fluxdelivery

type Applier struct {
	// Name is [TreeKustomizationName] for a tree, [KustomizationName] for a
	// flat cluster.
	Name string `json:"name"`
	// Source is the OCIRepository the applier reads, and must equal
	// Source.Name: one input, one source.
	Source string `json:"source"`
	// Cluster, Unit and Phase are the applier's coordinates in the bundle:
	// the rendered cluster name as the bundle's paths index it (a kube
	// context, not necessarily a DNS label), the delivery unit and the phase
	// of a tree. Unit and Phase are "" for a flat cluster. [Validate] derives
	// Name and Path from them; the template reads neither.
	Cluster string        `json:"cluster"`
	Unit    string        `json:"unit"`
	Phase   release.Phase `json:"phase"`
	// Path is release.BundleTreePath (tree) or release.BundleClusterPath
	// (flat) of the coordinates — CHECKED, because a Kustomization at a path
	// the artifact does not hold reconciles as "no resources" and reports
	// Ready.
	Path string `json:"path"`
	// Retire retires this applier alone: "" or [RetireOrphan]. The first of
	// the two writes that drop an applier.
	Retire string `json:"retire"`
	// Labels are stamped on this Kustomization beside BindingInput.Labels
	// (the hub: cluster, delivery unit, phase — [LabelValue] of each).
	Labels map[string]string `json:"labels"`
	// KubeConfigSecret names the destination kubeconfig Secret in Namespace
	// (key [KubeConfigKey]). Exactly one of KubeConfigSecret and InCluster.
	KubeConfigSecret string `json:"kubeConfigSecret"`
	// InCluster applies to the namespace's own cluster with the controller's
	// in-cluster identity, impersonating ServiceAccountName. Explicit rather
	// than inferred from an empty KubeConfigSecret: an absent kubeConfig is
	// a destination breach when it happens by omission.
	InCluster bool `json:"inCluster"`
	// ServiceAccountName is the identity an in-cluster apply impersonates.
	// Required with InCluster, refused beside a kubeconfig (the connected
	// shard applies as the kubeconfig's identity and nothing else). Rendered
	// even when empty, as the hub's objects already carry it.
	ServiceAccountName string `json:"serviceAccountName"`
	// TargetNamespace forces every applied object into one namespace (a
	// hosted destination); "" leaves the bundle's own namespaces.
	TargetNamespace string `json:"targetNamespace"`
	// DependsOn are applier names IN THIS INPUT that must be Ready first.
	DependsOn []string `json:"dependsOn"`
	// ExternalDependsOn are Kustomization names OUTSIDE this binding, in the
	// same namespace. Not resolved here; empty today.
	ExternalDependsOn []string `json:"externalDependsOn"`
	// Health is what the applier is judged on (instead of Wait).
	Health []HealthCheck `json:"health"`
	// HealthExprs override kstatus for kinds whose Ready alone does not prove
	// the current spec reconciled.
	HealthExprs []HealthCheckExpr `json:"healthExprs"`
	// Wait judges every applied object; a tree waits on Health instead.
	Wait bool `json:"wait"`
	// Timeout and RetryInterval are canonical Go durations ("1m30s");
	// RetryInterval "" leaves Flux's default.
	Timeout       string `json:"timeout"`
	RetryInterval string `json:"retryInterval"`
	// Suspended carries a live suspend into the input (adoption, or a tree
	// added suspended).
	Suspended bool `json:"suspended"`
	// CommonLabels are stamped on every object the applier applies (a hosted
	// destination's identity).
	CommonLabels map[string]string `json:"commonLabels"`
	// Patches are kustomize patches on the applied objects (a hosted
	// destination's deployment ids), in a stable order.
	Patches []Patch `json:"patches"`
}

type BindingInput struct {
	// Schema is [Schema].
	Schema string `json:"schema"`
	// Org is the owning organization. RFC-1123 label.
	Org string `json:"org"`
	// Env is the environment id. RFC-1123 label. (Not `id`: flux-operator
	// reserves inputs.id and inputs.provider.)
	Env string `json:"env"`
	// Binding is the ledger binding within the environment. "" — the whole
	// environment — is the only value [Validate] accepts until the ledger has
	// per-binding promotion; the key exists so nothing re-shapes later.
	Binding string `json:"binding"`
	// Namespace is where the ResourceSet and everything it renders live
	// (`flux-<org>` on the hub, `flux-system` self-hosted).
	Namespace string `json:"namespace"`
	// Fence is the writer's lease fence at the last write that moved
	// something, as decimal digits (inputs are JSON). Stamped on the
	// OCIRepository as [FenceAnnotation].
	Fence string `json:"fence"`
	// Promotion is the ledger row this input projects.
	Promotion string `json:"promotion"`
	// Retire is "", [RetireOrphan] or [RetireTeardown], and only ever from a
	// ledger-recorded intent. Binding-wide; an applier may also be retired
	// alone ([Applier.Retire]).
	Retire string `json:"retire"`
	// Labels are stamped on EVERY rendered object. Computed by the writer
	// (the hub: managed-by, org, environment; a binding label only for a
	// non-empty binding); the template adds only the shard label.
	Labels map[string]string `json:"labels"`
	// Source is the binding's ONE OCIRepository.
	Source Source `json:"source"`
	// Appliers are one Kustomization each: a layout-v2 tree, or a flat
	// (layout v1) cluster.
	Appliers []Applier `json:"appliers"`
}

type HealthCheck struct {
	APIVersion string `json:"apiVersion"`
	Kind       string `json:"kind"`
	Name       string `json:"name"`
	Namespace  string `json:"namespace,omitempty"`
}

type HealthCheckExpr struct {
	APIVersion string `json:"apiVersion"`
	Kind       string `json:"kind"`
	// InProgress and Failed are evaluated before Current, in that order
	// (Flux RFC 0009). omitempty keeps an expression that sets only Current
	// rendering exactly as before.
	InProgress string `json:"inProgress,omitempty"`
	Failed     string `json:"failed,omitempty"`
	Current    string `json:"current"`
}

type OIDCIdentity struct {
	Issuer  string `json:"issuer"`
	Subject string `json:"subject"`
}

type Patch struct {
	Patch  string      `json:"patch"`
	Target PatchTarget `json:"target"`
}

type PatchTarget struct {
	Group   string `json:"group,omitempty"`
	Version string `json:"version,omitempty"`
	Kind    string `json:"kind"`
	Name    string `json:"name"`
}

type Provider struct {
	Name   string
	Inputs []map[string]any
}

type SelfHosted struct {
	// ApplyIdentities is FluxDelivery.apply_identities: every tree names its derived
	// identity. False: no tree names one.
	ApplyIdentities bool
}

type Source struct {
	// Name is [SourceName](org, env, binding).
	Name string `json:"name"`
	// URL is the bundle repository, `oci://` scheme included, without a tag:
	// the digest pins it.
	URL string `json:"url"`
	// Digest is the bundle's OCI MANIFEST digest ("sha256:" + 64 hex), the
	// value Flux reports as the revision.
	Digest string `json:"digest"`
	// Interval is the reconcile interval of the source and of every applier,
	// as a canonical Go duration ("5m0s"): the form the API server stores, so
	// a render equals the live object byte for byte.
	Interval string `json:"interval"`
	// Insecure allows the pull over plain HTTP. The digest still pins the
	// content; this weakens transport, not integrity.
	Insecure bool `json:"insecure"`
	// Provider is Flux's pull auth provider ("" for Flux's generic default).
	Provider string `json:"provider"`
	// PullSecret names the registry pull Secret in Namespace, written by the
	// writer (or the self-hosted bootstrap), never by the template. "" for
	// an anonymous pull.
	PullSecret string `json:"pullSecret"`
	// Verify is the signature verification the source enforces.
	Verify Verify `json:"verify"`
}

type Verify struct {
	// Mode is [VerifyOff], [VerifyAudit] or [VerifyEnforce].
	Mode string `json:"mode"`
	// Provider is Flux's verification provider, "cosign" or "notation".
	// Required in enforce mode.
	Provider string `json:"provider"`
	// SecretRef names the Secret of trusted public keys in Namespace, written
	// by the writer before an enforcing input. Key-based verification;
	// exclusive with OIDC.
	SecretRef string `json:"secretRef"`
	// OIDC are the keyless identities a signature may carry; exclusive with
	// SecretRef.
	OIDC []OIDCIdentity `json:"oidc"`
}