webhook

const (
	SecretName = "kloak-webhook-certs"
	CertKey    = "tls.crt"
	KeyKey     = "tls.key"
)

const (
	// LabelEnabled is the label used to enable Kloak on a pod or namespace.
	// Pod-level enablement uses a label (not annotation) so that Kubernetes
	// objectSelector can match it, allowing the webhook to be scoped precisely.
	LabelEnabled = "getkloak.io/enabled"

	// AnnotationEnabled is the annotation injected by the webhook onto mutated pods.
	// The controller (DaemonSet) reads this to determine if a pod is kloak-enabled.
	AnnotationEnabled = "getkloak.io/enabled"
)

const (
	// AnnotationHosts is the hostname/IP a secret may be sent to.
	AnnotationHosts = "getkloak.io/hosts"
	// AnnotationPort restricts a secret to a specific port (or port/proto).
	AnnotationPort = "getkloak.io/port"
)