cert

type CAArtifacts struct {
	Cert    *x509.Certificate
	Key     *ecdsa.PrivateKey
	CertPEM []byte
	KeyPEM  []byte
}

type CertRotator struct {
	Client   client.Client
	Recorder record.EventRecorder
	Options  Options
}

type Options struct {
	// Required fields.
	Namespace        string
	CASecretName     string
	ServerSecretName string
	ServiceName      string

	// Owner is an optional Kubernetes object to set as the controller owner reference
	// on the generated secrets. When set, secrets are garbage-collected if the owner
	// is deleted. When nil, secrets are created without an owner reference.
	Owner client.Object

	// CertDir is the directory where the server cert is expected on disk.
	// Only used when WaitForProjection is true.
	CertDir string

	// RotationInterval is how often the background rotation loop runs.
	// Defaults to 1 hour.
	RotationInterval time.Duration

	// ComponentName is used in event messages (e.g., "Generated new <ComponentName> server certificate").
	// Defaults to "cert".
	ComponentName string

	// Organization overrides the certificate Organization field.
	// Defaults to the package-level Organization constant ("Multigres Operator").
	Organization string

	// AdditionalDNSNames are extra DNS SANs appended to the auto-generated
	// service DNS names (<svc>.<ns>.svc, <svc>.<ns>.svc.cluster.local).
	AdditionalDNSNames []string

	// ExtKeyUsages overrides the extended key usages for generated server certificates.
	// Defaults to [x509.ExtKeyUsageServerAuth].
	ExtKeyUsages []x509.ExtKeyUsage

	// WaitForProjection controls whether Bootstrap blocks until the cert file
	// appears on disk matching the Secret content. Set to true when using
	// Kubelet projected volumes (e.g., webhook servers).
	WaitForProjection bool

	// PostReconcileHook is called after the CA and server cert have been ensured.
	// Receives the CA bundle PEM bytes. Use this for consumer-specific tasks
	// like patching webhook configurations with the CA bundle.
	// If nil, no hook is called.
	PostReconcileHook func(ctx context.Context, caBundle []byte) error

	// Labels are applied to generated Secret objects. This is required when
	// secrets are created outside the operator namespace, because the informer
	// cache filters secrets by label (e.g., managed-by) in non-operator namespaces.
	// Without the correct labels, secrets are invisible to the cached client,
	// causing Get to return NotFound even after Create succeeds.
	Labels map[string]string
}

type ServerArtifacts struct {
	CertPEM []byte
	KeyPEM  []byte
}

type ServerCertOption func(*serverCertConfig)