v1alpha3

type AgentDownloadsSpec struct {
	// Kubernetes overrides the download source for kubelet/kubectl/kube-proxy
	// (upstream default: https://dl.k8s.io).
	// +optional
	Kubernetes *DownloadSource `json:"kubernetes,omitempty"`

	// Containerd overrides the download source for containerd
	// (upstream default: https://github.com/containerd/containerd).
	// +optional
	Containerd *DownloadSource `json:"containerd,omitempty"`

	// Runc overrides the download source for runc
	// (upstream default: https://github.com/opencontainers/runc).
	// +optional
	Runc *DownloadSource `json:"runc,omitempty"`

	// CNI overrides the download source for CNI plugins
	// (upstream default: https://github.com/containernetworking/plugins).
	// +optional
	CNI *DownloadSource `json:"cni,omitempty"`

	// Crictl overrides the download source for crictl
	// (upstream default: https://github.com/kubernetes-sigs/cri-tools).
	// +optional
	Crictl *DownloadSource `json:"crictl,omitempty"`

	// CoreDNS overrides the download source for CoreDNS.
	// +optional
	CoreDNS *DownloadSource `json:"coreDNS,omitempty"`
}

type AgentSpec struct {
	// Image is the OCI image reference used for provisioning the
	// nspawn machine (e.g. "ghcr.io/org/repo:tag"). When empty the
	// agent falls back to its built-in default image.
	// +optional
	Image string `json:"image,omitempty"`

	// Version pins the unbounded-agent release tag that is downloaded
	// onto the host (e.g. "v0.0.10"). When empty the install script
	// tracks the latest published release.
	// +optional
	Version string `json:"version,omitempty"`

	// BaseURL overrides the base URL used to construct the
	// unbounded-agent download URL. Defaults to the upstream GitHub
	// releases URL. The layout under BaseURL must match the GitHub
	// releases layout (<base>/latest/download/<asset> and
	// <base>/download/<tag>/<asset>).
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// URL is a fully qualified download URL for the unbounded-agent
	// tarball. When set it overrides Version and BaseURL entirely.
	// +optional
	URL string `json:"url,omitempty"`

	// Downloads overrides the download sources for the binaries the
	// agent installs into the nspawn rootfs (kubelet, containerd, runc,
	// CNI plugins, crictl). When unset the agent downloads each
	// artifact from its upstream default host.
	// +optional
	Downloads *AgentDownloadsSpec `json:"downloads,omitempty"`

	// LocalDNS configures the optional CoreDNS cache inside the nspawn machine.
	// +optional
	LocalDNS *LocalDNSSpec `json:"localDNS,omitempty"`
}

type AgentStatus struct {
	// Image is the OCI image reference that was applied to the
	// nspawn machine.
	Image string `json:"image,omitempty"`
}

type AzureHostSpec struct {
	// ResourceID is the full Azure Resource Manager ID of the virtual machine.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ResourceID string `json:"resourceID"`
}

type BastionSSHSpec struct {
	// Host is the hostname or IP address of the bastion, optionally
	// including the port (e.g. "1.2.3.4:2222"). When the port is
	// omitted, 22 is assumed.
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Username is the SSH username for the bastion.
	// +kubebuilder:default=azureuser
	Username string `json:"username,omitempty"`

	// PrivateKeyRef references a secret containing the SSH private key
	// for the bastion. If not specified, uses the same key as the
	// parent SSHSpec.
	// +optional
	PrivateKeyRef *SecretKeySelector `json:"privateKeyRef,omitempty"`
}

type BootstrapStatus struct {
	// CredentialID is the ID of the most recent bootstrap ServiceAccount
	// token issued for this Machine, in the form the API server reports in
	// the authentication.kubernetes.io/credential-id user extra
	// (for example "JTI=<uuid>"). Kubelet client certificate requests made
	// with the token are approved only for NodeName.
	// +optional
	CredentialID string `json:"credentialID,omitempty"`

	// NodeName is the Kubernetes Node name the credential was issued for.
	// It is the name written into the agent config served to the host, so
	// later spec.kubernetes.nodeRef edits do not change which node the
	// credential may claim.
	// +optional
	NodeName string `json:"nodeName,omitempty"`

	// IssuedAt is when the credential was issued.
	// +optional
	IssuedAt *metav1.Time `json:"issuedAt,omitempty"`
}

type CloudInitSpec struct {
	// UserDataConfigMapRef references a ConfigMap containing custom
	// cloud-init user-data. The referenced key (default "user-data")
	// must contain a valid cloud-init configuration (e.g. a
	// #cloud-config YAML document).
	// +optional
	UserDataConfigMapRef *ConfigMapKeySelector `json:"userDataConfigMapRef,omitempty"`
}

type ConfigMapKeySelector struct {
	// Name of the ConfigMap.
	Name string `json:"name"`

	// Namespace of the ConfigMap.
	Namespace string `json:"namespace"`

	// Key within the ConfigMap.
	// +kubebuilder:default=user-data
	Key string `json:"key,omitempty"`
}

type DHCPLease struct {
	// IPv4 is the IP address to assign.
	IPv4 string `json:"ipv4"`

	// MAC is the MAC address of the network interface.
	MAC string `json:"mac"`

	// SubnetMask is the subnet mask for the lease.
	SubnetMask string `json:"subnetMask"`

	// Gateway is the default gateway.
	Gateway string `json:"gateway"`

	// DNS is a list of DNS server addresses.
	// +optional
	DNS []string `json:"dns,omitempty"`
}

type DownloadSource struct {
	// BaseURL replaces the upstream host + path prefix used to
	// construct the download URL. Version and arch substitution are
	// preserved so mirrors need to publish assets under the same
	// layout as the upstream project.
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// URL is a fully qualified download URL template. Version/arch
	// substitution via fmt directives is preserved. When set it
	// overrides BaseURL entirely.
	// +optional
	URL string `json:"url,omitempty"`

	// Version overrides the version of the artifact that would
	// otherwise be derived from the cluster Kubernetes version or the
	// agent's compiled-in defaults.
	// +optional
	Version string `json:"version,omitempty"`
}

type ExternalHostSpec struct {
	// Provider selects the registered provider controller and its credentials.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider"`

	// ProviderID is an opaque provider-specific host identifier. Providers that
	// replace the underlying resource may update it after a successful handoff.
	// +optional
	ProviderID string `json:"providerID,omitempty"`

	// MachineRef identifies an optional provider-owned resource containing rich
	// provider-specific state for this Machine.
	// +optional
	MachineRef *ProviderMachineReference `json:"machineRef,omitempty"`
}

type GantryComponentSpec struct {
	SiteComponentSpec `json:",inline"`
}

type HostSpec struct {
	// Image is an opaque provider-interpreted image identifier. If omitted,
	// HostReplace preserves the host's current image.
	// +optional
	Image string `json:"image,omitempty"`

	// ProvisioningFormat declares the first-boot format for the desired host
	// image. When preserving an image, omission falls back to the installed
	// observation, then CloudInit for legacy hosts. Image identifiers are opaque;
	// an explicit replacement image on a known Ignition host requires a format.
	// +optional
	ProvisioningFormat ProvisioningFormat `json:"provisioningFormat,omitempty"`

	// Netboot contains the machine-specific network boot configuration owned by
	// Metalman.
	// +optional
	Netboot *PXESpec `json:"netboot,omitempty"`

	// Azure identifies an Azure VM managed by the built-in Azure provider.
	// +optional
	Azure *AzureHostSpec `json:"azure,omitempty"`

	// External identifies a host managed by a registered external provider.
	// +optional
	External *ExternalHostSpec `json:"external,omitempty"`
}

type KubernetesSpec struct {
	// Version is the Kubernetes version to install (e.g., "v1.34.0").
	// When omitted the controller falls back to the cluster's
	// Kubernetes version.
	// +optional
	Version string `json:"version,omitempty"`

	// NodeRef references the Node that corresponds to this Machine.
	// +optional
	NodeRef *LocalObjectReference `json:"nodeRef,omitempty"`

	// NodeLabels are labels passed to kubelet's --node-labels flag.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`

	// RegisterWithTaints are taints passed to kubelet's --register-with-taints flag.
	// Each entry uses the standard Kubernetes taint format: key=value:Effect.
	// +optional
	RegisterWithTaints []string `json:"registerWithTaints,omitempty"`

	// BootstrapTokenRef references a bootstrap token Secret in
	// kube-system. The secret must be of type
	// bootstrap.kubernetes.io/token with the well-known keys
	// "token-id" and "token-secret".
	// +optional
	BootstrapTokenRef *LocalObjectReference `json:"bootstrapTokenRef,omitempty"`
}

type LocalDNSSpec struct {
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// +optional
	NodeListenerIP string `json:"nodeListenerIP,omitempty"`
	// +optional
	ClusterListenerIP string `json:"clusterListenerIP,omitempty"`
	// +optional
	MetricsAddress string `json:"metricsAddress,omitempty"`
	// +optional
	CPULimitInMilliCores *int32 `json:"cpuLimitInMilliCores,omitempty"`
	// +optional
	MemoryLimitInMB *int32 `json:"memoryLimitInMB,omitempty"`
	// +optional
	RequiredPlugins []string `json:"requiredPlugins,omitempty"`
	// +optional
	CorefileTemplate string `json:"corefileTemplate,omitempty"`
}

type LocalObjectReference struct {
	// Name of the referenced resource.
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type MachinaComponentSpec struct {
	SiteComponentSpec `json:",inline"`
}

type Machine struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineSpec   `json:"spec,omitempty"`
	Status MachineStatus `json:"status,omitempty"`
}

type MachineConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineConfigurationSpec   `json:"spec,omitempty"`
	Status MachineConfigurationStatus `json:"status,omitempty"`
}

type MachineConfigurationAgent struct {
	// Image is the OCI image reference used for provisioning the
	// nspawn machine (e.g. "ghcr.io/org/repo:tag").
	// +kubebuilder:validation:Required
	Image string `json:"image"`

	// LocalDNS configures the optional CoreDNS cache for this version.
	// +optional
	LocalDNS *LocalDNSSpec `json:"localDNS,omitempty"`
}

type MachineConfigurationHostSpec struct {
	// ProvisioningFormat declares the first-boot payload understood by Image.
	// +optional
	ProvisioningFormat ProvisioningFormat `json:"provisioningFormat,omitempty"`
	// Image is an opaque provider-interpreted image identifier.
	// +optional
	Image string `json:"image,omitempty"`
}

type MachineConfigurationKubernetes struct {
	// Version is the Kubernetes version to install (e.g. "v1.34.0").
	// +optional
	Version string `json:"version,omitempty"`

	// NodeLabels are labels passed to kubelet's --node-labels flag.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`

	// RegisterWithTaints are taints passed to kubelet's
	// --register-with-taints flag.
	// +optional
	RegisterWithTaints []corev1.Taint `json:"registerWithTaints,omitempty"`
}

type MachineConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineConfiguration `json:"items"`
}

type MachineConfigurationRef struct {
	// Name is the name of the MachineConfiguration.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Version is the specific MachineConfigurationVersion number to
	// use. If omitted, the controller selects the latest locked
	// (deployed) version and populates this field.
	// +optional
	Version *int32 `json:"version,omitempty"`
}

type MachineConfigurationRefStatus struct {
	// Name is the MachineConfiguration name.
	Name string `json:"name,omitempty"`

	// Version is the MachineConfigurationVersion number that was applied.
	Version int32 `json:"version,omitempty"`

	// VersionName is the full MachineConfigurationVersion object name
	// (e.g. "myconfig-v3").
	VersionName string `json:"versionName,omitempty"`
}

type MachineConfigurationSpec struct {
	// Template contains the configuration fields that are versioned
	// into MachineConfigurationVersion objects.
	// +kubebuilder:validation:Required
	Template MachineConfigurationTemplate `json:"template"`

	// MachineSelector selects machines that should automatically
	// receive this configuration. If set, new machines matching the
	// selector will be assigned the latest locked version of the
	// highest priority configuration that matches.
	// +optional
	MachineSelector *metav1.LabelSelector `json:"machineSelector,omitempty"`

	// Priority determines which configuration is selected when multiple
	// configurations match a machine's labels. Higher values take
	// precedence. When two configurations have the same priority,
	// lexicographic ordering of names is used as a tiebreaker.
	// +optional
	// +kubebuilder:default=0
	Priority int32 `json:"priority,omitempty"`

	// UpdateStrategy controls how configuration changes are rolled out
	// to machines that reference this configuration.
	// +optional
	UpdateStrategy MachineConfigurationUpdateStrategy `json:"updateStrategy,omitempty"`

	// RevisionHistoryLimit is the number of old
	// MachineConfigurationVersions to retain for rollback. Versions
	// that are still referenced by a Machine are never deleted
	// regardless of this limit, so the actual number of retained
	// versions may exceed this value.
	// +optional
	// +kubebuilder:default=10
	// +kubebuilder:validation:Minimum=0
	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty"`
}

type MachineConfigurationStatus struct {
	// LatestVersion is the highest version number that has been
	// created for this MachineConfiguration. The controller uses this
	// to avoid reusing version numbers when versions are deleted.
	LatestVersion int32 `json:"latestVersion,omitempty"`

	// CurrentVersion is the version number of the latest non-deployed
	// (editable) MachineConfigurationVersion. If all versions are
	// deployed, this is 0.
	CurrentVersion int32 `json:"currentVersion,omitempty"`

	// Conditions represent the latest available observations of the
	// MachineConfiguration's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineConfigurationTemplate struct {
	// Host contains provider-neutral desired host settings.
	// +optional
	Host *MachineConfigurationHostSpec `json:"host,omitempty"`

	// Kubernetes contains Kubernetes-specific configuration such as
	// the target version, node labels, and taints.
	// +optional
	Kubernetes *MachineConfigurationKubernetes `json:"kubernetes,omitempty"`

	// Agent contains settings for the unbounded node agent (e.g. the
	// OCI image reference for the nspawn machine).
	// +optional
	Agent *MachineConfigurationAgent `json:"agent,omitempty"`
}

type MachineConfigurationUpdateStrategy struct {
	// Type is the update strategy type.
	// +kubebuilder:default=OnDelete
	Type MachineConfigurationUpdateStrategyType `json:"type,omitempty"`

	// MaxUnavailable is the maximum number of machines that can be
	// unavailable during a RollingUpdate. Only used when Type is
	// RollingUpdate. Can be an absolute number or a percentage.
	// +optional
	MaxUnavailable *int32 `json:"maxUnavailable,omitempty"`
}

type MachineConfigurationUpdateStrategyType string

type MachineConfigurationVersion struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineConfigurationVersionSpec   `json:"spec,omitempty"`
	Status MachineConfigurationVersionStatus `json:"status,omitempty"`
}

type MachineConfigurationVersionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineConfigurationVersion `json:"items"`
}

type MachineConfigurationVersionSpec struct {
	// Version is the monotonically increasing version number within
	// the parent MachineConfiguration.
	// +kubebuilder:validation:Minimum=1
	Version int32 `json:"version"`

	// Template is the configuration snapshot copied from the parent
	// MachineConfiguration at the time this version was created or
	// last updated (while still editable).
	Template MachineConfigurationTemplate `json:"template"`
}

type MachineConfigurationVersionStatus struct {
	// Deployed indicates whether any Machine has been provisioned
	// using this version. Once true, the spec fields are immutable.
	Deployed bool `json:"deployed,omitempty"`

	// DeployedMachines is the count of Machines currently referencing
	// this version.
	DeployedMachines int32 `json:"deployedMachines,omitempty"`

	// Conditions represent the latest available observations.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Machine `json:"items"`
}

type MachineOperation struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineOperationSpec   `json:"spec,omitempty"`
	Status MachineOperationStatus `json:"status,omitempty"`
}

type MachineOperationBootMediaStatus struct {
	ID              string    `json:"id"`
	SourceServer    string    `json:"sourceServer,omitempty"`
	SourceName      string    `json:"sourceName,omitempty"`
	Phase           string    `json:"phase"`
	MachineUID      types.UID `json:"machineUID"`
	Netboot         *PXESpec  `json:"netboot"`
	CertFingerprint string    `json:"certFingerprint,omitempty"`
	ImageWritten    bool      `json:"imageWritten,omitempty"`
	Cleaned         bool      `json:"cleaned,omitempty"`
	// StagedDeleted confirms rack media deletion after safe boot is restored.
	StagedDeleted bool `json:"stagedDeleted,omitempty"`
	// CleanedAt starts the bounded wait for installer reboot handoff.
	CleanedAt *metav1.Time `json:"cleanedAt,omitempty"`
	// RebootRequestedAt is set by the successful installer ready callback.
	RebootRequestedAt *metav1.Time `json:"rebootRequestedAt,omitempty"`
	// Released confirms local media removal after Cleaned revokes serving.
	Released bool `json:"released,omitempty"`
	// Site preserves controller ownership after the Machine is deleted.
	Site string `json:"site,omitempty"`
	// NodeName preserves the expected Node across Machine edits.
	NodeName string `json:"nodeName,omitempty"`
	// PhaseStartedAt bounds active progress without spending retry attempts.
	PhaseStartedAt *metav1.Time `json:"phaseStartedAt,omitempty"`
	// ReadinessStartedAt gives AC recovery one fixed grace window per phase.
	ReadinessStartedAt *metav1.Time `json:"readinessStartedAt,omitempty"`
	// LoaderStartedAt is set when the bootloader on the media first fetches
	// its install config. It proves the host booted the media.
	LoaderStartedAt *metav1.Time `json:"loaderStartedAt,omitempty"`
	// BootAttempts counts power-on attempts used to boot the media.
	BootAttempts int32 `json:"bootAttempts,omitempty"`
	// Abandoned ends ownership after the installer never finished its
	// handoff within the allowed time.
	Abandoned bool `json:"abandoned,omitempty"`
}

type MachineOperationCredential struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec MachineOperationCredentialSpec `json:"spec,omitempty"`
}

type MachineOperationCredentialAuth struct {
	// Mode identifies the credential source.
	// +kubebuilder:validation:Required
	Mode MachineOperationCredentialAuthMode `json:"mode"`

	// SecretRef references provider-specific external plugin configuration. It
	// is required for ExternalPlugin mode.
	// +optional
	SecretRef *NamespacedSecretReference `json:"secretRef,omitempty"`
}

type MachineOperationCredentialAuthMode string

type MachineOperationCredentialList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineOperationCredential `json:"items"`
}

type MachineOperationCredentialSpec struct {
	// SiteName is matched against the Machine site label.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	SiteName string `json:"siteName"`

	// Provider identifies the external control provider this credential applies
	// to.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider"`

	// Auth identifies how the provider should authenticate.
	// +kubebuilder:validation:Required
	Auth MachineOperationCredentialAuth `json:"auth"`
}

type MachineOperationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineOperation `json:"items"`
}

type MachineOperationSpec struct {
	// MachineRef is the name of the Machine CR this operation targets.
	// Either machineRef or machineSelector must be set.
	// +optional
	MachineRef string `json:"machineRef,omitempty"`

	// MachineSelector selects machines by labels. When set, the
	// controller creates individual MachineOperation children for
	// each matched machine. Either machineRef or machineSelector
	// must be set.
	// +optional
	MachineSelector *metav1.LabelSelector `json:"machineSelector,omitempty"`

	// OperationKind is the operation to perform on the target machine.
	// +kubebuilder:validation:Required
	OperationKind OperationKind `json:"operationKind"`

	// Parameters is an optional set of key-value pairs passed to the
	// operation executor. For example, RestartService uses "service" to
	// specify the systemd unit name.
	// TODO: Revisit whether map[string]string is sufficient or if we
	// need a richer type (e.g. runtime.RawExtension for arbitrary
	// JSON, or a typed []OperationParameter struct).
	// +optional
	Parameters map[string]string `json:"parameters,omitempty"`

	// TTLSecondsAfterFinished limits the lifetime of a completed or failed
	// MachineOperation. If set, the agent deletes the MachineOperation
	// this many seconds after it reaches a terminal phase. If unset, the
	// MachineOperation is kept indefinitely.
	// +optional
	// +kubebuilder:validation:Minimum=0
	TTLSecondsAfterFinished *int32 `json:"ttlSecondsAfterFinished,omitempty"`
}

type MachineOperationStatus struct {
	// Phase is the current phase of the operation.
	Phase OperationPhase `json:"phase,omitempty"`

	// Message is a human-readable description of the current state.
	// +optional
	Message string `json:"message,omitempty"`

	// StartedAt is when the agent began executing the operation.
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// CompletedAt is when the operation reached a terminal state
	// (Complete or Failed).
	// +optional
	CompletedAt *metav1.Time `json:"completedAt,omitempty"`

	// ObservedMachineGeneration is the Machine's metadata.generation
	// at the time the agent began executing the operation. Clients
	// can compare this to the current Machine generation to determine
	// whether the operation acted on the expected machine state.
	// +optional
	ObservedMachineGeneration int64 `json:"observedMachineGeneration,omitempty"`

	// Targets records the per-machine execution state for this operation.
	// For single-machine operations this contains one entry. For selector
	// operations, targets are snapshotted when execution begins and remain
	// authoritative even if selector matches change later.
	// +optional
	// +listType=map
	// +listMapKey=machineRef
	Targets []MachineOperationTargetStatus `json:"targets,omitempty"`

	// Conditions represent the latest available observations of the
	// operation's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineOperationTargetInput struct {
	// ProviderRef identifies the exact provider-owned resource referenced by
	// host.external.machineRef when the operation target was initialized.
	// +optional
	ProviderRef *ProviderMachineSnapshot `json:"providerRef,omitempty"`

	// HostImage is the resolved provider-interpreted host image for HostReplace.
	// An empty value instructs the provider to preserve the current image.
	// +optional
	HostImage string `json:"hostImage,omitempty"`

	// ProvisioningFormat is resolved with HostImage from the same configuration
	// version at HostReplace initialization. Retries use this frozen pair rather
	// than reselecting intent from a Machine edited during execution.
	// +optional
	ProvisioningFormat ProvisioningFormat `json:"provisioningFormat,omitempty"`
}

type MachineOperationTargetStatus struct {
	// BootMedia records immutable media ownership and cleanup progress.
	// +optional
	BootMedia *MachineOperationBootMediaStatus `json:"bootMedia,omitempty"`

	// MachineRef is the name of the targeted Machine.
	// +kubebuilder:validation:Required
	MachineRef string `json:"machineRef"`

	// Phase is the current lifecycle phase for this target.
	// +optional
	Phase OperationPhase `json:"phase,omitempty"`

	// Stage is the current operation-specific stage for this target.
	// +optional
	Stage OperationStage `json:"stage,omitempty"`

	// Message is a human-readable description of target progress or failure.
	// +optional
	Message string `json:"message,omitempty"`

	// StartedAt is when execution began for this target.
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// CompletedAt is when this target reached a terminal phase.
	// +optional
	CompletedAt *metav1.Time `json:"completedAt,omitempty"`

	// ObservedGeneration is the target Machine generation acted on.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// BootID is the host kernel boot ID the agent observed before it issued
	// a HostSoftReboot. The agent that starts after the reboot compares it with
	// the current boot ID to decide whether the reboot happened.
	// +optional
	BootID string `json:"bootID,omitempty"`

	// Input is the immutable provider input resolved before execution begins.
	// +optional
	Input *MachineOperationTargetInput `json:"input,omitempty"`

	// Attempts is the number of external action attempts made for this target.
	// Polling expected state changes does not increment this field.
	// +optional
	Attempts int32 `json:"attempts,omitempty"`

	// LastAttemptAt records when the latest external action attempt occurred.
	// +optional
	LastAttemptAt *metav1.Time `json:"lastAttemptAt,omitempty"`

	// ProviderOperation identifies the resumable external operation for this
	// target, when the provider returned one.
	// +optional
	ProviderOperation *ProviderOperationStatus `json:"providerOperation,omitempty"`

	// Conditions represent target-scoped observations for this operation. These
	// conditions are not persisted on the Machine, so BMC capability fallbacks
	// apply only to this MachineOperation target.
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachinePhase string

type MachineSpec struct {
	// SSH contains the SSH connection and credential details for the
	// machine.
	// +optional
	SSH *SSHSpec `json:"ssh,omitempty"`

	// PXE contains legacy PXE boot configuration for the machine. New callers
	// should use Host.Netboot.
	// +optional
	PXE *PXESpec `json:"pxe,omitempty"`

	// Kubernetes contains Kubernetes-specific configuration.
	// +optional
	Kubernetes *KubernetesSpec `json:"kubernetes,omitempty"`

	// Agent contains settings for the unbounded node agent.
	// +optional
	Agent *AgentSpec `json:"agent,omitempty"`

	// Provider identifies the legacy external control provider for this machine.
	// New callers should use Host.External.Provider or Host.Azure.
	// +optional
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider,omitempty"`

	// ProviderID identifies the underlying infrastructure resource for this
	// machine, using a Kubernetes-style provider ID such as
	// azure:///subscriptions/.../virtualMachines/name
	//
	// This is a legacy field. New callers should use Host.External.ProviderID,
	// Host.External.MachineRef, or Host.Azure.ResourceID.
	// +optional
	ProviderID string `json:"providerID,omitempty"`

	// Host contains desired host settings and exactly one optional host owner.
	// New Machines should set one of Netboot, Azure, or External. Image alone
	// may be used with deprecated ownership fields during migration.
	// +optional
	Host *HostSpec `json:"host,omitempty"`

	// ConfigurationRef references a MachineConfiguration (and
	// optionally a specific version) that defines the configuration
	// profile for this machine. If a specific version is set, that
	// version is used at provisioning time; otherwise the latest
	// locked version is used and the version field is set by the
	// controller.
	// +optional
	ConfigurationRef *MachineConfigurationRef `json:"configurationRef,omitempty"`
}

type MachineStatus struct {
	// ObservedProvisioningFormat is the agent's explicit installation observation.
	// It does not override desired replacement image settings.
	// +optional
	ObservedProvisioningFormat ProvisioningFormat `json:"observedProvisioningFormat,omitempty"`
	// Phase is the current phase of the machine. Intended for human
	// consumption; follows the state machine rather than driving it.
	Phase MachinePhase `json:"phase,omitempty"`

	// Message provides additional status information.
	Message string `json:"message,omitempty"`

	// SSH holds observed SSH state.
	// +optional
	SSH *SSHStatus `json:"ssh,omitempty"`

	// Redfish holds observed Redfish state.
	// +optional
	Redfish *RedfishStatus `json:"redfish,omitempty"`

	// TPM holds observed TPM state.
	// +optional
	TPM *TPMStatus `json:"tpm,omitempty"`

	// Bootstrap records the bootstrap credential most recently issued to
	// this Machine by TPM attestation.
	// +optional
	Bootstrap *BootstrapStatus `json:"bootstrap,omitempty"`

	// Agent holds the applied agent settings.
	// +optional
	Agent *AgentStatus `json:"agent,omitempty"`

	// Configuration records the MachineConfigurationVersion that was
	// applied to this machine during the most recent provisioning.
	// +optional
	Configuration *MachineConfigurationRefStatus `json:"configuration,omitempty"`

	// Conditions represent the latest available observations of the
	// machine's state.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MetalmanComponentSpec struct {
	SiteComponentSpec `json:",inline"`

	// DHCPAutoInterface lets Metalman choose the DHCP interface automatically.
	// +optional
	DHCPAutoInterface *bool `json:"dhcpAutoInterface,omitempty"`

	// Replicas is the desired number of Metalman replicas. Defaults to 1 when
	// omitted.
	// +kubebuilder:validation:Minimum=0
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`
}

type NamespacedSecretReference struct {
	// Name of the secret.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace of the secret.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Namespace string `json:"namespace"`
}

type OperationKind string

type OperationPhase string

type OperationStage string

type OverriddenWorkload struct {
	// Kind and Name identify the workload. Name alone is not unique, because a
	// Deployment and a DaemonSet may share one.
	Kind string `json:"kind"`
	Name string `json:"name"`

	// DesiredHash is computed by the operator from the observed ConfigMap.
	// AppliedHash is what the workload actually carries. They match when the
	// override is in effect and differ when it could not be applied.
	// +optional
	DesiredHash string `json:"desiredHash,omitempty"`
	// +optional
	AppliedHash string `json:"appliedHash,omitempty"`

	// VersionDrift is set when an override changed a container image, formatted
	// as `<container>=<image>`. Such a component is no longer version-matched to
	// the operator, and the pin survives operator upgrades, which makes it the
	// likeliest cause of an install behaving unlike its reported version.
	// +optional
	VersionDrift string `json:"versionDrift,omitempty"`

	// State is what happened to this workload's override in the last pass: one
	// of Applied, Pending, Withheld or Failed.
	//
	// The hashes alone cannot express it. A workload the operator declined to
	// write has no applied hash, and neither does one whose write was deferred
	// for a second, and neither does one whose merge failed; reading an empty
	// applied hash as "not applied" reported all three identically, and a
	// withheld workload appeared in status not at all.
	//
	// It may be empty when the operator that wrote this status predates the
	// field, or when a CRD older than the operator pruned it. Consumers should
	// fall back to comparing the hashes.
	// +optional
	State string `json:"state,omitempty"`
}

type OverrideStatus struct {
	// Phase is the aggregate state of override processing for this Site: one of
	// None, Applied or Degraded.
	//
	// Applied means every resolved workload carries the hash that was desired.
	// It reports that the override merged and was written, not that the
	// resulting pods are healthy.
	Phase string `json:"phase"`

	// ObservedResourceVersion is the resourceVersion of the overrides ConfigMap
	// this status was computed from, so a result is traceable to a specific
	// input version. Empty when no overrides ConfigMap exists.
	// +optional
	ObservedResourceVersion string `json:"observedResourceVersion,omitempty"`

	// Workloads carries the desired and applied hash for each overridden
	// workload.
	//
	// Both are per workload because contributors differ per workload: a
	// Site-wide desired hash would not be comparable to any of them whenever a
	// document targets more than one.
	// +optional
	// +listType=map
	// +listMapKey=kind
	// +listMapKey=name
	Workloads []OverriddenWorkload `json:"workloads,omitempty"`

	// Message explains a Degraded phase, naming the ConfigMap key and entry
	// index at fault. Empty otherwise.
	// +optional
	Message string `json:"message,omitempty"`
}

type PXESpec struct {
	// Image is an OCI image reference containing the machine disk image.
	// The image must contain /disk/disk.img.gz.
	// VirtualMedia requires a digest reference (image@sha256:...).
	// Example: "ghcr.io/azure/host-ubuntu2404:v1"
	// +kubebuilder:validation:Required
	Image string `json:"image"`

	// PullSecretRef references a Docker registry credential Secret used to pull
	// Image. The Secret must be type kubernetes.io/dockerconfigjson or
	// kubernetes.io/dockercfg.
	// +optional
	PullSecretRef *NamespacedSecretReference `json:"pullSecretRef,omitempty"`

	// Architecture is the target CPU architecture for PXE boot artifacts and
	// machine images.
	// +kubebuilder:validation:Enum=amd64;arm64
	// +kubebuilder:default=amd64
	// +optional
	Architecture string `json:"architecture,omitempty"`

	// NetbootImage is an OCI image reference containing the PXE boot
	// artifacts used to install Image. When omitted, metalman uses the
	// default netboot image that corresponds to its release.
	// VirtualMedia requires this field to be set to a digest reference
	// (image@sha256:...).
	// +optional
	NetbootImage string `json:"netbootImage,omitempty"`

	// NetbootPullSecretRef references a Docker registry credential Secret used to
	// pull NetbootImage. It is ignored when NetbootImage is omitted; metalman's
	// configured default netboot pull secret is used for the default netboot image.
	// The Secret must be type kubernetes.io/dockerconfigjson or
	// kubernetes.io/dockercfg.
	// +optional
	NetbootPullSecretRef *NamespacedSecretReference `json:"netbootPullSecretRef,omitempty"`

	// BootProtocol selects how metalman should trigger network boot for
	// repaves. PXE uses DHCP/TFTP bootfile options. HTTP uses Redfish UEFI
	// HTTP boot with a URL derived from the netboot image metadata.
	// VirtualMedia mounts an operation-owned bootstrap ISO through Redfish.
	// It requires redfish, a digest Image, and a digest NetbootImage.
	// +kubebuilder:validation:Enum=PXE;HTTP;VirtualMedia
	// +kubebuilder:default=PXE
	// +optional
	BootProtocol string `json:"bootProtocol,omitempty"`

	// DHCPLeases defines static IPv4 provisioning network settings. PXE boot
	// uses them as DHCP leases. HTTP boot uses the first entry to configure the
	// Redfish UEFI HTTP boot client.
	// +optional
	DHCPLeases []DHCPLease `json:"dhcpLeases,omitempty"`

	// TargetDisk is the block device the installer writes the machine image to.
	// Examples: /dev/nvme0n1, /dev/sda, /dev/disk/by-id/...
	// When omitted, the installer chooses a target disk automatically.
	// +optional
	TargetDisk string `json:"targetDisk,omitempty"`

	// Redfish configures optional Redfish BMC access.
	// +optional
	Redfish *RedfishSpec `json:"redfish,omitempty"`

	// CloudInit contains optional cloud-init customization for PXE-booted
	// machines.
	// +optional
	CloudInit *CloudInitSpec `json:"cloudInit,omitempty"`
}

type ProviderMachineReference struct {
	// APIGroup is the API group of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	APIGroup string `json:"apiGroup"`

	// Kind is the kind of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Kind string `json:"kind"`

	// Name is the name of the cluster-scoped provider-owned Machine resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type ProviderMachineSnapshot struct {
	// APIGroup is the API group of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	APIGroup string `json:"apiGroup"`

	// Kind is the kind of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	Kind string `json:"kind"`

	// Name is the name of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// UID detects deletion and recreation of the provider-owned resource.
	// +kubebuilder:validation:Required
	UID types.UID `json:"uid"`

	// Generation records the provider-owned resource generation whose inputs
	// were observed.
	// +kubebuilder:validation:Minimum=1
	Generation int64 `json:"generation"`
}

type ProviderOperationStatus struct {
	// Provider is the external provider that accepted the operation.
	// +kubebuilder:validation:Required
	Provider string `json:"provider"`

	// OperationID is the provider-assigned operation identifier.
	// +kubebuilder:validation:Required
	OperationID string `json:"operationID"`

	// ResumeToken is opaque provider data needed to resume polling. Providers
	// must not store credentials or other secrets in this field.
	// +optional
	ResumeToken string `json:"resumeToken,omitempty"`
}

type ProvisioningFormat string

type RedfishPasswordSelector struct {
	// Name of the secret.
	Name string `json:"name"`

	// Namespace of the secret.
	Namespace string `json:"namespace"`

	// Key within the secret. Defaults to "password".
	// +kubebuilder:default=password
	Key string `json:"key,omitempty"`
}

type RedfishSpec struct {
	// URL is the Redfish endpoint URL. It may include a per-system path prefix,
	// for example https://manager:8080/7. Do not include /redfish/v1.
	// +kubebuilder:validation:Required
	URL string `json:"url"`

	// Username is the Redfish username.
	// +kubebuilder:validation:Required
	Username string `json:"username"`

	// DeviceID is the Redfish system device ID. Defaults to "1".
	// It is ignored when the endpoint exposes a single system selected by its URL.
	// +kubebuilder:default="1"
	DeviceID string `json:"deviceID,omitempty"`

	// PasswordRef references a secret containing the Redfish password. Its key
	// defaults to "password".
	// +kubebuilder:validation:Required
	PasswordRef RedfishPasswordSelector `json:"passwordRef"`
}

type RedfishStatus struct {
	// CertFingerprint is the TLS certificate fingerprint for the
	// Redfish endpoint, pinned on first connection.
	CertFingerprint string `json:"certFingerprint,omitempty"`
}

type SSHSpec struct {
	// Host is the hostname or IP address of the machine, optionally
	// including the port (e.g. "1.2.3.4:2222"). When the port is
	// omitted, 22 is assumed.
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Username is the SSH username.
	// +kubebuilder:default=azureuser
	Username string `json:"username,omitempty"`

	// PrivateKeyRef references a secret containing the SSH private key.
	// +kubebuilder:validation:Required
	PrivateKeyRef SecretKeySelector `json:"privateKeyRef"`

	// Bastion configures an optional SSH jump host (bastion) for proxy
	// connections. Its structure is identical to SSHSpec minus the
	// bastion field itself.
	// +optional
	Bastion *BastionSSHSpec `json:"bastion,omitempty"`
}

type SSHStatus struct {
	// Fingerprint is the SSH host key fingerprint discovered on
	// first connection. Subsequent connections must match this value.
	Fingerprint string `json:"fingerprint,omitempty"`
}

type SecretKeySelector struct {
	// Name of the secret.
	Name string `json:"name"`

	// Namespace of the secret.
	Namespace string `json:"namespace"`

	// Key within the secret.
	// +kubebuilder:default=ssh-privatekey
	Key string `json:"key,omitempty"`
}

type Site struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   SiteSpec   `json:"spec,omitempty"`
	Status SiteStatus `json:"status,omitempty"`
}

type SiteComponentSpec struct {
	// Enabled controls whether the component is reconciled.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`
}

type SiteComponents struct {
	// Machina configures the machina controller for this site.
	// +optional
	Machina *MachinaComponentSpec `json:"machina,omitempty"`

	// Metalman configures the Metalman PXE controller for this site.
	// +optional
	Metalman *MetalmanComponentSpec `json:"metalman,omitempty"`

	// Gantry configures the gantry peer-to-peer OCI distribution agent for this
	// site. Gantry defaults to enabled; set
	// gantry.enabled to false to opt a site out. The apiserver defaults an
	// omitted gantry block to enabled=true so the intent is explicit on read
	// (for example the Gantry print column) whenever a components block is
	// present. A site that omits the components block entirely is not defaulted.
	// +optional
	// +kubebuilder:default={enabled: true}
	Gantry *GantryComponentSpec `json:"gantry,omitempty"`

	// TokenRefresher maintains bootstrap tokens for machines joining this Site.
	// It defaults to enabled and is ignored for the reserved cluster Site.
	// +optional
	// +kubebuilder:default={enabled: true}
	TokenRefresher *TokenRefresherComponentSpec `json:"tokenRefresher,omitempty"`
}

type SiteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Site `json:"items"`
}

type SiteSpec struct {
	// NodeCidrs are the CIDRs that contain the internal IPs of nodes at this site.
	// +kubebuilder:validation:MinItems=1
	NodeCidrs []string `json:"nodeCidrs"`

	// PodCidrAssignments define how pod CIDRs are allocated to nodes in this site.
	// +kubebuilder:validation:MinItems=1
	PodCidrAssignments []unboundednetv1alpha1.PodCidrAssignment `json:"podCidrAssignments"`

	// ManageCniPlugin controls whether the node agent writes CNI configuration
	// and creates tunnel endpoints for same-site nodes. When true (the default),
	// CNI config is written and all same-site nodes are tunnel peers.
	// When false, only tunnel links to gateway pools for other sites are created,
	// allowing an external CNI plugin to manage intra-site networking.
	// Omitted assignmentEnabled values on podCidrAssignments default to this
	// setting. Explicit assignmentEnabled values override that default.
	// The podCidrAssignments are still required to define the CIDR ranges
	// used for inter-site routing, even when assignment is disabled.
	// +optional
	ManageCniPlugin *bool `json:"manageCniPlugin,omitempty"`

	// NonMasqueradeCIDRs are CIDR blocks that should NOT be masqueraded when
	// traffic leaves the node via the default gateway. Traffic to these CIDRs
	// will use the pod's actual IP address.
	// +optional
	NonMasqueradeCIDRs []string `json:"nonMasqueradeCIDRs,omitempty"`

	// LocalCIDRs are CIDR blocks that are considered local to this site.
	// Traffic to these CIDRs should never be routed via gateway pools.
	// +optional
	LocalCIDRs []string `json:"localCidrs,omitempty"`

	// HealthCheckSettings controls health check settings for inter-site tunnel peers.
	// +optional
	HealthCheckSettings *unboundednetv1alpha1.HealthCheckSettings `json:"healthCheckSettings,omitempty"`

	// TunnelProtocol selects the tunnel protocol for this site.
	// Valid values are "WireGuard", "IPIP", "GENEVE", "VXLAN", "None", or "Auto".
	// Defaults to "Auto" when unset.
	// +kubebuilder:validation:Enum=WireGuard;IPIP;GENEVE;VXLAN;None;Auto
	// +optional
	TunnelProtocol *unboundednetv1alpha1.TunnelProtocol `json:"tunnelProtocol,omitempty"`

	// TunnelMTU is the MTU to set on routes through tunnels for this site.
	// +kubebuilder:validation:Minimum=576
	// +kubebuilder:validation:Maximum=9000
	// +optional
	TunnelMTU *int32 `json:"tunnelMTU,omitempty"`

	// Components declares optional Unbounded components managed for this site.
	// +optional
	Components SiteComponents `json:"components,omitempty"`
}

type SiteStatus struct {
	// NodeCount is the number of nodes matched to this site by unbounded-net.
	// +optional
	NodeCount int `json:"nodeCount,omitempty"`

	// SliceCount is the number of SiteNodeSlice objects for this site.
	// +optional
	SliceCount int `json:"sliceCount,omitempty"`

	// Conditions report the last observed state of site components. One
	// condition is published per component (for example NetReady, MachinaReady,
	// MetalmanReady) so callers can `kubectl wait` on a Site.
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Overrides summarizes user-supplied workload overrides affecting this
	// Site. It is absent when no override targets any of the Site's workloads.
	// +optional
	Overrides *OverrideStatus `json:"overrides,omitempty"`
}

type TPMStatus struct {
	// EKPublicKey is the TPM endorsement key public key, written
	// when the PXE boot image requests a bootstrap token.
	EKPublicKey string `json:"ekPublicKey,omitempty"`
}

type TokenRefresherComponentSpec struct {
	SiteComponentSpec `json:",inline"`
}