nodegc

const (
	// EventDeleted records one real node deletion. These entries are
	// also the restart-safe rate limiter: the delete budget counts
	// EventDeleted lines inside the trailing window, so a daemon that
	// restarts ten times in ten minutes shares ONE budget instead of
	// minting ten.
	EventDeleted = "deleted"
	// EventDryRunDeleted records a node dry-run mode WOULD have
	// deleted. Never counted against the real budget.
	EventDryRunDeleted = "dry_run_deleted"
	// EventRefusedMassStale records a whole pass refused by the
	// cluster-wide unhealthy circuit breaker.
	EventRefusedMassStale = "refused_mass_stale"
	// EventRefusedClockSkew records a whole pass refused because a
	// node's readiness evidence was timestamped in our future.
	EventRefusedClockSkew = "refused_clock_skew"
)

const (
	// RuntimeLabel / BackendLabel / HostLabel are the node-identity
	// labels the k3s agent entrypoint stamps at registration
	// (internal/agent/runtime/image/entrypoint.sh), matching the
	// cloud-hosted control plane's vocabulary exactly.
	RuntimeLabel = "outpost.dhnt.io/runtime"
	BackendLabel = "outpost.dhnt.io/backend"
	HostLabel    = "outpost.dhnt.io/host"

	// RuntimeAgent / BackendK3s are the only label values GC acts on.
	// Virtual-kubelet nodes carry runtime=virtual and a vk-* backend;
	// they have no kubelet lease of their own worth reaping here.
	RuntimeAgent = "agent"
	BackendK3s   = "k3s"

	// ControlPlaneRoleLabel / MasterRoleLabel mark apiserver-hosting
	// nodes (k3s stamps the first on its server node). A node carrying
	// either is NEVER a GC candidate regardless of its other labels —
	// reaping the plane's own node is strictly worse than reaping a
	// worker, and role labels are at least plane-adjacent facts rather
	// than pure worker self-assertion.
	ControlPlaneRoleLabel = "node-role.kubernetes.io/control-plane"
	MasterRoleLabel       = "node-role.kubernetes.io/master"

	// DefaultGrace is how long a node must have been NotReady/Unknown
	// (per its Ready condition's LastTransitionTime) before it is
	// stale. A day comfortably clears laptop sleeps, reboots, and
	// multi-hour network outages — the node of a machine that comes
	// back inside the window reconnects and goes Ready again.
	DefaultGrace = 24 * time.Hour

	// DefaultMaxDeletes bounds deletes per rate window (see
	// DefaultInterval). GC converges over several windows instead of
	// mass-deleting in one, so one bad pass can only do bounded damage.
	DefaultMaxDeletes = 3

	// DefaultInterval is the pass cadence AND the delete-rate window:
	// at most MaxDeletes deletions per Interval of wall clock, counted
	// from the persisted ledger — not per pass, and not per process
	// lifetime. Outpost self-restarts on any builtin toggle; a budget
	// that reset with the process would multiply by restart count.
	DefaultInterval = time.Hour

	// DefaultSettle delays the FIRST pass after Run starts. Boot is
	// exactly when evidence is least trustworthy: the tunnel may not
	// be up, NTP may not have corrected a wrong RTC yet, and restart
	// storms (10 toggles == 10 boots) would otherwise each get an
	// immediate pass.
	DefaultSettle = 5 * time.Minute

	// DefaultMinUptime is how long the collector must have been
	// running — measured monotonically, immune to wall-clock jumps —
	// before it is allowed to DELETE. Staleness is wall-clock
	// arithmetic against apiserver-recorded timestamps; a host whose
	// RTC was wrong at boot (consumer hardware, restored VM snapshot,
	// dual-boot) computes garbage elapsed times until NTP fixes the
	// clock, and boot is also when the settle-window pass fires. An
	// hour of uptime — a meaningful fraction of the 24 h grace — means
	// NTP had ample time to sync before we trust the math. Passes
	// before that run read-only.
	DefaultMinUptime = time.Hour

	// DefaultMaxStaleFraction is the cluster-wide unhealthy circuit
	// breaker (upstream's --unhealthy-zone-threshold analog): when
	// MORE than this fraction of the observed outpost-agent population
	// is stale at once, the pass deletes nothing. "Everything looks
	// dead" nearly always means the observer broke — a >24 h partition
	// of the control-plane host flips every worker to Unknown with the
	// same LastTransitionTime, and without this guard GC would drain
	// the cluster at MaxDeletes per window until empty.
	DefaultMaxStaleFraction = 0.5
)