operator

type MCPServerReconciler struct {
	client.Client
	Scheme *runtime.Scheme

	// APIReader is an uncached reader for objects the operator does not watch
	// (the server's pods). Nil falls back to Client.
	APIReader client.Reader

	// DefaultIngressHost is the default ingress host if not specified in the CR.
	DefaultIngressHost string

	// DefaultIngressEntryPoints is the default Traefik entrypoint annotation for MCP server ingresses.
	DefaultIngressEntryPoints string

	// DefaultIngressTLS enables Traefik TLS routing for MCP server ingresses by default.
	DefaultIngressTLS bool

	// DefaultIngressTLSSecret is the Kubernetes TLS Secret holding the
	// caller-facing (user->Traefik) host certificate for mtls servers. Path-based
	// mtls servers share one host, so this single platform host certificate is
	// published as Traefik's default certificate via a TLSStore named "default"
	// (see reconcileDefaultTLSStore) rather than a per-IngressRoute secretName.
	// Empty falls back to Traefik's built-in default certificate.
	DefaultIngressTLSSecret string

	// DefaultIngressTLSSecretNamespace is the Traefik-watched namespace that holds
	// the DefaultIngressTLSSecret and the single "default" TLSStore. Must be one
	// of the namespaces Traefik's kubernetescrd provider watches.
	DefaultIngressTLSSecretNamespace string

	// IngressReadinessMode controls how ingress readiness is evaluated.
	IngressReadinessMode string

	// ProvisionedRegistry holds the provisioned registry configuration.
	// If nil or URL is empty, provisioned registry features are disabled.
	ProvisionedRegistry *RegistryConfig

	// GatewayProxyImage is the default image used for the optional MCP gateway sidecar.
	GatewayProxyImage string

	// GatewayOTLPEndpoint is the OTLP/HTTP endpoint injected into MCP gateway sidecars.
	GatewayOTLPEndpoint string

	// DefaultAnalyticsIngestURL is the default analytics ingest endpoint used when analytics is enabled.
	DefaultAnalyticsIngestURL string

	// ClusterName is the cluster label attached to policy and audit events.
	ClusterName string

	// OAuthInternalIssuerURL is the in-cluster URL used by gateway sidecars for
	// OAuth metadata and JWKS discovery.
	OAuthInternalIssuerURL string

	// OAuthIssuerURL enables bundled authorization-server resource reconciliation
	// and supplies the default public issuer for OAuth MCPServers.
	OAuthIssuerURL string

	// MTLSClusterIssuer is the pre-existing cert-manager ClusterIssuer used for
	// gateway and adapter workload certificates. It is platform-wide; it does
	// not depend on MCP request authentication.
	MTLSClusterIssuer string

	// AdapterCertificatesEnabled opts OAuth servers into optional adapter
	// client certificates on their route (MCP_ADAPTER_CERTIFICATES).
	AdapterCertificatesEnabled bool

	// AdapterTrustDomain is the platform-wide SPIFFE trust domain used for
	// session-bound adapter certificates and the trusted Traefik identity.
	AdapterTrustDomain              string
	IngressControllerNamespace      string
	IngressControllerServiceAccount string
	IngressControllerPodLabels      map[string]string
}

type OperatorConfig struct {
	// DefaultIngressHost is the default host for ingress resources.
	DefaultIngressHost string

	// DefaultIngressClass is the ingress class to use.
	DefaultIngressClass string

	// DefaultIngressEntryPoints is the default Traefik entrypoint annotation for MCP server ingresses.
	DefaultIngressEntryPoints string

	// DefaultIngressTLS enables Traefik TLS routing for MCP server ingresses by default.
	DefaultIngressTLS bool

	// IngressReadinessMode controls how ingress readiness is evaluated.
	IngressReadinessMode string

	// ProvisionedRegistryURL is the URL of the provisioned registry.
	ProvisionedRegistryURL string

	// ProvisionedRegistryUsername is the username for the provisioned registry.
	ProvisionedRegistryUsername string

	// ProvisionedRegistryPassword is the password for the provisioned registry.
	ProvisionedRegistryPassword string

	// ProvisionedRegistrySecretName is the name of the secret for registry credentials.
	ProvisionedRegistrySecretName string

	// InternalRegistryEndpoint is the internal registry endpoint to use for image refs when not using a provisioned registry.
	InternalRegistryEndpoint string

	// RegistryPullHost is the pullable registry host used in image refs when the operator
	// needs to rewrite images to the platform-managed registry.
	RegistryPullHost string

	// RequeueDelaySeconds is the delay in seconds before requeueing when resources aren't ready.
	RequeueDelaySeconds int

	// GatewayProxyImage is the default image used for the optional MCP gateway sidecar.
	GatewayProxyImage string

	// GatewayOTLPEndpoint is the OTLP/HTTP endpoint injected into MCP gateway sidecars.
	GatewayOTLPEndpoint string

	// AnalyticsIngestURL is the default analytics ingest endpoint for gateway sidecars.
	AnalyticsIngestURL string

	// OAuthInternalIssuerURL is the in-cluster URL used by gateway sidecars for
	// OAuth metadata and JWKS discovery.
	OAuthInternalIssuerURL string

	// ClusterName is the cluster label attached to emitted audit events.
	ClusterName string
}

type RegistryConfig struct {
	URL        string
	Username   string
	Password   string
	SecretName string
}