const (
    // WorkerServiceAccountEnvVar is the name of the environment variable used to tell pachd
    // what service account to assign to new worker RCs, for the purpose of
    // creating S3 gateway services.
    WorkerServiceAccountEnvVar = "WORKER_SERVICE_ACCOUNT"
    // DefaultWorkerServiceAccountName is the default value to use if WorkerServiceAccountEnvVar is
    // undefined (for compatibility purposes)
    DefaultWorkerServiceAccountName = "pachyderm-worker"
)

const (
    // UploadConcurrencyLimitEnvVar is the environment variable for the upload concurrency limit.
    UploadConcurrencyLimitEnvVar = "STORAGE_UPLOAD_CONCURRENCY_LIMIT"

    // PutFileConcurrencyLimitEnvVar is the environment variable for the PutFile concurrency limit.
    PutFileConcurrencyLimitEnvVar = "STORAGE_PUT_FILE_CONCURRENCY_LIMIT"
)

const (
    // DefaultUploadConcurrencyLimit is the default maximum number of concurrent object storage uploads.
    // (bryce) this default is set here and in the service env config, need to figure out how to refactor
    // this to be in one place.
    DefaultUploadConcurrencyLimit = 100

    // DefaultPutFileConcurrencyLimit is the default maximum number of concurrent files that can be uploaded over GRPC or downloaded from external sources (ex. HTTP or blob storage).
    DefaultPutFileConcurrencyLimit = 100
)

const (
    // DefaultRequireCriticalServersOnly is the default for requiring critical servers only.
    // (bryce) this default is set here and in the service env config, need to figure out how to refactor
    // this to be in one place.
    DefaultRequireCriticalServersOnly = false
)

const (
    // RequireCriticalServersOnlyEnvVar is the environment variable for requiring critical servers only.
    RequireCriticalServersOnlyEnvVar = "REQUIRE_CRITICAL_SERVERS_ONLY"
)

var (

    // ServiceAccountName is the name of Pachyderm's service account.
    // It's public because it's needed by pps.APIServer to create the RCs for
    // workers.
    ServiceAccountName = "pachyderm"

    // PrometheusPort hosts the prometheus stats for scraping
    PrometheusPort = 656

    // IAMAnnotation is the annotation used for the IAM role, this can work
    // with something like kube2iam as an alternative way to provide
    // credentials.
    IAMAnnotation = "iam.amazonaws.com/role"
)

type AmazonCreds struct {
    // Direct credentials. Only applicable if Pachyderm is given its own permanent
    // AWS credentials
    ID     string // Access Key ID
    Secret string // Secret Access Key
    Token  string // Access token (if using temporary security credentials

    // Vault options (if getting AWS credentials from Vault)
    VaultAddress string // normally addresses come from env, but don't have vault service name
    VaultRole    string
    VaultToken   string
}

type AssetOpts struct {
    FeatureFlags
    StorageOpts
    PachdShards    uint64
    Version        string
    LogLevel       string
    Metrics        bool
    Dynamic        bool
    EtcdNodes      int
    EtcdVolume     string
    PostgresNodes  int
    PostgresVolume string
    DashOnly       bool
    NoDash         bool
    DashImage      string
    Registry       string
    EtcdPrefix     string
    PachdPort      int32
    TracePort      int32
    HTTPPort       int32
    PeerPort       int32

    // NoGuaranteed will not generate assets that have both resource limits and
    // resource requests set which causes kubernetes to give the pods
    // guaranteed QoS. Guaranteed QoS generally leads to more stable clusters
    // but on smaller test clusters such as those run on minikube it doesn't
    // help much and may cause more instability than it prevents.
    NoGuaranteed bool

    // DisableAuthentication stops Pachyderm's authentication service
    // from talking to GitHub, for testing. Instead users can authenticate
    // simply by providing a username.
    DisableAuthentication bool

    // BlockCacheSize is the amount of memory each PachD node allocates towards
    // its cache of PFS blocks. If empty, assets.go will choose a default size.
    BlockCacheSize string

    // PachdCPURequest is the amount of CPU we request for each pachd node. If
    // empty, assets.go will choose a default size.
    PachdCPURequest string

    // PachdNonCacheMemRequest is the amount of memory we request for each
    // pachd node in addition to BlockCacheSize. If empty, assets.go will choose
    // a default size.
    PachdNonCacheMemRequest string

    // EtcdCPURequest is the amount of CPU (in cores) we request for each etcd
    // node. If empty, assets.go will choose a default size.
    EtcdCPURequest string

    // EtcdMemRequest is the amount of memory we request for each etcd node. If
    // empty, assets.go will choose a default size.
    EtcdMemRequest string

    // EtcdStorageClassName is the name of an existing StorageClass to use when
    // creating a StatefulSet for dynamic etcd storage. If unset, a new
    // StorageClass will be created for the StatefulSet.
    EtcdStorageClassName string

    // PostgresCPURequest is the amount of CPU (in cores) we request for each
    // postgres node. If empty, assets.go will choose a default size.
    PostgresCPURequest string

    // PostgresMemRequest is the amount of memory we request for each postgres
    // node. If empty, assets.go will choose a default size.
    PostgresMemRequest string

    // PostgresStorageClassName is the name of an existing StorageClass to use when
    // creating a StatefulSet for dynamic postgres storage. If unset, a new
    // StorageClass will be created for the StatefulSet.
    PostgresStorageClassName string

    // IAM role that the Pachyderm deployment should assume when talking to AWS
    // services (if using kube2iam + metadata service + IAM role to delegate
    // permissions to pachd via its instance).
    // This is in AssetOpts rather than AmazonCreds because it must be passed
    // as an annotation on the pachd pod rather than as a k8s secret
    IAMRole string

    // ImagePullSecret specifies an image pull secret that gets attached to the
    // various deployments so that their images can be pulled from a private
    // registry.
    ImagePullSecret string

    // NoRBAC, if true, will disable creation of RBAC assets.
    NoRBAC bool

    // LocalRoles, if true, uses Role and RoleBinding instead of ClusterRole and
    // ClusterRoleBinding.
    LocalRoles bool

    // Namespace is the kubernetes namespace to deploy to.
    Namespace string

    // NoExposeDockerSocket if true prevents pipelines from accessing the docker socket.
    NoExposeDockerSocket bool

    // ExposeObjectAPI, if set, causes pachd to serve Object/Block API requests on
    // its public port. This should generally be false in production (it breaks
    // auth) but is needed by tests
    ExposeObjectAPI bool

    // If set, the files indictated by 'TLS.ServerCert' and 'TLS.ServerKey' are
    // placed into a Kubernetes secret and used by pachd nodes to authenticate
    // during TLS
    TLS *TLSOpts

    // Sets the cluster deployment ID. If unset, this will be a randomly
    // generated UUID without dashes.
    ClusterDeploymentID string

    // RequireCriticalServersOnly is true when only the critical Pachd servers
    // are required to startup and run without error.
    RequireCriticalServersOnly bool

    // WorkerServiceAccountName is the name of the service account that will be
    // used in the worker pods for creating S3 gateways.
    WorkerServiceAccountName string
}

type FeatureFlags struct {
    // NewStorageLayer, if true, will make Pachyderm use the new storage layer.
    NewStorageLayer bool
}

type StorageOpts struct {
    UploadConcurrencyLimit  int
    PutFileConcurrencyLimit int
}

type TLSOpts struct {
    ServerCert string
    ServerKey  string
}