v1alpha1

package
v0.0.0-...-ecf5dd6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 15, 2026 License: AGPL-3.0, Apache-2.0 Imports: 24 Imported by: 0

Documentation

Overview

Package v1alpha1 contains API Schema definitions for the clrk.apoxy.dev v1alpha1 API group.

Index

Constants

View Source 
const (
	// LabelAgent is the name of the parent agent (TaskAgent or DaemonAgent)
	// that owns this revision.
	LabelAgent = "clrk.apoxy.dev/agent"
	// LabelAgentKind is the kind of the parent agent ("TaskAgent" or
	// "DaemonAgent").
	LabelAgentKind = "clrk.apoxy.dev/agent-kind"
	// LabelGeneration is the parent agent's metadata.generation that the
	// revision was minted from.
	LabelGeneration = "clrk.apoxy.dev/generation"
	// LabelWorkerPool is the name of the WorkerPool the revision is
	// targeted at. Workers filter the watch by this label.
	LabelWorkerPool = "clrk.apoxy.dev/worker-pool"
	// LabelExpose opts a Service into the `clrk dev` host-port
	// auto-forwarder. Set on TaskAgent ingress data-plane Services by
	// the ingress controller; users can also stamp it on their own
	// Services to expose them to the host without a manual
	// `kubectl port-forward`.
	LabelExpose = "clrk.apoxy.dev/expose"
	// LabelExposePort is an optional per-Service host-port hint for the
	// `clrk dev` auto-forwarder. When set to a parsable port number and
	// the port is free, the forwarder binds that exact port; otherwise
	// it falls back to the next free port in its range. The ingress
	// controller does not set this; it's user-facing only.
	LabelExposePort = "clrk.apoxy.dev/expose-port"
	// LabelVersion is the standard app.kubernetes.io/version label the
	// installer stamps on the control-plane objects to record the installed
	// clrk version. Cosmetic (surfaced by `kubectl get -L`); the upgrade gate
	// reads InstalledVersionAnnotation, not this.
	LabelVersion = "app.kubernetes.io/version"
)

Labels projected onto AgentSandboxRevision and other derived resources by the controllers. Workers depend on these to filter and look up parent agent metadata without walking owner references on every reconcile.

View Source 
const (
	// RestartedAtAnnotation is stamped with an RFC3339 timestamp on a pod
	// template's annotations to force a rolling restart. For a controller-
	// owned Deployment (a WorkerPool's), it must be set on
	// WorkerPool.spec.template.metadata.annotations, not the Deployment: the
	// WorkerPoolDeploymentReconciler rebuilds the Deployment's pod template
	// from the WorkerPool on every reconcile, so an annotation patched onto
	// the Deployment is wiped on the next pass and the new ReplicaSet is
	// scaled back to zero. Set on the WorkerPool, the controller propagates
	// it into the Deployment template itself.
	RestartedAtAnnotation = "clrk.apoxy.dev/restartedAt"
	// InstalledVersionAnnotation records the clrk version the installer stamped
	// onto the controller-manager Deployment when `clrk install`/`clrk upgrade`
	// was run with --version. DetectInstall reads it back, and the upgrade gate
	// (GateUpgrade) compares it against the target version. Empty/absent on an
	// install that didn't pass --version.
	InstalledVersionAnnotation = "clrk.apoxy.dev/installed-version"
)

Annotations bumped to trigger pod rollouts (the same mechanism as `kubectl rollout restart`).

View Source 
const (
	AgentKindTask   = "TaskAgent"
	AgentKindDaemon = "DaemonAgent"
)

AgentKind values written into LabelAgentKind. Workers branch on this to pick the right sandbox lifecycle (TaskAgent: per-trigger, DaemonAgent: long-lived with restart policy).

View Source 
const (
	// AIProviderRouteConditionTranslationUnsupported is a route-wide
	// condition: True when at least one (rule match, backendRef) pair
	// can never serve cross-schema traffic — the schema pair lacks
	// llmcall codecs, or the Backend declares no modelRewrites (model
	// IDs don't transfer across providers). Such backends are dropped
	// from the candidate set at route-table build time; this condition
	// is how the operator learns why. Per-request skips (streaming,
	// capability misses) are runtime facts and surface on telemetry
	// (clrk.translation.skipped_backends), not here.
	AIProviderRouteConditionTranslationUnsupported = "TranslationUnsupported"

	// AIProviderRouteReasonUntranslatableBackends is the reason when
	// TranslationUnsupported is True.
	AIProviderRouteReasonUntranslatableBackends = "UntranslatableBackends"
	// AIProviderRouteReasonTranslationSupported is the reason when
	// TranslationUnsupported is False.
	AIProviderRouteReasonTranslationSupported = "TranslationSupported"
)

AIProviderRoute status condition types and reasons beyond the standard Gateway API set.

View Source 
const (
	EgressGatewayConditionAccepted   = "Accepted"
	EgressGatewayConditionProgrammed = "Programmed"
)

EgressGatewayConditionAccepted and EgressGatewayConditionProgrammed mirror the EG-managed Gateway's top-level lifecycle conditions onto the EgressGateway's own status, so consumers see the full lifecycle without reading the implementation-detail Gateway. EgressGatewayConditionReady stays the single readiness summary workers gate on.

View Source 
const (
	// ProviderAuthTypeAWSv4 signs requests with AWS Signature Version 4.
	// The referenced Secret carries `access_key_id` and
	// `secret_access_key` (required) plus an optional `session_token`.
	ProviderAuthTypeAWSv4 = "AWSv4"
	// ProviderAuthTypeGCPServiceAccount is reserved; not implemented.
	ProviderAuthTypeGCPServiceAccount = "GCPServiceAccount"
)

ProviderAuth type values.

View Source 
const (
	// WorkerServiceAccountName is the ServiceAccount worker pods run under by
	// default. The worker advertises itself into WorkerPool.status via the
	// k8s API, so the SA needs the matching RBAC.
	WorkerServiceAccountName = "clrk-worker"

	// WorkerContainerName is the fixed name of the worker container. The
	// AppArmor annotation key (WorkerAppArmorAnnotation) and the WorkerPool
	// Service selector both key on it.
	WorkerContainerName = "worker"

	// WorkerAppArmorAnnotation disables AppArmor for the worker container so
	// runsc can fork its gofer. K3s on Linux honors it; k3d-on-mac silently
	// ignores it. The key suffix is WorkerContainerName.
	WorkerAppArmorAnnotation = "container.apparmor.security.beta.kubernetes.io/worker"

	// WorkerDispatchPortName names the worker container's dispatch port
	// (internal/ports.DispatchPort, 8090). The per-TaskAgent ingress ext_proc
	// rewrites :authority to <podIP>:<DispatchPort> on each request.
	WorkerDispatchPortName = "dispatch"
)

Fixed gVisor/runsc invariants of a worker pod. These are owned by the controller's pod builder (internal/workerpod) and are not expressible on a WorkerPool: a user cannot set or break them. They live here, in the cross-platform API package, so both the builder and the WorkerPool admission validation (validation.go) reference one source of truth. The dispatch port *number* stays in internal/ports (a leaf the API package must not import); only the port *name* is duplicated here.

View Source 
const CLRKConfigSingletonName = "default"

CLRKConfigSingletonName is the only permitted name for the CLRKConfig singleton. Validation pins metadata.name to it so at most one object can exist per namespace.

View Source 
const DefaultEgressRequestTimeout = 5 * time.Minute

DefaultEgressRequestTimeout is the RequestTimeout applied when the spec leaves it unset. See the field doc for the rationale.

View Source 
const DefaultTaskAgentTimeout = 100 * time.Second

DefaultTaskAgentTimeout mirrors the +kubebuilder:default on TaskAgentSpec.Timeout. It is the maximum a single execution runs when the agent author does not set spec.timeout.

View Source 
const EgressGatewayConditionReady = "Ready"

EgressGatewayConditionReady is set on EgressGateway.Status.Conditions to mirror the EG-managed Gateway's Programmed condition. Workers should only dial Status.Listeners[*].BackendAddress once Ready=True.

View Source 
const GroupName = "clrk.apoxy.dev"

GroupName specifies the group name used to register the objects.

Variables

View Source 
var (
	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
	SchemeBuilder runtime.SchemeBuilder

	// Deprecated: use Install instead
	AddToScheme = localSchemeBuilder.AddToScheme
	Install     = localSchemeBuilder.AddToScheme
)
View Source 
var GroupVersion = v1.GroupVersion{Group: GroupName, Version: "v1alpha1"}

GroupVersion specifies the group and the version used to register the objects.

View Source 
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}

SchemeGroupVersion is group version used to register these objects Deprecated: use GroupVersion instead.

View Source 
var WorkerReservedVolumes = []WorkerReservedVolume{
	{Name: "state", MountPath: "/var/lib/clrk/state"},
	{Name: "run", MountPath: "/run/clrk"},
	{Name: "varlog", MountPath: "/var/log/clrk"},
}

WorkerReservedVolumes are the EmptyDir scratch volumes the worker runtime requires: runsc state/rootfs/image cache plus the per-invocation stdio tee (internal/workerlog.Dir = /run/clrk/logs), both under /run/clrk (run); and per-agent persistent state (/var/lib/clrk/state, state). The /var/log/clrk (varlog) mount is legacy and currently unused by the worker, retained to match the pre-overlay pod spec. The mount paths are hardcoded in the worker package (internal/worker, internal/workerlog), so they are owned by the pod builder and not settable on a WorkerPool; the validator rejects ExtraVolumes/ExtraVolumeMounts that collide with these names or paths.

Functions

func EncodeListenerSectionName 

func EncodeListenerSectionName(name string, shape EgressListenerShape) string

EncodeListenerSectionName builds the Gateway-API listener section name the controller stamps and the extension parses back: "<name>--<shape>".

func Resource 

func Resource(resource string) schema.GroupResource

Resource takes an unqualified resource and returns a Group qualified GroupResource

func ShapePriority 

func ShapePriority(s EgressListenerShape) int

ShapePriority orders listener shapes for tie-breaking at dial time when multiple listeners catch the same destination port. Higher value wins. TLS-terminate / HTTPS go first because they sniff and can carry any byte stream; plain TCP is last-resort because it hard-commits the connection to passthrough.

Types

type AIProviderRoute 

type AIProviderRoute struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AIProviderRouteSpec   `json:"spec"`
	Status            AIProviderRouteStatus `json:"status,omitempty"`
}

AIProviderRoute matches outbound requests to AI provider APIs and applies provider-aware policy.

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=aipr +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*AIProviderRoute) DeepCopy 

func (in *AIProviderRoute) DeepCopy() *AIProviderRoute

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AIProviderRoute.

func (*AIProviderRoute) DeepCopyInto 

func (in *AIProviderRoute) DeepCopyInto(out *AIProviderRoute)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AIProviderRoute) DeepCopyObject 

func (in *AIProviderRoute) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*AIProviderRoute) GetGroupVersionResource 

func (r *AIProviderRoute) GetGroupVersionResource() schema.GroupVersionResource

func (*AIProviderRoute) GetObjectMeta 

func (r *AIProviderRoute) GetObjectMeta() *metav1.ObjectMeta

func (*AIProviderRoute) GetSingularName 

func (r *AIProviderRoute) GetSingularName() string

func (*AIProviderRoute) GetStatus 

func (r *AIProviderRoute) GetStatus() resource.StatusSubResource

func (*AIProviderRoute) IsStorageVersion 

func (r *AIProviderRoute) IsStorageVersion() bool

func (*AIProviderRoute) NamespaceScoped 

func (r *AIProviderRoute) NamespaceScoped() bool

func (*AIProviderRoute) New 

func (r *AIProviderRoute) New() runtime.Object

func (*AIProviderRoute) NewList 

func (r *AIProviderRoute) NewList() runtime.Object

func (*AIProviderRoute) Validate 

func (r *AIProviderRoute) Validate(_ context.Context) field.ErrorList

func (*AIProviderRoute) ValidateUpdate 

func (r *AIProviderRoute) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type AIProviderRouteFilter 

type AIProviderRouteFilter struct {
	// Type selects the filter.
	Type AIProviderRouteFilterType `json:"type"`

	// TokenBudget — inline, AI-provider-specific.
	// +optional
	TokenBudget *TokenBudgetFilter `json:"tokenBudget,omitempty"`

	// ExtensionRef references a cross-cutting policy. It is also the seam
	// for classifier-driven backend selection: an ExtensionRef resolving
	// to a classifier kind picks among the rule's BackendRefs at
	// RequestBody end-of-stream (the classifier protocol is APO-480). When
	// absent, backend selection is the standard weighted pick over
	// BackendRefs (BackendRef.Weight).
	// +optional
	ExtensionRef *gwapiv1.LocalObjectReference `json:"extensionRef,omitempty"`
}

AIProviderRouteFilter defines a filter for AIProviderRoute rules.

func (*AIProviderRouteFilter) DeepCopy 

func (in *AIProviderRouteFilter) DeepCopy() *AIProviderRouteFilter

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AIProviderRouteFilter.

func (*AIProviderRouteFilter) DeepCopyInto 

func (in *AIProviderRouteFilter) DeepCopyInto(out *AIProviderRouteFilter)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AIProviderRouteFilterType 

type AIProviderRouteFilterType string

AIProviderRouteFilterType identifies the type of filter in an AIProviderRouteFilter. +kubebuilder:validation:Enum=TokenBudget;ExtensionRef 

const (
	AIProviderFilterTokenBudget  AIProviderRouteFilterType = "TokenBudget"
	AIProviderFilterExtensionRef AIProviderRouteFilterType = "ExtensionRef"
)

type AIProviderRouteList 

type AIProviderRouteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AIProviderRoute `json:"items"`
}

AIProviderRouteList contains a list of AIProviderRoute resources.

func (*AIProviderRouteList) DeepCopy 

func (in *AIProviderRouteList) DeepCopy() *AIProviderRouteList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AIProviderRouteList.

func (*AIProviderRouteList) DeepCopyInto 

func (in *AIProviderRouteList) DeepCopyInto(out *AIProviderRouteList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AIProviderRouteList) DeepCopyObject 

func (in *AIProviderRouteList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type AIProviderRouteMatch 

type AIProviderRouteMatch struct {
	// Provider selects the AI API provider. Validated against the
	// llmcall provider registry at admission (AIProviderRoute.Validate),
	// not an enum — a new provider plugin extends what is accepted
	// without an API change. "custom" opts out of schema awareness for
	// endpoint-only matching.
	Provider string `json:"provider"`

	// Models restricts to specific model IDs. Supports glob: "claude-*".
	// +optional
	Models []string `json:"models,omitempty"`

	// Endpoints restricts to API paths.
	// +optional
	Endpoints []string `json:"endpoints,omitempty"`
}

AIProviderRouteMatch defines match criteria for AI provider traffic.

func (*AIProviderRouteMatch) DeepCopy 

func (in *AIProviderRouteMatch) DeepCopy() *AIProviderRouteMatch

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AIProviderRouteMatch.

func (*AIProviderRouteMatch) DeepCopyInto 

func (in *AIProviderRouteMatch) DeepCopyInto(out *AIProviderRouteMatch)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AIProviderRouteRule 

type AIProviderRouteRule struct {
	Matches []AIProviderRouteMatch `json:"matches,omitempty"`

	// Filters apply policy to matched AI provider traffic.
	// +optional
	Filters []AIProviderRouteFilter `json:"filters,omitempty"`

	// BackendRefs is the candidate set of clrk Backends
	// (clrk.apoxy.dev/Backend) this rule may route to. With a single
	// ref the request is re-pointed to that backend. With two or more,
	// the request is distributed by the standard Gateway API
	// BackendRef.Weight — unless a FallbackRoutingPolicy attaches to
	// this route, in which case list ORDER is the fallback priority and
	// weights are ignored, or an ExtensionRef classifier filter on this
	// rule picks one instead (APO-480). Refs that are not clrk Backends
	// are reported as unresolved by the status controller and ignored
	// at selection time.
	// +optional
	BackendRefs []gwapiv1.BackendRef `json:"backendRefs,omitempty"`
}

AIProviderRouteRule defines a rule within an AIProviderRoute.

func (*AIProviderRouteRule) DeepCopy 

func (in *AIProviderRouteRule) DeepCopy() *AIProviderRouteRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AIProviderRouteRule.

func (*AIProviderRouteRule) DeepCopyInto 

func (in *AIProviderRouteRule) DeepCopyInto(out *AIProviderRouteRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AIProviderRouteSpec 

type AIProviderRouteSpec struct {
	ParentRefs []gwapiv1.ParentReference `json:"parentRefs"`
	Rules      []AIProviderRouteRule     `json:"rules"`
}

AIProviderRouteSpec defines the desired state of an AIProviderRoute.

func (*AIProviderRouteSpec) DeepCopy 

func (in *AIProviderRouteSpec) DeepCopy() *AIProviderRouteSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AIProviderRouteSpec.

func (*AIProviderRouteSpec) DeepCopyInto 

func (in *AIProviderRouteSpec) DeepCopyInto(out *AIProviderRouteSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AIProviderRouteStatus 

type AIProviderRouteStatus struct {
	Parents []gwapiv1.RouteParentStatus `json:"parents,omitempty"`
}

AIProviderRouteStatus describes the observed state of an AIProviderRoute.

func (*AIProviderRouteStatus) CopyTo 

func (s *AIProviderRouteStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*AIProviderRouteStatus) DeepCopy 

func (in *AIProviderRouteStatus) DeepCopy() *AIProviderRouteStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AIProviderRouteStatus.

func (*AIProviderRouteStatus) DeepCopyInto 

func (in *AIProviderRouteStatus) DeepCopyInto(out *AIProviderRouteStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AIProviderRouteStatus) SubResourceName 

func (s *AIProviderRouteStatus) SubResourceName() string

type AgentDelivery 

type AgentDelivery struct {
	// Mode is Stdin (default) or Metadata.
	// +kubebuilder:validation:Enum=Stdin;Metadata
	// +kubebuilder:default=Stdin
	// +optional
	Mode AgentDeliveryMode `json:"mode,omitempty"`
}

AgentDelivery selects the wire format used to hand a request off to the agent process.

func (*AgentDelivery) DeepCopy 

func (in *AgentDelivery) DeepCopy() *AgentDelivery

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentDelivery.

func (*AgentDelivery) DeepCopyInto 

func (in *AgentDelivery) DeepCopyInto(out *AgentDelivery)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AgentDeliveryMode 

type AgentDeliveryMode string

AgentDeliveryMode enumerates request delivery transports. 

const (
	// AgentDeliveryStdin writes a structured-mode CloudEvents JSON
	// envelope to the agent's stdin.
	AgentDeliveryStdin AgentDeliveryMode = "Stdin"

	// AgentDeliveryMetadata exposes an IMDS-style HTTP server in
	// the sandbox; the agent fetches the request via
	// $CLRK_METADATA_URL/event and posts the response body to
	// $CLRK_METADATA_URL/response.
	AgentDeliveryMetadata AgentDeliveryMode = "Metadata"
)

type AgentEgressRef 

type AgentEgressRef struct {
	// GatewayRef is the name of an EgressGateway in the same namespace.
	GatewayRef string `json:"gatewayRef"`
}

AgentEgressRef references an EgressGateway object for outbound access.

func (*AgentEgressRef) DeepCopy 

func (in *AgentEgressRef) DeepCopy() *AgentEgressRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentEgressRef.

func (*AgentEgressRef) DeepCopyInto 

func (in *AgentEgressRef) DeepCopyInto(out *AgentEgressRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AgentIdentity 

type AgentIdentity struct {
	// Extractors defines one or more identity extraction rules.
	Extractors []IdentityExtractor `json:"extractors"`
}

AgentIdentity configures user identity extraction from incoming requests.

func (*AgentIdentity) DeepCopy 

func (in *AgentIdentity) DeepCopy() *AgentIdentity

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentIdentity.

func (*AgentIdentity) DeepCopyInto 

func (in *AgentIdentity) DeepCopyInto(out *AgentIdentity)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AgentSandbox 

type AgentSandbox struct {
	// Image is the OCI image reference for the agent.
	Image string `json:"image"`
	// Command overrides the image entrypoint.
	// +optional
	Command []string `json:"command,omitempty"`
	// Args are arguments to the entrypoint.
	// +optional
	Args []string `json:"args,omitempty"`
	// Env is a list of environment variables to set in the sandbox.
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`
}

AgentSandbox defines the OCI image and process configuration for an agent.

func (*AgentSandbox) DeepCopy 

func (in *AgentSandbox) DeepCopy() *AgentSandbox

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentSandbox.

func (*AgentSandbox) DeepCopyInto 

func (in *AgentSandbox) DeepCopyInto(out *AgentSandbox)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AgentSandboxRevision 

type AgentSandboxRevision struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AgentSandboxRevisionSpec   `json:"spec"`
	Status            AgentSandboxRevisionStatus `json:"status,omitempty"`
}

AgentSandboxRevision is an immutable snapshot of an agent's sandbox configuration. Created automatically when a TaskAgent or DaemonAgent template changes. Named "{agent-name}-{5-digit-generation}".

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=asr +kubebuilder:printcolumn:name="Image",type=string,JSONPath=`.spec.image` +kubebuilder:printcolumn:name="Ready Workers",type=integer,JSONPath=`.status.readyWorkers` +kubebuilder:printcolumn:name="Ready",type=string,JSONPath=`.status.conditions[?(@.type=="Ready")].status` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*AgentSandboxRevision) DeepCopy 

func (in *AgentSandboxRevision) DeepCopy() *AgentSandboxRevision

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentSandboxRevision.

func (*AgentSandboxRevision) DeepCopyInto 

func (in *AgentSandboxRevision) DeepCopyInto(out *AgentSandboxRevision)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AgentSandboxRevision) DeepCopyObject 

func (in *AgentSandboxRevision) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*AgentSandboxRevision) GetGroupVersionResource 

func (r *AgentSandboxRevision) GetGroupVersionResource() schema.GroupVersionResource

func (*AgentSandboxRevision) GetObjectMeta 

func (r *AgentSandboxRevision) GetObjectMeta() *metav1.ObjectMeta

func (*AgentSandboxRevision) GetSingularName 

func (r *AgentSandboxRevision) GetSingularName() string

func (*AgentSandboxRevision) GetStatus 

func (r *AgentSandboxRevision) GetStatus() resource.StatusSubResource

func (*AgentSandboxRevision) IsStorageVersion 

func (r *AgentSandboxRevision) IsStorageVersion() bool

func (*AgentSandboxRevision) NamespaceScoped 

func (r *AgentSandboxRevision) NamespaceScoped() bool

func (*AgentSandboxRevision) New 

func (r *AgentSandboxRevision) New() runtime.Object

func (*AgentSandboxRevision) NewList 

func (r *AgentSandboxRevision) NewList() runtime.Object

type AgentSandboxRevisionList 

type AgentSandboxRevisionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentSandboxRevision `json:"items"`
}

AgentSandboxRevisionList contains a list of AgentSandboxRevision resources.

func (*AgentSandboxRevisionList) DeepCopy 

func (in *AgentSandboxRevisionList) DeepCopy() *AgentSandboxRevisionList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentSandboxRevisionList.

func (*AgentSandboxRevisionList) DeepCopyInto 

func (in *AgentSandboxRevisionList) DeepCopyInto(out *AgentSandboxRevisionList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AgentSandboxRevisionList) DeepCopyObject 

func (in *AgentSandboxRevisionList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type AgentSandboxRevisionSpec 

type AgentSandboxRevisionSpec struct {
	AgentSandbox `json:",inline"`
}

AgentSandboxRevisionSpec captures the immutable deployable artifact — the OCI image and process configuration.

func (*AgentSandboxRevisionSpec) DeepCopy 

func (in *AgentSandboxRevisionSpec) DeepCopy() *AgentSandboxRevisionSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentSandboxRevisionSpec.

func (*AgentSandboxRevisionSpec) DeepCopyInto 

func (in *AgentSandboxRevisionSpec) DeepCopyInto(out *AgentSandboxRevisionSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AgentSandboxRevisionStatus 

type AgentSandboxRevisionStatus struct {
	// Conditions represent the latest available observations.
	// Known condition types: "Ready", "Active".
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Workers tracks the sandbox status for each worker pod.
	// +optional
	Workers []WorkerSandboxStatus `json:"workers,omitempty"`

	// ReadyWorkers is the count of workers that have this revision's
	// sandbox ready (image pulled, warm instances available).
	// +optional
	ReadyWorkers int32 `json:"readyWorkers,omitempty"`
}

AgentSandboxRevisionStatus describes the observed state of a revision.

func (*AgentSandboxRevisionStatus) CopyTo 

func (s *AgentSandboxRevisionStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*AgentSandboxRevisionStatus) DeepCopy 

func (in *AgentSandboxRevisionStatus) DeepCopy() *AgentSandboxRevisionStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentSandboxRevisionStatus.

func (*AgentSandboxRevisionStatus) DeepCopyInto 

func (in *AgentSandboxRevisionStatus) DeepCopyInto(out *AgentSandboxRevisionStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AgentSandboxRevisionStatus) SubResourceName 

func (s *AgentSandboxRevisionStatus) SubResourceName() string

type AgentSandboxRevisionTemplate 

type AgentSandboxRevisionTemplate struct {
	// Metadata allows setting labels and annotations on the created revision.
	// Name and GenerateName are ignored; the controller generates the name.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec is the desired state of the revision.
	Spec AgentSandboxRevisionSpec `json:"spec"`
}

AgentSandboxRevisionTemplate is the template embedded in agent specs. When the template content changes, the agent controller creates a new AgentSandboxRevision snapshot.

func (*AgentSandboxRevisionTemplate) DeepCopy 

func (in *AgentSandboxRevisionTemplate) DeepCopy() *AgentSandboxRevisionTemplate

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentSandboxRevisionTemplate.

func (*AgentSandboxRevisionTemplate) DeepCopyInto 

func (in *AgentSandboxRevisionTemplate) DeepCopyInto(out *AgentSandboxRevisionTemplate)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AgentState 

type AgentState struct {
	// Backend is the storage backend. Currently only "sqlite" is supported.
	// +optional
	Backend string `json:"backend,omitempty"`
	// SizeLimitMB caps the state storage size in megabytes. Default 100.
	// +optional
	SizeLimitMB int32 `json:"sizeLimitMB,omitempty"`
	// MountPath is where state is mounted in the sandbox. Default "/var/clrk/state".
	// Must be a clean absolute path other than "/" and must not overlap with
	// runtime-managed paths (e.g. /proc, /dev, /sys, /tmp, /etc, /usr, /bin,
	// system CA bundles, /etc/resolv.conf). Admission rejects conflicts.
	// +optional
	MountPath string `json:"mountPath,omitempty"`
}

AgentState configures persistent state across executions.

func (*AgentState) DeepCopy 

func (in *AgentState) DeepCopy() *AgentState

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentState.

func (*AgentState) DeepCopyInto 

func (in *AgentState) DeepCopyInto(out *AgentState)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AgentStreaming 

type AgentStreaming struct {
	// Enabled controls whether streaming is active.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
}

AgentStreaming configures stdout/stderr streaming behavior.

func (*AgentStreaming) DeepCopy 

func (in *AgentStreaming) DeepCopy() *AgentStreaming

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentStreaming.

func (*AgentStreaming) DeepCopyInto 

func (in *AgentStreaming) DeepCopyInto(out *AgentStreaming)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Backend 

type Backend struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              BackendSpec   `json:"spec"`
	Status            BackendStatus `json:"status,omitempty"`
}

Backend is an addressable AI-provider upstream that an AIProviderRoute rule can route to via BackendRefs. It declares the wire schema, the destination, and any per-backend model/body rewrites; credentials attach separately via CredentialInjectionPolicy (sectionName-targeted).

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=be +kubebuilder:printcolumn:name="Type",type=string,JSONPath=`.spec.type` +kubebuilder:printcolumn:name="Schema",type=string,JSONPath=`.spec.schema.name` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*Backend) DeepCopy 

func (in *Backend) DeepCopy() *Backend

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backend.

func (*Backend) DeepCopyInto 

func (in *Backend) DeepCopyInto(out *Backend)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Backend) DeepCopyObject 

func (in *Backend) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*Backend) Default 

func (r *Backend) Default()

Default sets spec.type to Upstream when unset. This is load-bearing: the aggregated apiserver does not honor the +kubebuilder:default marker (see the package comment), so without it a type-less Backend persists with Type="", and the egress data plane's resolveBackends drops an empty-type backend as malformed instead of treating it as the documented Upstream default. BackendUpstream.Port is intentionally left unstamped: its only consumer (resolveBackends) already maps 0 to 443, so stamping it would add server-side-apply field-ownership churn for no behavioral change.

func (*Backend) GetGroupVersionResource 

func (r *Backend) GetGroupVersionResource() schema.GroupVersionResource

func (*Backend) GetObjectMeta 

func (r *Backend) GetObjectMeta() *metav1.ObjectMeta

func (*Backend) GetSingularName 

func (r *Backend) GetSingularName() string

func (*Backend) GetStatus 

func (r *Backend) GetStatus() resource.StatusSubResource

func (*Backend) IsStorageVersion 

func (r *Backend) IsStorageVersion() bool

func (*Backend) NamespaceScoped 

func (r *Backend) NamespaceScoped() bool

func (*Backend) New 

func (r *Backend) New() runtime.Object

func (*Backend) NewList 

func (r *Backend) NewList() runtime.Object

func (*Backend) Validate 

func (b *Backend) Validate(_ context.Context) field.ErrorList

func (*Backend) ValidateUpdate 

func (b *Backend) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type BackendBodyMutation 

type BackendBodyMutation struct {
	// EnsureStreamUsage forces stream_options.include_usage=true on
	// OpenAI-shaped streaming requests so streamed responses always emit
	// terminal token usage. No-op for non-OpenAI schemas.
	// +optional
	EnsureStreamUsage *bool `json:"ensureStreamUsage,omitempty"`
}

BackendBodyMutation configures request-body rewrites applied at RequestBody end-of-stream when this backend is selected. Today the only mutation is forcing OpenAI-shaped streaming usage; the struct exists so further per-backend body rewrites can be added without a schema break.

func (*BackendBodyMutation) DeepCopy 

func (in *BackendBodyMutation) DeepCopy() *BackendBodyMutation

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendBodyMutation.

func (*BackendBodyMutation) DeepCopyInto 

func (in *BackendBodyMutation) DeepCopyInto(out *BackendBodyMutation)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BackendList 

type BackendList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Backend `json:"items"`
}

BackendList contains a list of Backend resources.

func (*BackendList) DeepCopy 

func (in *BackendList) DeepCopy() *BackendList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendList.

func (*BackendList) DeepCopyInto 

func (in *BackendList) DeepCopyInto(out *BackendList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*BackendList) DeepCopyObject 

func (in *BackendList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type BackendSchema 

type BackendSchema struct {
	// Name is the wire schema the upstream speaks.
	Name BackendSchemaName `json:"name"`
}

BackendSchema declares the wire schema of the upstream. It is a struct (not a bare enum field) so vendor-specific schema details — e.g. a Bedrock region or an Azure deployment name — can be added later without reshaping the discriminator.

func (*BackendSchema) DeepCopy 

func (in *BackendSchema) DeepCopy() *BackendSchema

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendSchema.

func (*BackendSchema) DeepCopyInto 

func (in *BackendSchema) DeepCopyInto(out *BackendSchema)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BackendSchemaName 

type BackendSchemaName string

BackendSchemaName is the wire schema an upstream speaks: the request/response body shape, endpoint layout, and credential scheme. The short names deliberately match AIProviderRouteMatch.Provider so the ext_proc data plane can key its response parser to a selected backend's schema through the same parsers.Canonical mapping it already uses for host-derived providers.

Not an enum: Backend.Validate checks the value against the llmcall provider registry at admission, so a new provider plugin extends what is accepted without an API change. The constants below are the built-in spellings. 

const (
	BackendSchemaOpenAI      BackendSchemaName = "openai"
	BackendSchemaAnthropic   BackendSchemaName = "anthropic"
	BackendSchemaGoogle      BackendSchemaName = "google"
	BackendSchemaAzureOpenAI BackendSchemaName = "azure-openai"
	BackendSchemaBedrock     BackendSchemaName = "bedrock"
	BackendSchemaCustom      BackendSchemaName = "custom"
)

type BackendSpec 

type BackendSpec struct {
	// Type selects the destination kind.
	// +kubebuilder:default=Upstream
	Type BackendType `json:"type"`

	// Schema declares the wire schema the upstream speaks.
	Schema BackendSchema `json:"schema"`

	// Upstream is the external host:port destination. Required when
	// Type=Upstream.
	// +optional
	Upstream *BackendUpstream `json:"upstream,omitempty"`

	// InferencePoolRef references a Gateway API Inference Extension
	// InferencePool in the same namespace. Required when
	// Type=InferencePool. Accepted but not yet served by the data plane.
	// +optional
	InferencePoolRef *gwapiv1.LocalObjectReference `json:"inferencePoolRef,omitempty"`

	// ModelRewrites remap the request model ID before it reaches the
	// upstream; the first entry whose From glob matches wins.
	// +optional
	ModelRewrites []ModelRewrite `json:"modelRewrites,omitempty"`

	// BodyMutation configures request-body rewrites applied at
	// RequestBody end-of-stream when this backend is selected.
	// +optional
	BodyMutation *BackendBodyMutation `json:"bodyMutation,omitempty"`
}

BackendSpec defines the desired state of a Backend.

Exactly one destination is set per the Type discriminator: Upstream when Type=Upstream, InferencePoolRef when Type=InferencePool. The API server does not enforce this exclusivity (clrk does not use CEL validation markers); the AIProviderRoute status controller surfaces a violation as ResolvedRefs=False and ext_proc refuses an under-specified backend.

Credentials are NOT declared here. A Backend names no secret and holds no key: the credential injected when this backend is selected comes from a CredentialInjectionPolicy whose targetRef names the route with a sectionName equal to this Backend's ref name. This keeps the architectural invariant that keys live only in policy + Secret, never in a routing object.

func (*BackendSpec) DeepCopy 

func (in *BackendSpec) DeepCopy() *BackendSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendSpec.

func (*BackendSpec) DeepCopyInto 

func (in *BackendSpec) DeepCopyInto(out *BackendSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BackendStatus 

type BackendStatus struct {
	// Conditions report whether the Backend is well-formed and its
	// destination resolvable (Accepted, ResolvedRefs).
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

BackendStatus describes the observed state of a Backend.

func (*BackendStatus) CopyTo 

func (s *BackendStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*BackendStatus) DeepCopy 

func (in *BackendStatus) DeepCopy() *BackendStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendStatus.

func (*BackendStatus) DeepCopyInto 

func (in *BackendStatus) DeepCopyInto(out *BackendStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*BackendStatus) SubResourceName 

func (s *BackendStatus) SubResourceName() string

type BackendType 

type BackendType string

BackendType selects the destination kind. Exactly one of the matching destination fields must be set: Upstream for an external DNS host, InferencePoolRef for an in-cluster pool of model-serving pods.

+kubebuilder:validation:Enum=Upstream;InferencePool 

const (
	// BackendTypeUpstream routes to an external host:port resolved via
	// the egress dynamic_forward_proxy. This is the only type with data-
	// plane support today.
	BackendTypeUpstream BackendType = "Upstream"
	// BackendTypeInferencePool routes to a Gateway API Inference
	// Extension InferencePool. Accepted by the API but not yet wired in
	// the data plane; selecting such a backend is refused at runtime
	// until the in-cluster-pool follow-up lands.
	BackendTypeInferencePool BackendType = "InferencePool"
)

type BackendUpstream 

type BackendUpstream struct {
	// Host is the upstream DNS name (or IP literal) the egress proxy
	// dials. SNI and certificate SAN validation are derived from it.
	// +kubebuilder:validation:MinLength=1
	Host string `json:"host"`

	// Port is the upstream TCP port. Defaults to 443 (the egress data
	// plane is TLS-terminating MITM, so backends are HTTPS).
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +kubebuilder:default=443
	Port int32 `json:"port,omitempty"`
}

BackendUpstream is an external host:port destination. The host is DNS-resolved per request by the egress forward proxy; no static cluster is provisioned per backend.

func (*BackendUpstream) DeepCopy 

func (in *BackendUpstream) DeepCopy() *BackendUpstream

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendUpstream.

func (*BackendUpstream) DeepCopyInto 

func (in *BackendUpstream) DeepCopyInto(out *BackendUpstream)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BodyCaptureSpec 

type BodyCaptureSpec struct {
	// MaxBytes caps the captured body size per direction. Bodies larger
	// than this are truncated; the log record carries a truncated marker.
	// +kubebuilder:default=65536
	// +optional
	MaxBytes *int32 `json:"maxBytes,omitempty"`

	// IncludeContentTypes limits body capture to these Content-Type
	// prefixes. Empty means the default set (application/json,
	// application/x-ndjson, text/event-stream).
	// +optional
	IncludeContentTypes []string `json:"includeContentTypes,omitempty"`
}

BodyCaptureSpec governs request/response body capture bounds.

func (*BodyCaptureSpec) DeepCopy 

func (in *BodyCaptureSpec) DeepCopy() *BodyCaptureSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BodyCaptureSpec.

func (*BodyCaptureSpec) DeepCopyInto 

func (in *BodyCaptureSpec) DeepCopyInto(out *BodyCaptureSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type BodyExtractor 

type BodyExtractor struct {
	// JSONPath is the JSONPath expression into the request body.
	JSONPath string `json:"jsonPath"`
	// Field is the identity field to populate.
	Field string `json:"field"`
}

BodyExtractor extracts a value from the request body using JSONPath.

func (*BodyExtractor) DeepCopy 

func (in *BodyExtractor) DeepCopy() *BodyExtractor

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BodyExtractor.

func (*BodyExtractor) DeepCopyInto 

func (in *BodyExtractor) DeepCopyInto(out *BodyExtractor)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type CLRKConfig 

type CLRKConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              CLRKConfigSpec   `json:"spec"`
	Status            CLRKConfigStatus `json:"status,omitempty"`
}

CLRKConfig is the install-wide singleton configuration object. Exactly one object, named "default", lives in the clrk system namespace. It is the home for cross-cutting settings; the Notifications feature is one section (spec.notifications), and future settings live beside it. The spec is browser-writable (the console's signup gate sets spec.notifications.email); the status is controller-written (phone-home registration health). The registration token itself is never here -- it lives in a core/v1 Secret the browser cannot reach, referenced from status.notifications.

+k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=cc +kubebuilder:printcolumn:name="Email",type=string,JSONPath=`.spec.notifications.email` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*CLRKConfig) ConvertToTable 

func (c *CLRKConfig) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements resourcestrategy.TableConverter.

func (*CLRKConfig) DeepCopy 

func (in *CLRKConfig) DeepCopy() *CLRKConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CLRKConfig.

func (*CLRKConfig) DeepCopyInto 

func (in *CLRKConfig) DeepCopyInto(out *CLRKConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CLRKConfig) DeepCopyObject 

func (in *CLRKConfig) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*CLRKConfig) Default 

func (c *CLRKConfig) Default()

Default stamps the load-bearing notifications defaults once the feature is in use (email set): advisory polling defaults on, and SignedUpAt is stamped when the email is first recorded. EventRetention is intentionally left unset so the controller-manager's --notifications-event-retention flag is the fallback (unstamped => no server-side-apply churn on the common case).

func (*CLRKConfig) GetGroupVersionResource 

func (r *CLRKConfig) GetGroupVersionResource() schema.GroupVersionResource

func (*CLRKConfig) GetObjectMeta 

func (r *CLRKConfig) GetObjectMeta() *metav1.ObjectMeta

func (*CLRKConfig) GetSingularName 

func (r *CLRKConfig) GetSingularName() string

func (*CLRKConfig) GetStatus 

func (r *CLRKConfig) GetStatus() resource.StatusSubResource

func (*CLRKConfig) IsStorageVersion 

func (r *CLRKConfig) IsStorageVersion() bool

func (*CLRKConfig) NamespaceScoped 

func (r *CLRKConfig) NamespaceScoped() bool

func (*CLRKConfig) New 

func (r *CLRKConfig) New() runtime.Object

func (*CLRKConfig) NewList 

func (r *CLRKConfig) NewList() runtime.Object

func (*CLRKConfig) Validate 

func (c *CLRKConfig) Validate(_ context.Context) field.ErrorList

Validate enforces the CLRKConfig singleton discipline: the only permitted name is "default". Since the resource name is the primary key, name-pinning makes at most one CLRKConfig per namespace possible (a pure per-object hook cannot list-and-reject, which is why the singleton is a name pin, not a status condition). A set email must look like an email.

func (*CLRKConfig) ValidateUpdate 

func (c *CLRKConfig) ValidateUpdate(ctx context.Context, _ runtime.Object) field.ErrorList

ValidateUpdate re-runs the create validation (the name pin and email shape are invariants, not transition rules).

type CLRKConfigList 

type CLRKConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CLRKConfig `json:"items"`
}

CLRKConfigList contains a list of CLRKConfig resources.

func (*CLRKConfigList) ConvertToTable 

func (l *CLRKConfigList) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements resourcestrategy.TableConverter for list responses.

func (*CLRKConfigList) DeepCopy 

func (in *CLRKConfigList) DeepCopy() *CLRKConfigList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CLRKConfigList.

func (*CLRKConfigList) DeepCopyInto 

func (in *CLRKConfigList) DeepCopyInto(out *CLRKConfigList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CLRKConfigList) DeepCopyObject 

func (in *CLRKConfigList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type CLRKConfigSpec 

type CLRKConfigSpec struct {
	// Notifications configures the Notification Center + phone-home feature.
	// +optional
	Notifications NotificationsConfig `json:"notifications,omitempty"`
}

CLRKConfigSpec holds the install-wide configuration sections.

func (*CLRKConfigSpec) DeepCopy 

func (in *CLRKConfigSpec) DeepCopy() *CLRKConfigSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CLRKConfigSpec.

func (*CLRKConfigSpec) DeepCopyInto 

func (in *CLRKConfigSpec) DeepCopyInto(out *CLRKConfigSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type CLRKConfigStatus 

type CLRKConfigStatus struct {
	// Notifications carries the phone-home registration + health.
	// +optional
	Notifications NotificationsStatus `json:"notifications,omitempty"`
}

CLRKConfigStatus is the controller-written status.

func (*CLRKConfigStatus) CopyTo 

func (s *CLRKConfigStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*CLRKConfigStatus) DeepCopy 

func (in *CLRKConfigStatus) DeepCopy() *CLRKConfigStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CLRKConfigStatus.

func (*CLRKConfigStatus) DeepCopyInto 

func (in *CLRKConfigStatus) DeepCopyInto(out *CLRKConfigStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CLRKConfigStatus) SubResourceName 

func (s *CLRKConfigStatus) SubResourceName() string

type CredentialInjectionPolicy 

type CredentialInjectionPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              CredentialInjectionSpec         `json:"spec"`
	Status            CredentialInjectionPolicyStatus `json:"status,omitempty"`
}

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:resource:shortName=cip +kubebuilder:subresource:status +kubebuilder:printcolumn:name="Target",type=string,JSONPath=`.spec.target` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*CredentialInjectionPolicy) DeepCopy 

func (in *CredentialInjectionPolicy) DeepCopy() *CredentialInjectionPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CredentialInjectionPolicy.

func (*CredentialInjectionPolicy) DeepCopyInto 

func (in *CredentialInjectionPolicy) DeepCopyInto(out *CredentialInjectionPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CredentialInjectionPolicy) DeepCopyObject 

func (in *CredentialInjectionPolicy) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*CredentialInjectionPolicy) Default 

func (r *CredentialInjectionPolicy) Default()

Default sets spec.secretKey to "token" when unset, matching the credential injection consumer's own "" fallback.

func (*CredentialInjectionPolicy) GetGroupVersionResource 

func (r *CredentialInjectionPolicy) GetGroupVersionResource() schema.GroupVersionResource

func (*CredentialInjectionPolicy) GetObjectMeta 

func (r *CredentialInjectionPolicy) GetObjectMeta() *metav1.ObjectMeta

func (*CredentialInjectionPolicy) GetSingularName 

func (r *CredentialInjectionPolicy) GetSingularName() string

func (*CredentialInjectionPolicy) GetStatus 

func (r *CredentialInjectionPolicy) GetStatus() resource.StatusSubResource

func (*CredentialInjectionPolicy) IsStorageVersion 

func (r *CredentialInjectionPolicy) IsStorageVersion() bool

func (*CredentialInjectionPolicy) NamespaceScoped 

func (r *CredentialInjectionPolicy) NamespaceScoped() bool

func (*CredentialInjectionPolicy) New 

func (r *CredentialInjectionPolicy) New() runtime.Object

func (*CredentialInjectionPolicy) NewList 

func (r *CredentialInjectionPolicy) NewList() runtime.Object

func (*CredentialInjectionPolicy) Validate 

func (p *CredentialInjectionPolicy) Validate(_ context.Context) field.ErrorList

func (*CredentialInjectionPolicy) ValidateUpdate 

func (p *CredentialInjectionPolicy) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type CredentialInjectionPolicyList 

type CredentialInjectionPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CredentialInjectionPolicy `json:"items"`
}

CredentialInjectionPolicyList contains a list of CredentialInjectionPolicy resources.

func (*CredentialInjectionPolicyList) DeepCopy 

func (in *CredentialInjectionPolicyList) DeepCopy() *CredentialInjectionPolicyList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CredentialInjectionPolicyList.

func (*CredentialInjectionPolicyList) DeepCopyInto 

func (in *CredentialInjectionPolicyList) DeepCopyInto(out *CredentialInjectionPolicyList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CredentialInjectionPolicyList) DeepCopyObject 

func (in *CredentialInjectionPolicyList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type CredentialInjectionPolicyStatus 

type CredentialInjectionPolicyStatus struct {
	gwapiv1a2.PolicyStatus `json:",inline"`
}

CredentialInjectionPolicyStatus reports attachment acceptance for a CredentialInjectionPolicy. It embeds the Gateway API GEP-2649 PolicyStatus so every clrk policy reports through one uniform shape: one PolicyAncestorStatus per resolved attachment, carrying Accepted / Conflicted conditions.

func (*CredentialInjectionPolicyStatus) CopyTo 

func (s *CredentialInjectionPolicyStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*CredentialInjectionPolicyStatus) DeepCopy 

func (in *CredentialInjectionPolicyStatus) DeepCopy() *CredentialInjectionPolicyStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CredentialInjectionPolicyStatus.

func (*CredentialInjectionPolicyStatus) DeepCopyInto 

func (in *CredentialInjectionPolicyStatus) DeepCopyInto(out *CredentialInjectionPolicyStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*CredentialInjectionPolicyStatus) SubResourceName 

func (s *CredentialInjectionPolicyStatus) SubResourceName() string

type CredentialInjectionSpec 

type CredentialInjectionSpec struct {
	// TargetRefs attaches this policy DOWN onto AIProviderRoute, MCPRoute,
	// or EgressGateway targets (GEP-2648 Direct Policy Attachment). The
	// proxy applies the credential to traffic matching the referenced
	// target. Plural so one policy can cover several targets;
	// LocalPolicyTargetReferenceWithSectionName is same-namespace by
	// construction (cross-namespace attachment requires a ReferenceGrant).
	//
	// Match semantics by target kind:
	//   - AIProviderRoute: applies when the request matches that APR's
	//     rules (provider + endpoint + model gates). A sectionName names a
	//     specific BackendRef and gates injection to post-selection of that
	//     backend; an empty sectionName injects route-wide.
	//   - MCPRoute: applies when the request matches that route
	//     (no-op until MCPRoute consumption ships).
	//   - EgressGateway: catch-all for any traffic on the gateway that
	//     no narrower policy claimed.
	TargetRefs []gwapiv1a2.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`

	// SecretRef points at a K8s Secret containing the credential. The
	// `namespace` field is ignored: the Secret must live in the same
	// namespace as the CredentialInjectionPolicy. Cross-namespace refs
	// will gate on ReferenceGrant post-MVP.
	SecretRef gwapiv1.SecretObjectReference `json:"secretRef"`

	// SecretKey selects a key within the Secret. Defaults to "token".
	// +kubebuilder:default=token
	SecretKey string `json:"secretKey,omitempty"`

	// Target defines where to inject the credential.
	Target CredentialTarget `json:"target"`

	// HeaderName — required when target=Header.
	// +optional
	HeaderName *string `json:"headerName,omitempty"`

	// QueryParamName — required when target=QueryParam.
	// +optional
	QueryParamName *string `json:"queryParamName,omitempty"`

	// ProviderAuth — required when target=ProviderAuth.
	// +optional
	ProviderAuth *ProviderAuthConfig `json:"providerAuth,omitempty"`
}

CredentialInjectionSpec defines the desired state of a CredentialInjectionPolicy.

func (*CredentialInjectionSpec) DeepCopy 

func (in *CredentialInjectionSpec) DeepCopy() *CredentialInjectionSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CredentialInjectionSpec.

func (*CredentialInjectionSpec) DeepCopyInto 

func (in *CredentialInjectionSpec) DeepCopyInto(out *CredentialInjectionSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type CredentialTarget 

type CredentialTarget string

CredentialTarget defines where to inject the credential. +kubebuilder:validation:Enum=Header;QueryParam;ProviderAuth 

const (
	CredentialTargetHeader       CredentialTarget = "Header"
	CredentialTargetQueryParam   CredentialTarget = "QueryParam"
	CredentialTargetProviderAuth CredentialTarget = "ProviderAuth"
)

type DaemonAgent 

type DaemonAgent struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              DaemonAgentSpec   `json:"spec"`
	Status            DaemonAgentStatus `json:"status,omitempty"`
}

DaemonAgent defines a long-lived autonomous agent process — outbound-only, stays alive. NOT a server — does not accept incoming requests. Health is determined by process liveness. Single-instance by definition.

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=da +kubebuilder:printcolumn:name="Image",type=string,JSONPath=`.spec.template.spec.image` +kubebuilder:printcolumn:name="Pool",type=string,JSONPath=`.spec.workerPoolRef` +kubebuilder:printcolumn:name="Latest Ready",type=string,JSONPath=`.status.latestReadyRevisionName` +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase` +kubebuilder:printcolumn:name="Restarts",type=integer,JSONPath=`.status.restartCount` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*DaemonAgent) ConvertToTable 

func (da *DaemonAgent) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements resourcestrategy.TableConverter.

func (*DaemonAgent) DeepCopy 

func (in *DaemonAgent) DeepCopy() *DaemonAgent

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DaemonAgent.

func (*DaemonAgent) DeepCopyInto 

func (in *DaemonAgent) DeepCopyInto(out *DaemonAgent)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*DaemonAgent) DeepCopyObject 

func (in *DaemonAgent) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*DaemonAgent) Default 

func (r *DaemonAgent) Default()

Default sets spec.restartPolicy to Always when unset, matching the decideRestart consumer which already treats "" as Always.

func (*DaemonAgent) GetGroupVersionResource 

func (r *DaemonAgent) GetGroupVersionResource() schema.GroupVersionResource

func (*DaemonAgent) GetObjectMeta 

func (r *DaemonAgent) GetObjectMeta() *metav1.ObjectMeta

func (*DaemonAgent) GetSingularName 

func (r *DaemonAgent) GetSingularName() string

func (*DaemonAgent) GetStatus 

func (r *DaemonAgent) GetStatus() resource.StatusSubResource

func (*DaemonAgent) IsStorageVersion 

func (r *DaemonAgent) IsStorageVersion() bool

func (*DaemonAgent) NamespaceScoped 

func (r *DaemonAgent) NamespaceScoped() bool

func (*DaemonAgent) New 

func (r *DaemonAgent) New() runtime.Object

func (*DaemonAgent) NewList 

func (r *DaemonAgent) NewList() runtime.Object

func (*DaemonAgent) Validate 

func (da *DaemonAgent) Validate(_ context.Context) field.ErrorList

func (*DaemonAgent) ValidateUpdate 

func (da *DaemonAgent) ValidateUpdate(ctx context.Context, _ runtime.Object) field.ErrorList

type DaemonAgentList 

type DaemonAgentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DaemonAgent `json:"items"`
}

DaemonAgentList contains a list of DaemonAgent resources.

func (*DaemonAgentList) ConvertToTable 

func (l *DaemonAgentList) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements resourcestrategy.TableConverter for list responses.

func (*DaemonAgentList) DeepCopy 

func (in *DaemonAgentList) DeepCopy() *DaemonAgentList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DaemonAgentList.

func (*DaemonAgentList) DeepCopyInto 

func (in *DaemonAgentList) DeepCopyInto(out *DaemonAgentList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*DaemonAgentList) DeepCopyObject 

func (in *DaemonAgentList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type DaemonAgentSpec 

type DaemonAgentSpec struct {
	// Template defines the sandbox revision template. Changes to this
	// field trigger creation of a new AgentSandboxRevision.
	Template AgentSandboxRevisionTemplate `json:"template"`

	// WorkerPoolRef references a WorkerPool resource by name in the same namespace.
	WorkerPoolRef string `json:"workerPoolRef"`

	// Resources defines per-execution CPU/memory limits.
	// +optional
	Resources ExecutionResources `json:"resources,omitempty"`

	// RestartPolicy controls what happens when the process exits.
	// +kubebuilder:default=Always
	// +optional
	RestartPolicy RestartPolicy `json:"restartPolicy,omitempty"`

	// MaxRestarts caps total restart attempts. 0 = unlimited.
	// +optional
	MaxRestarts *int32 `json:"maxRestarts,omitempty"`

	// MaxLifetimeSeconds caps how long the daemon can run before
	// being terminated and optionally restarted. 0 = forever.
	// +optional
	MaxLifetimeSeconds *int32 `json:"maxLifetimeSeconds,omitempty"`

	// EgressRefs references EgressGateway objects for outbound access.
	// Token budgets are configured on AIProviderRoute, not here.
	// +optional
	EgressRefs []AgentEgressRef `json:"egressRefs,omitempty"`
}

func (*DaemonAgentSpec) DeepCopy 

func (in *DaemonAgentSpec) DeepCopy() *DaemonAgentSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DaemonAgentSpec.

func (*DaemonAgentSpec) DeepCopyInto 

func (in *DaemonAgentSpec) DeepCopyInto(out *DaemonAgentSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type DaemonAgentStatus 

type DaemonAgentStatus struct {
	// Conditions represent the latest available observations of the DaemonAgent's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// Phase is the observed lifecycle phase.
	// +optional
	Phase DaemonPhase `json:"phase,omitempty"`
	// UpSince is when the current daemon instance started.
	// +optional
	UpSince *metav1.Time `json:"upSince,omitempty"`
	// RestartCount is the number of times the daemon has been restarted.
	// +optional
	RestartCount int32 `json:"restartCount,omitempty"`
	// LatestCreatedRevisionName is the name of the last created AgentSandboxRevision.
	// +optional
	LatestCreatedRevisionName string `json:"latestCreatedRevisionName,omitempty"`
	// LatestReadyRevisionName is the name of the last revision that became ready.
	// +optional
	LatestReadyRevisionName string `json:"latestReadyRevisionName,omitempty"`
	// ObservedGeneration is the generation most recently observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

func (*DaemonAgentStatus) CopyTo 

func (s *DaemonAgentStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*DaemonAgentStatus) DeepCopy 

func (in *DaemonAgentStatus) DeepCopy() *DaemonAgentStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DaemonAgentStatus.

func (*DaemonAgentStatus) DeepCopyInto 

func (in *DaemonAgentStatus) DeepCopyInto(out *DaemonAgentStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*DaemonAgentStatus) SubResourceName 

func (s *DaemonAgentStatus) SubResourceName() string

type DaemonPhase 

type DaemonPhase string

DaemonPhase describes the observed lifecycle phase of a DaemonAgent. 

const (
	DaemonPhaseRunning          DaemonPhase = "Running"
	DaemonPhaseStopped          DaemonPhase = "Stopped"
	DaemonPhaseCrashLoopBackOff DaemonPhase = "CrashLoopBackOff"
)

type DenyResponseConfig 

type DenyResponseConfig struct {
	// +kubebuilder:default=403
	StatusCode int32   `json:"statusCode,omitempty"`
	Message    *string `json:"message,omitempty"`
}

DenyResponseConfig configures the rejection returned to the caller.

func (*DenyResponseConfig) DeepCopy 

func (in *DenyResponseConfig) DeepCopy() *DenyResponseConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DenyResponseConfig.

func (*DenyResponseConfig) DeepCopyInto 

func (in *DenyResponseConfig) DeepCopyInto(out *DenyResponseConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressDNSLookupFamily 

type EgressDNSLookupFamily string

EgressDNSLookupFamily selects which IP families the EG-managed Envoy's dynamic_forward_proxy DNS cache considers when resolving upstream hostnames.

V4Preferred is the clrk default because the most common clrk deployment environments (containerized dev clusters running in Docker, plain Linux VMs without an IPv6 transit) expose an IPv6 default route on the pod network but have no path to globally-routable v6 destinations. With Envoy's stock Auto behavior the EG sends every upstream SYN to the AAAA answer first and waits the full connect timeout for it to fail before retrying on A — blowing the agent's request budget. V4Preferred flips the order so the working family is tried first.

+kubebuilder:validation:Enum=V4Preferred;V4Only;V6Only;Auto;All 

const (
	// EgressDNSLookupV4Preferred resolves both A and AAAA; the connect
	// tries A first and falls back to AAAA only if no A record exists.
	// The clrk default.
	EgressDNSLookupV4Preferred EgressDNSLookupFamily = "V4Preferred"

	// EgressDNSLookupV4Only resolves only A records. AAAA-only hostnames
	// fail to resolve.
	EgressDNSLookupV4Only EgressDNSLookupFamily = "V4Only"

	// EgressDNSLookupV6Only resolves only AAAA records. A-only hostnames
	// fail to resolve.
	EgressDNSLookupV6Only EgressDNSLookupFamily = "V6Only"

	// EgressDNSLookupAuto returns AAAA when any AAAA record exists,
	// otherwise A. This is Envoy's stock default and prefers v6 even when
	// the v6 path is broken — appropriate only when the operator has
	// verified end-to-end IPv6 transit on this gateway.
	EgressDNSLookupAuto EgressDNSLookupFamily = "Auto"

	// EgressDNSLookupAll resolves both A and AAAA and load-balances
	// across the union. Useful when the operator wants Happy Eyeballs-
	// style v4/v6 racing rather than a strict preference order.
	EgressDNSLookupAll EgressDNSLookupFamily = "All"
)

type EgressDNSSpec 

type EgressDNSSpec struct {
	// LookupFamily selects which IP families the resolver considers when
	// resolving upstream hostnames. Defaults to V4Preferred.
	// +kubebuilder:default=V4Preferred
	// +optional
	LookupFamily EgressDNSLookupFamily `json:"lookupFamily,omitempty"`
}

EgressDNSSpec configures the EG-managed Envoy's upstream DNS behavior for the dynamic_forward_proxy resolver shared by every shape that re-resolves upstream by hostname (tls-terminate, https, http, tls-passthrough). Does not affect the tcp shape, which routes by destination IP via ORIGINAL_DST and never consults DNS.

func (*EgressDNSSpec) DeepCopy 

func (in *EgressDNSSpec) DeepCopy() *EgressDNSSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressDNSSpec.

func (*EgressDNSSpec) DeepCopyInto 

func (in *EgressDNSSpec) DeepCopyInto(out *EgressDNSSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressDenyPolicy 

type EgressDenyPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              EgressDenyPolicySpec   `json:"spec"`
	Status            EgressDenyPolicyStatus `json:"status,omitempty"`
}

EgressDenyPolicy attaches to routes via targetRefs to invert them from "allow" to "deny".

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:resource:shortName=edp +kubebuilder:subresource:status +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*EgressDenyPolicy) DeepCopy 

func (in *EgressDenyPolicy) DeepCopy() *EgressDenyPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressDenyPolicy.

func (*EgressDenyPolicy) DeepCopyInto 

func (in *EgressDenyPolicy) DeepCopyInto(out *EgressDenyPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressDenyPolicy) DeepCopyObject 

func (in *EgressDenyPolicy) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*EgressDenyPolicy) Default 

func (r *EgressDenyPolicy) Default()

Default sets the deny response status to 403 when a denyResponse block is present without an explicit code. It does not allocate an absent denyResponse.

func (*EgressDenyPolicy) GetGroupVersionResource 

func (r *EgressDenyPolicy) GetGroupVersionResource() schema.GroupVersionResource

func (*EgressDenyPolicy) GetObjectMeta 

func (r *EgressDenyPolicy) GetObjectMeta() *metav1.ObjectMeta

func (*EgressDenyPolicy) GetSingularName 

func (r *EgressDenyPolicy) GetSingularName() string

func (*EgressDenyPolicy) GetStatus 

func (r *EgressDenyPolicy) GetStatus() resource.StatusSubResource

func (*EgressDenyPolicy) IsStorageVersion 

func (r *EgressDenyPolicy) IsStorageVersion() bool

func (*EgressDenyPolicy) NamespaceScoped 

func (r *EgressDenyPolicy) NamespaceScoped() bool

func (*EgressDenyPolicy) New 

func (r *EgressDenyPolicy) New() runtime.Object

func (*EgressDenyPolicy) NewList 

func (r *EgressDenyPolicy) NewList() runtime.Object

func (*EgressDenyPolicy) Validate 

func (p *EgressDenyPolicy) Validate(_ context.Context) field.ErrorList

func (*EgressDenyPolicy) ValidateUpdate 

func (p *EgressDenyPolicy) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type EgressDenyPolicyList 

type EgressDenyPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []EgressDenyPolicy `json:"items"`
}

EgressDenyPolicyList contains a list of EgressDenyPolicy resources.

func (*EgressDenyPolicyList) DeepCopy 

func (in *EgressDenyPolicyList) DeepCopy() *EgressDenyPolicyList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressDenyPolicyList.

func (*EgressDenyPolicyList) DeepCopyInto 

func (in *EgressDenyPolicyList) DeepCopyInto(out *EgressDenyPolicyList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressDenyPolicyList) DeepCopyObject 

func (in *EgressDenyPolicyList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type EgressDenyPolicySpec 

type EgressDenyPolicySpec struct {
	// TargetRefs identifies the routes this policy attaches to. Plural
	// (GEP-2648 Direct Policy Attachment) so one policy can deny several
	// routes; LocalPolicyTargetReferenceWithSectionName is same-namespace
	// by construction and section-scopable (an empty sectionName denies
	// the whole route).
	TargetRefs []gwapiv1a2.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`

	// DenyResponse configures the rejection returned to the caller.
	// +optional
	DenyResponse *DenyResponseConfig `json:"denyResponse,omitempty"`
}

EgressDenyPolicySpec defines the desired state of an EgressDenyPolicy.

func (*EgressDenyPolicySpec) DeepCopy 

func (in *EgressDenyPolicySpec) DeepCopy() *EgressDenyPolicySpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressDenyPolicySpec.

func (*EgressDenyPolicySpec) DeepCopyInto 

func (in *EgressDenyPolicySpec) DeepCopyInto(out *EgressDenyPolicySpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressDenyPolicyStatus 

type EgressDenyPolicyStatus struct {
	gwapiv1a2.PolicyStatus `json:",inline"`
}

EgressDenyPolicyStatus reports attachment acceptance for an EgressDenyPolicy via the GEP-2649 PolicyStatus shape shared by every clrk policy.

func (*EgressDenyPolicyStatus) CopyTo 

func (s *EgressDenyPolicyStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*EgressDenyPolicyStatus) DeepCopy 

func (in *EgressDenyPolicyStatus) DeepCopy() *EgressDenyPolicyStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressDenyPolicyStatus.

func (*EgressDenyPolicyStatus) DeepCopyInto 

func (in *EgressDenyPolicyStatus) DeepCopyInto(out *EgressDenyPolicyStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressDenyPolicyStatus) SubResourceName 

func (s *EgressDenyPolicyStatus) SubResourceName() string

type EgressGateway 

type EgressGateway struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              EgressGatewaySpec   `json:"spec"`
	Status            EgressGatewayStatus `json:"status,omitempty"`
}

EgressGateway defines a transparent egress proxy that intercepts outbound traffic from agent sandboxes.

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=egw +kubebuilder:printcolumn:name="Policy",type=string,JSONPath=`.spec.defaultPolicy` +kubebuilder:printcolumn:name="Listeners",type=integer,JSONPath=`.status.listenerCount` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*EgressGateway) DeepCopy 

func (in *EgressGateway) DeepCopy() *EgressGateway

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGateway.

func (*EgressGateway) DeepCopyInto 

func (in *EgressGateway) DeepCopyInto(out *EgressGateway)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressGateway) DeepCopyObject 

func (in *EgressGateway) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*EgressGateway) Default 

func (r *EgressGateway) Default()

Default fills the EgressGateway's documented defaults. The defaultPolicy default is security-load-bearing: an empty defaultPolicy previously routed unmatched traffic as allow-all (fail open) in internal/egress; stamping deny-all makes the gateway fail closed, matching the marker.

func (*EgressGateway) GetGroupVersionResource 

func (r *EgressGateway) GetGroupVersionResource() schema.GroupVersionResource

func (*EgressGateway) GetObjectMeta 

func (r *EgressGateway) GetObjectMeta() *metav1.ObjectMeta

func (*EgressGateway) GetSingularName 

func (r *EgressGateway) GetSingularName() string

func (*EgressGateway) GetStatus 

func (r *EgressGateway) GetStatus() resource.StatusSubResource

func (*EgressGateway) IsStorageVersion 

func (r *EgressGateway) IsStorageVersion() bool

func (*EgressGateway) NamespaceScoped 

func (r *EgressGateway) NamespaceScoped() bool

func (*EgressGateway) New 

func (r *EgressGateway) New() runtime.Object

func (*EgressGateway) NewList 

func (r *EgressGateway) NewList() runtime.Object

type EgressGatewayList 

type EgressGatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []EgressGateway `json:"items"`
}

EgressGatewayList contains a list of EgressGateway resources.

func (*EgressGatewayList) DeepCopy 

func (in *EgressGatewayList) DeepCopy() *EgressGatewayList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayList.

func (*EgressGatewayList) DeepCopyInto 

func (in *EgressGatewayList) DeepCopyInto(out *EgressGatewayList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressGatewayList) DeepCopyObject 

func (in *EgressGatewayList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type EgressGatewaySpec 

type EgressGatewaySpec struct {
	// DefaultPolicy applies to traffic that matches no attached route.
	// +kubebuilder:default=deny-all
	DefaultPolicy EgressPolicy `json:"defaultPolicy"`

	// Listeners declare interception capabilities by protocol layer.
	// Routes attach to a specific listener by name via parentRef.sectionName.
	// +kubebuilder:validation:MinItems=1
	Listeners []EgressListener `json:"listeners"`

	// OTLP configures L7 capture for this EgressGateway. The
	// controller-manager always persists captured request/response
	// pairs to its embedded ClickHouse and additionally re-exports
	// them to OTLP.Endpoint when set. L7 capture is always on for
	// HTTP and MITM-terminated TLS listeners; this field shapes the
	// re-export destination and the body-capture bounds.
	// +optional
	OTLP *OTLPLogsSinkSpec `json:"otlp,omitempty"`

	// UpstreamTLS adjusts how the EG-managed Envoy validates TLS when
	// re-encrypting traffic to upstreams (the egress dial after MITM).
	// +optional
	UpstreamTLS *EgressUpstreamTLSSpec `json:"upstreamTLS,omitempty"`

	// DNS configures the Egress Gateway's DNS resolver.
	// Defaults to LookupFamily=V4Preferred.
	// +optional
	DNS *EgressDNSSpec `json:"dns,omitempty"`

	// RequestTimeout caps the duration of a single outbound request
	// transiting this gateway. Applied to the catch-all HTTPRoute's
	// Request and BackendRequest timeouts. Defaults to 5m when unset —
	// chosen to cover AI-provider streaming completions (Anthropic /
	// OpenAI SSE responses routinely run 30-60s; reasoning models can
	// stream several minutes). Envoy Gateway's bare default of 15s 504's
	// those mid-stream, so a generous clrk-side default keeps the
	// AI-runtime case working out of the box. Operators wanting a
	// tighter cap (e.g. test environments) can override; per-route
	// overrides are not supported today — every flow through this EG
	// shares the cap.
	// +optional
	RequestTimeout *metav1.Duration `json:"requestTimeout,omitempty"`
}

EgressGatewaySpec defines the desired state of an EgressGateway.

func (*EgressGatewaySpec) DeepCopy 

func (in *EgressGatewaySpec) DeepCopy() *EgressGatewaySpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewaySpec.

func (*EgressGatewaySpec) DeepCopyInto 

func (in *EgressGatewaySpec) DeepCopyInto(out *EgressGatewaySpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressGatewaySpec) EffectiveRequestTimeout 

func (s *EgressGatewaySpec) EffectiveRequestTimeout() time.Duration

EffectiveRequestTimeout resolves the gateway's request timeout: operator-supplied positive values win; unset or non-positive falls back to DefaultEgressRequestTimeout. Shared by the controller (which pins it on the catch-all HTTPRoute) and the EG extension server (which stamps it onto the synthesized Envoy routes — EG's translated HTTPRoute timeouts are discarded when the extension replaces the route config, so the extension must re-assert it).

type EgressGatewayStatus 

type EgressGatewayStatus struct {
	Conditions    []metav1.Condition     `json:"conditions,omitempty"`
	Listeners     []EgressListenerStatus `json:"listeners,omitempty"`
	ListenerCount int32                  `json:"listenerCount,omitempty"`
}

EgressGatewayStatus describes the observed state of an EgressGateway.

func (*EgressGatewayStatus) CopyTo 

func (s *EgressGatewayStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*EgressGatewayStatus) DeepCopy 

func (in *EgressGatewayStatus) DeepCopy() *EgressGatewayStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayStatus.

func (*EgressGatewayStatus) DeepCopyInto 

func (in *EgressGatewayStatus) DeepCopyInto(out *EgressGatewayStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressGatewayStatus) SubResourceName 

func (s *EgressGatewayStatus) SubResourceName() string

type EgressL4Route 

type EgressL4Route struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              EgressL4RouteSpec   `json:"spec"`
	Status            EgressL4RouteStatus `json:"status,omitempty"`
}

EgressL4Route provides destination CIDR, port, and protocol matching for raw L4 egress traffic.

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=el4r +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*EgressL4Route) DeepCopy 

func (in *EgressL4Route) DeepCopy() *EgressL4Route

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressL4Route.

func (*EgressL4Route) DeepCopyInto 

func (in *EgressL4Route) DeepCopyInto(out *EgressL4Route)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressL4Route) DeepCopyObject 

func (in *EgressL4Route) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*EgressL4Route) GetGroupVersionResource 

func (r *EgressL4Route) GetGroupVersionResource() schema.GroupVersionResource

func (*EgressL4Route) GetObjectMeta 

func (r *EgressL4Route) GetObjectMeta() *metav1.ObjectMeta

func (*EgressL4Route) GetSingularName 

func (r *EgressL4Route) GetSingularName() string

func (*EgressL4Route) GetStatus 

func (r *EgressL4Route) GetStatus() resource.StatusSubResource

func (*EgressL4Route) IsStorageVersion 

func (r *EgressL4Route) IsStorageVersion() bool

func (*EgressL4Route) NamespaceScoped 

func (r *EgressL4Route) NamespaceScoped() bool

func (*EgressL4Route) New 

func (r *EgressL4Route) New() runtime.Object

func (*EgressL4Route) NewList 

func (r *EgressL4Route) NewList() runtime.Object

func (*EgressL4Route) Validate 

func (r *EgressL4Route) Validate(_ context.Context) field.ErrorList

func (*EgressL4Route) ValidateUpdate 

func (r *EgressL4Route) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type EgressL4RouteList 

type EgressL4RouteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []EgressL4Route `json:"items"`
}

EgressL4RouteList contains a list of EgressL4Route resources.

func (*EgressL4RouteList) DeepCopy 

func (in *EgressL4RouteList) DeepCopy() *EgressL4RouteList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressL4RouteList.

func (*EgressL4RouteList) DeepCopyInto 

func (in *EgressL4RouteList) DeepCopyInto(out *EgressL4RouteList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressL4RouteList) DeepCopyObject 

func (in *EgressL4RouteList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type EgressL4RouteRule 

type EgressL4RouteRule struct {
	Matches []L4RouteMatch `json:"matches,omitempty"`

	// Filters — ExtensionRef to LoggingPolicy, RateLimitPolicy, etc.
	// +optional
	Filters []L4RouteFilter `json:"filters,omitempty"`

	// BackendRefs optionally routes through an explicit proxy.
	// Empty = passthrough to original destination.
	// +optional
	BackendRefs []gwapiv1.BackendRef `json:"backendRefs,omitempty"`
}

EgressL4RouteRule defines a rule within an EgressL4Route.

func (*EgressL4RouteRule) DeepCopy 

func (in *EgressL4RouteRule) DeepCopy() *EgressL4RouteRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressL4RouteRule.

func (*EgressL4RouteRule) DeepCopyInto 

func (in *EgressL4RouteRule) DeepCopyInto(out *EgressL4RouteRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressL4RouteSpec 

type EgressL4RouteSpec struct {
	// ParentRefs attaches to EgressGateway TCP or UDP listeners.
	ParentRefs []gwapiv1.ParentReference `json:"parentRefs"`

	Rules []EgressL4RouteRule `json:"rules"`
}

EgressL4RouteSpec defines the desired state of an EgressL4Route.

func (*EgressL4RouteSpec) DeepCopy 

func (in *EgressL4RouteSpec) DeepCopy() *EgressL4RouteSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressL4RouteSpec.

func (*EgressL4RouteSpec) DeepCopyInto 

func (in *EgressL4RouteSpec) DeepCopyInto(out *EgressL4RouteSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressL4RouteStatus 

type EgressL4RouteStatus struct {
	Parents []gwapiv1.RouteParentStatus `json:"parents,omitempty"`
}

EgressL4RouteStatus describes the observed state of an EgressL4Route.

func (*EgressL4RouteStatus) CopyTo 

func (s *EgressL4RouteStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*EgressL4RouteStatus) DeepCopy 

func (in *EgressL4RouteStatus) DeepCopy() *EgressL4RouteStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressL4RouteStatus.

func (*EgressL4RouteStatus) DeepCopyInto 

func (in *EgressL4RouteStatus) DeepCopyInto(out *EgressL4RouteStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*EgressL4RouteStatus) SubResourceName 

func (s *EgressL4RouteStatus) SubResourceName() string

type EgressListener 

type EgressListener struct {
	// Name identifies this listener. Routes reference it via
	// parentRef.sectionName (standard GW API field).
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name"`

	// Protocol selects the interception layer.
	Protocol EgressListenerProtocol `json:"protocol"`

	// Port constrains interception to a single destination port.
	// If unset, all ports are intercepted at this protocol layer.
	// +optional
	Port *int32 `json:"port,omitempty"`

	// TLS configures TLS handling. Required when protocol=TLS,
	// optional for HTTP (enables HTTPS MITM). Invalid for TCP/UDP.
	// +optional
	TLS *EgressListenerTLS `json:"tls,omitempty"`

	// AllowedRoutes constrains which route kinds and namespaces may
	// attach. Reuses the standard GW API AllowedRoutes type.
	// +optional
	AllowedRoutes *gwapiv1.AllowedRoutes `json:"allowedRoutes,omitempty"`
}

EgressListener declares an interception capability by protocol layer.

func (*EgressListener) DeepCopy 

func (in *EgressListener) DeepCopy() *EgressListener

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressListener.

func (*EgressListener) DeepCopyInto 

func (in *EgressListener) DeepCopyInto(out *EgressListener)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressListenerProtocol 

type EgressListenerProtocol string

EgressListenerProtocol selects the interception layer. +kubebuilder:validation:Enum=TCP;TLS;HTTP;HTTPS;UDP 

const (
	EgressProtocolTCP   EgressListenerProtocol = "TCP"
	EgressProtocolTLS   EgressListenerProtocol = "TLS"
	EgressProtocolHTTP  EgressListenerProtocol = "HTTP"
	EgressProtocolHTTPS EgressListenerProtocol = "HTTPS"
	EgressProtocolUDP   EgressListenerProtocol = "UDP"
)

type EgressListenerShape 

type EgressListenerShape string

EgressListenerShape encodes how the egextension server should rewrite each Envoy listener generated for an EgressListener entry. The shape travels from the controller to the extension via the Gateway listener name (the only stable channel — the extension does not read the EgressGateway CR), as a "<egListenerName>--<shape>" suffix. 

const (
	EgressShapeHTTP           EgressListenerShape = "http"
	EgressShapeHTTPS          EgressListenerShape = "https"
	EgressShapeTLSTerminate   EgressListenerShape = "tls-terminate"
	EgressShapeTLSPassthrough EgressListenerShape = "tls-passthrough"
	EgressShapeTCP            EgressListenerShape = "tcp"
)

func ParseListenerSectionName 

func ParseListenerSectionName(section string) (string, EgressListenerShape, bool)

ParseListenerSectionName splits a section name produced by EncodeListenerSectionName back into (egListenerName, shape). Returns ok=false when the suffix is missing or unrecognized.

func ShapeForListener 

func ShapeForListener(l EgressListener) (EgressListenerShape, error)

ShapeForListener resolves a CRD EgressListener to its on-the-wire shape. Returns ("", error) for unsupported combinations — callers surface the error on Status.Conditions[Ready] and skip Gateway materialization.

type EgressListenerStatus 

type EgressListenerStatus struct {
	Name string `json:"name"`

	// Port is the TCP port the EG-managed Envoy listens on for this
	// EgressListener. Workers dial Address:Port for connections that
	// match this listener's protocol/port selectors. Distinct
	// listener types (TLS-terminate, plain TCP, etc.) each get their
	// own port — protocols can't share a listener.
	// +optional
	Port int32 `json:"port,omitempty"`

	// BackendAddress is the host:port workers dial to reach this
	// listener's filter chain. In-cluster it's the EG Service's
	// cluster DNS name; in `clrk dev` it's a NodePort on the k3s
	// container hostname.
	// +optional
	BackendAddress string `json:"backendAddress,omitempty"`

	AttachedRoutes int32              `json:"attachedRoutes"`
	Conditions     []metav1.Condition `json:"conditions,omitempty"`
}

EgressListenerStatus describes the status of a single listener.

func (*EgressListenerStatus) DeepCopy 

func (in *EgressListenerStatus) DeepCopy() *EgressListenerStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressListenerStatus.

func (*EgressListenerStatus) DeepCopyInto 

func (in *EgressListenerStatus) DeepCopyInto(out *EgressListenerStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressListenerTLS 

type EgressListenerTLS struct {
	// Mode controls TLS handling.
	//   Passthrough: SNI-route only, no termination.
	//   Terminate:   MITM decrypt for L7 inspection, re-encrypt to upstream.
	// +kubebuilder:default=Passthrough
	Mode EgressTLSMode `json:"mode"`

	// CACertRef references a Secret with the CA cert+key for on-the-fly
	// cert generation. Required when mode=Terminate.
	// +optional
	CACertRef *gwapiv1.SecretObjectReference `json:"caCertRef,omitempty"`
}

EgressListenerTLS configures TLS handling for a listener.

func (*EgressListenerTLS) DeepCopy 

func (in *EgressListenerTLS) DeepCopy() *EgressListenerTLS

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressListenerTLS.

func (*EgressListenerTLS) DeepCopyInto 

func (in *EgressListenerTLS) DeepCopyInto(out *EgressListenerTLS)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type EgressPolicy 

type EgressPolicy string

EgressPolicy controls the default action for traffic matching no route. +kubebuilder:validation:Enum=allow-all;deny-all 

const (
	EgressPolicyAllowAll EgressPolicy = "allow-all"
	EgressPolicyDenyAll  EgressPolicy = "deny-all"
)

type EgressTLSMode 

type EgressTLSMode string

EgressTLSMode controls TLS handling on a listener. +kubebuilder:validation:Enum=Passthrough;Terminate 

const (
	EgressTLSPassthrough EgressTLSMode = "Passthrough"
	EgressTLSTerminate   EgressTLSMode = "Terminate"
)

type EgressUpstreamTLSSpec 

type EgressUpstreamTLSSpec struct {
	// AdditionalTrustBundleSecretRef references a Secret carrying one
	// or more CA certificates (PEM, under any data key) that Envoy
	// should trust in addition to the system bundle. Used for private
	// upstreams whose certs aren't anchored in a public CA.
	//
	// All non-empty values in the Secret's `data` map are concatenated
	// and appended to the system bundle inside the Envoy pod via an
	// init container; the main Envoy container reads the merged bundle
	// from the same well-known path it always has.
	// +optional
	AdditionalTrustBundleSecretRef *gwapiv1.SecretObjectReference `json:"additionalTrustBundleSecretRef,omitempty"`

	// HostAliases programs the EG-managed Envoy Pod's
	// spec.hostAliases. Each entry maps an IP to one or more hostnames;
	// the kubelet writes them into the pod's /etc/hosts ahead of the
	// cluster DNS lookup chain. Use this to point Envoy's
	// dynamic_forward_proxy resolver at a specific IP for a given
	// upstream hostname, e.g. an in-cluster stub pretending to be
	// api.openai.com without globally hijacking the cluster's CoreDNS.
	// +optional
	HostAliases []corev1.HostAlias `json:"hostAliases,omitempty"`
}

EgressUpstreamTLSSpec configures the EG-managed Envoy's upstream connection behavior. The default trust source is the system bundle at /etc/ssl/certs/ca-certificates.crt baked into the Envoy image and the default DNS resolver is the cluster DNS — this spec lets operators override either when reaching upstreams that aren't on the public Internet (internal services, integration-test stubs).

func (*EgressUpstreamTLSSpec) DeepCopy 

func (in *EgressUpstreamTLSSpec) DeepCopy() *EgressUpstreamTLSSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressUpstreamTLSSpec.

func (*EgressUpstreamTLSSpec) DeepCopyInto 

func (in *EgressUpstreamTLSSpec) DeepCopyInto(out *EgressUpstreamTLSSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ExecutionResources 

type ExecutionResources struct {
	// CPU limit for a single execution, enforced via cgroup v2
	// cpu.max (CFS quota/period). Applies to the entire sandbox
	// process tree. Default "1".
	// +optional
	CPU resource.Quantity `json:"cpu,omitempty"`
	// Memory limit for a single execution, enforced via cgroup v2
	// memory.max on the entire sandbox process tree. Budget ~32MB on
	// top of the guest's working set for Sentry+gofer baseline
	// overhead; guest pages mirrored into the Sentry's address space
	// count against this limit too. Swap is pinned to zero so the
	// OOM killer fires deterministically at memory.max. Default
	// "512Mi".
	// +optional
	Memory resource.Quantity `json:"memory,omitempty"`
	// EphemeralStorage limit for a single execution. Currently
	// advisory only — /tmp tmpfs sizing is controlled statically by
	// the worker's OCI spec and per-sandbox cgroup enforcement is
	// not yet wired through for this field.
	// +optional
	EphemeralStorage *resource.Quantity `json:"ephemeralStorage,omitempty"`
}

ExecutionResources defines per-execution CPU/memory limits enforced by the worker runtime via cgroup v2 controllers on a per-sandbox cgroup (<worker>/system/<id>) that contains the full sandbox process tree (Sentry + gofer + guest).

func (*ExecutionResources) DeepCopy 

func (in *ExecutionResources) DeepCopy() *ExecutionResources

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExecutionResources.

func (*ExecutionResources) DeepCopyInto 

func (in *ExecutionResources) DeepCopyInto(out *ExecutionResources)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type FallbackEjection 

type FallbackEjection struct {
	// MaxEjectionTime caps how long a failing backend stays ejected.
	// Ejection durations grow linearly with the backend's ejection
	// count (30s, 60s, 90s, ...) and the count never decays, so without
	// a cap a backend that flapped for a while keeps serving 5-minute
	// (Envoy's default cap) blackout windows even after it recovers —
	// there is no active probing, the expiry of this timer is what puts
	// the backend back in rotation. Values below the 30s base ejection
	// time also lower the base, so the very first ejection honors the
	// cap too. Defaults to Envoy's 300s.
	// +optional
	MaxEjectionTime *metav1.Duration `json:"maxEjectionTime,omitempty"`
}

FallbackEjection tunes passive outlier ejection on the synthesized per-rule cluster: a backend that fails repeatedly (consecutive 5xx or connection failures) is ejected from load balancing for a cooldown, so a dead primary stops eating the first attempt of every request.

func (*FallbackEjection) DeepCopy 

func (in *FallbackEjection) DeepCopy() *FallbackEjection

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FallbackEjection.

func (*FallbackEjection) DeepCopyInto 

func (in *FallbackEjection) DeepCopyInto(out *FallbackEjection)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type FallbackRetry 

type FallbackRetry struct {
	// NumRetries caps the number of retry attempts after the first.
	// Defaults to one fewer than the rule's viable backend count,
	// capped at 5.
	// +optional
	NumRetries *int32 `json:"numRetries,omitempty"`

	// RetriableStatusCodes lists upstream HTTP status codes that
	// trigger a retry, in addition to connection failures and stream
	// resets (always retried). Defaults to [429, 503].
	// +optional
	RetriableStatusCodes []int32 `json:"retriableStatusCodes,omitempty"`

	// PerTryTimeout bounds each individual attempt. Unset means no
	// per-attempt bound — streaming LLM responses routinely outlive any
	// reasonable fixed timeout, and a retry can only fire before
	// response headers arrive, so leaving this unset never strands a
	// stream.
	// +optional
	PerTryTimeout *metav1.Duration `json:"perTryTimeout,omitempty"`
}

FallbackRetry tunes the per-attempt retry behavior of a FallbackRoutingPolicy. All fields are optional; nil fields take the defaults documented per field.

func (*FallbackRetry) DeepCopy 

func (in *FallbackRetry) DeepCopy() *FallbackRetry

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FallbackRetry.

func (*FallbackRetry) DeepCopyInto 

func (in *FallbackRetry) DeepCopyInto(out *FallbackRetry)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type FallbackRoutingPolicy 

type FallbackRoutingPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              FallbackRoutingPolicySpec   `json:"spec"`
	Status            FallbackRoutingPolicyStatus `json:"status,omitempty"`
}

FallbackRoutingPolicy opts AIProviderRoutes into ordered inter-backend fallback: a request whose attempt fails (connect failure, reset, or a retriable status) is retried against the next backend in the rule's BackendRefs list, with per-attempt schema translation and credential injection. It is the first of the routing-policy family; siblings with other selection strategies (cost- or latency-based) can follow the same attachment pattern.

Fallback only applies before the upstream response starts: once response headers are forwarded to the agent there are no further attempts (a mid-stream provider failure surfaces through the translation error-frame convention instead).

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:resource:shortName=frp +kubebuilder:subresource:status +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*FallbackRoutingPolicy) DeepCopy 

func (in *FallbackRoutingPolicy) DeepCopy() *FallbackRoutingPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FallbackRoutingPolicy.

func (*FallbackRoutingPolicy) DeepCopyInto 

func (in *FallbackRoutingPolicy) DeepCopyInto(out *FallbackRoutingPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*FallbackRoutingPolicy) DeepCopyObject 

func (in *FallbackRoutingPolicy) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*FallbackRoutingPolicy) GetGroupVersionResource 

func (r *FallbackRoutingPolicy) GetGroupVersionResource() schema.GroupVersionResource

func (*FallbackRoutingPolicy) GetObjectMeta 

func (r *FallbackRoutingPolicy) GetObjectMeta() *metav1.ObjectMeta

func (*FallbackRoutingPolicy) GetSingularName 

func (r *FallbackRoutingPolicy) GetSingularName() string

func (*FallbackRoutingPolicy) GetStatus 

func (r *FallbackRoutingPolicy) GetStatus() resource.StatusSubResource

func (*FallbackRoutingPolicy) IsStorageVersion 

func (r *FallbackRoutingPolicy) IsStorageVersion() bool

func (*FallbackRoutingPolicy) NamespaceScoped 

func (r *FallbackRoutingPolicy) NamespaceScoped() bool

func (*FallbackRoutingPolicy) New 

func (r *FallbackRoutingPolicy) New() runtime.Object

func (*FallbackRoutingPolicy) NewList 

func (r *FallbackRoutingPolicy) NewList() runtime.Object

func (*FallbackRoutingPolicy) Validate 

func (p *FallbackRoutingPolicy) Validate(_ context.Context) field.ErrorList

func (*FallbackRoutingPolicy) ValidateUpdate 

func (p *FallbackRoutingPolicy) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type FallbackRoutingPolicyList 

type FallbackRoutingPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []FallbackRoutingPolicy `json:"items"`
}

FallbackRoutingPolicyList contains a list of FallbackRoutingPolicy resources.

func (*FallbackRoutingPolicyList) DeepCopy 

func (in *FallbackRoutingPolicyList) DeepCopy() *FallbackRoutingPolicyList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FallbackRoutingPolicyList.

func (*FallbackRoutingPolicyList) DeepCopyInto 

func (in *FallbackRoutingPolicyList) DeepCopyInto(out *FallbackRoutingPolicyList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*FallbackRoutingPolicyList) DeepCopyObject 

func (in *FallbackRoutingPolicyList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type FallbackRoutingPolicySpec 

type FallbackRoutingPolicySpec struct {
	// TargetRefs attaches this policy DOWN onto AIProviderRoutes (GEP-2648
	// Direct Policy Attachment, same-namespace by construction).
	// Attachment changes how the referenced routes' rules distribute
	// traffic across their BackendRefs: without a policy, BackendRef.Weight
	// splits traffic and each request gets a single attempt; with one,
	// BackendRefs list ORDER becomes the fallback priority — the first
	// viable backend serves all traffic while healthy, and a failed
	// attempt retries against the next, walking the list in order
	// (weights are ignored). Whole-route attachment only: AIProviderRoute
	// rules are unnamed, so a sectionName has no section to bind to and is
	// rejected at admission until per-rule scoping is designed.
	TargetRefs []gwapiv1a2.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`

	// Retry tunes the retry behavior. Nil applies the per-field
	// defaults documented on FallbackRetry.
	// +optional
	Retry *FallbackRetry `json:"retry,omitempty"`

	// Ejection tunes passive outlier ejection of failing backends. Nil
	// applies the per-field defaults documented on FallbackEjection.
	// +optional
	Ejection *FallbackEjection `json:"ejection,omitempty"`
}

FallbackRoutingPolicySpec defines the desired state of a FallbackRoutingPolicy.

func (*FallbackRoutingPolicySpec) DeepCopy 

func (in *FallbackRoutingPolicySpec) DeepCopy() *FallbackRoutingPolicySpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FallbackRoutingPolicySpec.

func (*FallbackRoutingPolicySpec) DeepCopyInto 

func (in *FallbackRoutingPolicySpec) DeepCopyInto(out *FallbackRoutingPolicySpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type FallbackRoutingPolicyStatus 

type FallbackRoutingPolicyStatus struct {
	gwapiv1a2.PolicyStatus `json:",inline"`
}

FallbackRoutingPolicyStatus reports attachment acceptance for a FallbackRoutingPolicy via the GEP-2649 PolicyStatus shape shared by every clrk policy.

func (*FallbackRoutingPolicyStatus) CopyTo 

func (s *FallbackRoutingPolicyStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*FallbackRoutingPolicyStatus) DeepCopy 

func (in *FallbackRoutingPolicyStatus) DeepCopy() *FallbackRoutingPolicyStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FallbackRoutingPolicyStatus.

func (*FallbackRoutingPolicyStatus) DeepCopyInto 

func (in *FallbackRoutingPolicyStatus) DeepCopyInto(out *FallbackRoutingPolicyStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*FallbackRoutingPolicyStatus) SubResourceName 

func (s *FallbackRoutingPolicyStatus) SubResourceName() string

type HeaderExtractor 

type HeaderExtractor struct {
	// Name is the HTTP header name.
	Name string `json:"name"`
	// Field is the identity field to populate.
	Field string `json:"field"`
}

HeaderExtractor extracts a value from an HTTP header.

func (*HeaderExtractor) DeepCopy 

func (in *HeaderExtractor) DeepCopy() *HeaderExtractor

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderExtractor.

func (*HeaderExtractor) DeepCopyInto 

func (in *HeaderExtractor) DeepCopyInto(out *HeaderExtractor)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IdentityExtractor 

type IdentityExtractor struct {
	// Type selects the extraction method.
	Type IdentityExtractorType `json:"type"`
	// Header extracts identity from an HTTP header.
	// +optional
	Header *HeaderExtractor `json:"header,omitempty"`
	// Body extracts identity from the request body via JSONPath.
	// +optional
	Body *BodyExtractor `json:"body,omitempty"`
	// JWT extracts identity from a JWT claim.
	// +optional
	JWT *JWTExtractor `json:"jwt,omitempty"`
}

IdentityExtractor defines a single identity extraction rule.

func (*IdentityExtractor) DeepCopy 

func (in *IdentityExtractor) DeepCopy() *IdentityExtractor

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IdentityExtractor.

func (*IdentityExtractor) DeepCopyInto 

func (in *IdentityExtractor) DeepCopyInto(out *IdentityExtractor)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IdentityExtractorType 

type IdentityExtractorType string

IdentityExtractorType defines the type of identity extractor. +kubebuilder:validation:Enum=Header;Body;JWT 

const (
	IdentityExtractorTypeHeader IdentityExtractorType = "Header"
	IdentityExtractorTypeBody   IdentityExtractorType = "Body"
	IdentityExtractorTypeJWT    IdentityExtractorType = "JWT"
)

type ImageCacheConfig 

type ImageCacheConfig struct {
	// Enabled controls whether image caching is active.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
}

ImageCacheConfig configures OCI image caching on worker nodes.

func (*ImageCacheConfig) DeepCopy 

func (in *ImageCacheConfig) DeepCopy() *ImageCacheConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageCacheConfig.

func (*ImageCacheConfig) DeepCopyInto 

func (in *ImageCacheConfig) DeepCopyInto(out *ImageCacheConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Invocation 

type Invocation struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              InvocationSpec   `json:"spec"`
	Status            InvocationStatus `json:"status,omitempty"`
}

Invocation is the durable lifecycle record of one request to a TaskAgent or DaemonAgent — the logical unit a customer trigger maps to, tracked from admission through a terminal phase (see InvocationPhase). It is deliberately distinct from an "execution", the act of running the agent in a worker sandbox, and the two are not 1:1: a Rejected invocation never executes, a Pending or Dispatched one has not started yet, and a retried request could execute more than once under a single invocation. The ActiveExecutions counters on TaskAgent, WorkerPool, and AgentSandboxRevision status are derived from this type and count a parent's non-terminal invocations (Pending, Dispatched, Running) — its in-flight executions — not all requests ever made. This Invocation/ActiveExecutions split mirrors AWS Lambda's Invocations vs. ConcurrentExecutions metrics.

Parent identity lives on spec.parentRef; the Create strategy synthesises a matching metadata.ownerReferences entry (controller=true, blockOwnerDeletion=false) so Kubernetes GC nukes Invocations when the parent is deleted. Invocations are system-written and immutable from clients: the stub backend returns 405 on POST; the eventual JetStream-backed storage will accept POST only from the ingress service principal.

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:resource:shortName=inv +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase` +kubebuilder:printcolumn:name="Trigger",type=string,JSONPath=`.spec.trigger.type` +kubebuilder:printcolumn:name="Parent",type=string,JSONPath=`.spec.parentRef.kind` +kubebuilder:printcolumn:name="ParentName",type=string,JSONPath=`.spec.parentRef.name` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*Invocation) DeepCopy 

func (in *Invocation) DeepCopy() *Invocation

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Invocation.

func (*Invocation) DeepCopyInto 

func (in *Invocation) DeepCopyInto(out *Invocation)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Invocation) DeepCopyObject 

func (in *Invocation) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*Invocation) GetGroupVersionResource 

func (r *Invocation) GetGroupVersionResource() schema.GroupVersionResource

func (*Invocation) GetObjectMeta 

func (r *Invocation) GetObjectMeta() *metav1.ObjectMeta

func (*Invocation) GetSingularName 

func (r *Invocation) GetSingularName() string

func (*Invocation) IsStorageVersion 

func (r *Invocation) IsStorageVersion() bool

func (*Invocation) NamespaceScoped 

func (r *Invocation) NamespaceScoped() bool

func (*Invocation) New 

func (r *Invocation) New() runtime.Object

func (*Invocation) NewList 

func (r *Invocation) NewList() runtime.Object

type InvocationIdentity 

type InvocationIdentity struct {
	// +optional
	Audiences []string `json:"audiences,omitempty"`
}

InvocationIdentity is the resolved identity asserted at ingress. Audiences are the validated outputs of the parent's spec.identity extractors. Stays empty until AgentIdentity grows an Audiences field in a follow-up ticket.

func (*InvocationIdentity) DeepCopy 

func (in *InvocationIdentity) DeepCopy() *InvocationIdentity

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InvocationIdentity.

func (*InvocationIdentity) DeepCopyInto 

func (in *InvocationIdentity) DeepCopyInto(out *InvocationIdentity)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type InvocationList 

type InvocationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Invocation `json:"items"`
}

InvocationList contains a list of Invocation resources.

func (*InvocationList) DeepCopy 

func (in *InvocationList) DeepCopy() *InvocationList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InvocationList.

func (*InvocationList) DeepCopyInto 

func (in *InvocationList) DeepCopyInto(out *InvocationList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*InvocationList) DeepCopyObject 

func (in *InvocationList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type InvocationParentKind 

type InvocationParentKind string

InvocationParentKind enumerates the kinds that can own an Invocation. +kubebuilder:validation:Enum=TaskAgent;DaemonAgent 

const (
	InvocationParentTaskAgent   InvocationParentKind = "TaskAgent"
	InvocationParentDaemonAgent InvocationParentKind = "DaemonAgent"
)

type InvocationParentRef 

type InvocationParentRef struct {
	Kind InvocationParentKind `json:"kind"`
	Name string               `json:"name"`
}

InvocationParentRef names the TaskAgent or DaemonAgent this Invocation belongs to. The parent must live in the same namespace as the Invocation. This is the canonical API surface for parent identity; the Create strategy synthesises a matching metadata.ownerReferences entry (controller=true, blockOwnerDeletion=false) so Kubernetes garbage collection cascades parent deletion.

func (*InvocationParentRef) DeepCopy 

func (in *InvocationParentRef) DeepCopy() *InvocationParentRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InvocationParentRef.

func (*InvocationParentRef) DeepCopyInto 

func (in *InvocationParentRef) DeepCopyInto(out *InvocationParentRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type InvocationPhase 

type InvocationPhase string

InvocationPhase enumerates the observable lifecycle states of an Invocation. Transitions are monotonic: Pending -> Dispatched -> Running -> (Succeeded | Failed | Timeout); Rejected is a terminal state from Pending when ingress admission denies the request before any worker assignment. Failed and Timeout are post-dispatch only. +kubebuilder:validation:Enum=Pending;Dispatched;Running;Succeeded;Failed;Timeout;Rejected 

const (
	InvocationPhasePending    InvocationPhase = "Pending"
	InvocationPhaseDispatched InvocationPhase = "Dispatched"
	InvocationPhaseRunning    InvocationPhase = "Running"
	InvocationPhaseSucceeded  InvocationPhase = "Succeeded"
	InvocationPhaseFailed     InvocationPhase = "Failed"
	InvocationPhaseTimeout    InvocationPhase = "Timeout"
	InvocationPhaseRejected   InvocationPhase = "Rejected"
)

type InvocationSpec 

type InvocationSpec struct {
	// ParentRef identifies the TaskAgent or DaemonAgent that owns
	// this Invocation. Required.
	ParentRef InvocationParentRef `json:"parentRef"`

	// Trigger describes how this invocation was initiated.
	Trigger InvocationTrigger `json:"trigger"`

	// Identity is the resolved identity asserted at ingress.
	// +optional
	Identity *InvocationIdentity `json:"identity,omitempty"`
}

InvocationSpec carries the ingress-known descriptors. Set once on Create and immutable thereafter. The canonical invocation ID lives on metadata.name (also mirrored into metadata.uid by the Create strategy); ce-id, metadata.name, metadata.uid, and the JetStream stream key are all the same UUID end-to-end.

func (*InvocationSpec) DeepCopy 

func (in *InvocationSpec) DeepCopy() *InvocationSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InvocationSpec.

func (*InvocationSpec) DeepCopyInto 

func (in *InvocationSpec) DeepCopyInto(out *InvocationSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type InvocationStatus 

type InvocationStatus struct {
	// +optional
	Phase InvocationPhase `json:"phase,omitempty"`
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

InvocationStatus intentionally starts minimal: phase plus Conditions. Lifecycle timestamps, exit code, response size, worker assignment, revision selection, and failure detail are all expressed as Conditions (LastTransitionTime / Reason / Message) until a concrete consumer demonstrates need for a first-class status field. CloudEvent envelope attributes are not duplicated here; recover them from the OTel span the ingress emits, keyed by metadata.name.

func (*InvocationStatus) DeepCopy 

func (in *InvocationStatus) DeepCopy() *InvocationStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InvocationStatus.

func (*InvocationStatus) DeepCopyInto 

func (in *InvocationStatus) DeepCopyInto(out *InvocationStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type InvocationTrigger 

type InvocationTrigger struct {
	Type InvocationTriggerType `json:"type"`
	// +optional
	Source string `json:"source,omitempty"`
}

InvocationTrigger describes the source that initiated this invocation. Source is a free-form descriptor: for HTTP the gateway route name, for Cron the parent's spec.schedule expression, for CLI the operator principal. Empty when unavailable.

func (*InvocationTrigger) DeepCopy 

func (in *InvocationTrigger) DeepCopy() *InvocationTrigger

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InvocationTrigger.

func (*InvocationTrigger) DeepCopyInto 

func (in *InvocationTrigger) DeepCopyInto(out *InvocationTrigger)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type InvocationTriggerType 

type InvocationTriggerType string

InvocationTriggerType selects how an invocation was initiated. +kubebuilder:validation:Enum=HTTP;Cron;CLI 

const (
	InvocationTriggerHTTP InvocationTriggerType = "HTTP"
	InvocationTriggerCron InvocationTriggerType = "Cron"
	InvocationTriggerCLI  InvocationTriggerType = "CLI"
)

func TriggerTypeFromHeaderValue 

func TriggerTypeFromHeaderValue(v string) InvocationTriggerType

TriggerTypeFromHeaderValue maps an X-Clrk-Trigger header value onto the Invocation trigger enum. The match is case-insensitive (the wire value is lowercase: "http" from the ingress HTTPRoute filter, "cron" from the cron invoker, "cli" from the run-task CLI). An unknown or empty value defaults to HTTP, the overwhelmingly common path. Shared by the ingress publisher and the worker dispatcher so the two never drift.

type JWTExtractor 

type JWTExtractor struct {
	// Claim is the JWT claim name.
	Claim string `json:"claim"`
	// Field is the identity field to populate.
	Field string `json:"field"`
}

JWTExtractor extracts a value from a JWT claim.

func (*JWTExtractor) DeepCopy 

func (in *JWTExtractor) DeepCopy() *JWTExtractor

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTExtractor.

func (*JWTExtractor) DeepCopyInto 

func (in *JWTExtractor) DeepCopyInto(out *JWTExtractor)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type L4PortMatch 

type L4PortMatch struct {
	// Port matches a single port.
	// +optional
	Port *int32 `json:"port,omitempty"`

	// StartPort + EndPort define an inclusive range.
	// Both must be set together. Mutually exclusive with Port.
	// +optional
	StartPort *int32 `json:"startPort,omitempty"`
	// +optional
	EndPort *int32 `json:"endPort,omitempty"`
}

L4PortMatch matches a single port or an inclusive port range.

func (*L4PortMatch) DeepCopy 

func (in *L4PortMatch) DeepCopy() *L4PortMatch

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new L4PortMatch.

func (*L4PortMatch) DeepCopyInto 

func (in *L4PortMatch) DeepCopyInto(out *L4PortMatch)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type L4Protocol 

type L4Protocol string

L4Protocol selects TCP or UDP. +kubebuilder:validation:Enum=TCP;UDP 

const (
	L4ProtocolTCP L4Protocol = "TCP"
	L4ProtocolUDP L4Protocol = "UDP"
)

type L4RouteFilter 

type L4RouteFilter struct {
	// +kubebuilder:validation:Enum=ExtensionRef
	Type         L4RouteFilterType             `json:"type"`
	ExtensionRef *gwapiv1.LocalObjectReference `json:"extensionRef,omitempty"`
}

L4RouteFilter defines a filter for EgressL4Route rules.

func (*L4RouteFilter) DeepCopy 

func (in *L4RouteFilter) DeepCopy() *L4RouteFilter

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new L4RouteFilter.

func (*L4RouteFilter) DeepCopyInto 

func (in *L4RouteFilter) DeepCopyInto(out *L4RouteFilter)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type L4RouteFilterType 

type L4RouteFilterType string

L4RouteFilterType identifies the type of filter in an L4RouteFilter. +kubebuilder:validation:Enum=ExtensionRef 

const (
	L4FilterExtensionRef L4RouteFilterType = "ExtensionRef"
)

type L4RouteMatch 

type L4RouteMatch struct {
	// DestinationCIDRs matches by IP range. Single IPs as /32 or /128.
	// IPv4 and IPv6 CIDRs are both honored.
	// +optional
	// +listType=set
	// +kubebuilder:validation:items:Format=cidr
	DestinationCIDRs []string `json:"destinationCIDRs,omitempty"`

	// DestinationHostnames matches by hostname. Exact
	// (`api.openai.com`) and wildcard (`*.openai.com`) forms are
	// accepted (gwapiv1.Hostname semantics — wildcard matches exactly
	// one prefix label).
	//
	// On TLS-terminated listeners (protocol=TLS or HTTPS with
	// mode=Terminate) the match runs against the SNI value the
	// tls_inspector recorded on the connection. On plain TCP
	// listeners the match runs against the DNS-bound destination
	// name: the worker snoops UDP/53 responses, caches each
	// `(resolved IP) → name` binding, and emits the hostname for the
	// connection's destination IP via PROXY v2 TLVDstName so Envoy
	// and L4 ext_proc records pick it up.
	//
	// Limitation: encrypted resolvers (DoT on TCP/853, DoH on
	// TCP/443) bypass the snoop. Connections from agents that use
	// those resolvers fall back to CIDR-only matching — no error,
	// just no name binding. Use the kernel resolver (default) to
	// guarantee hostname rules apply.
	// +optional
	// +listType=set
	DestinationHostnames []gwapiv1.Hostname `json:"destinationHostnames,omitempty"`

	// Ports restricts to specific destination ports or port ranges.
	// +optional
	Ports []L4PortMatch `json:"ports,omitempty"`

	// Protocol selects TCP or UDP. Must be compatible with the parent
	// listener's protocol. If unset, inherits from the listener.
	// +optional
	Protocol *L4Protocol `json:"protocol,omitempty"`

	// SourceAgents narrows the match to traffic from specific Agent CRs.
	// +optional
	SourceAgents *metav1.LabelSelector `json:"sourceAgents,omitempty"`
}

L4RouteMatch defines match criteria for L4 traffic.

func (*L4RouteMatch) DeepCopy 

func (in *L4RouteMatch) DeepCopy() *L4RouteMatch

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new L4RouteMatch.

func (*L4RouteMatch) DeepCopyInto 

func (in *L4RouteMatch) DeepCopyInto(out *L4RouteMatch)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type LoggingPolicy 

type LoggingPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              LoggingSpec `json:"spec"`
}

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:resource:shortName=lp +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*LoggingPolicy) DeepCopy 

func (in *LoggingPolicy) DeepCopy() *LoggingPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LoggingPolicy.

func (*LoggingPolicy) DeepCopyInto 

func (in *LoggingPolicy) DeepCopyInto(out *LoggingPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*LoggingPolicy) DeepCopyObject 

func (in *LoggingPolicy) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*LoggingPolicy) GetGroupVersionResource 

func (r *LoggingPolicy) GetGroupVersionResource() schema.GroupVersionResource

func (*LoggingPolicy) GetObjectMeta 

func (r *LoggingPolicy) GetObjectMeta() *metav1.ObjectMeta

func (*LoggingPolicy) GetSingularName 

func (r *LoggingPolicy) GetSingularName() string

func (*LoggingPolicy) IsStorageVersion 

func (r *LoggingPolicy) IsStorageVersion() bool

func (*LoggingPolicy) NamespaceScoped 

func (r *LoggingPolicy) NamespaceScoped() bool

func (*LoggingPolicy) New 

func (r *LoggingPolicy) New() runtime.Object

func (*LoggingPolicy) NewList 

func (r *LoggingPolicy) NewList() runtime.Object

type LoggingPolicyList 

type LoggingPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LoggingPolicy `json:"items"`
}

LoggingPolicyList contains a list of LoggingPolicy resources.

func (*LoggingPolicyList) DeepCopy 

func (in *LoggingPolicyList) DeepCopy() *LoggingPolicyList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LoggingPolicyList.

func (*LoggingPolicyList) DeepCopyInto 

func (in *LoggingPolicyList) DeepCopyInto(out *LoggingPolicyList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*LoggingPolicyList) DeepCopyObject 

func (in *LoggingPolicyList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type LoggingSpec 

type LoggingSpec struct {
	CaptureRequest  bool     `json:"captureRequest,omitempty"`
	CaptureResponse bool     `json:"captureResponse,omitempty"`
	RedactHeaders   []string `json:"redactHeaders,omitempty"`
	SinkRef         *string  `json:"sinkRef,omitempty"`
}

LoggingSpec defines the desired state of a LoggingPolicy.

func (*LoggingSpec) DeepCopy 

func (in *LoggingSpec) DeepCopy() *LoggingSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LoggingSpec.

func (*LoggingSpec) DeepCopyInto 

func (in *LoggingSpec) DeepCopyInto(out *LoggingSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type MCPRoute 

type MCPRoute struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              MCPRouteSpec   `json:"spec"`
	Status            MCPRouteStatus `json:"status,omitempty"`
}

MCPRoute enables fine-grained routing and policy for outbound MCP (Model Context Protocol) traffic.

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=mcpr +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*MCPRoute) DeepCopy 

func (in *MCPRoute) DeepCopy() *MCPRoute

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MCPRoute.

func (*MCPRoute) DeepCopyInto 

func (in *MCPRoute) DeepCopyInto(out *MCPRoute)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*MCPRoute) DeepCopyObject 

func (in *MCPRoute) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*MCPRoute) Default 

func (r *MCPRoute) Default()

Default stamps the documented PerAgent default on each inline tool rate limit's Scope. The +kubebuilder:default marker on ToolRateLimit.Scope is inert under the aggregated apiserver (see the package comment), so without this an omitted scope persists as "" rather than PerAgent. Nested defaults are applied only where the parent ToolPolicy already exists.

func (*MCPRoute) GetGroupVersionResource 

func (r *MCPRoute) GetGroupVersionResource() schema.GroupVersionResource

func (*MCPRoute) GetObjectMeta 

func (r *MCPRoute) GetObjectMeta() *metav1.ObjectMeta

func (*MCPRoute) GetSingularName 

func (r *MCPRoute) GetSingularName() string

func (*MCPRoute) GetStatus 

func (r *MCPRoute) GetStatus() resource.StatusSubResource

func (*MCPRoute) IsStorageVersion 

func (r *MCPRoute) IsStorageVersion() bool

func (*MCPRoute) NamespaceScoped 

func (r *MCPRoute) NamespaceScoped() bool

func (*MCPRoute) New 

func (r *MCPRoute) New() runtime.Object

func (*MCPRoute) NewList 

func (r *MCPRoute) NewList() runtime.Object

func (*MCPRoute) Validate 

func (r *MCPRoute) Validate(_ context.Context) field.ErrorList

func (*MCPRoute) ValidateUpdate 

func (r *MCPRoute) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type MCPRouteFilter 

type MCPRouteFilter struct {
	// Type selects the filter.
	Type MCPRouteFilterType `json:"type"`

	// ToolPolicy — inline, MCP-specific.
	// +optional
	ToolPolicy *ToolPolicyFilter `json:"toolPolicy,omitempty"`

	// ExtensionRef for cross-cutting policies.
	// +optional
	ExtensionRef *gwapiv1.LocalObjectReference `json:"extensionRef,omitempty"`
}

MCPRouteFilter defines a filter for MCPRoute rules.

func (*MCPRouteFilter) DeepCopy 

func (in *MCPRouteFilter) DeepCopy() *MCPRouteFilter

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MCPRouteFilter.

func (*MCPRouteFilter) DeepCopyInto 

func (in *MCPRouteFilter) DeepCopyInto(out *MCPRouteFilter)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type MCPRouteFilterType 

type MCPRouteFilterType string

MCPRouteFilterType identifies the type of filter in an MCPRouteFilter. +kubebuilder:validation:Enum=ToolPolicy;ExtensionRef 

const (
	MCPFilterToolPolicy   MCPRouteFilterType = "ToolPolicy"
	MCPFilterExtensionRef MCPRouteFilterType = "ExtensionRef"
)

type MCPRouteList 

type MCPRouteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MCPRoute `json:"items"`
}

MCPRouteList contains a list of MCPRoute resources.

func (*MCPRouteList) DeepCopy 

func (in *MCPRouteList) DeepCopy() *MCPRouteList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MCPRouteList.

func (*MCPRouteList) DeepCopyInto 

func (in *MCPRouteList) DeepCopyInto(out *MCPRouteList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*MCPRouteList) DeepCopyObject 

func (in *MCPRouteList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type MCPRouteMatch 

type MCPRouteMatch struct {
	// Servers matches by MCP server identity (URL pattern).
	// +optional
	Servers []string `json:"servers,omitempty"`

	// Tools matches by tool name. Supports glob: "github_*".
	// +optional
	Tools []string `json:"tools,omitempty"`

	// ToolsRegex matches by tool name via Go regexp. Evaluated as a
	// union with Tools; a match on either selects the rule.
	// +optional
	ToolsRegex []string `json:"toolsRegex,omitempty"`

	// Resources matches by MCP resource URI pattern.
	// +optional
	Resources []string `json:"resources,omitempty"`

	// Methods matches MCP JSON-RPC methods.
	// +optional
	Methods []string `json:"methods,omitempty"`
}

MCPRouteMatch defines match criteria for MCP traffic.

func (*MCPRouteMatch) DeepCopy 

func (in *MCPRouteMatch) DeepCopy() *MCPRouteMatch

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MCPRouteMatch.

func (*MCPRouteMatch) DeepCopyInto 

func (in *MCPRouteMatch) DeepCopyInto(out *MCPRouteMatch)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type MCPRouteRule 

type MCPRouteRule struct {
	Matches []MCPRouteMatch `json:"matches,omitempty"`

	// Filters apply policy to matched MCP traffic.
	// +optional
	Filters []MCPRouteFilter `json:"filters,omitempty"`

	// BackendRefs optionally routes through an explicit proxy.
	// Empty = passthrough to original destination.
	// +optional
	BackendRefs []gwapiv1.BackendRef `json:"backendRefs,omitempty"`
}

MCPRouteRule defines a rule within an MCPRoute.

func (*MCPRouteRule) DeepCopy 

func (in *MCPRouteRule) DeepCopy() *MCPRouteRule

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MCPRouteRule.

func (*MCPRouteRule) DeepCopyInto 

func (in *MCPRouteRule) DeepCopyInto(out *MCPRouteRule)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type MCPRouteSpec 

type MCPRouteSpec struct {
	// ParentRefs attaches this route to EgressGateway listeners.
	ParentRefs []gwapiv1.ParentReference `json:"parentRefs"`

	// Hostnames scopes to MCP server endpoints by Host header.
	// +optional
	Hostnames []gwapiv1.Hostname `json:"hostnames,omitempty"`

	Rules []MCPRouteRule `json:"rules"`
}

MCPRouteSpec defines the desired state of an MCPRoute.

func (*MCPRouteSpec) DeepCopy 

func (in *MCPRouteSpec) DeepCopy() *MCPRouteSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MCPRouteSpec.

func (*MCPRouteSpec) DeepCopyInto 

func (in *MCPRouteSpec) DeepCopyInto(out *MCPRouteSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type MCPRouteStatus 

type MCPRouteStatus struct {
	Parents []gwapiv1.RouteParentStatus `json:"parents,omitempty"`
}

MCPRouteStatus describes the observed state of an MCPRoute.

func (*MCPRouteStatus) CopyTo 

func (s *MCPRouteStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*MCPRouteStatus) DeepCopy 

func (in *MCPRouteStatus) DeepCopy() *MCPRouteStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MCPRouteStatus.

func (*MCPRouteStatus) DeepCopyInto 

func (in *MCPRouteStatus) DeepCopyInto(out *MCPRouteStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*MCPRouteStatus) SubResourceName 

func (s *MCPRouteStatus) SubResourceName() string

type ModelRewrite 

type ModelRewrite struct {
	// From is a glob (path.Match shape) over the request's model ID.
	// +kubebuilder:validation:MinLength=1
	From string `json:"from"`

	// To is the literal model ID substituted on the wire.
	// +kubebuilder:validation:MinLength=1
	To string `json:"to"`
}

ModelRewrite remaps a request's model ID before it reaches the selected backend. Rewrites are an ordered list; the first entry whose From glob matches the request model wins (mirrors the glob-and-first-hit conventions used by AIProviderRoute matching).

func (*ModelRewrite) DeepCopy 

func (in *ModelRewrite) DeepCopy() *ModelRewrite

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ModelRewrite.

func (*ModelRewrite) DeepCopyInto 

func (in *ModelRewrite) DeepCopyInto(out *ModelRewrite)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type NotificationsConfig 

type NotificationsConfig struct {
	// Email captured by the console signup gate. Empty => the feature is inert
	// (no notifications recorded to phone home, no registration).
	// +optional
	Email string `json:"email,omitempty"`

	// SignedUpAt is stamped by the defaulter when Email is first set.
	// +optional
	SignedUpAt *metav1.Time `json:"signedUpAt,omitempty"`

	// AdvisoryPollEnabled opts into INBOUND security-advisory polling from
	// api.apoxy.dev. Defaults true on signup.
	// +optional
	AdvisoryPollEnabled *bool `json:"advisoryPollEnabled,omitempty"`

	// EventRetention is the retention window for events.k8s.io/v1 notification
	// Events in the embedded apiserver; older Events are pruned. Unset falls
	// back to the controller-manager's --notifications-event-retention flag.
	// +optional
	EventRetention *metav1.Duration `json:"eventRetention,omitempty"`
}

NotificationsConfig is the browser-writable notifications settings.

func (*NotificationsConfig) DeepCopy 

func (in *NotificationsConfig) DeepCopy() *NotificationsConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NotificationsConfig.

func (*NotificationsConfig) DeepCopyInto 

func (in *NotificationsConfig) DeepCopyInto(out *NotificationsConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type NotificationsStatus 

type NotificationsStatus struct {
	// Conditions: Registered, PhoneHomeHealthy, AdvisorySyncHealthy.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// DeploymentID is the non-secret correlation id api.apoxy.dev returns at
	// registration. Safe to surface in the console.
	// +optional
	DeploymentID string `json:"deploymentID,omitempty"`

	// RegisteredEmail is the spec.notifications.email that produced the current
	// registration. The controller compares it to the live spec email to detect a
	// changed signup and re-register (metadata.generation is unreliable in this
	// apiserver). Not secret -- it is already the browser-writable spec email.
	// +optional
	RegisteredEmail string `json:"registeredEmail,omitempty"`

	// AdvisoryPollIntervalSeconds is the server-driven advisory poll cadence
	// returned at registration. Persisted so it survives restarts (the poller
	// reverts to the flag default if unset).
	// +optional
	AdvisoryPollIntervalSeconds int64 `json:"advisoryPollIntervalSeconds,omitempty"`

	// RegistrationTokenSecretRef points at the Secret holding the phone-home
	// bearer token. The console sees the reference but cannot fetch the Secret
	// (core/v1 is not proxied by the embedded apiserver).
	// +optional
	RegistrationTokenSecretRef *SecretKeyReference `json:"registrationTokenSecretRef,omitempty"`

	// RegisteredAt / LastAdvisorySync / LastReportAt for the health panel.
	// +optional
	RegisteredAt *metav1.Time `json:"registeredAt,omitempty"`
	// +optional
	LastAdvisorySync *metav1.Time `json:"lastAdvisorySync,omitempty"`
	// +optional
	LastReportAt *metav1.Time `json:"lastReportAt,omitempty"`

	// ReportsDropped counts security reports dropped under queue backpressure.
	// +optional
	ReportsDropped int64 `json:"reportsDropped,omitempty"`

	// ObservedGeneration is the spec generation this status reflects.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

NotificationsStatus reflects the phone-home lifecycle. The registration token is NOT here (it lives in a core/v1 Secret); only the browser-safe reference and non-secret correlation fields are.

func (*NotificationsStatus) DeepCopy 

func (in *NotificationsStatus) DeepCopy() *NotificationsStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NotificationsStatus.

func (*NotificationsStatus) DeepCopyInto 

func (in *NotificationsStatus) DeepCopyInto(out *NotificationsStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type OTLPLogsSinkSpec 

type OTLPLogsSinkSpec struct {
	// Endpoint is the OTLP/HTTP base URL the controller-manager
	// forwards captured signals to (e.g. "https://otel.example.com").
	// Empty disables the customer fan-out; signals are still kept in
	// the embedded ClickHouse.
	// +optional
	Endpoint string `json:"endpoint,omitempty"`

	// Headers are added to every forwarded OTLP export — typically
	// used to carry authentication tokens for the customer endpoint.
	// +optional
	Headers map[string]string `json:"headers,omitempty"`

	// CaptureBody bounds the request/response body bytes captured by
	// ext_proc and emitted as OTLP log records. Defaults: 64KiB per
	// direction; capture application/json, application/x-ndjson,
	// text/event-stream.
	// +optional
	CaptureBody *BodyCaptureSpec `json:"captureBody,omitempty"`
}

OTLPLogsSinkSpec configures where the controller-manager re-exports captured signals to and how much of each request/response body is captured. The controller-manager always persists captured signals to its embedded ClickHouse regardless of this field; Endpoint only adds a best-effort fan-out copy to an external collector.

func (*OTLPLogsSinkSpec) DeepCopy 

func (in *OTLPLogsSinkSpec) DeepCopy() *OTLPLogsSinkSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OTLPLogsSinkSpec.

func (*OTLPLogsSinkSpec) DeepCopyInto 

func (in *OTLPLogsSinkSpec) DeepCopyInto(out *OTLPLogsSinkSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ProviderAuthConfig 

type ProviderAuthConfig struct {
	// +kubebuilder:validation:Enum=AWSv4;GCPServiceAccount
	Type string `json:"type"`
	// Region scopes the AWSv4 signature. When unset, the region is
	// derived from the target hostname at signing time
	// (bedrock-runtime.<region>.amazonaws.com) — the derived value is
	// the only one guaranteed to agree with the endpoint actually hit
	// when one policy covers Backends in multiple regions.
	Region *string `json:"region,omitempty"`
	// Service is the AWSv4 credential-scope service name. Defaults to
	// "bedrock".
	Service *string `json:"service,omitempty"`
}

ProviderAuthConfig configures provider-specific authentication.

func (*ProviderAuthConfig) DeepCopy 

func (in *ProviderAuthConfig) DeepCopy() *ProviderAuthConfig

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderAuthConfig.

func (*ProviderAuthConfig) DeepCopyInto 

func (in *ProviderAuthConfig) DeepCopyInto(out *ProviderAuthConfig)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type RateLimitPolicy 

type RateLimitPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              RateLimitSpec `json:"spec"`
}

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:resource:shortName=rlp +kubebuilder:printcolumn:name="Requests",type=integer,JSONPath=`.spec.requests` +kubebuilder:printcolumn:name="Window",type=string,JSONPath=`.spec.window` +kubebuilder:printcolumn:name="Scope",type=string,JSONPath=`.spec.scope` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*RateLimitPolicy) DeepCopy 

func (in *RateLimitPolicy) DeepCopy() *RateLimitPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitPolicy.

func (*RateLimitPolicy) DeepCopyInto 

func (in *RateLimitPolicy) DeepCopyInto(out *RateLimitPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RateLimitPolicy) DeepCopyObject 

func (in *RateLimitPolicy) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*RateLimitPolicy) Default 

func (r *RateLimitPolicy) Default()

Default sets spec.scope to PerAgent when unset.

func (*RateLimitPolicy) GetGroupVersionResource 

func (r *RateLimitPolicy) GetGroupVersionResource() schema.GroupVersionResource

func (*RateLimitPolicy) GetObjectMeta 

func (r *RateLimitPolicy) GetObjectMeta() *metav1.ObjectMeta

func (*RateLimitPolicy) GetSingularName 

func (r *RateLimitPolicy) GetSingularName() string

func (*RateLimitPolicy) IsStorageVersion 

func (r *RateLimitPolicy) IsStorageVersion() bool

func (*RateLimitPolicy) NamespaceScoped 

func (r *RateLimitPolicy) NamespaceScoped() bool

func (*RateLimitPolicy) New 

func (r *RateLimitPolicy) New() runtime.Object

func (*RateLimitPolicy) NewList 

func (r *RateLimitPolicy) NewList() runtime.Object

func (*RateLimitPolicy) Validate 

func (p *RateLimitPolicy) Validate(_ context.Context) field.ErrorList

func (*RateLimitPolicy) ValidateUpdate 

func (p *RateLimitPolicy) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type RateLimitPolicyList 

type RateLimitPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []RateLimitPolicy `json:"items"`
}

RateLimitPolicyList contains a list of RateLimitPolicy resources.

func (*RateLimitPolicyList) DeepCopy 

func (in *RateLimitPolicyList) DeepCopy() *RateLimitPolicyList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitPolicyList.

func (*RateLimitPolicyList) DeepCopyInto 

func (in *RateLimitPolicyList) DeepCopyInto(out *RateLimitPolicyList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RateLimitPolicyList) DeepCopyObject 

func (in *RateLimitPolicyList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type RateLimitScope 

type RateLimitScope string

RateLimitScope defines the scope of rate limiting. The kubebuilder Enum marker is intentionally omitted: this group is served by the aggregated apiserver, which does not honor CRD validation markers (see defaults.go), so scope validity is enforced in the Validate hooks via validateRateLimitScope instead. 

const (
	RateLimitScopePerAgent     RateLimitScope = "PerAgent"
	RateLimitScopePerExecution RateLimitScope = "PerExecution"
	RateLimitScopePerRoute     RateLimitScope = "PerRoute"
)

type RateLimitSpec 

type RateLimitSpec struct {
	Requests int32  `json:"requests"`
	Window   string `json:"window"`

	// +kubebuilder:default=PerAgent
	Scope RateLimitScope `json:"scope,omitempty"`
}

RateLimitSpec defines the desired state of a RateLimitPolicy.

func (*RateLimitSpec) DeepCopy 

func (in *RateLimitSpec) DeepCopy() *RateLimitSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitSpec.

func (*RateLimitSpec) DeepCopyInto 

func (in *RateLimitSpec) DeepCopyInto(out *RateLimitSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type RestartPolicy 

type RestartPolicy string

RestartPolicy controls what happens when the daemon process exits. +kubebuilder:validation:Enum=Always;OnFailure;Never 

const (
	RestartPolicyAlways    RestartPolicy = "Always"
	RestartPolicyOnFailure RestartPolicy = "OnFailure"
	RestartPolicyNever     RestartPolicy = "Never"
)

type SecretKeyReference 

type SecretKeyReference struct {
	Name      string `json:"name"`
	Namespace string `json:"namespace"`
	Key       string `json:"key"`
}

SecretKeyReference names a key within a Secret in a namespace.

func (*SecretKeyReference) DeepCopy 

func (in *SecretKeyReference) DeepCopy() *SecretKeyReference

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretKeyReference.

func (*SecretKeyReference) DeepCopyInto 

func (in *SecretKeyReference) DeepCopyInto(out *SecretKeyReference)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type TaskAgent 

type TaskAgent struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              TaskAgentSpec   `json:"spec"`
	Status            TaskAgentStatus `json:"status,omitempty"`
}

TaskAgent defines a triggered agent workload — HTTP or cron, runs to completion, exits. Executions are multiplexed across shared worker pods managed by WorkerPool.

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=ta +kubebuilder:printcolumn:name="Image",type=string,JSONPath=`.spec.template.spec.image` +kubebuilder:printcolumn:name="Pool",type=string,JSONPath=`.spec.workerPoolRef` +kubebuilder:printcolumn:name="Latest Ready",type=string,JSONPath=`.status.latestReadyRevisionName` +kubebuilder:printcolumn:name="Active",type=integer,JSONPath=`.status.activeExecutions` +kubebuilder:printcolumn:name="Warm",type=integer,JSONPath=`.status.warmSandboxes` +kubebuilder:printcolumn:name="Schedule",type=string,JSONPath=`.spec.schedule` +kubebuilder:printcolumn:name="Last Run",type=date,JSONPath=`.status.lastScheduleTime` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*TaskAgent) ConvertToTable 

func (ta *TaskAgent) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements resourcestrategy.TableConverter.

func (*TaskAgent) DeepCopy 

func (in *TaskAgent) DeepCopy() *TaskAgent

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskAgent.

func (*TaskAgent) DeepCopyInto 

func (in *TaskAgent) DeepCopyInto(out *TaskAgent)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*TaskAgent) DeepCopyObject 

func (in *TaskAgent) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*TaskAgent) Default 

func (r *TaskAgent) Default()

Default sets spec.timeout to DefaultTaskAgentTimeout when unset. Without it a timeout-less TaskAgent dereferenced a nil Spec.Timeout in the ingress reconciler (APO-638); the consumer guards remain as defense-in-depth for objects persisted before this defaulter shipped.

func (*TaskAgent) GetGroupVersionResource 

func (r *TaskAgent) GetGroupVersionResource() schema.GroupVersionResource

func (*TaskAgent) GetObjectMeta 

func (r *TaskAgent) GetObjectMeta() *metav1.ObjectMeta

func (*TaskAgent) GetSingularName 

func (r *TaskAgent) GetSingularName() string

func (*TaskAgent) GetStatus 

func (r *TaskAgent) GetStatus() resource.StatusSubResource

func (*TaskAgent) IsStorageVersion 

func (r *TaskAgent) IsStorageVersion() bool

func (*TaskAgent) NamespaceScoped 

func (r *TaskAgent) NamespaceScoped() bool

func (*TaskAgent) New 

func (r *TaskAgent) New() runtime.Object

func (*TaskAgent) NewList 

func (r *TaskAgent) NewList() runtime.Object

func (*TaskAgent) Validate 

func (ta *TaskAgent) Validate(_ context.Context) field.ErrorList

func (*TaskAgent) ValidateUpdate 

func (ta *TaskAgent) ValidateUpdate(ctx context.Context, _ runtime.Object) field.ErrorList

Cross-object existence (workerPool / egressRef) is not enforced at admission — declarative apply chains create the agent before the referenced resource lands; reconcilers surface those via status conditions.

type TaskAgentList 

type TaskAgentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []TaskAgent `json:"items"`
}

TaskAgentList contains a list of TaskAgent resources.

func (*TaskAgentList) ConvertToTable 

func (l *TaskAgentList) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements resourcestrategy.TableConverter for list responses.

func (*TaskAgentList) DeepCopy 

func (in *TaskAgentList) DeepCopy() *TaskAgentList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskAgentList.

func (*TaskAgentList) DeepCopyInto 

func (in *TaskAgentList) DeepCopyInto(out *TaskAgentList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*TaskAgentList) DeepCopyObject 

func (in *TaskAgentList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type TaskAgentSpec 

type TaskAgentSpec struct {
	// Template defines the sandbox revision template. Changes to this
	// field trigger creation of a new AgentSandboxRevision.
	Template AgentSandboxRevisionTemplate `json:"template"`

	// WorkerPoolRef references a WorkerPool resource by name in the same namespace.
	WorkerPoolRef string `json:"workerPoolRef"`

	// Resources defines per-execution CPU/memory limits.
	// +optional
	Resources ExecutionResources `json:"resources,omitempty"`

	// Timeout caps how long a single execution can run. Accepts a Go
	// duration string ("100s", "5m", "1h30m"). Defaults to 100s.
	// +kubebuilder:default="100s"
	// +optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`

	// MaxConcurrent caps how many executions of this agent can run
	// simultaneously across all workers. 0 = unlimited.
	// +optional
	MaxConcurrent *int32 `json:"maxConcurrent,omitempty"`

	// WarmPoolSize is the per-worker target for pre-Created sandboxes
	// kept Ready (rootfs mounted, TAP+netns provisioned, libcontainer
	// container created but agent process not yet started). A warm
	// sandbox shaves cold-start off the request hot path. Defaults to
	// 0 (no warm pool). Capped by the worker at MaxExecutionsPerWorker/2.
	// +optional
	// +kubebuilder:default=0
	WarmPoolSize *int32 `json:"warmPoolSize,omitempty"`

	// WarmPoolIdleTTL bounds how long a pre-warmed sandbox can sit
	// in the pool before it is evicted and replaced. Defaults to
	// 10 minutes when unset. Bounds resource-leak accumulation in
	// long-idle agent processes (file descriptors, anon memory,
	// language-runtime caches) at the cost of a cold-fill every
	// IdleTTL when traffic is sparse.
	// +optional
	WarmPoolIdleTTL *metav1.Duration `json:"warmPoolIdleTTL,omitempty"`

	// Schedule adds a cron trigger. Does NOT disable HTTP triggering.
	// +optional
	Schedule *string `json:"schedule,omitempty"`

	// ScheduleInput is the JSON body sent to the agent on cron triggers.
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	ScheduleInput *runtime.RawExtension `json:"scheduleInput,omitempty"`

	// EgressRefs references EgressGateway objects for outbound access.
	// Token budgets are configured on AIProviderRoute, not here.
	// +optional
	EgressRefs []AgentEgressRef `json:"egressRefs,omitempty"`

	// Identity configures user identity extraction from incoming requests.
	// +optional
	Identity *AgentIdentity `json:"identity,omitempty"`

	// Streaming configures stdout/stderr streaming behavior.
	// +optional
	Streaming *AgentStreaming `json:"streaming,omitempty"`

	// State configures persistent state across executions.
	// +optional
	State *AgentState `json:"state,omitempty"`

	// Delivery selects how the request payload reaches the agent.
	// Stdin (default) writes a CloudEvents structured-mode JSON
	// envelope to the agent's stdin. Metadata closes stdin and
	// exposes an IMDS-style HTTP server inside the sandbox; the
	// agent fetches via $CLRK_METADATA_URL.
	// +optional
	Delivery *AgentDelivery `json:"delivery,omitempty"`
}

func (*TaskAgentSpec) DeepCopy 

func (in *TaskAgentSpec) DeepCopy() *TaskAgentSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskAgentSpec.

func (*TaskAgentSpec) DeepCopyInto 

func (in *TaskAgentSpec) DeepCopyInto(out *TaskAgentSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type TaskAgentStatus 

type TaskAgentStatus struct {
	// Conditions represent the latest available observations of the TaskAgent's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// ActiveExecutions is the count of this agent's in-flight Invocations
	// — those in a non-terminal phase (Pending, Dispatched, or Running).
	// It is sourced from the invocation read model (APO-620), falling back
	// to the per-worker WorkerStatus sum when that model is unavailable.
	// "Execution" here means an in-flight invocation, not a separate
	// resource; see Invocation.
	// +optional
	ActiveExecutions int32 `json:"activeExecutions,omitempty"`
	// WarmSandboxes is the current count of pre-warmed sandboxes held Ready
	// for this agent across its workers — Created sandboxes (rootfs mounted,
	// TAP+netns provisioned, libcontainer container created) whose agent
	// process has not started, ready to absorb a request without cold-start.
	// It is the per-worker WarmCount summed over the latest-ready revision's
	// WorkerStatus stream, the actual realization of spec.warmPoolSize. The
	// metrics snapshot's `warm` gauge reads this verbatim.
	// +optional
	WarmSandboxes int32 `json:"warmSandboxes,omitempty"`
	// LatestCreatedRevisionName is the name of the last created AgentSandboxRevision.
	// +optional
	LatestCreatedRevisionName string `json:"latestCreatedRevisionName,omitempty"`
	// LatestReadyRevisionName is the name of the last revision that became ready.
	// +optional
	LatestReadyRevisionName string `json:"latestReadyRevisionName,omitempty"`
	// LastScheduleTime is the last time the cron schedule fired. Unset
	// when spec.schedule is empty or no fire has occurred yet.
	// +optional
	LastScheduleTime *metav1.Time `json:"lastScheduleTime,omitempty"`
	// NextScheduleTime is the next time the cron schedule will fire on
	// the current leader. Computed lazily from spec.schedule; expect skew
	// of up to one slot across leader failover.
	// +optional
	NextScheduleTime *metav1.Time `json:"nextScheduleTime,omitempty"`
	// ObservedGeneration is the generation most recently observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

func (*TaskAgentStatus) CopyTo 

func (s *TaskAgentStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*TaskAgentStatus) DeepCopy 

func (in *TaskAgentStatus) DeepCopy() *TaskAgentStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TaskAgentStatus.

func (*TaskAgentStatus) DeepCopyInto 

func (in *TaskAgentStatus) DeepCopyInto(out *TaskAgentStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*TaskAgentStatus) SubResourceName 

func (s *TaskAgentStatus) SubResourceName() string

type TokenBudgetFilter 

type TokenBudgetFilter struct {
	// MaxTokensPerExecution caps total tokens (input+output) per agent run.
	// +optional
	MaxTokensPerExecution *int64 `json:"maxTokensPerExecution,omitempty"`

	// MaxTokensPerDay caps daily token usage across all runs for this route.
	// +optional
	MaxTokensPerDay *int64 `json:"maxTokensPerDay,omitempty"`

	// MaxOutputTokensPerRequest caps output tokens on a single API call.
	// +optional
	MaxOutputTokensPerRequest *int64 `json:"maxOutputTokensPerRequest,omitempty"`

	// BudgetRef references a shared TokenBudget resource for cross-agent
	// or cross-route budgets.
	// +optional
	BudgetRef *string `json:"budgetRef,omitempty"`
}

TokenBudgetFilter enforces token consumption limits on AI provider traffic.

func (*TokenBudgetFilter) DeepCopy 

func (in *TokenBudgetFilter) DeepCopy() *TokenBudgetFilter

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TokenBudgetFilter.

func (*TokenBudgetFilter) DeepCopyInto 

func (in *TokenBudgetFilter) DeepCopyInto(out *TokenBudgetFilter)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ToolPolicyFilter 

type ToolPolicyFilter struct {
	// AllowedTools is an explicit allowlist. Supports glob.
	// If set, only matching tools may be invoked.
	// +optional
	AllowedTools []string `json:"allowedTools,omitempty"`

	// AllowedToolsRegex is an explicit allowlist of Go regexp patterns.
	// Evaluated as a union with AllowedTools: when either list is
	// non-empty, the tool must match at least one entry across both.
	// +optional
	AllowedToolsRegex []string `json:"allowedToolsRegex,omitempty"`

	// DeniedTools blocks specific tools. Evaluated after AllowedTools.
	// +optional
	DeniedTools []string `json:"deniedTools,omitempty"`

	// DeniedToolsRegex blocks tools by Go regexp pattern. Evaluated as
	// a union with DeniedTools; a match in either list denies the call.
	// +optional
	DeniedToolsRegex []string `json:"deniedToolsRegex,omitempty"`

	// RequireConfirmation lists tools that need out-of-band human
	// confirmation before execution proceeds.
	// +optional
	RequireConfirmation []string `json:"requireConfirmation,omitempty"`

	// MaxCallsPerExecution caps total tool invocations per agent run.
	// +optional
	MaxCallsPerExecution *int32 `json:"maxCallsPerExecution,omitempty"`

	// RateLimits enforces per-tool rate limits using the same windowing
	// vocabulary as RateLimitPolicy. Each entry is scoped independently.
	// +optional
	RateLimits []ToolRateLimit `json:"rateLimits,omitempty"`
}

ToolPolicyFilter controls tool-call-level policy for MCP traffic.

func (*ToolPolicyFilter) DeepCopy 

func (in *ToolPolicyFilter) DeepCopy() *ToolPolicyFilter

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ToolPolicyFilter.

func (*ToolPolicyFilter) DeepCopyInto 

func (in *ToolPolicyFilter) DeepCopyInto(out *ToolPolicyFilter)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ToolRateLimit 

type ToolRateLimit struct {
	// Tools selects which tools this limit applies to. Supports glob.
	// Empty means all tools matched by the enclosing rule.
	// +optional
	Tools []string `json:"tools,omitempty"`

	// ToolsRegex restricts the limit to tools matching any Go regexp
	// pattern here. Evaluated as a union with Tools; empty Tools and
	// empty ToolsRegex means "any tool matched by the enclosing rule".
	// +optional
	ToolsRegex []string `json:"toolsRegex,omitempty"`

	// Requests is the maximum number of invocations permitted within
	// Window before further calls are rejected.
	Requests int32 `json:"requests"`

	// Window is a Go duration string (e.g. "1m", "1h", "24h") over which
	// Requests are counted.
	Window string `json:"window"`

	// Scope chooses the counter dimension. Defaults to PerAgent.
	// +kubebuilder:default=PerAgent
	Scope RateLimitScope `json:"scope,omitempty"`
}

ToolRateLimit caps invocations for a subset of tools matched by the enclosing rule.

func (*ToolRateLimit) DeepCopy 

func (in *ToolRateLimit) DeepCopy() *ToolRateLimit

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ToolRateLimit.

func (*ToolRateLimit) DeepCopyInto 

func (in *ToolRateLimit) DeepCopyInto(out *ToolRateLimit)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WorkerPodMeta 

type WorkerPodMeta struct {
	// Labels are merged into the pod template; the pool selector labels win on
	// key collision.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`

	// Annotations are merged into the pod template; the AppArmor annotation
	// wins on key collision.
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
}

WorkerPodMeta is the user-settable subset of the worker pod's ObjectMeta.

func (*WorkerPodMeta) DeepCopy 

func (in *WorkerPodMeta) DeepCopy() *WorkerPodMeta

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerPodMeta.

func (*WorkerPodMeta) DeepCopyInto 

func (in *WorkerPodMeta) DeepCopyInto(out *WorkerPodMeta)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WorkerPodTemplate 

type WorkerPodTemplate struct {
	// Image is the worker container image. Required. It must be a clrk worker
	// image (runsc + the sentrystack plugin); an arbitrary image will not boot
	// the sandbox runtime.
	Image string `json:"image"`

	// ImagePullPolicy for the worker container. Defaults to IfNotPresent.
	// +optional
	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`

	// ImagePullSecrets are attached to the worker pod for pulling Image.
	// +optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`

	// Resources are the worker container's compute resource requests/limits.
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// Env is additional environment for the worker container, appended after
	// the fixed downward-API vars (POD_NAME, POD_NAMESPACE, CLRK_POOL_NAME). A
	// var named POD_NAME/POD_NAMESPACE/CLRK_POOL_NAME is always dropped (the
	// controller owns it). CLRK_CM_OTLP_ENDPOINT/CLRK_CM_NATS_ADDR are dropped
	// only when the controller injects them (cm mode); in single-binary mode
	// the controller injects nothing, so an operator-supplied value here is
	// kept.
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`

	// NodeSelector constrains worker pods to matching nodes.
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Tolerations let worker pods schedule onto tainted nodes.
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// Affinity is the worker pods' scheduling affinity.
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`

	// PriorityClassName sets the worker pods' scheduling priority.
	// +optional
	PriorityClassName string `json:"priorityClassName,omitempty"`

	// TopologySpreadConstraints spread worker pods across failure domains.
	// +optional
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`

	// ServiceAccountName the worker pods run under. Defaults to clrk-worker.
	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// ExtraVolumes are additional pod volumes. Names colliding with the
	// reserved runtime volumes (state, run, varlog) are rejected at admission.
	// +optional
	ExtraVolumes []corev1.Volume `json:"extraVolumes,omitempty"`

	// ExtraVolumeMounts are additional mounts on the worker container. Names
	// colliding with a reserved volume, or mount paths overlapping a reserved
	// runtime path, are rejected at admission.
	// +optional
	ExtraVolumeMounts []corev1.VolumeMount `json:"extraVolumeMounts,omitempty"`

	// Metadata holds pod labels and annotations merged onto the base. The
	// controller-owned pool selector labels and the AppArmor annotation always
	// win on key collision, so user entries can add but never clobber a
	// load-bearing key. Setting the clrk.apoxy.dev/restartedAt annotation here
	// triggers a rolling restart, the same mechanism as `kubectl rollout
	// restart`.
	// +optional
	Metadata WorkerPodMeta `json:"metadata,omitempty"`
}

WorkerPodTemplate is the curated set of worker-pod knobs a pool owner may set. Every field is merged onto a fixed, code-owned base by the controller's pod builder (internal/workerpod). Fields that would compromise the runsc sandbox -- the security context, the worker container/ports, the reserved volumes, and the host namespaces -- are intentionally absent.

func (*WorkerPodTemplate) DeepCopy 

func (in *WorkerPodTemplate) DeepCopy() *WorkerPodTemplate

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerPodTemplate.

func (*WorkerPodTemplate) DeepCopyInto 

func (in *WorkerPodTemplate) DeepCopyInto(out *WorkerPodTemplate)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WorkerPool 

type WorkerPool struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              WorkerPoolSpec   `json:"spec"`
	Status            WorkerPoolStatus `json:"status,omitempty"`
}

WorkerPool defines a pool of worker pods that host agent executions. Teams own their pools with independent sizing, node placement, and runtime configuration. Agents reference WorkerPool by name in the same namespace.

+genclient +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +kubebuilder:object:root=true +kubebuilder:subresource:status +kubebuilder:resource:shortName=wp +kubebuilder:printcolumn:name="Replicas",type=integer,JSONPath=`.spec.replicas` +kubebuilder:printcolumn:name="Ready",type=integer,JSONPath=`.status.readyReplicas` +kubebuilder:printcolumn:name="Active",type=integer,JSONPath=`.status.activeExecutions` +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`

func (*WorkerPool) ConvertToTable 

func (wp *WorkerPool) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements resourcestrategy.TableConverter.

func (*WorkerPool) DeepCopy 

func (in *WorkerPool) DeepCopy() *WorkerPool

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerPool.

func (*WorkerPool) DeepCopyInto 

func (in *WorkerPool) DeepCopyInto(out *WorkerPool)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*WorkerPool) DeepCopyObject 

func (in *WorkerPool) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*WorkerPool) Default 

func (r *WorkerPool) Default()

Default sets spec.replicas to 1 when unset and stamps the curated overlay's load-bearing defaults (image pull policy and service account) so a minimal WorkerPool resolves to the canonical worker pod. The gVisor invariants themselves are not in the overlay -- the controller's pod builder owns them -- so they need no defaulting here.

func (*WorkerPool) GetGroupVersionResource 

func (r *WorkerPool) GetGroupVersionResource() schema.GroupVersionResource

func (*WorkerPool) GetObjectMeta 

func (r *WorkerPool) GetObjectMeta() *metav1.ObjectMeta

func (*WorkerPool) GetSingularName 

func (r *WorkerPool) GetSingularName() string

func (*WorkerPool) GetStatus 

func (r *WorkerPool) GetStatus() resource.StatusSubResource

func (*WorkerPool) IsStorageVersion 

func (r *WorkerPool) IsStorageVersion() bool

func (*WorkerPool) NamespaceScoped 

func (r *WorkerPool) NamespaceScoped() bool

func (*WorkerPool) New 

func (r *WorkerPool) New() runtime.Object

func (*WorkerPool) NewList 

func (r *WorkerPool) NewList() runtime.Object

func (*WorkerPool) Validate 

func (wp *WorkerPool) Validate(_ context.Context) field.ErrorList

func (*WorkerPool) ValidateUpdate 

func (wp *WorkerPool) ValidateUpdate(ctx context.Context, old runtime.Object) field.ErrorList

type WorkerPoolCapacity 

type WorkerPoolCapacity struct {
	// MaxExecutions is the total execution slots across all ready workers.
	// +optional
	MaxExecutions int32 `json:"maxExecutions,omitempty"`
	// AvailableExecutions is the number of free execution slots.
	// +optional
	AvailableExecutions int32 `json:"availableExecutions,omitempty"`
}

WorkerPoolCapacity describes the aggregate execution capacity of a WorkerPool.

func (*WorkerPoolCapacity) DeepCopy 

func (in *WorkerPoolCapacity) DeepCopy() *WorkerPoolCapacity

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerPoolCapacity.

func (*WorkerPoolCapacity) DeepCopyInto 

func (in *WorkerPoolCapacity) DeepCopyInto(out *WorkerPoolCapacity)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WorkerPoolList 

type WorkerPoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []WorkerPool `json:"items"`
}

WorkerPoolList contains a list of WorkerPool resources.

func (*WorkerPoolList) ConvertToTable 

func (l *WorkerPoolList) ConvertToTable(ctx context.Context, tableOptions runtime.Object) (*metav1.Table, error)

ConvertToTable implements resourcestrategy.TableConverter for list responses.

func (*WorkerPoolList) DeepCopy 

func (in *WorkerPoolList) DeepCopy() *WorkerPoolList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerPoolList.

func (*WorkerPoolList) DeepCopyInto 

func (in *WorkerPoolList) DeepCopyInto(out *WorkerPoolList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*WorkerPoolList) DeepCopyObject 

func (in *WorkerPoolList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type WorkerPoolSpec 

type WorkerPoolSpec struct {
	// Replicas is the desired number of worker pods.
	// +kubebuilder:default=1
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`

	// Template is the curated worker-pod overlay. It exposes only the pod-spec
	// knobs that are safe to tune; the gVisor/runsc-load-bearing fields
	// (privileged + seccomp Unconfined + the AppArmor annotation, the
	// run/state/varlog scratch volumes, the dispatch port, and the downward-API
	// env) are owned by the controller's pod builder and are not expressible
	// here, so a user edit cannot break the sandbox runtime.
	Template WorkerPodTemplate `json:"template"`

	// MaxExecutionsPerWorker caps how many agent executions a single worker pod
	// can host simultaneously.
	// +optional
	MaxExecutionsPerWorker *int32 `json:"maxExecutionsPerWorker,omitempty"`

	// WarmPool is the number of pre-spawned sandboxes to keep ready.
	// +optional
	WarmPool *int32 `json:"warmPool,omitempty"`

	// ImageCache configures OCI image caching on worker nodes.
	// +optional
	ImageCache *ImageCacheConfig `json:"imageCache,omitempty"`
}

func (*WorkerPoolSpec) DeepCopy 

func (in *WorkerPoolSpec) DeepCopy() *WorkerPoolSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerPoolSpec.

func (*WorkerPoolSpec) DeepCopyInto 

func (in *WorkerPoolSpec) DeepCopyInto(out *WorkerPoolSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WorkerPoolStatus 

type WorkerPoolStatus struct {
	// ObservedGeneration is the most recent metadata.generation the controller
	// has reconciled. Clients compare it against metadata.generation to tell
	// whether the controller has acted on the latest spec; together with the
	// Available/Progressing conditions it gives a race-free rollout signal.
	// `clrk dev reload worker` waits on this rather than polling the
	// controller-owned Deployment, whose status lags this resource (polling the
	// Deployment can observe the pre-reconcile converged state and report
	// "rolled out" before the roll has even started).
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// ReadyReplicas is the number of worker pods that are ready.
	// +optional
	ReadyReplicas int32 `json:"readyReplicas,omitempty"`
	// Capacity is the aggregate capacity across all ready workers.
	// +optional
	Capacity WorkerPoolCapacity `json:"capacity,omitempty"`
	// ActiveExecutions is the total number of in-flight (non-terminal)
	// Invocations across all workers in the pool. See Invocation.
	// +optional
	ActiveExecutions int32 `json:"activeExecutions,omitempty"`
	// Conditions represent the latest available observations of the WorkerPool's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

func (*WorkerPoolStatus) CopyTo 

func (s *WorkerPoolStatus) CopyTo(obj resource.ObjectWithStatusSubResource)

func (*WorkerPoolStatus) DeepCopy 

func (in *WorkerPoolStatus) DeepCopy() *WorkerPoolStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerPoolStatus.

func (*WorkerPoolStatus) DeepCopyInto 

func (in *WorkerPoolStatus) DeepCopyInto(out *WorkerPoolStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*WorkerPoolStatus) SubResourceName 

func (s *WorkerPoolStatus) SubResourceName() string

type WorkerReservedVolume 

type WorkerReservedVolume struct {
	// Name is the pod volume name and the worker container volumeMount name.
	Name string
	// MountPath is where the worker container mounts the volume.
	MountPath string
}

WorkerReservedVolume is a scratch volume the worker runtime owns and mounts at a fixed path.

func (*WorkerReservedVolume) DeepCopy 

func (in *WorkerReservedVolume) DeepCopy() *WorkerReservedVolume

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerReservedVolume.

func (*WorkerReservedVolume) DeepCopyInto 

func (in *WorkerReservedVolume) DeepCopyInto(out *WorkerReservedVolume)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type WorkerSandboxStatus 

type WorkerSandboxStatus struct {
	// PodName is the name of the worker pod.
	PodName string `json:"podName"`
	// ImagePulled indicates whether the sandbox image has been pulled.
	ImagePulled bool `json:"imagePulled"`
	// WarmCount is the number of warm sandbox instances on this worker.
	// +optional
	WarmCount int32 `json:"warmCount,omitempty"`
	// ActiveExecutions is the number of in-flight (non-terminal)
	// Invocations dispatched to this worker for the parent agent of the
	// revision. This per-worker count is the legacy source the TaskAgent
	// revision controller sums as a fallback when the invocation read
	// model is unavailable (see TaskAgent.Status.ActiveExecutions and
	// Invocation).
	// +optional
	ActiveExecutions int32 `json:"activeExecutions,omitempty"`
	// LastHeartbeat is the last time this worker reported status.
	// +optional
	LastHeartbeat metav1.Time `json:"lastHeartbeat,omitempty"`
}

WorkerSandboxStatus tracks sandbox readiness on a single worker pod.

func (*WorkerSandboxStatus) DeepCopy 

func (in *WorkerSandboxStatus) DeepCopy() *WorkerSandboxStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerSandboxStatus.

func (*WorkerSandboxStatus) DeepCopyInto 

func (in *WorkerSandboxStatus) DeepCopyInto(out *WorkerSandboxStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.