBindings (binding instances created
	// by the controller out of entities' konghq.com/plugins annotations).
	// This finalizer is used by the controller to be sure that whenever an entity is deleted,
	// all the targeting managed KongPluginBindings are deleted as well.
	CleanupPluginBindingFinalizer = "gateway.konghq.com/cleanup-plugin-binding"
	// PluginInUseFinalizer is the finalizer attached to KongPlugin resources that are
	// properly referenced by KongPluginBindings.
	// It avoids that KongPlugins get deleted when KongPluginBindings are still referencing them.
	PluginInUseFinalizer = "gateway.konghq.com/plugin-in-use"
	// KonnectExtensionSecretInUseFinalizer is the finalizer added to the secret
	// referenced by KonnectExtension to ensure that the secret is not deleted
	// when in use by an active KonnectExtension.
	KonnectExtensionSecretInUseFinalizer = "gateway.konghq.com/secret-in-use"

	// KonnectSecretInUseFinalizer is the finalizer added to the secret
	// referenced by Konnect resources to ensure that the secret is not deleted
	// when in use by an active Konnect resource.
	KonnectSecretInUseFinalizer = "gateway.konghq.com/secret-in-use-by-konnect-resource"
)

const (
	// SecretProvisioningLabelKey is the label key used to store the provisioning method
	// of the secret resource.
	SecretProvisioningLabelKey = "gateway.konghq.com/secret-provisioning"
	// SecretProvisioningAutomaticLabelValue indicates that the secret resource is
	// automatically provisioned by the controller.
	SecretProvisioningAutomaticLabelValue = "automatic"
	// KonnectExtensionManagedByLabelValue indicates that an object's lifecycle is managed
	// by the KonnectExtension controller.
	KonnectExtensionManagedByLabelValue = "konnect-extension"
	// MCPServerManagedByLabelValue indicates that an object's lifecycle is managed
	// by the MCPServer controller.
	MCPServerManagedByLabelValue = "mcpserver"
)

const (
	// AnnotationSpecHash is the annotation used to store the hash of the spec
	// in the owner object.
	// This is used to detect changes in the spec of the owner object and to prevent
	// unnecessary updates to the child objects when enforce-config is set to false.
	// One exemplar use case for this is AKS where Admission Enforcer mutates
	// ControlPlane's ValidatingWebhookConfiguration.
	AnnotationSpecHash = "gateway-operator.konghq.com/spec-hash"
)

const (
	// ControlPlaneManagedLabelValue indicates that an object's lifecycle is managed
	// by the controlplane controller.
	ControlPlaneManagedLabelValue = "controlplane"
)

const (
	// ControlPlanePrefix is used as a name prefix to generate controlplane-owned objects' name.
	ControlPlanePrefix = "controlplane"
)

const (
	// DataPlaneCertificateIDAnnotationKey is the label key used to store the certificate IDs
	// associated with the secret resource. Since multiple Konnect Certificates can be
	// created out of a single secret, this label is used to store the certificate ID
	// of all the certificates created out of the secret, separated by commas.
	// Example: konnect.konghq.com/certificate-ids: "xxxxxx,yyyyyy,zzzzzz".
	DataPlaneCertificateIDAnnotationKey = "konnect.konghq.com/certificate-ids"
)

const (
	// DataPlaneOwnedWaitForOwnerFinalizer is the finalizer added to resources owned by a DataPlane
	// to ensure that the resources are not deleted before the DataPlane is deleted.
	DataPlaneOwnedWaitForOwnerFinalizer = "gateway-operator.konghq.com/wait-for-owner"
)

const (
	// DataPlanePrefix is used as a name prefix to generate dataplane-owned objects' name.
	DataPlanePrefix = "dataplane"
)

const (
	// EnvVarKongDatabase is the environment variable name to specify database
	// backend used for dataplane(Kong gateway). Currently only DBLess mode
	// (empty, or "off") is supported.
	EnvVarKongDatabase = "KONG_DATABASE"
)

const (
	// ExtensionInUseFinalizer is the finalizer added to KonnectExtension
	// to ensure that the resources are not deleted when in use by a dataplane.
	ExtensionInUseFinalizer = "gateway-operator.konghq.com/extension-in-use"
)

const MaxKongServiceTimeout = 2147483646