config

type AdminAPIClientConfig struct {
	// Disable verification of TLS certificate of Kong's Admin endpoint.
	TLSSkipVerify bool
	// SNI name to use to verify the certificate presented by Kong in TLS.
	TLSServerName string
	// Path to PEM-encoded CA certificate file to verify Kong's Admin SSL certificate.
	CACertPath string
	// PEM-encoded CA certificate to verify Kong's Admin SSL certificate.
	CACert string
	// Array of headers added to every Admin API call.
	Headers []string
	// TLSClient is TLS client config.
	TLSClient TLSClientConfig
}

type Config struct {
	// Logging configurations
	LogLevel  string
	LogFormat string

	// Kong high-level controller manager configurations
	KongAdminAPIConfig                AdminAPIClientConfig
	KongAdminInitializationRetries    uint
	KongAdminInitializationRetryDelay time.Duration
	KongAdminToken                    string
	KongAdminTokenPath                string
	KongWorkspace                     string
	AnonymousReports                  bool
	EnableReverseSync                 bool
	UseLastValidConfigForFallback     bool
	SyncPeriod                        time.Duration
	SkipCACertificates                bool
	CacheSyncTimeout                  time.Duration
	GracefulShutdownTimeout           *time.Duration

	// Kong Proxy configurations
	APIServerHost                          string
	APIServerQPS                           int
	APIServerBurst                         int
	APIServerCAData                        []byte
	APIServerCertData                      []byte
	APIServerKeyData                       []byte
	MetricsAddr                            string
	MetricsAccessFilter                    MetricsAccessFilter
	ProbeAddr                              string
	KongAdminURLs                          []string
	KongAdminSvc                           OptionalNamespacedName
	GatewayDiscoveryReadinessCheckInterval time.Duration
	GatewayDiscoveryReadinessCheckTimeout  time.Duration
	KongAdminSvcPortNames                  []string
	ProxySyncInterval                      time.Duration
	InitCacheSyncDuration                  time.Duration
	ProxySyncTimeout                       time.Duration

	// KubeRestConfig takes precedence over any fields related to what it configures,
	// such as APIServerHost, APIServerQPS, etc. It's intended to be used when the controller
	// is run as a part of Kong Operator. It bypass the mechanism of constructing this config.
	KubeRestConfig *rest.Config `json:"-"`

	// Kubernetes configurations
	KubeconfigPath           string
	IngressClassName         string
	LeaderElectionNamespace  string
	LeaderElectionID         string
	LeaderElectionForce      string
	Concurrency              int
	FilterTags               []string
	WatchNamespaces          []string
	GatewayAPIControllerName string
	Impersonate              string
	EmitKubernetesEvents     bool
	ClusterDomain            string

	// Ingress status
	PublishServiceUDP       OptionalNamespacedName
	PublishService          OptionalNamespacedName
	PublishStatusAddress    []string
	PublishStatusAddressUDP []string

	UpdateStatus                bool
	UpdateStatusQueueBufferSize int

	// Kubernetes API toggling
	IngressNetV1Enabled           bool
	IngressClassNetV1Enabled      bool
	IngressClassParametersEnabled bool
	KongClusterPluginEnabled      bool
	KongPluginEnabled             bool
	KongConsumerEnabled           bool
	ServiceEnabled                bool
	KongUpstreamPolicyEnabled     bool
	KongServiceFacadeEnabled      bool
	KongVaultEnabled              bool
	KongLicenseEnabled            bool
	KongCustomEntityEnabled       bool

	// Gateway API toggling.
	GatewayAPIGatewayController         bool
	GatewayAPIHTTPRouteController       bool
	GatewayAPIReferenceGrantController  bool
	GatewayAPIGRPCRouteController       bool
	GatewayAPIBackendTLSRouteController bool
	GatewayAPITCPRouteController        bool
	GatewayAPITLSRouteController        bool
	GatewayAPIUDPRouteController        bool

	// GatewayToReconcile specifies the Gateway to be reconciled.
	GatewayToReconcile OptionalNamespacedName

	// SecretLabelSelector specifies the label which will be used to limit the ingestion of secrets. Only those that have this label set to "true" will be ingested.
	SecretLabelSelector map[string]string

	// ConfigMapLabelSelector specifies the label which will be used to limit the ingestion of configmaps. Only those that have this label set to "true" will be ingested.
	ConfigMapLabelSelector map[string]string

	// Diagnostics and performance
	EnableProfiling      bool
	EnableConfigDumps    bool
	DumpSensitiveConfig  bool
	DiagnosticServerPort int
	// TODO: https://github.com/Kong/kubernetes-ingress-controller/issues/7285
	// instead of this toggle, move the server out of the internal.Manager
	DisableRunningDiagnosticsServer bool

	// EnableDrainSupport controls whether to include terminating endpoints in Kong upstreams
	// with weight=0 for graceful connection draining
	EnableDrainSupport bool

	// CombinedServicesFromDifferentHTTPRoutes controls whether we should combine rules from different HTTPRoutes
	// that are sharing the same combination of backends to one Kong service.
	CombinedServicesFromDifferentHTTPRoutes bool

	// Feature Gates
	FeatureGates FeatureGates

	// TermDelay is the time.Duration which the controller manager will wait
	// after receiving SIGTERM or SIGINT before shutting down. This can be
	// helpful for advanced cases with load-balancers so that the ingress
	// controller can be gracefully removed/drained from their rotation.
	TermDelay time.Duration

	Konnect KonnectConfig

	// AnonymousReportsFixedPayloadCustomizer allows customization of anonymous telemetry reports sent by the controller.
	AnonymousReportsFixedPayloadCustomizer types.PayloadCustomizer `json:"-"`
	// Override default telemetry settings (e.g. for testing). They aren't exposed in the CLI.
	SplunkEndpoint                   string
	SplunkEndpointInsecureSkipVerify bool
	TelemetryPeriod                  time.Duration
}

type FeatureGates map[string]bool

type KonnectConfig struct {
	// TODO: https://github.com/Kong/kubernetes-ingress-controller/issues/3922
	// ConfigSynchronizationEnabled is the only toggle we had prior to the addition of the license agent.
	// We likely want to combine these into a single Konnect toggle or piggyback off other Konnect functionality.
	ConfigSynchronizationEnabled bool
	ControlPlaneID               string
	Address                      string
	UploadConfigPeriod           time.Duration
	RefreshNodePeriod            time.Duration
	TLSClient                    TLSClientConfig

	LicenseSynchronizationEnabled bool
	InitialLicensePollingPeriod   time.Duration
	LicensePollingPeriod          time.Duration
	LicenseStorageEnabled         bool
	ConsumersSyncDisabled         bool
}

type MetricsAccessFilter string

type Opt func(*Config)

type OptionalNamespacedName = mo.Option[k8stypes.NamespacedName]

type TLSClientConfig struct {
	// Cert is a client certificate.
	Cert string
	// CertFile is a client certificate file path.
	CertFile string

	// Key is a client key.
	Key string
	// KeyFile is a client key file path.
	KeyFile string
}