klist

type ClusterConfig struct {
	Name          string       `yaml:"name"`
	Server        string       `yaml:"server"`
	CABundle      string       `yaml:"caBundle"`
	OIDC          []OIDCIssuer `yaml:"oidc"`
	AllowedGroups []string     `yaml:"allowedGroups"`
}

type ClusterRef struct {
	Customer    string
	ClusterName string
	YAMLPath    string
}

type CustomerDefaults struct {
	Customer    string       `yaml:"customer"`
	DisplayName string       `yaml:"displayName"`
	OIDC        []OIDCIssuer `yaml:"oidc"`
}

type GlobalConfig struct {
	NetBird NetBirdSettings `yaml:"netbird"`
	// ContextPrefix is prepended to every cluster/context/user name
	// kubeaid-cli writes into the user's kubeconfig. Empty by default
	// (no prefix). Useful in merge mode so kubeaid-managed entries are
	// distinguishable from entries added by other tools — for example,
	// setting "kubeaid-" gives contexts like "kubeaid-staging.acme".
	ContextPrefix string `yaml:"contextPrefix,omitempty"`
}

type NetBirdSettings struct {
	// ManagementURL is the expected `management.url` reported by the
	// local netbird daemon. Used for sanity-checking; mismatch is a
	// warning, not a failure.
	ManagementURL string `yaml:"managementUrl"`
	// ClusterPeerPrefix and ClusterPeerSuffix bracket the cluster name
	// in the NetBird peer FQDN, e.g. prefix "k8s-" + cluster name
	// "staging" + suffix ".netbird.selfhosted". Use the Prefix() and
	// Suffix() accessors instead of dereferencing — they apply
	// baked-in defaults when the field is nil.
	ClusterPeerPrefix *string `yaml:"clusterPeerPrefix,omitempty"`
	ClusterPeerSuffix *string `yaml:"clusterPeerSuffix,omitempty"`
}

type OIDCIssuer struct {
	// Name labels the issuer in the interactive picker and selects it via
	// `login --issuer <name>`. Required and unique when a cluster lists more
	// than one issuer; optional for a single-issuer cluster.
	Name string `yaml:"name"`
	// IssuerURL is the Keycloak realm URL kube-apiserver validates JWTs against.
	IssuerURL string `yaml:"issuerUrl"`
	// ClientID is the OIDC client whose tokens kube-apiserver accepts (the
	// token's `aud`). Per-issuer — the customer and Obmondo entries differ.
	ClientID string `yaml:"clientId"`
	// GroupsClaim is the JWT claim kube-apiserver reads for RBAC groups.
	// Defaults to "groups" when omitted.
	GroupsClaim string `yaml:"groupsClaim"`
	// UsernameClaim is the JWT claim kube-apiserver maps to the user identity.
	// Defaults to "email" when omitted.
	UsernameClaim string `yaml:"usernameClaim"`
}