v1alpha1

type ClusterExternalDNS struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +kubebuilder:validation:Required
	Spec   ClusterExternalDNSSpec   `json:"spec,omitempty"`
	Status ClusterExternalDNSStatus `json:"status,omitempty"`
}

type ClusterExternalDNSList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterExternalDNS `json:"items"`
}

type ClusterExternalDNSSpec struct {
	// ResourceName is the name that will be used for the ExternalDNS deployment and related resources. Will default to the name of the ClusterExternalDNS resource if not specified.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	ResourceName string `json:"resourceName"`

	// TenantID is the ID of the Azure tenant where the DNS zones are located.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Format:=uuid
	// +kubebuilder:validation:Pattern=`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`
	TenantID *string `json:"tenantId,omitempty"`

	// DNSZoneResourceIDs is a list of Azure Resource IDs of the DNS zones that the ExternalDNS controller should manage. These must be in the same resource group and be of the same type (public or private). The number of zones is currently capped at 7 but may be expanded in the future.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems:=1
	// +kubebuilder:validation:MaxItems:=7
	// +kubebuilder:validation:XValidation:rule="self.all(item, item.split('/')[2] == self[0].split('/')[2])",message="all items must have the same subscription ID"
	// +kubebuilder:validation:XValidation:rule="self.all(item, item.split('/')[4] == self[0].split('/')[4])",message="all items must have the same resource group"
	// +kubebuilder:validation:XValidation:rule="self.all(item, item.split('/')[7] == self[0].split('/')[7])",message="all items must be of the same resource type"
	// +listType:=set
	DNSZoneResourceIDs []string `json:"dnsZoneResourceIDs"`

	// ResourceTypes is a list of Kubernetes resource types that the ExternalDNS controller should manage. The supported resource types are 'ingress' and 'gateway'.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems:=1
	// +kubebuilder:validation:MaxItems:=2
	// +kubebuilder:validation:XValidation:rule="self.all(item, item.matches('(?i)(gateway|ingress)'))",message="all items must be either 'gateway' or 'ingress'"
	// +listType:=set
	ResourceTypes []string `json:"resourceTypes"`

	// Identity contains information about the identity that ExternalDNS will use to interface with Azure resources.
	// +kubebuilder:validation:Required
	Identity ExternalDNSIdentity `json:"identity"`

	// ResourceNamespace is the namespace where the ExternalDNS resources will be deployed by app routing.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	ResourceNamespace string `json:"resourceNamespace"`

	// Filters contains optional filters that the ExternalDNS controller should use to determine which resources to manage.
	// +optional
	Filters *ExternalDNSFilters `json:"filters,omitempty"`
}

type ClusterExternalDNSStatus struct {
	ExternalDNSStatus `json:",inline"`
}

type DefaultSSLCertificate struct {
	// Secret is a struct that holds the name and namespace fields used for the default ssl secret
	// +optional
	Secret *Secret `json:"secret,omitempty"`

	// Secret in the form of a Key Vault URI
	// +optional
	KeyVaultURI *string `json:"keyVaultURI,omitempty"`

	// ForceSSLRedirect is a flag that sets the global value of redirects to HTTPS if there is a defined DefaultSSLCertificate
	// +kubebuilder:default:=false
	ForceSSLRedirect bool `json:"forceSSLRedirect,omitempty"`
}

type ExternalDNS struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +kubebuilder:validation:Required
	Spec   ExternalDNSSpec   `json:"spec,omitempty"`
	Status ExternalDNSStatus `json:"status,omitempty"`
}

type ExternalDNSFilters struct {
	// GatewayLabelSelector is the label selector that the ExternalDNS controller will use to filter the Gateways that it manages.
	// +optional
	// +kubebuilder:validation:Pattern=`^[^=]+=[^=]+$`
	GatewayLabelSelector *string `json:"gatewayLabels,omitempty"`

	// RouteAndIngressLabelSelector is the label selector that the ExternalDNS controller will use to filter the HTTPRoutes and Ingresses that it manages.
	// +optional
	// +kubebuilder:validation:Pattern=`^[^=]+=[^=]+$`
	RouteAndIngressLabelSelector *string `json:"routeAndIngressLabels,omitempty"`
}

type ExternalDNSIdentity struct {
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	// +kubebuilder:validation:Required
	// ServiceAccount is the name of the Kubernetes ServiceAccount that ExternalDNS will use to interface with Azure resources. It must be in the same namespace as the ExternalDNS.
	ServiceAccount string `json:"serviceAccount"`
}

type ExternalDNSList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ExternalDNS `json:"items"`
}

type ExternalDNSSpec struct {
	// ResourceName is the name that will be used for the ExternalDNS deployment and related resources. Will default to the name of the ExternalDNS resource if not specified.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	// +kubebuilder:validation:Required
	ResourceName string `json:"resourceName"`

	// TenantID is the ID of the Azure tenant where the DNS zones are located.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Format:=uuid
	// +kubebuilder:validation:Pattern=`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`
	TenantID *string `json:"tenantId,omitempty"`

	// DNSZoneResourceIDs is a list of Azure Resource IDs of the DNS zones that the ExternalDNS controller should manage. These must be in the same resource group and be of the same type (public or private). The number of zones is currently capped at 7 but may be expanded in the future.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems:=1
	// +kubebuilder:validation:MaxItems:=7
	// +kubebuilder:validation:XValidation:rule="self.all(item, item.split('/')[2] == self[0].split('/')[2])",message="all items must have the same subscription ID"
	// +kubebuilder:validation:XValidation:rule="self.all(item, item.split('/')[4] == self[0].split('/')[4])",message="all items must have the same resource group"
	// +kubebuilder:validation:XValidation:rule="self.all(item, item.split('/')[7] == self[0].split('/')[7])",message="all items must be of the same resource type"
	// +listType:=set
	DNSZoneResourceIDs []string `json:"dnsZoneResourceIDs"`

	// ResourceTypes is a list of Kubernetes resource types that the ExternalDNS controller should manage. The supported resource types are 'ingress' and 'gateway'.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems:=1
	// +kubebuilder:validation:MaxItems:=2
	// +kubebuilder:validation:XValidation:rule="self.all(item, item.matches('(?i)(gateway|ingress)'))",message="all items must be either 'gateway' or 'ingress'"
	// +listType:=set
	ResourceTypes []string `json:"resourceTypes"`

	// Identity contains information about the identity that ExternalDNS will use to interface with Azure resources.
	// +kubebuilder:validation:Required
	Identity ExternalDNSIdentity `json:"identity"`

	// Filters contains optional filters that the ExternalDNS controller should use to determine which resources to manage.
	// +optional
	Filters *ExternalDNSFilters `json:"filters,omitempty"`
}

type ExternalDNSStatus struct {
	// Conditions is an array of current observed conditions for the ExternalDNS
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions"`

	ExternalDNSReadyReplicas       int32 `json:"externalDNSReadyReplicas"`
	ExternalDNSUnavailableReplicas int32 `json:"externalDNSUnavailableReplicas"`

	// Count of hash collisions for the managed resources. The App Routing Operator uses this field
	// as a collision avoidance mechanism when it needs to create the name for the managed resources.
	// +optional
	// +kubebuilder:validation:Maximum=5
	CollisionCount int32 `json:"collisionCount"`

	// ManagedResourceRefs is a list of references to the managed resources
	// +optional
	ManagedResourceRefs []ManagedObjectReference `json:"managedResourceRefs,omitempty"`
}

type ManagedObjectReference struct {
	// Name is the name of the managed object
	Name string `json:"name"`

	// Namespace is the namespace of the managed object. If not specified, the resource is cluster-scoped
	// +optional
	Namespace string `json:"namespace"`

	// Kind is the kind of the managed object
	Kind string `json:"kind"`

	// APIGroup is the API group of the managed object. If not specified, the resource is in the core API group
	// +optional
	APIGroup string `json:"apiGroup"`
}

type NICNamespacedName struct {
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	Name string `json:"name"`

	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	Namespace string `json:"namespace"`
}

type NginxIngressController struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +required
	// +kubebuilder:default:={"ingressClassName":"nginx.approuting.kubernetes.azure.com","controllerNamePrefix":"nginx"}
	Spec NginxIngressControllerSpec `json:"spec"` // ^ for the above thing https://github.com/kubernetes-sigs/controller-tools/issues/622 defaulting doesn't cascade, so we have to define it all. Comment on this line so it's not in crd spec.

	// +optional
	Status NginxIngressControllerStatus `json:"status,omitempty"`
}

type NginxIngressControllerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NginxIngressController `json:"items"`
}

type NginxIngressControllerSpec struct {
	// IngressClassName is the name of the IngressClass that will be used for the NGINX Ingress Controller. Defaults to metadata.name if
	// not specified.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:default:=nginx.approuting.kubernetes.azure.com
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	// +kubebuilder:validation:Required
	IngressClassName string `json:"ingressClassName"`

	// ControllerNamePrefix is the name to use for the managed NGINX Ingress Controller resources.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=60
	// +kubebuilder:default:=nginx
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9]*[a-z0-9]$`
	// +kubebuilder:validation:Required
	ControllerNamePrefix string `json:"controllerNamePrefix"`

	// LoadBalancerAnnotations is a map of annotations to apply to the NGINX Ingress Controller's Service. Common annotations
	// will be from the Azure LoadBalancer annotations here https://cloud-provider-azure.sigs.k8s.io/topics/loadbalancer/#loadbalancer-annotations
	// +optional
	LoadBalancerAnnotations map[string]string `json:"loadBalancerAnnotations,omitempty"`

	// LoadBalancerSourceRanges restricts traffic to the LoadBalancer Service to the specified client IPs. This can be used along with
	// deny-all annotations to restrict access  https://cloud-provider-azure.sigs.k8s.io/topics/loadbalancer/#loadbalancer-annotations
	LoadBalancerSourceRanges []string `json:"loadBalancerSourceRanges,omitempty"`

	// DefaultSSLCertificate defines whether the NginxIngressController should use a certain SSL certificate by default.
	// If this field is omitted, no default certificate will be used.
	// +optional
	DefaultSSLCertificate *DefaultSSLCertificate `json:"defaultSSLCertificate,omitempty"`

	// DefaultBackendService defines the service that the NginxIngressController should default to when given HTTP traffic with not matching known server names.
	// The controller directs traffic to the first port of the service.
	// +optional
	DefaultBackendService *NICNamespacedName `json:"defaultBackendService,omitempty"`

	// CustomHTTPErrors defines the error codes that the NginxIngressController should send to its default-backend in case of error.
	// +optional
	CustomHTTPErrors []int32 `json:"customHTTPErrors,omitempty"`

	// Scaling defines configuration options for how the Ingress Controller scales
	// +optional
	Scaling *Scaling `json:"scaling,omitempty"`

	// HTTPDisabled is a flag that disables HTTP traffic to the NginxIngressController
	// +optional
	HTTPDisabled bool `json:"httpDisabled,omitempty"`

	// LogFormat is the log format used by the Nginx Ingress Controller. See https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#log-format-upstream
	// +optional
	LogFormat *string `json:"logFormat,omitempty"`

	// EnableSSLPassthrough is a flag that enables SSL passthrough for the NginxIngressController. This allows the controller to pass through SSL traffic without terminating it.
	// +optional
	EnableSSLPassthrough bool `json:"enableSSLPassthrough,omitempty"`
}

type NginxIngressControllerStatus struct {
	// Conditions is an array of current observed conditions for the NGINX Ingress Controller
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions"`

	// ControllerReplicas is the desired number of replicas of the NGINX Ingress Controller
	// +optional
	ControllerReplicas int32 `json:"controllerReplicas"`

	// ControllerReadyReplicas is the number of ready replicas of the NGINX Ingress Controller deployment
	// +optional
	ControllerReadyReplicas int32 `json:"controllerReadyReplicas"`

	// ControllerAvailableReplicas is the number of available replicas of the NGINX Ingress Controller deployment
	// +optional
	ControllerAvailableReplicas int32 `json:"controllerAvailableReplicas"`

	// ControllerUnavailableReplicas is the number of unavailable replicas of the NGINX Ingress Controller deployment
	// +optional
	ControllerUnavailableReplicas int32 `json:"controllerUnavailableReplicas"`

	// Count of hash collisions for the managed resources. The App Routing Operator uses this field
	// as a collision avoidance mechanism when it needs to create the name for the managed resources.
	// +optional
	// +kubebuilder:validation:Maximum=5
	CollisionCount int32 `json:"collisionCount"`

	// ManagedResourceRefs is a list of references to the managed resources
	// +optional
	ManagedResourceRefs []ManagedObjectReference `json:"managedResourceRefs,omitempty"`
}

type Scaling struct {
	// MinReplicas is the lower limit for the number of Ingress Controller replicas. It defaults to 2 pods.
	// +kubebuilder:validation:Minimum=1
	// +optional
	MinReplicas *int32 `json:"minReplicas,omitempty"`
	// MaxReplicas is the upper limit for the number of Ingress Controller replicas. It defaults to 100 pods.
	// +kubebuilder:validation:Minimum=1
	// +optional
	MaxReplicas *int32 `json:"maxReplicas,omitempty"`

	// Threshold defines how quickly the Ingress Controller pods should scale based on workload. Rapid means the Ingress Controller
	// will scale quickly and aggressively, which is the best choice for handling sudden and significant traffic spikes. Steady
	// is the opposite, prioritizing cost-effectiveness. Steady is the best choice when fewer replicas handling more work is desired or when
	// traffic isn't expected to fluctuate. Balanced is a good mix between the two that works for most use-cases. If unspecified, this field
	// defaults to balanced.
	// +kubebuilder:validation:Enum=rapid;balanced;steady;
	// +optional
	Threshold *Threshold `json:"threshold,omitempty"`
}

type Secret struct {
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	Name string `json:"name"`

	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9][-a-z0-9\.]*[a-z0-9]$`
	Namespace string `json:"namespace"`
}

type Threshold string