webhook

type Component struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Port is the HTTPS port for the webhook server.
	// Default: 9443
	Port int

	// Path is the URL path for validation requests.
	// Default: "/validate"
	Path string

	// CertDir, when set, is a directory containing tls.crt and tls.key
	// (typically the mounted webhook-cert Secret). The server reads them
	// per-handshake and hot-reloads a rotated certificate without a restart.
	// Takes precedence over CertPEM/KeyPEM; production uses this path.
	CertDir string

	// CertPEM is the PEM-encoded TLS certificate.
	// Used when CertDir is unset (e.g. tests pass certs directly).
	CertPEM []byte

	// KeyPEM is the PEM-encoded TLS private key.
	// Used when CertDir is unset.
	KeyPEM []byte

	// Rules defines which resources the webhook validates.
	// Used for registering validators by GVK.
	Rules []WebhookRule

	// DryRunValidator performs dry-run validation of resources.
	// Required when Rules is non-empty.
	DryRunValidator DryRunValidator

	// ResourceAdmissionTimeout bounds watched-resource dry-run validation.
	// Default: 9s. Keep it below the corresponding Kubernetes webhook
	// timeoutSeconds value so the controller can return a structured decision.
	ResourceAdmissionTimeout time.Duration

	// Server is a caller-owned listener; the component replaces only its validator generation.
	Server *webhook.Server

	// OnGenerationRetired releases resources captured by the installed table.
	OnGenerationRetired func()
}

type DryRunValidator interface {
	ValidateDirect(ctx context.Context, gvk, namespace, name string, object, oldObject any, operation string) (allowed bool, reason string, warnings []string)
}

type MetricsRecorder interface {
	RecordWebhookRequest(gvk, result string, durationSeconds float64)
	RecordWebhookValidation(gvk, result string)
}

type WebhookRule struct {
	// APIGroup that this rule matches.
	// Example: "networking.k8s.io"
	APIGroup string

	// APIVersion that this rule matches.
	// Example: "v1"
	APIVersion string

	// Resource that this rule matches (plural, lowercase).
	// Example: "ingresses"
	Resource string
}