v1alpha1

type AzureCredential struct {
	// Default uses the node's managed identity through the Azure Instance
	// Metadata Service (IMDS).
	// +optional
	Default *AzureDefaultCredential `json:"default,omitempty"`

	// WorkloadIdentity uses Microsoft Entra Workload ID. The Racer dataplane
	// exchanges a projected token for its own ServiceAccount (audience
	// api://AzureADTokenExchange), so the identity needs a federated
	// credential for the Racer dataplane ServiceAccount. No webhook is needed.
	// +optional
	WorkloadIdentity *AzureWorkloadIdentityCredential `json:"workloadIdentity,omitempty"`
}

type AzureDefaultCredential struct {
	// ClientID selects a user-assigned managed identity. When unset, the
	// system-assigned identity, or the only user-assigned identity, is used.
	// +kubebuilder:validation:Pattern=`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`
	// +optional
	ClientID string `json:"clientID,omitempty"`

	// SecretRef is deprecated and unsupported. The Racer dataplane cannot
	// read Secret credentials, so a cache that sets it is rejected. It stays
	// in the schema only so that stored caches which still set it are not
	// pruned into a managed identity credential and instead fail closed.
	// +optional
	SecretRef *SecretReference `json:"secretRef,omitempty"`
}

type AzureOrigin struct {
	// ContainerURL is the blob container URL, for example
	// https://account.blob.core.windows.net/models. The last path segment is
	// the container name. Azurite-style URLs may carry one account path
	// segment before it, for example http://127.0.0.1:10000/account/models.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=320
	// +kubebuilder:validation:XValidation:rule="isURL(self) && url(self).getScheme() in ['http', 'https']",message="containerURL must be an http or https URL"
	// +kubebuilder:validation:XValidation:rule="!self.contains('?') && !self.contains('#') && !self.contains('@')",message="containerURL must not contain credentials, a query, or a fragment"
	// +kubebuilder:validation:XValidation:rule="self.matches('^https?://[]A-Za-z0-9.:[-]+(/[A-Za-z0-9_-]+)?/[a-z0-9]+(-[a-z0-9]+)*$') && self.substring(self.lastIndexOf('/') + 1).size() >= 3 && self.substring(self.lastIndexOf('/') + 1).size() <= 63",message="containerURL must be an account URL followed by one valid container name, such as https://account.blob.core.windows.net/models"
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="containerURL is immutable; create a new ClusterCache for a different container"
	ContainerURL string `json:"containerURL"`

	// Credential selects how the Racer dataplane authenticates. When omitted,
	// requests are anonymous.
	// +optional
	Credential *AzureCredential `json:"credential,omitempty"`
}

type AzureWorkloadIdentityCredential struct {
	// ClientID is the client ID of the federated identity.
	// +kubebuilder:validation:Pattern=`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`
	ClientID string `json:"clientID"`

	// TenantID is the identity's Microsoft Entra tenant. When unset, it is
	// discovered from the storage account's bearer challenge.
	// +kubebuilder:validation:Pattern=`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`
	// +optional
	TenantID string `json:"tenantID,omitempty"`
}

type ClusterCache struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec configures optional cache features.
	// +optional
	Spec ClusterCacheSpec `json:"spec,omitempty,omitzero"`
}

type ClusterCacheList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterCache `json:"items"`
}

type ClusterCacheSpec struct {
	// Origin makes the Racer dataplane read this cache's objects directly from
	// object storage, with no separate origin process. Origin can be set only
	// at creation and cannot be removed later; leave it unset to deploy your
	// own origin.
	// +optional
	Origin *ObjectOrigin `json:"origin,omitempty"`

	// Priority is the relative weight used to share node cache capacity among
	// ClusterCaches. Disk shares are weighted across published caches, plus any
	// unpublished caches that still hold data on the node, which count at the
	// default weight. Memory shares are weighted across caches that are
	// actively using memory, and each cache also gets a bounded working
	// allowance from shared memory. Eviction prefers data from caches that use
	// more than their share, within bounded scans. A priority of 0 gets no
	// weighted share while caches with positive priority compete, but it keeps
	// its working allowance. If every counted cache has priority 0, they share
	// equally. When unset, the priority is 500. Priority may be changed at any
	// time.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=1000
	// +optional
	Priority *int32 `json:"priority,omitempty"`

	// Passthrough, when set, turns off caching for this cache: Racer proxies
	// reads to the origin and keeps no data. Pages are not written to disk and
	// are held in memory only while concurrent readers share an in-flight
	// origin read. Object metadata (ETag, size, expiry) is not reused across
	// reads, so each read revalidates with the origin; one read still pins one
	// object version for all of its pages. Prefetch requests are rejected with
	// 409 passthrough. Priority still weights in-flight memory use. Passthrough may be
	// added, changed, or removed at any time; when a cache switches to
	// passthrough, data previously cached for it is dropped.
	// +optional
	Passthrough *Passthrough `json:"passthrough,omitempty"`

	// NodeSelector selects, by Node labels, the Racer nodes that store, serve,
	// and read this cache. When unset or empty, every Racer node does.
	// Changing it moves the cache to a new pool of nodes with no migration:
	// pages are refilled from the origin. The Racer admission webhook
	// restricts client pods that use this cache to matching nodes.
	// +optional
	NodeSelector *metav1.LabelSelector `json:"nodeSelector,omitempty"`
}

type ObjectOrigin struct {
	// MetadataTTL bounds how long object metadata is reused before it is revalidated.
	// It must not be negative. When unset, 30s.
	// +kubebuilder:validation:XValidation:rule="duration(self) >= duration('0s')",message="metadataTTL must not be negative"
	// +optional
	MetadataTTL *metav1.Duration `json:"metadataTTL,omitempty"`

	// RequestTimeout bounds each upstream request. It must be positive.
	// When unset, 1m.
	// +kubebuilder:validation:XValidation:rule="duration(self) > duration('0s')",message="requestTimeout must be positive"
	// +optional
	RequestTimeout *metav1.Duration `json:"requestTimeout,omitempty"`

	// MaxConcurrentRequests bounds concurrent upstream requests for this cache
	// on each dataplane node. When unset, 512.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65536
	// +optional
	MaxConcurrentRequests *int32 `json:"maxConcurrentRequests,omitempty"`

	// Azure reads one Azure Blob Storage container.
	// +optional
	Azure *AzureOrigin `json:"azure,omitempty"`
}

type Passthrough struct {
	// Route selects which node's origin serves a read. Peers routes pages to
	// their owner nodes and shares origin reads cluster-wide. Local reads from
	// the reading node's own origin, so every reading node needs an origin
	// (spec.origin is served by every dataplane node). When unset, Peers.
	// +kubebuilder:default=Peers
	// +optional
	Route PassthroughRoute `json:"route,omitempty"`
}

type PassthroughRoute string

type SecretReference struct {
	// Name of the Secret.
	// +optional
	Name string `json:"name,omitempty"`
}