controller

type AuditEventReconciler struct {
	client.Client
	Scheme *runtime.Scheme

	// Retention is the TTL window. Zero selects DefaultAuditRetention.
	Retention time.Duration
	// contains filtered or unexported fields
}

type BrokerCASource struct {
	Namespace string
	Name      string
}

type BrokerHTTPClient struct {
	// TokenReader, when non-nil, overrides the inner client's TokenReader on
	// every Issue call. NewBrokerHTTPClient initialises this field and the
	// inner client's TokenReader to the same closure (re-reads tokenPath on
	// every call), so production paths see no behavioural change. Tests can
	// mutate this field after construction to inject inline byte slices,
	// which the next Issue call propagates to the inner client.
	TokenReader brokerclient.TokenReader
	// contains filtered or unexported fields
}

type BrokerIssuer interface {
	Issue(ctx context.Context, runName, runNamespace, credentialName string) (*brokerapi.IssueResponse, error)
	Revoke(ctx context.Context, runName, runNamespace string, lease paddockv1alpha1.IssuedLease) error
}

type BrokerPolicyReconciler struct {
	client.Client
	Scheme *runtime.Scheme

	// Now returns the current time. Tests can override; production sets
	// it to time.Now in SetupWithManager / wiring.
	Now func() time.Time
}

type CiliumNetworkPolicyDiscovery interface {
	ServerResourcesForGroupVersion(groupVersion string) (*metav1.APIResourceList, error)
}

type ControllerAudit struct {
	Sink auditing.Sink
}

type HarnessRunReconciler struct {
	client.Client
	Scheme   *runtime.Scheme
	Recorder record.EventRecorder

	// CollectorImage is the image used for the generic collector
	// sidecar. When empty, DefaultCollectorImage is used.
	CollectorImage string

	// RingMaxEvents caps status.recentEvents at decode time.
	// Mirrors the collector's ring-max-events flag (ADR-0007);
	// the controller trims the parsed list to this count as
	// belt-and-braces against ConfigMap-side drift. 0 disables.
	RingMaxEvents int

	// BrokerClient, when non-nil, is used to issue per-run credentials
	// for templates with non-empty spec.requires.credentials. nil means
	// no broker is configured — runs against templates with requires
	// are held with BrokerReady=False.
	BrokerClient BrokerIssuer

	// ProxyAllowList is a static comma-separated host:port allow-list
	// passed to every run's proxy sidecar via --allow. Populated from
	// --proxy-allow at manager startup. M7 replaces the static list
	// with live broker.ValidateEgress calls.
	ProxyAllowList string

	// IPTablesInitImage is the image used for the NET_ADMIN init
	// container that installs the transparent-mode REDIRECT chain
	// (ADR-0013 §7.2). Empty disables transparent mode entirely —
	// every run resolves to cooperative regardless of PSA labels.
	IPTablesInitImage string

	// HomeInitImage overrides the image used for the paddock-home-init
	// init container. Empty falls back to DefaultHomeInitImage.
	HomeInitImage string

	// Audit emits per-decision AuditEvents. Nil-safe — when unset (e.g.
	// in unit tests), all emits are no-ops. F-40.
	Audit *ControllerAudit

	// ProxyBrokerConfig carries the shared cluster-and-manager config
	// used to render run-pod proxy sidecars and per-run NetworkPolicies.
	// Populated once in cmd/main.go and embedded in both reconcilers.
	ProxyBrokerConfig
}

type NetworkPolicyEnforceMode string

type ProxyBrokerConfig struct {
	// ProxyImage is the image used for the per-run egress proxy
	// sidecar. Empty disables the proxy sidecar (the run still
	// proceeds; EgressConfigured stays False with reason=ProxyNotConfigured).
	ProxyImage string

	// BrokerEndpoint is the in-cluster broker URL the proxy sidecar
	// calls for ValidateEgress + SubstituteAuth. Empty disables
	// broker-backed proxy enforcement (proxy falls back to
	// --proxy-allow static list).
	BrokerEndpoint string

	// BrokerNamespace is the namespace where the broker is deployed
	// (default `paddock-system`). Used by the per-pod NetworkPolicy
	// to allow broker egress when NP enforcement is on.
	BrokerNamespace string

	// BrokerPort is the broker's TLS service port. Defaults to 8443
	// when 0; populated from --broker-port at manager startup.
	// (Previously defaulted inside buildBrokerEgressRule with no CLI
	// override; promoted to a real flag in this refactor.)
	BrokerPort int32

	// BrokerCASource names the cert-manager-issued broker-serving-cert
	// Secret whose ca.crt is copied into per-run/per-workspace
	// broker-ca Secrets. Zero Name disables broker-CA copy.
	BrokerCASource BrokerCASource

	// ProxyCAClusterIssuer is the cert-manager ClusterIssuer (kind:
	// CA) that signs per-run intermediate CAs (F-18 / Phase 2f).
	// Empty disables proxy-TLS integration.
	ProxyCAClusterIssuer string

	// NetworkPolicyEnforce selects whether per-pod NetworkPolicy
	// objects are emitted. "auto" defers to the CNI probe.
	NetworkPolicyEnforce NetworkPolicyEnforceMode

	// NetworkPolicyAutoEnabled is set at manager startup from the
	// CNI probe when NetworkPolicyEnforce="auto".
	NetworkPolicyAutoEnabled bool

	// ClusterPodCIDR is the cluster's pod CIDR. Excluded from
	// per-pod NetworkPolicy public-internet egress (F-19).
	ClusterPodCIDR string

	// ClusterServiceCIDR is the cluster's service CIDR. Same
	// purpose as ClusterPodCIDR.
	ClusterServiceCIDR string

	// APIServerIPs is the set of IPv4 addresses the controller
	// resolves the kube-apiserver to (F-41). Each becomes a /32
	// allow rule in the per-pod NP.
	APIServerIPs []net.IP

	// CiliumCNPAvailable reports whether the cluster has the
	// CiliumNetworkPolicy CRD registered. Set at controller-manager
	// startup via DetectCiliumCNP. When true, ensureRunNetworkPolicy
	// emits a CiliumNetworkPolicy variant; when false, it emits a
	// standard NetworkPolicy. Issue #79.
	CiliumCNPAvailable bool
}

type WorkspaceReconciler struct {
	client.Client
	Scheme   *runtime.Scheme
	Recorder record.EventRecorder

	// SeedImage overrides the default alpine/git image. Primarily for
	// tests; production uses defaultSeedImage.
	SeedImage string

	// Audit is the canonical sink for terminal-condition events emitted
	// by the Workspace reconciler (F-51 ca-misconfigured). Optional;
	// nil falls back to silent, with status conditions remaining the
	// primary signal.
	Audit *ControllerAudit

	// ProxyBrokerConfig carries the shared cluster-and-manager config
	// used to render seed-pod proxy sidecars and per-seed-Pod
	// NetworkPolicies. Populated once in cmd/main.go and embedded in
	// both reconcilers.
	ProxyBrokerConfig
}