config

type CRTListFile struct {
	// Template is the template content that generates the crt-list file.
	Template string `yaml:"template"`

	// PostProcessing defines optional post-processors to apply after rendering.
	// Post-processors are applied in order to transform the rendered output.
	PostProcessing []PostProcessorConfig `yaml:"post_processing,omitempty"`
}

type Config struct {
	// PodSelector identifies HAProxy pods to configure.
	PodSelector PodSelector `yaml:"pod_selector"`

	// Controller contains controller-level settings (ports, etc.).
	Controller ControllerConfig `yaml:"controller"`

	// Logging configures logging behavior.
	Logging LoggingConfig `yaml:"logging"`

	// Dataplane configures the Dataplane API for production HAProxy instances.
	Dataplane DataplaneConfig `yaml:"dataplane"`

	// TemplatingSettings configures template rendering behavior and custom variables.
	TemplatingSettings TemplatingSettings `yaml:"templating_settings" json:"templatingSettings"`

	// WatchedResourcesIgnoreFields specifies JSONPath expressions for fields
	// to remove from all watched resources to reduce memory usage.
	//
	// Example: ["metadata.managedFields"]
	WatchedResourcesIgnoreFields []string `yaml:"watched_resources_ignore_fields"`

	// WatchedResources maps resource type names to their watch configuration.
	//
	// Example:
	//   ingresses:
	//     api_version: networking.k8s.io/v1
	//     kind: Ingress
	//     index_by: ["metadata.namespace", "metadata.name"]
	WatchedResources map[string]WatchedResource `yaml:"watched_resources"`

	// Validators lists pluggable validator sidecars consulted by the
	// admission webhook before admitting changes that affect plugin
	// configuration. See ValidatorConfig for per-entry semantics.
	//
	// An empty list (the default) leaves admission validation at
	// template + HAProxy syntax dry-run only.
	Validators []ValidatorConfig `yaml:"validators,omitempty"`

	// TemplateSnippets maps snippet names to reusable template fragments.
	//
	// Snippets can be included in other templates using {{ render "name" }}.
	TemplateSnippets map[string]TemplateSnippet `yaml:"template_snippets"`

	// Maps maps map file names to their template definitions.
	//
	// These generate HAProxy map files for backend routing and other features.
	Maps map[string]MapFile `yaml:"maps"`

	// Files maps file names to their template definitions.
	//
	// These generate auxiliary files like custom error pages.
	Files map[string]GeneralFile `yaml:"files"`

	// SSLCertificates maps certificate names to their template definitions.
	//
	// These generate SSL certificate files for HAProxy.
	SSLCertificates map[string]SSLCertificate `yaml:"ssl_certificates"`

	// K8sResources maps resource template names to their template
	// definitions. Each entry's rendered output is parsed as one or
	// more Kubernetes resources (multi-doc YAML separated by `---`)
	// and applied via Server-Side Apply by the controller.
	K8sResources map[string]K8sResource `yaml:"k8s_resources"`

	// CRTLists maps crt-list file names to their template definitions.
	//
	// These generate crt-list files for SSL certificate lists with per-certificate options.
	CRTLists map[string]CRTListFile `yaml:"crt_lists"`

	// HAProxyConfig contains the main HAProxy configuration template.
	HAProxyConfig HAProxyConfig `yaml:"haproxy_config"`

	// ValidationTests contains embedded tests for validating template rendering.
	// These tests are used both in CLI validation and webhook admission validation.
	// The map key is the test name, which must be unique.
	ValidationTests map[string]ValidationTest `yaml:"validation_tests"`
}

type ConfigPublishingConfig struct {
	// CompressionThreshold is the minimum size in bytes at which configs are compressed.
	// Default: 1 MiB (1048576 bytes) via CRD kubebuilder default.
	// Set to 0 or negative to disable compression.
	CompressionThreshold int64 `yaml:"compression_threshold"`
}

type ControllerConfig struct {
	// LeaderElection configures leader election for high availability.
	LeaderElection LeaderElectionConfig `yaml:"leader_election"`

	// ConfigPublishing configures how rendered configs are stored in CRDs.
	ConfigPublishing ConfigPublishingConfig `yaml:"config_publishing"`
}

type Credentials struct {
	// DataplaneUsername is the username for production HAProxy instances.
	DataplaneUsername string

	// DataplanePassword is the password for production HAProxy instances.
	DataplanePassword string
}

type DataplaneConfig struct {
	// Port is the Dataplane API port for production HAProxy pods.
	// A value of 0 means "uninitialized" and will be replaced with the default.
	// This is a production port and MUST NOT remain 0 after defaults are applied.
	// Default: 5555
	Port int `yaml:"port"`

	// MinDeploymentInterval enforces minimum time between consecutive deployments.
	// This prevents rapid-fire deployments from hammering HAProxy instances.
	// Format: Go duration string (e.g., "2s", "500ms")
	// Default: 2s
	MinDeploymentInterval string `yaml:"min_deployment_interval"`

	// DriftPreventionInterval triggers periodic deployments to prevent configuration drift.
	// A deployment is automatically triggered if no deployment has occurred within this interval.
	// This detects and corrects drift caused by external Dataplane API clients.
	// Format: Go duration string (e.g., "60s", "5m")
	// Default: 60s
	DriftPreventionInterval string `yaml:"drift_prevention_interval"`

	// DeploymentTimeout is the maximum time to wait for a deployment to complete.
	// If exceeded, the scheduler assumes the deployment was lost and retries.
	// This is a safety net for race conditions during leadership transitions.
	// Format: Go duration string (e.g., "30s", "1m")
	// Default: 30s
	DeploymentTimeout string `yaml:"deployment_timeout"`

	// MapsDir is the directory for HAProxy map files.
	// Used for both validation and deployment.
	// Default: /etc/haproxy/maps
	MapsDir string `yaml:"maps_dir"`

	// SSLCertsDir is the directory for SSL certificates.
	// Used for both validation and deployment.
	// Default: /etc/haproxy/ssl
	SSLCertsDir string `yaml:"ssl_certs_dir"`

	// GeneralStorageDir is the directory for general files (error pages, etc.).
	// Used for both validation and deployment.
	// Default: /etc/haproxy/general
	GeneralStorageDir string `yaml:"general_storage_dir"`

	// ConfigFile is the path to the main HAProxy configuration file.
	// Used for validation.
	// Default: /etc/haproxy/haproxy.cfg
	ConfigFile string `yaml:"config_file"`

	// ConfigPublishInterval throttles how often the HAProxyCfg CRD is updated.
	// During endpoint churn the rendered config changes frequently, but each CRD update
	// writes ~500 KB to etcd. This interval limits CRD publishes while deployments to
	// HAProxy pods (via events) remain unthrottled.
	// Uses leading-edge triggering: first change publishes immediately, subsequent
	// changes within the interval are buffered and published when the interval expires.
	// Format: Go duration string (e.g., "30s", "1m")
	// Default: 30s
	ConfigPublishInterval string `yaml:"config_publish_interval"`

	// ReloadVerificationTimeout bounds how long the Dataplane sync waits for a
	// graceful HAProxy reload to be reported as completed before failing the sync.
	// Format: Go duration string (e.g., "10s", "30s")
	// Default: 10s
	ReloadVerificationTimeout string `yaml:"reload_verification_timeout"`

	// SyncTimeout is the overall timeout for one Dataplane sync to a single
	// HAProxy endpoint (parse + diff + raw-push apply + optional reload-verify).
	// Format: Go duration string (e.g., "2m", "30s")
	// Default: 2m
	SyncTimeout string `yaml:"sync_timeout"`
}

type GeneralFile struct {
	// Template is the template content that generates the file.
	Template string `yaml:"template"`

	// PostProcessing defines optional post-processors to apply after rendering.
	// Post-processors are applied in order to transform the rendered output.
	PostProcessing []PostProcessorConfig `yaml:"post_processing,omitempty"`
}

type HAProxyConfig struct {
	// Template is the template content that generates haproxy.cfg.
	Template string `yaml:"template"`

	// PostProcessing defines optional post-processors to apply after rendering.
	// Post-processors are applied in order to transform the rendered output.
	// Common use case: indentation normalization with regex_replace.
	//
	// Example:
	//   post_processing:
	//     - type: regex_replace
	//       params:
	//         pattern: "^[ ]+"
	//         replace: "  "
	PostProcessing []PostProcessorConfig `yaml:"post_processing,omitempty"`
}

type HTTPResourceFixture struct {
	// URL is the HTTP URL that will be matched.
	// When a template calls http.Fetch() with this URL, the fixture content is returned.
	URL string `yaml:"url" json:"url"`

	// Content is the response body to return when this URL is fetched.
	Content string `yaml:"content" json:"content"`
}

type K8sResource struct {
	// Template is the template content that generates the resource YAML.
	Template string `yaml:"template"`

	// PostProcessing defines optional post-processors to apply after rendering.
	// Post-processors are applied in order to transform the rendered output.
	PostProcessing []PostProcessorConfig `yaml:"post_processing,omitempty"`
}

type LeaderElectionConfig struct {
	// Enabled determines whether leader election is active.
	// If false, the controller assumes it is the sole instance (single-replica mode).
	// Default: true
	Enabled bool `yaml:"enabled"`

	// LeaseName is the name of the Lease resource used for coordination.
	// Default: haptic-leader
	LeaseName string `yaml:"lease_name"`

	// LeaseDuration is the duration that non-leader candidates will wait
	// to force acquire leadership (measured against time of last observed ack).
	// Format: Go duration string (e.g., "60s", "1m")
	// Default: 60s
	// Minimum: 15s
	LeaseDuration string `yaml:"lease_duration"`

	// RenewDeadline is the duration that the acting leader will retry
	// refreshing leadership before giving up.
	// Format: Go duration string (e.g., "15s")
	// Default: 15s
	// Must be less than LeaseDuration
	RenewDeadline string `yaml:"renew_deadline"`

	// RetryPeriod is the duration the LeaderElector clients should wait
	// between tries of actions.
	// Format: Go duration string (e.g., "5s")
	// Default: 5s
	// Must be less than RenewDeadline
	RetryPeriod string `yaml:"retry_period"`
}

type LoggingConfig struct {
	// Level controls the log level: TRACE, DEBUG, INFO, WARN, ERROR (case-insensitive)
	// Empty string means use LOG_LEVEL env var or default (INFO)
	Level string `yaml:"level"`
}

type MapFile struct {
	// Template is the template content that generates the map file.
	Template string `yaml:"template"`

	// PostProcessing defines optional post-processors to apply after rendering.
	// Post-processors are applied in order to transform the rendered output.
	PostProcessing []PostProcessorConfig `yaml:"post_processing,omitempty"`
}

type PodSelector struct {
	// MatchLabels are the labels to match HAProxy pods.
	//
	// Example:
	//   app: haproxy
	//   component: loadbalancer
	MatchLabels map[string]string `yaml:"match_labels"`
}

type PostProcessorConfig struct {
	// Type specifies the post-processor type.
	// Supported values: "regex_replace"
	Type string `yaml:"type"`

	// Params contains type-specific configuration parameters.
	// For regex_replace:
	//   - pattern: Regular expression pattern to match (required)
	//   - replace: Replacement string (required)
	Params map[string]string `yaml:"params"`
}

type Resolution struct {
	// ResolvedVersions maps watched-resource names to the apiVersion the
	// controller actually watches (the first served candidate).
	ResolvedVersions map[string]string

	// Unavailable lists optional watched-resource names with no served
	// candidate version, sorted alphabetically.
	Unavailable []string

	// StrippedSnippets and StrippedTests list the names of templateSnippets /
	// validationTests removed because a resource they require is unavailable,
	// sorted alphabetically.
	StrippedSnippets []string
	StrippedTests    []string

	// StrippedFieldTests lists the names of validationTests removed because
	// a field named in their RequiresFields is absent from the resolved
	// schema generation, sorted alphabetically. Disjoint from StrippedTests:
	// resource-level stripping wins when both apply. Unlike the other
	// stripped lists this is NOT derived from Unavailable — an in-place CRD
	// upgrade can change it while every resolved version stays the same, so
	// Equal compares it explicitly (the CRD watch relies on that to reload).
	StrippedFieldTests []string
}

type SSLCertificate struct {
	// Template is the template content that generates the certificate file.
	Template string `yaml:"template"`

	// PostProcessing defines optional post-processors to apply after rendering.
	// Post-processors are applied in order to transform the rendered output.
	PostProcessing []PostProcessorConfig `yaml:"post_processing,omitempty"`
}

type SchemaFieldChecker interface {
	// FieldServed returns true when the schema served for the plural
	// resource at the given group/version contains the dot-separated
	// field path (descending into array items transparently). Any
	// error is treated as transient and fails the whole resolution —
	// silently stripping on a schema-fetch blip would disable features
	// spuriously.
	FieldServed(apiVersion, resources, fieldPath string) (bool, error)
}

type ServedVersionChecker interface {
	// IsServed returns true when the plural resource is served at the given
	// group/version (e.g. "gateway.networking.k8s.io/v1", "tcproutes").
	IsServed(apiVersion, resources string) bool
}

type TemplateSnippet struct {
	// Name is the snippet identifier for {{ render "name" }}.
	// This is derived from the map key in the configuration.
	Name string

	// Template is the template content.
	Template string `yaml:"template"`

	// Requires lists watched-resource names this snippet depends on. When an
	// optional watched resource has no served candidate version, every
	// snippet requiring it is stripped from the effective config at load
	// time (surviving snippets must reach stripped resources only through
	// compile-safe seams such as `render "..." default ""`).
	// Each entry must name a key of WatchedResources.
	Requires []string `yaml:"requires,omitempty"`
}

type TemplatingSettings struct {
	// Engine specifies which template engine to use for rendering.
	// Valid values: "scriggo" (default and only supported engine)
	Engine string `yaml:"engine" json:"engine"`

	// RenderTimeout is the maximum time allowed for rendering a single template.
	// Uses Go duration format (e.g., "30s", "1m"). Default: "30s"
	RenderTimeout string `yaml:"render_timeout" json:"renderTimeout"`

	// ExtraContext provides custom variables that are passed to all templates.
	//
	// This allows users to add arbitrary data to the template context without
	// modifying controller code. Values can be any valid JSON type (string, number,
	// boolean, object, array).
	//
	// Example in YAML:
	//   extra_context:
	//     debug:
	//       enabled: true
	//     environment: production
	//     custom_value: 42
	//
	// Templates can then reference these variables directly: {{ debug.enabled }}, {{ environment }}, etc.
	ExtraContext map[string]any `yaml:"extra_context" json:"extraContext"`
}

type ValidationAssertion struct {
	// Type is the assertion type: "haproxy_valid", "contains", "not_contains", "match_count", "equals", "jsonpath", "match_order", "deterministic".
	Type string `yaml:"type"`

	// Description explains what this assertion validates.
	Description string `yaml:"description"`

	// Target specifies what to validate: "haproxy.cfg", "map:<name>", "file:<name>", "cert:<name>".
	// Only used for non-haproxy_valid assertions.
	Target string `yaml:"target"`

	// Pattern is the regex pattern to match (for "contains" and "not_contains").
	Pattern string `yaml:"pattern"`

	// Expected is the expected value (for "equals" and "jsonpath").
	Expected string `yaml:"expected"`

	// JSONPath is the JSONPath expression to query (for "jsonpath").
	JSONPath string `yaml:"jsonpath"`

	// Patterns is a list of regex patterns that must appear in the specified order (for "match_order").
	Patterns []string `yaml:"patterns"`
}

type ValidationTest struct {
	// Description explains what this test validates.
	Description string `yaml:"description"`

	// Fixtures contains mock Kubernetes resources for this test.
	// The map key is the resource type name (e.g., "services", "ingresses").
	// The map value is a list of resources in unstructured format.
	Fixtures map[string][]any `yaml:"fixtures"`

	// HTTPFixtures contains mock HTTP responses for this test.
	// When templates call http.Fetch() for a URL that matches a fixture,
	// the fixture content is returned instead of making an actual HTTP request.
	HTTPFixtures []HTTPResourceFixture `yaml:"httpResources,omitempty"`

	// CurrentConfig contains the raw HAProxy configuration from a previous deployment.
	// This is used for testing slot-aware server assignment during rolling deployments.
	// When provided, templates can access currentConfig to preserve server slot ordering.
	// The content is parsed using the HAProxy config parser before being passed to templates.
	CurrentConfig string `yaml:"currentConfig,omitempty"`

	// ExtraContext provides custom variables that override the global extraContext for this test.
	// This allows testing template behavior with different extraContext values.
	ExtraContext map[string]any `yaml:"extraContext,omitempty" json:"extraContext,omitempty"`

	// MinHAProxyVersion specifies the minimum HAProxy version required to run this test.
	// Format: "major.minor" (e.g., "3.3"). When set, the test is skipped if the local
	// HAProxy version is below this threshold.
	MinHAProxyVersion string `yaml:"minHAProxyVersion,omitempty"`

	// Requires lists watched-resource names this test depends on. When an
	// optional watched resource has no served candidate version, every test
	// requiring it is stripped from the effective config at load time.
	// Each entry must name a key of WatchedResources.
	Requires []string `yaml:"requires,omitempty"`

	// RequiresFields lists schema field paths this test depends on, each in
	// the form "<watchedResourceKey>.<field.path>" (e.g.
	// "httproutes.spec.rules.filters.cors"). When ANY referenced field is
	// absent from the RESOLVED schema generation of its watched resource,
	// the test is stripped from the effective config at load time. This
	// covers clusters that serve the resource at the same version string
	// as newer releases but with an older schema generation lacking the
	// field — resource-level Requires stripping cannot fire there. The
	// first dot-segment of each entry must name a key of WatchedResources.
	RequiresFields []string `yaml:"requiresFields,omitempty"`

	// Assertions contains validation checks to run against the rendered config.
	Assertions []ValidationAssertion `yaml:"assertions"`
}

type ValidatorConfig struct {
	// Name is the operator-facing validator identifier.
	Name string `yaml:"name"`

	// SocketPath is the absolute filesystem path to the validator's
	// Unix domain socket inside the controller pod.
	SocketPath string `yaml:"socket_path"`

	// Files is the list of glob patterns matched against rendered
	// file paths to decide which files to send to this validator.
	// Globs follow Go's `path/filepath.Match` rules; absolute paths
	// only.
	Files []string `yaml:"files"`

	// TimeoutMs is the per-call deadline in milliseconds, covering
	// the request-response cycle for one file. Zero falls back to
	// 5000 (5 seconds).
	TimeoutMs int32 `yaml:"timeout_ms,omitempty"`

	// MaxConnections caps the controller-side pool size for this
	// validator's socket. Zero falls back to 4. The pool starts
	// small and grows on contention up to this cap.
	MaxConnections int32 `yaml:"max_connections,omitempty"`
}

type WatchedResource struct {
	// APIVersion is the Kubernetes API version (e.g., "networking.k8s.io/v1").
	// Mutually exclusive with APIVersions; equivalent to a one-element list.
	APIVersion string `yaml:"api_version"`

	// APIVersions is an ordered candidate list of API versions. At iteration
	// start the controller resolves the entry to the FIRST candidate the
	// apiserver serves, and that resolved version is used everywhere the
	// literal APIVersion would be (informer GVR, stores, schema fetch,
	// webhook registration, fixture defaulting). Mutually exclusive with
	// APIVersion.
	//
	// Example: ["gateway.networking.k8s.io/v1", "gateway.networking.k8s.io/v1beta1"]
	APIVersions []string `yaml:"api_versions,omitempty"`

	// Optional marks this resource as non-essential: when NO candidate
	// version is served by the cluster, the watch is dropped and every
	// TemplateSnippet / ValidationTest whose Requires names this resource is
	// stripped from the effective config at load time, instead of failing
	// startup. When false (default), an unserved resource fails the
	// iteration fast with a named error.
	Optional bool `yaml:"optional,omitempty"`

	// Resources is the plural form of the Kubernetes resource type (e.g., "ingresses", "services").
	// This is the name used in RBAC rules and API paths.
	Resources string `yaml:"resources"`

	// EnableValidationWebhook enables admission webhook validation for this resource.
	// Default: false
	EnableValidationWebhook bool `yaml:"enable_validation_webhook"`

	// IndexBy specifies JSONPath expressions for extracting index keys.
	//
	// Resources are indexed by these values for O(1) lookup.
	//
	// Examples:
	//   ["metadata.namespace", "metadata.name"]
	//   ["metadata.labels['kubernetes.io/service-name']"]
	IndexBy []string `yaml:"index_by"`

	// LabelSelector filters resources by labels (server-side filtering).
	//
	// Example:
	//   app: haproxy
	//   component: loadbalancer
	LabelSelector map[string]string `yaml:"label_selector,omitempty"`

	// FieldSelector filters resources using client-side JSONPath evaluation.
	// Unlike Kubernetes' native fieldSelector (which only supports limited fields),
	// this supports any JSONPath expression.
	//
	// Format: "field.path=value"
	// Example: "spec.ingressClassName=haproxy-internal"
	FieldSelector string `yaml:"field_selector,omitempty"`

	// Store specifies the storage backend: "full" (MemoryStore) or "on-demand" (CachedStore).
	// Default: "full"
	//
	// Use "on-demand" for large resources that are accessed infrequently (e.g., Secrets).
	// Use "full" for frequently accessed resources (e.g., Services, EndpointSlices).
	Store string `yaml:"store"`

	// DebounceInterval overrides the default leading-edge refractory window
	// for this resource type's watcher. Format: Go duration string (e.g.,
	// "500ms", "10s"). When empty or invalid, the watcher falls back to
	// pkg/k8s/types.DefaultDebounceInterval (100ms).
	//
	// Lower values make the controller respond faster to bursty changes at
	// the cost of more reconciliations and GC pressure. Most workloads
	// should leave this empty.
	DebounceInterval string `yaml:"debounce_interval,omitempty"`
}