v1alpha1

type AssetFile struct {
	// URL is where to download the asset from (e.g. a gs:// URL). atelet
	// fetches every URL through the node's object-store plugin, with the
	// plugin's credentials. The plugin refuses URLs under a snapshot location.
	// The in-tree plugin serves only its storage backend's scheme: gs:// on
	// GCS, s3:// on S3. A gs:// URL the plugin has no object for or cannot
	// serve is then read anonymously, which serves public buckets such as
	// gs://gvisor.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	URL string `json:"url"`

	// SHA256 is the lower-case hex SHA256 of the asset. It both names the cached
	// file (preventing collisions) and verifies the download's integrity.
	//
	// +required
	// +kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
	SHA256 string `json:"sha256"`
}

type CSIDriverConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec CSIDriverConfigSpec `json:"spec"`
}

type CSIDriverConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CSIDriverConfig `json:"items"`
}

type CSIDriverConfigSpec struct {
	// DriverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io").
	// Matches the StorageClass referenced in ActorTemplate volume definitions.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^(substrate\.io/)?([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)$`
	DriverName string `json:"driverName"`

	// ControllerEndpoint is the gRPC endpoint for the CSI Controller service.
	// Must be a valid network URI (e.g. dns:///csi-service:9000 or tcp://127.0.0.1:9000).
	// TODO: Harden endpoint validation to prevent invalid or unsafe URI inputs.
	//
	// +required
	// +kubebuilder:validation:Pattern=`^(tcp|dns)://.+$`
	ControllerEndpoint string `json:"controllerEndpoint"`

	// NodeSocketOverride is an optional override for the CSI Node service socket
	// on the worker nodes. If empty, ATE defaults to unix:///var/lib/kubelet/plugins/[DriverName]/csi.sock.
	//
	// +optional
	// +kubebuilder:validation:Pattern=`^unix://.+$`
	NodeSocketOverride string `json:"nodeSocketOverride,omitempty"`

	// TLS configures TLS/mTLS for the connection to the ControllerEndpoint.
	// +optional
	TLS *CSIDriverTLSConfig `json:"tls,omitempty"`
}

type CSIDriverTLSConfig struct {
	// Enabled controls whether TLS is used.
	// +required
	Enabled bool `json:"enabled"`

	// TODO: Add alternative support for manual certs by adding SecretReference fields.
	// UsePodIdentity indicates whether to reuse Substrate's Pod Identity (SPIFFE) certificates.
	// +optional
	UsePodIdentity bool `json:"usePodIdentity,omitempty"`

	// ServerName specifies the expected server name (SAN) for TLS certificate verification.
	// Required when TLS is enabled.
	// +optional
	ServerName string `json:"serverName,omitempty"`
}

type SandboxClass string

type SandboxConfig struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec defines the desired state of SandboxConfig
	// +required
	Spec SandboxConfigSpec `json:"spec"`
}

type SandboxConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SandboxConfig `json:"items"`
}

type SandboxConfigReference struct {
	// Name is the SandboxConfig's metadata.name.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	Name string `json:"name,omitempty"`
}

type SandboxConfigSpec struct {
	// SandboxClass is the sandbox runtime family this config applies to. An
	// ActorTemplate only uses SandboxConfigs whose SandboxClass matches its
	// sandbox_config.sandbox_class.
	//
	// +required
	// +kubebuilder:validation:Enum=gvisor;microvm
	// +kubebuilder:default=gvisor
	SandboxClass SandboxClass `json:"sandboxClass"`

	// defaultVersion names the entry in versions that new sandboxes boot with.
	// It must name an existing, non-Disabled version.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	DefaultVersion string `json:"defaultVersion,omitempty"`

	// versions are the sandbox versions this config offers, keyed by name.
	//
	// +required
	// +listType=map
	// +listMapKey=name
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=16
	Versions []SandboxVersionConfig `json:"versions,omitempty"`
}

type SandboxVersionConfig struct {
	// name identifies this version within its SandboxConfig. It is a DNS label
	// (lower-case alphanumerics and '-').
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	Name string `json:"name,omitempty"`

	// state is whether this version may be used: Enabled (default) or
	// Disabled.
	//
	// +optional
	// +kubebuilder:default=Enabled
	State *SandboxVersionState `json:"state,omitempty"`

	// PauseImage is the container image used as the root sandbox container.
	// It holds the sandbox's namespaces and runs no workload code, so it is an
	// implementation detail of the sandbox rather than something actor authors
	// choose. Required for gvisor; not allowed for microvm, which runs no pause
	// container. It is captured in the snapshot manifest alongside the sandbox
	// binaries, so a restore always re-creates the sandbox from the same image
	// the snapshot was taken with.
	//
	// Typically, set it to [1] for on-gcp, and [2] for off-gcp
	//
	//   - [1] gcr.io/gke-release/pause@sha256:bcbd57ba5653580ec647b16d8163cdd1112df3609129b01f912a8032e48265da
	//   - [2] registry.k8s.io/pause:3.10.2@sha256:f548e0e8e3dc1896ca956272154dde3314e8cc4fde0a57577ee9fa1c63f5baf4
	//
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +kubebuilder:validation:XValidation:rule="self.contains('@')",message="All images must include a digest"
	PauseImage string `json:"pauseImage,omitempty"`

	// Assets is the set of files atelet fetches for this runtime, keyed first by
	// architecture (GOARCH, e.g. "amd64", "arm64") and then by asset name. The
	// asset names are interpreted by the sandbox backend: gVisor expects a
	// "gvisor" asset (the release's gvisor.tar.zstd, which atelet extracts so
	// the gvisor-bin/ helpers sit next to runsc; a legacy bare-binary "runsc"
	// asset is still accepted); a micro-VM backend expects several (e.g.
	// "cloud-hypervisor", "kata-kernel", "kata-image"). The schema is
	// intentionally generic; per-class requirements are enforced by a
	// ValidatingAdmissionPolicy.
	//
	// +optional
	Assets map[string]map[string]AssetFile `json:"assets,omitempty"`
}

type SandboxVersionState string

type WorkerPool struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec defines the desired state of WorkerPool
	// +required
	Spec WorkerPoolSpec `json:"spec"`

	// status is the observed state of WorkerPool
	// +optional
	Status WorkerPoolStatus `json:"status,omitempty"`
}

type WorkerPoolLabelValue string

type WorkerPoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []WorkerPool `json:"items"`
}

type WorkerPoolPodTemplate struct {
	// Labels are added to the generated Deployment and worker pods. Keys in
	// the ate.dev domain and its subdomains are reserved for controllers.
	//
	// +optional
	// +kubebuilder:validation:MaxProperties=64
	// +kubebuilder:validation:XValidation:rule="self.all(key, !key.startsWith('ate.dev/') && !key.contains('.ate.dev/'))",message="ate.dev and its subdomains are reserved"
	// +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="label keys must be valid Kubernetes qualified names"
	Labels map[string]WorkerPoolLabelValue `json:"labels,omitempty"`

	// Annotations are added to the generated Deployment and worker pods. Keys
	// in the ate.dev domain and its subdomains are reserved for controllers.
	//
	// +optional
	// +kubebuilder:validation:MaxProperties=64
	// +kubebuilder:validation:XValidation:rule="self.all(key, !key.startsWith('ate.dev/') && !key.contains('.ate.dev/'))",message="ate.dev and its subdomains are reserved"
	// +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="annotation keys must be valid Kubernetes qualified names"
	Annotations map[string]string `json:"annotations,omitempty"`

	// NodeSelector is a selector which must be true for the pod to fit on a node.
	//
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Tolerations for the worker pods.
	//
	// +optional
	// +kubebuilder:validation:MaxItems=16
	// +listType=atomic
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// PriorityClassName for the worker pods.
	//
	// +optional
	PriorityClassName string `json:"priorityClassName,omitempty"`

	// NodeAffinity scheduling rules for the worker pods. Mapped to
	// spec.affinity.nodeAffinity on the pod.
	//
	// +optional
	NodeAffinity *corev1.NodeAffinity `json:"nodeAffinity,omitempty"`

	// Resources are the compute resources allocated for each worker pod.
	//
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

	// ServiceAccountName for the worker pods. The ServiceAccount must exist
	// in the WorkerPool's namespace. When omitted, the pods use the
	// namespace's default ServiceAccount.
	//
	// +optional
	// +kubebuilder:validation:MinLength=1
	ServiceAccountName *string `json:"serviceAccountName,omitempty"`
}

type WorkerPoolSandboxClass struct {
	// Name selects the sandbox runtime family, which drives the worker pod
	// shape (KVM/vhost device mounts and node placement). The concrete binary
	// is still selected by WorkerImage. The sandbox binaries themselves come
	// from the SandboxConfig each ActorTemplate names (required).
	//
	// See Also: TODOs in ActorTemplate SandboxClass
	//
	// +required
	// +kubebuilder:validation:Enum=gvisor;microvm
	Name SandboxClass `json:"name,omitempty"`

	// ConfigRef names a cluster-scoped SandboxConfig for this sandbox class.
	// The referenced config's SandboxClass must match Name. When omitted, the
	// pool uses the newest SandboxConfig of this class annotated
	// sandboxconfig.ate.dev/is-class-default: "true". The controller reports
	// the resolved config in status.sandboxClasses.
	//
	// +optional
	ConfigRef *SandboxConfigReference `json:"configRef,omitempty"`
}

type WorkerPoolSandboxClassStatus struct {
	// Name is the sandbox runtime family.
	//
	// +required
	// +kubebuilder:validation:Enum=gvisor;microvm
	Name SandboxClass `json:"name,omitempty"`

	// ConfigRef names the cluster-scoped SandboxConfig in use. That is the
	// config spec.sandboxClasses[].configRef names, or the class default, or
	// the last resolved config while the spec does not resolve. Omitted when
	// the class has never resolved.
	//
	// +optional
	ConfigRef *SandboxConfigReference `json:"configRef,omitempty"`

	// PendingConfigRef names the SandboxConfig the class is switching to
	// while the controller confirms it against the API server. It protects
	// the config from deletion like configRef does. The same reconcile
	// clears it, and configRef either moves to it or stays where it was.
	//
	// +optional
	PendingConfigRef *SandboxConfigReference `json:"pendingConfigRef,omitempty"`

	// Conditions describe the current state of this sandbox class.
	//
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type WorkerPoolSpec struct {
	// Replicas is the number of worker pods to run.
	// +required
	// +kubebuilder:validation:Minimum=0
	Replicas int32 `json:"replicas"`

	// WorkerImage is the ateom container image to deploy as workers.
	// +kubebuilder:validation:MinLength=1
	// +required
	WorkerImage string `json:"workerImage"`

	// Template holds optional metadata, scheduling, and resource settings for worker workloads.
	//
	// +optional
	Template *WorkerPoolPodTemplate `json:"template,omitempty"`

	// SandboxClasses lists the sandbox runtime families this pool runs. Exactly
	// one entry is allowed today. The names cannot change after creation.
	//
	// +required
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=1
	// +kubebuilder:validation:XValidation:rule="self.map(c, c.name) == oldSelf.map(c, c.name)",message="sandboxClasses names are immutable"
	// +listType=map
	// +listMapKey=name
	SandboxClasses []WorkerPoolSandboxClass `json:"sandboxClasses,omitempty"`
}

type WorkerPoolStatus struct {
	// Replicas is the total number of worker pods.
	// +kubebuilder:validation:Minimum=0
	// +optional
	Replicas int32 `json:"replicas"`

	// ReadyReplicas is the number of ready worker pods.
	// +kubebuilder:validation:Minimum=0
	// +optional
	ReadyReplicas int32 `json:"readyReplicas,omitempty"`

	// Selector is the label selector for the worker pods.
	// +optional
	Selector string `json:"selector,omitempty"`

	// SandboxClasses reports the SandboxConfig each sandbox class of the pool
	// uses and whether the class's spec resolves.
	//
	// +optional
	// +kubebuilder:validation:MaxItems=1
	// +listType=map
	// +listMapKey=name
	SandboxClasses []WorkerPoolSandboxClassStatus `json:"sandboxClasses,omitempty"`
}