kubernetes

type API interface {
	CreatePod(ctx context.Context, p Pod) (Pod, error)
	LerPod(ctx context.Context, name string) (Pod, error)
	Logs(ctx context.Context, name string, follow bool) (io.ReadCloser, error)
	DeletePod(ctx context.Context, name string) error
}

type Client struct {
	// contains filtered or unexported fields
}

type Condition struct {
	Type    string `json:"type"`
	Status  string `json:"status"`
	Reason  string `json:"reason,omitempty"`
	Message string `json:"message,omitempty"`
}

type Container struct {
	Name         string        `json:"name"`
	Image        string        `json:"image"`
	Command      []string      `json:"command,omitempty"`
	Args         []string      `json:"args,omitempty"`
	Env          []Var         `json:"env,omitempty"`
	EnvFrom      []EnvSource   `json:"envFrom,omitempty"`
	Resources    *Resources    `json:"resources,omitempty"`
	WorkingDir   string        `json:"workingDir,omitempty"`
	VolumeMounts []VolumeMount `json:"volumeMounts,omitempty"`

	// TerminationMessagePath is where the step publishes its context, and the
	// kubelet copies that file's contents into the pod's status when the
	// container ends -- with success or not.
	//
	// Declared even though it is the default, because it is half of a contract:
	// the other half is the BREVIS_OUTPUT the step is handed, and the two
	// disagreeing means a step writes somewhere nobody reads. Written side by
	// side, they cannot drift.
	TerminationMessagePath string `json:"terminationMessagePath,omitempty"`
}

type EnvSource struct {
	SecretRef    *RefLocal `json:"secretRef,omitempty"`
	ConfigMapRef *RefLocal `json:"configMapRef,omitempty"`
}

type ErrOutsideCluster struct{ Reason string }

type Executor struct {

	// Status polling interval. Polling rather than watching is deliberate: a
	// watch needs reconnection, resync and handling of missed events to gain
	// seconds on a task that lasts minutes.
	Interval time.Duration
	// contains filtered or unexported fields
}

type Grace struct {
	Key      string `json:"key,omitempty"`
	Operator string `json:"operator,omitempty"`
	Value    string `json:"value,omitempty"`
	Effect   string `json:"effect,omitempty"`
}

type KeyRef struct {
	Name string `json:"name"`
	Key  string `json:"key"`
}

type Metadata struct {
	Name        string            `json:"name,omitempty"`
	Namespace   string            `json:"namespace,omitempty"`
	Labels      map[string]string `json:"labels,omitempty"`
	Annotations map[string]string `json:"annotations,omitempty"`
}

type Options struct {
	Namespace         string
	ServiceAccount    string
	PullSecrets       []string
	NodeSelector      map[string]string
	Tolerations       []Grace
	EnvFromSecrets    []string
	EnvFromConfigMaps []string

	// CredencialPVC and CredencialPath mount a volume where the SDK keeps the
	// credential it rotates between runs.
	//
	// With both set, EVERY step pod gets the volume and a BREVIS_CREDENTIAL_DIR
	// env pointing at the mount. Without them nothing changes -- which is how
	// the feature stays a shortcut rather than a requirement.
	//
	// The credential on the volume is encrypted; the key is an ordinary Secret,
	// arriving through EnvFromSecrets. The engine neither sees it nor needs
	// it.
	CredentialPVC  string
	CredentialPath string

	// AllowedSecrets are the Secrets a YAML may name in `secrets:`.
	//
	// It exists because `secrets:` inverts who chooses. EnvFromSecrets comes
	// from the scheduler's environment: the INSTALLATION decides. `secrets:` is
	// in the file, and the file is written by somebody else -- without this
	// list, a workflow could mount any Secret in the namespace, including
	// Brevis's own database secret, and run an arbitrary command holding it.
	//
	// Empty denies everything. Denying by default costs one variable in the
	// installation; allowing by default costs the opposite, and the opposite is
	// irreversible.
	//
	// The final division is this: the installation says WHICH secrets exist for
	// workflows, the YAML says WHICH step receives each one.
	AllowedSecrets []string
	Labels         map[string]string
	Shell          []string
	// EsperaParaIniciar is how long a pod may go without starting before the
	// step gives up. It exists because `Pending` is not an error to Kubernetes:
	// a pod that fits on no node sits there forever, and without this limit the
	// step waits along with it -- no log, no failure, no retry. It happened in
	// dev with a CPU request larger than the pool's free capacity.
	EsperaParaIniciar time.Duration

	// KeepFailedPod leaves the pod around for inspection when a step fails.
	// A successful one is always deleted: thousands of Completed pods clutter
	// the namespace and say nothing Brevis's own history does not say better.
	KeepFailedPod bool
}

type PVCSource struct {
	ClaimName string `json:"claimName"`
}

type Pod struct {
	APIVersion string   `json:"apiVersion,omitempty"`
	Kind       string   `json:"kind,omitempty"`
	Metadata   Metadata `json:"metadata"`
	Spec       PodSpec  `json:"spec,omitempty"`
	// A pointer because `omitempty` does not omit an empty struct: without it
	// every created pod would send `"status":{}` to the server -- harmless, but
	// noise in an object people read to debug.
	Status *PodStatus `json:"status,omitempty"`
}

type PodSpec struct {
	RestartPolicy         string            `json:"restartPolicy,omitempty"`
	ServiceAccountName    string            `json:"serviceAccountName,omitempty"`
	ImagePullSecrets      []RefLocal        `json:"imagePullSecrets,omitempty"`
	NodeSelector          map[string]string `json:"nodeSelector,omitempty"`
	Tolerations           []Grace           `json:"tolerations,omitempty"`
	ActiveDeadlineSeconds *int64            `json:"activeDeadlineSeconds,omitempty"`
	Volumes               []Volume          `json:"volumes,omitempty"`
	Containers            []Container       `json:"containers"`
}

type PodStatus struct {
	Phase             string            `json:"phase,omitempty"`
	Conditions        []Condition       `json:"conditions,omitempty"`
	Reason            string            `json:"reason,omitempty"`
	Message           string            `json:"message,omitempty"`
	ContainerStatuses []StatusContainer `json:"containerStatuses,omitempty"`
}

type RefLocal struct {
	Name string `json:"name"`
}

type Resources struct {
	Requests map[string]string `json:"requests,omitempty"`
	Limits   map[string]string `json:"limits,omitempty"`
}

type StatusContainer struct {
	Name  string `json:"name"`
	State struct {
		Waiting *struct {
			Reason  string `json:"reason"`
			Message string `json:"message"`
		} `json:"waiting,omitempty"`
		Running *struct {
			StartedAt string `json:"startedAt"`
		} `json:"running,omitempty"`
		Terminated *struct {
			ExitCode int    `json:"exitCode"`
			Reason   string `json:"reason"`
			Message  string `json:"message"`
		} `json:"terminated,omitempty"`
	} `json:"state"`
}

type Var struct {
	Name string `json:"name"`
	// Value with omitempty because a Var coming from a secret sends `valueFrom`,
	// and sending `"value":""` alongside makes the server refuse both.
	Value     string     `json:"value,omitempty"`
	ValueFrom *VarSource `json:"valueFrom,omitempty"`
}

type VarSource struct {
	SecretKeyRef *KeyRef `json:"secretKeyRef,omitempty"`
}

type Volume struct {
	Name string     `json:"name"`
	PVC  *PVCSource `json:"persistentVolumeClaim,omitempty"`
}

type VolumeMount struct {
	Name      string `json:"name"`
	MountPath string `json:"mountPath"`
}