cmd

type AgentConfig struct {
	manager.Config

	// MeshConfigPath is the path to the mounted proxy MeshConfig YAML (ConfigMap).
	MeshConfigPath string

	// NodeName is the Kubernetes node name where the agent runs (the edge derives
	// it from POD_NAME). It doubles as the xDS node ID of the co-located Envoy —
	// the separate --proxy-id every caller set identically was retired (proposal
	// 031); the snapshot cache and xDS server must agree on one identity.
	NodeName string
	// ClusterName is the Kubernetes cluster name
	ClusterName string

	// MountedLocalStorageDir is the directory where pod data is stored locally
	MountedLocalStorageDir string

	// NodeLockPath is the node-ownership lock (proposal 041): the agent that
	// owns the node holds an exclusive flock on it, and an agent that finds it
	// taken starts as a standby that takes the node over when it is released.
	// Empty disables the lock (owned from the start, the pre-041 behaviour).
	NodeLockPath string

	// HealthSocketPath, when set, serves /healthz and /readyz on this Unix
	// socket for the agent-ready exec probe (proposal 041). It must be in the
	// pod's own filesystem (an emptyDir), never on a host path. Empty serves
	// no socket. The TCP endpoint (manager.Config.HealthProbeBindAddress) is
	// independent; the chart turns it off ("0") when it uses the socket.
	HealthSocketPath string

	// MountedCNINetDir is the host's CNI network-config directory as mounted into
	// the agent container (read-write). The re-assert loop watches the active
	// conflist there.
	MountedCNINetDir string

	// CNIConflistReassert keeps aether's chained plugin entry in the node's active
	// CNI conflist: the agent watches the CNI config directory and re-appends the
	// entry whenever a competing writer (kube-flannel's `cp -f` on every pod
	// recreation, #645) strips it. Default ON — it is a safety net against silent
	// fleet-wide unmeshing, and it never creates a config of its own.
	CNIConflistReassert bool

	// UDSCSIRoot is where the csi.aether.io node plugin mounts each UDS pod's
	// tmpfs on the host, and — at the identical path — what the proxy container
	// mounts, so rendered Envoy Pipe addresses need no prefix translation. It is
	// how the node proxy reaches a workload's Unix socket for UDS delivery
	// (proposals 034/039): <UDSCSIRoot>/<pod-UID>/<file>. The chart passes
	// udsCsi.root, the same value the node plugin gets. Empty disables UDS
	// delivery: pods requesting a socket fall back to TCP loopback.
	UDSCSIRoot string

	// RegistrarAddress is the gRPC address of the in-cluster Registrar service
	RegistrarAddress string

	// MeshDomain is the DNS-style domain mesh authorities live under
	// (<service>.<mesh-domain>); see meshconst.DefaultMeshDomain.
	MeshDomain string

	// EmitStatsPod enables per-pod labels (source_pod/destination_pod) on the
	// aether_stats request counter. Off by default to bound cardinality.
	EmitStatsPod bool

	// AccessLogsEnabled attaches the OTel access logger to every HCM (proposal
	// 014), pushing per-request OTLP logs to the collector. Off by default.
	AccessLogsEnabled bool
	// AccessLogSuccessSampleRate is the percent (0-100) of successful requests
	// logged; failures (any response flag / status >= 500) are always logged.
	AccessLogSuccessSampleRate uint32

	// ProxyTracingEnabled adds an OpenTelemetry tracer to every proxy HCM so the
	// data plane generates/propagates W3C trace context and exports spans.
	ProxyTracingEnabled bool
	// ProxyTraceSampleRate is the fraction (0.0-1.0) of requests traced. Keep low
	// at high data-plane QPS.
	ProxyTraceSampleRate float64

	// SpireEnabled controls whether the SPIRE bridge is started
	SpireEnabled bool
	// SpireBrokerSocketPath is the path to the SPIRE agent's SPIFFE Broker
	// Endpoint socket (proposal 036), over which the agent brokers per-pod SVIDs.
	SpireBrokerSocketPath string
	// SpireWorkloadSocketPath is the path to the SPIRE Workload API UDS socket
	SpireWorkloadSocketPath string
	// SpireWaitWarnAfter is how long the wait for this workload's first SVID
	// stays at INFO before escalating to WARN, and the dwell the spire-svid
	// readiness gate allows before reporting NotReady (issue #740).
	SpireWaitWarnAfter time.Duration

	// CNIServerConfig holds CNI server configuration
	CNIServerConfig *cniServer.CNIServerConfig

	// EdgeHTTPPort is the port the edge proxy's public-facing HTTP listener
	// binds (edge subcommand only).
	EdgeHTTPPort uint32

	// RouteNamespace is the edge's default namespace for Gateway TLS certificate
	// Secrets (edge subcommand only); empty means the edge pod's own namespace.
	// Gateway/route watching itself is cluster-wide regardless.
	RouteNamespace string

	// Gamma enables GAMMA east-west L7 routing on the node proxy: the agent watches
	// HTTPRoutes parented to a Service and enriches the outbound routes (proposal
	// 018, Phase 2). Default on since proposal 031 (kept as a kill switch); the
	// reconciler degrades gracefully when the Gateway API CRDs are absent.
	Gamma bool

	// ImportConfig enables cross-cluster config import (proposal 026): the agent polls
	// the registrar for GAMMA config projections peer clusters exported and materializes
	// the imported routes into the cache (merged with local; local wins). Default off;
	// no-op when the registry backend has no cross-cluster config plane (etcd only).
	ImportConfig bool

	// GeoipCityDB is the MaxMind city-type mmdb path for the edge geoip filter
	// (proposal 028); empty = geoip off (the x-geo-* strip still applies).
	GeoipCityDB string
	// GeoipHeaders selects which x-geo-* headers the edge emits.
	GeoipHeaders []string
	// XffNumTrustedHops is the edge topology fact (proxies in front): feeds both
	// the HCM and the geoip filter's XFF config.
	XffNumTrustedHops uint32

	// AuthzSidecar enables the node-local external-authorization sidecar entry
	// (proposal 027): a disabled ext_authz HCM filter targeting the chart's static
	// authz_sidecar UDS cluster; HTTPFilter (extAuthz) opts routes in.
	AuthzSidecar bool
	// AuthzSidecarTimeout is the per-check gRPC timeout.
	AuthzSidecarTimeout time.Duration
	// AuthzSidecarFailureModeAllow selects fail-open (true) vs fail-closed (false,
	// requests on opted-in routes are denied when the sidecar is unreachable).
	AuthzSidecarFailureModeAllow bool

	// ControlCluster, when set, names the single authorized config-exporting cluster
	// (proposal 026 EM3, Option E): the importer then trusts ONLY config originating
	// there and ignores all other origins. Empty = federated (trust any peer origin).
	ControlCluster string

	// EastWestWaypoint enables the split-horizon east/west waypoint rewrite
	// (proposal 019): an endpoint in another cluster is dialed at its node's
	// routable IP + the fixed tunnel port (proxy.DefaultEastWestTunnelPort)
	// instead of its pod IP, and that node's host-network proxy SNI-forwards to
	// the local pod. Intra-cluster traffic stays direct pod-to-pod. Default off.
	//
	// NOTE (proposal 031): transparent capture, the dormant redirect-all
	// passthrough chain, and the L4 route types are UNCONDITIONAL — their old
	// flags encoded install-ordering fears now handled by CRD detection. The
	// remaining capture knobs are the per-pod capture.aether.io/* annotations
	// and the CNI's --capture-redirect-all-default.
	EastWestWaypoint bool
	// EastWestQUICPairFetchWindow bounds how long after the agent starts a
	// PERSISTED QUIC pair with no evidence of use -- never fetched on demand,
	// subscribed, or re-stated as held by the proxy, in this or any earlier
	// agent process -- is kept before it is pruned (issues #1033, #1073).
	// <= 0 disables the prune.
	EastWestQUICPairFetchWindow time.Duration
	// EastWestQUICIdleTimeout is the idle timeout of every `quic:` twin's
	// connection pool (aether#1054). Must be > 0; the chart also enforces
	// idle + 5s < proxy.hotRestart.parentShutdownTime, which the agent does
	// not know (the proxy is another DaemonSet). h1/h2 keep 30s.
	EastWestQUICIdleTimeout time.Duration

	// MeshDNS enables the per-pod mesh-DNS listener (proposal 018, mesh-global FQDN):
	// the agent answers <svc>.<meshDomain> from the generated mesh Services' ClusterIPs.
	// Upstream forwarding lives in the mesh-dns daemon (agent/cmd/mesh-dns) since the
	// #578 decouple. Pairs with the CNI :53 redirect. Default off.
	MeshDNS bool
	// MeshDNSSnapshotPath is the host-persistent file the mesh-DNS resolver writes
	// its last-known record table to on every reconcile and warm-loads at boot, so a
	// rolling agent restart answers mesh names from last-known ClusterIPs within ms
	// of process start (before the informer cache syncs the first reconcile). Lives
	// under the CNI registry hostPath so it survives the pod (a restart = a new pod).
	MeshDNSSnapshotPath string
	// GatewayClassName is the GatewayClass whose Gateways this edge serves.
	GatewayClassName string

	// EdgeServiceName is the name of the edge's own LoadBalancer Service (in the
	// edge's namespace). The edge resolves its assigned LB address from that
	// Service's status and publishes it as every class-aether Gateway's
	// status.addresses (proposal 021 Phase 1, shared edge address). Empty disables
	// address publication (edge subcommand only).
	EdgeServiceName string

	// EdgeTLS enables downstream TLS termination: the edge serves an HTTPS
	// listener on EdgeHTTPSPort (certs per Gateway listener via SDS) and an
	// HTTP->HTTPS redirect on the plain port (edge subcommand only).
	EdgeTLS bool
	// EdgeHTTPSPort is the port the edge TLS listener binds when EdgeTLS is set.
	EdgeHTTPSPort uint32
}