controller

type ClusterScanSpec struct {
	// Contexts are kubeconfig context names to include in the scan.
	Contexts []string `json:"contexts,omitempty"`
	// Group is the name of a fleetsweeper group whose members will be scanned.
	Group string `json:"group,omitempty"`
	// Interval is a Go duration string between scans, for example "15m".
	Interval string `json:"interval,omitempty"`
	// Scanners restricts the scan to the named scanners. Empty runs all.
	Scanners []string `json:"scanners,omitempty"`
	// Emit selects which artifacts to emit after each scan.
	Emit EmitOptions `json:"emit"`
	// Paused, when true, makes the controller skip reconciliation.
	Paused bool `json:"paused,omitempty"`
}

type ClusterScanStatus struct {
	// Phase is the current reconciliation phase.
	Phase string `json:"phase,omitempty"`
	// LastScanID is the most recently completed scan identifier.
	LastScanID string `json:"lastScanID,omitempty"`
	// LastScanTime is when the most recent successful scan completed.
	LastScanTime *time.Time `json:"lastScanTime,omitempty"`
	// NextScanTime is when the controller intends to run the next scan.
	NextScanTime *time.Time `json:"nextScanTime,omitempty"`
	// ObservedScore is the fleet score from the most recent scan.
	ObservedScore int `json:"observedScore,omitempty"`
	// ObservedGrade is the letter grade from the most recent scan.
	ObservedGrade string `json:"observedGrade,omitempty"`
	// ObservedCritical is the count of critical findings.
	ObservedCritical int `json:"observedCritical,omitempty"`
	// ObservedWarning is the count of warning findings.
	ObservedWarning int `json:"observedWarning,omitempty"`
	// ObservedClusters is the number of clusters that returned data.
	ObservedClusters int `json:"observedClusters,omitempty"`
	// ObservedGeneration is the resource generation this status was computed from.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// ConsecutiveFailures counts scans that failed since the last success. It sets the retry delay.
	ConsecutiveFailures int `json:"consecutiveFailures,omitempty"`
	// Message is a human-readable summary of the last reconciliation.
	Message string `json:"message,omitempty"`
	// Conditions are the Ready, Scanning, and Failed status conditions.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type Config struct {
	// Dynamic is the in-cluster dynamic client used to watch ClusterScans.
	Dynamic dynamic.Interface
	// Namespace, when non-empty, restricts the controller to one namespace.
	// Empty watches all namespaces (requires cluster-wide RBAC).
	Namespace string
	// Runner executes scans on the controller's behalf.
	Runner ScanRunner
	// Log is the structured logger.
	Log *zap.Logger
	// PollInterval is how often cached ClusterScans are re-enqueued to check
	// for due scans. Defaults to 15s when zero.
	PollInterval time.Duration
	// Recorder receives the Kubernetes Events the controller emits. When nil, Run builds one
	// on Events, and when both are nil Events are dropped.
	Recorder record.EventRecorder
	// Events is the core client Run uses to build an event recorder when Recorder is nil.
	Events typedcorev1.EventsGetter
}

type Controller struct {
	// contains filtered or unexported fields
}

type EmitOptions struct {
	// FleetDriftReport emits FleetDriftReport YAMLs to the configured directory.
	FleetDriftReport bool `json:"fleetDriftReport,omitempty"`
	// PolicyReport emits wgpolicyk8s.io PolicyReports to the configured directory.
	PolicyReport bool `json:"policyReport,omitempty"`
	// Slack delivers new critical findings to the configured webhook URL.
	Slack bool `json:"slack,omitempty"`
}

type ScanOptions struct {
	// Contexts is the kubeconfig context names to scan.
	Contexts []string
	// Group, when non-empty, supersedes Contexts: members of that group are scanned.
	Group string
	// Scanners restricts the scan to the named scanners. Empty runs all.
	Scanners []string
	// Emit selects which sinks receive outputs.
	Emit EmitOptions
	// ResourceName is the name of the originating ClusterScan, used for logging.
	ResourceName string
}

type ScanRunner interface {
	// ScanOnce executes one scan with the given options and returns the summary.
	// Implementations must be safe to call concurrently from multiple goroutines.
	ScanOnce(ctx context.Context, opts ScanOptions) (ScanSummary, error)
}

type ScanSummary struct {
	// ScanID is the persistent scan record identifier.
	ScanID string
	// Score is the fleet score (0-100).
	Score int
	// Grade is the letter grade (A-F).
	Grade string
	// Critical is the count of critical findings.
	Critical int
	// Warning is the count of warning findings.
	Warning int
	// Clusters is the number of clusters that produced data.
	Clusters int
}