controller

type ClusterScanSpec struct {
	// Contexts are kubeconfig context names to include in the scan.
	Contexts []string `json:"contexts,omitempty"`
	// Group is the name of a fleetsweeper group whose members will be scanned.
	Group string `json:"group,omitempty"`
	// Interval is a Go duration string between scans, for example "15m".
	Interval string `json:"interval,omitempty"`
	// Scanners restricts the scan to the named scanners. Empty runs all.
	Scanners []string `json:"scanners,omitempty"`
	// Emit selects which artefacts to emit after each scan.
	Emit EmitOptions `json:"emit"`
	// Paused, when true, makes the controller skip reconciliation.
	Paused bool `json:"paused,omitempty"`
}

type ClusterScanStatus struct {
	// Phase is the current reconciliation phase.
	Phase string `json:"phase,omitempty"`
	// LastScanID is the most recently completed scan identifier.
	LastScanID string `json:"lastScanID,omitempty"`
	// LastScanTime is when the most recent scan completed.
	LastScanTime *time.Time `json:"lastScanTime,omitempty"`
	// NextScanTime is when the controller intends to run the next scan.
	NextScanTime *time.Time `json:"nextScanTime,omitempty"`
	// ObservedScore is the fleet score from the most recent scan.
	ObservedScore int `json:"observedScore,omitempty"`
	// ObservedGrade is the letter grade from the most recent scan.
	ObservedGrade string `json:"observedGrade,omitempty"`
	// ObservedCritical is the count of critical findings.
	ObservedCritical int `json:"observedCritical,omitempty"`
	// ObservedWarning is the count of warning findings.
	ObservedWarning int `json:"observedWarning,omitempty"`
	// ObservedClusters is the number of clusters that returned data.
	ObservedClusters int `json:"observedClusters,omitempty"`
	// Message is a human-readable summary of the last reconciliation.
	Message string `json:"message,omitempty"`
	// Conditions are standard Kubernetes status conditions.
	Conditions []Condition `json:"conditions,omitempty"`
}

type Condition struct {
	// Type names the condition (for example "Ready").
	Type string `json:"type"`
	// Status is "True", "False", or "Unknown".
	Status string `json:"status"`
	// Reason is a CamelCase reason for the transition.
	Reason string `json:"reason,omitempty"`
	// Message is human-readable detail.
	Message string `json:"message,omitempty"`
	// LastTransitionTime is when the condition last changed.
	LastTransitionTime time.Time `json:"lastTransitionTime"`
}

type Config struct {
	// Dynamic is the in-cluster dynamic client used to watch ClusterScans.
	Dynamic dynamic.Interface
	// Namespace, when non-empty, restricts the controller to one namespace.
	// Empty watches all namespaces (requires cluster-wide RBAC).
	Namespace string
	// Runner executes scans on the controller's behalf.
	Runner ScanRunner
	// Log is the structured logger.
	Log *zap.Logger
	// PollInterval is how often cached ClusterScans are re-enqueued to check
	// for due scans. Defaults to 15s when zero.
	PollInterval time.Duration
}

type Controller struct {
	// contains filtered or unexported fields
}

type EmitOptions struct {
	// FleetDriftReport emits FleetDriftReport YAMLs to the configured directory.
	FleetDriftReport bool `json:"fleetDriftReport,omitempty"`
	// PolicyReport emits wgpolicyk8s.io PolicyReports to the configured directory.
	PolicyReport bool `json:"policyReport,omitempty"`
	// Slack delivers new critical findings to the configured webhook URL.
	Slack bool `json:"slack,omitempty"`
}

type ScanOptions struct {
	// Contexts is the kubeconfig context names to scan.
	Contexts []string
	// Group, when non-empty, supersedes Contexts: members of that group are scanned.
	Group string
	// Scanners restricts the scan to the named scanners. Empty runs all.
	Scanners []string
	// Emit selects which sinks receive outputs.
	Emit EmitOptions
	// ResourceName is the name of the originating ClusterScan, used for logging.
	ResourceName string
}

type ScanRunner interface {
	// ScanOnce executes one scan with the given options and returns the summary.
	// Implementations must be safe to call concurrently from multiple goroutines.
	ScanOnce(ctx context.Context, opts ScanOptions) (ScanSummary, error)
}

type ScanSummary struct {
	// ScanID is the persistent scan record identifier.
	ScanID string
	// Score is the fleet score (0-100).
	Score int
	// Grade is the letter grade (A-F).
	Grade string
	// Critical is the count of critical findings.
	Critical int
	// Warning is the count of warning findings.
	Warning int
	// Clusters is the number of clusters that produced data.
	Clusters int
}