config

type CommonRuntimeConfig struct {
	AzureTenantID string `yaml:"azureTenantId"`
	LogLevel      *int   `yaml:"logLevel"`
	ApiserverURL  string `yaml:"apiserverURL"`
}

type Config struct {
	// ConfigFile is the path to the runtime YAML config file, used for dynamic reloading.
	ConfigFile string
	// KubeconfigPath is the path to the kubeconfig file. Empty for in-cluster config.
	KubeconfigPath string
	// ApiserverURL overrides the Kubernetes API server URL. When set, this URL
	// is used instead of the in-cluster service host. Empty means use the default.
	ApiserverURL string
	// AzureTenantID is surfaced by the status UI for Azure portal links.
	AzureTenantID string
	// DryRun causes the controller to run a single evaluation and print proposed changes.
	DryRun bool
	// HealthPort is the port for the health check HTTP server. 0 disables the server.
	HealthPort int
	// NodeAgentHealthPort is the port where node agents serve their health/status endpoints.
	NodeAgentHealthPort int
	// InformerResyncPeriod is the resync period for informers.
	InformerResyncPeriod time.Duration
	// LeaderElection contains leader election configuration.
	LeaderElection LeaderElectionConfig
	// StatusStaleThreshold is the duration after which a node's pushed status is considered stale.
	// When stale, the controller falls back to pulling status directly from the node.
	StatusStaleThreshold time.Duration
	// StatusDetailCacheTTL is the startup-loaded lifetime of received node details.
	StatusDetailCacheTTL time.Duration
	// StatusDetailRequestTimeout is the startup-loaded end-to-end detail request deadline.
	StatusDetailRequestTimeout time.Duration
	// RegisterAggregatedAPIServer controls whether the controller serves aggregated API status endpoints.
	RegisterAggregatedAPIServer bool
	// StatusWSKeepaliveInterval controls websocket ping cadence for node status streams.
	// Set to 0 to disable controller-side websocket keepalive pings.
	StatusWSKeepaliveInterval time.Duration
	// StatusWSKeepaliveFailureCount is the number of sequential websocket keepalive ping failures
	// before the controller closes a node status websocket connection.
	StatusWSKeepaliveFailureCount int
	// RequireDashboardAuth controls whether the status dashboard and JSON
	// endpoints require authentication and SubjectAccessReview authorization.
	RequireDashboardAuth bool
	// OIDCIssuerURL enables local validation of Kubernetes service account
	// tokens using the cluster's OIDC discovery endpoint. Empty attempts discovery
	// from the controller's mounted token before falling back to TokenReview.
	OIDCIssuerURL string
	// OIDCAudience is the audience required in node service account tokens.
	// Empty uses the mounted token's audience during automatic discovery,
	// or OIDCIssuerURL when the issuer is explicitly configured.
	OIDCAudience string
	// NodeMTU is the configured node MTU from the shared configmap (node.mtu).
	// Used to validate that no node's detected WireGuard MTU is lower than this value.
	// A value of 0 means the check is skipped.
	NodeMTU int
	// KubeProxyHealthInterval is the interval between kube-proxy health checks on the controller node.
	// Set to 0 to disable the check.
	KubeProxyHealthInterval time.Duration
	// ManagedKubeProxyEnabled controls whether the controller creates kube-proxy
	// DaemonSets for unbounded-managed site nodes that are not covered by the
	// cloud provider's kube-proxy DaemonSet.
	ManagedKubeProxyEnabled bool
	// ManagedKubeProxyImage sets the image of the managed per-site kube-proxy
	// DaemonSets. A reference with a tag or digest is used as-is; one without
	// takes its tag from kube-system/kube-proxy, or searches its registry for
	// the Kubernetes server's major.minor.patch version with the highest numeric
	// maintenance suffix. Empty means reuse the provider image when versioned,
	// otherwise use its repository or fall back to registry.k8s.io/kube-proxy.
	ManagedKubeProxyImage string
	// NetlinkResyncPeriod is the interval between full netlink cache resyncs on node agents.
	NetlinkResyncPeriod time.Duration
	// NodeTokenLifetime is the lifetime of HMAC tokens issued to node agents.
	NodeTokenLifetime time.Duration
	// ViewerTokenLifetime is the lifetime of HMAC tokens issued to dashboard viewers.
	ViewerTokenLifetime time.Duration
}

type ControllerLeaderElectionYAML struct {
	Enabled           *bool  `yaml:"enabled"`
	LeaseDuration     string `yaml:"leaseDuration"`
	RenewDeadline     string `yaml:"renewDeadline"`
	RetryPeriod       string `yaml:"retryPeriod"`
	ResourceNamespace string `yaml:"resourceNamespace"`
	ResourceName      string `yaml:"resourceName"`
}

type ControllerRuntimeConfig struct {
	InformerResyncPeriod        string                        `yaml:"informerResyncPeriod"`
	HealthPort                  *int                          `yaml:"healthPort"`
	NodeAgentHealthPort         *int                          `yaml:"nodeAgentHealthPort"`
	StatusStaleThreshold        string                        `yaml:"statusStaleThreshold"`
	StatusDetailCacheTTL        string                        `yaml:"statusDetailCacheTTL"`
	StatusDetailRequestTimeout  string                        `yaml:"statusDetailRequestTimeout"`
	StatusWSKeepaliveInterval   string                        `yaml:"statusWebsocketKeepaliveInterval"`
	StatusWSKeepaliveFailCount  *int                          `yaml:"statusWsKeepaliveFailureCount"`
	RegisterAggregatedAPIServer *bool                         `yaml:"registerAggregatedAPIServer"`
	RequireDashboardAuth        *bool                         `yaml:"requireDashboardAuth"`
	OIDCIssuerURL               string                        `yaml:"oidcIssuerURL"`
	OIDCAudience                string                        `yaml:"oidcAudience"`
	KubeProxyHealthInterval     string                        `yaml:"kubeProxyHealthInterval"`
	ManagedKubeProxy            ManagedKubeProxyRuntimeConfig `yaml:"managedKubeProxy"`
	LeaderElection              ControllerLeaderElectionYAML  `yaml:"leaderElection"`
}

type ImageReference struct {
	// Name is the registry and repository, such as registry.k8s.io/kube-proxy.
	Name string

	// Tag is empty when the reference names none.
	Tag string

	// Digest is empty when the reference names none.
	Digest string
}

type LeaderElectionConfig struct {
	// Enabled indicates whether leader election is enabled.
	Enabled bool
	// LeaseDuration is the duration that non-leader candidates will wait to force acquire leadership.
	LeaseDuration time.Duration
	// RenewDeadline is the duration that the acting leader will retry refreshing leadership before giving up.
	RenewDeadline time.Duration
	// RetryPeriod is the duration the LeaderElector clients should wait between tries of actions.
	RetryPeriod time.Duration
	// ResourceNamespace is the namespace in which the leader election resource will be created.
	ResourceNamespace string
	// ResourceName is the name of the leader election resource.
	ResourceName string
}

type ManagedKubeProxyRuntimeConfig struct {
	Enabled *bool  `yaml:"enabled"`
	Image   string `yaml:"image"`
}

type NodeRuntimeConfig struct {
	InformerResyncPeriod    string `yaml:"informerResyncPeriod"`
	NodeName                string `yaml:"nodeName"`
	STUNEnabled             *bool  `yaml:"stunEnabled"`
	STUNHost                string `yaml:"stunHost"`
	STUNPort                *int   `yaml:"stunPort"`
	STUNRecheckInterval     string `yaml:"stunRecheckInterval"`
	CNIConfDir              string `yaml:"cniConfDir"`
	CNIConfFile             string `yaml:"cniConfFile"`
	IPAMSocketPath          string `yaml:"ipamSocketPath"`
	InstallIPAMPlugin       *bool  `yaml:"installIPAMPlugin"`
	IPAMBinDir              string `yaml:"ipamBinDir"`
	ManageSameSitePodRoutes *bool  `yaml:"manageSameSitePodRoutes"`
	BridgeName              string `yaml:"bridgeName"`
	WireGuardDir            string `yaml:"wireGuardDir"`
	WireGuardPort           *int   `yaml:"wireGuardPort"`
	// Deprecated: EnablePolicyRouting enables connmark/fwmark/ip-rule policy
	// routing on gateway interfaces. Replaced by the UNBOUNDED-FORWARD chain.
	// Defaults to false; retained for backward compatibility.
	EnablePolicyRouting                  *bool  `yaml:"enablePolicyRouting"`
	MTU                                  *int   `yaml:"mtu"`
	HealthPort                           *int   `yaml:"healthPort"`
	StatusPushEnabled                    *bool  `yaml:"statusPushEnabled"`
	StatusPushURL                        string `yaml:"statusPushURL"`
	StatusPushInterval                   string `yaml:"statusPushInterval"`
	StatusPushAPIServerInterval          string `yaml:"statusPushApiserverInterval"`
	StatusPushDelta                      *bool  `yaml:"statusPushDelta"`
	StatusDetailMode                     string `yaml:"statusDetailMode"`
	StatusWSEnabled                      *bool  `yaml:"statusWebsocketEnabled"`
	StatusWSURL                          string `yaml:"statusWebsocketURL"`
	StatusWSAPIServerMode                string `yaml:"statusWebsocketApiserverMode"`
	StatusWSAPIServerURL                 string `yaml:"statusWebsocketApiserverURL"`
	StatusWSAPIServerStartupDelay        string `yaml:"statusWebsocketApiserverStartupDelay"`
	StatusWSKeepaliveInterval            string `yaml:"statusWebsocketKeepaliveInterval"`
	StatusWSKeepaliveFailCount           *int   `yaml:"statusWsKeepaliveFailureCount"`
	RemoveConfigurationOnShutdown        *bool  `yaml:"removeConfigurationOnShutdown"`
	ShutdownRemoveWireGuardConfiguration *bool  `yaml:"shutdownRemoveWireGuardConfiguration"` // Deprecated: use RemoveConfigurationOnShutdown
	ShutdownRemoveIPRoutes               *bool  `yaml:"shutdownRemoveIPRoutes"`               // Deprecated: use RemoveConfigurationOnShutdown
	ShutdownRemoveMasqueradeRules        *bool  `yaml:"shutdownRemoveMasqueradeRules"`        // Deprecated: use RemoveConfigurationOnShutdown
	CriticalDeltaEvery                   string `yaml:"criticalDeltaEvery"`
	StatsDeltaEvery                      string `yaml:"statsDeltaEvery"`
	FullSyncEvery                        string `yaml:"fullSyncEvery"`
	PreferredPrivateNetworkEncapsulation string `yaml:"preferredPrivateNetworkEncapsulation"`
	PreferredPublicNetworkEncapsulation  string `yaml:"preferredPublicNetworkEncapsulation"`
	HealthFlapMaxBackoff                 string `yaml:"healthFlapMaxBackoff"`
	KubeProxyHealthInterval              string `yaml:"kubeProxyHealthInterval"`
	RouteTableID                         *int   `yaml:"routeTableId"`
	NetlinkResyncPeriod                  string `yaml:"netlinkResyncPeriod"`
	TunnelDataplaneMapSize               *int   `yaml:"tunnelDataplaneMapSize"`
	TunnelIPFamily                       string `yaml:"tunnelIPFamily"`
	VXLANSrcPortLow                      *int   `yaml:"vxlanSrcPortLow"`
	VXLANSrcPortHigh                     *int   `yaml:"vxlanSrcPortHigh"`
	GeneveInterfaceName                  string `yaml:"geneveInterfaceName"`
	VXLANInterfaceName                   string `yaml:"vxlanInterfaceName"`
	IPIPInterfaceName                    string `yaml:"ipipInterfaceName"`
	WireGuardInterfacePrefix             string `yaml:"wireGuardInterfacePrefix"`
}

type RuntimeConfig struct {
	Common     CommonRuntimeConfig     `yaml:"common"`
	Controller ControllerRuntimeConfig `yaml:"controller"`
	Node       NodeRuntimeConfig       `yaml:"node"`
}