kubernetes

type CRDController struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Enabled controls whether Kubernetes integration is active.
	// Default: false (must be explicitly enabled).
	Enabled bool

	// CRDEnabled controls whether CRD management is active.
	// Default: true when Enabled is true.
	CRDEnabled bool

	// Namespace overrides the auto-detected namespace. If empty, the
	// namespace is read from the service account metadata at runtime.
	Namespace string

	// AuditLogPath is the filesystem path to the Kubernetes audit log.
	// Default: /var/log/kubernetes/audit/audit.log.
	AuditLogPath string

	// CRDSyncInterval controls how often CRD state is reconciled.
	// Must be at least 1s. Default: 10s.
	CRDSyncInterval time.Duration

	// TokenPath is the filesystem path to the service account token.
	// Default: /var/run/secrets/kubernetes.io/serviceaccount/token.
	TokenPath string
}

type DataEntry struct {
	Key         string `json:"key"`
	ContentType string `json:"contentType,omitempty"`
	Payload     any    `json:"payload,omitempty"`
	Version     int    `json:"version,omitempty"`
	UpdatedAt   string `json:"updatedAt,omitempty"`
}

type DefaultDetector struct {
	Logger *slog.Logger
}

type EnvironmentDetector interface {
	// Detect returns information about the Kubernetes environment.
	// Returns nil if the process is not running inside a Kubernetes pod.
	Detect() *KubernetesEnvironment
}

type HTTPTokenReviewClient struct {
	// contains filtered or unexported fields
}

type K8sAuditLogReader struct {
	// contains filtered or unexported fields
}

type KubeClient interface {
	// GetNodeState retrieves the PlexdNodeState CRD for the given name and namespace.
	// Returns ErrNotFound if the resource does not exist.
	GetNodeState(ctx context.Context, namespace, name string) (*PlexdNodeState, error)

	// CreateNodeState creates a new PlexdNodeState CRD resource.
	// Returns ErrAlreadyExists if the resource already exists.
	CreateNodeState(ctx context.Context, state *PlexdNodeState) error

	// UpdateNodeState updates an existing PlexdNodeState CRD resource spec.
	// Returns ErrNotFound if the resource does not exist.
	UpdateNodeState(ctx context.Context, state *PlexdNodeState) error

	// DeleteNodeState deletes a PlexdNodeState CRD resource.
	// Returns nil if the resource does not exist (idempotent).
	DeleteNodeState(ctx context.Context, namespace, name string) error

	// WatchNodeState starts a watch on a specific PlexdNodeState resource.
	// Returns a channel that receives events until the context is cancelled.
	WatchNodeState(ctx context.Context, namespace, name string) (<-chan PlexdNodeStateEvent, error)

	// CreateSecret creates a Kubernetes Secret.
	// Returns ErrAlreadyExists if the secret already exists.
	CreateSecret(ctx context.Context, secret *KubeSecret) error

	// UpdateSecret updates an existing Kubernetes Secret.
	// Returns ErrNotFound if the secret does not exist.
	UpdateSecret(ctx context.Context, secret *KubeSecret) error

	// DeleteSecret deletes a Kubernetes Secret.
	// Returns nil if the secret does not exist (idempotent).
	DeleteSecret(ctx context.Context, namespace, name string) error

	// WatchPlexdHooks starts a watch on PlexdHook resources in the given namespace.
	// Returns a channel that receives events until the context is cancelled.
	WatchPlexdHooks(ctx context.Context, namespace string) (<-chan PlexdHookEvent, error)

	// UpdatePlexdHookStatus updates the status subresource of a PlexdHook resource.
	// Returns ErrNotFound if the resource does not exist.
	UpdatePlexdHookStatus(ctx context.Context, hook *PlexdHook) error

	// CreateJob creates a Kubernetes batch/v1 Job.
	// Returns ErrAlreadyExists if the Job already exists.
	CreateJob(ctx context.Context, job *PlexdJob) error
}

type KubeSecret struct {
	Name         string            `json:"name"`
	Namespace    string            `json:"namespace"`
	Labels       map[string]string `json:"labels,omitempty"`
	Data         map[string][]byte `json:"data,omitempty"`
	OwnerRefName string            `json:"ownerRefName,omitempty"`
	OwnerRefUID  string            `json:"ownerRefUID,omitempty"`
}

type KubernetesEnvironment struct {
	// InCluster is true when plexd is running inside a Kubernetes pod.
	InCluster bool

	// Namespace is the Kubernetes namespace of the pod.
	Namespace string

	// PodName is the name of the pod, typically sourced from the HOSTNAME env var.
	PodName string

	// NodeName is the Kubernetes node name, sourced from the MY_NODE_NAME env var
	// (set via the downward API).
	NodeName string

	// ServiceAccountToken is the filesystem path to the service account token.
	ServiceAccountToken string
}

type PlexdHook struct {
	Name            string            `json:"name"`
	Namespace       string            `json:"namespace"`
	UID             string            `json:"uid,omitempty"`
	ResourceVersion string            `json:"resourceVersion,omitempty"`
	Labels          map[string]string `json:"labels,omitempty"`
	Spec            PlexdHookSpec     `json:"spec"`
	Status          PlexdHookStatus   `json:"status,omitempty"`
}

type PlexdHookController struct {
	// contains filtered or unexported fields
}

type PlexdHookEvent struct {
	Type string     `json:"type"`
	Hook *PlexdHook `json:"hook"`
}

type PlexdHookJobTemplate struct {
	Image   string   `json:"image"`
	Command []string `json:"command,omitempty"`
	Args    []string `json:"args,omitempty"`
}

type PlexdHookParam struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type PlexdHookSpec struct {
	HookName    string                `json:"hookName"`
	JobTemplate *PlexdHookJobTemplate `json:"jobTemplate,omitempty"`
	Parameters  []PlexdHookParam      `json:"parameters,omitempty"`
	Privileged  bool                  `json:"privileged,omitempty"`
}

type PlexdHookStatus struct {
	JobName     string     `json:"jobName,omitempty"`
	Phase       string     `json:"phase,omitempty"`
	Message     string     `json:"message,omitempty"`
	StartedAt   *time.Time `json:"startedAt,omitempty"`
	CompletedAt *time.Time `json:"completedAt,omitempty"`
}

type PlexdJob struct {
	Name               string              `json:"name"`
	Namespace          string              `json:"namespace"`
	Labels             map[string]string   `json:"labels,omitempty"`
	OwnerReferences    []PlexdJobOwnerRef  `json:"ownerReferences,omitempty"`
	NodeSelector       map[string]string   `json:"nodeSelector,omitempty"`
	ServiceAccountName string              `json:"serviceAccountName,omitempty"`
	Containers         []PlexdJobContainer `json:"containers"`
	RestartPolicy      string              `json:"restartPolicy"`
}

type PlexdJobContainer struct {
	Name             string            `json:"name"`
	Image            string            `json:"image"`
	Command          []string          `json:"command,omitempty"`
	Args             []string          `json:"args,omitempty"`
	Env              map[string]string `json:"env,omitempty"`
	Privileged       bool              `json:"privileged,omitempty"`
	ReadOnlyRootFS   bool              `json:"readOnlyRootFilesystem,omitempty"`
	DropCapabilities []string          `json:"dropCapabilities,omitempty"`
}

type PlexdJobOwnerRef struct {
	APIVersion         string `json:"apiVersion"`
	Kind               string `json:"kind"`
	Name               string `json:"name"`
	UID                string `json:"uid"`
	Controller         bool   `json:"controller"`
	BlockOwnerDeletion bool   `json:"blockOwnerDeletion"`
}

type PlexdNodeState struct {
	Name            string               `json:"name"`
	Namespace       string               `json:"namespace"`
	UID             string               `json:"uid,omitempty"`
	ResourceVersion string               `json:"resourceVersion,omitempty"`
	Labels          map[string]string    `json:"labels,omitempty"`
	Spec            PlexdNodeStateSpec   `json:"spec"`
	Status          PlexdNodeStateStatus `json:"status,omitempty"`
	LastUpdate      time.Time            `json:"lastUpdate"`
}

type PlexdNodeStateEvent struct {
	Type  string          `json:"type"` // ADDED, MODIFIED, DELETED
	State *PlexdNodeState `json:"state"`
}

type PlexdNodeStateSpec struct {
	NodeID     string            `json:"nodeId"`
	MeshIP     string            `json:"meshIp,omitempty"`
	Metadata   map[string]string `json:"metadata,omitempty"`
	Data       []DataEntry       `json:"data,omitempty"`
	SecretRefs []SecretRef       `json:"secretRefs,omitempty"`
}

type PlexdNodeStateStatus struct {
	Report []DataEntry `json:"report,omitempty"`
}

type ReportNotifier interface {
	NotifyChange()
}

type SecretRef struct {
	Key        string `json:"key"`
	SecretName string `json:"secretName"`
	Version    int    `json:"version,omitempty"`
}

type TokenReviewAuthenticator struct {
	// contains filtered or unexported fields
}

type TokenReviewClient interface {
	// Review validates a bearer token via the Kubernetes TokenReview API.
	// Returns the authenticated identity if valid, or an error if invalid or unreachable.
	Review(ctx context.Context, token string) (*TokenReviewResult, error)
}

type TokenReviewResult struct {
	Authenticated bool
	Username      string
	UID           string
	Groups        []string
	Audiences     []string
}