config

type AdditionalHostMount struct {
	Source   string `json:"Source"`
	Target   string `json:"Target,omitempty"`
	ReadOnly bool   `json:"ReadOnly,omitempty"`
}

type AgentClusterConfig struct {
	CaCertBase64 string `json:"CaCertBase64"`
	ClusterDNS   string `json:"ClusterDNS"`
	Version      string `json:"Version"`
}

type AgentConfig struct {
	MachineName string `json:"MachineName"`
	// NodeName is the Kubernetes Node name used by kubelet and host-side
	// daemon watches. During goal-state resolution this field is backfilled
	// once. Resolution prefers an explicitly configured value, then a valid
	// host hostname, then MachineName. Explicit and resolved values must be
	// valid Kubernetes DNS subdomains.
	NodeName string               `json:"NodeName,omitempty"`
	Cluster  AgentClusterConfig   `json:"Cluster"`
	Kubelet  AgentKubeletConfig   `json:"Kubelet"`
	CRI      CRIConfig            `json:"CRI"`
	CNI      CNIConfig            `json:"CNI"`
	Gantry   *GantryConfig        `json:"Gantry,omitempty"`
	LocalDNS *AgentLocalDNSConfig `json:"LocalDNS,omitempty"`

	// OCIImage is an OCI registry reference, local OCI layout, or HTTPS URL
	// to a tarred OCI image layout used to bootstrap the machine rootfs. HTTPS
	// archives must contain exactly one tagged image reference, which the agent
	// selects automatically. HTTPS URLs may contain signed query parameters.
	// When empty the agent uses the built-in default image.
	OCIImage string `json:"OCIImage,omitempty"`

	// AdditionalHostDevices lists extra host device nodes under /dev or systemd
	// device group specifiers that should be exposed to the nspawn machine in
	// addition to automatically discovered devices.
	AdditionalHostDevices []string `json:"AdditionalHostDevices,omitempty"`

	// AdditionalHostMounts lists extra host paths that should be bind-mounted
	// into the nspawn machine. ReadOnly should be used unless write access is
	// required.
	AdditionalHostMounts []AdditionalHostMount `json:"AdditionalHostMounts,omitempty"`

	// OfflineArtifacts points to a complete offline binary artifact source.
	// When set, it takes precedence over download overrides. Source is rendered
	// as a strict Go template using the cluster Kubernetes version, then
	// resolved as an absolute filesystem path, file:// URL, HTTPS archive, or
	// oci:// artifact reference. HTTPS URLs may contain signed query parameters.
	OfflineArtifacts *AgentOfflineArtifacts `json:"OfflineArtifacts,omitempty"`
}

type AgentKubeletConfig struct {
	ApiServer string `json:"ApiServer"`
	// NodeIP overrides kubelet --node-ip. Supports a single IP or a
	// comma-separated dual-stack pair.
	NodeIP             string            `json:"NodeIP,omitempty"`
	Auth               KubeletAuthInfo   `json:"Auth"`
	Labels             map[string]string `json:"Labels"`
	RegisterWithTaints []string          `json:"RegisterWithTaints"`

	// Configuration is merged over the agent's baseline kubelet configuration
	// and rendered as a kubelet.config.k8s.io/v1beta1
	// KubeletConfiguration. apiVersion, kind, authentication,
	// authorization.mode, clusterDNS, containerRuntimeEndpoint,
	// registerWithTaints, and rotateCertificates are agent-owned and must not be
	// supplied here.
	Configuration map[string]any `json:"Configuration,omitempty"`

	// ImageCredentialProvider configures kubelet's exec image credential
	// provider paths inside the nspawn machine.
	ImageCredentialProvider *ImageCredentialProvider `json:"ImageCredentialProvider,omitempty"`
}

type AgentLocalDNSConfig struct {
	Enabled              bool     `json:"Enabled"`
	NodeListenerIP       string   `json:"NodeListenerIP,omitempty"`
	ClusterListenerIP    string   `json:"ClusterListenerIP,omitempty"`
	MetricsAddress       string   `json:"MetricsAddress,omitempty"`
	CPULimitInMilliCores *int     `json:"CPULimitInMilliCores,omitempty"`
	MemoryLimitInMB      *int     `json:"MemoryLimitInMB,omitempty"`
	RequiredPlugins      []string `json:"RequiredPlugins,omitempty"`
	CorefileTemplate     string   `json:"CorefileTemplate,omitempty"`
}

type AgentOfflineArtifacts struct {
	Source string `json:"Source,omitempty"`
}

type CNIConfig struct {
	// PluginVersion overrides the default CNI plugin version (e.g. "1.5.1").
	PluginVersion string `json:"PluginVersion,omitempty"`
}

type CRIConfig struct {
	Containerd ContainerdConfig `json:"Containerd"`
	Runc       RuncConfig       `json:"Runc"`
}

type ContainerdConfig struct {
	// Version overrides the default containerd version (e.g. "2.1.8").
	Version string `json:"Version,omitempty"`

	// SandboxImage overrides the CRI sandbox image used by containerd
	// (e.g. "mcr.microsoft.com/oss/v2/kubernetes/pause:3.9").
	SandboxImage string `json:"SandboxImage,omitempty"`
}

type GantryConfig struct {
	// Disabled skips writing the default containerd hosts.toml that points at
	// Gantry. This is a breakglass setting for environments that need to own
	// containerd registry routing independently.
	Disabled bool `json:"Disabled,omitempty"`
}

type ImageCredentialProvider struct {
	ConfigPath string `json:"ConfigPath"`
	BinDir     string `json:"BinDir"`
}

type KubeletAuthInfo struct {
	// BootstrapToken is a Kubernetes bootstrap token in
	// "<token-id>.<token-secret>" format used for TLS bootstrapping.
	BootstrapToken string `json:"BootstrapToken,omitempty"`

	// ExecCredential configures kubelet to authenticate via a
	// client.authentication.k8s.io exec credential plugin.
	ExecCredential *clientcmdapi.ExecConfig `json:"ExecCredential,omitempty"`
}

type RuncConfig struct {
	// Version overrides the default runc version (e.g. "1.5.0").
	Version string `json:"Version,omitempty"`
}