v1alpha1

type ApplicationNetworkPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ApplicationNetworkPolicySpec   `json:"spec,omitempty"`
	Status ApplicationNetworkPolicyStatus `json:"status,omitempty"`
}

type ApplicationNetworkPolicyEgressRule struct {
	// Ports is a list of destination ports for outgoing traffic.
	// Each item in this list is combined using a logical OR. If this field is
	// empty or missing, this rule matches all ports (traffic not restricted by port).
	// If this field is present and contains at least one item, then this rule allows
	// traffic only if the traffic matches at least one port in the list.
	// +optional
	Ports []networking.NetworkPolicyPort `json:"ports,omitempty"`

	// To is a list of destinations for outgoing traffic of pods selected for this rule.
	// Items in this list are combined using a logical OR operation. If this field is
	// empty or missing, this rule matches all destinations (traffic not restricted by
	// destination). If this field is present and contains at least one item, this rule
	// allows traffic only if the traffic matches at least one item in the to list.
	// +optional
	To []ApplicationNetworkPolicyPeer `json:"to,omitempty"`
}

type ApplicationNetworkPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ApplicationNetworkPolicy `json:"items"`
}

type ApplicationNetworkPolicyPeer struct {
	// PodSelector is a label selector which selects pods. This field follows standard label
	// selector semantics; if present but empty, it selects all pods.
	//
	// If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
	// the pods matching podSelector in the Namespaces selected by NamespaceSelector.
	// Otherwise it selects the pods matching podSelector in the policy's own namespace.
	// +optional
	PodSelector *metav1.LabelSelector `json:"podSelector,omitempty"`

	// NamespaceSelector selects namespaces using cluster-scoped labels. This field follows
	// standard label selector semantics; if present but empty, it selects all namespaces.
	//
	// If podSelector is also set, then the NetworkPolicyPeer as a whole selects
	// the pods matching podSelector in the namespaces selected by namespaceSelector.
	// Otherwise it selects all pods in the namespaces selected by namespaceSelector.
	// +optional
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

	// IPBlock defines policy on a particular IPBlock. If this field is set then
	// neither of the other fields can be.
	// +optional
	IPBlock *networking.IPBlock `json:"ipBlock,omitempty"`

	// DomainNames provides a way to specify domain names as peers.
	//
	// DomainNames is only supported for Allow rules. In order to control
	// access, DomainNames Allow rules should be used with a lower priority
	// egress deny -- this allows the admin to maintain an explicit "allowlist"
	// of reachable domains.
	//
	// This field is mutually exclusive with PodSelector, NamespaceSelector, and IPBlock.
	// FQDN rules are ALLOW-only and do not support DENY semantics.
	//
	// +optional
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	DomainNames []DomainName `json:"domainNames,omitempty"`
}

type ApplicationNetworkPolicySpec struct {
	// PodSelector selects the pods to which this ApplicationNetworkPolicy object applies.
	PodSelector metav1.LabelSelector `json:"podSelector"`

	// PolicyTypes is a list of rule types that the ApplicationNetworkPolicy relates to.
	// Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"].
	// If this field is not specified, it will default based on the existence of ingress or egress rules.
	// +optional
	PolicyTypes []networking.PolicyType `json:"policyTypes,omitempty"`

	// Ingress is a list of ingress rules to be applied to the selected pods.
	// Traffic is allowed to a pod if there are no ApplicationNetworkPolicies selecting the pod
	// (and cluster policy otherwise allows the traffic), OR if the traffic source is
	// the pod's local node, OR if the traffic matches at least one ingress rule
	// across all of the ApplicationNetworkPolicy objects whose podSelector matches the pod.
	// +optional
	Ingress []networking.NetworkPolicyIngressRule `json:"ingress,omitempty"`

	// Egress is a list of egress rules to be applied to the selected pods. Outgoing traffic
	// is allowed if there are no ApplicationNetworkPolicies selecting the pod (and cluster policy
	// otherwise allows the traffic), OR if the traffic matches at least one egress rule
	// across all of the ApplicationNetworkPolicy objects whose podSelector matches the pod.
	// +optional
	Egress []ApplicationNetworkPolicyEgressRule `json:"egress,omitempty"`
}

type ApplicationNetworkPolicyStatus struct {
	// Conditions represent the latest available observations of the ApplicationNetworkPolicy's current state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type CIDR string

type CNPPort struct {
	// Protocol is the network protocol (TCP, UDP, or SCTP) which traffic must
	// match. If not specified, this field defaults to TCP.
	// +kubebuilder:default=TCP
	Protocol corev1.Protocol `json:"protocol"`

	// Port defines a network port value.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port int32 `json:"port"`
}

type CNPPortRange struct {
	// Protocol is the network protocol (TCP, UDP, or SCTP) which traffic must
	// match. If not specified, this field defaults to TCP.
	// +kubebuilder:default=TCP
	Protocol corev1.Protocol `json:"protocol,omitempty"`

	// Start defines a network port that is the start of a port range, the Start
	// value must be less than End.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Start int32 `json:"start"`

	// End defines a network port that is the end of a port range, the End value
	// must be greater than Start.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	End int32 `json:"end"`
}

type ClusterEndpointInfo struct {
	// CIDR is the network address(s) of the endpoint
	CIDR NetworkAddress `json:"cidr,omitempty"`

	// Ports is the list of ports
	Ports []Port `json:"ports,omitempty"`

	// DomainName is the FQDN for the endpoint (egress-only)
	DomainName DomainName `json:"domainName,omitempty"`

	// Action from the CNP rule
	Action ClusterNetworkPolicyRuleAction `json:"action"`
}

type ClusterNetworkPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterNetworkPolicySpec   `json:"spec,omitempty"`
	Status ClusterNetworkPolicyStatus `json:"status,omitempty"`
}

type ClusterNetworkPolicyEgressPeer struct {
	// Namespaces defines a way to select all pods within a set of Namespaces.
	// Note that host-networked pods are not included in this type of peer.
	//
	// +optional
	Namespaces *metav1.LabelSelector `json:"namespaces,omitempty"`
	// Pods defines a way to select a set of pods in
	// a set of namespaces. Note that host-networked pods
	// are not included in this type of peer.
	//
	// +optional
	Pods *NamespacedPod `json:"pods,omitempty"`
	// Networks defines a way to select peers via CIDR blocks.
	//
	// +optional
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=25
	Networks []CIDR `json:"networks,omitempty"`

	// DomainNames provides a way to specify domain names as peers.
	// DomainNames support Accept and Pass actions (our extension from upstream)
	// Upstream CNP only supports Accept for domainNames, we add Pass support
	//
	// +optional
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=25
	DomainNames []DomainName `json:"domainNames,omitempty"`
}

type ClusterNetworkPolicyEgressRule struct {
	// Name is an identifier for this rule, that may be no more than
	// 100 characters in length. This field should be used by the implementation
	// to help improve observability, readability and error-reporting
	// for any applied AdminNetworkPolicies.
	//
	// +optional
	// +kubebuilder:validation:MaxLength=100
	Name string `json:"name,omitempty"`

	// Action specifies the effect this rule will have on matching traffic.
	Action ClusterNetworkPolicyRuleAction `json:"action"`

	// To is the List of destinations whose traffic this rule applies to.
	// If any element matches the destination of outgoing
	// traffic then the specified action is applied.
	// This field must be defined and contain at least one item.
	//
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	To []ClusterNetworkPolicyEgressPeer `json:"to"`

	// Ports allows for matching traffic based on port and protocols.
	// This field is a list of destination ports for the outgoing egress traffic.
	// If Ports is not set then the rule does not filter traffic via port.
	//
	// +optional
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	Ports *[]ClusterNetworkPolicyPort `json:"ports,omitempty"`
}

type ClusterNetworkPolicyIngressPeer struct {
	// Namespaces defines a way to select all pods within a set of Namespaces.
	// Note that host-networked pods are not included in this type of peer.
	//
	// +optional
	Namespaces *metav1.LabelSelector `json:"namespaces,omitempty"`
	// Pods defines a way to select a set of pods in
	// a set of namespaces. Note that host-networked pods
	// are not included in this type of peer.
	//
	// +optional
	Pods *NamespacedPod `json:"pods,omitempty"`
}

type ClusterNetworkPolicyIngressRule struct {
	// Name is an identifier for this rule, that may be no more than
	// 100 characters in length. This field should be used by the implementation
	// to help improve observability, readability and error-reporting
	// for any applied AdminNetworkPolicies.
	//
	// +optional
	// +kubebuilder:validation:MaxLength=100
	Name string `json:"name,omitempty"`

	// Action specifies the effect this rule will have on matching traffic.
	Action ClusterNetworkPolicyRuleAction `json:"action"`

	// From is the list of sources whose traffic this rule applies to.
	// If any element matches the source of incoming
	// traffic then the specified action is applied.
	// This field must be defined and contain at least one item.
	//
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	From []ClusterNetworkPolicyIngressPeer `json:"from"`

	// Ports allows for matching traffic based on port and protocols.
	// This field is a list of ports which should be matched on
	// the pods selected for this policy i.e the subject of the policy.
	// So it matches on the destination port for the ingress traffic.
	// If Ports is not set then the rule does not filter traffic via port.
	//
	// +optional
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	Ports *[]ClusterNetworkPolicyPort `json:"ports,omitempty"`
}

type ClusterNetworkPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterNetworkPolicy `json:"items"`
}

type ClusterNetworkPolicyPort struct {
	// +optional
	PortNumber *CNPPort `json:"portNumber,omitempty"`
	// +optional
	PortRange *CNPPortRange `json:"portRange,omitempty"`
	// +optional
	NamedPort *string `json:"namedPort,omitempty"`
}

type ClusterNetworkPolicyRuleAction string

type ClusterNetworkPolicySpec struct {
	// Tier specifies the policy tier (Admin, Baseline)
	// +kubebuilder:validation:Enum={"Admin", "Baseline"}
	Tier Tier `json:"tier"`

	// Priority within the tier (0-1000, lower = higher precedence)
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=1000
	Priority int32 `json:"priority"`

	// Subject defines which pods this policy applies to
	Subject ClusterNetworkPolicySubject `json:"subject"`

	// Ingress rules
	// +optional
	// +kubebuilder:validation:MaxItems=100
	Ingress []ClusterNetworkPolicyIngressRule `json:"ingress,omitempty"`

	// Egress rules
	// +optional
	// +kubebuilder:validation:MaxItems=100
	Egress []ClusterNetworkPolicyEgressRule `json:"egress,omitempty"`
}

type ClusterNetworkPolicyStatus struct {
	// Conditions represent the latest available observations of the ClusterNetworkPolicy's current state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type ClusterNetworkPolicySubject struct {
	// Namespaces is used to select pods via namespace selectors.
	// +optional
	Namespaces *metav1.LabelSelector `json:"namespaces,omitempty"`
	// Pods is used to select pods via namespace AND pod selectors.
	// +optional
	Pods *NamespacedPod `json:"pods,omitempty"`
}

type ClusterPolicyEndpoint struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterPolicyEndpointSpec   `json:"spec,omitempty"`
	Status ClusterPolicyEndpointStatus `json:"status,omitempty"`
}

type ClusterPolicyEndpointList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterPolicyEndpoint `json:"items"`
}

type ClusterPolicyEndpointSpec struct {
	// PolicyRef is a reference to the Kubernetes ClusterNetworkPolicy resource.
	PolicyRef ClusterPolicyReference `json:"policyRef"`

	// Tier from the CNP
	Tier Tier `json:"tier"`

	// Priority from the CNP
	Priority int32 `json:"priority"`

	// PodSelectorEndpoints contains information about the pods
	// matching the policy across all namespaces
	PodSelectorEndpoints []PodEndpoint `json:"podSelectorEndpoints,omitempty"`

	// Ingress is the list of ingress rules containing resolved network addresses
	Ingress []ClusterEndpointInfo `json:"ingress,omitempty"`

	// Egress is the list of egress rules containing resolved network addresses
	Egress []ClusterEndpointInfo `json:"egress,omitempty"`
}

type ClusterPolicyEndpointStatus struct {
}

type ClusterPolicyReference struct {
	// Name is the name of the ClusterNetworkPolicy
	Name string `json:"name"`
}

type DomainName string

type EndpointInfo struct {
	// CIDR is the network address(s) of the endpoint
	CIDR NetworkAddress `json:"cidr,omitempty"`

	// Except is the exceptions to the CIDR ranges mentioned above.
	Except []NetworkAddress `json:"except,omitempty"`

	// Ports is the list of ports
	Ports []Port `json:"ports,omitempty"`

	// DomainName is the FQDN for the endpoint (mutually exclusive with CIDR, egress-only)
	// Note: This field should only be used in egress rules, not ingress
	DomainName DomainName `json:"domainName,omitempty"`
}

type NamespacedPod struct {
	// NamespaceSelector follows standard label selector semantics; if empty,
	// it selects all Namespaces.
	NamespaceSelector metav1.LabelSelector `json:"namespaceSelector"`

	// PodSelector is used to explicitly select pods within a namespace;
	// if empty, it selects all Pods.
	PodSelector metav1.LabelSelector `json:"podSelector"`
}

type NetworkAddress string

type PodEndpoint struct {
	// HostIP is the IP address of the host the pod is currently running on
	HostIP NetworkAddress `json:"hostIP"`
	// PodIP is the IP address of the pod
	PodIP NetworkAddress `json:"podIP"`
	// Name is the pod name
	Name string `json:"name"`
	// Namespace is the pod namespace
	Namespace string `json:"namespace"`
}

type PolicyEndpoint struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   PolicyEndpointSpec   `json:"spec,omitempty"`
	Status PolicyEndpointStatus `json:"status,omitempty"`
}

type PolicyEndpointList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []PolicyEndpoint `json:"items"`
}

type PolicyEndpointSpec struct {
	// PodSelector is the podSelector from the policy resource
	PodSelector *metav1.LabelSelector `json:"podSelector,omitempty"`

	// PolicyRef is a reference to the Kubernetes NetworkPolicy resource.
	PolicyRef PolicyReference `json:"policyRef"`

	// PodIsolation specifies whether the pod needs to be isolated for a
	// particular traffic direction Ingress or Egress, or both. If default isolation is not
	// specified, and there are no ingress/egress rules, then the pod is not isolated
	// from the point of view of this policy. This follows the NetworkPolicy spec.PolicyTypes.
	PodIsolation []networking.PolicyType `json:"podIsolation,omitempty"`

	// PodSelectorEndpoints contains information about the pods
	// matching the podSelector
	PodSelectorEndpoints []PodEndpoint `json:"podSelectorEndpoints,omitempty"`

	// Ingress is the list of ingress rules containing resolved network addresses
	Ingress []EndpointInfo `json:"ingress,omitempty"`

	// Egress is the list of egress rules containing resolved network addresses
	Egress []EndpointInfo `json:"egress,omitempty"`
}

type PolicyEndpointStatus struct {
}

type PolicyReference struct {
	// Name is the name of the Policy
	Name string `json:"name"`

	// Namespace is the namespace of the Policy
	Namespace string `json:"namespace"`
}

type Port struct {
	// Protocol specifies the transport protocol, default TCP
	// +default="TCP"
	Protocol *corev1.Protocol `json:"protocol,omitempty"`

	// Port specifies the numerical port for the protocol. If empty applies to all ports
	Port *int32 `json:"port,omitempty"`

	// Endport specifies the port range port to endPort
	// port must be defined and an integer, endPort > port
	EndPort *int32 `json:"endPort,omitempty"`
}

type Tier string