manager

type Config struct {
	// Agent SVID and key resulting from successful attestation.
	SVID                 []*x509.Certificate
	SVIDKey              keymanager.Key
	Bundle               *managerCache.Bundle
	Reattestable         bool
	Catalog              catalog.Catalog
	TrustDomain          spiffeid.TrustDomain
	Log                  logrus.FieldLogger
	Metrics              telemetry.Metrics
	ServerAddr           string
	Storage              storage.Storage
	TrustBundleSources   trustbundlesources.Bundle
	RebootstrapMode      string
	RebootstrapDelay     time.Duration
	WorkloadKeyType      workloadkey.KeyType
	SyncInterval         time.Duration
	SyncRetryBackoff     *SyncRetryBackoffConfig
	RotationInterval     time.Duration
	SVIDStoreCache       *storecache.Cache
	X509SVIDCacheMaxSize int
	JWTSVIDCacheMaxSize  int
	WITSVIDCacheMaxSize  int
	EnableWITSVIDs       bool
	DisableLRUCache      bool
	NodeAttestor         nodeattestor.NodeAttestor
	RotationStrategy     *rotationutil.RotationStrategy
	TLSPolicy            tlspolicy.Policy

	// LoadBalancingConfig is an optional, opaque payload used as the
	// loadBalancingConfig field of the gRPC service config.
	LoadBalancingConfig string

	// Clk is the clock the manager will use to get time
	Clk clock.Clock
}

type Manager interface {
	// Initialize initializes the manager.
	Initialize(ctx context.Context) error

	// Run runs the manager. It will block until the context is cancelled.
	Run(ctx context.Context) error

	// SubscribeToX509CacheChanges returns a Subscriber on which cache entry updates are sent
	// for a particular set of selectors.
	SubscribeToX509CacheChanges(ctx context.Context, key cache.Selectors) (cache.Subscriber[cache.X509WorkloadUpdate], error)

	// SubscribeToWITCacheChanges returns a Subscriber on which cache entry updates are sent
	// for a particular set of selectors. It fails with ErrWITSVIDsDisabled if WIT-SVIDs are
	// not enabled.
	SubscribeToWITCacheChanges(ctx context.Context, key cache.Selectors) (cache.Subscriber[cache.WITWorkloadUpdate], error)

	// SubscribeToSVIDChanges returns a new observer.Stream on which svid.State instances are received
	// each time an SVID rotation finishes.
	SubscribeToSVIDChanges() observer.Stream

	// SubscribeToBundleChanges returns a new bundle stream on which
	// map[string][]*x509.Certificate instances are received each time the
	// bundle changes.
	SubscribeToBundleChanges() *cache.BundleStream

	// GetRotationMtx returns a mutex that locks in SVIDs rotations
	GetRotationMtx() *sync.RWMutex

	// GetCurrentCredentials returns the current SVID and key
	GetCurrentCredentials() svid.State

	// SetRotationFinishedHook sets a hook that will be called when a rotation finished
	SetRotationFinishedHook(func())

	// MatchingRegistrationEntries returns all the cached registration entries whose
	// selectors are a subset of the passed selectors.
	MatchingRegistrationEntries(selectors []*common.Selector) []*common.RegistrationEntry

	// FetchWorkloadUpdates gets the latest workload update for the selectors
	FetchWorkloadUpdate(selectors []*common.Selector) *cache.X509WorkloadUpdate

	// FetchJWTSVID returns a JWT SVID for the specified SPIFFEID and audience. If there
	// is no JWT cached, the manager will get one signed upstream.
	FetchJWTSVID(ctx context.Context, entry *common.RegistrationEntry, audience []string) (*client.JWTSVID, error)

	// CountX509SVIDs returns the amount of X509 SVIDs on memory
	CountX509SVIDs() int

	// CountJWTSVIDs returns the amount of JWT SVIDs on memory
	CountJWTSVIDs() int

	// CountSVIDStoreX509SVIDs returns the amount of x509 SVIDs on SVIDStore in-memory cache
	CountSVIDStoreX509SVIDs() int

	// GetLastSync returns the last successful rotation timestamp
	GetLastSync() time.Time

	// GetBundle get latest cached bundle
	GetBundle() *cache.Bundle

	// GetBundles gets the latest cached bundles for all trust domains.
	GetBundles() map[spiffeid.TrustDomain]*cache.Bundle

	// GetX509Bundle returns an X509 bundle source
	GetX509Bundle() x509bundle.Source
}

type SyncRetryBackoffConfig struct {
	// MaxInterval is the upper limit of the interval between retries.
	// Defaults to 48 times the sync interval, capped at 8 minutes.
	MaxInterval time.Duration

	// Multiplier is the factor the interval is multiplied by after each
	// failure. Defaults to 1.5.
	Multiplier *float64

	// Jitter is the fraction of the interval the interval is randomized by.
	// Defaults to 0.10.
	Jitter *float64
}