v1alpha3

type AgentDownloadsSpec struct {
	// Kubernetes overrides the download source for kubelet/kubectl/kube-proxy
	// (upstream default: https://dl.k8s.io).
	// +optional
	Kubernetes *DownloadSource `json:"kubernetes,omitempty"`

	// Containerd overrides the download source for containerd
	// (upstream default: https://github.com/containerd/containerd).
	// +optional
	Containerd *DownloadSource `json:"containerd,omitempty"`

	// Runc overrides the download source for runc
	// (upstream default: https://github.com/opencontainers/runc).
	// +optional
	Runc *DownloadSource `json:"runc,omitempty"`

	// CNI overrides the download source for CNI plugins
	// (upstream default: https://github.com/containernetworking/plugins).
	// +optional
	CNI *DownloadSource `json:"cni,omitempty"`

	// Crictl overrides the download source for crictl
	// (upstream default: https://github.com/kubernetes-sigs/cri-tools).
	// +optional
	Crictl *DownloadSource `json:"crictl,omitempty"`
}

type AgentSpec struct {
	// Image is the OCI image reference used for provisioning the
	// nspawn machine (e.g. "ghcr.io/org/repo:tag"). When empty the
	// agent falls back to its built-in default image.
	// +optional
	Image string `json:"image,omitempty"`

	// Version pins the unbounded-agent release tag that is downloaded
	// onto the host (e.g. "v0.0.10"). When empty the install script
	// tracks the latest published release.
	// +optional
	Version string `json:"version,omitempty"`

	// BaseURL overrides the base URL used to construct the
	// unbounded-agent download URL. Defaults to the upstream GitHub
	// releases URL. The layout under BaseURL must match the GitHub
	// releases layout (<base>/latest/download/<asset> and
	// <base>/download/<tag>/<asset>).
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// URL is a fully qualified download URL for the unbounded-agent
	// tarball. When set it overrides Version and BaseURL entirely.
	// +optional
	URL string `json:"url,omitempty"`

	// Downloads overrides the download sources for the binaries the
	// agent installs into the nspawn rootfs (kubelet, containerd, runc,
	// CNI plugins, crictl). When unset the agent downloads each
	// artifact from its upstream default host.
	// +optional
	Downloads *AgentDownloadsSpec `json:"downloads,omitempty"`
}

type AgentStatus struct {
	// Image is the OCI image reference that was applied to the
	// nspawn machine.
	Image string `json:"image,omitempty"`
}

type BastionSSHSpec struct {
	// Host is the hostname or IP address of the bastion, optionally
	// including the port (e.g. "1.2.3.4:2222"). When the port is
	// omitted, 22 is assumed.
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Username is the SSH username for the bastion.
	// +kubebuilder:default=azureuser
	Username string `json:"username,omitempty"`

	// PrivateKeyRef references a secret containing the SSH private key
	// for the bastion. If not specified, uses the same key as the
	// parent SSHSpec.
	// +optional
	PrivateKeyRef *SecretKeySelector `json:"privateKeyRef,omitempty"`
}

type CloudInitSpec struct {
	// UserDataConfigMapRef references a ConfigMap containing custom
	// cloud-init user-data. The referenced key (default "user-data")
	// must contain a valid cloud-init configuration (e.g. a
	// #cloud-config YAML document).
	// +optional
	UserDataConfigMapRef *ConfigMapKeySelector `json:"userDataConfigMapRef,omitempty"`
}

type ConfigMapKeySelector struct {
	// Name of the ConfigMap.
	Name string `json:"name"`

	// Namespace of the ConfigMap.
	Namespace string `json:"namespace"`

	// Key within the ConfigMap.
	// +kubebuilder:default=user-data
	Key string `json:"key,omitempty"`
}

type DHCPLease struct {
	// IPv4 is the IP address to assign.
	IPv4 string `json:"ipv4"`

	// MAC is the MAC address of the network interface.
	MAC string `json:"mac"`

	// SubnetMask is the subnet mask for the lease.
	SubnetMask string `json:"subnetMask"`

	// Gateway is the default gateway.
	Gateway string `json:"gateway"`

	// DNS is a list of DNS server addresses.
	// +optional
	DNS []string `json:"dns,omitempty"`
}

type DownloadSource struct {
	// BaseURL replaces the upstream host + path prefix used to
	// construct the download URL. Version and arch substitution are
	// preserved so mirrors need to publish assets under the same
	// layout as the upstream project.
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// URL is a fully qualified download URL template. Version/arch
	// substitution via fmt directives is preserved. When set it
	// overrides BaseURL entirely.
	// +optional
	URL string `json:"url,omitempty"`

	// Version overrides the version of the artifact that would
	// otherwise be derived from the cluster Kubernetes version or the
	// agent's compiled-in defaults.
	// +optional
	Version string `json:"version,omitempty"`
}

type KubernetesSpec struct {
	// Version is the Kubernetes version to install (e.g., "v1.34.0").
	// When omitted the controller falls back to the cluster's
	// Kubernetes version.
	// +optional
	Version string `json:"version,omitempty"`

	// NodeRef references the Node that corresponds to this Machine.
	// +optional
	NodeRef *LocalObjectReference `json:"nodeRef,omitempty"`

	// NodeLabels are labels passed to kubelet's --node-labels flag.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`

	// RegisterWithTaints are taints passed to kubelet's --register-with-taints flag.
	// Each entry uses the standard Kubernetes taint format: key=value:Effect.
	// +optional
	RegisterWithTaints []string `json:"registerWithTaints,omitempty"`

	// BootstrapTokenRef references a bootstrap token Secret in
	// kube-system. The secret must be of type
	// bootstrap.kubernetes.io/token with the well-known keys
	// "token-id" and "token-secret".
	// +kubebuilder:validation:Required
	BootstrapTokenRef LocalObjectReference `json:"bootstrapTokenRef"`
}

type LocalObjectReference struct {
	// Name of the referenced resource.
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type Machine struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineSpec   `json:"spec,omitempty"`
	Status MachineStatus `json:"status,omitempty"`
}

type MachineConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineConfigurationSpec   `json:"spec,omitempty"`
	Status MachineConfigurationStatus `json:"status,omitempty"`
}

type MachineConfigurationAgent struct {
	// Image is the OCI image reference used for provisioning the
	// nspawn machine (e.g. "ghcr.io/org/repo:tag").
	// +kubebuilder:validation:Required
	Image string `json:"image"`
}

type MachineConfigurationKubernetes struct {
	// Version is the Kubernetes version to install (e.g. "v1.34.0").
	// +optional
	Version string `json:"version,omitempty"`

	// NodeLabels are labels passed to kubelet's --node-labels flag.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`

	// RegisterWithTaints are taints passed to kubelet's
	// --register-with-taints flag.
	// +optional
	RegisterWithTaints []corev1.Taint `json:"registerWithTaints,omitempty"`
}

type MachineConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineConfiguration `json:"items"`
}

type MachineConfigurationRef struct {
	// Name is the name of the MachineConfiguration.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Version is the specific MachineConfigurationVersion number to
	// use. If omitted, the controller selects the latest locked
	// (deployed) version and populates this field.
	// +optional
	Version *int32 `json:"version,omitempty"`
}

type MachineConfigurationRefStatus struct {
	// Name is the MachineConfiguration name.
	Name string `json:"name,omitempty"`

	// Version is the MachineConfigurationVersion number that was applied.
	Version int32 `json:"version,omitempty"`

	// VersionName is the full MachineConfigurationVersion object name
	// (e.g. "myconfig-v3").
	VersionName string `json:"versionName,omitempty"`
}

type MachineConfigurationSpec struct {
	// Template contains the configuration fields that are versioned
	// into MachineConfigurationVersion objects.
	// +kubebuilder:validation:Required
	Template MachineConfigurationTemplate `json:"template"`

	// MachineSelector selects machines that should automatically
	// receive this configuration. If set, new machines matching the
	// selector will be assigned the latest locked version of the
	// highest priority configuration that matches.
	// +optional
	MachineSelector *metav1.LabelSelector `json:"machineSelector,omitempty"`

	// Priority determines which configuration is selected when multiple
	// configurations match a machine's labels. Higher values take
	// precedence. When two configurations have the same priority,
	// lexicographic ordering of names is used as a tiebreaker.
	// +optional
	// +kubebuilder:default=0
	Priority int32 `json:"priority,omitempty"`

	// UpdateStrategy controls how configuration changes are rolled out
	// to machines that reference this configuration.
	// +optional
	UpdateStrategy MachineConfigurationUpdateStrategy `json:"updateStrategy,omitempty"`

	// RevisionHistoryLimit is the number of old
	// MachineConfigurationVersions to retain for rollback. Versions
	// that are still referenced by a Machine are never deleted
	// regardless of this limit, so the actual number of retained
	// versions may exceed this value.
	// +optional
	// +kubebuilder:default=10
	// +kubebuilder:validation:Minimum=0
	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty"`
}

type MachineConfigurationStatus struct {
	// LatestVersion is the highest version number that has been
	// created for this MachineConfiguration. The controller uses this
	// to avoid reusing version numbers when versions are deleted.
	LatestVersion int32 `json:"latestVersion,omitempty"`

	// CurrentVersion is the version number of the latest non-deployed
	// (editable) MachineConfigurationVersion. If all versions are
	// deployed, this is 0.
	CurrentVersion int32 `json:"currentVersion,omitempty"`

	// Conditions represent the latest available observations of the
	// MachineConfiguration's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineConfigurationTemplate struct {
	// Kubernetes contains Kubernetes-specific configuration such as
	// the target version, node labels, and taints.
	// +optional
	Kubernetes *MachineConfigurationKubernetes `json:"kubernetes,omitempty"`

	// Agent contains settings for the unbounded node agent (e.g. the
	// OCI image reference for the nspawn machine).
	// +optional
	Agent *MachineConfigurationAgent `json:"agent,omitempty"`
}

type MachineConfigurationUpdateStrategy struct {
	// Type is the update strategy type.
	// +kubebuilder:default=OnDelete
	Type MachineConfigurationUpdateStrategyType `json:"type,omitempty"`

	// MaxUnavailable is the maximum number of machines that can be
	// unavailable during a RollingUpdate. Only used when Type is
	// RollingUpdate. Can be an absolute number or a percentage.
	// +optional
	MaxUnavailable *int32 `json:"maxUnavailable,omitempty"`
}

type MachineConfigurationUpdateStrategyType string

type MachineConfigurationVersion struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineConfigurationVersionSpec   `json:"spec,omitempty"`
	Status MachineConfigurationVersionStatus `json:"status,omitempty"`
}

type MachineConfigurationVersionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineConfigurationVersion `json:"items"`
}

type MachineConfigurationVersionSpec struct {
	// Version is the monotonically increasing version number within
	// the parent MachineConfiguration.
	// +kubebuilder:validation:Minimum=1
	Version int32 `json:"version"`

	// Template is the configuration snapshot copied from the parent
	// MachineConfiguration at the time this version was created or
	// last updated (while still editable).
	Template MachineConfigurationTemplate `json:"template"`
}

type MachineConfigurationVersionStatus struct {
	// Deployed indicates whether any Machine has been provisioned
	// using this version. Once true, the spec fields are immutable.
	Deployed bool `json:"deployed,omitempty"`

	// DeployedMachines is the count of Machines currently referencing
	// this version.
	DeployedMachines int32 `json:"deployedMachines,omitempty"`

	// Conditions represent the latest available observations.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Machine `json:"items"`
}

type MachineOperation struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineOperationSpec   `json:"spec,omitempty"`
	Status MachineOperationStatus `json:"status,omitempty"`
}

type MachineOperationCredential struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec MachineOperationCredentialSpec `json:"spec,omitempty"`
}

type MachineOperationCredentialAuth struct {
	// Mode identifies the credential source.
	// +kubebuilder:validation:Required
	Mode MachineOperationCredentialAuthMode `json:"mode"`

	// SecretRef references provider-specific external plugin configuration. It
	// is required for ExternalPlugin mode.
	// +optional
	SecretRef *NamespacedSecretReference `json:"secretRef,omitempty"`
}

type MachineOperationCredentialAuthMode string

type MachineOperationCredentialList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineOperationCredential `json:"items"`
}

type MachineOperationCredentialSpec struct {
	// SiteName is matched against the Machine site label.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	SiteName string `json:"siteName"`

	// Provider identifies the external control provider this credential applies
	// to.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider"`

	// Auth identifies how the provider should authenticate.
	// +kubebuilder:validation:Required
	Auth MachineOperationCredentialAuth `json:"auth"`
}

type MachineOperationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineOperation `json:"items"`
}

type MachineOperationSpec struct {
	// MachineRef is the name of the Machine CR this operation targets.
	// Either machineRef or machineSelector must be set.
	// +optional
	MachineRef string `json:"machineRef,omitempty"`

	// MachineSelector selects machines by labels. When set, the
	// controller creates individual MachineOperation children for
	// each matched machine. Either machineRef or machineSelector
	// must be set.
	// +optional
	MachineSelector *metav1.LabelSelector `json:"machineSelector,omitempty"`

	// OperationKind is the operation to perform on the target machine.
	// +kubebuilder:validation:Required
	OperationKind OperationKind `json:"operationKind"`

	// Parameters is an optional set of key-value pairs passed to the
	// operation executor. For example, RestartService uses "service" to
	// specify the systemd unit name.
	// TODO: Revisit whether map[string]string is sufficient or if we
	// need a richer type (e.g. runtime.RawExtension for arbitrary
	// JSON, or a typed []OperationParameter struct).
	// +optional
	Parameters map[string]string `json:"parameters,omitempty"`

	// TTLSecondsAfterFinished limits the lifetime of a completed or failed
	// MachineOperation. If set, the agent deletes the MachineOperation
	// this many seconds after it reaches a terminal phase. If unset, the
	// MachineOperation is kept indefinitely.
	// +optional
	// +kubebuilder:validation:Minimum=0
	TTLSecondsAfterFinished *int32 `json:"ttlSecondsAfterFinished,omitempty"`
}

type MachineOperationStatus struct {
	// Phase is the current phase of the operation.
	Phase OperationPhase `json:"phase,omitempty"`

	// Message is a human-readable description of the current state.
	// +optional
	Message string `json:"message,omitempty"`

	// StartedAt is when the agent began executing the operation.
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// CompletedAt is when the operation reached a terminal state
	// (Complete or Failed).
	// +optional
	CompletedAt *metav1.Time `json:"completedAt,omitempty"`

	// ObservedMachineGeneration is the Machine's metadata.generation
	// at the time the agent began executing the operation. Clients
	// can compare this to the current Machine generation to determine
	// whether the operation acted on the expected machine state.
	// +optional
	ObservedMachineGeneration int64 `json:"observedMachineGeneration,omitempty"`

	// Targets records the per-machine execution state for this operation.
	// For single-machine operations this contains one entry. For selector
	// operations, targets are snapshotted when execution begins and remain
	// authoritative even if selector matches change later.
	// +optional
	// +listType=map
	// +listMapKey=machineRef
	Targets []MachineOperationTargetStatus `json:"targets,omitempty"`

	// Conditions represent the latest available observations of the
	// operation's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineOperationTargetStatus struct {
	// MachineRef is the name of the targeted Machine.
	// +kubebuilder:validation:Required
	MachineRef string `json:"machineRef"`

	// Phase is the current lifecycle phase for this target.
	// +optional
	Phase OperationPhase `json:"phase,omitempty"`

	// Stage is the current operation-specific stage for this target.
	// +optional
	Stage OperationStage `json:"stage,omitempty"`

	// Message is a human-readable description of target progress or failure.
	// +optional
	Message string `json:"message,omitempty"`

	// StartedAt is when execution began for this target.
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// CompletedAt is when this target reached a terminal phase.
	// +optional
	CompletedAt *metav1.Time `json:"completedAt,omitempty"`

	// ObservedGeneration is the target Machine generation acted on.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// TargetOperations records the Machine operation counters this operation
	// requested. It is used by counter-backed HostReplace operations to remain
	// idempotent across controller restarts.
	// +optional
	TargetOperations *OperationsStatus `json:"targetOperations,omitempty"`

	// Attempts is the number of external action attempts made for this target.
	// Polling expected state changes does not increment this field.
	// +optional
	Attempts int32 `json:"attempts,omitempty"`

	// LastAttemptAt records when the latest external action attempt occurred.
	// +optional
	LastAttemptAt *metav1.Time `json:"lastAttemptAt,omitempty"`
}

type MachinePhase string

type MachineSpec struct {
	// SSH contains the SSH connection and credential details for the
	// machine.
	// +optional
	SSH *SSHSpec `json:"ssh,omitempty"`

	// PXE contains PXE boot configuration for the machine.
	// +optional
	PXE *PXESpec `json:"pxe,omitempty"`

	// Kubernetes contains Kubernetes-specific configuration.
	// +optional
	Kubernetes *KubernetesSpec `json:"kubernetes,omitempty"`

	// Agent contains settings for the unbounded node agent.
	// +optional
	Agent *AgentSpec `json:"agent,omitempty"`

	// Operations contains counter-based operation triggers.
	// +optional
	Operations *OperationsSpec `json:"operations,omitempty"`

	// Provider identifies the external control provider for this machine.
	// +optional
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider,omitempty"`

	// ProviderID identifies the underlying infrastructure resource for this
	// machine, using a Kubernetes-style provider ID such as
	// azure:///subscriptions/.../virtualMachines/name or oci://ocid1.instance...
	// +optional
	ProviderID string `json:"providerID,omitempty"`

	// ConfigurationRef references a MachineConfiguration (and
	// optionally a specific version) that defines the configuration
	// profile for this machine. If a specific version is set, that
	// version is used at provisioning time; otherwise the latest
	// locked version is used and the version field is set by the
	// controller.
	// +optional
	ConfigurationRef *MachineConfigurationRef `json:"configurationRef,omitempty"`
}

type MachineStatus struct {
	// Phase is the current phase of the machine. Intended for human
	// consumption; follows the state machine rather than driving it.
	Phase MachinePhase `json:"phase,omitempty"`

	// Message provides additional status information.
	Message string `json:"message,omitempty"`

	// SSH holds observed SSH state.
	// +optional
	SSH *SSHStatus `json:"ssh,omitempty"`

	// Redfish holds observed Redfish state.
	// +optional
	Redfish *RedfishStatus `json:"redfish,omitempty"`

	// TPM holds observed TPM state.
	// +optional
	TPM *TPMStatus `json:"tpm,omitempty"`

	// Agent holds the applied agent settings.
	// +optional
	Agent *AgentStatus `json:"agent,omitempty"`

	// Operations holds the last-observed operation counters.
	// +optional
	Operations *OperationsStatus `json:"operations,omitempty"`

	// Configuration records the MachineConfigurationVersion that was
	// applied to this machine during the most recent provisioning.
	// +optional
	Configuration *MachineConfigurationRefStatus `json:"configuration,omitempty"`

	// Conditions represent the latest available observations of the
	// machine's state.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type NamespacedSecretReference struct {
	// Name of the secret.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace of the secret.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Namespace string `json:"namespace"`
}

type OperationKind string

type OperationPhase string

type OperationStage string

type OperationsSpec struct {
	// RebootCounter triggers a reboot when it exceeds the status
	// reboot counter.
	// +optional
	RebootCounter int64 `json:"rebootCounter,omitempty"`

	// RepaveCounter triggers a repave when it exceeds the status
	// repave counter.
	// +optional
	RepaveCounter int64 `json:"repaveCounter,omitempty"`
}

type OperationsStatus struct {
	// RebootCounter is the last reboot counter value that was acted on.
	RebootCounter int64 `json:"rebootCounter,omitempty"`

	// RepaveCounter is the last repave counter value that was acted on.
	RepaveCounter int64 `json:"repaveCounter,omitempty"`
}

type PXESpec struct {
	// Image is an OCI image reference containing netboot artifacts.
	// Example: "ghcr.io/azure/images/host-ubuntu2404:v1"
	// +kubebuilder:validation:Required
	Image string `json:"image"`

	// DHCPLeases defines static DHCP leases for PXE booting.
	// +optional
	DHCPLeases []DHCPLease `json:"dhcpLeases,omitempty"`

	// Redfish configures optional Redfish BMC access.
	// +optional
	Redfish *RedfishSpec `json:"redfish,omitempty"`

	// CloudInit contains optional cloud-init customization for PXE-booted
	// machines.
	// +optional
	CloudInit *CloudInitSpec `json:"cloudInit,omitempty"`
}

type RedfishSpec struct {
	// URL is the Redfish endpoint URL.
	// +kubebuilder:validation:Required
	URL string `json:"url"`

	// Username is the Redfish username.
	// +kubebuilder:validation:Required
	Username string `json:"username"`

	// DeviceID is the Redfish system device ID. Defaults to "1".
	// +kubebuilder:default="1"
	DeviceID string `json:"deviceID,omitempty"`

	// PasswordRef references a secret containing the Redfish password.
	// +kubebuilder:validation:Required
	PasswordRef SecretKeySelector `json:"passwordRef"`
}

type RedfishStatus struct {
	// CertFingerprint is the TLS certificate fingerprint for the
	// Redfish endpoint, pinned on first connection.
	CertFingerprint string `json:"certFingerprint,omitempty"`
}

type SSHSpec struct {
	// Host is the hostname or IP address of the machine, optionally
	// including the port (e.g. "1.2.3.4:2222"). When the port is
	// omitted, 22 is assumed.
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Username is the SSH username.
	// +kubebuilder:default=azureuser
	Username string `json:"username,omitempty"`

	// PrivateKeyRef references a secret containing the SSH private key.
	// +kubebuilder:validation:Required
	PrivateKeyRef SecretKeySelector `json:"privateKeyRef"`

	// Bastion configures an optional SSH jump host (bastion) for proxy
	// connections. Its structure is identical to SSHSpec minus the
	// bastion field itself.
	// +optional
	Bastion *BastionSSHSpec `json:"bastion,omitempty"`
}

type SSHStatus struct {
	// Fingerprint is the SSH host key fingerprint discovered on
	// first connection. Subsequent connections must match this value.
	Fingerprint string `json:"fingerprint,omitempty"`
}

type SecretKeySelector struct {
	// Name of the secret.
	Name string `json:"name"`

	// Namespace of the secret.
	Namespace string `json:"namespace"`

	// Key within the secret.
	// +kubebuilder:default=ssh-privatekey
	Key string `json:"key,omitempty"`
}

type TPMStatus struct {
	// EKPublicKey is the TPM endorsement key public key, written
	// when the PXE boot image requests a bootstrap token.
	EKPublicKey string `json:"ekPublicKey,omitempty"`
}