const CACertificateKey = "ca.crt"

type Builder struct {
    // Source is the source of Kubernetes objects
    // from which to build a DAG.
    Source KubernetesCache

    // Processors is the ordered list of Processors to
    // use to build the DAG.
    Processors []Processor
}

type CORSPolicy struct {
    // Specifies whether the resource allows credentials.
    AllowCredentials bool
    // AllowOrigin specifies the origins that will be allowed to do CORS requests.
    AllowOrigin []string
    // AllowMethods specifies the content for the *access-control-allow-methods* header.
    AllowMethods []string
    // AllowHeaders specifies the content for the *access-control-allow-headers* header.
    AllowHeaders []string
    // ExposeHeaders Specifies the content for the *access-control-expose-headers* header.
    ExposeHeaders []string
    // MaxAge specifies the content for the *access-control-max-age* header.
    MaxAge timeout.Setting
}

type Cluster struct {
    // Upstream is the backend Kubernetes service traffic arriving
    // at this Cluster will be forwarded too.
    Upstream *Service

    // The relative weight of this Cluster compared to its siblings.
    Weight uint32

    // The protocol to use to speak to this cluster.
    Protocol string

    // UpstreamValidation defines how to verify the backend service's certificate
    UpstreamValidation *PeerValidationContext

    // The load balancer type to use when picking a host in the cluster.
    // See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#enum-config-cluster-v3-cluster-lbpolicy
    LoadBalancerPolicy string

    // Cluster http health check policy
    *HTTPHealthCheckPolicy

    // Cluster tcp health check policy
    *TCPHealthCheckPolicy

    // RequestHeadersPolicy defines how headers are managed during forwarding
    RequestHeadersPolicy *HeadersPolicy

    // ResponseHeadersPolicy defines how headers are managed during forwarding
    ResponseHeadersPolicy *HeadersPolicy

    // SNI is used when a route proxies an upstream using tls.
    // SNI describes how the SNI is set on a Cluster and is configured via RequestHeadersPolicy.Host key.
    // Policies set on service are used before policies set on a route. Otherwise the value of the externalService
    // is used if the route is configured to proxy to an externalService type.
    // If the value is not set, then SNI is not changed.
    SNI string

    // DNSLookupFamily defines how external names are looked up
    // When configured as V4, the DNS resolver will only perform a lookup
    // for addresses in the IPv4 family. If V6 is configured, the DNS resolver
    // will only perform a lookup for addresses in the IPv6 family.
    // If AUTO is configured, the DNS resolver will first perform a lookup
    // for addresses in the IPv6 family and fallback to a lookup for addresses
    // in the IPv4 family.
    // Note: This only applies to externalName clusters.
    DNSLookupFamily string

    // ClientCertificate is the optional identifier of the TLS secret containing client certificate and
    // private key to be used when establishing TLS connection to upstream cluster.
    ClientCertificate *Secret
}

type DAG struct {
    // StatusCache holds a cache of status updates to send.
    StatusCache status.Cache
    // contains filtered or unexported fields
}

type ExtensionCluster struct {
    // Name is the (globally unique) name of the corresponding Envoy cluster resource.
    Name string

    // Upstream is the cluster that receives network traffic.
    Upstream ServiceCluster

    // The protocol to use to speak to this cluster.
    Protocol string

    // UpstreamValidation defines how to verify the backend service's certificate
    UpstreamValidation *PeerValidationContext

    // The load balancer type to use when picking a host in the cluster.
    // See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#enum-config-cluster-v3-cluster-lbpolicy
    LoadBalancerPolicy string

    // TimeoutPolicy specifies how to handle timeouts to this extension.
    TimeoutPolicy TimeoutPolicy

    // SNI is used when a route proxies an upstream using TLS.
    SNI string

    // ClientCertificate is the optional identifier of the TLS secret containing client certificate and
    // private key to be used when establishing TLS connection to upstream cluster.
    ClientCertificate *Secret
}

type ExtensionServiceProcessor struct {
    logrus.FieldLogger

    // ClientCertificate is the optional identifier of the TLS
    // secret containing client certificate and private key to be
    // used when establishing TLS connection to upstream cluster.
    ClientCertificate *types.NamespacedName
}

type HTTPHealthCheckPolicy struct {
    Path               string
    Host               string
    Interval           time.Duration
    Timeout            time.Duration
    UnhealthyThreshold uint32
    HealthyThreshold   uint32
}

type HTTPProxyProcessor struct {

    // DisablePermitInsecure disables the use of the
    // permitInsecure field in HTTPProxy.
    DisablePermitInsecure bool

    // FallbackCertificate is the optional identifier of the
    // TLS secret to use by default when SNI is not set on a
    // request.
    FallbackCertificate *types.NamespacedName

    // DNSLookupFamily defines how external names are looked up
    // When configured as V4, the DNS resolver will only perform a lookup
    // for addresses in the IPv4 family. If V6 is configured, the DNS resolver
    // will only perform a lookup for addresses in the IPv6 family.
    // If AUTO is configured, the DNS resolver will first perform a lookup
    // for addresses in the IPv6 family and fallback to a lookup for addresses
    // in the IPv4 family.
    // Note: This only applies to externalName clusters.
    DNSLookupFamily config.ClusterDNSFamilyType

    // ClientCertificate is the optional identifier of the TLS secret containing client certificate and
    // private key to be used when establishing TLS connection to upstream cluster.
    ClientCertificate *types.NamespacedName
    // contains filtered or unexported fields
}

type HeaderMatchCondition struct {
    Name      string
    Value     string
    MatchType string
    Invert    bool
}

type HeaderValue struct {
    // Name represents a key of a header
    Key string
    // Value represents the value of a header specified by a key
    Value string
}

type HeadersPolicy struct {
    // HostRewrite defines if a host should be rewritten on upstream requests
    HostRewrite string

    Set    map[string]string
    Remove []string
}

type IngressProcessor struct {
    logrus.FieldLogger

    // ClientCertificate is the optional identifier of the TLS secret containing client certificate and
    // private key to be used when establishing TLS connection to upstream cluster.
    ClientCertificate *types.NamespacedName
    // contains filtered or unexported fields
}

type KubernetesCache struct {
    // RootNamespaces specifies the namespaces where root
    // HTTPProxies can be defined. If empty, roots can be defined in any
    // namespace.
    RootNamespaces []string

    // Contour's IngressClass.
    // If not set, defaults to DEFAULT_INGRESS_CLASS.
    IngressClass string

    // Secrets that are referred from the configuration file.
    ConfiguredSecretRefs []*types.NamespacedName

    logrus.FieldLogger
    // contains filtered or unexported fields
}

type Listener struct {

    // Address is the TCP address to listen on.
    // If blank 0.0.0.0, or ::/0 for IPv6, is assumed.
    Address string

    // Port is the TCP port to listen on.
    Port int

    VirtualHosts []Vertex
}

type ListenerProcessor struct{}

type LocalRateLimitPolicy struct {
    MaxTokens            uint32
    TokensPerFill        uint32
    FillInterval         time.Duration
    ResponseStatusCode   uint32
    ResponseHeadersToAdd map[string]string
}

type MatchCondition interface {
    fmt.Stringer
}

type MirrorPolicy struct {
    Cluster *Cluster
}

type ObjectStatusWriter struct {
    // contains filtered or unexported fields
}

type Observer interface {
    OnChange(*DAG)
}

type ObserverFunc func(*DAG)

type PeerValidationContext struct {
    // CACertificate holds a reference to the Secret containing the CA to be used to
    // verify the upstream connection.
    CACertificate *Secret
    // SubjectName holds an optional subject name which Envoy will check against the
    // certificate presented by the upstream.
    SubjectName string
}

type PrefixMatchCondition struct {
    Prefix string
}

type Processor interface {
    // Run executes the processor.
    Run(dag *DAG, source *KubernetesCache)
}

type ProcessorFunc func(*DAG, *KubernetesCache)

type RateLimitPolicy struct {
    Local *LocalRateLimitPolicy
}

type RegexMatchCondition struct {
    Regex string
}

type RetryPolicy struct {
    // RetryOn specifies the conditions under which retry takes place.
    // If empty, retries will not be performed.
    RetryOn string

    // RetriableStatusCodes specifies the HTTP status codes under which retry takes place.
    RetriableStatusCodes []uint32

    // NumRetries specifies the allowed number of retries.
    // Ignored if RetryOn is blank, or defaults to 1 if RetryOn is set.
    NumRetries uint32

    // PerTryTimeout specifies the timeout per retry attempt.
    // Ignored if RetryOn is blank.
    PerTryTimeout timeout.Setting
}

type Route struct {

    // PathMatchCondition specifies a MatchCondition to match on the request path.
    // Must not be nil.
    PathMatchCondition MatchCondition

    // HeaderMatchConditions specifies a set of additional Conditions to
    // match on the request headers.
    HeaderMatchConditions []HeaderMatchCondition

    Clusters []*Cluster

    // Should this route generate a 301 upgrade if accessed
    // over HTTP?
    HTTPSUpgrade bool

    // AuthDisabled is set if authorization should be disabled
    // for this route. If authorization is disabled, the AuthContext
    // field has no effect.
    AuthDisabled bool

    // AuthContext sets the authorization context (if authorization is enabled).
    AuthContext map[string]string

    // Is this a websocket route?
    // TODO(dfc) this should go on the service
    Websocket bool

    // TimeoutPolicy defines the timeout request/idle
    TimeoutPolicy TimeoutPolicy

    // RetryPolicy defines the retry / number / timeout options for a route
    RetryPolicy *RetryPolicy

    // Indicates that during forwarding, the matched prefix (or path) should be swapped with this value
    PrefixRewrite string

    // Mirror Policy defines the mirroring policy for this Route.
    MirrorPolicy *MirrorPolicy

    // RequestHeadersPolicy defines how headers are managed during forwarding
    RequestHeadersPolicy *HeadersPolicy

    // ResponseHeadersPolicy defines how headers are managed during forwarding
    ResponseHeadersPolicy *HeadersPolicy

    // RateLimitPolicy defines if/how requests for the route are rate limited.
    RateLimitPolicy *RateLimitPolicy
}

type RouteServiceName struct {
    Name      string
    Namespace string
    Port      int32
}

type Secret struct {
    Object *v1.Secret
}

type SecureVirtualHost struct {
    VirtualHost

    // TLS minimum protocol version. Defaults to envoy_tls_v3.TlsParameters_TLS_AUTO
    MinTLSVersion string

    // The cert and key for this host.
    Secret *Secret

    // FallbackCertificate
    FallbackCertificate *Secret

    // Service to TCP proxy all incoming connections.
    *TCPProxy

    // DownstreamValidation defines how to verify the client's certificate.
    DownstreamValidation *PeerValidationContext

    // AuthorizationService points to the extension that client
    // requests are forwarded to for authorization. If nil, no
    // authorization is enabled for this host.
    AuthorizationService *ExtensionCluster

    // AuthorizationResponseTimeout sets how long the proxy should wait
    // for authorization server responses.
    AuthorizationResponseTimeout timeout.Setting

    // AuthorizationFailOpen sets whether authorization server
    // failures should cause the client request to also fail. The
    // only reason to set this to `true` is when you are migrating
    // from internal to external authorization.
    AuthorizationFailOpen bool
}

type Service struct {
    Weighted WeightedService

    // Protocol is the layer 7 protocol of this service
    // One of "", "h2", "h2c", or "tls".
    Protocol string

    // Max connections is maximum number of connections
    // that Envoy will make to the upstream cluster.
    MaxConnections uint32

    // MaxPendingRequests is maximum number of pending
    // requests that Envoy will allow to the upstream cluster.
    MaxPendingRequests uint32

    // MaxRequests is the maximum number of parallel requests that
    // Envoy will make to the upstream cluster.
    MaxRequests uint32

    // MaxRetries is the maximum number of parallel retries that
    // Envoy will allow to the upstream cluster.
    MaxRetries uint32

    // ExternalName is an optional field referencing a dns entry for Service type "ExternalName"
    ExternalName string
}

type ServiceCluster struct {
    // ClusterName is a globally unique name for this ServiceCluster.
    // It is eventually used as the Envoy ClusterLoadAssignment
    // name, and must not be empty.
    ClusterName string
    // Services are the load balancing targets. This slice must not be empty.
    Services []WeightedService
}

type Status struct {
    Object      k8s.Object
    Status      string
    Description string
    Vhost       string
}

type StatusWriter struct {
    // contains filtered or unexported fields
}

type TCPHealthCheckPolicy struct {
    Interval           time.Duration
    Timeout            time.Duration
    UnhealthyThreshold uint32
    HealthyThreshold   uint32
}

type TCPProxy struct {

    // Clusters is the, possibly weighted, set
    // of upstream services to forward decrypted traffic.
    Clusters []*Cluster
}

type TimeoutPolicy struct {
    // ResponseTimeout is the timeout applied to the response
    // from the backend server.
    ResponseTimeout timeout.Setting

    // IdleTimeout is the timeout applied to idle connections.
    IdleTimeout timeout.Setting
}

type Vertex interface {
    Visit(func(Vertex))
}

type VirtualHost struct {
    // Name is the fully qualified domain name of a network host,
    // as defined by RFC 3986.
    Name string

    // CORSPolicy is the cross-origin policy to apply to the VirtualHost.
    CORSPolicy *CORSPolicy

    // RateLimitPolicy defines if/how requests for the virtual host
    // are rate limited.
    RateLimitPolicy *RateLimitPolicy
    // contains filtered or unexported fields
}

type WeightedService struct {
    // Weight is the integral load balancing weight.
    Weight uint32
    // ServiceName is the v1.Service name.
    ServiceName string
    // ServiceNamespace is the v1.Service namespace.
    ServiceNamespace string
    // ServicePort is the port to which we forward traffic.
    ServicePort v1.ServicePort
}