v1alpha3

type AgentArtifact struct {
	// URL is the agent tarball location: an https URL whose host is a DNS name
	// or dotted IPv4 address with an optional port from 1 to 65535, or a local
	// file:/// path. It must not embed credentials, a query, or a fragment.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=2048
	// +kubebuilder:validation:Pattern=`^(https://[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*(:(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3}))?|file://)(/[A-Za-z0-9._~%+=,:-]+)+$`
	URL string `json:"url"`

	// SHA256 is the lowercase hex SHA-256 digest of the tarball.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
	SHA256 string `json:"sha256"`
}

type AgentDownloadsSpec struct {
	// Kubernetes overrides the download source for kubelet/kubectl/kube-proxy
	// (upstream default: https://dl.k8s.io).
	// +optional
	Kubernetes *DownloadSource `json:"kubernetes,omitempty"`

	// Containerd overrides the download source for containerd
	// (upstream default: https://github.com/containerd/containerd).
	// +optional
	Containerd *DownloadSource `json:"containerd,omitempty"`

	// Runc overrides the download source for runc
	// (upstream default: https://github.com/opencontainers/runc).
	// +optional
	Runc *DownloadSource `json:"runc,omitempty"`

	// CNI overrides the download source for CNI plugins
	// (upstream default: https://github.com/containernetworking/plugins).
	// +optional
	CNI *DownloadSource `json:"cni,omitempty"`

	// Crictl overrides the download source for crictl
	// (upstream default: https://github.com/kubernetes-sigs/cri-tools).
	// +optional
	Crictl *DownloadSource `json:"crictl,omitempty"`

	// CoreDNS overrides the download source for CoreDNS.
	// +optional
	CoreDNS *DownloadSource `json:"coreDNS,omitempty"`
}

type AgentSpec struct {
	// Image is the OCI image reference used for provisioning the
	// nspawn machine (e.g. "ghcr.io/org/repo:tag"). When empty the
	// agent falls back to its built-in default image.
	// +optional
	Image string `json:"image,omitempty"`

	// Version pins the unbounded-agent release tag that is downloaded
	// onto the host (e.g. "v0.0.10"). When empty the install script
	// tracks the latest published release.
	// +optional
	Version string `json:"version,omitempty"`

	// BaseURL overrides the base URL used to construct the
	// unbounded-agent download URL. Defaults to the upstream GitHub
	// releases URL. The layout under BaseURL must match the GitHub
	// releases layout (<base>/latest/download/<asset> and
	// <base>/download/<tag>/<asset>).
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// URL is a fully qualified download URL for the unbounded-agent
	// tarball. When set it overrides Version and BaseURL entirely.
	// +optional
	URL string `json:"url,omitempty"`

	// Downloads overrides the download sources for the binaries the
	// agent installs into the nspawn rootfs (kubelet, containerd, runc,
	// CNI plugins, crictl). When unset the agent downloads each
	// artifact from its upstream default host.
	// +optional
	Downloads *AgentDownloadsSpec `json:"downloads,omitempty"`

	// LocalDNS configures the optional CoreDNS cache inside the nspawn machine.
	// +optional
	LocalDNS *LocalDNSSpec `json:"localDNS,omitempty"`
}

type AgentStatus struct {
	// Image is the OCI image reference that was applied to the
	// nspawn machine.
	Image string `json:"image,omitempty"`
}

type AzureHostSpec struct {
	// ResourceID is the full Azure Resource Manager ID of the virtual machine.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ResourceID string `json:"resourceID"`
}

type BastionSSHSpec struct {
	// Host is the hostname or IP address of the bastion, optionally
	// including the port (e.g. "1.2.3.4:2222"). When the port is
	// omitted, 22 is assumed.
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Username is the SSH username for the bastion.
	// +kubebuilder:default=azureuser
	Username string `json:"username,omitempty"`

	// PrivateKeyRef references a secret containing the SSH private key
	// for the bastion. If not specified, uses the same key as the
	// parent SSHSpec.
	// +optional
	PrivateKeyRef *SecretKeySelector `json:"privateKeyRef,omitempty"`
}

type BondSpec struct {
	// Name is the bond interface name, for example bond0.
	// +kubebuilder:validation:MaxLength=15
	// +kubebuilder:validation:Pattern=`^[a-zA-Z][a-zA-Z0-9_-]{0,14}$`
	Name string `json:"name"`

	// Interfaces lists the names of the ethernets aggregated by this bond.
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=8
	// +kubebuilder:validation:items:MaxLength=15
	Interfaces []string `json:"interfaces"`

	// Mode is the bonding mode.
	// +kubebuilder:validation:Enum="802.3ad";active-backup;balance-xor
	// +kubebuilder:default="802.3ad"
	// +optional
	Mode string `json:"mode,omitempty"`

	// MIIMonitorInterval is the link monitoring interval in milliseconds.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=10000
	// +kubebuilder:default=100
	// +optional
	MIIMonitorInterval *int32 `json:"miiMonitorInterval,omitempty"`

	// TransmitHashPolicy selects the member used to transmit each flow in
	// 802.3ad and balance-xor modes.
	// +kubebuilder:validation:Enum=layer2;layer2+3;layer3+4;encap2+3;encap3+4
	// +optional
	TransmitHashPolicy string `json:"transmitHashPolicy,omitempty"`

	// LACPRate is the LACPDU transmit rate requested from the link partner in
	// 802.3ad mode.
	// +kubebuilder:validation:Enum=slow;fast
	// +optional
	LACPRate string `json:"lacpRate,omitempty"`

	InterfaceAddressing `json:",inline"`
}

type BootstrapStatus struct {
	// CredentialID is the ID of the most recent bootstrap ServiceAccount
	// token issued for this Machine, in the form the API server reports in
	// the authentication.kubernetes.io/credential-id user extra
	// (for example "JTI=<uuid>"). Kubelet client certificate requests made
	// with the token are approved only for NodeName.
	// +optional
	CredentialID string `json:"credentialID,omitempty"`

	// NodeName is the Kubernetes Node name the credential was issued for.
	// It is the name written into the agent config served to the host, so
	// later spec.kubernetes.nodeRef edits do not change which node the
	// credential may claim.
	// +optional
	NodeName string `json:"nodeName,omitempty"`

	// IssuedAt is when the credential was issued.
	// +optional
	IssuedAt *metav1.Time `json:"issuedAt,omitempty"`
}

type CapacityType string

type CloudInitSpec struct {
	// UserDataConfigMapRef references a ConfigMap containing custom
	// cloud-init user-data. The referenced key (default "user-data")
	// must contain a valid cloud-init configuration (e.g. a
	// #cloud-config YAML document).
	// +optional
	UserDataConfigMapRef *ConfigMapKeySelector `json:"userDataConfigMapRef,omitempty"`
}

type ConfigMapKeySelector struct {
	// Name of the ConfigMap.
	Name string `json:"name"`

	// Namespace of the ConfigMap.
	Namespace string `json:"namespace"`

	// Key within the ConfigMap.
	// +kubebuilder:default=user-data
	Key string `json:"key,omitempty"`
}

type ConfigurationContentSnapshot struct {
	// Name is the MachineConfiguration name.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Version is the MachineConfiguration version.
	// +kubebuilder:validation:Required
	Version int32 `json:"version"`

	// VersionName is the MachineConfigurationVersion object name.
	// +kubebuilder:validation:Required
	VersionName string `json:"versionName"`

	// UID is the MachineConfigurationVersion UID.
	// +kubebuilder:validation:Required
	UID types.UID `json:"uid"`

	// Hash is the SHA-256 of the configuration template.
	// +kubebuilder:validation:Required
	Hash string `json:"hash"`
}

type DHCPLease struct {
	// IPv4 is the IP address to assign.
	IPv4 string `json:"ipv4"`

	// MAC is the MAC address of the network interface.
	MAC string `json:"mac"`

	// SubnetMask is the subnet mask for the lease.
	SubnetMask string `json:"subnetMask"`

	// Gateway is the default gateway.
	Gateway string `json:"gateway"`

	// DNS is a list of DNS server addresses.
	// +optional
	DNS []string `json:"dns,omitempty"`

	// HoldLease, when true, makes the installed host also run a DHCPv4
	// client on this lease's NIC so the site DHCP server keeps the lease
	// for IPv4 and does not reassign it to another host. The static
	// address, gateway, and DNS remain authoritative; routes, DNS, NTP,
	// hostname, and domains from DHCP are ignored. The site DHCP server
	// should reserve IPv4 for MAC. Leave unset where there is no DHCP
	// server.
	// +optional
	HoldLease bool `json:"holdLease,omitempty"`
}

type DownloadSource struct {
	// BaseURL replaces the upstream host + path prefix used to
	// construct the download URL. Version and arch substitution are
	// preserved so mirrors need to publish assets under the same
	// layout as the upstream project.
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// URL is a fully qualified download URL template. Version/arch
	// substitution via fmt directives is preserved. When set it
	// overrides BaseURL entirely.
	// +optional
	URL string `json:"url,omitempty"`

	// Version overrides the version of the artifact that would
	// otherwise be derived from the cluster Kubernetes version or the
	// agent's compiled-in defaults.
	// +optional
	Version string `json:"version,omitempty"`
}

type EthernetSpec struct {
	// Name is the interface name persisted on the installed host, for example
	// enp1s0f0. Metalman matches the device by MACAddress and does not rely
	// on the kernel's naming during installation.
	// +kubebuilder:validation:MaxLength=15
	// +kubebuilder:validation:Pattern=`^[a-zA-Z][a-zA-Z0-9_-]{0,14}$`
	Name string `json:"name"`

	// MACAddress is the permanent MAC address of the physical interface, as
	// lowercase colon-separated hex (aa:bb:cc:dd:ee:ff).
	// +kubebuilder:validation:Pattern=`^([0-9a-f]{2}:){5}[0-9a-f]{2}$`
	MACAddress string `json:"macAddress"`

	InterfaceAddressing `json:",inline"`
}

type ExternalHostSpec struct {
	// Provider selects the registered provider controller and its credentials.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider"`

	// ProviderID is an opaque provider-specific host identifier. Providers that
	// replace the underlying resource may update it after a successful handoff.
	// +optional
	ProviderID string `json:"providerID,omitempty"`

	// MachineRef identifies an optional provider-owned resource containing rich
	// provider-specific state for this Machine.
	// +optional
	MachineRef *ProviderMachineReference `json:"machineRef,omitempty"`
}

type GantryArtifactStreamingSpec struct {
	// Enabled controls the Gantry range endpoint and OverlayBD configurator.
	// +optional
	Enabled bool `json:"enabled,omitempty"`

	// NodeSelector must select only AKS node pools with Artifact Streaming
	// enabled. It is required when Enabled is true.
	// +kubebuilder:validation:MinProperties=1
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
}

type GantryComponentSpec struct {
	SiteComponentSpec `json:",inline"`

	// ArtifactStreaming configures Gantry as the node-local range proxy for
	// AKS ACR Artifact Streaming. It is disabled when omitted. Because Gantry is
	// a cluster singleton, every Site that enables it must use the same node
	// selector.
	// +optional
	ArtifactStreaming *GantryArtifactStreamingSpec `json:"artifactStreaming,omitempty"`
}

type HostNetworkSpec struct {
	// Ethernets declares the physical network interfaces, matched by their
	// permanent MAC addresses.
	// +listType=map
	// +listMapKey=name
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=16
	Ethernets []EthernetSpec `json:"ethernets"`

	// Bonds declares link aggregation interfaces built from ethernets.
	// +listType=map
	// +listMapKey=name
	// +kubebuilder:validation:MaxItems=8
	// +optional
	Bonds []BondSpec `json:"bonds,omitempty"`

	// VLANs declares 802.1Q VLAN interfaces on top of ethernets or bonds.
	// +listType=map
	// +listMapKey=name
	// +kubebuilder:validation:MaxItems=32
	// +optional
	VLANs []VLANSpec `json:"vlans,omitempty"`

	// DNS is the list of IPv4 nameserver addresses for the host.
	// +kubebuilder:validation:MaxItems=3
	// +kubebuilder:validation:items:MaxLength=15
	// +optional
	DNS []string `json:"dns,omitempty"`
}

type HostSpec struct {
	// Image is an opaque provider-interpreted image identifier. If omitted,
	// HostReplace preserves the host's current image.
	// +optional
	Image string `json:"image,omitempty"`

	// ProvisioningFormat declares the first-boot format for the desired host
	// image. When preserving an image, omission falls back to the installed
	// observation, then CloudInit for legacy hosts. Image identifiers are opaque;
	// an explicit replacement image on a known Ignition host requires a format.
	// +optional
	ProvisioningFormat ProvisioningFormat `json:"provisioningFormat,omitempty"`

	// Netboot contains the machine-specific network boot configuration owned by
	// Metalman.
	// +optional
	Netboot *PXESpec `json:"netboot,omitempty"`

	// Azure identifies an Azure VM managed by the built-in Azure provider.
	// +optional
	Azure *AzureHostSpec `json:"azure,omitempty"`

	// External identifies a host managed by a registered external provider.
	// +optional
	External *ExternalHostSpec `json:"external,omitempty"`
}

type InterfaceAddressing struct {
	// MTU is the interface MTU in bytes. When omitted, the kernel default is
	// used.
	// +kubebuilder:validation:Minimum=576
	// +kubebuilder:validation:Maximum=9216
	// +optional
	MTU *int32 `json:"mtu,omitempty"`

	// Addresses lists static IPv4 addresses in CIDR notation, for example
	// 192.0.2.10/24.
	// +kubebuilder:validation:MaxItems=8
	// +kubebuilder:validation:items:MaxLength=18
	// +optional
	Addresses []string `json:"addresses,omitempty"`

	// Gateway is the IPv4 default gateway reachable through this interface.
	// At most one interface in the host network may set it.
	// +kubebuilder:validation:MaxLength=15
	// +optional
	Gateway string `json:"gateway,omitempty"`

	// Routes lists static IPv4 routes through this interface.
	// +kubebuilder:validation:MaxItems=32
	// +optional
	Routes []RouteSpec `json:"routes,omitempty"`
}

type IsolationChangePhase string

type IsolationChangeStatus struct {
	// TargetMode is the mode the change was moving the node to. It is not
	// limited to the modes this release can run: an agent reports a change it
	// refused to a mode it does not know.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	TargetMode IsolationMode `json:"targetMode"`

	// Phase is how far the change got.
	Phase IsolationChangePhase `json:"phase"`

	// Strategy is how the change was carried out.
	// +optional
	Strategy IsolationChangeStrategy `json:"strategy,omitempty"`

	// Reason is a machine-readable CamelCase reason for a refused change,
	// such as UnsupportedMode or ReprovisionNotAllowed. Empty for a change
	// that was attempted.
	// +kubebuilder:validation:MaxLength=64
	// +kubebuilder:validation:Pattern=`^([A-Za-z][A-Za-z0-9]*)?$`
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message explains the phase, including why a failed change failed and
	// whether the node was rolled back.
	// +kubebuilder:validation:MaxLength=4096
	// +optional
	Message string `json:"message,omitempty"`

	// LastTransitionTime is when Phase last changed.
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
}

type IsolationChangeStrategy string

type IsolationMode string

type KubernetesSpec struct {
	// Version is the Kubernetes version to install (e.g., "v1.34.0").
	// When omitted the controller falls back to the cluster's
	// Kubernetes version.
	// +optional
	Version string `json:"version,omitempty"`

	// NodeRef references the Node that corresponds to this Machine.
	// +optional
	NodeRef *LocalObjectReference `json:"nodeRef,omitempty"`

	// NodeLabels are labels passed to kubelet's --node-labels flag.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`

	// RegisterWithTaints are taints passed to kubelet's --register-with-taints flag.
	// Each entry uses the standard Kubernetes taint format: key=value:Effect.
	// +optional
	RegisterWithTaints []string `json:"registerWithTaints,omitempty"`

	// BootstrapTokenRef references a bootstrap token Secret in
	// kube-system. The secret must be of type
	// bootstrap.kubernetes.io/token with the well-known keys
	// "token-id" and "token-secret".
	// +optional
	BootstrapTokenRef *LocalObjectReference `json:"bootstrapTokenRef,omitempty"`
}

type LocalDNSSpec struct {
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// +optional
	NodeListenerIP string `json:"nodeListenerIP,omitempty"`
	// +optional
	ClusterListenerIP string `json:"clusterListenerIP,omitempty"`
	// +optional
	MetricsAddress string `json:"metricsAddress,omitempty"`
	// +optional
	CPULimitInMilliCores *int32 `json:"cpuLimitInMilliCores,omitempty"`
	// +optional
	MemoryLimitInMB *int32 `json:"memoryLimitInMB,omitempty"`
	// +optional
	RequiredPlugins []string `json:"requiredPlugins,omitempty"`
	// +optional
	CorefileTemplate string `json:"corefileTemplate,omitempty"`
}

type LocalObjectReference struct {
	// Name of the referenced resource.
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type MachinaComponentSpec struct {
	SiteComponentSpec `json:",inline"`
}

type Machine struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineSpec   `json:"spec,omitempty"`
	Status MachineStatus `json:"status,omitempty"`
}

type MachineAllocation struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +required
	Spec   MachineAllocationSpec   `json:"spec"`
	Status MachineAllocationStatus `json:"status,omitempty"`
}

type MachineAllocationConsumerReference struct {
	// APIGroup is the consumer API group. An empty value means the core API
	// group.
	// +kubebuilder:validation:Required
	APIGroup string `json:"apiGroup"`

	// Kind is the consumer kind.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Kind string `json:"kind"`

	// Name is the consumer name.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// UID is the consumer UID. A consumer with another UID is a different
	// object.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:MinLength=1
	UID types.UID `json:"uid"`
}

type MachineAllocationFailureReason string

type MachineAllocationLifecycle string

type MachineAllocationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineAllocation `json:"items"`
}

type MachineAllocationNodeTemplate struct {
	// Labels are added to the Node at registration.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`

	// Taints are added to the Node at registration.
	// +optional
	Taints []corev1.Taint `json:"taints,omitempty"`

	// StartupTaints are added at registration and removed by their owners
	// once the Node is initialized.
	// +optional
	StartupTaints []corev1.Taint `json:"startupTaints,omitempty"`
}

type MachineAllocationOperations struct {
	// Allocate is the MachineOperation that launches the host.
	// +optional
	Allocate *UIDReference `json:"allocate,omitempty"`

	// Release is the MachineOperation that releases the host.
	// +optional
	Release *UIDReference `json:"release,omitempty"`
}

type MachineAllocationRequirement struct {
	// Key is the label key.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Key string `json:"key"`

	// Operator is the requirement operator.
	// +kubebuilder:validation:Required
	Operator RequirementOperator `json:"operator"`

	// Values are the operator values.
	// +optional
	Values []string `json:"values,omitempty"`

	// MinValues is the consumer's flexibility floor: at least this many
	// distinct values of Key must remain among the current offerings that
	// satisfy every requirement, or the allocation fails with
	// InsufficientCapacity. The allocation then resolves to one of them.
	// +optional
	// +kubebuilder:validation:Minimum=1
	MinValues *int32 `json:"minValues,omitempty"`
}

type MachineAllocationSnapshot struct {
	// ClassUID is the class UID the snapshot was taken from.
	// +kubebuilder:validation:Required
	ClassUID types.UID `json:"classUID"`

	// ClassGeneration is the class generation the snapshot was taken from.
	// +kubebuilder:validation:Required
	ClassGeneration int64 `json:"classGeneration"`

	// ClassRevision is the class resolved revision.
	// +kubebuilder:validation:Required
	ClassRevision string `json:"classRevision"`

	// Provider is the provider adapter name.
	// +kubebuilder:validation:Required
	Provider string `json:"provider"`

	// SiteName is the Site the machine joins.
	// +kubebuilder:validation:Required
	SiteName string `json:"siteName"`

	// SiteUID is the exact Site instance frozen before any effect. A Site
	// recreated under the same name has a different UID.
	// +kubebuilder:validation:Required
	SiteUID types.UID `json:"siteUID"`

	// Credential is the exact MachineOperationCredential instance frozen
	// before any effect. A credential recreated under the same name has a
	// different UID.
	// +kubebuilder:validation:Required
	Credential UIDReference `json:"credential"`

	// Offering is the selected offering.
	// +kubebuilder:validation:Required
	Offering MachineClassOffering `json:"offering"`

	// ProviderConfig is the exact provider config content.
	// +kubebuilder:validation:Required
	ProviderConfig ObjectContentSnapshot `json:"providerConfig"`

	// BootstrapFiles is the exact bootstrap files content.
	// +optional
	BootstrapFiles *ObjectContentSnapshot `json:"bootstrapFiles,omitempty"`

	// AgentArtifact is the digest-pinned agent tarball.
	// +optional
	AgentArtifact *AgentArtifact `json:"agentArtifact,omitempty"`

	// Configuration identifies the configuration version content.
	// +kubebuilder:validation:Required
	Configuration ConfigurationContentSnapshot `json:"configuration"`

	// ConfigurationTemplate is the frozen configuration content for Machines
	// of this allocation, copied from the configuration version.
	// +kubebuilder:validation:Required
	ConfigurationTemplate MachineConfigurationTemplate `json:"configurationTemplate"`

	// HostImage is the provider-interpreted host image.
	// +kubebuilder:validation:Required
	HostImage string `json:"hostImage"`

	// HostProviderID is the provider-specific host ID planned before the
	// host exists. It is intended to become the Machine's
	// host.external.providerID.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	HostProviderID string `json:"hostProviderID"`
}

type MachineAllocationSpec struct {
	// ConsumerRef identifies the object that requested this allocation.
	// +kubebuilder:validation:Required
	ConsumerRef MachineAllocationConsumerReference `json:"consumerRef"`

	// ClassRef identifies the exact MachineClass the allocation is made from.
	// +kubebuilder:validation:Required
	ClassRef UIDReference `json:"classRef"`

	// Resources are the minimum requested resources.
	// +optional
	Resources corev1.ResourceList `json:"resources,omitempty"`

	// Requirements constrain the offering labels the allocation may use.
	// +optional
	Requirements []MachineAllocationRequirement `json:"requirements,omitempty"`

	// NodeTemplate is applied to the Node at registration.
	// +optional
	NodeTemplate *MachineAllocationNodeTemplate `json:"nodeTemplate,omitempty"`

	// Lifecycle authorizes release. It moves only from Active to Released.
	// +optional
	// +kubebuilder:default=Active
	// +kubebuilder:validation:XValidation:rule="oldSelf == 'Active' || self == 'Released'",message="lifecycle cannot return to Active"
	Lifecycle MachineAllocationLifecycle `json:"lifecycle,omitempty"`
}

type MachineAllocationStatus struct {
	// ObservedGeneration is the allocation generation last reconciled.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Snapshot is the frozen input for every remote effect made for this
	// allocation. It is set by the allocation controller and cannot change or
	// be removed once set.
	// +optional
	Snapshot *MachineAllocationSnapshot `json:"snapshot,omitempty"`

	// ProviderID is the exact Node.spec.providerID the machine registers with.
	// It cannot change or be removed once set.
	// +optional
	ProviderID string `json:"providerID,omitempty"`

	// ProviderResourceID is the provider-native host identifier.
	// +optional
	ProviderResourceID string `json:"providerResourceID,omitempty"`

	// InstanceType is the launched instance type.
	// +optional
	InstanceType string `json:"instanceType,omitempty"`

	// Zone is the launched zone.
	// +optional
	Zone string `json:"zone,omitempty"`

	// CapacityType is the launched purchase model.
	// +optional
	CapacityType CapacityType `json:"capacityType,omitempty"`

	// Image is the launched host image.
	// +optional
	Image string `json:"image,omitempty"`

	// Capacity is the machine capacity.
	// +optional
	Capacity corev1.ResourceList `json:"capacity,omitempty"`

	// Allocatable is observed from the Node once registered, otherwise
	// capacity minus overhead.
	// +optional
	Allocatable corev1.ResourceList `json:"allocatable,omitempty"`

	// Labels are the labels the Node registers with.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`

	// OwnedResources are the provider resources the allocate operation
	// confirmed as created for this allocation, with provider-native identity
	// proving ownership. Release is limited to these resources.
	// +optional
	// +listType=map
	// +listMapKey=id
	OwnedResources []ProviderOwnedResource `json:"ownedResources,omitempty"`

	// MachineRef identifies the Machine created for this allocation.
	// +optional
	MachineRef *UIDReference `json:"machineRef,omitempty"`

	// NodeRef identifies the first Node registered for this allocation.
	// +optional
	NodeRef *UIDReference `json:"nodeRef,omitempty"`

	// Operations identifies the durable allocation operations.
	// +optional
	Operations MachineAllocationOperations `json:"operations,omitempty"`

	// FailureReason is a normalized terminal launch failure category.
	// +optional
	FailureReason MachineAllocationFailureReason `json:"failureReason,omitempty"`

	// FailureMessage describes the terminal launch failure.
	// +optional
	FailureMessage string `json:"failureMessage,omitempty"`

	// Conditions represent the latest available observations.
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineClass struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +required
	Spec   MachineClassSpec   `json:"spec"`
	Status MachineClassStatus `json:"status,omitempty"`
}

type MachineClassBootstrap struct {
	// FilesRef references a ConfigMap of bootstrap files for hosts launched
	// from this class. Its required "run" key is the script that runs as root
	// on the host before the agent installer.
	// +optional
	FilesRef *NamespacedObjectReference `json:"filesRef,omitempty"`

	// AgentArtifact overrides the agent tarball location and pins its digest.
	// +optional
	AgentArtifact *AgentArtifact `json:"agentArtifact,omitempty"`
}

type MachineClassList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineClass `json:"items"`
}

type MachineClassOffering struct {
	// Name uniquely identifies the offering within the class.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceType is the provider instance type.
	// +kubebuilder:validation:Required
	InstanceType string `json:"instanceType"`

	// Zone is the provider zone, or empty for regional capacity.
	// +optional
	Zone string `json:"zone,omitempty"`

	// CapacityType is the purchase model.
	// +kubebuilder:validation:Required
	CapacityType CapacityType `json:"capacityType"`

	// Labels are the well-known labels Nodes from this offering register with.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`

	// Capacity is the machine capacity before overhead.
	// +optional
	Capacity corev1.ResourceList `json:"capacity,omitempty"`

	// Overhead is the capacity reserved from workloads.
	// +optional
	Overhead OfferingOverhead `json:"overhead,omitempty"`

	// Availability is the observed availability.
	// +kubebuilder:validation:Required
	Availability OfferingAvailability `json:"availability"`

	// Price is the observed or configured price, when known.
	// +optional
	Price *OfferingPrice `json:"price,omitempty"`

	// ObservedAt is when availability and capacity were observed.
	// +optional
	ObservedAt *metav1.Time `json:"observedAt,omitempty"`

	// ValidUntil is when this observation expires. An expired offering must
	// not be used to launch a machine.
	// +optional
	ValidUntil *metav1.Time `json:"validUntil,omitempty"`
}

type MachineClassSpec struct {
	// SiteRef identifies the Site that allocated machines join. It is
	// immutable after creation.
	// +kubebuilder:validation:Required
	SiteRef LocalObjectReference `json:"siteRef"`

	// Provider selects the registered provider adapter that interprets
	// providerConfigRef and executes allocation operations. It is immutable
	// after creation.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider"`

	// ProviderConfigRef references provider-specific configuration. Only a
	// namespaced ConfigMap in the core API group is accepted today.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="!has(self.apiGroup) || self.apiGroup == ”",message="providerConfigRef.apiGroup must be the core group"
	// +kubebuilder:validation:XValidation:rule="self.kind == 'ConfigMap'",message="providerConfigRef.kind must be ConfigMap"
	// +kubebuilder:validation:XValidation:rule="self.kind != 'ConfigMap' || has(self.namespace)",message="providerConfigRef.namespace is required for a ConfigMap"
	ProviderConfigRef TypedObjectReference `json:"providerConfigRef"`

	// ConfigurationRef pins the MachineConfiguration version whose content is
	// frozen into each allocation.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="has(self.version)",message="configurationRef.version is required"
	ConfigurationRef MachineConfigurationRef `json:"configurationRef"`

	// Bootstrap optionally customizes first-boot artifact delivery.
	// +optional
	Bootstrap *MachineClassBootstrap `json:"bootstrap,omitempty"`
}

type MachineClassStatus struct {
	// ObservedGeneration is the class generation whose inputs were resolved.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// ResolvedRevision identifies the resolved spec, provider config,
	// bootstrap files, and configuration content. Allocations whose frozen
	// revision differs are drifted.
	// +optional
	ResolvedRevision string `json:"resolvedRevision,omitempty"`

	// ProviderConfig records the provider config observed for the revision.
	// +optional
	ProviderConfig *ObjectContentSnapshot `json:"providerConfig,omitempty"`

	// BootstrapFiles records the bootstrap files observed for the revision.
	// +optional
	BootstrapFiles *ObjectContentSnapshot `json:"bootstrapFiles,omitempty"`

	// Configuration records the configuration version observed for the revision.
	// +optional
	Configuration *ConfigurationContentSnapshot `json:"configuration,omitempty"`

	// Site is the exact Site instance the revision was resolved for. A Site
	// deleted and recreated under the same name is a different authority.
	// +optional
	Site *UIDReference `json:"site,omitempty"`

	// Credential is the exact MachineOperationCredential instance the
	// revision was resolved with.
	// +optional
	Credential *UIDReference `json:"credential,omitempty"`

	// Offerings are the normalized capacity offerings for this class.
	// +optional
	// +listType=map
	// +listMapKey=name
	Offerings []MachineClassOffering `json:"offerings,omitempty"`

	// Conditions represent the latest available observations.
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineConfigurationSpec   `json:"spec,omitempty"`
	Status MachineConfigurationStatus `json:"status,omitempty"`
}

type MachineConfigurationAgent struct {
	// Image is the OCI image reference used for provisioning the
	// nspawn machine (e.g. "ghcr.io/org/repo:tag").
	// +kubebuilder:validation:Required
	Image string `json:"image"`

	// LocalDNS configures the optional CoreDNS cache for this version.
	// +optional
	LocalDNS *LocalDNSSpec `json:"localDNS,omitempty"`
}

type MachineConfigurationHostSpec struct {
	// ProvisioningFormat declares the first-boot payload understood by Image.
	// +optional
	ProvisioningFormat ProvisioningFormat `json:"provisioningFormat,omitempty"`
	// Image is an opaque provider-interpreted image identifier.
	// +optional
	Image string `json:"image,omitempty"`
}

type MachineConfigurationKubernetes struct {
	// Version is the Kubernetes version to install (e.g. "v1.34.0").
	// +optional
	Version string `json:"version,omitempty"`

	// NodeLabels are labels passed to kubelet's --node-labels flag.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`

	// RegisterWithTaints are taints passed to kubelet's
	// --register-with-taints flag.
	// +optional
	RegisterWithTaints []corev1.Taint `json:"registerWithTaints,omitempty"`
}

type MachineConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineConfiguration `json:"items"`
}

type MachineConfigurationRef struct {
	// Name is the name of the MachineConfiguration.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Version is the specific MachineConfigurationVersion number to
	// use. If omitted, the controller selects the latest locked
	// (deployed) version and populates this field.
	// +optional
	Version *int32 `json:"version,omitempty"`
}

type MachineConfigurationRefStatus struct {
	// Name is the MachineConfiguration name.
	Name string `json:"name,omitempty"`

	// Version is the MachineConfigurationVersion number that was applied.
	Version int32 `json:"version,omitempty"`

	// VersionName is the full MachineConfigurationVersion object name
	// (e.g. "myconfig-v3").
	VersionName string `json:"versionName,omitempty"`
}

type MachineConfigurationSpec struct {
	// Template contains the configuration fields that are versioned
	// into MachineConfigurationVersion objects.
	// +kubebuilder:validation:Required
	Template MachineConfigurationTemplate `json:"template"`

	// MachineSelector selects machines that should automatically
	// receive this configuration. If set, new machines matching the
	// selector will be assigned the latest locked version of the
	// highest priority configuration that matches.
	// +optional
	MachineSelector *metav1.LabelSelector `json:"machineSelector,omitempty"`

	// Priority determines which configuration is selected when multiple
	// configurations match a machine's labels. Higher values take
	// precedence. When two configurations have the same priority,
	// lexicographic ordering of names is used as a tiebreaker.
	// +optional
	// +kubebuilder:default=0
	Priority int32 `json:"priority,omitempty"`

	// UpdateStrategy controls how configuration changes are rolled out
	// to machines that reference this configuration.
	// +optional
	UpdateStrategy MachineConfigurationUpdateStrategy `json:"updateStrategy,omitempty"`

	// RevisionHistoryLimit is the number of old
	// MachineConfigurationVersions to retain for rollback. Versions
	// that are still referenced by a Machine are never deleted
	// regardless of this limit, so the actual number of retained
	// versions may exceed this value.
	// +optional
	// +kubebuilder:default=10
	// +kubebuilder:validation:Minimum=0
	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty"`
}

type MachineConfigurationStatus struct {
	// LatestVersion is the highest version number that has been
	// created for this MachineConfiguration. The controller uses this
	// to avoid reusing version numbers when versions are deleted.
	LatestVersion int32 `json:"latestVersion,omitempty"`

	// CurrentVersion is the version number of the latest non-deployed
	// (editable) MachineConfigurationVersion. If all versions are
	// deployed, this is 0.
	CurrentVersion int32 `json:"currentVersion,omitempty"`

	// Conditions represent the latest available observations of the
	// MachineConfiguration's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineConfigurationTemplate struct {
	// Host contains provider-neutral desired host settings.
	// +optional
	Host *MachineConfigurationHostSpec `json:"host,omitempty"`

	// Kubernetes contains Kubernetes-specific configuration such as
	// the target version, node labels, and taints.
	// +optional
	Kubernetes *MachineConfigurationKubernetes `json:"kubernetes,omitempty"`

	// Agent contains settings for the unbounded node agent (e.g. the
	// OCI image reference for the nspawn machine).
	// +optional
	Agent *MachineConfigurationAgent `json:"agent,omitempty"`
}

type MachineConfigurationUpdateStrategy struct {
	// Type is the update strategy type.
	// +kubebuilder:default=OnDelete
	Type MachineConfigurationUpdateStrategyType `json:"type,omitempty"`

	// MaxUnavailable is the maximum number of machines that can be
	// unavailable during a RollingUpdate. Only used when Type is
	// RollingUpdate. Can be an absolute number or a percentage.
	// +optional
	MaxUnavailable *int32 `json:"maxUnavailable,omitempty"`
}

type MachineConfigurationUpdateStrategyType string

type MachineConfigurationVersion struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineConfigurationVersionSpec   `json:"spec,omitempty"`
	Status MachineConfigurationVersionStatus `json:"status,omitempty"`
}

type MachineConfigurationVersionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineConfigurationVersion `json:"items"`
}

type MachineConfigurationVersionSpec struct {
	// Version is the monotonically increasing version number within
	// the parent MachineConfiguration.
	// +kubebuilder:validation:Minimum=1
	Version int32 `json:"version"`

	// Template is the configuration snapshot copied from the parent
	// MachineConfiguration at the time this version was created or
	// last updated (while still editable).
	Template MachineConfigurationTemplate `json:"template"`
}

type MachineConfigurationVersionStatus struct {
	// Deployed indicates whether any Machine has been provisioned
	// using this version. Once true, the spec fields are immutable.
	Deployed bool `json:"deployed,omitempty"`

	// DeployedMachines is the count of Machines currently referencing
	// this version.
	DeployedMachines int32 `json:"deployedMachines,omitempty"`

	// Conditions represent the latest available observations.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Machine `json:"items"`
}

type MachineOperation struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MachineOperationSpec   `json:"spec,omitempty"`
	Status MachineOperationStatus `json:"status,omitempty"`
}

type MachineOperationAllocationResult struct {
	// ProviderResourceID is the provider-native host identifier.
	// +optional
	ProviderResourceID string `json:"providerResourceID,omitempty"`

	// InstanceType is the launched instance type.
	// +optional
	InstanceType string `json:"instanceType,omitempty"`

	// Zone is the launched zone.
	// +optional
	Zone string `json:"zone,omitempty"`

	// Image is the launched host image.
	// +optional
	Image string `json:"image,omitempty"`

	// OwnedResources are the provider resources confirmed as created for the
	// allocation, with provider-native identity. A failed allocation may still
	// report them.
	// +optional
	// +listType=map
	// +listMapKey=id
	OwnedResources []ProviderOwnedResource `json:"ownedResources,omitempty"`
}

type MachineOperationBootMediaStatus struct {
	ID              string    `json:"id"`
	SourceServer    string    `json:"sourceServer,omitempty"`
	SourceName      string    `json:"sourceName,omitempty"`
	Phase           string    `json:"phase"`
	MachineUID      types.UID `json:"machineUID"`
	Netboot         *PXESpec  `json:"netboot"`
	CertFingerprint string    `json:"certFingerprint,omitempty"`
	ImageWritten    bool      `json:"imageWritten,omitempty"`
	Cleaned         bool      `json:"cleaned,omitempty"`
	// StagedDeleted confirms rack media deletion after safe boot is restored.
	StagedDeleted bool `json:"stagedDeleted,omitempty"`
	// CleanedAt starts the bounded wait for installer reboot handoff.
	CleanedAt *metav1.Time `json:"cleanedAt,omitempty"`
	// RebootRequestedAt is set by the successful installer ready callback.
	RebootRequestedAt *metav1.Time `json:"rebootRequestedAt,omitempty"`
	// Released confirms local media removal after Cleaned revokes serving.
	Released bool `json:"released,omitempty"`
	// Site preserves controller ownership after the Machine is deleted.
	Site string `json:"site,omitempty"`
	// NodeName preserves the expected Node across Machine edits.
	NodeName string `json:"nodeName,omitempty"`
	// PhaseStartedAt bounds active progress without spending retry attempts.
	PhaseStartedAt *metav1.Time `json:"phaseStartedAt,omitempty"`
	// ReadinessStartedAt gives AC recovery one fixed grace window per phase.
	ReadinessStartedAt *metav1.Time `json:"readinessStartedAt,omitempty"`
	// LoaderStartedAt is set when the bootloader on the media first fetches
	// its install config. It proves the host booted the media.
	LoaderStartedAt *metav1.Time `json:"loaderStartedAt,omitempty"`
	// BootAttempts counts power-on attempts used to boot the media.
	BootAttempts int32 `json:"bootAttempts,omitempty"`
	// Abandoned ends ownership after the installer never finished its
	// handoff within the allowed time.
	Abandoned bool `json:"abandoned,omitempty"`
}

type MachineOperationCredential struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec MachineOperationCredentialSpec `json:"spec,omitempty"`
}

type MachineOperationCredentialAuth struct {
	// Mode identifies the credential source.
	// +kubebuilder:validation:Required
	Mode MachineOperationCredentialAuthMode `json:"mode"`

	// SecretRef references provider-specific external plugin configuration. It
	// is required for ExternalPlugin mode.
	// +optional
	SecretRef *NamespacedSecretReference `json:"secretRef,omitempty"`
}

type MachineOperationCredentialAuthMode string

type MachineOperationCredentialList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineOperationCredential `json:"items"`
}

type MachineOperationCredentialSpec struct {
	// SiteName is matched against the Machine site label.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	SiteName string `json:"siteName"`

	// Provider identifies the external control provider this credential applies
	// to.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider"`

	// Auth identifies how the provider should authenticate.
	// +kubebuilder:validation:Required
	Auth MachineOperationCredentialAuth `json:"auth"`
}

type MachineOperationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MachineOperation `json:"items"`
}

type MachineOperationSpec struct {
	// MachineRef is the name of the Machine CR this operation targets.
	// Either machineRef or machineSelector must be set.
	// +optional
	MachineRef string `json:"machineRef,omitempty"`

	// AllocationRef identifies the MachineAllocation incarnation that a
	// HostAllocate or HostRelease acts on. It is required for those kinds,
	// forbidden for all others, and immutable.
	// +optional
	AllocationRef *UIDReference `json:"allocationRef,omitempty"`

	// MachineSelector selects machines by labels. When set, the
	// controller creates individual MachineOperation children for
	// each matched machine. Either machineRef or machineSelector
	// must be set.
	// +optional
	MachineSelector *metav1.LabelSelector `json:"machineSelector,omitempty"`

	// OperationKind is the operation to perform on the target machine.
	// +kubebuilder:validation:Required
	OperationKind OperationKind `json:"operationKind"`

	// Parameters is an optional set of key-value pairs passed to the
	// operation executor. For example, RestartService uses "service" to
	// specify the systemd unit name.
	// TODO: Revisit whether map[string]string is sufficient or if we
	// need a richer type (e.g. runtime.RawExtension for arbitrary
	// JSON, or a typed []OperationParameter struct).
	// +optional
	Parameters map[string]string `json:"parameters,omitempty"`

	// TTLSecondsAfterFinished limits the lifetime of a completed or failed
	// MachineOperation. If set, the agent deletes the MachineOperation
	// this many seconds after it reaches a terminal phase. If unset, the
	// MachineOperation is kept indefinitely.
	// +optional
	// +kubebuilder:validation:Minimum=0
	TTLSecondsAfterFinished *int32 `json:"ttlSecondsAfterFinished,omitempty"`
}

type MachineOperationStatus struct {
	// Phase is the current phase of the operation.
	Phase OperationPhase `json:"phase,omitempty"`

	// Message is a human-readable description of the current state.
	// +optional
	Message string `json:"message,omitempty"`

	// StartedAt is when the agent began executing the operation.
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// CompletedAt is when the operation reached a terminal state
	// (Complete or Failed).
	// +optional
	CompletedAt *metav1.Time `json:"completedAt,omitempty"`

	// ObservedMachineGeneration is the Machine's metadata.generation
	// at the time the agent began executing the operation. Clients
	// can compare this to the current Machine generation to determine
	// whether the operation acted on the expected machine state.
	// +optional
	ObservedMachineGeneration int64 `json:"observedMachineGeneration,omitempty"`

	// Targets records the per-machine execution state for this operation.
	// For single-machine operations this contains one entry. For selector
	// operations, targets are snapshotted when execution begins and remain
	// authoritative even if selector matches change later.
	// +optional
	// +listType=map
	// +listMapKey=machineRef
	Targets []MachineOperationTargetStatus `json:"targets,omitempty"`

	// Allocation is the provider's result for a HostAllocate. It is accepted
	// only on HostAllocate and cannot change or be removed once set.
	// +optional
	Allocation *MachineOperationAllocationResult `json:"allocation,omitempty"`

	// Conditions represent the latest available observations of the
	// operation's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachineOperationTargetInput struct {
	// ProviderRef identifies the exact provider-owned resource referenced by
	// host.external.machineRef when the operation target was initialized.
	// +optional
	ProviderRef *ProviderMachineSnapshot `json:"providerRef,omitempty"`

	// HostImage is the resolved provider-interpreted host image for HostReplace.
	// An empty value instructs the provider to preserve the current image.
	// +optional
	HostImage string `json:"hostImage,omitempty"`

	// ProvisioningFormat is resolved with HostImage from the same configuration
	// version at HostReplace initialization. Retries use this frozen pair rather
	// than reselecting intent from a Machine edited during execution.
	// +optional
	ProvisioningFormat ProvisioningFormat `json:"provisioningFormat,omitempty"`
}

type MachineOperationTargetStatus struct {
	// BootMedia records immutable media ownership and cleanup progress.
	// +optional
	BootMedia *MachineOperationBootMediaStatus `json:"bootMedia,omitempty"`

	// MachineRef is the name of the targeted Machine.
	// +kubebuilder:validation:Required
	MachineRef string `json:"machineRef"`

	// Phase is the current lifecycle phase for this target.
	// +optional
	Phase OperationPhase `json:"phase,omitempty"`

	// Stage is the current operation-specific stage for this target.
	// +optional
	Stage OperationStage `json:"stage,omitempty"`

	// Message is a human-readable description of target progress or failure.
	// +optional
	Message string `json:"message,omitempty"`

	// StartedAt is when execution began for this target.
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// CompletedAt is when this target reached a terminal phase.
	// +optional
	CompletedAt *metav1.Time `json:"completedAt,omitempty"`

	// ObservedGeneration is the target Machine generation acted on.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// BootID is the host kernel boot ID the agent observed before it issued
	// a HostSoftReboot. The agent that starts after the reboot compares it with
	// the current boot ID to decide whether the reboot happened.
	// +optional
	BootID string `json:"bootID,omitempty"`

	// Input is the immutable provider input resolved before execution begins.
	// +optional
	Input *MachineOperationTargetInput `json:"input,omitempty"`

	// Attempts is the number of external action attempts made for this target.
	// Polling expected state changes does not increment this field.
	// +optional
	Attempts int32 `json:"attempts,omitempty"`

	// LastAttemptAt records when the latest external action attempt occurred.
	// +optional
	LastAttemptAt *metav1.Time `json:"lastAttemptAt,omitempty"`

	// ProviderOperation identifies the resumable external operation for this
	// target, when the provider returned one.
	// +optional
	ProviderOperation *ProviderOperationStatus `json:"providerOperation,omitempty"`

	// Conditions represent target-scoped observations for this operation. These
	// conditions are not persisted on the Machine, so BMC capability fallbacks
	// apply only to this MachineOperation target.
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MachinePhase string

type MachineSpec struct {
	// SSH contains the SSH connection and credential details for the
	// machine.
	// +optional
	SSH *SSHSpec `json:"ssh,omitempty"`

	// PXE contains legacy PXE boot configuration for the machine. New callers
	// should use Host.Netboot.
	// +optional
	PXE *PXESpec `json:"pxe,omitempty"`

	// Kubernetes contains Kubernetes-specific configuration.
	// +optional
	Kubernetes *KubernetesSpec `json:"kubernetes,omitempty"`

	// Agent contains settings for the unbounded node agent.
	// +optional
	Agent *AgentSpec `json:"agent,omitempty"`

	// Isolation declares where the node stack (containerd, kubelet, CNI and
	// CoreDNS) runs on the host. Empty means no declaration: a new host is
	// provisioned in nspawn, and a repave leaves a running node in the mode it
	// already uses. Setting it does not move a running node: the node changes
	// to this mode at its next repave, which the agent performs when the Node
	// is deleted. The enum lists only the modes this release can run.
	// container is experimental: machina provisions it, and the agent runs
	// it, only when explicitly enabled (see the isolation reference docs).
	// +kubebuilder:validation:Enum="";nspawn;none;container
	// +optional
	Isolation IsolationMode `json:"isolation,omitempty"`

	// Provider identifies the legacy external control provider for this machine.
	// New callers should use Host.External.Provider or Host.Azure.
	// +optional
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider,omitempty"`

	// ProviderID identifies the underlying infrastructure resource for this
	// machine, using a Kubernetes-style provider ID such as
	// azure:///subscriptions/.../virtualMachines/name
	//
	// This is a legacy field. New callers should use Host.External.ProviderID,
	// Host.External.MachineRef, or Host.Azure.ResourceID.
	// +optional
	ProviderID string `json:"providerID,omitempty"`

	// Host contains desired host settings and exactly one optional host owner.
	// New Machines should set one of Netboot, Azure, or External. Image alone
	// may be used with deprecated ownership fields during migration.
	// +optional
	Host *HostSpec `json:"host,omitempty"`

	// ConfigurationRef references a MachineConfiguration (and
	// optionally a specific version) that defines the configuration
	// profile for this machine. If a specific version is set, that
	// version is used at provisioning time; otherwise the latest
	// locked version is used and the version field is set by the
	// controller.
	// +optional
	ConfigurationRef *MachineConfigurationRef `json:"configurationRef,omitempty"`

	// AllocationRef identifies the MachineAllocation this Machine was
	// created for. It can be set only when the Machine is created.
	// +optional
	AllocationRef *UIDReference `json:"allocationRef,omitempty"`

	// Fenced forbids the agent from starting this Machine's node again. It
	// can only change from false to true, and requires AllocationRef.
	// +optional
	Fenced bool `json:"fenced,omitempty"`
}

type MachineStatus struct {
	// ObservedProvisioningFormat is the agent's explicit installation observation.
	// It does not override desired replacement image settings.
	// +optional
	ObservedProvisioningFormat ProvisioningFormat `json:"observedProvisioningFormat,omitempty"`

	// Isolation is the isolation mode the agent reports as applied on the
	// host. Empty means the agent has not reported one. It is compared with
	// spec.isolation to report drift. Only the agent writes it.
	// +kubebuilder:validation:Enum="";nspawn;none;container
	// +optional
	Isolation IsolationMode `json:"isolation,omitempty"`

	// IsolationChange reports the agent's latest attempt to move the node to
	// the mode in spec.isolation during a repave. Only the agent writes it.
	// +optional
	IsolationChange *IsolationChangeStatus `json:"isolationChange,omitempty"`
	// Phase is the current phase of the machine. Intended for human
	// consumption; follows the state machine rather than driving it.
	Phase MachinePhase `json:"phase,omitempty"`

	// Message provides additional status information.
	Message string `json:"message,omitempty"`

	// SSH holds observed SSH state.
	// +optional
	SSH *SSHStatus `json:"ssh,omitempty"`

	// Redfish holds observed Redfish state.
	// +optional
	Redfish *RedfishStatus `json:"redfish,omitempty"`

	// TPM holds observed TPM state.
	// +optional
	TPM *TPMStatus `json:"tpm,omitempty"`

	// Bootstrap records the bootstrap credential most recently issued to
	// this Machine by TPM attestation.
	// +optional
	Bootstrap *BootstrapStatus `json:"bootstrap,omitempty"`

	// Agent holds the applied agent settings.
	// +optional
	Agent *AgentStatus `json:"agent,omitempty"`

	// Configuration records the MachineConfigurationVersion that was
	// applied to this machine during the most recent provisioning.
	// +optional
	Configuration *MachineConfigurationRefStatus `json:"configuration,omitempty"`

	// Conditions represent the latest available observations of the
	// machine's state.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type MetalmanComponentSpec struct {
	SiteComponentSpec `json:",inline"`

	// DHCPAutoInterface lets Metalman choose the DHCP interface automatically.
	// +optional
	DHCPAutoInterface *bool `json:"dhcpAutoInterface,omitempty"`

	// Replicas is the desired number of Metalman replicas. Defaults to 1 when
	// omitted.
	// +kubebuilder:validation:Minimum=0
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`
}

type NamespacedObjectReference struct {
	// Namespace is the referenced object namespace.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Namespace string `json:"namespace"`

	// Name is the referenced object name.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type NamespacedSecretReference struct {
	// Name of the secret.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace of the secret.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Namespace string `json:"namespace"`
}

type ObjectContentSnapshot struct {
	// Namespace is the object namespace.
	// +kubebuilder:validation:Required
	Namespace string `json:"namespace"`

	// Name is the object name.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// UID detects deletion and recreation of the object.
	// +kubebuilder:validation:Required
	UID types.UID `json:"uid"`

	// Hash is the SHA-256 of the object content.
	// +kubebuilder:validation:Required
	Hash string `json:"hash"`
}

type OfferingAvailability string

type OfferingOverhead struct {
	// KubeReserved is reserved for Kubernetes node components.
	// +optional
	KubeReserved corev1.ResourceList `json:"kubeReserved,omitempty"`

	// SystemReserved is reserved for operating system daemons.
	// +optional
	SystemReserved corev1.ResourceList `json:"systemReserved,omitempty"`

	// EvictionThreshold is the hard eviction threshold.
	// +optional
	EvictionThreshold corev1.ResourceList `json:"evictionThreshold,omitempty"`
}

type OfferingPrice struct {
	// Currency is the ISO 4217 currency code.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[A-Z]{3}$`
	Currency string `json:"currency"`

	// PerHour is the decimal price per instance hour.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[0-9]+(\.[0-9]+)?$`
	PerHour string `json:"perHour"`

	// Source documents where the price came from and what it includes.
	// +optional
	Source string `json:"source,omitempty"`

	// ObservedAt is when the price was observed.
	// +optional
	ObservedAt *metav1.Time `json:"observedAt,omitempty"`
}

type OperationKind string

type OperationPhase string

type OperationStage string

type OverriddenWorkload struct {
	// Kind and Name identify the workload. Name alone is not unique, because a
	// Deployment and a DaemonSet may share one.
	Kind string `json:"kind"`
	Name string `json:"name"`

	// DesiredHash is computed by the operator from the observed ConfigMap.
	// AppliedHash is what the workload actually carries. They match when the
	// override is in effect and differ when it could not be applied.
	// +optional
	DesiredHash string `json:"desiredHash,omitempty"`
	// +optional
	AppliedHash string `json:"appliedHash,omitempty"`

	// VersionDrift is set when an override changed a container image, formatted
	// as `<container>=<image>`. Such a component is no longer version-matched to
	// the operator, and the pin survives operator upgrades, which makes it the
	// likeliest cause of an install behaving unlike its reported version.
	// +optional
	VersionDrift string `json:"versionDrift,omitempty"`

	// State is what happened to this workload's override in the last pass: one
	// of Applied, Pending, Withheld or Failed.
	//
	// The hashes alone cannot express it. A workload the operator declined to
	// write has no applied hash, and neither does one whose write was deferred
	// for a second, and neither does one whose merge failed; reading an empty
	// applied hash as "not applied" reported all three identically, and a
	// withheld workload appeared in status not at all.
	//
	// It may be empty when the operator that wrote this status predates the
	// field, or when a CRD older than the operator pruned it. Consumers should
	// fall back to comparing the hashes.
	// +optional
	State string `json:"state,omitempty"`
}

type OverrideStatus struct {
	// Phase is the aggregate state of override processing for this Site: one of
	// None, Applied or Degraded.
	//
	// Applied means every resolved workload carries the hash that was desired.
	// It reports that the override merged and was written, not that the
	// resulting pods are healthy.
	Phase string `json:"phase"`

	// ObservedResourceVersion is the resourceVersion of the overrides ConfigMap
	// this status was computed from, so a result is traceable to a specific
	// input version. Empty when no overrides ConfigMap exists.
	// +optional
	ObservedResourceVersion string `json:"observedResourceVersion,omitempty"`

	// Workloads carries the desired and applied hash for each overridden
	// workload.
	//
	// Both are per workload because contributors differ per workload: a
	// Site-wide desired hash would not be comparable to any of them whenever a
	// document targets more than one.
	// +optional
	// +listType=map
	// +listMapKey=kind
	// +listMapKey=name
	Workloads []OverriddenWorkload `json:"workloads,omitempty"`

	// Message explains a Degraded phase, naming the ConfigMap key and entry
	// index at fault. Empty otherwise.
	// +optional
	Message string `json:"message,omitempty"`
}

type PXESpec struct {
	// Image is an OCI image reference containing the machine disk image.
	// The image must contain /disk/disk.img.gz.
	// VirtualMedia requires a digest reference (image@sha256:...).
	// Example: "ghcr.io/azure/host-ubuntu2404:v1"
	// +kubebuilder:validation:Required
	Image string `json:"image"`

	// PullSecretRef references a Docker registry credential Secret used to pull
	// Image. The Secret must be type kubernetes.io/dockerconfigjson or
	// kubernetes.io/dockercfg.
	// +optional
	PullSecretRef *NamespacedSecretReference `json:"pullSecretRef,omitempty"`

	// Architecture is the target CPU architecture for PXE boot artifacts and
	// machine images.
	// +kubebuilder:validation:Enum=amd64;arm64
	// +kubebuilder:default=amd64
	// +optional
	Architecture string `json:"architecture,omitempty"`

	// NetbootImage is an OCI image reference containing the PXE boot
	// artifacts used to install Image. When omitted, metalman uses the
	// default netboot image that corresponds to its release.
	// VirtualMedia requires this field to be set to a digest reference
	// (image@sha256:...).
	// +optional
	NetbootImage string `json:"netbootImage,omitempty"`

	// NetbootPullSecretRef references a Docker registry credential Secret used to
	// pull NetbootImage. It is ignored when NetbootImage is omitted; metalman's
	// configured default netboot pull secret is used for the default netboot image.
	// The Secret must be type kubernetes.io/dockerconfigjson or
	// kubernetes.io/dockercfg.
	// +optional
	NetbootPullSecretRef *NamespacedSecretReference `json:"netbootPullSecretRef,omitempty"`

	// BootProtocol selects how metalman should trigger network boot for
	// repaves. PXE uses DHCP/TFTP bootfile options. HTTP uses Redfish UEFI
	// HTTP boot with a URL derived from the netboot image metadata.
	// VirtualMedia mounts an operation-owned bootstrap ISO through Redfish.
	// It requires redfish, a digest Image, and a digest NetbootImage.
	// +kubebuilder:validation:Enum=PXE;HTTP;VirtualMedia
	// +kubebuilder:default=PXE
	// +optional
	BootProtocol string `json:"bootProtocol,omitempty"`

	// DHCPLeases defines static IPv4 provisioning network settings. PXE boot
	// uses them as DHCP leases. HTTP boot uses the first entry to configure the
	// Redfish UEFI HTTP boot client.
	// +optional
	DHCPLeases []DHCPLease `json:"dhcpLeases,omitempty"`

	// TargetDisk is the block device the installer writes the machine image to.
	// Examples: /dev/nvme0n1, /dev/sda, /dev/disk/by-id/...
	// When omitted, the installer chooses a target disk automatically.
	// +optional
	TargetDisk string `json:"targetDisk,omitempty"`

	// Redfish configures optional Redfish BMC access.
	// +optional
	Redfish *RedfishSpec `json:"redfish,omitempty"`

	// CloudInit contains optional cloud-init customization for PXE-booted
	// machines.
	// +optional
	CloudInit *CloudInitSpec `json:"cloudInit,omitempty"`

	// CloudInitTimeout bounds how long a HostReplace target may wait from the
	// installer reboot handoff until first-boot cloud-init completes and the
	// Node registers. It covers firmware POST. When omitted, metalman allows
	// 20 minutes. Large GPU servers can spend most of the default budget in
	// POST alone.
	// +optional
	// +kubebuilder:validation:XValidation:rule="duration(self) > duration('0s')",message="cloudInitTimeout must be positive"
	CloudInitTimeout *metav1.Duration `json:"cloudInitTimeout,omitempty"`

	// Network declares the host's static network topology: physical
	// ethernets identified by MAC address, bonds, and VLANs. The installer
	// brings it up before fetching install instructions and persists it as
	// netplan or systemd-networkd configuration on the installed host.
	// It requires the VirtualMedia boot protocol: metalman then boots the
	// installer from the bootstrap ISO without network access, so links that
	// only pass traffic once LACP negotiates (no switch fallback) still work.
	// The first DHCPLeases entry remains the provisioning identity: its IPv4
	// address and gateway must be configured on exactly one declared
	// interface, and its MAC must be one of the declared ethernets.
	// When omitted, metalman keeps the single-NIC behavior driven by
	// DHCPLeases.
	// +optional
	Network *HostNetworkSpec `json:"network,omitempty"`
}

type ProviderMachineReference struct {
	// APIGroup is the API group of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	APIGroup string `json:"apiGroup"`

	// Kind is the kind of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Kind string `json:"kind"`

	// Name is the name of the cluster-scoped provider-owned Machine resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type ProviderMachineSnapshot struct {
	// APIGroup is the API group of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	APIGroup string `json:"apiGroup"`

	// Kind is the kind of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	Kind string `json:"kind"`

	// Name is the name of the provider-owned Machine resource.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// UID detects deletion and recreation of the provider-owned resource.
	// +kubebuilder:validation:Required
	UID types.UID `json:"uid"`

	// Generation records the provider-owned resource generation whose inputs
	// were observed.
	// +kubebuilder:validation:Minimum=1
	Generation int64 `json:"generation"`
}

type ProviderOperationStatus struct {
	// Provider is the external provider that accepted the operation.
	// +kubebuilder:validation:Required
	Provider string `json:"provider"`

	// OperationID is the provider-assigned operation identifier.
	// +kubebuilder:validation:Required
	OperationID string `json:"operationID"`

	// ResumeToken is opaque provider data needed to resume polling. Providers
	// must not store credentials or other secrets in this field.
	// +optional
	ResumeToken string `json:"resumeToken,omitempty"`
}

type ProviderOwnedResource struct {
	// ID is the provider resource identifier.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ID string `json:"id"`

	// NativeID is the provider-assigned instance identity. A resource
	// recreated under the same ID has a different NativeID.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	NativeID string `json:"nativeID"`
}

type ProvisioningFormat string

type RedfishPasswordSelector struct {
	// Name of the secret.
	Name string `json:"name"`

	// Namespace of the secret.
	Namespace string `json:"namespace"`

	// Key within the secret. Defaults to "password".
	// +kubebuilder:default=password
	Key string `json:"key,omitempty"`
}

type RedfishSpec struct {
	// URL is the Redfish endpoint URL. It may include a per-system path prefix,
	// for example https://manager:8080/7. Do not include /redfish/v1.
	// +kubebuilder:validation:Required
	URL string `json:"url"`

	// Username is the Redfish username.
	// +kubebuilder:validation:Required
	Username string `json:"username"`

	// DeviceID is the Redfish system device ID. Defaults to "1".
	// It is ignored when the endpoint exposes a single system selected by its URL.
	// +kubebuilder:default="1"
	DeviceID string `json:"deviceID,omitempty"`

	// PasswordRef references a secret containing the Redfish password. Its key
	// defaults to "password".
	// +kubebuilder:validation:Required
	PasswordRef RedfishPasswordSelector `json:"passwordRef"`
}

type RedfishStatus struct {
	// CertFingerprint is the TLS certificate fingerprint for the
	// Redfish endpoint, pinned on first connection.
	CertFingerprint string `json:"certFingerprint,omitempty"`
}

type RequirementOperator string

type RouteSpec struct {
	// To is the destination prefix in CIDR notation, for example
	// 198.51.100.0/24.
	// +kubebuilder:validation:MaxLength=18
	To string `json:"to"`

	// Via is the IPv4 next-hop address.
	// +kubebuilder:validation:MaxLength=15
	Via string `json:"via"`
}

type SSHSpec struct {
	// Host is the hostname or IP address of the machine, optionally
	// including the port (e.g. "1.2.3.4:2222"). When the port is
	// omitted, 22 is assumed.
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Username is the SSH username.
	// +kubebuilder:default=azureuser
	Username string `json:"username,omitempty"`

	// PrivateKeyRef references a secret containing the SSH private key.
	// +kubebuilder:validation:Required
	PrivateKeyRef SecretKeySelector `json:"privateKeyRef"`

	// Bastion configures an optional SSH jump host (bastion) for proxy
	// connections. Its structure is identical to SSHSpec minus the
	// bastion field itself.
	// +optional
	Bastion *BastionSSHSpec `json:"bastion,omitempty"`
}

type SSHStatus struct {
	// Fingerprint is the SSH host key fingerprint discovered on
	// first connection. Subsequent connections must match this value.
	Fingerprint string `json:"fingerprint,omitempty"`
}

type SecretKeySelector struct {
	// Name of the secret.
	Name string `json:"name"`

	// Namespace of the secret.
	Namespace string `json:"namespace"`

	// Key within the secret.
	// +kubebuilder:default=ssh-privatekey
	Key string `json:"key,omitempty"`
}

type Site struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   SiteSpec   `json:"spec,omitempty"`
	Status SiteStatus `json:"status,omitempty"`
}

type SiteComponentSpec struct {
	// Enabled controls whether the component is reconciled.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`
}

type SiteComponents struct {
	// Machina is a deprecated compatibility setting and is ignored.
	// Machina is required and cannot be disabled.
	// +optional
	Machina *MachinaComponentSpec `json:"machina,omitempty"`

	// Metalman configures the Metalman PXE controller for this site.
	// +optional
	Metalman *MetalmanComponentSpec `json:"metalman,omitempty"`

	// Gantry configures the gantry peer-to-peer OCI distribution agent for this
	// site. Gantry defaults to enabled; set
	// gantry.enabled to false to opt a site out. The apiserver defaults an
	// omitted gantry block to enabled=true so the intent is explicit on read
	// (for example the Gantry print column) whenever a components block is
	// present. A site that omits the components block entirely is not defaulted.
	// +optional
	// +kubebuilder:default={enabled: true}
	Gantry *GantryComponentSpec `json:"gantry,omitempty"`

	// TokenRefresher maintains bootstrap tokens for machines joining this Site.
	// It defaults to enabled and is ignored for the reserved cluster Site.
	// +optional
	// +kubebuilder:default={enabled: true}
	TokenRefresher *TokenRefresherComponentSpec `json:"tokenRefresher,omitempty"`
}

type SiteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Site `json:"items"`
}

type SiteSpec struct {
	// NodeCidrs are the CIDRs that contain the internal IPs of nodes at this site.
	// +kubebuilder:validation:MinItems=1
	NodeCidrs []string `json:"nodeCidrs"`

	// PodCidrAssignments define how pod CIDRs are allocated to nodes in this site.
	// +kubebuilder:validation:MinItems=1
	PodCidrAssignments []unboundednetv1alpha1.PodCidrAssignment `json:"podCidrAssignments"`

	// ManageCniPlugin controls whether the node agent writes CNI configuration
	// and creates tunnel endpoints for same-site nodes. When true (the default),
	// CNI config is written and all same-site nodes are tunnel peers.
	// When false, only tunnel links to gateway pools for other sites are created,
	// allowing an external CNI plugin to manage intra-site networking.
	// Omitted assignmentEnabled values on podCidrAssignments default to this
	// setting. Explicit assignmentEnabled values override that default.
	// The podCidrAssignments are still required to define the CIDR ranges
	// used for inter-site routing, even when assignment is disabled.
	// +optional
	ManageCniPlugin *bool `json:"manageCniPlugin,omitempty"`

	// NonMasqueradeCIDRs are CIDR blocks that should NOT be masqueraded when
	// traffic leaves the node via the default gateway. Traffic to these CIDRs
	// will use the pod's actual IP address.
	// +optional
	NonMasqueradeCIDRs []string `json:"nonMasqueradeCIDRs,omitempty"`

	// LocalCIDRs are CIDR blocks that are considered local to this site.
	// Traffic to these CIDRs should never be routed via gateway pools.
	// +optional
	LocalCIDRs []string `json:"localCidrs,omitempty"`

	// HealthCheckSettings controls health check settings for inter-site tunnel peers.
	// +optional
	HealthCheckSettings *unboundednetv1alpha1.HealthCheckSettings `json:"healthCheckSettings,omitempty"`

	// TunnelProtocol selects the tunnel protocol for this site.
	// Valid values are "WireGuard", "IPIP", "GENEVE", "VXLAN", "None", or "Auto".
	// Defaults to "Auto" when unset.
	// +kubebuilder:validation:Enum=WireGuard;IPIP;GENEVE;VXLAN;None;Auto
	// +optional
	TunnelProtocol *unboundednetv1alpha1.TunnelProtocol `json:"tunnelProtocol,omitempty"`

	// TunnelMTU is the MTU to set on routes through tunnels for this site.
	// +kubebuilder:validation:Minimum=576
	// +kubebuilder:validation:Maximum=9000
	// +optional
	TunnelMTU *int32 `json:"tunnelMTU,omitempty"`

	// Components declares optional Unbounded components managed for this site.
	// +optional
	Components SiteComponents `json:"components,omitempty"`
}

type SiteStatus struct {
	// NodeCount is the number of nodes matched to this site by unbounded-net.
	// +optional
	NodeCount int `json:"nodeCount,omitempty"`

	// SliceCount is the number of SiteNodeSlice objects for this site.
	// +optional
	SliceCount int `json:"sliceCount,omitempty"`

	// Conditions report the last observed state of site components. One
	// condition is published per component (for example NetReady, MachinaReady,
	// MetalmanReady) so callers can `kubectl wait` on a Site.
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Overrides summarizes user-supplied workload overrides affecting this
	// Site. It is absent when no override targets any of the Site's workloads.
	// +optional
	Overrides *OverrideStatus `json:"overrides,omitempty"`
}

type TPMStatus struct {
	// EKPublicKey is the TPM endorsement key public key, written
	// when the PXE boot image requests a bootstrap token.
	EKPublicKey string `json:"ekPublicKey,omitempty"`
}

type TokenRefresherComponentSpec struct {
	SiteComponentSpec `json:",inline"`
}

type TypedObjectReference struct {
	// APIGroup is the API group of the referenced object. An absent or empty
	// value means the core API group.
	// +optional
	APIGroup string `json:"apiGroup,omitempty"`

	// Kind is the kind of the referenced object.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Kind string `json:"kind"`

	// Name is the name of the referenced object.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace is the namespace of the referenced object. It is absent for
	// cluster-scoped kinds.
	// +optional
	// +kubebuilder:validation:MinLength=1
	Namespace string `json:"namespace,omitempty"`
}

type UIDReference struct {
	// Name is the object name.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// UID is the object UID.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:MinLength=1
	UID types.UID `json:"uid"`
}

type VLANSpec struct {
	// Name is the VLAN interface name, for example bond0.64.
	// +kubebuilder:validation:MaxLength=15
	// +kubebuilder:validation:Pattern=`^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$`
	Name string `json:"name"`

	// ID is the 802.1Q VLAN identifier.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=4094
	ID int32 `json:"id"`

	// Link is the name of the ethernet or bond carrying the VLAN.
	// +kubebuilder:validation:MaxLength=15
	Link string `json:"link"`

	InterfaceAddressing `json:",inline"`
}