v1alpha1

type AzureCredential struct {
	// Default uses DefaultAzureCredential, such as a managed identity or
	// service principal environment variables from a Secret.
	// +optional
	Default *AzureDefaultCredential `json:"default,omitempty"`

	// WorkloadIdentity uses Microsoft Entra Workload ID. The cluster must run
	// the Azure Workload Identity webhook, and the identity must trust the
	// origin's ServiceAccount.
	// +optional
	WorkloadIdentity *AzureWorkloadIdentityCredential `json:"workloadIdentity,omitempty"`
}

type AzureDefaultCredential struct {
	// ClientID selects a user-assigned managed identity.
	// +kubebuilder:validation:Pattern=`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`
	// +optional
	ClientID string `json:"clientID,omitempty"`

	// SecretRef names a Secret in the operator namespace whose keys are
	// injected as environment variables, for example AZURE_CLIENT_ID,
	// AZURE_TENANT_ID, and AZURE_CLIENT_SECRET.
	// +optional
	SecretRef *SecretReference `json:"secretRef,omitempty"`
}

type AzureOrigin struct {
	// ContainerURL is the blob container URL, for example
	// https://account.blob.core.windows.net/models. The last path segment is
	// the container name. Azurite-style URLs may carry one account path
	// segment before it, for example http://127.0.0.1:10000/account/models.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=320
	// +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() in ['http', 'https']",message="containerURL must be an http or https URL"
	// +kubebuilder:validation:XValidation:rule="!self.contains('?') && !self.contains('#') && !self.contains('@')",message="containerURL must not contain credentials, a query, or a fragment"
	// +kubebuilder:validation:XValidation:rule="self.matches('^https?://[]A-Za-z0-9.:[-]+(/[A-Za-z0-9_-]+)?/[a-z0-9]+(-[a-z0-9]+)*$') && self.substring(self.lastIndexOf('/') + 1).size() >= 3 && self.substring(self.lastIndexOf('/') + 1).size() <= 63",message="containerURL must be an account URL followed by one valid container name, such as https://account.blob.core.windows.net/models"
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="containerURL is immutable; create a new ClusterCache for a different container"
	ContainerURL string `json:"containerURL"`

	// Credential selects how the origin authenticates. When omitted, requests are anonymous.
	// +optional
	Credential *AzureCredential `json:"credential,omitempty"`
}

type AzureWorkloadIdentityCredential struct {
	// ClientID is the client ID of the federated identity.
	// +kubebuilder:validation:Pattern=`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`
	ClientID string `json:"clientID"`

	// TenantID overrides the tenant configured by the webhook.
	// +kubebuilder:validation:Pattern=`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`
	// +optional
	TenantID string `json:"tenantID,omitempty"`
}

type ClusterCache struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec configures optional cache features.
	// +optional
	Spec ClusterCacheSpec `json:"spec,omitempty,omitzero"`
}

type ClusterCacheList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterCache `json:"items"`
}

type ClusterCacheSpec struct {
	// Origin deploys a managed racer-object origin for this cache. The operator runs
	// one origin pod per dataplane node. Origin can be set only at creation and
	// cannot be removed later; leave it unset to deploy your own origin.
	// +optional
	Origin *ObjectOrigin `json:"origin,omitempty"`
}

type ObjectOrigin struct {
	// MetadataTTL bounds how long object metadata is reused before it is revalidated.
	// It must not be negative. When unset, the racer-object default applies.
	// +kubebuilder:validation:XValidation:rule="duration(self) >= duration('0s')",message="metadataTTL must not be negative"
	// +optional
	MetadataTTL *metav1.Duration `json:"metadataTTL,omitempty"`

	// RequestTimeout bounds each upstream request. It must be positive.
	// When unset, the racer-object default applies.
	// +kubebuilder:validation:XValidation:rule="duration(self) > duration('0s')",message="requestTimeout must be positive"
	// +optional
	RequestTimeout *metav1.Duration `json:"requestTimeout,omitempty"`

	// MaxConcurrentRequests bounds concurrent upstream requests per origin pod.
	// When unset, the racer-object default applies.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65536
	// +optional
	MaxConcurrentRequests *int32 `json:"maxConcurrentRequests,omitempty"`

	// Azure reads one Azure Blob Storage container.
	// +optional
	Azure *AzureOrigin `json:"azure,omitempty"`
}

type SecretReference struct {
	// Name of the Secret. It must be a DNS-1123 subdomain.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	Name string `json:"name"`
}