nodeapi

type AuditEvent struct {
	Kind              string
	Time              time.Time
	AuthenticatedNode string
	ClaimedNode       string
	Namespace         string
	Pod               string
	PodUID            string
	Method            string
	Path              string
	RemoteAddr        string
}

type AuthOptions struct {
	// APIServer is the API server base URL serving issuer discovery and /openid/v1/jwks.
	APIServer string
	// HTTPClient carries the API server transport and credentials.
	HTTPClient     *http.Client
	Audience       string
	Namespace      string
	ServiceAccount string
	ResolvePod     NodeResolver
	MaxLifetime    time.Duration
	Clock          func() time.Time
}

type Authenticator struct {
	// contains filtered or unexported fields
}

type Backend interface {
	Register(ctx context.Context, node string, req RegisterRequest) (RegisterResponse, error)
	// Submit returns only after the items are durably stored; queue names the sequence space of the item sequences.
	Submit(ctx context.Context, node, queue string, items []Item) (ackedThrough uint64, err error)
	// Bundle returns nil when have is current; changed is closed once the answer may differ.
	Bundle(ctx context.Context, node, have string) (*BundlePayload, <-chan struct{}, error)
	// Kube reports nothing new while the revision is at most since.
	Kube(ctx context.Context, node string, since uint64) (KubeUpdate, <-chan struct{}, error)
	Tasks(ctx context.Context, node string) ([]Task, <-chan struct{}, error)
	TaskResult(ctx context.Context, node string, res TaskResult) error
}

type BundlePayload struct {
	Version     string `cbor:"1,keyasint"`
	Archive     []byte `cbor:"2,keyasint"`
	Signature   []byte `cbor:"3,keyasint,omitempty"`
	KeyManifest []byte `cbor:"4,keyasint,omitempty"`
	// KeyManifestChain is forwarded unchanged from the control plane (ascending sequence).
	KeyManifestChain [][]byte `cbor:"5,keyasint,omitempty"`
}

type Client struct {
	// contains filtered or unexported fields
}

type ClientOptions struct {
	BaseURL string
	// CAFile verifies the coordinator certificate; empty uses the system roots.
	CAFile string
	// TokenFile is reread on every request because the kubelet rotates it.
	TokenFile       string
	Node            string
	Timeout         time.Duration
	LongPollTimeout time.Duration
}

type Error struct {
	Op         string
	StatusCode int
	Message    string
	Retryable  bool
	// Malformed is set when the request content itself is refused (HTTP 400 or 413) or cannot be encoded.
	Malformed bool
	Err       error
}

type Identity struct {
	Node           string
	Namespace      string
	ServiceAccount string
	Pod            string
	PodUID         string
	Expiry         time.Time
}

type Item struct {
	Seq     uint64             `cbor:"1,keyasint"`
	Kind    ItemKind           `cbor:"2,keyasint"`
	Finding []byte             `cbor:"3,keyasint,omitempty"`
	Facts   []metricfacts.Fact `cbor:"4,keyasint,omitempty"`
	Part    *Part              `cbor:"5,keyasint,omitempty"`
}

type ItemKind string

type KubeSeries struct {
	Labels map[string]string `cbor:"1,keyasint,omitempty"`
	Value  float64           `cbor:"2,keyasint"`
}

type KubeUpdate struct {
	Revision uint64       `cbor:"1,keyasint"`
	Series   []KubeSeries `cbor:"2,keyasint,omitempty"`
}

type NodeResolver func(namespace, name, uid string) (nodeName string, ok bool)

type Options struct {
	Auth         *Authenticator
	Backend      Backend
	Audit        func(AuditEvent)
	Clock        func() time.Time
	MaxBody      int64
	LongPollMax  time.Duration
	Logger       *slog.Logger
	AuthLogEvery time.Duration
}

type Part struct {
	RuleID        string   `cbor:"1,keyasint"`
	RuleVersion   int      `cbor:"2,keyasint,omitempty"`
	BundleVersion string   `cbor:"3,keyasint,omitempty"`
	EvalTimeMs    int64    `cbor:"4,keyasint"`
	Samples       []Sample `cbor:"5,keyasint,omitempty"`
}

type Process struct {
	UID          int      `cbor:"1,keyasint" json:"uid"`
	GID          int      `cbor:"2,keyasint" json:"gid"`
	Capabilities []string `cbor:"3,keyasint,omitempty" json:"capabilities"`
}

type QueueUsage struct {
	Bytes    int64  `cbor:"1,keyasint,omitempty"`
	Capacity int64  `cbor:"2,keyasint,omitempty"`
	Items    uint64 `cbor:"3,keyasint,omitempty"`
	Acked    uint64 `cbor:"4,keyasint,omitempty"`
	Next     uint64 `cbor:"5,keyasint,omitempty"`
}

type RegisterRequest struct {
	Node          string            `cbor:"1,keyasint"`
	AgentVersion  string            `cbor:"2,keyasint,omitempty"`
	BundleVersion string            `cbor:"3,keyasint,omitempty"`
	Capabilities  []string          `cbor:"4,keyasint,omitempty"`
	Coverage      map[string]string `cbor:"5,keyasint,omitempty"`
	Warming       bool              `cbor:"6,keyasint,omitempty"`
	QueueUsage    QueueUsage        `cbor:"7,keyasint"`
	// Rules are the node-local rule states, at most MaxRuleStatuses, most severe first.
	Rules []RuleStatus `cbor:"8,keyasint,omitempty"`
	// Process is the node agent's user and effective capabilities, so a root agent is visible on the connector.
	Process *Process `cbor:"9,keyasint,omitempty"`
}

type RegisterResponse struct {
	TargetBundle string `cbor:"1,keyasint,omitempty"`
	ServerTimeMs int64  `cbor:"2,keyasint"`
}

type RuleStatus struct {
	RuleID          string `cbor:"1,keyasint"`
	Version         int    `cbor:"2,keyasint,omitempty"`
	State           string `cbor:"3,keyasint"`
	Reason          string `cbor:"4,keyasint,omitempty"`
	LastEvalMs      int64  `cbor:"5,keyasint,omitempty"`
	BudgetLimited   bool   `cbor:"6,keyasint,omitempty"`
	EvidenceLimited bool   `cbor:"7,keyasint,omitempty"`
}

type Sample struct {
	Labels      map[string]string `cbor:"1,keyasint,omitempty"`
	Value       float64           `cbor:"2,keyasint"`
	TimestampMs int64             `cbor:"3,keyasint"`
}

type SubmitRequest struct {
	Node  string `cbor:"1,keyasint"`
	Items []Item `cbor:"2,keyasint,omitempty"`
	// Queue identifies the node queue whose sequence space Items belong to; empty from agents that predate it.
	Queue string `cbor:"3,keyasint,omitempty"`
}

type SubmitResponse struct {
	AckedThrough uint64 `cbor:"1,keyasint"`
}

type Task struct {
	ID         string   `cbor:"1,keyasint"`
	Kind       TaskKind `cbor:"2,keyasint"`
	Payload    []byte   `cbor:"3,keyasint,omitempty"`
	DeadlineMs int64    `cbor:"4,keyasint,omitempty"`
}

type TaskKind string

type TaskList struct {
	Tasks []Task `cbor:"1,keyasint,omitempty"`
}

type TaskResult struct {
	ID      string `cbor:"1,keyasint"`
	Payload []byte `cbor:"2,keyasint,omitempty"`
	Error   string `cbor:"3,keyasint,omitempty"`
}