podbuilder

type PodConfig struct {

	// PodName is set for AgentRun pods (e.g. "agentorca-run-<name>").
	// Empty for Deployment templates and warm pods that use GenerateName.
	PodName string
	// GenerateName is set for warm pods (e.g. "warm-<deploy>-").
	// Mutually exclusive with PodName.
	GenerateName string
	Namespace    string
	Labels       map[string]string
	Annotations  map[string]string

	// Agent is the Agent CRD that defines the runtime image, framework, tools, etc.
	Agent *agentorcav1alpha1.Agent
	// AgentEnv holds caller-specific env vars (e.g. AGENTORC_RUN_ID for runs,
	// AGENTORC_AGENT for deployments). FrameworkEnvVars are appended automatically.
	AgentEnv []corev1.EnvVar
	// TokenSecretName is the Secret containing OPENAI_BASE_URL and OPENAI_API_KEY,
	// injected via EnvFrom on the agent container.
	TokenSecretName string

	ServiceAccount string
	RestartPolicy  corev1.RestartPolicy // Never (runs/warm) or Always (deployments)

	ModelRouterImage string
	// RouterConfigName is the ConfigMap name containing the router config JSON.
	RouterConfigName string
	// RedisSecretName is the Secret holding the Redis password, mounted read-only
	// at RedisPasswordFile in the model-router container only. Empty when Redis
	// needs no password.
	RedisSecretName string
	// RouterExtraPorts are additional ports on the model-router container
	// (e.g. warm-mgmt:9090 for warm pods).
	RouterExtraPorts []corev1.ContainerPort
	// RouterProbePort is the port for the model-router startup probe.
	// Defaults to 8080 if zero.
	RouterProbePort int
	// RouterResources overrides the default model-router resource requirements.
	// If nil, DefaultRouterResources is used.
	RouterResources *corev1.ResourceRequirements
	// WebhookNotifySecretRef, when set, mounts the referenced Secret key as the
	// WEBHOOK_URL env var into the model-router sidecar so the _webhook_notify
	// builtin tool can POST to a Slack incoming webhook. Not mounted to the agent
	// container. +optional
	WebhookNotifySecretRef *corev1.SecretKeySelector

	// HindsightURL is the configured hindsight API endpoint (e.g. http://hindsight.local).
	// Used to generate ipBlock egress rules in the per-run NetworkPolicies when the cluster has a default-deny egress policy.
	HindsightURL string

	// HindsightAPIKeySecretRef, when set, injects the hindsight API key into the
	// model-router container as HINDSIGHT_API_KEY so it can authenticate to a
	// hindsight API that requires a tenant API key. Never mounted to the agent
	// container. +optional
	HindsightAPIKeySecretRef *corev1.SecretKeySelector

	// AgentReadinessProbe is set for http-mode AgentRun pods.
	// If nil, no readiness probe is added to the agent container.
	AgentReadinessProbe *corev1.Probe

	ProviderVolumes   []corev1.Volume
	ProviderMounts    []corev1.VolumeMount
	ToolSecretVolumes []corev1.Volume
	ToolSecretMounts  []corev1.VolumeMount
	MCPBinVolumes     []corev1.Volume
	MCPBinMounts      []corev1.VolumeMount

	// AgentSecretVolumes and AgentSecretMounts carry secrets referenced by
	// Agent.spec.runtime.secretRefs. They are mounted into the agent container only
	// (not the model-router sidecar). Use ResolveAgentSecretRefs to build them.
	AgentSecretVolumes []corev1.Volume
	AgentSecretMounts  []corev1.VolumeMount

	// WarmLocalCacheEnabled attaches a disk-backed emptyDir to the model-router
	// sidecar as a local checkpoint cache that supplements Redis. Only set true
	// for warm pods (buildWarmPod); one-shot AgentRun pods leave it false so their
	// specs are unchanged.
	WarmLocalCacheEnabled bool
	// WarmLocalCacheSizeLimit is the SizeLimit for the warm-cache emptyDir.
	// May be nil for "no limit" (bounded by node ephemeral storage).
	WarmLocalCacheSizeLimit *resource.Quantity

	// RouterBaseURL is the base URL the agent uses to reach the model-router.
	// Defaults to "http://localhost:8080" when empty (combined-pod sidecar topology).
	// Set to the router Service URL (e.g. "http://agentorca-router-<run>.<ns>:8080") in
	// split-pod topology so framework env vars point at the correct endpoint.
	RouterBaseURL string

	// CloudProvider is used for Azure Workload Identity pod labeling.
	CloudProvider security.CloudProvider
}