relay

type AWSDriver struct {
	// contains filtered or unexported fields
}

type CloudInitConfig struct {
	// UpstreamURL is the LLM provider endpoint to proxy to.
	UpstreamURL string
	// Token is the per-VM shared-secret the relay-router presents in the
	// X-Relay-Token header. The VM's relay-proxy rejects any request without
	// a constant-time-matching token. Generated by the controller per provider
	// slot and persisted in the relay-vm-tokens Secret.
	Token string
	// ArtifactURLs are the base mirror URLs the VM downloads the relay-proxy
	// binary from. The cloud-init appends "/<binary>" where <binary> is the
	// arch-resolved name (relay-proxy-arm64 / relay-proxy-amd64) and tries
	// each mirror in order. The controller embeds these at render time —
	// typically a GitHub Release URL plus optional object-storage mirrors.
	// Required: without an artifact URL the systemd unit references a binary
	// that can never arrive on the VM.
	ArtifactURLs []string
	// ArtifactSHA256 is the hex SHA-256 of the relay-proxy binary for the
	// VM's architecture. The cloud-init verifies the downloaded binary
	// against this checksum before exec (security doc §7: supply-chain
	// integrity). Required: downloading without verification is rejected.
	ArtifactSHA256 string
	// BinaryName is the arch-resolved artifact name (relay-proxy-arm64 or
	// relay-proxy-amd64). The controller resolves this from the VM shape via
	// archForShape so the cloud-init downloads the matching binary.
	BinaryName string
}

type HealthChecker struct {
	// contains filtered or unexported fields
}

type HealthReport struct {
	Relays         map[string]*RelayHealth
	FallbackActive bool
}

type InferenceRelayReconciler struct {
	client.Client
	Scheme *runtime.Scheme

	// Namespace is the controller's namespace (for ConfigMaps, Secrets).
	Namespace string

	// HealthChecker scrapes the relay-router /metrics endpoint.
	HealthChecker *HealthChecker

	// Drivers map provider name → driver implementation.
	Drivers map[string]ProviderDriver

	// ExpectedCredentialSecrets maps provider name → the K8s Secret name
	// the driver reads credentials from. The reconciler validates that
	// spec.providers[].credentialsRef.Name matches this value.
	ExpectedCredentialSecrets map[string]string

	// ArtifactURLs are the base mirror URLs the controller embeds into each
	// relay VM's cloud-init so it can download the relay-proxy binary. Set
	// via the --relay-artifact-url controller flag (comma-separated), sourced
	// from the operator's Helm values. The cloud-init appends "/<binary>"
	// (arch-resolved) and tries each mirror in order.
	ArtifactURLs []string

	// ArtifactSHA256Arm64 is the hex SHA-256 of the arm64 relay-proxy binary.
	// Required when provisioning any arm64 shape (AWS t4g, OCI A1).
	ArtifactSHA256Arm64 string

	// ArtifactSHA256Amd64 is the hex SHA-256 of the amd64 relay-proxy binary.
	// Required when provisioning any amd64 shape (GCP e2, AWS t3).
	ArtifactSHA256Amd64 string
}

type OCIDriver struct {
	// contains filtered or unexported fields
}

type OrphanDetector struct {
	Client   client.Client
	Drivers  map[string]ProviderDriver
	Interval time.Duration

	// Regions enumerates the regions the detector should sweep per
	// driver, in addition to whatever regions are referenced by
	// active InferenceRelay CRs at sweep time. Set explicitly only
	// if you need to sweep regions that no current CR uses (e.g.
	// clean up after a region was removed from the spec).
	Regions []string
}

type PeerConfig struct {
	Relays []PeerEntry `json:"relays"`
}

type PeerEntry struct {
	ID       string `json:"id"`
	Endpoint string `json:"endpoint"`
	Provider string `json:"provider"`
	State    string `json:"state"`
	Token    string `json:"token"`
}

type ProviderDriver interface {
	// Provision creates a relay VM with the given cloud-init userdata
	// and returns the instance ID and public IP.
	Provision(ctx context.Context, req ProvisionRequest) (*ProvisionResult, error)

	// Destroy terminates a relay VM.
	Destroy(ctx context.Context, instanceID, region string) error

	// GetStatus returns the current VM state and public IP.
	GetStatus(ctx context.Context, instanceID, region string) (*VMStatus, error)

	// ListInstances returns relay VMs managed by this driver.
	ListInstances(ctx context.Context, region string) ([]VMInstance, error)
}

type ProvisionRequest struct {
	Name      string
	Region    string
	Shape     string
	CloudInit string

	// OwnerUID is the InferenceRelay CR's UID. Drivers MUST tag the
	// provisioned VM with this value so it can be adopted by the
	// reconciler if a Status update is lost mid-provisioning (the
	// classic K8s controller leak — provisioning side-effect committed
	// but Status persistence failed). Empty OwnerUID disables tagging
	// and the leak-protection guarantee. See worklog 0473/0474.
	OwnerUID string

	// Provider identifies which provider slot this VM serves
	// (e.g. "aws"). Drivers MUST tag the VM with this value so the
	// reconciler can adopt the right slot when multiple providers
	// share the same OwnerUID.
	Provider string
}

type ProvisionResult struct {
	InstanceID string
	PublicIP   string
}

type RelayHealth struct {
	ID            string
	Healthy       bool
	ActiveStreams int64
	Requests      int64
	Requests429   int64
	EgressBytes   int64
}

type VMInstance struct {
	InstanceID string
	PublicIP   string
	State      VMState
	OwnerUID   string
	Provider   string
}

type VMState string

type VMStatus struct {
	InstanceID string
	State      VMState
	PublicIP   string
}