networkingress

type Authority struct {
	Surface          requestorigin.Surface `json:"surface,omitempty"`
	BaseURL          string                `json:"base_url,omitempty"`
	OrganizationID   string                `json:"organization_id,omitempty"`
	NetworkIngressID uuid.UUID             `json:"network_ingress_id,omitempty"`
	NamespaceKind    string                `json:"namespace_kind,omitempty"`
	CustomDomainID   uuid.NullUUID         `json:"custom_domain_id,omitzero"`
}

type Executor struct {
	// contains filtered or unexported fields
}

type ExecutorOptions struct {
	// Queue is the authoritative reconciliation task queue.
	Queue string

	// Image is the attestor image used by Apply.
	Image string

	// BackendService is the private backend Service name.
	BackendService string

	// BackendPort is the private backend Service port.
	BackendPort int32

	// CanApply is checked on every attempt before credential decryption.
	CanApply func(context.Context) error

	// PublicationRequester atomically records organization invalidations for
	// committed DNS authority changes. A nil requester keeps the producer off.
	PublicationRequester PublicationRequester

	// PublicationActor identifies the reconciler actor in publication hints.
	PublicationActor string
}

type ExpansionAdmission struct {
	// contains filtered or unexported fields
}

type HealthRefresher interface {
	RefreshNetworkIngress(context.Context, string, uuid.UUID) error
}

type OutboxRequester struct {
	// contains filtered or unexported fields
}

type PublicationRequester interface {
	Organization(context.Context, pgx.Tx, string, string) error
}

type ReconcileError struct {
	// Code is a bounded diagnostic suitable for orchestration history.
	Code string

	// Retryable controls retries within the current workflow run.
	Retryable bool
}

type ReconcileHandler struct {
	// contains filtered or unexported fields
}

type ReconcileRequester interface {
	Enqueue(context.Context, pgx.Tx, string, uuid.UUID) error
}

type ReconcileResult struct {
	// Requeue means desired state changed during this pass.
	Requeue bool
}

type ResourceNames = k8s.NetworkIngressResourceNames

type RuntimeConfig struct {
	// ReconcileTaskQueue is explicit and never falls back to a general worker queue.
	ReconcileTaskQueue string

	// ProviderMutationsEnabled permits apply and rotation, not admission or cleanup.
	ProviderMutationsEnabled bool

	// Tailscale configures operator resources and private backend network access.
	Tailscale k8s.TailscaleNetworkIngressConfig

	// AttestorImage is the digest-pinned image deployed for each ingress.
	AttestorImage string

	// BackendService names the private HTTPS Service in Tailscale.BackendNamespace.
	BackendService string

	// BackendPort is the private HTTPS Service port; zero means unconfigured.
	BackendPort int32

	// IngressClass must explicitly select the supported tailscale ingress class.
	IngressClass string

	// TokenAudience must match the private listener's projected token audience.
	TokenAudience string
}

type Service struct {
	// contains filtered or unexported fields
}

type Telemetry struct {
	// contains filtered or unexported fields
}