controller

type Capabilities struct {
	Add  []string `json:"add,omitempty"`
	Drop []string `json:"drop,omitempty"`
}

type CapacityGrant struct {
	APIVersion string          `json:"apiVersion"`
	Kind       string          `json:"kind"`
	Metadata   kube.ObjectMeta `json:"metadata"`
	Spec       Spec            `json:"spec"`
	Status     Status          `json:"status,omitempty"`
}

type CapacityGrantList struct {
	Items []CapacityGrant `json:"items"`
}

type Container struct {
	Name            string            `json:"name"`
	Image           string            `json:"image"`
	Command         []string          `json:"command,omitempty"`
	Args            []string          `json:"args"`
	Env             []EnvVar          `json:"env,omitempty"`
	Ports           []ContainerPort   `json:"ports,omitempty"`
	Resources       json.RawMessage   `json:"resources,omitempty"`
	SecurityContext *SecurityContext  `json:"securityContext,omitempty"`
	VolumeMounts    []VolumeMount     `json:"volumeMounts"`
	ReadinessProbe  *Probe            `json:"readinessProbe,omitempty"`
	StartupProbe    *Probe            `json:"startupProbe,omitempty"`
	LivenessProbe   *Probe            `json:"livenessProbe,omitempty"`
	Labels          map[string]string `json:"-"`
}

type ContainerPort struct {
	Name          string `json:"name"`
	ContainerPort int    `json:"containerPort"`
}

type Controller struct {
	Client *kube.Client
	Issuer *grant.Issuer
	// Poll is the reconcile cadence (default 2s).
	Poll time.Duration
	// Now is for tests.
	Now func() time.Time
}

type EmptyDirVolume struct {
	Medium string `json:"medium,omitempty"`
}

type EnvSource struct {
	FieldRef *struct {
		FieldPath string `json:"fieldPath"`
	} `json:"fieldRef,omitempty"`
}

type EnvVar struct {
	Name      string     `json:"name"`
	Value     string     `json:"value,omitempty"`
	ValueFrom *EnvSource `json:"valueFrom,omitempty"`
}

type ExecAction struct {
	Command []string `json:"command"`
}

type Pod struct {
	APIVersion string          `json:"apiVersion"`
	Kind       string          `json:"kind"`
	Metadata   kube.ObjectMeta `json:"metadata"`
	Spec       PodSpecObject   `json:"spec"`
	Status     struct {
		Phase      string           `json:"phase,omitempty"`
		PodIP      string           `json:"podIP,omitempty"`
		Conditions []kube.Condition `json:"conditions,omitempty"`
	} `json:"status,omitempty"`
}

type PodSpec struct {
	// Image carries fiberd, the template and (for FIBER_CHECKPOINT) criu.
	Image   string `json:"image"`
	Runtime string `json:"runtime,omitempty"` // proc (default), runc, gvisor, hyperlight
	// Args are appended to fiberd's flags (-template ..., -parity ...).
	Args []string `json:"args,omitempty"`
	// Resources is the container's resources: its limits are the block
	// ceiling the kubelet enforces on the Pod's cgroup.
	Resources          json.RawMessage `json:"resources,omitempty"`
	ServiceAccountName string          `json:"serviceAccountName,omitempty"`
	// ResourceClaims are the Pod's DRA claims (its device channel).
	ResourceClaims json.RawMessage `json:"resourceClaims,omitempty"`
	// Devices are what the claim exposes, as the engine expects them.
	Devices []string `json:"devices,omitempty"`
	// EndpointFamily is inet4 (default) or inet6: which Pod IP fibers
	// are served on.
	EndpointFamily string            `json:"endpointFamily,omitempty"`
	NodeSelector   map[string]string `json:"nodeSelector,omitempty"`
	NodeName       string            `json:"nodeName,omitempty"`
	// Privileged runs fiberd privileged. When unset, the proc runtime gets
	// only the capabilities in caps.Proc and no seccomp filter, because criu
	// cannot dump from under one. Every other runtime runs privileged, a
	// known gap, even though caps.Runc measures what runc needs.
	Privileged *bool `json:"privileged,omitempty"`
	// UnsafeAdmin enables fiberd's test-only admin controls. It needs
	// an image whose fiberd is built with -tags fiberd_testhooks.
	UnsafeAdmin bool              `json:"unsafeAdmin,omitempty"`
	Labels      map[string]string `json:"labels,omitempty"`
	Annotations map[string]string `json:"annotations,omitempty"`
}

type PodSpecObject struct {
	ServiceAccountName string            `json:"serviceAccountName,omitempty"`
	RestartPolicy      string            `json:"restartPolicy"`
	ReadinessGates     []ReadinessGate   `json:"readinessGates"`
	NodeSelector       map[string]string `json:"nodeSelector,omitempty"`
	NodeName           string            `json:"nodeName,omitempty"`
	ResourceClaims     json.RawMessage   `json:"resourceClaims,omitempty"`
	Volumes            []Volume          `json:"volumes"`
	Containers         []Container       `json:"containers"`
}

type Probe struct {
	Exec             *ExecAction      `json:"exec,omitempty"`
	TCPSocket        *TCPSocketAction `json:"tcpSocket,omitempty"`
	PeriodSeconds    int              `json:"periodSeconds,omitempty"`
	TimeoutSeconds   int              `json:"timeoutSeconds,omitempty"`
	FailureThreshold int              `json:"failureThreshold,omitempty"`
}

type ReadinessGate struct {
	ConditionType string `json:"conditionType"`
}

type SeccompProfile struct {
	Type string `json:"type"`
}

type SecretVolume struct {
	SecretName string `json:"secretName"`
	Optional   bool   `json:"optional"`
}

type SecurityContext struct {
	Privileged     bool            `json:"privileged"`
	Capabilities   *Capabilities   `json:"capabilities,omitempty"`
	SeccompProfile *SeccompProfile `json:"seccompProfile,omitempty"`
}

type Spec struct {
	// Template is the digest of the zygote artifact (what fiberd's
	// -template maps).
	Template string `json:"template"`
	Fibers   struct {
		Max  int `json:"max"`
		Warm int `json:"warm,omitempty"`
	} `json:"fibers"`
	// WBudget is the per-fiber dirtied working set ceiling (32Mi).
	WBudget string `json:"wBudget,omitempty"`
	MinTier string `json:"minTier,omitempty"`
	// Isolation is UNTRUSTED or TRUSTED. UNTRUSTED is the default, and only
	// a gvisor or hyperlight Pod serves it, so the controller refuses it on
	// any other runtime. Any runtime serves TRUSTED, including proc and runc.
	Isolation string `json:"isolation,omitempty"`
	// Lease is how long each minted grant is valid; the controller renews
	// at half-life. Default 10m.
	Lease        string `json:"lease,omitempty"`
	Durability   string `json:"durability,omitempty"`
	SessionClass string `json:"sessionClass,omitempty"`
	DeviceBudget *struct {
		Bytes string `json:"bytes"`
		Class string `json:"class,omitempty"`
	} `json:"deviceBudget,omitempty"`
	Pod PodSpec `json:"pod"`
}

type Status struct {
	// GrantUID is the uid the minted grants carry (the resource's uid).
	GrantUID string `json:"grantUID,omitempty"`
	PodName  string `json:"podName,omitempty"`
	// Placed is set once the scheduler put the Pod on a node.
	Placed bool   `json:"placed"`
	Node   string `json:"node,omitempty"`
	// Ready mirrors the Pod's readiness gate: a template is warm.
	Ready bool `json:"ready"`
	// Endpoint is where callers reach fiberd (Pod IP and port).
	Endpoint  string `json:"endpoint,omitempty"`
	IssuedAt  string `json:"issuedAt,omitempty"`
	ExpiresAt string `json:"expiresAt,omitempty"`
	Message   string `json:"message,omitempty"`
}

type TCPSocketAction struct {
	Port int `json:"port"`
}

type Volume struct {
	Name     string          `json:"name"`
	Secret   *SecretVolume   `json:"secret,omitempty"`
	EmptyDir *EmptyDirVolume `json:"emptyDir,omitempty"`
}

type VolumeMount struct {
	Name      string `json:"name"`
	MountPath string `json:"mountPath"`
	ReadOnly  bool   `json:"readOnly,omitempty"`
}