webhook

const (
	LabelInject        = "berth.skaphos.io/inject"
	InjectValueAcquire = "acquire"
)

const (
	AnnLeaseName           = "berth.skaphos.io/lease-name"
	AnnLeaseNamespace      = "berth.skaphos.io/lease-namespace"
	AnnMode                = "berth.skaphos.io/mode"
	AnnHolderIdentity      = "berth.skaphos.io/holder-identity"
	AnnTTLSeconds          = "berth.skaphos.io/ttl-seconds"
	AnnHeartbeatSeconds    = "berth.skaphos.io/heartbeat-interval-seconds"
	AnnReleaseOnShutdown   = "berth.skaphos.io/release-on-shutdown"
	AnnEnforce             = "berth.skaphos.io/enforce"
	AnnEnforceGraceSeconds = "berth.skaphos.io/enforce-grace-seconds"
	// AnnSignalTarget scopes enforce=signal to the workload process, matched by
	// comm or executable basename (e.g. "nginx"). Without it the sidecar signals
	// every process in the shared PID namespace except berth's own, which can
	// terminate co-located sidecars on lease loss.
	AnnSignalTarget = "berth.skaphos.io/signal-target"

	// AnnInjected is set on a Pod once it has been mutated. It is an
	// observable marker for humans and tooling — "this pod went through the
	// injector" — and nothing more.
	//
	// It MUST NOT be used to decide whether to inject. It is submitter-
	// controlled: a workload can set it on create, and treating that as proof
	// of prior injection admitted ungated pods that still carried the opt-in
	// label (#143). Which admission path a request arrived on is read from
	// the AdmissionRequest's subresource instead, which cannot be forged by
	// the object under review.
	AnnInjected = "berth.skaphos.io/injected"
)

const (
	VolumeName           = "berth-state"
	InitContainerName    = "berth-acquire"
	SidecarContainerName = "berth-sidecar"

	// AuthTokenVolume / AuthCABundleVolume mount the bearer token and CA
	// bundle into the injected helper containers when those sources are
	// configured (SKA-444).
	AuthTokenVolume    = "berth-auth-token"
	AuthCABundleVolume = "berth-auth-ca"
)