const (
    // DefaultRequireCriticalServersOnly is the default for requiring critical servers only.
    // (bryce) this default is set here and in the service env config, need to figure out how to refactor
    // this to be in one place.
    DefaultRequireCriticalServersOnly = false
)

const (
    // DefaultUploadConcurrencyLimit is the default maximum number of concurrent object storage uploads.
    // (bryce) this default is set here and in the service env config, need to figure out how to refactor
    // this to be in one place.
    DefaultUploadConcurrencyLimit = 100
)

const (
    // RequireCriticalServersOnlyEnvVar is the environment variable for requiring critical servers only.
    RequireCriticalServersOnlyEnvVar = "REQUIRE_CRITICAL_SERVERS_ONLY"
)

const (
    // UploadConcurrencyLimitEnvVar is the environment variable for the upload concurrency limit.
    UploadConcurrencyLimitEnvVar = "STORAGE_UPLOAD_CONCURRENCY_LIMIT"
)

const (
    // WorkerSAName is the name of the service account that pachyderm
    // pipelines use to create an s3 gateway service for each job
    WorkerSAName = "pachyderm-worker"
)

var (

    // ServiceAccountName is the name of Pachyderm's service account.
    // It's public because it's needed by pps.APIServer to create the RCs for
    // workers.
    ServiceAccountName = "pachyderm"

    // PrometheusPort hosts the prometheus stats for scraping
    PrometheusPort = 656

    // IAMAnnotation is the annotation used for the IAM role, this can work
    // with something like kube2iam as an alternative way to provide
    // credentials.
    IAMAnnotation = "iam.amazonaws.com/role"
)

type AmazonCreds struct {
    // Direct credentials. Only applicable if Pachyderm is given its own permanent
    // AWS credentials
    ID     string // Access Key ID
    Secret string // Secret Access Key
    Token  string // Access token (if using temporary security credentials

    // Vault options (if getting AWS credentials from Vault)
    VaultAddress string // normally addresses come from env, but don't have vault service name
    VaultRole    string
    VaultToken   string
}

type AssetOpts struct {
    FeatureFlags
    StorageOpts
    PachdShards uint64
    Version     string
    LogLevel    string
    Metrics     bool
    Dynamic     bool
    EtcdNodes   int
    EtcdVolume  string
    DashOnly    bool
    NoDash      bool
    DashImage   string
    Registry    string
    EtcdPrefix  string
    PachdPort   int32
    TracePort   int32
    HTTPPort    int32
    PeerPort    int32

    // NoGuaranteed will not generate assets that have both resource limits and
    // resource requests set which causes kubernetes to give the pods
    // guaranteed QoS. Guaranteed QoS generally leads to more stable clusters
    // but on smaller test clusters such as those run on minikube it doesn't
    // help much and may cause more instability than it prevents.
    NoGuaranteed bool

    // DisableAuthentication stops Pachyderm's authentication service
    // from talking to GitHub, for testing. Instead users can authenticate
    // simply by providing a username.
    DisableAuthentication bool

    // BlockCacheSize is the amount of memory each PachD node allocates towards
    // its cache of PFS blocks. If empty, assets.go will choose a default size.
    BlockCacheSize string

    // PachdCPURequest is the amount of CPU we request for each pachd node. If
    // empty, assets.go will choose a default size.
    PachdCPURequest string

    // PachdNonCacheMemRequest is the amount of memory we request for each
    // pachd node in addition to BlockCacheSize. If empty, assets.go will choose
    // a default size.
    PachdNonCacheMemRequest string

    // EtcdCPURequest is the amount of CPU (in cores) we request for each etcd
    // node. If empty, assets.go will choose a default size.
    EtcdCPURequest string

    // EtcdMemRequest is the amount of memory we request for each etcd node. If
    // empty, assets.go will choose a default size.
    EtcdMemRequest string

    // EtcdStorageClassName is the name of an existing StorageClass to use when
    // creating a StatefulSet for dynamic etcd storage. If unset, a new
    // StorageClass will be created for the StatefulSet.
    EtcdStorageClassName string

    // IAM role that the Pachyderm deployment should assume when talking to AWS
    // services (if using kube2iam + metadata service + IAM role to delegate
    // permissions to pachd via its instance).
    // This is in AssetOpts rather than AmazonCreds because it must be passed
    // as an annotation on the pachd pod rather than as a k8s secret
    IAMRole string

    // ImagePullSecret specifies an image pull secret that gets attached to the
    // various deployments so that their images can be pulled from a private
    // registry.
    ImagePullSecret string

    // NoRBAC, if true, will disable creation of RBAC assets.
    NoRBAC bool

    // LocalRoles, if true, uses Role and RoleBinding instead of ClusterRole and
    // ClusterRoleBinding.
    LocalRoles bool

    // Namespace is the kubernetes namespace to deploy to.
    Namespace string

    // NoExposeDockerSocket if true prevents pipelines from accessing the docker socket.
    NoExposeDockerSocket bool

    // ExposeObjectAPI, if set, causes pachd to serve Object/Block API requests on
    // its public port. This should generally be false in production (it breaks
    // auth) but is needed by tests
    ExposeObjectAPI bool

    // If set, the files indictated by 'TLS.ServerCert' and 'TLS.ServerKey' are
    // placed into a Kubernetes secret and used by pachd nodes to authenticate
    // during TLS
    TLS *TLSOpts

    // Sets the cluster deployment ID. If unset, this will be a randomly
    // generated UUID without dashes.
    ClusterDeploymentID string

    // RequireCriticalServersOnly is true when only the critical Pachd servers
    // are required to startup and run without error.
    RequireCriticalServersOnly bool
}

type FeatureFlags struct {
    // NewStorageLayer, if true, will make Pachyderm use the new storage layer.
    NewStorageLayer bool
}

type StorageOpts struct {
    UploadConcurrencyLimit int
}

type TLSOpts struct {
    ServerCert string
    ServerKey  string
}