v1alpha3

type AgentDownloadsSpec struct {
	// Kubernetes overrides the download source for kubelet/kubectl/kube-proxy
	// (upstream default: https://dl.k8s.io).
	// +optional
	Kubernetes *DownloadSource `json:"kubernetes,omitempty"`

	// Containerd overrides the download source for containerd
	// (upstream default: https://github.com/containerd/containerd).
	// +optional
	Containerd *DownloadSource `json:"containerd,omitempty"`

	// Runc overrides the download source for runc
	// (upstream default: https://github.com/opencontainers/runc).
	// +optional
	Runc *DownloadSource `json:"runc,omitempty"`

	// CNI overrides the download source for CNI plugins
	// (upstream default: https://github.com/containernetworking/plugins).
	// +optional
	CNI *DownloadSource `json:"cni,omitempty"`

	// Crictl overrides the download source for crictl
	// (upstream default: https://github.com/kubernetes-sigs/cri-tools).
	// +optional
	Crictl *DownloadSource `json:"crictl,omitempty"`
}

type AgentSpec struct {
	// Image is the OCI image reference used for provisioning the
	// nspawn machine (e.g. "ghcr.io/org/repo:tag"). When empty the
	// agent falls back to its built-in default image.
	// +optional
	Image string `json:"image,omitempty"`

	// Version pins the unbounded-agent release tag that is downloaded
	// onto the host (e.g. "v0.0.10"). When empty the install script
	// tracks the latest published release.
	// +optional
	Version string `json:"version,omitempty"`

	// BaseURL overrides the base URL used to construct the
	// unbounded-agent download URL. Defaults to the upstream GitHub
	// releases URL. The layout under BaseURL must match the GitHub
	// releases layout (<base>/latest/download/<asset> and
	// <base>/download/<tag>/<asset>).
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// URL is a fully qualified download URL for the unbounded-agent
	// tarball. When set it overrides Version and BaseURL entirely.
	// +optional
	URL string `json:"url,omitempty"`

	// Downloads overrides the download sources for the binaries the
	// agent installs into the nspawn rootfs (kubelet, containerd, runc,
	// CNI plugins, crictl). When unset the agent downloads each
	// artifact from its upstream default host.
	// +optional
	Downloads *AgentDownloadsSpec `json:"downloads,omitempty"`
}

type AgentStatus struct {
	// Image is the OCI image reference that was applied to the
	// nspawn machine.
	Image string `json:"image,omitempty"`
}

type BastionSSHSpec struct {
	// Host is the hostname or IP address of the bastion, optionally
	// including the port (e.g. "1.2.3.4:2222"). When the port is
	// omitted, 22 is assumed.
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Username is the SSH username for the bastion.
	// +kubebuilder:default=azureuser
	Username string `json:"username,omitempty"`

	// PrivateKeyRef references a secret containing the SSH private key
	// for the bastion. If not specified, uses the same key as the
	// parent SSHSpec.
	// +optional
	PrivateKeyRef *SecretKeySelector `json:"privateKeyRef,omitempty"`
}

type CloudInitSpec struct {
	// UserDataConfigMapRef references a ConfigMap containing custom
	// cloud-init user-data. The referenced key (default "user-data")
	// must contain a valid cloud-init configuration (e.g. a
	// #cloud-config YAML document).
	// +optional
	UserDataConfigMapRef *ConfigMapKeySelector `json:"userDataConfigMapRef,omitempty"`
}

type ConfigMapKeySelector struct {
	// Name of the ConfigMap.
	Name string `json:"name"`

	// Namespace of the ConfigMap.
	Namespace string `json:"namespace"`

	// Key within the ConfigMap.
	// +kubebuilder:default=user-data
	Key string `json:"key,omitempty"`
}

type DHCPLease struct {
	// IPv4 is the IP address to assign.
	IPv4 string `json:"ipv4"`

	// MAC is the MAC address of the network interface.
	MAC string `json:"mac"`

	// SubnetMask is the subnet mask for the lease.
	SubnetMask string `json:"subnetMask"`

	// Gateway is the default gateway.
	Gateway string `json:"gateway"`

	// DNS is a list of DNS server addresses.
	// +optional
	DNS []string `json:"dns,omitempty"`
}

type DownloadSource struct {
	// BaseURL replaces the upstream host + path prefix used to
	// construct the download URL. Version and arch substitution are
	// preserved so mirrors need to publish assets under the same
	// layout as the upstream project.
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// URL is a fully qualified download URL template. Version/arch
	// substitution via fmt directives is preserved. When set it
	// overrides BaseURL entirely.
	// +optional
	URL string `json:"url,omitempty"`

	// Version overrides the version of the artifact that would
	// otherwise be derived from the cluster Kubernetes version or the
	// agent's compiled-in defaults.
	// +optional
	Version string `json:"version,omitempty"`
}

type KubernetesSpec struct {
	// Version is the Kubernetes version to install (e.g., "v1.34.0").
	// When omitted the controller falls back to the cluster's
	// Kubernetes version.
	// +optional
	Version string `json:"version,omitempty"`

	// NodeRef references the Node that corresponds to this Machine.
	// +optional
	NodeRef *LocalObjectReference `json:"nodeRef,omitempty"`

	// NodeLabels are labels passed to kubelet's --node-labels flag.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`

	// RegisterWithTaints are taints passed to kubelet's --register-with-taints flag.
	// Each entry uses the standard Kubernetes taint format: key=value:Effect.
	// +optional
	RegisterWithTaints []string `json:"registerWithTaints,omitempty"`

	// BootstrapTokenRef references a bootstrap token Secret in
	// kube-system. The secret must be of type
	// bootstrap.kubernetes.io/token with the well-known keys
	// "token-id" and "token-secret".
	// +kubebuilder:validation:Required
	BootstrapTokenRef LocalObjectReference `json:"bootstrapTokenRef"`
}

type LocalObjectReference struct {
	// Name of the referenced resource.
	Name string `json:"name"`
}

type Machine struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineSpec   `json:"spec,omitempty"`
	Status MachineStatus `json:"status,omitempty"`
}

type MachineList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Machine `json:"items"`
}

type MachinePhase string

type MachineSpec struct {
	// SSH contains the SSH connection and credential details for the
	// machine.
	// +optional
	SSH *SSHSpec `json:"ssh,omitempty"`

	// PXE contains PXE boot configuration for the machine.
	// +optional
	PXE *PXESpec `json:"pxe,omitempty"`

	// Kubernetes contains Kubernetes-specific configuration.
	// +optional
	Kubernetes *KubernetesSpec `json:"kubernetes,omitempty"`

	// Agent contains settings for the unbounded node agent.
	// +optional
	Agent *AgentSpec `json:"agent,omitempty"`

	// Operations contains counter-based operation triggers.
	// +optional
	Operations *OperationsSpec `json:"operations,omitempty"`
}

type MachineStatus struct {
	// Phase is the current phase of the machine. Intended for human
	// consumption; follows the state machine rather than driving it.
	Phase MachinePhase `json:"phase,omitempty"`

	// Message provides additional status information.
	Message string `json:"message,omitempty"`

	// SSH holds observed SSH state.
	// +optional
	SSH *SSHStatus `json:"ssh,omitempty"`

	// Redfish holds observed Redfish state.
	// +optional
	Redfish *RedfishStatus `json:"redfish,omitempty"`

	// TPM holds observed TPM state.
	// +optional
	TPM *TPMStatus `json:"tpm,omitempty"`

	// Agent holds the applied agent settings.
	// +optional
	Agent *AgentStatus `json:"agent,omitempty"`

	// Operations holds the last-observed operation counters.
	// +optional
	Operations *OperationsStatus `json:"operations,omitempty"`

	// Conditions represent the latest available observations of the
	// machine's state.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type OperationsSpec struct {
	// RebootCounter triggers a reboot when it exceeds the status
	// reboot counter.
	// +optional
	RebootCounter int64 `json:"rebootCounter,omitempty"`

	// RepaveCounter triggers a repave when it exceeds the status
	// repave counter.
	// +optional
	RepaveCounter int64 `json:"repaveCounter,omitempty"`
}

type OperationsStatus struct {
	// RebootCounter is the last reboot counter value that was acted on.
	RebootCounter int64 `json:"rebootCounter,omitempty"`

	// RepaveCounter is the last repave counter value that was acted on.
	RepaveCounter int64 `json:"repaveCounter,omitempty"`
}

type PXESpec struct {
	// Image is an OCI image reference containing netboot artifacts.
	// Example: "ghcr.io/azure/images/host-ubuntu2404:v1"
	// +kubebuilder:validation:Required
	Image string `json:"image"`

	// DHCPLeases defines static DHCP leases for PXE booting.
	// +optional
	DHCPLeases []DHCPLease `json:"dhcpLeases,omitempty"`

	// Redfish configures optional Redfish BMC access.
	// +optional
	Redfish *RedfishSpec `json:"redfish,omitempty"`

	// CloudInit contains optional cloud-init customization for PXE-booted
	// machines.
	// +optional
	CloudInit *CloudInitSpec `json:"cloudInit,omitempty"`
}

type RedfishSpec struct {
	// URL is the Redfish endpoint URL.
	// +kubebuilder:validation:Required
	URL string `json:"url"`

	// Username is the Redfish username.
	// +kubebuilder:validation:Required
	Username string `json:"username"`

	// DeviceID is the Redfish system device ID. Defaults to "1".
	// +kubebuilder:default="1"
	DeviceID string `json:"deviceID,omitempty"`

	// PasswordRef references a secret containing the Redfish password.
	// +kubebuilder:validation:Required
	PasswordRef SecretKeySelector `json:"passwordRef"`
}

type RedfishStatus struct {
	// CertFingerprint is the TLS certificate fingerprint for the
	// Redfish endpoint, pinned on first connection.
	CertFingerprint string `json:"certFingerprint,omitempty"`
}

type SSHSpec struct {
	// Host is the hostname or IP address of the machine, optionally
	// including the port (e.g. "1.2.3.4:2222"). When the port is
	// omitted, 22 is assumed.
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Username is the SSH username.
	// +kubebuilder:default=azureuser
	Username string `json:"username,omitempty"`

	// PrivateKeyRef references a secret containing the SSH private key.
	// +kubebuilder:validation:Required
	PrivateKeyRef SecretKeySelector `json:"privateKeyRef"`

	// Bastion configures an optional SSH jump host (bastion) for proxy
	// connections. Its structure is identical to SSHSpec minus the
	// bastion field itself.
	// +optional
	Bastion *BastionSSHSpec `json:"bastion,omitempty"`
}

type SSHStatus struct {
	// Fingerprint is the SSH host key fingerprint discovered on
	// first connection. Subsequent connections must match this value.
	Fingerprint string `json:"fingerprint,omitempty"`
}

type SecretKeySelector struct {
	// Name of the secret.
	Name string `json:"name"`

	// Namespace of the secret.
	Namespace string `json:"namespace"`

	// Key within the secret.
	// +kubebuilder:default=ssh-privatekey
	Key string `json:"key,omitempty"`
}

type TPMStatus struct {
	// EKPublicKey is the TPM endorsement key public key, written
	// when the PXE boot image requests a bootstrap token.
	EKPublicKey string `json:"ekPublicKey,omitempty"`
}