coreapi

type APIRegistry interface {
	Register(version Version) error
	ListVersions() set.Set[string]
	Lookup(key string) (version Version, ok bool)
}

type AccountOwner struct {
	Puid  *string `json:"puid,omitempty"`
	Email *string `json:"-,omitempty"` // we don't need to nor want to serialize this field
}

type AvailabilityZone struct {
	Location     *string        `json:"location,omitempty"`
	ZoneMappings *[]ZoneMapping `json:"zoneMappings,omitempty"`
}

type AzureMultiReference struct {
	// PendingAzureResources contains resource IDs that have been requested but
	// not yet confirmed to exist in Azure.
	PendingAzureResources []*azcorearm.ResourceID `json:"pendingAzureResources,omitempty"`
	// AzureResources contains resource IDs that have been confirmed to exist in Azure.
	AzureResources []*azcorearm.ResourceID `json:"azureResources,omitempty"`
}

type AzureReference struct {
	// PendingAzureResource is the resource ID that has been requested but
	// not yet confirmed to exist in Azure.
	PendingAzureResource *azcorearm.ResourceID `json:"pendingAzureResource,omitempty"`
	// AzureResource is the resource ID that has been confirmed to exist in Azure.
	AzureResource *azcorearm.ResourceID `json:"azureResource,omitempty"`
}

type AzureResources struct {
	// DenyAssignments tracks the deny assignments applied to the cluster's resources.
	DenyAssignments DenyAssignmentReferences `json:"denyAssignments,omitempty"`
	// ManagedResourceGroup tracks the managed resource group for the cluster.
	// Written by: EnsureManagedResourceGroup
	ManagedResourceGroup AzureReference `json:"managedResourceGroup,omitempty"`
	// RoleAssignments tracks the role assignments created on the managed resource group
	// for the cluster's control-plane and data-plane operator identities and its service
	// managed identity.
	// Written by: IdentityRoleAssignments
	RoleAssignments AzureMultiReference `json:"roleAssignments,omitempty"`
}

type BackupScheduleState string

type CloudError struct {
	// The HTTP status code
	StatusCode int `json:"-"`

	// The response body to be converted to JSON
	*CloudErrorBody `json:"error,omitempty"`
}

type CloudErrorBody struct {
	// An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
	Code string `json:"code,omitempty"`

	// A message describing the error, intended to be suitable for display in a user interface.
	Message string `json:"message,omitempty"`

	// The target of the particular error. For example, the name of the property in error.
	Target string `json:"target,omitempty"`

	// A list of additional details about the error.
	Details []CloudErrorBody `json:"details,omitempty"`
}

type Cluster struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	TrackedResource

	// Written by: Frontend PUT/PATCH Cluster, ClusterBaseDomainPrefixSync
	CustomerProperties ClusterCustomerProperties `json:"customerProperties,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE Cluster, all Operation*Cluster controllers, ClusterPropertiesSync, ClusterClusterServiceCreate, ClusterDeletion* controllers, CreateBillingDoc
	ServiceProviderProperties ClusterServiceProviderProperties `json:"serviceProviderProperties,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster (Create/Update), ClusterIdentitySync
	Identity *ManagedServiceIdentity `json:"identity,omitempty"`
	// Written by: ClusterDegradedAggregator, ClusterRequirementsValidAggregator
	Status ClusterStatus `json:"status"`
}

type ClusterAdminCredential struct {
	ExpirationTimestamp time.Time `json:"expirationTimestamp"`
	Kubeconfig          string    `json:"kubeconfig"`
}

type ClusterAdminCredentialRequest struct {
	CertificateSigningRequest string `json:"certificateSigningRequest,omitempty"`
}

type ClusterAutoscalingProfile struct {
	MaxNodesTotal               int32 `json:"maxNodesTotal,omitempty"`
	MaxPodGracePeriodSeconds    int32 `json:"maxPodGracePeriodSeconds,omitempty"`
	MaxNodeProvisionTimeSeconds int32 `json:"maxNodeProvisionTimeSeconds,omitempty"`
	PodPriorityThreshold        int32 `json:"podPriorityThreshold,omitempty"`
}

type ClusterCustomerProperties struct {
	// Written by: Frontend PUT/PATCH Cluster
	Version VersionProfile `json:"version,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster, ClusterBaseDomainPrefixSync (BaseDomainPrefix only)
	DNS CustomerDNSProfile `json:"dns,omitempty"`
	// Written by: Frontend PUT Cluster (Create)
	Network NetworkProfile `json:"network,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	API CustomerAPIProfile `json:"api,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	Ingress CustomerIngressProfile `json:"ingress,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	Platform CustomerPlatformProfile `json:"platform,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	Autoscaling ClusterAutoscalingProfile `json:"autoscaling,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	NodeDrainTimeoutMinutes int32 `json:"nodeDrainTimeoutMinutes,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	Etcd EtcdProfile `json:"etcd,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	ClusterImageRegistry ClusterImageRegistryProfile `json:"clusterImageRegistry,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	ImageDigestMirrors []ImageDigestMirror `json:"imageDigestMirrors,omitempty"`
	// Written by: Frontend PUT Cluster
	CryptoRestrictions metadataapi.CryptoRestrictions `json:"cryptoRestrictions,omitempty"`
}

type ClusterImageRegistryProfile struct {
	// state indicates the desired ImageStream-backed cluster image registry installation mode. This can only be set during cluster
	// creation and cannot be changed after cluster creation. Enabled means the
	// ImageStream-backed image registry will be run as pods on worker nodes in the cluster. Disabled means the ImageStream-backed
	// image registry will not be present in the cluster. The default is Enabled.
	State metadataapi.ClusterImageRegistryState `json:"state,omitempty"`
}

type ClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Cluster `json:"items"`
}

type ClusterServiceProviderProperties struct {
	// Written by: Frontend PUT/PATCH/DELETE Cluster, OperationClusterCreate, OperationClusterUpdate, OperationClusterDelete
	ProvisioningState ProvisioningState `json:"provisioningState,omitempty"`
	// Written by: ClusterPendingClusterServiceIDAssign
	PendingClusterServiceID *metadataapi.InternalID `json:"pendingClusterServiceID,omitempty"`
	// Written by: Frontend PUT Cluster (Create), ClusterClusterServiceCreate, ClusterDeletionClusterServiceIDClearer
	ClusterServiceID *metadataapi.InternalID `json:"clusterServiceID,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE Cluster, OperationClusterCreate, OperationClusterUpdate, OperationClusterDelete
	ActiveOperationID string `json:"activeOperationId,omitempty"`
	// Written by: Frontend POST RevokeCredentials, SystemAdminCredentialOperationRevokeCredentialsPoll
	RevokeCredentialsOperationID string `json:"revokeCredentialsOperationId,omitempty"`
	// Written by: ClusterPropertiesSync
	DNS ServiceProviderDNSProfile `json:"dns,omitempty"`
	// Written by: ClusterPropertiesSync
	Console ServiceProviderConsoleProfile `json:"console,omitempty"`
	// Written by: ClusterPropertiesSync
	API ServiceProviderAPIProfile `json:"api,omitempty"`
	// Written by: ClusterPropertiesSync
	Platform ServiceProviderPlatformProfile `json:"platform,omitempty"`

	// ExperimentalFeatures captures experimental feature state evaluated from
	// AFEC and per-resource tags. Stored in Cosmos but NOT exposed via ARM API.
	// Written by: Frontend PUT Cluster (Create)
	ExperimentalFeatures ExperimentalFeatures `json:"experimentalFeatures,omitzero"`
	// ManagedIdentitiesDataPlaneIdentityURL is the Managed Identities Data Plane
	// Identity URL associated with the cluster. It is the URL that will be used
	// to communicate with the Managed Identities Resource Provider (MI RP).
	// Written by: Frontend PUT Cluster (Create)
	ManagedIdentitiesDataPlaneIdentityURL string `json:"managedIdentitiesDataPlaneIdentityURL,omitempty"`
	// Written by: BackfillClusterUID
	ClusterUID string `json:"clusterUID,omitempty"`
	// BillingDocumentCosmosID is the Cosmos DB document ID of the billing document
	// associated with this cluster. It is set when the billing document is created
	// and used to avoid redundant creation attempts.
	// Written by: CreateBillingDoc
	BillingDocumentCosmosID string `json:"billingDocumentCosmosID,omitempty"`
	// DeletionTimestamp is the timestamp at which the Cluster deletion was requested.
	// The timestamp is in UTC.
	// A nil value indicates that the Cluster deletion has not been requested.
	// Written by: Frontend DELETE Cluster
	DeletionTimestamp *metav1.Time `json:"deletionTimestamp,omitempty"`
	// ClusterServiceDeletionTimestamp is written when a dispatch of a Cluster
	// Service Delete Cluster request against Cluster Service for this cluster
	// has been handled. It is set after a successful DeleteCluster call to
	// Cluster Service, but also when it's determined that no delete call is
	// needed but we consider we should behave as if the delete call was
	// successfully issued.
	// A nil value indicates that the Cluster Service Deletion has not been requested.
	// The timestamp is in UTC.
	// Written by: ClusterClusterServiceDeleteDispatch
	ClusterServiceDeletionTimestamp *metav1.Time `json:"clusterServiceDeletionTimestamp,omitempty"`

	// TODO Temporary field to track whether the cluster operation is using the new deletion approach.
	// Written by: Frontend DELETE Cluster
	UsesNewClusterDeletionApproach bool `json:"usesNewClusterDeletionApproach"`

	// CreateOperationCompletionDeadline is the time by which the cluster creation operation must complete.
	// If it is not complete by this time, the operation will be marked as failed with the best message we can give at the time.
	// The default value is 60 minutes after the creation request is received.
	// When the subscription.HasRegisteredFeature(api.FeatureExperimentalReleaseFeatures), this value can be set
	// using the ExperimentalClusterTagPrefix + "max-creation-duration" tag, specified as a time.Duration.
	// The operation cluster create controller uses this value to decide about marking the install as failed.
	// The e2e tests set this value to one minute less than the default timeout.
	CreateOperationCompletionDeadline *metav1.Time `json:"createOperationCompletionDeadline,omitempty"`

	// UpdateOperationCompletionDeadline is the time by which the current cluster update must complete.
	// Admission resets it on each update to 60 minutes from the request, unless overridden
	// by the experimental max-update-duration tag (requires ExperimentalReleaseFeatures).
	// The update operation controller fails pending operations after this deadline,
	// including the current pending reasons in the returned error.
	// Written by: Frontend PUT/PATCH Cluster (via admission)
	UpdateOperationCompletionDeadline *metav1.Time `json:"updateOperationCompletionDeadline,omitempty"`

	// DeleteOperationCompletionTimeout is the duration after which a cluster deletion operation will be
	// marked as failed with a message listing the remaining cosmos resources preventing deletion.
	// Set by admission on CREATE and UPDATE from the TagClusterMaxDeletionDuration tag.
	// Nil when the tag is absent or the ExperimentalReleaseFeatures AFEC is not registered.
	// The frontend DELETE handler adds this duration to the accepted attempt time, defaulting to 12 hours when nil.
	// Written by: Frontend PUT/PATCH Cluster (via admission)
	DeleteOperationCompletionTimeout *time.Duration `json:"deleteOperationCompletionTimeout,omitempty"`

	// DeleteOperationCompletionDeadline is the absolute time by which the cluster deletion operation
	// must complete. Computed by the frontend DELETE handler as the accepted attempt time plus
	// DeleteOperationCompletionTimeout (or 12 hours when nil), preserving the original DeletionTimestamp.
	// Written by: Frontend DELETE Cluster
	DeleteOperationCompletionDeadline *metav1.Time `json:"deleteOperationCompletionDeadline,omitempty"`
}

type ClusterStatus struct {
	// Conditions are the top-level Cluster status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// Written by: ClusterDegradedAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// UserFacingConditions is a list of conditions that tracks user-facing cluster
	// conditions. Each Condition Type should be unique among all conditions.
	// The conditions here are exposed to the ARM API. This means that UserFacingConditions
	// must not contain any internal details. This also means the Type and Reason
	// values become part of the public API.
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum.
	// Written by: ClusterRequirementsValidAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	UserFacingConditions []metav1.Condition `json:"userFacingConditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// ActiveVersions are the active versions of the cluster control plane, ordered newest first.
	// Written by: ControlPlaneActiveVersions
	// +optional
	// +listType=set
	ActiveVersions []HCPClusterActiveVersion `json:"activeVersions,omitempty"`
}

type ContainerRegistryProfile struct {
	// Written by: Frontend PUT Cluster (Create), Frontend PATCH Cluster (Update)
	PullManagedIdentity *azcorearm.ResourceID `json:"pullManagedIdentity,omitempty"`
}

type ControlPlaneAvailability string

type ControlPlanePodSizing string

type Controller struct {
	// CosmosMetadata ResourceID is nested under the cluster so that association and cleanup work as expected
	// it will be the ServiceProviderCluster type and the name default.
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// ExternalID is the Azure resource ID of the type this is associated with.
	ExternalID *azcorearm.ResourceID `json:"externalId,omitempty"`

	Status ControllerStatus `json:"status"`
}

type ControllerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Controller `json:"items"`
}

type ControllerStatus struct {
	// every controller is expected to set a Degraded condition.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type CorrelationData struct {
	// RequestID is a generated unique identifier for the current operation.
	RequestID uuid.UUID

	// ClientRequestID contains the value of header "x-ms-client-request-id".
	ClientRequestID string `json:"clientRequestId,omitempty"`

	// CorrelationRequestID contains the value of header "x-ms-correlation-request-id".
	CorrelationRequestID string `json:"correlationRequestId,omitempty"`

	// ClientPrincipalName contains the value of header "x-ms-client-principal-name".
	ClientPrincipalName string `json:"clientPrincipalName,omitempty"`
}

type CosmosMetadata struct {
	ResourceID *azcorearm.ResourceID `json:"resourceID"`

	// ParentResourceID is the parent resource ID, populated on create and replace.
	// It is nil when ResourceID is nil, when its parent is nil, or when the parent
	// is the subscription root sentinel (whose string form is empty). The value is
	// derived from the lower-cased parent: resource names and the provider namespace
	// are lower-cased, while the Azure SDK canonicalizes reserved segment keywords
	// (such as "resourceGroups") so those keep their canonical casing.
	ParentResourceID *azcorearm.ResourceID `json:"parentResourceID,omitempty"`

	// ExistingCosmosUID exists to allow for a migration path from where we are today to a uuid based cosmosID
	// and this will be deleted afterwards.
	ExistingCosmosUID string `json:"-"`

	CosmosETag azcore.ETag `json:"etag,omitempty"`

	// InstanceVersion is a field that auto-increments every time the resource is updated.  This gives us the ability to
	// compare two instances of stored resources and determine which one is newer.  We will use this field to integrate
	// changefeeds for controllers and decide which changes are newer than the level we have already observed so that we
	// can periodically re-list all items.
	// The auto-incrementing happens automatically in the storage layer for conditional updates.
	InstanceVersion int64 `json:"instanceVersion"`

	// PartitionKey is the partition key for the CosmosDB document, it must be set before creation and must be all lowercase.
	// On the read-path, during our migration we will fill in an empty value based on the type we're reading.
	// Every type that embeds this struct must comment about what the PartitionKey is. For instance, subscriptionID, managementClusterID, etc.
	PartitionKey string `json:"partitionKey"`
}

type CosmosMetadataAccessor interface {
	CosmosPersistable
	GetCosmosUID() string
	GetResourceID() *azcorearm.ResourceID
	SetResourceID(*azcorearm.ResourceID)
	GetEtag() azcore.ETag
	SetEtag(cosmosETag azcore.ETag)
	GetPartitionKey() string
	SetPartitionKey(string)
	GetInstanceVersion() int64
	SetInstanceVersion(int64)
}

type CosmosMetadataAccessorPtr[T any] interface {
	*T
	CosmosMetadataAccessor
}

type CosmosPersistable interface {
	GetCosmosData() *CosmosMetadata
}

type CreatedByType string

type CustomerAPIProfile struct {
	Visibility      metadataapi.Visibility `json:"visibility,omitempty"`
	AuthorizedCIDRs []string               `json:"authorizedCidrs,omitempty"`
}

type CustomerDNSProfile struct {
	BaseDomainPrefix string `json:"baseDomainPrefix,omitempty"`
}

type CustomerIngressProfile struct {
	Type metadataapi.IngressType `json:"type,omitempty"`
}

type CustomerManagedEncryptionProfile struct {
	EncryptionType metadataapi.CustomerManagedEncryptionType `json:"encryptionType,omitempty"`
	Kms            *KmsEncryptionProfile                     `json:"kms,omitempty"`
}

type CustomerPlatformProfile struct {
	ManagedResourceGroup    string                         `json:"managedResourceGroup,omitempty"`
	SubnetID                *azcorearm.ResourceID          `json:"subnetId,omitempty"`
	VnetIntegrationSubnetID *azcorearm.ResourceID          `json:"vnetIntegrationSubnetId,omitempty"`
	OutboundType            metadataapi.OutboundType       `json:"outboundType,omitempty"`
	NetworkSecurityGroupID  *azcorearm.ResourceID          `json:"networkSecurityGroupId,omitempty"`
	OperatorsAuthentication OperatorsAuthenticationProfile `json:"operatorsAuthentication,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster
	ContainerRegistry ContainerRegistryProfile `json:"containerRegistry,omitzero"`
}

type DenyAssignmentReference struct {
	// DenyAssignmentType identifies the category of deny assignment (e.g. "resources-deny-assignment").
	// Used as a suffix when generating the deterministic deny assignment UUID.
	// Written by: ClusterDenyAssignment
	DenyAssignmentType string `json:"denyAssignmentType"`
	// DenyAssignmentResourceID is the full Azure resource ID of the deny assignment,
	// e.g. "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Authorization/denyAssignments/{uuid}".
	// Written by: ClusterDenyAssignment
	DenyAssignmentResourceID *azcorearm.ResourceID `json:"denyAssignmentResourceID"`
}

type DenyAssignmentReferences struct {
	// PendingAzureResources contains resource IDs that have been requested but
	// not yet confirmed to exist in Azure.
	// Written by: ClusterDenyAssignment
	PendingAzureResources []DenyAssignmentReference `json:"pendingDenyAssignments,omitempty"`
	// AzureResources contains resource IDs that have been confirmed to exist in Azure.
	// Written by: ClusterDenyAssignment
	AzureResources []DenyAssignmentReference `json:"denyAssignments,omitempty"`
	// EarliestRecheckTime is the earliest time at which the controller should
	// re-check the pending resources. Nil means recheck immediately.
	// This allows for controllers to avoid repeatedly hitting an Azure API to recheck that the desired state is true.
	// Controllers should set this field with substantial jitter: without another concern, jitter of 50% is considered normal
	// so that any storms are quickly dissipated.
	// Additionally, long recheck times are recommended for resources outside of their active phases. Order of at least
	// six hours is, with durations up to 24 hours considered normal.
	// Written by: ClusterDenyAssignment
	EarliestRecheckTime *metav1.Time `json:"earliestRecheckTime,omitempty"`
}

type DeploymentPreflight struct {
	Resources []json.RawMessage `json:"resources"`
}

type DeploymentPreflightResource struct {
	Name       string `json:"name"`
	Type       string `json:"type"`
	Location   string `json:"location"`
	APIVersion string `json:"apiVersion,omitempty"`

	// Preserve other tracked resource fields as raw data.
	Identity   json.RawMessage `json:"identity,omitempty"`
	Properties json.RawMessage `json:"properties,omitempty"`
	Tags       json.RawMessage `json:"tags,omitempty"`
	SystemData json.RawMessage `json:"systemData,omitempty"`
}

type DeploymentPreflightResponse struct {
	Status DeploymentPreflightStatus `json:"status"`
	Error  *CloudErrorBody           `json:"error,omitempty"`
}

type DeploymentPreflightStatus string

type EtcdDataEncryptionProfile struct {
	KeyManagementMode metadataapi.EtcdDataEncryptionKeyManagementModeType `json:"keyManagementMode,omitempty"`
	CustomerManaged   *CustomerManagedEncryptionProfile                   `json:"customerManaged,omitempty"`
}

type EtcdProfile struct {
	DataEncryption EtcdDataEncryptionProfile `json:"dataEncryption,omitempty"`
}

type ExperimentalFeatures struct {
	// ControlPlaneAvailability controls the AvailabilityPolicy for control
	// plane components. When set to SingleReplica, CS configures the cluster
	// with AvailabilityPolicy set to SingleReplica.
	ControlPlaneAvailability ControlPlaneAvailability `json:"singleReplica,omitempty"`

	// ControlPlanePodSizing controls resource request sizing for hosted
	// control plane components. When set to Minimal, CS sets the
	// ClusterSizeOverride annotation for reduced resource requests.
	ControlPlanePodSizing ControlPlanePodSizing `json:"sizeOverride,omitempty"`

	// ControlPlaneOperatorImage overrides the control plane operator
	// image for a HostedCluster. When non-empty, the OCM converter sets
	// the control_plane_operator_image CS cluster property, which CS
	// translates into the HostedCluster annotation.
	ControlPlaneOperatorImage string `json:"controlPlaneOperatorImage,omitempty"`

	// ControlPlaneExactVersion pins the control plane to an exact OpenShift
	// release (e.g. 4.17.3) instead of letting the fleet version rollout resolve a
	// version from Cincinnati. When non-nil on an unpinned cluster, the Forced
	// Cluster Desired Version Assignment controller holds the cluster's desired
	// control plane version at this value, and the Normal Cluster Desired Version
	// Assignment controller excludes the cluster from rollout advancement. An SRE
	// PinnedVersion, if present, takes precedence over this value.
	ControlPlaneExactVersion *semver.Version `json:"controlPlaneExactVersion,omitempty"`

	// ZStreamUpdatePolicy controls automatic z-stream advancement. Immediate
	// follows the channel's best version without progressive rollout gates so
	// production e2e tests do not depend on the fleet's canary progress. SRE pins
	// and ControlPlaneExactVersion take precedence; unset uses normal rollout.
	// Written by: Frontend PUT/PATCH Cluster (admission)
	ZStreamUpdatePolicy ZStreamUpdatePolicy `json:"zStreamUpdatePolicy,omitempty"`
}

type ExternalAuth struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	ProxyResource
	// Written by: Frontend PUT/PATCH ExternalAuth, OperationExternalAuth* controllers
	Properties ExternalAuthProperties `json:"properties"`
	// Written by: Frontend PUT/PATCH/DELETE ExternalAuth, OperationExternalAuth* controllers, ExternalAuthClusterServiceCreate, ExternalAuthDeletion* controllers
	ServiceProviderProperties ExternalAuthServiceProviderProperties `json:"serviceProviderProperties,omitempty"`
	// Written by: ExternalAuthDegradedAggregator
	Status ExternalAuthStatus `json:"status"`
}

type ExternalAuthClaimProfile struct {
	Mappings        TokenClaimMappingsProfile  `json:"mappings"`
	ValidationRules []TokenClaimValidationRule `json:"validationRules"`
}

type ExternalAuthClientComponentProfile struct {
	Name                string `json:"name"`
	AuthClientNamespace string `json:"authClientNamespace"`
}

type ExternalAuthClientProfile struct {
	Component   ExternalAuthClientComponentProfile `json:"component"`
	ClientID    string                             `json:"clientId"`
	ExtraScopes []string                           `json:"extraScopes"`
	Type        metadataapi.ExternalAuthClientType `json:"type"`
}

type ExternalAuthList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ExternalAuth `json:"items"`
}

type ExternalAuthProperties struct {
	// Written by: Frontend PUT/PATCH/DELETE ExternalAuth, OperationExternalAuthCreate, OperationExternalAuthUpdate, OperationExternalAuthDelete
	ProvisioningState ProvisioningState `json:"provisioningState"`
	// Written by: Frontend PUT/PATCH ExternalAuth
	Issuer TokenIssuerProfile `json:"issuer"`
	// Written by: Frontend PUT/PATCH ExternalAuth
	Clients []ExternalAuthClientProfile `json:"clients"`
	// Written by: Frontend PUT/PATCH ExternalAuth
	Claim ExternalAuthClaimProfile `json:"claim"`
}

type ExternalAuthServiceProviderProperties struct {
	// Written by: Frontend PUT ExternalAuth (Create), ExternalAuthClusterServiceCreate, ExternalAuthDeletionClusterServiceIDClearer
	ClusterServiceID *metadataapi.InternalID `json:"clusterServiceID,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE ExternalAuth, OperationExternalAuthCreate, OperationExternalAuthUpdate, OperationExternalAuthDelete
	ActiveOperationID string `json:"activeOperationId,omitempty"`
	// DeletionTimestamp is the timestamp at which the ExternalAuth deletion was requested.
	// The timestamp is in UTC.
	// A nil value indicates that the ExternalAuth deletion has not been requested.
	// Written by: Frontend DELETE ExternalAuth
	DeletionTimestamp *metav1.Time `json:"deletionTimestamp,omitempty"`
	// ClusterServiceDeletionTimestamp is written when a dispatch of a Cluster
	// Service Delete ExternalAuth request against Cluster Service for this
	// external auth has been handled.
	// Written by: ExternalAuthClusterServiceDeleteDispatch
	ClusterServiceDeletionTimestamp *metav1.Time `json:"clusterServiceDeletionTimestamp,omitempty"`

	// Written by: Frontend DELETE ExternalAuth
	UsesNewExternalAuthDeletionApproach bool `json:"usesNewExternalAuthDeletionApproach"`
}

type ExternalAuthStatus struct {
	// Conditions are the top-level ExternalAuth status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// Written by: ExternalAuthDegradedAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// UserFacingConditions is a list of conditions that tracks user-facing external auth
	// conditions. Each Condition Type should be unique among all conditions.
	// The conditions here are exposed to the ARM API. This means that UserFacingConditions
	// must not contain any internal details. This also means the Type and Reason
	// values become part of the public API.
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	UserFacingConditions []metav1.Condition `json:"userFacingConditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type Feature struct {
	Name  *string `json:"name,omitempty"`
	State *string `json:"state,omitempty"`
}

type GroupClaimProfile struct {
	Claim  string `json:"claim"`
	Prefix string `json:"prefix"`
}

type HCPClusterActiveVersion struct {
	// Version is the user-facing version in x.y format (e.g., "4.20")
	// Written by: ControlPlaneActiveVersions
	Version string `json:"version,omitempty"`
}

type HCPNodePoolActiveVersion struct {
	// Version is the user-facing version in x.y.z format (e.g., "4.20.8")
	// Written by: NodePoolActiveVersions
	Version string `json:"version,omitempty"`
}

type HostedClusterControlPlaneSize string

type ImageDigestMirror struct {
	Source  string   `json:"source,omitempty"`
	Mirrors []string `json:"mirrors,omitempty"`

	// MirrorSourcePolicy is not exposed in the customer-facing API as of
	// v20251223preview, but is still recorded in CosmosDB so that, if we
	// ever do expose this field, existing cluster documents in CosmosDB
	// will not need to be migrated.
	MirrorSourcePolicy metadataapi.MirrorSourcePolicy `json:"mirrorSourcePolicy,omitempty"`
}

type KmsEncryptionProfile struct {
	Visibility metadataapi.KeyVaultVisibility `json:"visibility,omitempty"`
	ActiveKey  KmsKey                         `json:"activeKey,omitempty"`
}

type KmsKey struct {
	Name      string `json:"name"`
	VaultName string `json:"vaultName"`
	Version   string `json:"version"`
}

type MaestroBundleInternalName string

type MaestroBundleReference struct {
	// Name is a logical name that represents the Maestro Bundle conceptually.
	Name MaestroBundleInternalName `json:"name"`
	// MaestroAPIMaestroBundleName is the name of the Maestro Bundle in the Maestro API.
	// It must be unique within a given Maestro Consumer Name and Maestro Source ID.
	// Maestro's ManifestWorks Go client abstraction uses Maestro Bundle Names to
	// identify the Maestro Bundle.
	MaestroAPIMaestroBundleName string `json:"maestroAPIMaestroBundleName"`
	// MaestroAPIMaestroBundleID is the ID of the Maestro Bundle in the Maestro API.
	// Returned by the Maestro API when the Maestro Bundle is first created.
	// This attribute can be unset if the Maestro Bundle reference has been created
	// but the Maestro Bundle has not been created yet.
	// Maestro's REST API Go client abstraction uses Maestro Bundle IDs to identify the Maestro Bundle.
	MaestroAPIMaestroBundleID string `json:"maestroAPIMaestroBundleID"`
	// ResourceIdentifiers contains the identifiers for all resources within the Maestro Bundle.
	// Each entry corresponds to a ResourceIdentifier in the ManifestWork's ManifestConfigs.
	ResourceIdentifiers []MaestroBundleResourceIdentifier `json:"resourceIdentifiers,omitempty"`
}

type MaestroBundleReferenceList []*MaestroBundleReference

type MaestroBundleResourceIdentifier struct {
	// APIVersion is the API version of the resource (e.g. "hypershift.openshift.io/v1beta1").
	APIVersion string `json:"apiVersion"`
	// Kind is the kind of the resource (e.g. "HostedCluster").
	Kind string `json:"kind"`
	// Resource is the resource type (e.g. "hostedclusters").
	// This corresponds to the ResourceIdentifier.Resource in the ManifestWork's ManifestConfigs.
	Resource string `json:"resource"`
	// Name is the name of the resource.
	// For example, for a HostedCluster bundle this is the HostedCluster name on the management cluster.
	Name string `json:"name"`
	// Namespace is the namespace of the resource.
	// For example, for a HostedCluster bundle this is the HostedCluster namespace on the management cluster.
	Namespace string `json:"namespace"`
}

type ManagedServiceIdentity struct {
	// Written by: Frontend PUT/PATCH Cluster/NodePool (Update: preserves stored values; cleared from Create input)
	PrincipalID string `json:"principalId,omitempty"`
	// Written by: Frontend PUT/PATCH Cluster/NodePool (Update: preserves stored values; cleared from Create input)
	TenantID               string                           `json:"tenantId,omitempty"`
	Type                   ManagedServiceIdentityType       `json:"type"`
	UserAssignedIdentities map[string]*UserAssignedIdentity `json:"userAssignedIdentities,omitempty"`
}

type ManagedServiceIdentityType string

type ManagementClusterContent struct {
	// CosmosMetadata is nested under the corresponding resource type so that association and cleanup work as expected.
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// Status track the status of the Management Cluster Content.
	Status ManagementClusterContentStatus `json:"status,omitempty"`
}

type ManagementClusterContentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ManagementClusterContent `json:"items"`
}

type ManagementClusterContentStatus struct {
	// Conditions is a list of conditions that track the status of the Management Cluster Content.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// A Condition Status of True means that the condition is met, and a Condition Status of False means that the condition is not met.
	// The Condition Reason and Message are used to provide more details about the condition status.
	// The Condition LastTransitionTime is used to track the last time the condition transitioned from one status to another.
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// KubeContent contains a list of K8s resources that represent content of the Management Cluster associated to this
	// resource ID.
	KubeContent *metav1.List `json:"kubeContent"`
}

type NamespaceOperation struct {
	// Operation name: {providerNamespace}/{resourceType}/{operation}
	Name string `json:"name"`

	// The object that describes the operation.
	Display NamespaceOperationDisplay `json:"display"`

	// Sources of requests to this operation. Valid values are
	// "user", "system", or, the default value, "user,system".
	Origin NamespaceOperationOrigin `json:"origin,omitempty"`

	// Indicates whether the operation applies to the data-plane.
	IsDataAction bool `json:"isDataAction"`
}

type NamespaceOperationDisplay struct {
	// The localized friendly form of the resource provider name.
	Provider string `json:"provider"`

	// The localized friendly form of the resource type related to this action/operation.
	Resource string `json:"resource"`

	// The localized friendly name for the operation, as it should be shown to the user.
	Operation string `json:"operation"`

	// The localized friendly description for the operation, as it should be shown to the user.
	Description string `json:"description"`
}

type NamespaceOperationOrigin string

type NetworkProfile struct {
	NetworkType metadataapi.NetworkType `json:"networkType,omitempty"`
	PodCIDR     string                  `json:"podCidr,omitempty"`
	ServiceCIDR string                  `json:"serviceCidr,omitempty"`
	MachineCIDR string                  `json:"machineCidr,omitempty"`
	HostPrefix  int32                   `json:"hostPrefix,omitempty"`
}

type NodePool struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	TrackedResource
	// Written by: Frontend PUT/PATCH NodePool, OperationNodePoolCreate, OperationNodePoolUpdate, OperationNodePoolDelete
	Properties NodePoolProperties `json:"properties,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE NodePool, OperationNodePool* controllers, NodePoolClusterServiceCreate, NodePoolDeletion* controllers
	ServiceProviderProperties NodePoolServiceProviderProperties `json:"serviceProviderProperties,omitempty"`
	Identity                  *ManagedServiceIdentity           `json:"identity,omitempty"`
	// Written by: NodePoolDegradedAggregator, NodePoolRequirementsValidAggregator
	Status NodePoolStatus `json:"status"`
}

type NodePoolAutoScaling struct {
	Min int32 `json:"min,omitempty"`
	Max int32 `json:"max,omitempty"`
}

type NodePoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NodePool `json:"items"`
}

type NodePoolPlatformProfile struct {
	// SubnetID is the resource ID of the subnet to use for this Node Pool's virtual machines.
	// * If SubnetID is nil on CREATE, mutation defaults it to the parent cluster's subnet.
	// * SubnetID must belong to the same VNet as the parent cluster's subnet.
	// * The same subnet may be used across Node Pools of the same cluster (and may match
	//   the parent cluster's subnet), but a subnet cannot be reused across different
	//   ARO-HCP Clusters.
	SubnetID               *azcorearm.ResourceID `json:"subnetId,omitempty"`
	VMSize                 string                `json:"vmSize,omitempty"`
	EnableEncryptionAtHost bool                  `json:"enableEncryptionAtHost"`
	OSDisk                 OSDiskProfile         `json:"osDisk"`
	// AvailabilityZone can be empty.
	// * If AvailabilityZone is not specified during creation, then the Node Pool is not part of any Availability Zone and the Node Pool's
	//   virtual machines are included in an Availability Set.
	// * If AvailabilityZone is specified, then the virtual machines are deployed as standalone instances in the specified Availability Zone.
	// * It must not be specified for Node Pools whose parent cluster is in an Azure location that does not support Availability Zones
	// * It is a logical Availability Zone
	// * It is optional during creation and immutable
	AvailabilityZone string `json:"availabilityZone,omitempty"`
}

type NodePoolProperties struct {
	// Written by: Frontend PUT/PATCH/DELETE NodePool, OperationNodePoolCreate, OperationNodePoolUpdate, OperationNodePoolDelete
	ProvisioningState ProvisioningState `json:"provisioningState,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Version NodePoolVersionProfile `json:"version,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Platform NodePoolPlatformProfile `json:"platform,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Replicas int32 `json:"replicas,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	AutoRepair bool `json:"autoRepair,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	AutoScaling *NodePoolAutoScaling `json:"autoScaling,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Labels map[string]string `json:"labels,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	Taints []Taint `json:"taints,omitempty"`
	// Written by: Frontend PUT/PATCH NodePool
	NodeDrainTimeoutMinutes *int32 `json:"nodeDrainTimeoutMinutes,omitempty"`
}

type NodePoolServiceProviderProperties struct {
	// Written by: Frontend PUT NodePool (Create), NodePoolClusterServiceCreate, NodePoolDeletionClusterServiceIDClearer
	ClusterServiceID *metadataapi.InternalID `json:"clusterServiceID,omitempty"`
	// Written by: Frontend PUT/PATCH/DELETE NodePool, OperationNodePoolCreate, OperationNodePoolUpdate, OperationNodePoolDelete
	ActiveOperationID string `json:"activeOperationId,omitempty"`
	// DeletionTimestamp is the timestamp at which the NodePool deletion was requested.
	// The timestamp is in UTC.
	// A nil value indicates that the NodePool deletion has not been requested.
	// Written by: Frontend DELETE NodePool
	DeletionTimestamp *metav1.Time `json:"deletionTimestamp,omitempty"`
	// ClusterServiceDeletionTimestamp is written when a dispatch of a Cluster
	// Service Delete NodePool request against Cluster Service for this node
	// pool has been handled.
	// Written by: NodePoolClusterServiceDeleteDispatch
	ClusterServiceDeletionTimestamp *metav1.Time `json:"clusterServiceDeletionTimestamp,omitempty"`

	// Written by: Frontend DELETE NodePool
	UsesNewNodePoolDeletionApproach bool `json:"usesNewNodePoolDeletionApproach"`

	// CreateOperationCompletionDeadline is the time by which the node pool creation operation must complete.
	// If it is not complete by this time, the operation will be marked as failed with the best message we can give at the time.
	// The default value is 60 minutes after the creation request is received.
	// When the subscription.HasRegisteredFeature(api.FeatureExperimentalReleaseFeatures), this value can be set
	// using the ExperimentalNodePoolTagPrefix + "max-creation-duration" tag, specified as a time.Duration.
	// The operation node pool create controller uses this value to decide about marking the install as failed.
	// The e2e tests set this value to one minute less than the default timeout.
	CreateOperationCompletionDeadline *metav1.Time `json:"createOperationCompletionDeadline,omitempty"`

	// UpdateOperationCompletionDeadline is the time by which the current node pool update must complete.
	// Admission resets it on each update to 60 minutes from the request, unless overridden
	// by the experimental max-update-duration tag (requires ExperimentalReleaseFeatures).
	// The update operation controller fails pending operations after this deadline,
	// including the current pending reasons in the returned error.
	// Written by: Frontend PUT/PATCH NodePool (via admission)
	UpdateOperationCompletionDeadline *metav1.Time `json:"updateOperationCompletionDeadline,omitempty"`
}

type NodePoolStatus struct {
	// Conditions are the top-level NodePool status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// Written by: NodePoolDegradedAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// UserFacingConditions is a list of conditions that tracks user-facing node pool
	// conditions. Each Condition Type should be unique among all conditions.
	// The conditions here are exposed to the ARM API. This means that UserFacingConditions
	// must not contain any internal details. This also means the Type and Reason
	// values become part of the public API.
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum.
	// Written by: NodePoolRequirementsValidAggregator
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	UserFacingConditions []metav1.Condition `json:"userFacingConditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// ActiveVersions are the active versions of the node pool, ordered newest first.
	// Written by: NodePoolActiveVersions
	// +optional
	// +listType=set
	ActiveVersions []HCPNodePoolActiveVersion `json:"activeVersions,omitempty"`
}

type NodePoolVersionProfile struct {
	ID           string `json:"id,omitempty"`
	ChannelGroup string `json:"channelGroup,omitempty"`
}

type OSDiskProfile struct {
	SizeGiB                *int32                             `json:"sizeGiB,omitempty"`
	DiskStorageAccountType metadataapi.DiskStorageAccountType `json:"diskStorageAccountType,omitempty"`
	EncryptionSetID        *azcorearm.ResourceID              `json:"encryptionSetId,omitempty"`
	DiskType               metadataapi.OsDiskType             `json:"diskType,omitempty"`
}

type OpenShiftVersion struct {
	ProxyResource
	Properties OpenShiftVersionProperties `json:"properties,omitempty"`
}

type OpenShiftVersionProperties struct {
	ChannelGroup       string    `json:"channelGroup"`
	Enabled            bool      `json:"enabled"`
	EndOfLifeTimestamp time.Time `json:"endOfLifeTimestamp"`
}

type Operation struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// TenantID is the tenant ID of the client that requested the operation
	TenantID string `json:"tenantId,omitempty"`
	// ClientID is the object ID of the client that requested the operation
	ClientID string `json:"clientId,omitempty"`
	// Request is the type of asynchronous operation requested
	Request OperationRequest `json:"request,omitempty"`
	// ExternalID is the Azure resource ID of the cluster or node pool
	ExternalID *azcorearm.ResourceID `json:"externalId,omitempty"`
	// InternalID is the Cluster Service resource identifier in the form of a URL path
	InternalID metadataapi.InternalID `json:"internalId,omitempty"`
	// OperationID is the Azure resource ID of the operation status (may be nil if the
	// operation was implicit, such as deleting a child resource along with the parent)
	OperationID *azcorearm.ResourceID `json:"operationId,omitempty"`
	// ClientRequestID is provided by the "x-ms-client-request-id" request header
	ClientRequestID string `json:"clientRequestId,omitempty"`
	// CorrelationRequstID is provided by the "x-ms-correlation-request-id" request header
	CorrelationRequestID string `json:"correlationRequestId,omitempty"`
	// NotificationURI is provided by the Azure-AsyncNotificationUri header if the
	// Async Operation Callbacks ARM feature is enabled
	NotificationURI string `json:"notificationUri,omitempty"`

	// StartTime marks the start of the operation
	StartTime time.Time `json:"startTime,omitempty"`
	// LastTransitionTime marks the most recent state change
	LastTransitionTime time.Time `json:"lastTransitionTime,omitempty"`
	// Status is the current operation status, using the same set of values
	// as the resource's provisioning state
	Status ProvisioningState `json:"status,omitempty"`
	// Error is an OData error, present when Status is "Failed" or "Canceled"
	Error *CloudErrorBody `json:"error,omitempty"`

	// Temporary field to track whether the node pool operation is using the new deletion approach.
	// We are migrating from the node pool cs deletion synchronous in frontend to the backend, to be fully asynchronous
	// This boolean is true for NodePool delete operations that are created with new deletion approach.
	// This will be removed once all nodepools whose deletion was triggered before the new approach is fully rolled out have been
	// fully deleted in all ARO-HCP permanent environments, for all regions.
	UsesNewNodePoolDeletionApproach bool `json:"usesNewNodePoolDeletionApproach"`

	// TODO Temporary field to track whether the external auth operation is using the new deletion approach.
	// We are migrating from the external auth CS deletion synchronous in frontend to the backend, to be fully asynchronous.
	// This boolean is true for ExternalAuth delete operations that are created with new deletion approach.
	// This will be removed once all external auths whose deletion was triggered before the new approach is fully rolled out have been
	// fully deleted in all ARO-HCP permanent environments, for all regions.
	UsesNewExternalAuthDeletionApproach bool `json:"usesNewExternalAuthDeletionApproach"`

	// TODO Temporary field to track whether the cluster operation is using the new deletion approach.
	// We are migrating from the cluster CS deletion synchronous in frontend to the backend, to be fully asynchronous.
	// This boolean is true for Cluster delete operations that are created with new deletion approach.
	// This will be removed once all clusters whose deletion was triggered before the new approach is fully rolled out have been
	// fully deleted in all ARO-HCP permanent environments, for all regions.
	UsesNewClusterDeletionApproach bool `json:"usesNewClusterDeletionApproach"`

	// Written by: Frontend POST requestAdminCredential, backend systemadmincredentialcontrollers
	SystemAdminCredentialRequest *OperationSystemAdminCredentialRequest `json:"systemAdminCredentialRequest,omitempty"`
	// Written by: Frontend POST revokeCredentials, backend systemadmincredentialcontrollers
	SystemAdminCredentialRevocation *OperationSystemAdminCredentialRevocation `json:"systemAdminCredentialRevocation,omitempty"`
}

type OperationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Operation `json:"items"`
}

type OperationRequest string

type OperationStatus struct {
	ID              *azcorearm.ResourceID `json:"id,omitempty"`
	Name            string                `json:"name,omitempty"`
	Status          ProvisioningState     `json:"status"`
	StartTime       *time.Time            `json:"startTime,omitempty"`
	EndTime         *time.Time            `json:"endTime,omitempty"`
	PercentComplete float64               `json:"percentComplete,omitempty"`
	Properties      json.RawMessage       `json:"properties,omitempty"`
	Error           *CloudErrorBody       `json:"error,omitempty"`
	Operations      []OperationStatus     `json:"operations,omitempty"`
}

type OperationSystemAdminCredentialRequest struct {
	CertificateSigningRequest              string                `json:"certificateSigningRequest,omitempty"`
	SystemAdminCredentialRequestResourceID *azcorearm.ResourceID `json:"systemAdminCredentialRequestResourceID,omitempty"`
}

type OperationSystemAdminCredentialRevocation struct {
	SystemAdminCredentialRevocationResourceID *azcorearm.ResourceID `json:"systemAdminCredentialRevocationResourceID,omitempty"`
}

type OperatorsAuthenticationProfile struct {
	UserAssignedIdentities UserAssignedIdentitiesProfile `json:"userAssignedIdentities,omitempty"`
}

type PagedResponse struct {
	Value    []json.RawMessage `json:"value"`
	NextLink string            `json:"nextLink,omitempty"`
}

type ProvisioningState string

type ProxyResource struct {
	Resource
}

type Resource struct {
	ID         *azcorearm.ResourceID `json:"id,omitempty"`
	Name       string                `json:"name,omitempty"`
	Type       string                `json:"type,omitempty"`
	SystemData *SystemData           `json:"systemData,omitempty"`
}

type ServiceProviderAPIProfile struct {
	// Written by: ClusterPropertiesSync
	URL string `json:"url,omitempty"`
}

type ServiceProviderCluster struct {
	// CosmosMetadata ResourceID is nested under the cluster so that association and cleanup work as expected
	// it will be the ServiceProviderCluster type and the name default.
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	LoadBalancerResourceID *azcorearm.ResourceID `json:"loadBalancerResourceID,omitempty"`

	Spec ServiceProviderClusterSpec `json:"spec"`

	// Status contains the observed state of the cluster.
	Status ServiceProviderClusterStatus `json:"status,omitempty"`
}

type ServiceProviderClusterActiveVersion struct {
	// Version is the full version in x.y.z format (e.g., "4.19.2")
	// Written by: ControlPlaneActiveVersions
	Version *semver.Version `json:"version,omitempty"`
	// State is the update state from OpenShift (e.g. configv1.CompletedUpdate or configv1.PartialUpdate).
	// Written by: ControlPlaneActiveVersions
	State configv1.UpdateState `json:"state,omitempty"`
	// LastTransitionTime is when we last observed this version enter its current
	// State. It is used to decide when a cluster has held an achieved version
	// long enough to be considered successfully upgraded.
	// Written by: ControlPlaneActiveVersions
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
}

type ServiceProviderClusterControlPlaneOperatorIdentity struct {
	// ResourceID is the Azure Resource ID of the Azure User Assigned Managed Identity.
	// Its value comes from the Cluster's CustomerProperties.
	// The ControlPlaneOperatorsIdentities map key is the fully lowercased form
	// of this ID used for lookups.
	ResourceID *azcorearm.ResourceID `json:"resourceId,omitempty"`
	// ClientID is the Client ID of the Azure User Assigned Managed Identity represented by ResourceID.
	// Fetched from Azure and written here by the FetchMSIIdentitiesInfo.
	// It may be nil or empty.
	ClientID *string `json:"clientId,omitempty"`
	// PrincipalID is the Principal ID of the Azure User Assigned Managed Identity represented by ResourceID.
	// Fetched from Azure and written here by the FetchMSIIdentitiesInfo.
	// It may be nil or empty.
	PrincipalID *string `json:"principalId,omitempty"`
}

type ServiceProviderClusterDataPlaneOperatorManagedIdentity struct {
	// ResourceID is the Azure Resource ID of the Azure User Assigned Managed Identity.
	// This field is an input: its value is mirrored from the Cluster's CustomerProperties
	// (Platform.OperatorsAuthentication.UserAssignedIdentities.DataPlaneOperators) into this status.
	// Written by: FetchDataPlaneOperatorsManagedIdentitiesInfoController
	ResourceID *azcorearm.ResourceID `json:"resourceID,omitempty"`
	// ClientID is the Client ID of the Azure User Assigned Managed Identity represented by ResourceID.
	// This field is an output: it is fetched from Azure and written here by the controller.
	// Written by: FetchDataPlaneOperatorsManagedIdentitiesInfoController
	ClientID *string `json:"clientId,omitempty"`
	// PrincipalID is the Principal ID of the Azure User Assigned Managed Identity represented by ResourceID.
	// This field is an output: it is fetched from Azure and written here by the controller.
	// Written by: FetchDataPlaneOperatorsManagedIdentitiesInfoController
	PrincipalID *string `json:"principalId,omitempty"`
	// RetrievalError, when non-nil, is the error (truncated to the first 1024 characters) from the
	// most recent attempt to retrieve this identity's metadata from Azure. When set, ClientID and
	// PrincipalID are nil because the last retrieval attempt failed - either the identity was not
	// found in Azure or the Get call returned an error - and any previously resolved values are no
	// longer trustworthy. It is nil when the last retrieval succeeded.
	// This field is an output: it is written here by the controller.
	// Written by: FetchDataPlaneOperatorsManagedIdentitiesInfoController
	RetrievalError *string `json:"retrievalError,omitempty"`
}

type ServiceProviderClusterDataPlaneOperatorsManagedIdentities struct {
	// Identities is a map containing resolved ClientID/PrincipalID for the Azure
	// User Assigned Managed Identities associated with the cluster's data plane
	// operators. The key is the fully lowercased Azure Resource ID of the
	// identity. Which operators reference each identity is tracked on
	// Cluster.CustomerProperties, not here. Multiple operators may share one
	// identity entry.
	// Written by: FetchDataPlaneOperatorsManagedIdentitiesInfoController
	Identities map[string]*ServiceProviderClusterDataPlaneOperatorManagedIdentity `json:"identities,omitempty"`
}

type ServiceProviderClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceProviderCluster `json:"items"`
}

type ServiceProviderClusterMSIManagedIdentities struct {
	// ControlPlaneOperatorsIdentities is a map containing resolved ClientID/PrincipalID
	// for Managed Service Identity (MSI) based Azure User-Assigned Managed Identities
	// used by the cluster's control plane operators. The key is the fully lowercased
	// Azure Resource ID of the identity. Which operators reference each identity is
	// tracked on Cluster.CustomerProperties, not here. Multiple operators may share
	// one identity entry.
	// Written by: FetchMSIIdentitiesInfo
	ControlPlaneOperatorsIdentities map[string]*ServiceProviderClusterControlPlaneOperatorIdentity `json:"controlPlaneOperatorsIdentities,omitempty"`
	// ServiceManagedIdentity holds resolved ClientID/PrincipalID for the cluster's
	// service managed identity.
	// Written by: FetchMSIIdentitiesInfo
	ServiceManagedIdentity *ServiceProviderClusterServiceManagedIdentity `json:"serviceManagedIdentity,omitempty"`
}

type ServiceProviderClusterPinnedVersion struct {
	// ExactVersion is the exact z-stream this cluster is pinned to regardless of
	// its previous version.
	// Written by: Forced Cluster Desired Version Assignment (clear); Admin API setter planned
	ExactVersion *semver.Version `json:"exactVersion,omitempty"`

	// UntilExactVersion is the fleet bestExactVersion at or above which the pin is
	// released and normal upgrade selection may continue.
	// Written by: Forced Cluster Desired Version Assignment (clear); Admin API setter planned
	UntilExactVersion *semver.Version `json:"untilExactVersion,omitempty"`
}

type ServiceProviderClusterPlacementStatus struct {
	// Conditions holds placement conditions. Known types:
	//   - "CapacityAvailable": True when suitable placement capacity was found;
	//     False when no usable capacity exists; Unknown when required observations or
	//     configuration are unavailable. Placement itself is recorded in
	//     Spec.ManagementClusterResourceID.
	// Written by: PlacementController
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type ServiceProviderClusterServiceManagedIdentity struct {
	// ResourceID is the Azure Resource ID of the Azure User Assigned Managed Identity that is associated to the cluster's Service Managed Identity.
	// Its value comes from the Cluster's CustomerProperties.
	ResourceID *azcorearm.ResourceID `json:"resourceId,omitempty"`
	// ClientID is the Client ID of the Azure User Assigned Managed Identity represented by ResourceID.
	// Fetched from Azure and written here by the FetchMSIIdentitiesInfo.
	// It may be nil or empty.
	ClientID *string `json:"clientId,omitempty"`
	// PrincipalID is the Principal ID of the Azure User Assigned Managed Identity represented by ResourceID.
	// Fetched from Azure and written here by the FetchMSIIdentitiesInfo.
	// It may be nil or empty.
	PrincipalID *string `json:"principalId,omitempty"`
}

type ServiceProviderClusterSpec struct {
	// ControlPlaneVersion contains the desired control plane version information.
	// Example JSON structure:
	// {
	//   "control_plane_version": {
	//     "desired_version": "4.19.2"
	//   }
	// }
	ControlPlaneVersion ServiceProviderClusterSpecVersion `json:"control_plane_version,omitempty"`

	// DesiredHostedCluster is the HostedCluster that we want to exist on the management cluster.
	// We will only explicitly set the fields we care about, but serialization may store additional empty fields.
	// Once this contains the critical values, we will create it on management clusters.
	// We may or may not choose to store the actual state in status.  We may choose to store the actual state independently.
	DesiredHostedCluster *v1beta1.HostedCluster `json:"desiredHostedCluster,omitempty"`

	// DesiredHostedClusterControlPlaneSize is the SRE-selected control plane
	// sizing tier (one of "Small", "Medium", "Large", "Xlarge", "XXlarge") to
	// apply to the HostedCluster. Stored as *string so unset is distinguishable
	// from any explicit choice; nil means no tier has been requested. Valid
	// values are the HostedClusterControlPlaneSize* constants above.
	DesiredHostedClusterControlPlaneSize *string `json:"desiredHostedClusterControlPlaneSize,omitempty"`

	// BackupScheduleState is the desired backup scheduling state: Enabled or Disabled.
	// Default is Enabled. Set to Disabled via Admin API to pause scheduled backups.
	BackupScheduleState BackupScheduleState `json:"backupScheduleState,omitempty"`

	// ManagementClusterResourceID is the resource ID of the management cluster the
	// scheduler has selected for this HCP. This is the scheduler's intent (desired
	// placement): nil means placement has not been resolved yet. Downstream
	// controllers (cluster creation gating and Cluster Service provision-shard
	// pinning) rely on it once set.
	//
	// It is set once by the PlacementController and is not otherwise mutated.
	// Written by: PlacementController
	ManagementClusterResourceID *azcorearm.ResourceID `json:"managementClusterResourceID,omitempty"`

	// EarliestRecheckTimesByController records, per controller, the earliest time
	// at which that controller should next re-query Azure (or another external
	// system) for the state it maintains. The map key is the controller's
	// ControllerName constant; a nil or absent entry means recheck immediately.
	// Centralizing these per-controller recheck times here lets each controller
	// avoid repeatedly hitting an external API to confirm the desired state is
	// still true, without every tracked struct carrying its own recheck field.
	// Controllers should set their entry with substantial jitter: without another
	// concern, jitter of 50% is considered normal so that any storms are quickly
	// dissipated. Additionally, long recheck times are recommended for resources
	// outside of their active phases. Order of at least six hours is, with
	// durations up to 24 hours considered normal.
	// Written by: FetchMSIIdentitiesInfo, FetchDataPlaneOperatorsManagedIdentitiesInfoController, IdentityRoleAssignments
	EarliestRecheckTimesByController map[string]*metav1.Time `json:"earliestRecheckTimesByController,omitempty"`

	// PinnedVersion, when its ExactVersion is set, is an SRE-specified
	// cluster-specific exact-version override. The Forced Cluster Desired Version
	// Assignment controller holds this cluster at PinnedVersion.ExactVersion until
	// the fleet's bestExactVersion reaches PinnedVersion.UntilExactVersion, after
	// which the pin is cleared and normal rollout selection resumes. An empty
	// PinnedVersion (nil ExactVersion) means no pin and serializes as {}. The
	// Admin API setter is a follow-up; this change only implements consuming pins.
	// Written by: Forced Cluster Desired Version Assignment (clear)
	PinnedVersion ServiceProviderClusterPinnedVersion `json:"pinnedVersion,omitempty"`
}

type ServiceProviderClusterSpecVersion struct {
	// DesiredVersion is the full version the controller has resolved and wants to upgrade to (format: x.y.z)
	// This is compared on each sync to detect when a new upgrade should be triggered.
	// Written by: Forced Cluster Desired Version Assignment, Z-stream Progressive Desired Version Rollout, InitialNormalClusterDesiredVersion, MinorUpgradeNormalClusterDesiredVersion
	DesiredVersion *semver.Version `json:"desired_version,omitempty"`

	// DesiredVersionLastTransitionTime is when DesiredVersion last changed. It is
	// used to decide when a cluster has been mismatched (desired set but not yet
	// achieved) for longer than the allowed upgrade duration.
	// Legacy missing/zero timestamps are initialized at first observation by
	// InitialNormalClusterDesiredVersion without changing the desired version.
	// TODO: align DesiredVersion with its transition time into a better structure
	// (mirroring ServiceProviderClusterActiveVersion), instead of two loosely-coupled fields.
	// Written by: Forced Cluster Desired Version Assignment, Z-stream Progressive Desired Version Rollout, InitialNormalClusterDesiredVersion, MinorUpgradeNormalClusterDesiredVersion
	DesiredVersionLastTransitionTime *metav1.Time `json:"desired_version_last_transition_time,omitempty"`
}

type ServiceProviderClusterStatus struct {
	// Conditions are the top-level ServiceProviderCluster status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// Known condition types are:
	// - "Progressing": True when the cluster is in the process of being created, updated, or deleted. Both end-user initiated actions as
	//   well as internal actions such as upgrades or other maintenance operations are in progress are included in thsi condition.
	// - "Degraded": True when the cluster is in a degraded state
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum. Take into consideration that conditions at other levels can be specified within
	// ServiceProviderClusterStatus too.
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
	// ControlPlaneVersion contains the actual control plane version information.
	// ActiveVersions contains all versions currently active in the control plane.
	//
	// During an upgrade, multiple versions can be active simultaneously. For example:
	// - Simple upgrade: [vNew, vOld]
	// - Sequential upgrades before completion: [vNewest, vNewer, vNew, vOld]
	//
	// The list is ordered with the most recent version first.
	//
	// Example JSON structure (state is "Completed" or "Partial"):
	// {
	//   "control_plane_version": {
	//     "active_versions": [
	//       {"version": "4.19.2", "state": "Partial"},
	//       {"version": "4.19.1", "state": "Completed"}
	//     ]
	//   }
	// }
	ControlPlaneVersion ServiceProviderClusterStatusVersion `json:"control_plane_version,omitempty"`

	// DesiredVersionChannels mirrors the observed HostedCluster's
	// status.version.desired.channels (see hypershift ClusterVersionStatus ->
	// configv1.Release.Channels). Each entry is an OpenShift update channel name
	// such as "stable-4.19" or "candidate-4.20".
	//
	// A channel only appears in status.version.desired.channels when the
	// cluster's current desired release has a valid upgrade edge to a release
	// served by that channel. In other words, this is the set of channels the
	// cluster can currently move along; a channel being absent means there is no
	// supported upgrade path to that channel's release line yet.
	//
	// This list is mirrored here by the backend (which alone can observe the
	// HostedCluster) so that DB-free cluster admission can reject a version.id
	// change whose target channel ("<channelGroup>-<id>") is not reachable,
	// without the frontend ever needing access to the management cluster.
	// Written by: ControlPlaneActiveVersions
	DesiredVersionChannels []string `json:"desiredVersionChannels,omitempty"`

	// ActualHostedCluster is the HostedCluster as it currently exists on the
	// management cluster, mirrored here from the kube-applier ReadDesire by the
	// backend. Both spec and status are carried, so this is the single place the
	// frontend can consult for observed management-cluster state.
	//
	// The frontend is deliberately denied any path to a management cluster (no
	// kube-applier container access, no ReadDesireLister, no Maestro), so a
	// frontend compromise cannot create arbitrary resources on a management
	// cluster. Anything admission needs to know about the real HostedCluster has
	// to travel through this field; see internal/admission/CLAUDE.md.
	//
	// The object is mirrored verbatim, exactly as observed on the management
	// cluster. Nothing is stripped or rewritten on the way in, so a consumer can
	// read any field without having to know a mirroring policy.
	//
	// nil means there is no observed HostedCluster to report: the backend has not
	// observed one yet (the cluster is still being created, or the first sync has
	// not run), or a completed read found no HostedCluster on the management
	// cluster, in which case the mirror is retracted rather than left pointing at
	// an object that no longer exists. Consumers must treat nil as unavailable
	// observed state. Safety-critical admission checks must fail closed while it
	// is nil; they cannot assume a required property such as a data-plane image
	// mirror is present.
	//
	// Backend controllers must NOT read this field. They have first-class access
	// to the ReadDesire mirror and are expected to read that instead, staying as
	// close to the source as possible rather than waiting for this copy to catch up.
	// Written by: ActualHostedCluster
	ActualHostedCluster *v1beta1.HostedCluster `json:"actualHostedCluster,omitempty"`

	// Validations is a list of conditions that tracks the status of each cluster validation.
	// Each Condition Type represents a validation and it should be unique among all validations.
	// A Condition Status of True means that the validation passed successfully, and a Condition Status of False means that the validation failed.
	// The Condition Reason and Message are used to provide more details about the validation status.
	// The Condition LastTransitionTime is used to track the last time the validation transitioned from one status to another.
	Validations []metav1.Condition `json:"validations,omitempty"`

	// MaestroReadonlyBundles contains a list of Maestro readonly bundles references.
	// These bundles are used to retrieve particular K8s resources from the Management Cluster.
	// The reference contains a mapping between the logical name we give to the Maestro bundle internally
	// and the Maestro Bundle Name and ID at the Maestro API level.
	MaestroReadonlyBundles MaestroBundleReferenceList `json:"maestroReadonlyBundles,omitempty"`
	// ManagementClusterResourceID is the resource ID of the management cluster
	// this HCP is placed on. Nil means placement has not been resolved yet.
	// Once set, this field is immutable.
	ManagementClusterResourceID *azcorearm.ResourceID `json:"managementClusterResourceID,omitempty"`

	// Placement holds capacity availability for the HCP's placement attempt.
	// CapacityAvailable=True is recorded on the same Replace that sets
	// Spec.ManagementClusterResourceID.
	// Written by: PlacementController
	Placement *ServiceProviderClusterPlacementStatus `json:"placement,omitempty"`

	// DesiredHostedClusterControlPlaneSize mirrors the value of
	// Spec.DesiredHostedClusterControlPlaneSize once cluster-service reflects
	// the effective size override (as confirmed by the desired-control-plane-size
	// status reconciler). It exists so NeedsWork can cheaply detect divergence,
	// including the unset transition (Spec nil, Status non-nil), where there
	// is no signal on Spec alone that dispatch still needs to clear the CS
	// property.
	DesiredHostedClusterControlPlaneSize *string `json:"desiredHostedClusterControlPlaneSize,omitempty"`

	// HostedClusterNamespace is the namespace of the actual HostedCluster.  It contains things like
	//  - HostedCluster CR — the primary user-facing API object
	//  - NodePool CRs — user creates these here
	//  - User-provided secrets — pull secret, SSH key, cloud credentials, encryption secrets, etcd encryption key, audit webhook config, additional trust bundles, service account signing key
	//  - Generated kubeconfig secrets — admin-kubeconfig (copied back from HCP namespace), kubeadmin-password
	//  - EtcdBackup CRs (if used)
	// Written by: ServiceProviderClusterPropertiesSync
	HostedClusterNamespace string `json:"hostedClusterNamespace,omitempty"`

	// ControlPlaneNamespace is the namespace containing the pods that manage and run the HostedCluster.  It contains things like
	//  - etcd
	//  - kube-apiserver
	//  - control-plane-operator
	//  - control-plane-pki-operator
	// it is derived as <hostedClusterNamespace>-<hostedClusterName> with dots replaced by dashes.
	// Hypershift uses the HostedControlPlaneNamespace function.
	// Written by: ServiceProviderClusterPropertiesSync
	ControlPlaneNamespace string `json:"controlPlaneNamespace,omitempty"`

	// ServingCABundle is the PEM-encoded serving CA bundle for the cluster's
	// kube-apiserver. Populated from a ReadDesire mirror of the management
	// cluster's serving CA Secret.
	// Written by: ServiceProviderClusterPropertiesSync
	ServingCABundle string `json:"servingCABundle,omitempty"`

	// AzureResources tracks the lifecycle of Azure resources associated with
	// the cluster, including deny assignments and the managed resource group.
	AzureResources AzureResources `json:"azureResources,omitempty"`

	// MSIManagedIdentities tracks resolved ClientID/PrincipalID for
	// the Managed Service Identity (MSI) based Azure User-Assigned Managed Identities
	// associated to the cluster. Those are the cluster's control plane operators and
	// the cluster's service managed identity.
	// A cluster's control plane operator is a kubernetes operator associated to
	// the cluster that runs in the cluster's control plane. For example,
	// the Cluster's CustomerProperties.Platform.OperatorsAuthentication.UserAssignedIdentities.ControlPlaneOperators
	// map contains (and is not limited to) the set of required control plane operators associated to a Cluster.
	// The cluster's service managed identity is used to read and modify
	// customer-provided Azure resources (for example the cluster subnet),
	// subject to the permissions granted to that identity.
	// MSI-based user-assigned managed identities are the identities defined in
	// the Cluster's `identity` section. Credentials for those identities can be
	// obtained from Microsoft's Managed Identities Data Plane service.
	// In ARO-HCP environments where Microsoft's Managed Identities Data Plane
	// service is unavailable, a fake Managed Identities Data Plane client is
	// used. That client always returns the same identity metadata and
	// credentials, regardless of which identity is requested. The returned
	// values belong to the "MI Mock" identity, so the ClientID and PrincipalID
	// stored for each entry here will not match that entry's ResourceID key,
	// nor the real ClientID/PrincipalID of the corresponding identity in the
	// Cluster's `identity` section.
	// Additionally, this also tracks when Azure should next be re-queried for that info.
	// Written by: FetchMSIIdentitiesInfo
	MSIManagedIdentities ServiceProviderClusterMSIManagedIdentities `json:"msiManagedIdentities,omitempty"`

	// DataPlaneOperatorsManagedIdentities tracks resolved ClientID/PrincipalID for
	// the Azure User Assigned Managed Identities associated with the cluster's data
	// plane operators, plus when Azure should next be re-queried for that info.
	// A cluster's data plane operator is a Kubernetes operator associated with the
	// cluster that runs in the cluster's data plane.
	// For example, the Cluster's CustomerProperties.Platform.OperatorsAuthentication.UserAssignedIdentities.DataPlaneOperators map
	// contains the set of required data plane operators associated with a Cluster.
	// Written by: FetchDataPlaneOperatorsManagedIdentitiesInfoController
	DataPlaneOperatorsManagedIdentities ServiceProviderClusterDataPlaneOperatorsManagedIdentities `json:"dataPlaneOperatorsManagedIdentities,omitempty"`

	// KeyRotationBackupFingerprint identifies the active-key fingerprint of the
	// most recent KMS rotation whose on-demand backup outcome (completed or
	// skipped because backups were paused) has been durably recorded, so it's
	// never acted on again. Only a later rotation with a new fingerprint is
	// eligible for a new backup. Empty means no rotation has been handled yet.
	// Written by: KeyRotationBackup
	KeyRotationBackupFingerprint string `json:"keyRotationBackupFingerprint,omitempty"`
}

type ServiceProviderClusterStatusVersion struct {
	// ActiveVersions is an array of versions currently active in the control plane, ordered with the most recent first.
	// During upgrades, multiple versions can be active simultaneously.
	// Written by: ControlPlaneActiveVersions
	ActiveVersions []ServiceProviderClusterActiveVersion `json:"active_versions,omitempty"`
}

type ServiceProviderConsoleProfile struct {
	// Written by: ClusterPropertiesSync
	URL string `json:"url,omitempty"`
}

type ServiceProviderDNSProfile struct {
	// Written by: ClusterPropertiesSync
	BaseDomain string `json:"baseDomain,omitempty"`
}

type ServiceProviderNodePool struct {
	// CosmosMetadata ResourceID is nested under the cluster so that association and cleanup work as expected
	// it will be the ServiceProviderNodePool type and the name default.
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// Spec contains the desired state of the nodepool
	Spec ServiceProviderNodePoolSpec `json:"spec,omitempty"`

	// Status contains the observed state of the nodepool
	Status ServiceProviderNodePoolStatus `json:"status,omitempty"`
}

type ServiceProviderNodePoolActiveVersion struct {
	// Version is the full version in x.y.z format (e.g., "4.19.2")
	// Written by: NodePoolActiveVersions
	Version *semver.Version `json:"version,omitempty"`
}

type ServiceProviderNodePoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceProviderNodePool `json:"items"`
}

type ServiceProviderNodePoolSpec struct {
	// NodePoolVersion contains the desired node pool version information.
	// Example JSON structure:
	// {
	//   "nodePoolVersion": {
	//     "desiredVersion": "4.19.2"
	//   }
	// }
	NodePoolVersion ServiceProviderNodePoolSpecVersion `json:"nodePoolVersion,omitempty"`
}

type ServiceProviderNodePoolSpecVersion struct {
	// DesiredVersion is the full version the controller wants to upgrade to (format: x.y.z)
	DesiredVersion *semver.Version `json:"desiredVersion,omitempty"`
}

type ServiceProviderNodePoolStatus struct {
	// Conditions are the top-level ServiceProviderNodePoolStatus status conditions.
	// Each Condition Type represents a condition and it should be unique among all conditions.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// Known condition types are:
	// - "Progressing": True when the cluster is in the process of being created, updated, or deleted. Both end-user initiated actions as
	//   well as internal actions such as upgrades or other maintenance operations are in progress are included in thsi condition.
	// - "Degraded": True when the cluster is in a degraded state
	// Addition of new conditions here should be done only when strictly necessary, sparingly and only done
	// when there is a clear benefit to doing so. We expect the number of conditions at this
	// level to be kept to a minimum. Take into consideration that conditions at other levels can be specified within
	// ServiceProviderNodePoolStatus too.
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
	// NodePoolActiveVersions contains the actual node pool versions information
	// ServiceProviderNodePoolActiveVersions contains all versions currently active in the NodePool
	// During an upgrade, multiple versions can be active simultaneously. Meaning, there are nodes
	// with different versions. For example:
	// - Simple upgrade: [vNew, vOld]
	// - Sequential upgrades before completion: [vNewer, vNew, vOld]
	//
	// The list is ordered with the most recent version first.
	//
	// Example JSON structure:
	// {
	//   "nodePoolVersion":{
	//		"activeVersions": [
	//       {"version": "4.19.2"},
	//       {"version": "4.19.1"}
	//     ]
	//   }
	// }
	NodePoolVersion ServiceProviderNodePoolStatusVersion `json:"nodePoolVersion,omitempty"`

	// Validations is a list of conditions that tracks the status of each node pool validation.
	// Each Condition Type represents a validation and it should be unique among all validations.
	// A Condition Status of True means that the validation passed successfully, and a Condition Status of False means that the validation failed.
	// The Condition Reason and Message are used to provide more details about the validation status.
	// The Condition LastTransitionTime is used to track the last time the validation transitioned from one status to another.
	Validations []metav1.Condition `json:"validations,omitempty"`

	// MaestroReadonlyBundles contains a list of Maestro readonly bundles references.
	// These bundles are used to retrieve particular K8s resources from the Management Cluster.
	// The reference contains a mapping between the logical name we give to the Maestro bundle internally
	// and the Maestro Bundle Name and ID at the Maestro API level.
	MaestroReadonlyBundles MaestroBundleReferenceList `json:"maestroReadonlyBundles,omitempty"`
}

type ServiceProviderNodePoolStatusVersion struct {
	// ActiveVersions is an array of versions currently active in the nodepool, ordered with the most recent first.
	// During upgrades, multiple versions can be active simultaneously.
	// Written by: NodePoolActiveVersions
	ActiveVersions []ServiceProviderNodePoolActiveVersion `json:"activeVersions,omitempty"`
}

type ServiceProviderPlatformProfile struct {
	// Written by: ClusterPropertiesSync
	IssuerURL string `json:"issuerUrl,omitempty"`
}

type Subscription struct {
	// PartitionKey holds the lowercased subscriptionID.
	CosmosMetadata `json:"cosmosMetadata"`

	// The resource provider contract gives an example RegistrationDate
	// in RFC1123 format but does not explicitly state a required format
	// so we leave it a plain string.
	State            SubscriptionState       `json:"state"`
	RegistrationDate *string                 `json:"registrationDate"`
	Properties       *SubscriptionProperties `json:"properties"`

	// LastUpdated is a copy of the Cosmos DB system generated
	// "_ts" last updated timestamp field for metrics reporting.
	LastUpdated int `json:"-"`
}