features

const (

	// DeprecatedPolicySpec enable the use of deprecated policy spec
	DeprecatedPolicySpec featuregate.Feature = "DeprecatedPolicySpec"
	// LegacyObjectTypeIdentifier enable the use of legacy object type identifier for selecting ref-object
	LegacyObjectTypeIdentifier featuregate.Feature = "LegacyObjectTypeIdentifier"
	// DeprecatedObjectLabelSelector enable the use of deprecated object label selector for selecting ref-object
	DeprecatedObjectLabelSelector featuregate.Feature = "DeprecatedObjectLabelSelector"
	// LegacyResourceTrackerGC enable the gc of legacy resource tracker in managed clusters
	LegacyResourceTrackerGC featuregate.Feature = "LegacyResourceTrackerGC"
	// LegacyResourceOwnerValidation if enabled, the resource dispatch will allow existing resource not to have owner
	// application and the current application will take over it
	LegacyResourceOwnerValidation featuregate.Feature = "LegacyResourceOwnerValidation"
	// DisableReferObjectsFromURL if set, the url ref objects will be disallowed
	DisableReferObjectsFromURL featuregate.Feature = "DisableReferObjectsFromURL"

	// ApplyResourceByReplace enforces the modification of resource through PUT requests.
	// If not set, the resource modification will use patch requests (three-way-strategy-merge-patch).
	// The side effect of enabling this feature is that the request traffic will increase due to
	// the increase of bytes transferred and the more frequent resource mutation failure due to the
	// potential conflicts.
	// If set, KubeVela controller will enforce strong restriction on the managed resource that external
	// system would be unable to make modifications to the KubeVela managed resource. In other words,
	// no merge for modifications from multiple sources. Only KubeVela keeps the Source-of-Truth for the
	// resource.
	ApplyResourceByReplace featuregate.Feature = "ApplyResourceByReplace"

	// AuthenticateApplication enable the authentication for application
	AuthenticateApplication featuregate.Feature = "AuthenticateApplication"
	// ValidateDefinitionPermissions enables RBAC validation for definition access in applications
	ValidateDefinitionPermissions featuregate.Feature = "ValidateDefinitionPermissions"
	// RestrictDefinitionNamespaces enforces a definition's spec.restrictions, or
	// its definition.oam.dev/restrict-namespaces annotation, when an Application is
	// written. Defaults on: it does nothing until a definition declares a
	// restriction, and is here to switch enforcement off, not on.
	RestrictDefinitionNamespaces featuregate.Feature = "RestrictDefinitionNamespaces"
	// GzipResourceTracker enables the gzip compression for ResourceTracker. It can be useful if you have large
	// application that needs to dispatch lots of resources or large resources (like CRD or huge ConfigMap),
	// which at the cost of slower processing speed due to the extra overhead for compression and decompression.
	GzipResourceTracker featuregate.Feature = "GzipResourceTracker"
	// ZstdResourceTracker enables the zstd compression for ResourceTracker.
	// Refer to GzipResourceTracker for its use-cases. It is much faster and more
	// efficient than gzip, about 2x faster and compresses to smaller size.
	// If you are dealing with very large ResourceTrackers (1MB or so), it should
	// have almost NO performance penalties compared to no compression at all.
	// If dealing with smaller ResourceTrackers (10KB - 1MB), the performance
	// penalties are minimal.
	ZstdResourceTracker featuregate.Feature = "ZstdResourceTracker"

	// GzipApplicationRevision serves the same purpose as GzipResourceTracker,
	// but for ApplicationRevision.
	GzipApplicationRevision featuregate.Feature = "GzipApplicationRevision"
	// ZstdApplicationRevision serves the same purpose as ZstdResourceTracker,
	// but for ApplicationRevision.
	ZstdApplicationRevision featuregate.Feature = "ZstdApplicationRevision"

	// ApplyOnce enable the apply-once feature for all applications
	// If enabled, no StateKeep will be run, ResourceTracker will also disable the storage of all resource data, only
	// metadata will be kept
	ApplyOnce featuregate.Feature = "ApplyOnce"

	// MultiStageComponentApply enable multi-stage feature for component
	// If enabled, the dispatch of manifests is performed in batches according to the stage
	MultiStageComponentApply featuregate.Feature = "MultiStageComponentApply"

	// PreDispatchDryRun enable dryrun before dispatching resources
	// Enable this flag can help prevent unsuccessful dispatch resources entering resourcetracker and improve the
	// user experiences of gc but at the cost of increasing network requests.
	PreDispatchDryRun featuregate.Feature = "PreDispatchDryRun"

	// ValidateComponentWhenSharding validate component in sharding mode
	// In sharding mode, since ApplicationRevision will not be cached for webhook, the validation of component
	// need to call Kubernetes APIServer which can be slow and take up some network traffic. So by default, the
	// validation of component will be disabled.
	ValidateComponentWhenSharding = "ValidateComponentWhenSharding"

	// DisableWebhookAutoSchedule disable auto schedule for application mutating webhook when sharding enabled
	// If set to true, the webhook will not make auto schedule for applications and users can make customized
	// scheduler for assigning shards to applications
	DisableWebhookAutoSchedule = "DisableWebhookAutoSchedule"

	// DisableBootstrapClusterInfo disable the cluster info bootstrap at the starting of the controller
	DisableBootstrapClusterInfo = "DisableBootstrapClusterInfo"

	// InformerCacheFilterUnnecessaryFields filter unnecessary fields for informer cache
	InformerCacheFilterUnnecessaryFields = "InformerCacheFilterUnnecessaryFields"

	// SharedDefinitionStorageForApplicationRevision use definition cache to reduce duplicated definition storage
	// for application revision, must be used with InformerCacheFilterUnnecessaryFields
	SharedDefinitionStorageForApplicationRevision = "SharedDefinitionStorageForApplicationRevision"

	// DisableWorkflowContextConfigMapCache disable the workflow context's configmap informer cache
	DisableWorkflowContextConfigMapCache = "DisableWorkflowContextConfigMapCache"

	// EnableCueValidation enable strict cue validation fields for the required parameter field verification
	EnableCueValidation = "EnableCueValidation"

	// EnableApplicationStatusMetrics enable the collection and export of application status metrics and structured logging
	EnableApplicationStatusMetrics = "EnableApplicationStatusMetrics"

	// ValidateResourcesExist enables webhook validation to check if resource types referenced in
	// ComponentDefinition/TraitDefinition/WorkflowStepDefinition/PolicyDefinition CUE templates exist in the cluster
	ValidateResourcesExist = "ValidateResourcesExist"

	// EnableGlobalPolicies enables automatic discovery of global PolicyDefinitions
	// Controls whether policies with global: true are discovered from vela-system and namespace
	EnableGlobalPolicies featuregate.Feature = "EnableGlobalPolicies"

	// EnableApplicationScopedPolicies enables the execution of Application-scoped policies.
	// When disabled, policies with scope: Application will not be applied (both global and explicit).
	// This gates the core Application transform functionality. Use EnableGlobalPolicies to
	// separately control global policy discovery.
	EnableApplicationScopedPolicies featuregate.Feature = "EnableApplicationScopedPolicies"

	// EnableSourceAutoUpdate is the controller-wide default for source-driven
	// re-dispatch: whether a component is re-applied when a value it read from a
	// SourceDefinition changes. It decides only what happens to an Application
	// carrying no opinion of its own - spec.sources[].autoUpdate overrides it in
	// both directions, and a publishVersion pin suppresses the refresh regardless.
	EnableSourceAutoUpdate featuregate.Feature = "EnableSourceAutoUpdate"

	// ValidateUndeclaredParameters enables validation that rejects parameters not declared in the
	// CUE definition schema. When enabled, any parameter field not present in the template's
	// parameter stanza will cause a validation error at admission time.
	ValidateUndeclaredParameters = "ValidateUndeclaredParameters"

	// EnableAddonComponent enables installing an addon as an Application component via the
	// type: addon ComponentDefinition. The ComponentDefinition and its vela/addon CueX
	// package always ship, because the definition cannot compile without the package; this
	// gate controls whether the render service is wired up and whether the shared Application
	// webhook runs its addon-specific compatibility-validation branch. The shared Application
	// webhook is always registered. When disabled, nothing addon-specific runs and an
	// Application using type: addon fails at render with an actionable message.
	EnableAddonComponent featuregate.Feature = "EnableAddonComponent"
	// EnableCelExpressions turns on $( ) property expressions, and with them
	// SourceDefinition, which cannot be used without them. The dependency runs one
	// way: an expression reading $(context.namespace) needs no source at all, so
	// this gate is named for the mechanism rather than for its first consumer.
	//
	// Off by default because the delimiter is Kubernetes' own: $(VAR_NAME) is the
	// documented syntax for a dependent environment variable, and is ordinary in
	// env, command and args. With the pass running, such a value is read as an
	// expression and refused - at admission and again at render. An installed base
	// that has never heard of this feature must not have to escape anything, so
	// the pass does not run until an operator asks for it.
	//
	// When enabled, an Application still opts in individually unless
	// RequireCelExpressionOptIn is turned off. See there for why.
	EnableCelExpressions featuregate.Feature = "EnableCelExpressions"

	// RequireCelExpressionOptIn keeps expressions to Applications that ask for
	// them by annotation, so enabling the feature is not itself a fleet-wide
	// change.
	//
	// Defaults on, so the safe path is the default one: switch the feature on,
	// annotate the Applications that want it, and only relax this once the fleet
	// has been checked for $(VAR) in env, command and args. Turning it off makes
	// every Application eligible at once.
	RequireCelExpressionOptIn featuregate.Feature = "RequireCelExpressionOptIn"

	// EnableDefinitionInheritance enables spec.extends on ComponentDefinition and
	// TraitDefinition, letting a definition render on top of another. With the
	// gate off a definition that sets the field is refused rather than ignored,
	// since ignoring it would render the child's template with an unresolved
	// `$super`.
	EnableDefinitionInheritance featuregate.Feature = "EnableDefinitionInheritance"

	// EnableModuleComponent enables installing a module as an Application component via the
	// type: module ComponentDefinition. As with EnableAddonComponent, the ComponentDefinition
	// and its vela/module CueX package always ship, because the definition cannot compile
	// without the package; this gate controls whether the render service is wired up and
	// whether the shared Application webhook runs its module-specific validation branch.
	// When disabled, an Application using type: module fails at render with an actionable
	// message.
	EnableModuleComponent featuregate.Feature = "EnableModuleComponent"

	// AutoMigrateLegacyConfigs runs one adoption sweep when the controller starts:
	// every legacy config template (config-template-* ConfigMap) and legacy config
	// (velacore-config Secret) in the cluster is adopted into a ConfigTemplate or
	// Config CR, the same as `vela config-template migrate --all` in every
	// namespace. Legacy objects are kept; conflicts and failures are reported as
	// Events, log lines and the kubevela_config_migration_total metric, never as a
	// startup error. Off by default: the CLI command is the on-demand path, this
	// gate is for operators who want the upgrade itself to do it.
	AutoMigrateLegacyConfigs featuregate.Feature = "AutoMigrateLegacyConfigs"
)

const (
	// FeatureGatesConfigMapName is the ConfigMap, in the system namespace, where
	// the controller publishes KubeVela's feature gates when it starts: a key per
	// gate, "true" or "false". Other processes that run KubeVela code, such as
	// VelaUX, read it to behave as the controller does.
	FeatureGatesConfigMapName = "kubevela-feature-gates"
	// FeatureGatesVersionAnnotation is the KubeVela version that published them.
	FeatureGatesVersionAnnotation = "core.oam.dev/kubevela-version"
)