kms

type EncryptionStatusProvider interface {
	GetKMSEncryptionStatus(ctx context.Context) (*operatorv1.KMSEncryptionStatus, error)

	// ApplyKMSEncryptionStatus uses Server-Side Apply. Each caller owns only
	// the fields it explicitly sets, identified by fieldManager.
	ApplyKMSEncryptionStatus(ctx context.Context, fieldManager string, status *applyoperatorv1.KMSEncryptionStatusApplyConfiguration) error

	// UpdateKMSEncryptionStatus reads the current status, applies the mutation,
	// and writes it back. Implementations must retry on conflict (409).
	//
	// Note: use this instead of ApplyKMSEncryptionStatus when the controller is
	// the sole owner of a field. Apply requires re-sending every owned field on
	// every sync, omitting one causes the server to remove it, which is
	// cumbersome for a controller that only writes a field once.
	UpdateKMSEncryptionStatus(ctx context.Context, mutate func(*operatorv1.KMSEncryptionStatus)) error
}

type KMSPluginConfig struct {
	metav1.TypeMeta `json:",inline"`
	Type            KMSProviderType      `json:"type"`
	Vault           VaultKMSPluginConfig `json:"vault,omitempty,omitzero"`
}

type KMSProviderType string

type VaultAppRoleAuthentication struct {
	Secret VaultSecretReference `json:"secret,omitzero"`
}

type VaultAuthentication struct {
	Type    VaultAuthenticationType    `json:"type,omitempty"`
	AppRole VaultAppRoleAuthentication `json:"appRole,omitzero"`
}

type VaultAuthenticationType string

type VaultConfigMapReference struct {
	Name string `json:"name,omitempty"`
}

type VaultKMSPluginConfig struct {
	KMSPluginImage string `json:"kmsPluginImage,omitempty"`
	VaultAddress   string `json:"vaultAddress,omitempty"`

	VaultNamespace     string `json:"vaultNamespace,omitempty"`
	VaultAuthNamespace string `json:"vaultAuthNamespace,omitempty"`

	TLS            VaultTLSConfig      `json:"tls,omitzero"`
	Authentication VaultAuthentication `json:"authentication,omitzero"`

	VaultKeyPath string `json:"vaultKeyPath,omitempty"`
}

type VaultSecretReference struct {
	Name string `json:"name,omitempty"`
}

type VaultTLSConfig struct {
	CABundle   VaultConfigMapReference `json:"caBundle,omitzero"`
	ServerName string                  `json:"serverName,omitempty"`
}