kubeapplierapi

type ApplyDesire struct {
	// CosmosMetadata.ResourceID is nested under an HCPOpenShiftCluster (and
	// optionally a NodePool) so that listing the partition by parent prefix
	// naturally returns the desires associated with that resource — and so
	// that cluster/nodepool deletion can sweep them.
	// PartitionKey holds the lowercased Spec.ManagementCluster resource ID
	// (e.g. "/providers/microsoft.redhatopenshift/stamps/1/managementclusters/default")
	// so that all desires for one management cluster live together in one Cosmos
	// partition (and one container, in the per-MC container model).
	coreapi.CosmosMetadata `json:"cosmosMetadata"`

	Spec ApplyDesireSpec `json:"spec"`

	Status ApplyDesireStatus `json:"status"`

	// Tags are optional key-value pairs stored alongside the desire in Cosmos.
	// Callers filter on tag presence Go-side after listing.
	Tags map[string]string `json:"tags,omitempty"`
}

type ApplyDesireList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ApplyDesire `json:"items"`
}

type ApplyDesireSpec struct {
	// ManagementCluster names the management cluster whose kube-applier should
	// reconcile this desire. It is the cosmos partition key for the
	// kube-applier container; entries from one management cluster never see
	// entries from another.
	// This is the same resourceID as the fleetapi.ManagementCluster.CosmosMetadata.ResourceID
	// Example: "/providers/microsoft.redhatopenshift/stamps/1/managementclusters/default"
	ManagementCluster *azcorearm.ResourceID `json:"managementCluster"`

	// Type discriminates the operation: ServerSideApply or Delete.
	// +k8s:union
	Type ApplyDesireType `json:"type"`

	// TargetItem identifies the GVR (and optionally the namespace) of the
	// target Kubernetes resource. For ServerSideApply, the controller uses
	// Group + Resource verbatim rather than guessing a plural form from
	// KubeContent's kind. Name and Namespace must agree with
	// KubeContent.metadata.{name,namespace}; the controller does not
	// re-derive them from the manifest. For Delete, TargetItem identifies
	// the single kube object to delete.
	TargetItem ResourceReference `json:"targetItem"`

	// ServerSideApply holds the configuration for the ServerSideApply variant.
	// Must be non-nil when Type=ServerSideApply; must be nil when Type=Delete.
	// +k8s:unionMember=ServerSideApply
	ServerSideApply *ServerSideApplyConfig `json:"serverSideApply,omitempty"`
}

type ApplyDesireStatus struct {
	// Conditions reports per-desire reconciliation status. Well-known types:
	//   - "SuccessfullyApplied": set for Type=ServerSideApply. True means the SSA
	//                   succeeded.
	//   - "SuccessfullyDeleted": set for Type=Delete. True means the target is
	//                   gone. While finalizers are running it stays False with
	//                   reason "WaitingForDeletion".
	//   - "Successful": retained for backwards compatibility. It mirrors whichever
	//                   operation-specific condition applies (SuccessfullyApplied
	//                   for ServerSideApply, SuccessfullyDeleted for Delete) with
	//                   the same status/reason/message. Prefer the
	//                   operation-specific condition; see
	//                   kubeapplierapihelpers.IsConditionTruePreferring.
	//   - "Degraded":   the controller is not making progress for an
	//                   out-of-band reason.
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AppliedKubeGeneration records the metadata.generation of the
	// Kubernetes object returned by the most recent successful server-side
	// apply call. When the most recent apply attempt failed, this field is
	// nil so that consumers can distinguish "last apply succeeded and the
	// kube object is at generation N" from "last apply failed".
	AppliedKubeGeneration *int64 `json:"appliedKubeGeneration,omitempty"`
}

type ApplyDesireType string

type ManagementClusterAccessor interface {
	GetManagementCluster() *azcorearm.ResourceID
}

type ReadDesire struct {
	// CosmosMetadata.ResourceID is nested under an HCPOpenShiftCluster (and
	// optionally a NodePool) so that listing the partition by parent prefix
	// naturally returns the desires associated with that resource — and so
	// that cluster/nodepool deletion can sweep them.
	// PartitionKey holds the lowercased Spec.ManagementCluster resource ID
	// (e.g. "/providers/microsoft.redhatopenshift/stamps/1/managementclusters/default")
	// so that all desires for one management cluster live together in one Cosmos
	// partition (and one container, in the per-MC container model).
	coreapi.CosmosMetadata `json:"cosmosMetadata"`

	Spec ReadDesireSpec `json:"spec"`

	Status ReadDesireStatus `json:"status"`

	// Tags are optional key-value pairs stored alongside the desire in Cosmos.
	// Callers filter on tag presence Go-side after listing.
	Tags map[string]string `json:"tags,omitempty"`
}

type ReadDesireList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ReadDesire `json:"items"`
}

type ReadDesireSpec struct {
	// ManagementCluster names the management cluster whose kube-applier should
	// reconcile this desire. It is the cosmos partition key for the
	// kube-applier container; entries from one management cluster never see
	// entries from another.
	// This is the same resourceID as the fleetapi.ManagementCluster.CosmosMetadata.ResourceID
	// Example: "/providers/microsoft.redhatopenshift/stamps/1/managementclusters/default"
	ManagementCluster *azcorearm.ResourceID `json:"managementCluster"`

	// TargetItem identifies the single kube object to read. The kube-applier
	// runs a per-instance list/watch+informer scoped to this exact name and
	// mirrors the live object into .status.kubeContent. Refresh frequency is
	// not contractual, and .status carries no explicit observed-at timestamp.
	TargetItem ResourceReference `json:"targetItem,omitempty"`
}

type ReadDesireStatus struct {
	// Conditions reports per-desire reconciliation status. Well-known types:
	//   - "Successful": the informer has synced and KubeContent reflects
	//                   the last observation.
	//   - "Degraded":   the controller is not making progress for an
	//                   out-of-band reason.
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// KubeContent holds the most recently observed state of TargetItem.
	// nil means the target either has not been observed yet or is absent
	// from the cluster — distinguish those two via the "Successful"
	// condition (Unknown vs. True).
	//
	// When TargetItem is a core/v1 Secret, KubeContent is redacted before
	// storage: structural fields (apiVersion, kind, type) and metadata are
	// preserved, but annotations that can embed the full Secret (e.g.
	// kubectl.kubernetes.io/last-applied-configuration) are stripped. In the
	// data map only known-safe keys (currently "tls.crt") survive; all other
	// data keys, along with all of binaryData and stringData, are removed to
	// prevent private keys, passwords, and tokens from leaking into Cosmos.
	KubeContent *runtime.RawExtension `json:"kubeContent,omitempty"`
}

type ResourceReference struct {
	// Group is the API group of the target resource. Empty for the core API.
	Group string `json:"group"`
	// Version is the API version of the target resource (e.g. "v1", "v1beta1").
	// Required: the dynamic client builds URLs from it and has no fallback.
	Version string `json:"version"`
	// Resource is the lower-cased plural resource name (e.g. "configmaps").
	// This is the URL-path segment, not Kind; it intentionally avoids
	// RESTMapping logic in the controller.
	Resource string `json:"resource"`
	// Namespace is the namespace of the target Kubernetes resource. Leave
	// empty for cluster-scoped Kubernetes resources. Note: this is the
	// Kubernetes scope, not the Cosmos scope — every *Desire is itself
	// nested under an HCPOpenShiftCluster (and possibly a NodePool) on the
	// Cosmos side regardless of the value here.
	Namespace string `json:"namespace,omitempty"`
	// Name is the name of the target resource.
	Name string `json:"name"`
}

type ServerSideApplyConfig struct {
	// KubeContent is a single Kubernetes object (not a List) to be applied
	// with server-side-apply and Force=true. The object must carry apiVersion,
	// kind, metadata.name, and metadata.namespace if namespaced.
	//
	// A nil pointer (or one with an empty Raw) is treated as a pre-check
	// failure: the kube-applier needs an object to apply.
	//
	// The kube-applier always issues SSA with FieldManager="aro-hcp-kube-applier".
	// The manager name is intentionally not configurable via this API: every
	// field the kube-applier owns on the cluster traces to that one string,
	// so an operator inspecting fieldsV1 metadata can attribute ownership at
	// a glance.
	KubeContent *runtime.RawExtension `json:"kubeContent,omitempty"`
}