operator

type ComplianceSchedule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComplianceScheduleSpec   `json:"spec,omitempty"`
	Status ComplianceScheduleStatus `json:"status,omitempty"`
}

type ComplianceScheduleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComplianceSchedule `json:"items"`
}

type ComplianceScheduleSpec struct {
	// CronExpr is a standard 5-field cron expression (UTC unless the
	// daemon's CK_TZ overrides). robfig/cron/v3 evaluates the spec.
	CronExpr string `json:"cronExpr"`

	// Providers selects which provider scans run on each tick. Empty
	// = every provider currently enabled in the daemon.
	Providers []string `json:"providers,omitempty"`

	// DaemonRef points at a daemon instance the schedule targets.
	DaemonRef DaemonRef `json:"daemonRef"`

	// Enabled lets the operator pause / un-pause without deleting the
	// CR. Defaults true.
	Enabled *bool `json:"enabled,omitempty"`
}

type ComplianceScheduleStatus struct {
	LastRunTime *metav1.Time       `json:"lastRunTime,omitempty"`
	LastStatus  string             `json:"lastStatus,omitempty"`
	NextRunTime *metav1.Time       `json:"nextRunTime,omitempty"`
	Conditions  []metav1.Condition `json:"conditions,omitempty"`
}

type DaemonRef struct {
	// URL is the daemon's externally-reachable base URL.
	URL string `json:"url"`

	// BearerSecret references a Secret + key in the operator's
	// namespace whose value is the daemon API bearer token.
	BearerSecret SecretKeyRef `json:"bearerSecret"`
}

type ScanJob struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ScanJobSpec   `json:"spec,omitempty"`
	Status ScanJobStatus `json:"status,omitempty"`
}

type ScanJobList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ScanJob `json:"items"`
}

type ScanJobReconciler struct {
	client.Client
	DefaultImage string // fallback when ScanJob.Spec.Image is empty
}

type ScanJobSpec struct {
	// Image is the compliancekit OCI image to scan with. Defaults to
	// the operator's `image.repository:image.tag` configured at boot.
	Image string `json:"image,omitempty"`

	// Args are appended after `scan`. e.g. ["--provider=aws",
	// "--out=/tmp/findings.json"].
	Args []string `json:"args,omitempty"`

	// EvidencePackPVC mounts a PVC at /work to receive the evidence
	// pack output. Optional.
	EvidencePackPVC string `json:"evidencePackPVC,omitempty"`

	// EnvFromSecret loads env vars from a Secret (cloud creds).
	EnvFromSecret string `json:"envFromSecret,omitempty"`
}

type ScanJobStatus struct {
	// Phase mirrors the underlying Pod's PodPhase string
	// (Pending / Running / Succeeded / Failed / Unknown).
	Phase string `json:"phase,omitempty"`

	// PodName is the name of the Pod this CR spawned.
	PodName        string             `json:"podName,omitempty"`
	StartTime      *metav1.Time       `json:"startTime,omitempty"`
	CompletionTime *metav1.Time       `json:"completionTime,omitempty"`
	Conditions     []metav1.Condition `json:"conditions,omitempty"`
}

type ScheduleReconciler struct {
	client.Client
	HTTP *http.Client
}

type SecretKeyRef struct {
	Name string `json:"name"`
	Key  string `json:"key"`
}