graph

type BackendRef struct {
	// BackendTLSPolicy is the BackendTLSPolicy of the Service which is referenced by the backendRef.
	BackendTLSPolicy *BackendTLSPolicy
	// InvalidForGateways is a map of Gateways for which this BackendRef is invalid for, with the corresponding
	// condition. Certain NginxProxy configurations may result in a backend not being valid for some Gateways,
	// but not others.
	InvalidForGateways map[types.NamespacedName]conditions.Condition
	// SvcNsName is the NamespacedName of the Service referenced by the backendRef.
	SvcNsName types.NamespacedName
	// ServicePort is the ServicePort of the Service which is referenced by the backendRef.
	ServicePort v1.ServicePort
	// Weight is the weight of the backendRef.
	Weight int32
	// Valid indicates whether the backendRef is valid.
	// No configuration should be generated for an invalid BackendRef.
	Valid bool
	// IsMirrorBackend indicates whether the BackendGroup is for a mirrored backend.
	IsMirrorBackend bool
}

type BackendTLSPolicy struct {
	// Source is the source resource.
	Source *v1alpha3.BackendTLSPolicy
	// CaCertRef is the name of the ConfigMap that contains the CA certificate.
	CaCertRef types.NamespacedName
	// Gateways are the names of the Gateways that are being checked for this BackendTLSPolicy.
	Gateways []types.NamespacedName
	// Conditions include Conditions for the BackendTLSPolicy.
	Conditions []conditions.Condition
	// Valid shows whether the BackendTLSPolicy is valid.
	Valid bool
	// IsReferenced shows whether the BackendTLSPolicy is referenced by a BackendRef.
	IsReferenced bool
	// Ignored shows whether the BackendTLSPolicy is ignored.
	Ignored bool
}

type CaCertConfigMap struct {
	// Source holds the actual ConfigMap resource. Can be nil if the ConfigMap does not exist.
	Source     *apiv1.ConfigMap
	CertBundle *CertificateBundle
}

type Certificate struct {
	// TLSCert is the SSL certificate used to send to CA.
	TLSCert []byte
	// TLSPrivateKey is the cryptographic key for encrpyting traffic during secure TLS.
	TLSPrivateKey []byte
	// CACert is the root certificate authority.
	CACert []byte
}

type CertificateBundle struct {
	Cert *Certificate

	Name types.NamespacedName
	Kind v1.Kind
}

type ClusterState struct {
	GatewayClasses     map[types.NamespacedName]*gatewayv1.GatewayClass
	Gateways           map[types.NamespacedName]*gatewayv1.Gateway
	HTTPRoutes         map[types.NamespacedName]*gatewayv1.HTTPRoute
	TLSRoutes          map[types.NamespacedName]*v1alpha2.TLSRoute
	Services           map[types.NamespacedName]*v1.Service
	Namespaces         map[types.NamespacedName]*v1.Namespace
	ReferenceGrants    map[types.NamespacedName]*v1beta1.ReferenceGrant
	Secrets            map[types.NamespacedName]*v1.Secret
	CRDMetadata        map[types.NamespacedName]*metav1.PartialObjectMetadata
	BackendTLSPolicies map[types.NamespacedName]*v1alpha3.BackendTLSPolicy
	ConfigMaps         map[types.NamespacedName]*v1.ConfigMap
	NginxProxies       map[types.NamespacedName]*ngfAPIv1alpha2.NginxProxy
	GRPCRoutes         map[types.NamespacedName]*gatewayv1.GRPCRoute
	NGFPolicies        map[PolicyKey]policies.Policy
	SnippetsFilters    map[types.NamespacedName]*ngfAPIv1alpha1.SnippetsFilter
}

type EffectiveNginxProxy ngfAPIv1alpha2.NginxProxySpec

type ExtensionRefFilter struct {
	// SnippetsFilter contains the SnippetsFilter. Will be non-nil if the Ref.Kind is SnippetsFilter and the
	// SnippetsFilter exists.
	// Once we support more filters, we can extend this struct with more filter kinds.
	SnippetsFilter *SnippetsFilter
	// Valid indicates whether the filter is valid.
	Valid bool
}

type Filter struct {
	// RequestHeaderModifier holds an HTTP Request Header Modifier filter.
	// Will be non-nil if FilterType is FilterRequestHeaderModifier.
	// Can be set on GRPCRoutes and HTTPRoutes.
	RequestHeaderModifier *v1.HTTPHeaderFilter
	// ResponseHeaderModifier holds an HTTP Response Header Modifier filter.
	// Will be non-nil if FilterType is FilterResponseHeaderModifier.
	// Can be set on GRPCRoutes and HTTPRoutes.
	ResponseHeaderModifier *v1.HTTPHeaderFilter
	// RequestRedirect holds an HTTP Request Redirect filter.
	// Will be non-nil if FilterType is FilterRequestRedirect.
	// Can be set on HTTPRoutes only.
	RequestRedirect *v1.HTTPRequestRedirectFilter
	// URLRewrite holds an HTTP URL Rewrite filter.
	// Will be non-nil if FilterType is FilterURLRewrite.
	// Can be set on HTTPRoutes only.
	URLRewrite *v1.HTTPURLRewriteFilter
	// RequestMirror holds an HTTP Request Mirror filter.
	// Will be non-nil if FilterType is FilterRequestMirror.
	// Can be set on GRPCRoutes and HTTPRoutes.
	RequestMirror *v1.HTTPRequestMirrorFilter
	// ExtensionRef holds an Extension Ref filter.
	// Will be non-nil if FilterType is FilterExtensionRef.
	// Can be set on GRPCRoutes and HTTPRoutes.
	ExtensionRef *v1.LocalObjectReference
	// ResolvedExtensionRef holds the filter that the Extension Ref points to.
	// Will be non-nil if the Extension Ref is non-nil and was resolved successfully.
	// Can be set on GRPCRoutes and HTTPRoutes.
	ResolvedExtensionRef *ExtensionRefFilter
	// RouteType is the type of Route that this filter is on.
	RouteType RouteType
	// FilterType is the type of filter.
	FilterType FilterType
}

type FilterType string

type Gateway struct {
	// LatestReloadResult is the result of the last nginx reload attempt.
	LatestReloadResult NginxReloadResult
	// Source is the corresponding Gateway resource.
	Source *v1.Gateway
	// NginxProxy is the NginxProxy referenced by this Gateway.
	NginxProxy *NginxProxy
	// EffectiveNginxProxy holds the result of merging the NginxProxySpec on this resource with the NginxProxySpec on
	// the GatewayClass resource. This is the effective set of config that should be applied to the Gateway.
	// If non-nil, then this config is valid.
	EffectiveNginxProxy *EffectiveNginxProxy
	// DeploymentName is the name of the nginx Deployment associated with this Gateway.
	DeploymentName types.NamespacedName
	// Listeners include the listeners of the Gateway.
	Listeners []*Listener
	// Conditions holds the conditions for the Gateway.
	Conditions []conditions.Condition
	// Policies holds the policies attached to the Gateway.
	Policies []*Policy
	// Valid indicates whether the Gateway Spec is valid.
	Valid bool
}

type GatewayClass struct {
	// Source is the source resource.
	Source *v1.GatewayClass
	// NginxProxy is the NginxProxy resource referenced by this GatewayClass.
	NginxProxy *NginxProxy
	// Conditions include Conditions for the GatewayClass.
	Conditions []conditions.Condition
	// Valid shows whether the GatewayClass is valid.
	Valid bool
}

type Graph struct {
	// GatewayClass holds the GatewayClass resource.
	GatewayClass *GatewayClass
	// Gateways holds the all Gateway resource.
	Gateways map[types.NamespacedName]*Gateway
	// IgnoredGatewayClasses holds the ignored GatewayClass resources, which reference NGINX Gateway Fabric in the
	// controllerName, but are not configured via the NGINX Gateway Fabric CLI argument. It doesn't hold the GatewayClass
	// resources that do not belong to the NGINX Gateway Fabric.
	IgnoredGatewayClasses map[types.NamespacedName]*gatewayv1.GatewayClass
	// Routes hold Route resources.
	Routes map[RouteKey]*L7Route
	// L4Routes hold L4Route resources.
	L4Routes map[L4RouteKey]*L4Route
	// ReferencedSecrets includes Secrets referenced by Gateway Listeners or BackendTLSPolicies, including invalid ones.
	// It is different from the other maps, because it includes entries for Secrets that do not exist
	// in the cluster. We need such entries so that we can query the Graph to determine if a Secret is referenced
	// by the Gateway, including the case when the Secret is newly created.
	ReferencedSecrets map[types.NamespacedName]*Secret
	// ReferencedNamespaces includes Namespaces with labels that match the Gateway Listener's label selector.
	ReferencedNamespaces map[types.NamespacedName]*v1.Namespace
	// ReferencedServices includes the NamespacedNames of all the Services that are referenced by at least one Route.
	ReferencedServices map[types.NamespacedName]*ReferencedService
	// ReferencedCaCertConfigMaps includes ConfigMaps that have been referenced by any BackendTLSPolicies.
	ReferencedCaCertConfigMaps map[types.NamespacedName]*CaCertConfigMap
	// ReferencedNginxProxies includes NginxProxies that have been referenced by a GatewayClass or a Gateway.
	ReferencedNginxProxies map[types.NamespacedName]*NginxProxy
	// BackendTLSPolicies holds BackendTLSPolicy resources.
	BackendTLSPolicies map[types.NamespacedName]*BackendTLSPolicy
	// NGFPolicies holds all NGF Policies.
	NGFPolicies map[PolicyKey]*Policy
	// SnippetsFilters holds all the SnippetsFilters.
	SnippetsFilters map[types.NamespacedName]*SnippetsFilter
	// PlusSecrets holds the secrets related to NGINX Plus licensing.
	PlusSecrets map[types.NamespacedName][]PlusSecretFile
}

type L4Route struct {
	// Source is the source Gateway API object of the Route.
	Source client.Object
	// ParentRefs describe the references to the parents in a Route.
	ParentRefs []ParentRef
	// Conditions define the conditions to be reported in the status of the Route.
	Conditions []conditions.Condition
	// Spec is the L4RouteSpec of the Route
	Spec L4RouteSpec
	// Valid indicates if the Route is valid.
	Valid bool
	// Attachable indicates if the Route is attachable to any Listener.
	Attachable bool
}

type L4RouteKey struct {
	// NamespacedName is the NamespacedName of the Route.
	NamespacedName types.NamespacedName
}

type L4RouteSpec struct {
	// Hostnames defines a set of hostnames used to select a Route used to process the request.
	Hostnames []v1.Hostname
	// FIXME (sarthyparty): change to slice of BackendRef, as for now we are only supporting one BackendRef.
	// We will eventually support multiple BackendRef https://github.com/nginx/nginx-gateway-fabric/issues/2184
	BackendRef BackendRef
}

type L7Route struct {
	// Source is the source Gateway API object of the Route.
	Source client.Object
	// RouteType is the type (http or grpc) of the Route.
	RouteType RouteType
	// Spec is the L7RouteSpec of the Route
	Spec L7RouteSpec
	// ParentRefs describe the references to the parents in a Route.
	ParentRefs []ParentRef
	// Conditions define the conditions to be reported in the status of the Route.
	Conditions []conditions.Condition
	// Policies holds the policies that are attached to the Route.
	Policies []*Policy
	// Valid indicates if the Route is valid.
	Valid bool
	// Attachable indicates if the Route is attachable to any Listener.
	Attachable bool
}

type L7RouteSpec struct {
	// Hostnames defines a set of hostnames used to select a Route used to process the request.
	Hostnames []v1.Hostname
	// Rules are the list of HTTP matchers, filters and actions.
	Rules []RouteRule
}

type Listener struct {
	Name string
	// GatewayName is the name of the Gateway resource this Listener belongs to.
	GatewayName types.NamespacedName
	// Source holds the source of the Listener from the Gateway resource.
	Source v1.Listener
	// Routes holds the GRPC/HTTPRoutes attached to the Listener.
	// Only valid routes are attached.
	Routes map[RouteKey]*L7Route
	// L4Routes holds the TLSRoutes attached to the Listener.
	L4Routes map[L4RouteKey]*L4Route
	// AllowedRouteLabelSelector is the label selector for this Listener's allowed routes, if defined.
	AllowedRouteLabelSelector labels.Selector
	// ResolvedSecret is the namespaced name of the Secret resolved for this listener.
	// Only applicable for HTTPS listeners.
	ResolvedSecret *types.NamespacedName
	// Conditions holds the conditions of the Listener.
	Conditions []conditions.Condition
	// SupportedKinds is the list of RouteGroupKinds allowed by the listener.
	SupportedKinds []v1.RouteGroupKind
	// Valid shows whether the Listener is valid.
	// A Listener is considered valid if NGF can generate valid NGINX configuration for it.
	Valid bool
	// Attachable shows whether Routes can attach to the Listener.
	// Listener can be invalid but still attachable.
	Attachable bool
}

type NginxProxy struct {
	// Source is the source resource.
	Source *ngfAPIv1alpha2.NginxProxy
	// ErrMsgs contains the validation errors if they exist, to be included in the GatewayClass condition.
	ErrMsgs field.ErrorList
	// Valid shows whether the NginxProxy is valid.
	Valid bool
}

type NginxReloadResult struct {
	// Error is the error that occurred during the reload.
	Error error
}

type ParentRef struct {
	// Attachment is the attachment status of the ParentRef. It could be nil. In that case, NGF didn't attempt to
	// attach because of problems with the Route.
	Attachment *ParentRefAttachmentStatus
	// SectionName is the name of a section within the target Gateway.
	SectionName *v1.SectionName
	// Port is the network port this Route targets.
	Port *v1.PortNumber
	// Gateway is the metadata about the parent Gateway.
	Gateway *ParentRefGateway
	// Idx is the index of the corresponding ParentReference in the Route.
	Idx int
}

type ParentRefAttachmentStatus struct {
	// AcceptedHostnames is an intersection between the hostnames supported by an attached Listener
	// and the hostnames from this Route. Key is <gatewayNamespacedName/listenerName>, value is list of hostnames.
	AcceptedHostnames map[string][]string
	// FailedConditions are the conditions that describe why the ParentRef is not attached to the Gateway, or other
	// failures that may lead to partial attachments. For example, a backendRef could be invalid, but the route can
	// still attach. The backendRef condition would be displayed here.
	FailedConditions []conditions.Condition
	// ListenerPort is the port on the Listener that the Route is attached to.
	ListenerPort v1.PortNumber
	// Attached indicates if the ParentRef is attached to the Gateway.
	Attached bool
}

type ParentRefGateway struct {
	EffectiveNginxProxy *EffectiveNginxProxy
	NamespacedName      types.NamespacedName
}

type PlusSecretFile struct {
	// FieldName is the field name within the Secret that holds the data for this file.
	FieldName string
	// Content is the content of this file.
	Content []byte
	// Type is the type of Secret file.
	Type SecretFileType
}

type Policy struct {
	// Source is the corresponding Policy resource.
	Source policies.Policy
	// InvalidForGateways is a map of Gateways for which this Policy is invalid for. Certain NginxProxy
	// configurations may result in a policy not being valid for some Gateways, but not others.
	InvalidForGateways map[types.NamespacedName]struct{}
	// Ancestors is a list of ancestor objects of the Policy. Used in status.
	Ancestors []PolicyAncestor
	// TargetRefs are the resources that the Policy targets.
	TargetRefs []PolicyTargetRef
	// Conditions holds the conditions for the Policy.
	// These conditions apply to the entire Policy.
	// The conditions in the Ancestor apply only to the Policy in regard to the Ancestor.
	Conditions []conditions.Condition
	// Valid indicates whether the Policy is valid.
	Valid bool
}

type PolicyAncestor struct {
	// Ancestor is the ancestor object.
	Ancestor v1.ParentReference
	// Conditions contains the list of conditions of the Policy in relation to the ancestor.
	Conditions []conditions.Condition
}

type PolicyKey struct {
	// Nsname is the NamespacedName of the Policy.
	NsName types.NamespacedName
	// GVK is the GroupVersionKind of the Policy.
	GVK schema.GroupVersionKind
}

type PolicyTargetRef struct {
	// Kind is the Kind of the object.
	Kind v1.Kind
	// Group is the Group of the object.
	Group v1.Group
	// Nsname is the NamespacedName of the object.
	Nsname types.NamespacedName
}

type ProtectedPorts map[int32]string

type ReferencedService struct {
	// GatewayNsNames are all the Gateways that this Service indirectly attaches to through a Route.
	GatewayNsNames map[types.NamespacedName]struct{}
	// Policies is a list of NGF Policies that target this Service.
	Policies []*Policy
}

type RouteBackendRef struct {
	// If this backend is defined in a RequestMirror filter, this value will indicate the filter's index.
	MirrorBackendIdx *int

	v1.BackendRef
	Filters []any
}

type RouteKey struct {
	// NamespacedName is the NamespacedName of the Route.
	NamespacedName types.NamespacedName
	// RouteType is the type of the Route.
	RouteType RouteType
}

type RouteRule struct {
	// Matches define the predicate used to match requests to a given action.
	Matches []v1.HTTPRouteMatch
	// RouteBackendRefs are a wrapper for v1.BackendRef and any BackendRef filters from the HTTPRoute or GRPCRoute.
	RouteBackendRefs []RouteBackendRef
	// BackendRefs is an internal representation of a backendRef in a Route.
	BackendRefs []BackendRef
	// Filters define processing steps that must be completed during the request or response lifecycle.
	Filters RouteRuleFilters
	// ValidMatches indicates if the matches are valid and accepted by the Route.
	ValidMatches bool
}

type RouteRuleFilters struct {
	// Filters are the filters in the RouteRule.
	Filters []Filter
	// Valid indicates if the filters are valid and accepted by the Route.
	Valid bool
}

type RouteType string

type Secret struct {
	// Source holds the actual Secret resource. Can be nil if the Secret does not exist.
	Source *apiv1.Secret

	// CertBundle holds actual certificate data.
	CertBundle *CertificateBundle
}

type SecretFileType int

type SnippetsFilter struct {
	// Source is the SnippetsFilter.
	Source *ngfAPI.SnippetsFilter
	// Snippets stored as a map of nginx context to snippet value.
	Snippets map[ngfAPI.NginxContext]string
	// Conditions define the conditions to be reported in the status of the SnippetsFilter.
	Conditions []conditions.Condition
	// Valid indicates whether the SnippetsFilter is semantically and syntactically valid.
	Valid bool
	// Referenced indicates whether the SnippetsFilter is referenced by a Route.
	Referenced bool
}