v1alpha1

type ActorTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec defines the desired state of ActorTemplate. This field is immutable.
	// +required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Spec is immutable"
	Spec ActorTemplateSpec `json:"spec"`

	// status is the observed state of ActorTemplate
	// +optional
	Status ActorTemplateStatus `json:"status,omitempty"`
}

type ActorTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ActorTemplate `json:"items"`
}

type ActorTemplateSpec struct {
	// PauseImage is the container to use as the root sandbox container.
	//
	// Typically, set it to [1] for on-gcp, and [2] for off-gcp
	//
	//   - [1] gcr.io/gke-release/pause@sha256:bcbd57ba5653580ec647b16d8163cdd1112df3609129b01f912a8032e48265da
	//   - [2] registry.k8s.io/pause:3.10.2@sha256:f548e0e8e3dc1896ca956272154dde3314e8cc4fde0a57577ee9fa1c63f5baf4
	//
	// +required
	// +kubebuilder:validation:XValidation:rule="self.contains('@')",message="All images must be pinned (changing the image invalidates snapshots)"
	PauseImage string `json:"pauseImage,omitempty"`

	// Containers is the workload definition.
	//
	// +optional
	// +kubebuilder:validation:MaxItems=10
	Containers []Container `json:"containers,omitempty"`

	// Snapshots configuration for the actor.
	//
	// +required
	SnapshotsConfig SnapshotsConfig `json:"snapshotsConfig"`

	// SandboxClass selects the sandbox runtime family this template's actors run
	// on. Only worker pools whose SandboxClass matches are eligible. Snapshots are
	// not portable across classes, so this is a hard gate, AND'd with WorkerSelector
	// and the actor's worker_selector. Defaults to gvisor.
	//
	// TODO: This is almost certainly insufficient.  We have to decide a number of things:
	//
	// 1) How does someone discover what classes are available, or what they mean?
	// 2) How does someone define a new sandbox class?
	// 3) Does a class mean the specific type of sandbox tech or does it include some aspect of config (e.g. can we have 2 different classes which both use gVisor with different config, or 2 classes which use different microvms)
	// 4) How does the default get set and who sets it?
	//
	// See Also: WorkerPool SandboxClass
	//
	//
	// +optional
	// +kubebuilder:validation:Enum=gvisor;microvm
	// +kubebuilder:default=gvisor
	SandboxClass SandboxClass `json:"sandboxClass,omitempty"`

	// WorkerSelector restricts which worker pools actors from this template may
	// use. The scheduler only considers pools whose labels match this selector.
	// If nil, all pools are eligible (subject to the actor's own worker_selector).
	// Acts as a gate: the actor's worker_selector can only narrow this set further,
	// never expand it.
	//
	// +optional
	WorkerSelector *metav1.LabelSelector `json:"workerSelector,omitempty"`
}

type ActorTemplateStatus struct {
	// Phase of the actor template.
	// +optional
	Phase PhaseType `json:"phase,omitempty"`

	GoldenActorID        string      `json:"goldenActorID,omitempty"`
	TakeGoldenSnapshotAt metav1.Time `json:"takeGoldenSnapshotAt,omitempty"`
	GoldenSnapshot       string      `json:"goldenSnapshot,omitempty"`

	// conditions defines the status conditions array
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type AssetFile struct {
	// URL is where to download the asset from (e.g. a gs:// URL). It may be
	// fetched anonymously or with credentials depending on atelet's
	// configuration.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	URL string `json:"url"`

	// SHA256 is the lower-case hex SHA256 of the asset. It both names the cached
	// file (preventing collisions) and verifies the download's integrity.
	//
	// +required
	// +kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
	SHA256 string `json:"sha256"`
}

type Container struct {
	// Name of the container.
	//
	// +required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:XValidation:rule="!format.dns1123Label().validate(self).hasValue()",message="Name must be a valid DNS label"
	Name string `json:"name"`

	// Image to use for the worker replicas.
	//
	// +required
	// +kubebuilder:validation:XValidation:rule="self.contains('@')",message="All images must be pinned (changing the image invalidates snapshots)"
	Image string `json:"image,omitempty"`

	// Entrypoint array. Not executed within a shell.
	//
	// +optional
	// +kubebuilder:validation:MaxItems=64
	// +listType=atomic
	Command []string `json:"command,omitempty"`

	// Environment variables to set in the worker replicas.
	//
	// +optional
	// +kubebuilder:validation:MaxItems=32
	Env []EnvVar `json:"env,omitempty"`
}

type EnvVar struct {
	// Name is the name of the environment variable. May be any printable ASCII
	// character except '='.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:Pattern=`^[ -<>-~]+$`
	Name string `json:"name"`

	// Variable value. Mutually exclusive with ValueFrom.
	// Value is the literal value of the environment variable. Unlike in
	// Kubernetes pods, this value is not interpolated, and $(VAR)
	// references are not expanded.
	//
	// +optional
	// +kubebuilder:validation:MinLength=0
	Value *string `json:"value,omitempty"`

	// Source for the environment variable's value. Mutually exclusive with
	// Value.
	//
	// +optional
	ValueFrom *EnvVarSource `json:"valueFrom,omitempty"`
}

type EnvVarSource struct {
	// Selects a key of a Secret in the ActorTemplate's namespace.
	//
	// +optional
	SecretKeyRef *SecretKeySelector `json:"secretKeyRef,omitempty"`
}

type PhaseType string

type SandboxClass string

type SandboxConfig struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec defines the desired state of SandboxConfig
	// +required
	Spec SandboxConfigSpec `json:"spec"`
}

type SandboxConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SandboxConfig `json:"items"`
}

type SandboxConfigSpec struct {
	// SandboxClass is the sandbox runtime family this config applies to. A
	// WorkerPool only uses SandboxConfigs whose SandboxClass matches its own.
	//
	// +required
	// +kubebuilder:validation:Enum=gvisor;microvm
	// +kubebuilder:default=gvisor
	SandboxClass SandboxClass `json:"sandboxClass"`

	// Default marks this SandboxConfig as the cluster-wide default for its
	// SandboxClass. A WorkerPool with no explicit SandboxConfigName resolves to
	// the default config for its SandboxClass. At most one default is expected
	// per SandboxClass.
	//
	// +optional
	Default bool `json:"default,omitempty"`

	// Assets is the set of files atelet fetches for this runtime, keyed first by
	// architecture (GOARCH, e.g. "amd64", "arm64") and then by asset name. The
	// asset names are interpreted by the sandbox backend: gVisor expects a
	// "runsc" asset; a micro-VM backend expects several (e.g. "cloud-hypervisor",
	// "kata-kernel", "kata-image"). The schema is intentionally generic;
	// per-class requirements are enforced by a ValidatingAdmissionPolicy.
	//
	// +optional
	Assets map[string]map[string]AssetFile `json:"assets,omitempty"`
}

type SecretKeySelector struct {
	// Name of the referent Secret.
	//
	// +required
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="Name must be a valid DNS subdomain"
	Name string `json:"name"`

	// Key to select within the Secret.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:Pattern=`^[-._a-zA-Z0-9]+$`
	Key string `json:"key"`

	// Specify whether the Secret or its key must be defined.
	//
	// +optional
	Optional *bool `json:"optional,omitempty"`
}

type SnapshotsConfig struct {
	// Location to store snapshots in.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	Location string `json:"location"`
}

type WorkerPool struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec defines the desired state of WorkerPool
	// +required
	Spec WorkerPoolSpec `json:"spec"`

	// status is the observed state of WorkerPool
	// +optional
	Status WorkerPoolStatus `json:"status,omitempty"`
}

type WorkerPoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []WorkerPool `json:"items"`
}

type WorkerPoolPodTemplate struct {
	// NodeSelector is a selector which must be true for the pod to fit on a node.
	//
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Tolerations for the worker pods.
	//
	// +optional
	// +kubebuilder:validation:MaxItems=16
	// +listType=atomic
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// PriorityClassName for the worker pods.
	//
	// +optional
	PriorityClassName string `json:"priorityClassName,omitempty"`

	// NodeAffinity scheduling rules for the worker pods. Mapped to
	// spec.affinity.nodeAffinity on the pod.
	//
	// +optional
	NodeAffinity *corev1.NodeAffinity `json:"nodeAffinity,omitempty"`
}

type WorkerPoolSpec struct {
	// Replicas is the number of worker pods to run.
	// +required
	// +kubebuilder:validation:Minimum=0
	Replicas int32 `json:"replicas"`

	// AteomImage is the ateom container image to deploy as workers.
	// +kubebuilder:validation:MinLength=1
	// +required
	AteomImage string `json:"ateomImage"`

	// Template holds optional pod scheduling and resource settings for worker pods.
	//
	// +optional
	Template *WorkerPoolPodTemplate `json:"template,omitempty"`

	// SandboxClass selects the sandbox runtime family for this pool, which drives
	// the worker pod shape (KVM/vhost device mounts and node placement) and which
	// SandboxConfigs are eligible. The concrete binary is still selected by
	// AteomImage. Defaults to gvisor.
	//
	// See Also: TODOs in ActorTemplate SandboxClass
	//
	// +optional
	// +kubebuilder:validation:Enum=gvisor;microvm
	// +kubebuilder:default=gvisor
	SandboxClass SandboxClass `json:"sandboxClass,omitempty"`

	// SandboxConfigName names a cluster-scoped SandboxConfig to use for fetching
	// sandbox binaries. It overrides the cluster-wide default SandboxConfig for
	// this pool's SandboxClass. The referenced config's SandboxClass must match
	// this pool's SandboxClass. If empty, the default SandboxConfig for the
	// SandboxClass is used.
	// +optional
	SandboxConfigName string `json:"sandboxConfigName,omitempty"`
}

type WorkerPoolStatus struct {
	// Replicas is the total number of worker pods.
	// +kubebuilder:validation:Minimum=0
	// +optional
	Replicas int32 `json:"replicas"`
}