health

type AdmissionRequest struct {
	// UID — must be echoed verbatim in the Response.UID.
	// The API server uses this to correlate requests and responses.
	UID string `json:"uid"`

	// Kind — the GVK of the object being admitted.
	Kind metav1.GroupVersionKind `json:"kind"`

	// Resource — the GVR of the object being admitted.
	Resource metav1.GroupVersionResource `json:"resource"`

	// Name — the name of the object. May be empty for CREATE operations
	// when the name is server-generated.
	Name string `json:"name,omitempty"`

	// Namespace — the namespace of the object. Empty for cluster-scoped resources.
	Namespace string `json:"namespace,omitempty"`

	// Operation — the operation being performed: CREATE, UPDATE, DELETE, or CONNECT.
	Operation string `json:"operation"`

	// Object — the full object being admitted, as raw JSON.
	// Present for CREATE and UPDATE operations.
	// For UPDATE, this is the new (incoming) version of the object.
	Object json.RawMessage `json:"object,omitempty"`

	// OldObject — the existing object, as raw JSON.
	// Present for UPDATE and DELETE operations.
	OldObject json.RawMessage `json:"oldObject,omitempty"`

	// DryRun — true when the operation is a dry run (kubectl apply --dry-run=server).
	// Orkestra should evaluate rules but return allowed: true without side effects.
	DryRun *bool `json:"dryRun,omitempty"`
}

type AdmissionResponse struct {
	// UID — must exactly match AdmissionRequest.UID.
	UID string `json:"uid"`

	// Allowed — true when the operation should proceed, false to reject.
	// For validation webhooks: false causes kubectl to show the Status message.
	// For mutation webhooks: should always be true (mutation doesn't reject).
	Allowed bool `json:"allowed"`

	// Status — populated when Allowed is false. Shown to the user as the
	// rejection reason. Code should be 400 for validation failures.
	Status *AdmissionStatus `json:"status,omitempty"`

	// Patch — JSON patch (RFC 6902) to apply to the object.
	// Only meaningful for mutation webhooks.
	// Must be base64-encoded. PatchType must be "JSONPatch" when set.
	Patch []byte `json:"patch,omitempty"`

	// PatchType — the type of patch. Always "JSONPatch" when Patch is set.
	PatchType *string `json:"patchType,omitempty"`

	// Warnings — strings shown to the user via kubectl as Warning: header lines.
	// Used by Orkestra for action: warn validation rules — the object is allowed
	// but the warnings surface in the user's terminal.
	// Supported by Kubernetes API server 1.19+.
	Warnings []string `json:"warnings,omitempty"`
}

type AdmissionReview struct {
	// TypeMeta mirrors metav1.TypeMeta — we inline it to avoid the import.
	APIVersion string `json:"apiVersion"`
	Kind       string `json:"kind"`

	// Request — populated by the API server. Contains the object being admitted.
	// Nil in the response direction.
	Request *AdmissionRequest `json:"request,omitempty"`

	// Response — populated by Orkestra. Must reference the same UID as Request.
	// Nil in the request direction.
	Response *AdmissionResponse `json:"response,omitempty"`
}

type AdmissionStats struct {

	// ── Validation counters ──────────────────────────────────────────────────
	ValidationTotal   int64 // total /validate calls
	ValidationAllowed int64 // allowed (no deny rules fired)
	ValidationDenied  int64 // denied (at least one deny rule fired)
	ValidationWarned  int64 // allowed with warnings (warn rules fired, no deny)

	// ── Mutation counters ────────────────────────────────────────────────────
	MutationTotal   int64 // total /mutate calls
	MutationApplied int64 // at least one rule produced a change
	MutationSkipped int64 // no rules produced changes — no-op
	// contains filtered or unexported fields
}

type AdmissionStatsSnapshot struct {
	// Validation
	ValidationTotal   int64   `json:"validationTotal"`
	ValidationAllowed int64   `json:"validationAllowed"`
	ValidationDenied  int64   `json:"validationDenied"`
	ValidationWarned  int64   `json:"validationWarned"`
	ValAvgLatencyMs   float64 `json:"valAvgLatencyMs"`
	ValP95LatencyMs   float64 `json:"valP95LatencyMs"`
	ValMaxLatencyMs   float64 `json:"valMaxLatencyMs"`

	// Mutation
	MutationTotal   int64   `json:"mutationTotal"`
	MutationApplied int64   `json:"mutationApplied"`
	MutationSkipped int64   `json:"mutationSkipped"`
	MutAvgLatencyMs float64 `json:"mutAvgLatencyMs"`
	MutP95LatencyMs float64 `json:"mutP95LatencyMs"`
	MutMaxLatencyMs float64 `json:"mutMaxLatencyMs"`

	// Whether admission webhooks are enabled
	WebhooksEnabled bool `json:"webhooksEnabled"`
}

type AdmissionStatus struct {
	// Message — the human-readable rejection message shown by kubectl.
	Message string `json:"message"`

	// Code — HTTP status code. Use 400 for validation failures.
	Code int32 `json:"code"`
}

type ConversionReview struct {
	APIVersion string                    `json:"apiVersion"`
	Kind       string                    `json:"kind"`
	Request    *ConversionReviewRequest  `json:"request,omitempty"`
	Response   *ConversionReviewResponse `json:"response,omitempty"`
}

type ConversionReviewRequest struct {
	UID               string            `json:"uid"`
	DesiredAPIVersion string            `json:"desiredAPIVersion"`
	Objects           []json.RawMessage `json:"objects"`
}

type ConversionReviewResponse struct {
	UID              string            `json:"uid"`
	ConvertedObjects []json.RawMessage `json:"convertedObjects"`
	Result           *Status           `json:"result"`
}

type ConversionStats struct {
	TotalRequests   int64
	SuccessRequests int64
	FailedRequests  int64
	// contains filtered or unexported fields
}

type ConversionStatsSnapshot struct {
	TotalRequests   int64
	SuccessRequests int64
	FailedRequests  int64
	AvgLatency      time.Duration
	P95Latency      time.Duration
	MaxLatency      time.Duration
	MinLatency      time.Duration
}

type DeletionProtectionStats struct {
	TotalRequests int64 // total DELETE admission reviews received
	Blocked       int64 // DELETE requests denied (CRD or deployment protected)
	Allowed       int64 // DELETE requests allowed through
	// contains filtered or unexported fields
}

type DeletionProtectionStatsSnapshot struct {
	TotalRequests int64 `json:"total"`
	Blocked       int64 `json:"blocked"`
	Allowed       int64 `json:"allowed"`
}

type HealthServer struct {
	// contains filtered or unexported fields
}

type JSONPatchOp struct {
	Op    string      `json:"op"`
	Path  string      `json:"path"`
	Value interface{} `json:"value,omitempty"`
}

type NamespaceProtectionStats struct {
	TotalRequests int64 // total CREATE/UPDATE admission reviews received
	Blocked       int64 // requests denied — namespace not in allowed set / in restricted set
	Allowed       int64 // requests allowed through
	// contains filtered or unexported fields
}

type NamespaceProtectionStatsSnapshot struct {
	TotalRequests int64 `json:"total"`
	Blocked       int64 `json:"blocked"`
	Allowed       int64 `json:"allowed"`
}

type NamespaceRules struct {
	Allowed    map[string]struct{}
	Restricted map[string]struct{}
}

type ProviderStatEntry struct {
	Provider  string
	Total     int64
	Errors    int64
	ErrorRate float64
}

type ProviderStats struct {
	// contains filtered or unexported fields
}

type Status struct {
	Status  string `json:"status"`
	Message string `json:"message,omitempty"`
}

type WebhookCleanupOptions struct {
	// contains filtered or unexported fields
}

type WebhookConfgurationOptions struct {
	WebhooksEnabled  bool   // admission (validation + mutation) enabled
	ConvEnabled      bool   // CRD conversion webhook enabled
	TLSCert          string // certificate used by the HTTPS server
	TLSKey           string // private key used by the HTTPS server
	ConversionWindow int    // rolling window for conversion statistics
}

type WebhookRegistrationOptions struct {
	// ServiceName — the name of the Kubernetes Service fronting Orkestra.
	// The API server calls this service to reach /validate and /mutate.
	// Default: "orkestra"
	ServiceName string

	// ServiceNamespace — the namespace where the Orkestra Service lives.
	// Default: read from ORKESTRA_NAMESPACE environment variable.
	ServiceNamespace string

	// Port — the HTTPS port. Must match the conversion server port.
	// Default: 8443
	Port int32

	// FailurePolicy — what the API server does if Orkestra is unreachable.
	// admissionv1.Ignore (default): allow the operation and continue.
	// admissionv1.Fail: reject the operation if Orkestra cannot be reached.
	// Configurable from WEBHOOK_FAILURE_POLICY environment variable.
	FailurePolicy admissionv1.FailurePolicyType

	// TLSCertFile — path to the TLS certificate file.
	// The certificate is read and used as the caBundle in the webhook config.
	// Default: read from TLS_CERT environment variable.
	TLSCertFile string

	// OrkestraResourceLabels defines the labels used to identify Orkestra-managed
	// resources for deletion protection.
	OrkestraResourceLabels map[string]string

	// Label selector shared by all Orkestra-managed Kubernetes resources.
	// Narrows the webhook to only the operator's own deployment, service, ingress,
	// and admission webhook configurations (validation + mutation).
	OrkestraResourceSelector *metav1.LabelSelector
}

type WebhookStats struct {
	Reconciled int64 // total successful reconciliation cycles
	Failed     int64 // reconciliation attempts that encountered errors
	// contains filtered or unexported fields
}

type WebhookStatsSnapshot struct {
	Reconciled int64 `json:"reconciled"`
	Failed     int64 `json:"failed"`
}