coreapi

type APIRegistry interface {
	Register(version Version) error
	ListVersions() set.Set[string]
	Lookup(key string) (version Version, ok bool)
}

type AccountOwner struct {
	Puid  *string `json:"puid,omitempty"`
	Email *string `json:"-,omitempty"` // we don't need to nor want to serialize this field
}

type AvailabilityZone struct {
	Location     *string        `json:"location,omitempty"`
	ZoneMappings *[]ZoneMapping `json:"zoneMappings,omitempty"`
}

type AzureMultiReference struct {
	// PendingAzureResources contains resource IDs that have been requested but
	// not yet confirmed to exist in Azure.
	PendingAzureResources []*azcorearm.ResourceID `json:"pendingAzureResources,omitempty"`
	// AzureResources contains resource IDs that have been confirmed to exist in Azure.
	AzureResources []*azcorearm.ResourceID `json:"azureResources,omitempty"`
	// EarliestRecheckTime is the earliest time at which the controller should
	// re-check the pending resources. Nil means recheck immediately.
	// This allows for controllers to avoid repeatedly hitting an Azure API to recheck that the desired state is true.
	// Controllers should set this field with substantial jitter: without another concern, jitter of 50% is considered normal
	// so that any storms are quickly dissipated.
	// Additionally, long recheck times are recommended for resources outside of their active phases. Order of at least
	// six hours is, with durations up to 24 hours considered normal.
	EarliestRecheckTime *metav1.Time `json:"earliestRecheckTime,omitempty"`
}

type AzureReference struct {
	// PendingAzureResource is the resource ID that has been requested but
	// not yet confirmed to exist in Azure.
	PendingAzureResource *azcorearm.ResourceID `json:"pendingAzureResource,omitempty"`
	// AzureResource is the resource ID that has been confirmed to exist in Azure.
	AzureResource *azcorearm.ResourceID `json:"azureResource,omitempty"`
	// EarliestRecheckTime is the earliest time at which the controller should
	// re-check the pending resources. Nil means recheck immediately.
	// This allows for controllers to avoid repeatedly hitting an Azure API to recheck that the desired state is true.
	// Controllers should set this field with substantial jitter: without another concern, jitter of 50% is considered normal
	// so that any storms are quickly dissipated.
	// Additionally, long recheck times are recommended for resources outside of their active phases. Order of at least
	// six hours is, with durations up to 24 hours considered normal.
	EarliestRecheckTime *metav1.Time `json:"earliestRecheckTime,omitempty"`
}

type AzureResources struct {
	// DenyAssignments tracks the deny assignments applied to the cluster's resources.
	DenyAssignments AzureMultiReference `json:"denyAssignments,omitempty"`
	// ManagedResourceGroup tracks the managed resource group for the cluster.
	ManagedResourceGroup AzureReference `json:"managedResourceGroup,omitempty"`
}

type BackupScheduleState string

type CloudError struct {
	// The HTTP status code
	StatusCode int `json:"-"`

	// The response body to be converted to JSON
	*CloudErrorBody `json:"error,omitempty"`
}

type CloudErrorBody struct {
	// An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
	Code string `json:"code,omitempty"`

	// A message describing the error, intended to be suitable for display in a user interface.
	Message string `json:"message,omitempty"`

	// The target of the particular error. For example, the name of the property in error.
	Target string `json:"target,omitempty"`

	// A list of additional details about the error.
	Details []CloudErrorBody `json:"details,omitempty"`
}

type ClusterAutoscalingProfile struct {
	MaxNodesTotal               int32 `json:"maxNodesTotal,omitempty"`
	MaxPodGracePeriodSeconds    int32 `json:"maxPodGracePeriodSeconds,omitempty"`
	MaxNodeProvisionTimeSeconds int32 `json:"maxNodeProvisionTimeSeconds,omitempty"`
	PodPriorityThreshold        int32 `json:"podPriorityThreshold,omitempty"`
}

type ClusterImageRegistryProfile struct {
	// state indicates the desired ImageStream-backed cluster image registry installation mode. This can only be set during cluster
	// creation and cannot be changed after cluster creation. Enabled means the
	// ImageStream-backed image registry will be run as pods on worker nodes in the cluster. Disabled means the ImageStream-backed
	// image registry will not be present in the cluster. The default is Enabled.
	State metadataapi.ClusterImageRegistryState `json:"state,omitempty"`
}

type ControlPlaneAvailability string

type ControlPlanePodSizing string

type Controller struct {
	// CosmosMetadata ResourceID is nested under the cluster so that association and cleanup work as expected
	// it will be the ServiceProviderCluster type and the name default.
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// ExternalID is the Azure resource ID of the type this is associated with.
	ExternalID *azcorearm.ResourceID `json:"externalId,omitempty"`

	Status ControllerStatus `json:"status"`
}

type ControllerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Controller `json:"items"`
}

type ControllerStatus struct {
	// every controller is expected to set a Degraded condition.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type CorrelationData struct {
	// RequestID is a generated unique identifier for the current operation.
	RequestID uuid.UUID

	// ClientRequestID contains the value of header "x-ms-client-request-id".
	ClientRequestID string `json:"clientRequestId,omitempty"`

	// CorrelationRequestID contains the value of header "x-ms-correlation-request-id".
	CorrelationRequestID string `json:"correlationRequestId,omitempty"`

	// ClientPrincipalName contains the value of header "x-ms-client-principal-name".
	ClientPrincipalName string `json:"clientPrincipalName,omitempty"`
}

type CosmosMetadata struct {
	ResourceID *azcorearm.ResourceID `json:"resourceID"`

	// ExistingCosmosUID exists to allow for a migration path from where we are today to a uuid based cosmosID
	// and this will be deleted afterwards.
	ExistingCosmosUID string `json:"-"`

	CosmosETag azcore.ETag `json:"etag,omitempty"`

	// InstanceVersion is a field that auto-increments every time the resource is updated.  This gives us the ability to
	// compare two instances of stored resources and determine which one is newer.  We will use this field to integrate
	// changefeeds for controllers and decide which changes are newer than the level we have already observed so that we
	// can periodically re-list all items.
	// The auto-incrementing happens automatically in the storage layer for conditional updates.
	InstanceVersion int64 `json:"instanceVersion"`

	// PartitionKey is the partition key for the CosmosDB document, it must be set before creation and must be all lowercase.
	// On the read-path, during our migration we will fill in an empty value based on the type we're reading.
	// Every type that embeds this struct must comment about what the PartitionKey is. For instance, subscriptionID, managementClusterID, etc.
	PartitionKey string `json:"partitionKey"`
}

type CosmosMetadataAccessor interface {
	CosmosPersistable
	GetCosmosUID() string
	GetResourceID() *azcorearm.ResourceID
	SetResourceID(*azcorearm.ResourceID)
	GetEtag() azcore.ETag
	SetEtag(cosmosETag azcore.ETag)
	GetPartitionKey() string
	SetPartitionKey(string)
	GetInstanceVersion() int64
	SetInstanceVersion(int64)
}

type CosmosMetadataAccessorPtr[T any] interface {
	*T
	CosmosMetadataAccessor
}

type CosmosPersistable interface {
	GetCosmosData() *CosmosMetadata
}

type CreatedByType string

type CustomerAPIProfile struct {
	Visibility      metadataapi.Visibility `json:"visibility,omitempty"`
	AuthorizedCIDRs []string               `json:"authorizedCidrs,omitempty"`
}

type CustomerDNSProfile struct {
	BaseDomainPrefix string `json:"baseDomainPrefix,omitempty"`
}

type CustomerIngressProfile struct {
	Type metadataapi.IngressType `json:"type,omitempty"`
}

type CustomerManagedEncryptionProfile struct {
	EncryptionType metadataapi.CustomerManagedEncryptionType `json:"encryptionType,omitempty"`
	Kms            *KmsEncryptionProfile                     `json:"kms,omitempty"`
}

type CustomerPlatformProfile struct {
	ManagedResourceGroup    string                         `json:"managedResourceGroup,omitempty"`
	SubnetID                *azcorearm.ResourceID          `json:"subnetId,omitempty"`
	VnetIntegrationSubnetID *azcorearm.ResourceID          `json:"vnetIntegrationSubnetId,omitempty"`
	OutboundType            metadataapi.OutboundType       `json:"outboundType,omitempty"`
	NetworkSecurityGroupID  *azcorearm.ResourceID          `json:"networkSecurityGroupId,omitempty"`
	OperatorsAuthentication OperatorsAuthenticationProfile `json:"operatorsAuthentication,omitempty"`
}

type DeploymentPreflight struct {
	Resources []json.RawMessage `json:"resources"`
}

type DeploymentPreflightResource struct {
	Name       string `json:"name"`
	Type       string `json:"type"`
	Location   string `json:"location"`
	APIVersion string `json:"apiVersion,omitempty"`

	// Preserve other tracked resource fields as raw data.
	Identity   json.RawMessage `json:"identity,omitempty"`
	Properties json.RawMessage `json:"properties,omitempty"`
	Tags       json.RawMessage `json:"tags,omitempty"`
	SystemData json.RawMessage `json:"systemData,omitempty"`
}

type DeploymentPreflightResponse struct {
	Status DeploymentPreflightStatus `json:"status"`
	Error  *CloudErrorBody           `json:"error,omitempty"`
}

type DeploymentPreflightStatus string

type EtcdDataEncryptionProfile struct {
	KeyManagementMode metadataapi.EtcdDataEncryptionKeyManagementModeType `json:"keyManagementMode,omitempty"`
	CustomerManaged   *CustomerManagedEncryptionProfile                   `json:"customerManaged,omitempty"`
}

type EtcdProfile struct {
	DataEncryption EtcdDataEncryptionProfile `json:"dataEncryption,omitempty"`
}

type ExperimentalFeatures struct {
	// ControlPlaneAvailability controls the AvailabilityPolicy for control
	// plane components. When set to SingleReplica, CS configures the cluster
	// with AvailabilityPolicy set to SingleReplica.
	ControlPlaneAvailability ControlPlaneAvailability `json:"singleReplica,omitempty"`

	// ControlPlanePodSizing controls resource request sizing for hosted
	// control plane components. When set to Minimal, CS sets the
	// ClusterSizeOverride annotation for reduced resource requests.
	ControlPlanePodSizing ControlPlanePodSizing `json:"sizeOverride,omitempty"`

	// ControlPlaneOperatorImage overrides the control plane operator
	// image for a HostedCluster. When non-empty, the OCM converter sets
	// the control_plane_operator_image CS cluster property, which CS
	// translates into the HostedCluster annotation.
	ControlPlaneOperatorImage string `json:"controlPlaneOperatorImage,omitempty"`
}

type ExternalAuthClaimProfile struct {
	Mappings        TokenClaimMappingsProfile  `json:"mappings"`
	ValidationRules []TokenClaimValidationRule `json:"validationRules"`
}

type ExternalAuthClientComponentProfile struct {
	Name                string `json:"name"`
	AuthClientNamespace string `json:"authClientNamespace"`
}

type ExternalAuthClientProfile struct {
	Component   ExternalAuthClientComponentProfile `json:"component"`
	ClientID    string                             `json:"clientId"`
	ExtraScopes []string                           `json:"extraScopes"`
	Type        metadataapi.ExternalAuthClientType `json:"type"`
}

type Feature struct {
	Name  *string `json:"name,omitempty"`
	State *string `json:"state,omitempty"`
}

type GroupClaimProfile struct {
	Claim  string `json:"claim"`
	Prefix string `json:"prefix"`
}

type HCPClusterActiveVersion struct {
	// Version is the full version in x.y.z format (e.g., "4.19.2")
	Version *semver.Version `json:"version,omitempty"`
	// State is the update state from OpenShift (e.g. configv1.CompletedUpdate or configv1.PartialUpdate).
	State configv1.UpdateState `json:"state,omitempty"`
}

type HCPNodePoolActiveVersion struct {
	// Version is the full version in x.y.z format (e.g., "4.19.2")
	Version *semver.Version `json:"version,omitempty"`
}

type HCPOpenShiftCluster struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	TrackedResource

	// Written by: Frontend PUT/PATCH Cluster, ClusterBaseDomainPrefixSync
	CustomerProperties HCPOpenShiftClusterCustomerProperties `json:"customerProperties,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE Cluster, all Operation*Cluster controllers, ClusterPropertiesSync, ClusterClusterServiceCreate, ClusterDeletion* controllers, CreateBillingDoc
	ServiceProviderProperties HCPOpenShiftClusterServiceProviderProperties `json:"serviceProviderProperties,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster (Create/Update), IdentityMigration
	Identity *ManagedServiceIdentity `json:"identity,omitempty"`
	// Written by: ClusterDegradedAggregator, ClusterRequirementsValidAggregator
	Status HCPOpenShiftClusterStatus `json:"status"`
}

type HCPOpenShiftClusterAdminCredential struct {
	ExpirationTimestamp time.Time `json:"expirationTimestamp"`
	Kubeconfig          string    `json:"kubeconfig"`
}

type HCPOpenShiftClusterAdminCredentialRequest struct {
	CertificateSigningRequest string `json:"certificateSigningRequest,omitempty"`
}

type HCPOpenShiftClusterCustomerProperties struct {
	// Written by: Frontend PUT/PATCH Cluster
	Version VersionProfile `json:"version,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster, ClusterBaseDomainPrefixSync (BaseDomainPrefix only)
	DNS CustomerDNSProfile `json:"dns,omitempty"`
	// Written by: Frontend PUT Cluster (Create)
	Network NetworkProfile `json:"network,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	API CustomerAPIProfile `json:"api,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	Ingress CustomerIngressProfile `json:"ingress,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	Platform CustomerPlatformProfile `json:"platform,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	Autoscaling ClusterAutoscalingProfile `json:"autoscaling,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	NodeDrainTimeoutMinutes int32 `json:"nodeDrainTimeoutMinutes,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	Etcd EtcdProfile `json:"etcd,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	ClusterImageRegistry ClusterImageRegistryProfile `json:"clusterImageRegistry,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	ImageDigestMirrors []ImageDigestMirror `json:"imageDigestMirrors,omitempty"`
	// Written by: Frontend PUT Cluster
	CryptoRestrictions metadataapi.CryptoRestrictions `json:"cryptoRestrictions,omitempty"`
}

type HCPOpenShiftClusterExternalAuth struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	ProxyResource
	// Written by: Frontend PUT/PATCH ExternalAuth, OperationExternalAuth* controllers
	Properties HCPOpenShiftClusterExternalAuthProperties `json:"properties"`
	// Written by: Frontend PUT/PATCH/DELETE ExternalAuth, OperationExternalAuth* controllers, ExternalAuthClusterServiceCreate, ExternalAuthDeletion* controllers
	ServiceProviderProperties HCPOpenShiftClusterExternalAuthServiceProviderProperties `json:"serviceProviderProperties,omitempty"`
	// Written by: ExternalAuthDegradedAggregator
	Status HCPOpenShiftClusterExternalAuthStatus `json:"status"`
}

type HCPOpenShiftClusterExternalAuthList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []HCPOpenShiftClusterExternalAuth `json:"items"`
}

type HCPOpenShiftClusterExternalAuthProperties struct {
	// Written by: Frontend PUT/PATCH/DELETE ExternalAuth, OperationExternalAuthCreate, OperationExternalAuthUpdate, OperationExternalAuthDelete
	ProvisioningState ProvisioningState `json:"provisioningState"`
	// Written by: Frontend PUT/PATCH ExternalAuth
	Issuer TokenIssuerProfile `json:"issuer"`
	// Written by: Frontend PUT/PATCH ExternalAuth
	Clients []ExternalAuthClientProfile `json:"clients"`
	// Written by: Frontend PUT/PATCH ExternalAuth
	Claim ExternalAuthClaimProfile `json:"claim"`
}

type HCPOpenShiftClusterExternalAuthServiceProviderProperties struct {
	// Written by: Frontend PUT ExternalAuth (Create), ExternalAuthClusterServiceCreate, ExternalAuthDeletionClusterServiceIDClearer
	ClusterServiceID *metadataapi.InternalID `json:"clusterServiceID,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE ExternalAuth, OperationExternalAuthCreate, OperationExternalAuthUpdate, OperationExternalAuthDelete
	ActiveOperationID string `json:"activeOperationId,omitempty"`
	// DeletionTimestamp is the timestamp at which the ExternalAuth deletion was requested.
	// The timestamp is in UTC.
	// A nil value indicates that the ExternalAuth deletion has not been requested.
	// Written by: Frontend DELETE ExternalAuth
	DeletionTimestamp *metav1.Time `json:"deletionTimestamp,omitempty"`
	// ClusterServiceDeletionTimestamp is written when a dispatch of a Cluster
	// Service Delete ExternalAuth request against Cluster Service for this
	// external auth has been handled.
	// Written by: ExternalAuthClusterServiceDeleteDispatch
	ClusterServiceDeletionTimestamp *metav1.Time `json:"clusterServiceDeletionTimestamp,omitempty"`

	// Written by: Frontend DELETE ExternalAuth
	UsesNewExternalAuthDeletionApproach bool `json:"usesNewExternalAuthDeletionApproach"`
}

type HCPOpenShiftClusterExternalAuthStatus struct {
	// Conditions are the top-level HCPOpenShiftClusterExternalAuth status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// Written by: ExternalAuthDegradedAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// UserFacingConditions is a list of conditions that tracks user-facing external auth
	// conditions. Each Condition Type should be unique among all conditions.
	// The conditions here are exposed to the ARM API. This means that UserFacingConditions
	// must not contain any internal details. This also means the Type and Reason
	// values become part of the public API.
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	UserFacingConditions []metav1.Condition `json:"userFacingConditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type HCPOpenShiftClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []HCPOpenShiftCluster `json:"items"`
}

type HCPOpenShiftClusterNodePool struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	TrackedResource
	// Written by: Frontend PUT/PATCH NodePool, OperationNodePoolCreate, OperationNodePoolUpdate, OperationNodePoolDelete
	Properties HCPOpenShiftClusterNodePoolProperties `json:"properties,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE NodePool, OperationNodePool* controllers, NodePoolClusterServiceCreate, NodePoolDeletion* controllers
	ServiceProviderProperties HCPOpenShiftClusterNodePoolServiceProviderProperties `json:"serviceProviderProperties,omitempty"`
	Identity                  *ManagedServiceIdentity                              `json:"identity,omitempty"`
	// Written by: NodePoolDegradedAggregator, NodePoolRequirementsValidAggregator
	Status HCPOpenShiftClusterNodePoolStatus `json:"status"`
}

type HCPOpenShiftClusterNodePoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []HCPOpenShiftClusterNodePool `json:"items"`
}

type HCPOpenShiftClusterNodePoolProperties struct {
	// Written by: Frontend PUT/PATCH/DELETE NodePool, OperationNodePoolCreate, OperationNodePoolUpdate, OperationNodePoolDelete
	ProvisioningState ProvisioningState `json:"provisioningState,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Version NodePoolVersionProfile `json:"version,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Platform NodePoolPlatformProfile `json:"platform,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Replicas int32 `json:"replicas,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	AutoRepair bool `json:"autoRepair,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	AutoScaling *NodePoolAutoScaling `json:"autoScaling,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Labels map[string]string `json:"labels,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Taints []Taint `json:"taints,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	NodeDrainTimeoutMinutes *int32 `json:"nodeDrainTimeoutMinutes,omitempty"`
}

type HCPOpenShiftClusterNodePoolServiceProviderProperties struct {
	// Written by: Frontend PUT NodePool (Create), NodePoolClusterServiceCreate, NodePoolDeletionClusterServiceIDClearer
	ClusterServiceID *metadataapi.InternalID `json:"clusterServiceID,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE NodePool, OperationNodePoolCreate, OperationNodePoolUpdate, OperationNodePoolDelete
	ActiveOperationID string `json:"activeOperationId,omitempty"`
	// DeletionTimestamp is the timestamp at which the NodePool deletion was requested.
	// The timestamp is in UTC.
	// A nil value indicates that the NodePool deletion has not been requested.
	// Written by: Frontend DELETE NodePool
	DeletionTimestamp *metav1.Time `json:"deletionTimestamp,omitempty"`
	// ClusterServiceDeletionTimestamp is written when a dispatch of a Cluster
	// Service Delete NodePool request against Cluster Service for this node
	// pool has been handled.
	// Written by: NodePoolClusterServiceDeleteDispatch
	ClusterServiceDeletionTimestamp *metav1.Time `json:"clusterServiceDeletionTimestamp,omitempty"`

	// Written by: Frontend DELETE NodePool
	UsesNewNodePoolDeletionApproach bool `json:"usesNewNodePoolDeletionApproach"`

	// CreateOperationCompletionDeadline is the time by which the node pool creation operation must complete.
	// If it is not complete by this time, the operation will be marked as failed with the best message we can give at the time.
	// The default value is 60 minutes after the creation request is received.
	// When the subscription.HasRegisteredFeature(api.FeatureExperimentalReleaseFeatures), this value can be set
	// using the ExperimentalNodePoolTagPrefix + "max-creation-duration" tag, specified as a time.Duration.
	// The operation node pool create controller uses this value to decide about marking the install as failed.
	// The e2e tests set this value to one minute less than the default timeout.
	CreateOperationCompletionDeadline *metav1.Time `json:"createOperationCompletionDeadline,omitempty"`
}

type HCPOpenShiftClusterNodePoolStatus struct {
	// Conditions are the top-level HCPOpenShiftClusterNodePool status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// Written by: NodePoolDegradedAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// UserFacingConditions is a list of conditions that tracks user-facing node pool
	// conditions. Each Condition Type should be unique among all conditions.
	// The conditions here are exposed to the ARM API. This means that UserFacingConditions
	// must not contain any internal details. This also means the Type and Reason
	// values become part of the public API.
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum.
	// Written by: NodePoolRequirementsValidAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	UserFacingConditions []metav1.Condition `json:"userFacingConditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type HCPOpenShiftClusterServiceProviderProperties struct {
	// Written by: Frontend PUT/PATCH/DELETE Cluster, OperationClusterCreate, OperationClusterUpdate, OperationClusterDelete
	ProvisioningState ProvisioningState `json:"provisioningState,omitempty"`
	// Written by: ClusterPendingClusterServiceIDAssign
	PendingClusterServiceID *metadataapi.InternalID `json:"pendingClusterServiceID,omitempty"`
	// Written by: Frontend PUT Cluster (Create), ClusterClusterServiceCreate, ClusterDeletionClusterServiceIDClearer
	ClusterServiceID *metadataapi.InternalID `json:"clusterServiceID,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE Cluster, OperationClusterCreate, OperationClusterUpdate, OperationClusterDelete
	ActiveOperationID string `json:"activeOperationId,omitempty"`
	// Written by: Frontend POST RevokeCredentials, SystemAdminCredentialOperationRevokeCredentialsPoll
	RevokeCredentialsOperationID string `json:"revokeCredentialsOperationId,omitempty"`
	// Written by: ClusterPropertiesSync
	DNS ServiceProviderDNSProfile `json:"dns,omitempty"`
	// Written by: ClusterPropertiesSync
	Console ServiceProviderConsoleProfile `json:"console,omitempty"`
	// Written by: ClusterPropertiesSync
	API ServiceProviderAPIProfile `json:"api,omitempty"`
	// Written by: ClusterPropertiesSync
	Platform ServiceProviderPlatformProfile `json:"platform,omitempty"`

	// ExperimentalFeatures captures experimental feature state evaluated from
	// AFEC and per-resource tags. Stored in Cosmos but NOT exposed via ARM API.
	// Written by: Frontend PUT Cluster (Create)
	ExperimentalFeatures ExperimentalFeatures `json:"experimentalFeatures,omitzero"`
	// ManagedIdentitiesDataPlaneIdentityURL is the Managed Identities Data Plane
	// Identity URL associated with the cluster. It is the URL that will be used
	// to communicate with the Managed Identities Resource Provider (MI RP).
	// Written by: Frontend PUT Cluster (Create)
	ManagedIdentitiesDataPlaneIdentityURL string `json:"managedIdentitiesDataPlaneIdentityURL,omitempty"`
	// Written by: BackfillClusterUID
	ClusterUID string `json:"clusterUID,omitempty"`
	// BillingDocumentCosmosID is the Cosmos DB document ID of the billing document
	// associated with this cluster. It is set when the billing document is created
	// and used to avoid redundant creation attempts.
	// Written by: CreateBillingDoc
	BillingDocumentCosmosID string `json:"billingDocumentCosmosID,omitempty"`
	// DeletionTimestamp is the timestamp at which the Cluster deletion was requested.
	// The timestamp is in UTC.
	// A nil value indicates that the Cluster deletion has not been requested.
	// Written by: Frontend DELETE Cluster
	DeletionTimestamp *metav1.Time `json:"deletionTimestamp,omitempty"`
	// ClusterServiceDeletionTimestamp is written when a dispatch of a Cluster
	// Service Delete Cluster request against Cluster Service for this cluster
	// has been handled. It is set after a successful DeleteCluster call to
	// Cluster Service, but also when it's determined that no delete call is
	// needed but we consider we should behave as if the delete call was
	// successfully issued.
	// A nil value indicates that the Cluster Service Deletion has not been requested.
	// The timestamp is in UTC.
	// Written by: ClusterClusterServiceDeleteDispatch
	ClusterServiceDeletionTimestamp *metav1.Time `json:"clusterServiceDeletionTimestamp,omitempty"`

	// TODO Temporary field to track whether the cluster operation is using the new deletion approach.
	// Written by: Frontend DELETE Cluster
	UsesNewClusterDeletionApproach bool `json:"usesNewClusterDeletionApproach"`

	// CreateOperationCompletionDeadline is the time by which the cluster creation operation must complete.
	// If it is not complete by this time, the operation will be marked as failed with the best message we can give at the time.
	// The default value is 60 minutes after the creation request is received.
	// When the subscription.HasRegisteredFeature(api.FeatureExperimentalReleaseFeatures), this value can be set
	// using the ExperimentalClusterTagPrefix + "max-creation-duration" tag, specified as a time.Duration.
	// The operation cluster create controller uses this value to decide about marking the install as failed.
	// The e2e tests set this value to one minute less than the default timeout.
	CreateOperationCompletionDeadline *metav1.Time `json:"createOperationCompletionDeadline,omitempty"`

	// DeleteOperationCompletionTimeout is the duration after which a cluster deletion operation will be
	// marked as failed with a message listing the remaining cosmos resources preventing deletion.
	// Set by admission on CREATE and UPDATE from the TagClusterMaxDeletionDuration tag.
	// Nil when the tag is absent or the ExperimentalReleaseFeatures AFEC is not registered.
	// The frontend DELETE handler computes the deadline as DeletionTimestamp + this duration.
	// Written by: Frontend PUT/PATCH Cluster (via admission)
	DeleteOperationCompletionTimeout *time.Duration `json:"deleteOperationCompletionTimeout,omitempty"`

	// DeleteOperationCompletionDeadline is the absolute time by which the cluster deletion operation
	// must complete. Computed by the frontend DELETE handler as DeletionTimestamp + DeleteOperationCompletionTimeout
	// (or DeletionTimestamp + 12h when DeleteOperationCompletionTimeout is nil).
	// Written by: Frontend DELETE Cluster
	DeleteOperationCompletionDeadline *metav1.Time `json:"deleteOperationCompletionDeadline,omitempty"`
}

type HCPOpenShiftClusterStatus struct {
	// Conditions are the top-level HCPOpenShiftCluster status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// Written by: ClusterDegradedAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// UserFacingConditions is a list of conditions that tracks user-facing cluster
	// conditions. Each Condition Type should be unique among all conditions.
	// The conditions here are exposed to the ARM API. This means that UserFacingConditions
	// must not contain any internal details. This also means the Type and Reason
	// values become part of the public API.
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum.
	// Written by: ClusterRequirementsValidAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	UserFacingConditions []metav1.Condition `json:"userFacingConditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type HCPOpenShiftVersion struct {
	ProxyResource
	Properties HCPOpenShiftVersionProperties `json:"properties,omitempty"`
}

type HCPOpenShiftVersionProperties struct {
	ChannelGroup       string    `json:"channelGroup"`
	Enabled            bool      `json:"enabled"`
	EndOfLifeTimestamp time.Time `json:"endOfLifeTimestamp"`
}

type HostedClusterControlPlaneSize string

type ImageDigestMirror struct {
	Source  string   `json:"source,omitempty"`
	Mirrors []string `json:"mirrors,omitempty"`

	// MirrorSourcePolicy is not exposed in the customer-facing API as of
	// v20251223preview, but is still recorded in CosmosDB so that, if we
	// ever do expose this field, existing cluster documents in CosmosDB
	// will not need to be migrated.
	MirrorSourcePolicy metadataapi.MirrorSourcePolicy `json:"mirrorSourcePolicy,omitempty"`
}

type KmsEncryptionProfile struct {
	Visibility metadataapi.KeyVaultVisibility `json:"visibility,omitempty"`
	ActiveKey  KmsKey                         `json:"activeKey,omitempty"`
}

type KmsKey struct {
	Name      string `json:"name"`
	VaultName string `json:"vaultName"`
	Version   string `json:"version"`
}

type MaestroBundleInternalName string

type MaestroBundleReference struct {
	// Name is a logical name that represents the Maestro Bundle conceptually.
	Name MaestroBundleInternalName `json:"name"`
	// MaestroAPIMaestroBundleName is the name of the Maestro Bundle in the Maestro API.
	// It must be unique within a given Maestro Consumer Name and Maestro Source ID.
	// Maestro's ManifestWorks Go client abstraction uses Maestro Bundle Names to
	// identify the Maestro Bundle.
	MaestroAPIMaestroBundleName string `json:"maestroAPIMaestroBundleName"`
	// MaestroAPIMaestroBundleID is the ID of the Maestro Bundle in the Maestro API.
	// Returned by the Maestro API when the Maestro Bundle is first created.
	// This attribute can be unset if the Maestro Bundle reference has been created
	// but the Maestro Bundle has not been created yet.
	// Maestro's REST API Go client abstraction uses Maestro Bundle IDs to identify the Maestro Bundle.
	MaestroAPIMaestroBundleID string `json:"maestroAPIMaestroBundleID"`
	// ResourceIdentifiers contains the identifiers for all resources within the Maestro Bundle.
	// Each entry corresponds to a ResourceIdentifier in the ManifestWork's ManifestConfigs.
	ResourceIdentifiers []MaestroBundleResourceIdentifier `json:"resourceIdentifiers,omitempty"`
}

type MaestroBundleReferenceList []*MaestroBundleReference

type MaestroBundleResourceIdentifier struct {
	// APIVersion is the API version of the resource (e.g. "hypershift.openshift.io/v1beta1").
	APIVersion string `json:"apiVersion"`
	// Kind is the kind of the resource (e.g. "HostedCluster").
	Kind string `json:"kind"`
	// Resource is the resource type (e.g. "hostedclusters").
	// This corresponds to the ResourceIdentifier.Resource in the ManifestWork's ManifestConfigs.
	Resource string `json:"resource"`
	// Name is the name of the resource.
	// For example, for a HostedCluster bundle this is the HostedCluster name on the management cluster.
	Name string `json:"name"`
	// Namespace is the namespace of the resource.
	// For example, for a HostedCluster bundle this is the HostedCluster namespace on the management cluster.
	Namespace string `json:"namespace"`
}

type ManagedServiceIdentity struct {
	PrincipalID            string                           `json:"principalId,omitempty"`
	TenantID               string                           `json:"tenantId,omitempty"`
	Type                   ManagedServiceIdentityType       `json:"type"`
	UserAssignedIdentities map[string]*UserAssignedIdentity `json:"userAssignedIdentities,omitempty"`
}

type ManagedServiceIdentityType string

type ManagementClusterContent struct {
	// CosmosMetadata is nested under the corresponding resource type so that association and cleanup work as expected.
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// Status track the status of the Management Cluster Content.
	Status ManagementClusterContentStatus `json:"status,omitempty"`
}

type ManagementClusterContentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ManagementClusterContent `json:"items"`
}

type ManagementClusterContentStatus struct {
	// Conditions is a list of conditions that track the status of the Management Cluster Content.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// A Condition Status of True means that the condition is met, and a Condition Status of False means that the condition is not met.
	// The Condition Reason and Message are used to provide more details about the condition status.
	// The Condition LastTransitionTime is used to track the last time the condition transitioned from one status to another.
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// KubeContent contains a list of K8s resources that represent content of the Management Cluster associated to this
	// resource ID.
	KubeContent *metav1.List `json:"kubeContent"`
}

type NamespaceOperation struct {
	// Operation name: {providerNamespace}/{resourceType}/{operation}
	Name string `json:"name"`

	// The object that describes the operation.
	Display NamespaceOperationDisplay `json:"display"`

	// Sources of requests to this operation. Valid values are
	// "user", "system", or, the default value, "user,system".
	Origin NamespaceOperationOrigin `json:"origin,omitempty"`

	// Indicates whether the operation applies to the data-plane.
	IsDataAction bool `json:"isDataAction"`
}

type NamespaceOperationDisplay struct {
	// The localized friendly form of the resource provider name.
	Provider string `json:"provider"`

	// The localized friendly form of the resource type related to this action/operation.
	Resource string `json:"resource"`

	// The localized friendly name for the operation, as it should be shown to the user.
	Operation string `json:"operation"`

	// The localized friendly description for the operation, as it should be shown to the user.
	Description string `json:"description"`
}

type NamespaceOperationOrigin string

type NetworkProfile struct {
	NetworkType metadataapi.NetworkType `json:"networkType,omitempty"`
	PodCIDR     string                  `json:"podCidr,omitempty"`
	ServiceCIDR string                  `json:"serviceCidr,omitempty"`
	MachineCIDR string                  `json:"machineCidr,omitempty"`
	HostPrefix  int32                   `json:"hostPrefix,omitempty"`
}

type NodePoolAutoScaling struct {
	Min int32 `json:"min,omitempty"`
	Max int32 `json:"max,omitempty"`
}

type NodePoolPlatformProfile struct {
	// SubnetID is the resource ID of the subnet to use for this Node Pool's virtual machines.
	// * If SubnetID is nil on CREATE, mutation defaults it to the parent cluster's subnet.
	// * SubnetID must belong to the same VNet as the parent cluster's subnet.
	// * The same subnet may be used across Node Pools of the same cluster (and may match
	//   the parent cluster's subnet), but a subnet cannot be reused across different
	//   ARO-HCP Clusters.
	SubnetID               *azcorearm.ResourceID `json:"subnetId,omitempty"`
	VMSize                 string                `json:"vmSize,omitempty"`
	EnableEncryptionAtHost bool                  `json:"enableEncryptionAtHost"`
	OSDisk                 OSDiskProfile         `json:"osDisk"`
	// AvailabilityZone can be empty.
	// * If AvailabilityZone is not specified during creation, then the Node Pool is not part of any Availability Zone and the Node Pool's
	//   virtual machines are included in an Availability Set.
	// * If AvailabilityZone is specified, then the virtual machines are deployed as standalone instances in the specified Availability Zone.
	// * It must not be specified for Node Pools whose parent cluster is in an Azure location that does not support Availability Zones
	// * It is a logical Availability Zone
	// * It is optional during creation and immutable
	AvailabilityZone string `json:"availabilityZone,omitempty"`
}

type NodePoolVersionProfile struct {
	ID           string `json:"id,omitempty"`
	ChannelGroup string `json:"channelGroup,omitempty"`
}

type OSDiskProfile struct {
	SizeGiB                *int32                             `json:"sizeGiB,omitempty"`
	DiskStorageAccountType metadataapi.DiskStorageAccountType `json:"diskStorageAccountType,omitempty"`
	EncryptionSetID        *azcorearm.ResourceID              `json:"encryptionSetId,omitempty"`
	DiskType               metadataapi.OsDiskType             `json:"diskType,omitempty"`
}

type Operation struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// TenantID is the tenant ID of the client that requested the operation
	TenantID string `json:"tenantId,omitempty"`
	// ClientID is the object ID of the client that requested the operation
	ClientID string `json:"clientId,omitempty"`
	// Request is the type of asynchronous operation requested
	Request OperationRequest `json:"request,omitempty"`
	// ExternalID is the Azure resource ID of the cluster or node pool
	ExternalID *azcorearm.ResourceID `json:"externalId,omitempty"`
	// InternalID is the Cluster Service resource identifier in the form of a URL path
	InternalID metadataapi.InternalID `json:"internalId,omitempty"`
	// OperationID is the Azure resource ID of the operation status (may be nil if the
	// operation was implicit, such as deleting a child resource along with the parent)
	OperationID *azcorearm.ResourceID `json:"operationId,omitempty"`
	// ClientRequestID is provided by the "x-ms-client-request-id" request header
	ClientRequestID string `json:"clientRequestId,omitempty"`
	// CorrelationRequstID is provided by the "x-ms-correlation-request-id" request header
	CorrelationRequestID string `json:"correlationRequestId,omitempty"`
	// NotificationURI is provided by the Azure-AsyncNotificationUri header if the
	// Async Operation Callbacks ARM feature is enabled
	NotificationURI string `json:"notificationUri,omitempty"`

	// StartTime marks the start of the operation
	StartTime time.Time `json:"startTime,omitempty"`
	// LastTransitionTime marks the most recent state change
	LastTransitionTime time.Time `json:"lastTransitionTime,omitempty"`
	// Status is the current operation status, using the same set of values
	// as the resource's provisioning state
	Status ProvisioningState `json:"status,omitempty"`
	// Error is an OData error, present when Status is "Failed" or "Canceled"
	Error *CloudErrorBody `json:"error,omitempty"`

	// Temporary field to track whether the node pool operation is using the new deletion approach.
	// We are migrating from the node pool cs deletion synchronous in frontend to the backend, to be fully asynchronous
	// This boolean is true for NodePool delete operations that are created with new deletion approach.
	// This will be removed once all nodepools whose deletion was triggered before the new approach is fully rolled out have been
	// fully deleted in all ARO-HCP permanent environments, for all regions.
	UsesNewNodePoolDeletionApproach bool `json:"usesNewNodePoolDeletionApproach"`

	// TODO Temporary field to track whether the external auth operation is using the new deletion approach.
	// We are migrating from the external auth CS deletion synchronous in frontend to the backend, to be fully asynchronous.
	// This boolean is true for ExternalAuth delete operations that are created with new deletion approach.
	// This will be removed once all external auths whose deletion was triggered before the new approach is fully rolled out have been
	// fully deleted in all ARO-HCP permanent environments, for all regions.
	UsesNewExternalAuthDeletionApproach bool `json:"usesNewExternalAuthDeletionApproach"`

	// TODO Temporary field to track whether the cluster operation is using the new deletion approach.
	// We are migrating from the cluster CS deletion synchronous in frontend to the backend, to be fully asynchronous.
	// This boolean is true for Cluster delete operations that are created with new deletion approach.
	// This will be removed once all clusters whose deletion was triggered before the new approach is fully rolled out have been
	// fully deleted in all ARO-HCP permanent environments, for all regions.
	UsesNewClusterDeletionApproach bool `json:"usesNewClusterDeletionApproach"`

	// Written by: Frontend POST requestAdminCredential, backend systemadmincredentialcontrollers
	SystemAdminCredentialRequest *OperationSystemAdminCredentialRequest `json:"systemAdminCredentialRequest,omitempty"`
	// Written by: Frontend POST revokeCredentials, backend systemadmincredentialcontrollers
	SystemAdminCredentialRevocation *OperationSystemAdminCredentialRevocation `json:"systemAdminCredentialRevocation,omitempty"`
}

type OperationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Operation `json:"items"`
}

type OperationRequest string

type OperationStatus struct {
	ID              *azcorearm.ResourceID `json:"id,omitempty"`
	Name            string                `json:"name,omitempty"`
	Status          ProvisioningState     `json:"status"`
	StartTime       *time.Time            `json:"startTime,omitempty"`
	EndTime         *time.Time            `json:"endTime,omitempty"`
	PercentComplete float64               `json:"percentComplete,omitempty"`
	Properties      json.RawMessage       `json:"properties,omitempty"`
	Error           *CloudErrorBody       `json:"error,omitempty"`
	Operations      []OperationStatus     `json:"operations,omitempty"`
}

type OperationSystemAdminCredentialRequest struct {
	CertificateSigningRequest              string                `json:"certificateSigningRequest,omitempty"`
	SystemAdminCredentialRequestResourceID *azcorearm.ResourceID `json:"systemAdminCredentialRequestResourceID,omitempty"`
}

type OperationSystemAdminCredentialRevocation struct {
	SystemAdminCredentialRevocationResourceID *azcorearm.ResourceID `json:"systemAdminCredentialRevocationResourceID,omitempty"`
}

type OperatorsAuthenticationProfile struct {
	UserAssignedIdentities UserAssignedIdentitiesProfile `json:"userAssignedIdentities,omitempty"`
}

type PagedResponse struct {
	Value    []json.RawMessage `json:"value"`
	NextLink string            `json:"nextLink,omitempty"`
}

type ProvisioningState string

type ProxyResource struct {
	Resource
}

type Resource struct {
	ID         *azcorearm.ResourceID `json:"id,omitempty"`
	Name       string                `json:"name,omitempty"`
	Type       string                `json:"type,omitempty"`
	SystemData *SystemData           `json:"systemData,omitempty"`
}

type ServiceProviderAPIProfile struct {
	URL string `json:"url,omitempty"`
}

type ServiceProviderCluster struct {
	// CosmosMetadata ResourceID is nested under the cluster so that association and cleanup work as expected
	// it will be the ServiceProviderCluster type and the name default.
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	LoadBalancerResourceID *azcorearm.ResourceID `json:"loadBalancerResourceID,omitempty"`

	Spec ServiceProviderClusterSpec `json:"spec"`

	// Status contains the observed state of the cluster.
	Status ServiceProviderClusterStatus `json:"status,omitempty"`
}

type ServiceProviderClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceProviderCluster `json:"items"`
}

type ServiceProviderClusterSpec struct {
	// ControlPlaneVersion contains the desired control plane version information.
	// Example JSON structure:
	// {
	//   "control_plane_version": {
	//     "desired_version": "4.19.2"
	//   }
	// }
	ControlPlaneVersion ServiceProviderClusterSpecVersion `json:"control_plane_version,omitempty"`

	// DesiredHostedCluster is the HostedCluster that we want to exist on the management cluster.
	// We will only explicitly set the fields we care about, but serialization may store additional empty fields.
	// Once this contains the critical values, we will create it on management clusters.
	// We may or may not choose to store the actual state in status.  We may choose to store the actual state independently.
	DesiredHostedCluster *v1beta1.HostedCluster `json:"desiredHostedCluster,omitempty"`

	// DesiredHostedClusterControlPlaneSize is the SRE-selected control plane
	// sizing tier (one of "Small", "Medium", "Large", "Xlarge", "XXlarge") to
	// apply to the HostedCluster. Stored as *string so unset is distinguishable
	// from any explicit choice; nil means no tier has been requested. Valid
	// values are the HostedClusterControlPlaneSize* constants above.
	DesiredHostedClusterControlPlaneSize *string `json:"desiredHostedClusterControlPlaneSize,omitempty"`

	// BackupScheduleState is the desired backup scheduling state: Enabled or Disabled.
	// Default is Enabled. Set to Disabled via Admin API to pause scheduled backups.
	BackupScheduleState BackupScheduleState `json:"backupScheduleState,omitempty"`
}

type ServiceProviderClusterSpecVersion struct {
	// DesiredVersion is the full version the controller has resolved and wants to upgrade to (format: x.y.z)
	// This is compared on each sync to detect when a new upgrade should be triggered.
	DesiredVersion *semver.Version `json:"desired_version,omitempty"`
}

type ServiceProviderClusterStatus struct {
	// Conditions are the top-level ServiceProviderCluster status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// Known condition types are:
	// - "Progressing": True when the cluster is in the process of being created, updated, or deleted. Both end-user initiated actions as
	//   well as internal actions such as upgrades or other maintenance operations are in progress are included in thsi condition.
	// - "Degraded": True when the cluster is in a degraded state
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum. Take into consideration that conditions at other levels can be specified within
	// ServiceProviderClusterStatus too.
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
	// ControlPlaneVersion contains the actual control plane version information.
	// ActiveVersions contains all versions currently active in the control plane.
	//
	// During an upgrade, multiple versions can be active simultaneously. For example:
	// - Simple upgrade: [vNew, vOld]
	// - Sequential upgrades before completion: [vNewest, vNewer, vNew, vOld]
	//
	// The list is ordered with the most recent version first.
	//
	// Example JSON structure (state is "Completed" or "Partial"):
	// {
	//   "control_plane_version": {
	//     "active_versions": [
	//       {"version": "4.19.2", "state": "Partial"},
	//       {"version": "4.19.1", "state": "Completed"}
	//     ]
	//   }
	// }
	ControlPlaneVersion ServiceProviderClusterStatusVersion `json:"control_plane_version,omitempty"`

	// DesiredVersionChannels mirrors the observed HostedCluster's
	// status.version.desired.channels (see hypershift ClusterVersionStatus ->
	// configv1.Release.Channels). Each entry is an OpenShift update channel name
	// such as "stable-4.19" or "candidate-4.20".
	//
	// A channel only appears in status.version.desired.channels when the
	// cluster's current desired release has a valid upgrade edge to a release
	// served by that channel. In other words, this is the set of channels the
	// cluster can currently move along; a channel being absent means there is no
	// supported upgrade path to that channel's release line yet.
	//
	// This list is mirrored here by the backend (which alone can observe the
	// HostedCluster) so that DB-free cluster admission can reject a version.id
	// change whose target channel ("<channelGroup>-<id>") is not reachable,
	// without the frontend ever needing access to the management cluster.
	// Written by: ControlPlaneActiveVersions
	DesiredVersionChannels []string `json:"desiredVersionChannels,omitempty"`

	// Validations is a list of conditions that tracks the status of each cluster validation.
	// Each Condition Type represents a validation and it should be unique among all validations.
	// A Condition Status of True means that the validation passed successfully, and a Condition Status of False means that the validation failed.
	// The Condition Reason and Message are used to provide more details about the validation status.
	// The Condition LastTransitionTime is used to track the last time the validation transitioned from one status to another.
	Validations []metav1.Condition `json:"validations,omitempty"`
	// MaestroReadonlyBundles contains a list of Maestro readonly bundles references.
	// These bundles are used to retrieve particular K8s resources from the Management Cluster.
	// The reference contains a mapping between the logical name we give to the Maestro bundle internally
	// and the Maestro Bundle Name and ID at the Maestro API level.
	MaestroReadonlyBundles MaestroBundleReferenceList `json:"maestroReadonlyBundles,omitempty"`
	// ManagementClusterResourceID is the resource ID of the management cluster
	// this HCP is placed on. Nil means placement has not been resolved yet.
	// Once set, this field is immutable.
	ManagementClusterResourceID *azcorearm.ResourceID `json:"managementClusterResourceID,omitempty"`

	// DesiredHostedClusterControlPlaneSize mirrors the value of
	// Spec.DesiredHostedClusterControlPlaneSize once cluster-service reflects
	// the effective size override (as confirmed by the desired-control-plane-size
	// status reconciler). It exists so NeedsWork can cheaply detect divergence,
	// including the unset transition (Spec nil, Status non-nil), where there
	// is no signal on Spec alone that dispatch still needs to clear the CS
	// property.
	DesiredHostedClusterControlPlaneSize *string `json:"desiredHostedClusterControlPlaneSize,omitempty"`

	// HostedClusterNamespace is the namespace of the actual HostedCluster.  It contains things like
	//  - HostedCluster CR — the primary user-facing API object
	//  - NodePool CRs — user creates these here
	//  - User-provided secrets — pull secret, SSH key, cloud credentials, encryption secrets, etcd encryption key, audit webhook config, additional trust bundles, service account signing key
	//  - Generated kubeconfig secrets — admin-kubeconfig (copied back from HCP namespace), kubeadmin-password
	//  - EtcdBackup CRs (if used)
	// Written by: ServiceProviderClusterPropertiesSync
	HostedClusterNamespace string `json:"hostedClusterNamespace,omitempty"`

	// ControlPlaneNamespace is the namespace containing the pods that manage and run the HostedCluster.  It contains things like
	//  - etcd
	//  - kube-apiserver
	//  - control-plane-operator
	//  - control-plane-pki-operator
	// it is derived as <hostedClusterNamespace>-<hostedClusterName> with dots replaced by dashes.
	// Hypershift uses the HostedControlPlaneNamespace function.
	// Written by: ServiceProviderClusterPropertiesSync
	ControlPlaneNamespace string `json:"controlPlaneNamespace,omitempty"`

	// ServingCABundle is the PEM-encoded serving CA bundle for the cluster's
	// kube-apiserver. Populated from a ReadDesire mirror of the management
	// cluster's serving CA Secret.
	// Written by: ServiceProviderClusterPropertiesSync
	ServingCABundle string `json:"servingCABundle,omitempty"`

	// AzureResources tracks the lifecycle of Azure resources associated with
	// the cluster, including deny assignments and the managed resource group.
	AzureResources AzureResources `json:"azureResources,omitempty"`
}

type ServiceProviderClusterStatusVersion struct {
	// ActiveVersions is an array of versions currently active in the control plane, ordered with the most recent first.
	// During upgrades, multiple versions can be active simultaneously.
	ActiveVersions []HCPClusterActiveVersion `json:"active_versions,omitempty"`
}

type ServiceProviderConsoleProfile struct {
	URL string `json:"url,omitempty"`
}

type ServiceProviderDNSProfile struct {
	BaseDomain string `json:"baseDomain,omitempty"`
}

type ServiceProviderNodePool struct {
	// CosmosMetadata ResourceID is nested under the cluster so that association and cleanup work as expected
	// it will be the ServiceProviderNodePool type and the name default.
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// Spec contains the desired state of the nodepool
	Spec ServiceProviderNodePoolSpec `json:"spec,omitempty"`

	// Status contains the observed state of the nodepool
	Status ServiceProviderNodePoolStatus `json:"status,omitempty"`
}

type ServiceProviderNodePoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceProviderNodePool `json:"items"`
}

type ServiceProviderNodePoolSpec struct {
	// NodePoolVersion contains the desired node pool version information.
	// Example JSON structure:
	// {
	//   "nodePoolVersion": {
	//     "desiredVersion": "4.19.2"
	//   }
	// }
	NodePoolVersion ServiceProviderNodePoolSpecVersion `json:"nodePoolVersion,omitempty"`
}

type ServiceProviderNodePoolSpecVersion struct {
	// DesiredVersion is the full version the controller wants to upgrade to (format: x.y.z)
	DesiredVersion *semver.Version `json:"desiredVersion,omitempty"`
}

type ServiceProviderNodePoolStatus struct {
	// Conditions are the top-level ServiceProviderNodePoolStatus status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// Known condition types are:
	// - "Progressing": True when the cluster is in the process of being created, updated, or deleted. Both end-user initiated actions as
	//   well as internal actions such as upgrades or other maintenance operations are in progress are included in thsi condition.
	// - "Degraded": True when the cluster is in a degraded state
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum. Take into consideration that conditions at other levels can be specified within
	// ServiceProviderNodePoolStatus too.
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
	// NodePoolActiveVersions contains the actual node pool versions information
	// ServiceProviderNodePoolActiveVersions contains all versions currently active in the NodePool
	// During an upgrade, multiple versions can be active simultaneously. Meaning, there are nodes
	// with different versions. For example:
	// - Simple upgrade: [vNew, vOld]
	// - Sequential upgrades before completion: [vNewer, vNew, vOld]
	//
	// The list is ordered with the most recent version first.
	//
	// Example JSON structure:
	// {
	//   "nodePoolVersion":{
	//		"activeVersions": [
	//       {"version": "4.19.2"},
	//       {"version": "4.19.1"}
	//     ]
	//   }
	// }
	NodePoolVersion ServiceProviderNodePoolStatusVersion `json:"nodePoolVersion,omitempty"`

	// Validations is a list of conditions that tracks the status of each node pool validation.
	// Each Condition Type represents a validation and it should be unique among all validations.
	// A Condition Status of True means that the validation passed successfully, and a Condition Status of False means that the validation failed.
	// The Condition Reason and Message are used to provide more details about the validation status.
	// The Condition LastTransitionTime is used to track the last time the validation transitioned from one status to another.
	Validations []metav1.Condition `json:"validations,omitempty"`

	// MaestroReadonlyBundles contains a list of Maestro readonly bundles references.
	// These bundles are used to retrieve particular K8s resources from the Management Cluster.
	// The reference contains a mapping between the logical name we give to the Maestro bundle internally
	// and the Maestro Bundle Name and ID at the Maestro API level.
	MaestroReadonlyBundles MaestroBundleReferenceList `json:"maestroReadonlyBundles,omitempty"`
}

type ServiceProviderNodePoolStatusVersion struct {
	// ActiveVersions is an array of versions currently active in the nodepool, ordered with the most recent first.
	// During upgrades, multiple versions can be active simultaneously.
	ActiveVersions []HCPNodePoolActiveVersion `json:"activeVersions,omitempty"`
}

type ServiceProviderPlatformProfile struct {
	IssuerURL string `json:"issuerUrl,omitempty"`
}

type Subscription struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// kept so untyped client can function
	ResourceID *azcorearm.ResourceID `json:"resourceId,omitempty"`

	// The resource provider contract gives an example RegistrationDate
	// in RFC1123 format but does not explicitly state a required format
	// so we leave it a plain string.
	State            SubscriptionState       `json:"state"`
	RegistrationDate *string                 `json:"registrationDate"`
	Properties       *SubscriptionProperties `json:"properties"`

	// LastUpdated is a copy of the Cosmos DB system generated
	// "_ts" last updated timestamp field for metrics reporting.
	LastUpdated int `json:"-"`
}

type SubscriptionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Subscription `json:"items"`
}

type SubscriptionProperties struct {
	TenantId             *string              `json:"tenantId,omitempty"`
	LocationPlacementId  *string              `json:"locationPlacementId,omitempty"`
	QuotaId              *string              `json:"quotaId,omitempty"`
	RegisteredFeatures   *[]Feature           `json:"registeredFeatures,omitempty"`
	AvailabilityZones    *AvailabilityZone    `json:"availabilityZones,omitempty"`
	SpendingLimit        *string              `json:"spendingLimit,omitempty"`
	AccountOwner         *AccountOwner        `json:"accountOwner,omitempty"`
	ManagedByTenants     *[]map[string]string `json:"managedByTenants,omitempty"`
	AdditionalProperties any                  `json:"additionalProperties,omitempty"`
}

type SubscriptionState string

type SystemAdminCredentialRequest struct {
	CosmosMetadata `json:"cosmosMetadata"`

	Spec   SystemAdminCredentialRequestSpec   `json:"spec"`
	Status SystemAdminCredentialRequestStatus `json:"status"`
}

type SystemAdminCredentialRequestList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SystemAdminCredentialRequest `json:"items"`
}

type SystemAdminCredentialRequestSpec struct {
	// CreationTimestamp is when the credential request was created (server-set).
	// The garbage collector deletes each request once it is older than the
	// retention window, regardless of the request's status.
	// Written by: SystemAdminCredentialDispatchRequestCredential
	CreationTimestamp metav1.Time `json:"creationTimestamp"`
	// ExpirationTimestamp is when the cert ceases to be valid (server-set, now + 24h).
	// Written by: SystemAdminCredentialDispatchRequestCredential
	ExpirationTimestamp metav1.Time `json:"expirationTimestamp"`
	// OperationID is the ARM operation that created this credential request.
	// Written by: SystemAdminCredentialDispatchRequestCredential
	OperationID string `json:"operationID"`
	// CertificateSigningRequestPEM is the PEM-encoded PKCS#10 certificate signing
	// request provided by the caller. The backend embeds this directly in
	// the Kubernetes CertificateSigningRequest it creates on the management
	// cluster. The corresponding private key is held only by the caller.
	// Written by: SystemAdminCredentialDispatchRequestCredential
	CertificateSigningRequestPEM string `json:"certificateSigningRequestPEM"`
}