internal/

Package cmd provides the command-line interface for the aether-controller.

Package edgeconfig provides the admission validator for EdgeConfig resources (proposal 029): it proto-validates the spec so a CR can never describe a config the edge would refuse.

Package endpointpolicy holds the controller's admission webhook for the EndpointPolicy CRD (proposal 034 Phase 1b, service-scoped UDS delivery).

Package gatewayapi provides the aether-controller's Gateway API HTTPRoute validating admission webhook.

Package httpfilter holds the controller's admission webhook for the HTTPFilter CRD (proposal 025, the proxy-extension escape hatch).

Package meshconfig hosts the MeshConfig CRD machinery that runs in the aether-controller: a validating admission webhook (protovalidate) and a reconciler that projects the singleton MeshConfig custom resource into the ConfigMap the agent consumes.

Package nodetaint holds the controller's node-taint guard: a leader-elected reconciler that RE-ARMS the aether startup taint (aetherlabels.TaintAgentNotReady) on a node whose agent pod is missing or not-Ready past a grace period, so a node that rebooted (kubelet never re-applies register-with-taints, gap G1) or whose agent crashed (gap G2) stops scheduling workload pods until an agent is serving again.

Package podmutate contains the controller's pod-mutating admission webhook.

Package webhook provides the aether-controller's single validating admission endpoint (/validate).