types

type APIServerCertificatePaths struct {
	CertificatePaths
}

type APIServerConfig struct {
	// ExtraSANs are additional Subject Alternative Names for the API server
	// certificate, as IP addresses or DNS names.
	ExtraSANs []string `json:"extraSANs,omitempty"`

	// AuthenticationConfigFile names the kube-apiserver AuthenticationConfiguration
	// file. JWT configuration changes are reloaded by kube-apiserver.
	AuthenticationConfigFile string `json:"authenticationConfigFile,omitempty"`

	// StartupTimeoutSeconds bounds how long each component may take to pass its
	// health check at startup. Raise it on slow storage such as SD cards.
	StartupTimeoutSeconds int `json:"startupTimeoutSeconds"`

	// Port is the API server's secure port, on every interface. The generated
	// kubeconfigs point at it.
	Port int `json:"port"`
}

type AdminCertificatePaths struct {
	CertificatePaths
}

type CACertificatePaths struct {
	Cert string
	Key  string
}

type CPUManagerConfig struct {
	Policy        string            `json:"policy"`
	PolicyOptions map[string]string `json:"policyOptions,omitempty"`
	ReservedCPUs  string            `json:"reservedCPUs"`
}

type CertificatePaths struct {
	CACert string
	Cert   string
	Key    string
}

type Config struct {
	APIVersion string `json:"apiVersion"`
	Kind       string `json:"kind"`

	// Path is the directory KubeSolo stores all of its state in. It cannot be
	// changed on a running install: every certificate, the kine database and all
	// containerd state live below it, and nothing migrates them.
	Path string `json:"path,omitempty"`

	Logging    LoggingConfig    `json:"logging"`
	Network    NetworkConfig    `json:"network"`
	Runtime    RuntimeConfig    `json:"runtime"`
	Kubernetes KubernetesConfig `json:"kubernetes"`
	Storage    StorageConfig    `json:"storage"`
	Portainer  PortainerConfig  `json:"portainer"`
	D2K        D2KConfig        `json:"d2k"`
	Metrics    MetricsConfig    `json:"metrics"`
	API        ConfigAPI        `json:"api"`
}

type ConfigAPI struct {
	Enabled bool `json:"enabled"`

	// SocketPath is where the socket is created. Empty means
	// <path>/DefaultAPISocketName.
	SocketPath string `json:"socketPath"`
}

type ControllerManagerCertificatePaths struct {
	CertificatePaths
}

type ControllerManagerConfig struct {
	// Port is the controller manager's secure (health and metrics) port, on
	// every interface.
	Port int `json:"port"`
}

type D2KCertificatePaths struct {
	CACert     string
	ServerCert string
	ServerKey  string
	ClientCert string
	ClientKey  string
}

type D2KConfig struct {
	Enabled bool `json:"enabled"`

	// Namespace is the single namespace d2k is deployed into and translates
	// Docker API calls against.
	Namespace string `json:"namespace"`

	// Port is the port the d2k LoadBalancer Service publishes the Docker API on,
	// at the LoadBalancer IP.
	Port int `json:"port"`
}

type EdgeAgentConfig struct {
	Image            string
	EdgeID           string
	EdgeKey          string
	EdgeAsync        bool
	EdgeInsecurePoll string
	EdgeSecret       string
	EnvVars          map[string]string

	// APISocketDir is a host directory holding a KubeSolo API socket for the
	// agent, mounted into its pod. Empty means the agent gets no access to the
	// API.
	APISocketDir string
}

type Embedded struct {
	// NodeName is the name of the single node this control plane manages. It is
	// the kubelet's registered node name, the subject of its client certificate
	// and its RBAC binding, and the node the NodeSetter webhook pins pods to.
	// Resolved from kubernetes.nodeName, falling back to the hostname.
	NodeName string

	// System Node IP
	NodeIP string

	// NodeIPSpecified is true when the node IP was explicitly set via --node-ip
	// (rather than auto-detected). When set, the API server cert SANs are scoped
	// to this IP instead of every local interface address.
	NodeIPSpecified bool

	// Network MTU used by the embedded CNI bridge (cni0) and pod veth interfaces
	MTU int

	// MTUSpecified is true when the MTU was explicitly set via --mtu (rather
	// than auto-detected).
	MTUSpecified bool

	// PKI directories
	PKIDir              string
	PKICADir            string
	PKIAdminDir         string
	PKIAPIServerDir     string
	PKIControllerDir    string
	PKIKubeletDir       string
	PKIWebhookDir       string
	PKIRequestHeaderDir string

	// Admin kubeconfig file
	AdminKubeconfigFile string

	// Certificate paths
	KubeletCerts           KubeletCertificatePaths
	APIServerCerts         APIServerCertificatePaths
	ControllerManagerCerts ControllerManagerCertificatePaths
	AdminCerts             AdminCertificatePaths
	WebhookCerts           WebhookCertificatePaths
	CACerts                CACertificatePaths
	RequestHeaderCerts     RequestHeaderCertificatePaths

	// Containerd directories and files
	ContainerdDir               string
	ContainerdSocketFile        string
	ContainerdBinaryFile        string
	ContainerdImagesDir         string
	ContainerdConfigFile        string
	ContainerdShimBinaryFile    string
	ContainerdRootDir           string
	ContainerdStateDir          string
	ContainerdRegistryConfigDir string

	// Conitainerd CNI directories and files
	ContainerdCNIDir        string
	ContainerdCNIPluginsDir string
	ContainerdCNIConfigDir  string
	ContainerdCNIConfigFile string

	// Crun binary
	CrunBinaryFile string

	// Container runtime. RuntimeExternal is true when KubeSolo attaches to a
	// host-managed CRI runtime given with --container-runtime-endpoint instead of
	// starting its own embedded containerd. RuntimeEndpoint is populated in both
	// cases — for the embedded containerd it is "unix://" + ContainerdSocketFile —
	// so consumers need only one code path. RuntimeSocketPath is the filesystem
	// path of RuntimeEndpoint.
	// RuntimeCgroupDriver is the cgroup driver reported by an external runtime over
	// CRI, which the kubelet must match. Empty when the runtime does not report one,
	// in which case the kubelet detects the driver from the host instead.
	RuntimeExternal     bool
	RuntimeEndpoint     string
	RuntimeSocketPath   string
	RuntimeCgroupDriver string

	// Kubelet directories
	KubeletDir            string
	KubeletConfigDir      string
	KubeletConfigFile     string
	KubeletDropInDir      string
	KubeletKubeConfigFile string
	KubeletPluginsDir     string

	// API Server directory
	APIServerDir          string
	ServiceAccountKeyFile string
	// API Server extra SANs
	APIServerExtraSANs []string
	// API Server structured authentication configuration file
	APIServerAuthenticationConfigFile string

	// Kine directories and files
	KineDir        string
	KineSocketFile string

	// Controller manager directory
	ControllerDir string

	// Webhook directory
	WebhookDir string

	// Images
	PortainerEdgeImageFile        string
	CorednsImageFile              string
	SandboxImageFile              string
	LocalPathProvisionerImageFile string
	D2KImageFile                  string

	// Load Balancer
	LoadBalancer bool

	// LoadBalancerIP is the IP published as the LoadBalancer EXTERNAL-IP.
	// Defaults to NodeIP unless overridden with --load-balancer-ip.
	LoadBalancerIP string

	// Ports the control plane listens on (kubernetes.*.port, storage.kine.port,
	// logging.pprofPort, d2k.port). KineEndpoint is kine's address on loopback.
	APIServerPort         int
	ControllerManagerPort int
	KubeletPort           int
	KubeletHealthzPort    int
	KubeProxyHealthzPort  int
	WebhookPort           int
	KinePort              int
	KineEndpoint          string
	PprofPort             int
	D2KPort               int

	// Cluster networks (kubernetes.podCIDR, kubernetes.serviceCIDR,
	// kubernetes.clusterDNS). KubernetesServiceIP is the first address of
	// ServiceCIDR; ClusterDNS is the CoreDNS Service's cluster IP, resolved.
	PodCIDR             string
	ServiceCIDR         string
	KubernetesServiceIP string
	ClusterDNS          string

	// Local Path Storage
	LocalPathStorageDir string
	LocalStorage        bool

	// Portainer Edge
	IsPortainerEdge    bool
	PortainerEdgeImage string

	// Container Mode
	ContainerMode bool

	// IPv6
	DisableIPv6 bool

	// d2k integration
	D2K          bool
	D2KNamespace string
	D2KCerts     D2KCertificatePaths

	// Metrics endpoint configuration
	Metrics MetricsConfig

	// CPU manager configuration
	CPUManager CPUManagerConfig

	// SystemReserved is the resource list withheld from node allocatable for the
	// host, e.g. {"cpu": "1", "memory": "500Mi"}
	SystemReserved map[string]string
}

type KineConfig struct {
	// Port is the port kine serves the etcd API on, on loopback: only the API
	// server talks to it.
	Port int `json:"port"`
}

type KubeProxyConfig struct {
	// HealthzPort is kube-proxy's health endpoint, on every interface.
	HealthzPort int `json:"healthzPort"`
}

type KubeletCertificatePaths struct {
	CertificatePaths
}

type KubeletConfig struct {
	CPUManager CPUManagerConfig `json:"cpuManager"`

	// SystemReserved is withheld from node allocatable for the host, keyed by
	// resource name, e.g. {"cpu": "1", "memory": "500Mi"}.
	SystemReserved map[string]string `json:"systemReserved,omitempty"`

	// Port is the kubelet API's port, on every interface: the API server reaches
	// it for logs, exec and port-forward.
	Port int `json:"port"`

	// HealthzPort is the kubelet's health endpoint, on loopback.
	HealthzPort int `json:"healthzPort"`
}

type KubernetesConfig struct {
	// NodeName is the name of the single node this control plane manages. Empty
	// means the hostname.
	//
	// It is trimmed and lowercased, because that is what the kubelet does to the
	// name before registering it, and the NodeSetter webhook pins every pod to
	// this name — a mismatch leaves the whole cluster Pending.
	NodeName string `json:"nodeName,omitempty"`

	// PodCIDR is the range pod IPs are allocated from: the CNI bridge's, the
	// node's spec.podCIDR, kube-proxy's and the pod masquerade rule's. It cannot
	// be changed on an existing install: the node's spec.podCIDR is immutable
	// once allocated, and running pods keep their addresses.
	PodCIDR string `json:"podCIDR"`

	// ServiceCIDR is the range Service cluster IPs are allocated from. Its first
	// address is the kubernetes Service's, which the API server certificate
	// carries. It cannot be changed on an existing install: Services keep the
	// cluster IPs they were given.
	ServiceCIDR string `json:"serviceCIDR"`

	// ClusterDNS is the cluster IP of the CoreDNS Service, which the kubelet hands
	// to every pod as its nameserver. Empty means the tenth address of
	// ServiceCIDR. Like it, it cannot be changed on an existing install.
	ClusterDNS string `json:"clusterDNS"`

	APIServer         APIServerConfig         `json:"apiServer"`
	ControllerManager ControllerManagerConfig `json:"controllerManager"`
	Kubelet           KubeletConfig           `json:"kubelet"`
	KubeProxy         KubeProxyConfig         `json:"kubeProxy"`
	Webhook           WebhookConfig           `json:"webhook"`
}

type LoadBalancerConfig struct {
	Enabled bool `json:"enabled"`

	// IP overrides the address published as EXTERNAL-IP. Empty means the node IP.
	IP string `json:"ip"`
}

type LocalPathConfig struct {
	Enabled bool `json:"enabled"`

	// SharedPath is a shared filesystem for local storage. Empty means the
	// provisioner uses its directory below Path.
	SharedPath string `json:"sharedPath"`
}

type LoggingConfig struct {
	Debug bool `json:"debug"`
	Pprof bool `json:"pprof"`

	// PprofPort is the port the pprof server listens on, on every interface,
	// when Pprof is set.
	PprofPort int `json:"pprofPort"`
}

type MetricsConfig struct {
	Enabled     bool   `json:"enabled"`
	BindAddress string `json:"bindAddress"`
}

type NetworkConfig struct {
	// NodeIP overrides the auto-detected node IP. Empty means auto-detect,
	// preferring a private (RFC 1918) address.
	NodeIP string `json:"nodeIP"`

	// MTU overrides the auto-detected MTU used by cni0 and pod veth interfaces.
	// Zero means auto-detect.
	MTU int `json:"mtu"`

	// DisableIPv6 stops CoreDNS serving ip6.arpa reverse zones and makes the
	// kubelet register with an explicit IPv4 node address.
	DisableIPv6  bool               `json:"disableIPv6"`
	LoadBalancer LoadBalancerConfig `json:"loadBalancer"`
}

type PortainerConfig struct {
	EdgeID string `json:"edgeID"`

	// EdgeKey is a credential. It is redacted in config API responses and the
	// config file is written 0600.
	EdgeKey string `json:"edgeKey"`
	Async   bool   `json:"async"`

	// Image is the full agent image reference including its tag. Anything other
	// than the default is pulled from a registry rather than loaded from the
	// embedded archive.
	Image string `json:"image"`
}

type PreflightCheck struct {
	Name   string          `json:"name"`
	Result PreflightResult `json:"result"`
	// Message says what the check found; empty when it passed.
	Message string `json:"message,omitempty"`
}

type PreflightReport struct {
	Checks []PreflightCheck `json:"checks"`
}

type PreflightResult string

type RequestHeaderCertificatePaths struct {
	CACert     string
	CAKey      string
	ClientCert string
	ClientKey  string
}

type RuntimeConfig struct {
	// Endpoint is the CRI endpoint of a host-managed runtime, for example
	// unix:///run/crio/crio.sock. Empty means KubeSolo runs its own containerd.
	Endpoint string `json:"endpoint"`

	// ContainerMode forces container mode on or off. Nil — the default — means
	// auto-detect, which is why this is a pointer: false and unset must differ.
	ContainerMode *bool `json:"containerMode,omitempty"`
}

type StorageConfig struct {
	LocalPath LocalPathConfig `json:"localPath"`
	Kine      KineConfig      `json:"kine"`

	// DBWALRepair runs an integrity check against the SQLite database at startup
	// and clears WAL artefacts if it is corrupt. Recovers from power loss.
	DBWALRepair bool `json:"dbWALRepair"`
}

type WebhookCertificatePaths struct {
	CertificatePaths
}

type WebhookConfig struct {
	// Port is the webhook's port, on loopback: only the API server calls it.
	Port int `json:"port"`
}