v1alpha1

type ArchivalSpec struct {
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	History *runtime.RawExtension `json:"history,omitempty"`
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Visibility *runtime.RawExtension `json:"visibility,omitempty"`
}

type AuthorizationSpec struct {
	// +optional
	Authorizer string `json:"authorizer,omitempty"`
	// +optional
	ClaimMapper string `json:"claimMapper,omitempty"`
	// Config is a passthrough for authorization provider configuration.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Config *runtime.RawExtension `json:"config,omitempty"`
}

type CassandraDatastoreSpec struct {
	// +kubebuilder:validation:MinItems=1
	Hosts []string `json:"hosts"`

	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +kubebuilder:default=9042
	Port int32 `json:"port"`

	Keyspace string `json:"keyspace"`

	// +optional
	User string `json:"user,omitempty"`

	// +optional
	PasswordSecretRef *SecretKeyReference `json:"passwordSecretRef,omitempty"`

	// +optional
	Datacenter string `json:"datacenter,omitempty"`

	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=1
	// +optional
	Replicas int32 `json:"replicationFactor,omitempty"`

	// +optional
	TLS *DatastoreTLSSpec `json:"tls,omitempty"`
}

type CertificateAuthoritySpec struct {
	// +optional
	SecretName string `json:"secretName,omitempty"`
	// +optional
	Duration *metav1.Duration `json:"duration,omitempty"`
}

type ClusterMetadataSpec struct {
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Raw *runtime.RawExtension `json:"raw,omitempty"`
}

type DatastoreSpec struct {
	// +optional
	SQL *SQLDatastoreSpec `json:"sql,omitempty"`
	// +optional
	Cassandra *CassandraDatastoreSpec `json:"cassandra,omitempty"`
	// +optional
	Elasticsearch *ElasticsearchDatastoreSpec `json:"elasticsearch,omitempty"`

	// SchemaVersion is either "auto" (operator-managed migrations) or a pinned
	// schema version string.
	// +kubebuilder:default="auto"
	// +optional
	SchemaVersion string `json:"schemaVersion,omitempty"`
}

type DatastoreTLSSpec struct {
	// +kubebuilder:default=true
	Enabled bool `json:"enabled"`

	// +optional
	CASecretRef *SecretKeyReference `json:"caSecretRef,omitempty"`
	// +optional
	CertSecretRef *SecretKeyReference `json:"certSecretRef,omitempty"`
	// +optional
	KeySecretRef *SecretKeyReference `json:"keySecretRef,omitempty"`

	// +optional
	EnableHostVerification bool `json:"enableHostVerification,omitempty"`
	// +optional
	ServerName string `json:"serverName,omitempty"`
}

type DynamicConfigConstraints struct {
	// +optional
	Namespace string `json:"namespace,omitempty"`
	// +optional
	TaskQueueName string `json:"taskQueueName,omitempty"`
	// +optional
	TaskQueueType string `json:"taskQueueType,omitempty"`
}

type DynamicConfigSpec struct {
	// Values maps a dynamic config key to one or more constrained values.
	// +optional
	Values map[string][]DynamicConfigValue `json:"values,omitempty"`
}

type DynamicConfigValue struct {
	// Value is an arbitrary JSON value for the dynamic config key.
	// +kubebuilder:pruning:PreserveUnknownFields
	Value runtime.RawExtension `json:"value"`

	// +optional
	Constraints *DynamicConfigConstraints `json:"constraints,omitempty"`
}

type ElasticsearchDatastoreSpec struct {
	URL string `json:"url"`

	// +kubebuilder:validation:Enum=v7;v8
	// +kubebuilder:default=v8
	Version string `json:"version"`

	// +optional
	Username string `json:"username,omitempty"`

	// +optional
	PasswordSecretRef *SecretKeyReference `json:"passwordSecretRef,omitempty"`

	// +optional
	Indices map[string]string `json:"indices,omitempty"`

	// +optional
	TLS *DatastoreTLSSpec `json:"tls,omitempty"`
}

type EndpointsStatus struct {
	// +optional
	Frontend string `json:"frontend,omitempty"`
	// +optional
	UI string `json:"ui,omitempty"`
	// +optional
	Metrics string `json:"metrics,omitempty"`
}

type FrontendMTLSSpec struct {
	// +optional
	SecretName string `json:"secretName,omitempty"`
	// +optional
	DNSNames []string `json:"dnsNames,omitempty"`
}

type InternalFrontendSpec struct {
	// +kubebuilder:default=false
	Enabled bool `json:"enabled"`
	// +kubebuilder:default=1
	// +kubebuilder:validation:Minimum=1
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`
}

type IssuerReference struct {
	Name string `json:"name"`
	// +kubebuilder:validation:Enum=Issuer;ClusterIssuer
	// +kubebuilder:default=Issuer
	// +optional
	Kind string `json:"kind,omitempty"`
	// +kubebuilder:default="cert-manager.io"
	// +optional
	Group string `json:"group,omitempty"`
}

type MTLSSpec struct {
	// Provider selects the certificate provider.
	// +kubebuilder:validation:Enum=cert-manager
	// +kubebuilder:default=cert-manager
	Provider string `json:"provider"`

	// IssuerRef references the cert-manager issuer used to mint certificates.
	// Required when provider is cert-manager.
	// +optional
	IssuerRef *IssuerReference `json:"issuerRef,omitempty"`

	// InternodeCA configures the internode certificate authority.
	// +optional
	InternodeCA *CertificateAuthoritySpec `json:"internodeCA,omitempty"`

	// Frontend configures the frontend certificate.
	// +optional
	Frontend *FrontendMTLSSpec `json:"frontend,omitempty"`

	// RefreshInterval is the certificate refresh interval.
	// +kubebuilder:default="720h"
	// +optional
	RefreshInterval *metav1.Duration `json:"refreshInterval,omitempty"`

	// RenewBefore is how long before expiry a certificate is renewed.
	// +kubebuilder:default="240h"
	// +optional
	RenewBefore *metav1.Duration `json:"renewBefore,omitempty"`
}

type MetricsSpec struct {
	// +kubebuilder:default=true
	Enabled bool `json:"enabled"`

	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +kubebuilder:default=9090
	// +optional
	Port int32 `json:"port,omitempty"`

	// +optional
	ServiceMonitor *ServiceMonitorSpec `json:"serviceMonitor,omitempty"`
}

type PersistenceSpec struct {
	// DefaultStore holds workflow execution state. Exactly one of sql or
	// cassandra must be set.
	// +kubebuilder:validation:XValidation:rule="has(self.sql) != has(self.cassandra)",message="exactly one of sql or cassandra must be set for defaultStore"
	DefaultStore DatastoreSpec `json:"defaultStore"`

	// VisibilityStore holds visibility records. One of sql, cassandra, or
	// elasticsearch must be set.
	VisibilityStore DatastoreSpec `json:"visibilityStore"`
}

type PersistenceStatus struct {
	// SchemaVersions maps a store name to its observed schema version.
	// +optional
	SchemaVersions map[string]string `json:"schemaVersions,omitempty"`

	// History records schema upgrades applied by the operator.
	// +optional
	History []SchemaUpgradeRecord `json:"history,omitempty"`

	// Reachable indicates whether the datastores were reachable at last reconcile.
	// +optional
	Reachable bool `json:"reachable,omitempty"`
}

type PodTemplateOverride struct {
	// +optional
	Labels map[string]string `json:"labels,omitempty"`
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
	// Spec is a partial PodSpec (strategic-merge patch) merged onto the
	// generated pod template. It is stored as an opaque object to keep the
	// CRD schema small.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Spec *runtime.RawExtension `json:"spec,omitempty"`
}

type SQLDatastoreSpec struct {
	// PluginName selects the SQL driver.
	// +kubebuilder:validation:Enum=postgres12;postgres12_pgx;mysql8
	// +kubebuilder:default=postgres12
	PluginName string `json:"pluginName"`

	Host string `json:"host"`

	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +kubebuilder:default=5432
	Port int32 `json:"port"`

	Database string `json:"database"`

	User string `json:"user"`

	// PasswordSecretRef references a secret containing the password. Required
	// for password authentication.
	// +optional
	PasswordSecretRef *SecretKeyReference `json:"passwordSecretRef,omitempty"`

	// PasswordCommandSecretRef references a secret holding a command that emits
	// a short-lived credential (Temporal 1.31+ IAM auth).
	// +optional
	PasswordCommandSecretRef *SecretKeyReference `json:"passwordCommandSecretRef,omitempty"`

	// +optional
	ConnectAttributes map[string]string `json:"connectAttributes,omitempty"`

	// +kubebuilder:validation:Minimum=1
	// +optional
	MaxConns int32 `json:"maxConns,omitempty"`

	// +kubebuilder:validation:Minimum=1
	// +optional
	MaxIdleConns int32 `json:"maxIdleConns,omitempty"`

	// +optional
	MaxConnLifetime *metav1.Duration `json:"maxConnLifetime,omitempty"`

	// +optional
	TLS *DatastoreTLSSpec `json:"tls,omitempty"`
}

type SchemaUpgradeRecord struct {
	Store       string      `json:"store"`
	FromVersion string      `json:"fromVersion"`
	ToVersion   string      `json:"toVersion"`
	Time        metav1.Time `json:"time"`
}

type SecretKeyReference struct {
	Name string `json:"name"`
	// +kubebuilder:default=password
	// +optional
	Key string `json:"key,omitempty"`
}

type ServiceExposureSpec struct {
	// +kubebuilder:validation:Enum=ClusterIP;NodePort;LoadBalancer
	// +kubebuilder:default=ClusterIP
	// +optional
	Type corev1.ServiceType `json:"type,omitempty"`
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
}

type ServiceMonitorSpec struct {
	// +kubebuilder:default=false
	Enabled bool `json:"enabled"`
	// +optional
	Interval *metav1.Duration `json:"interval,omitempty"`
	// +optional
	Labels map[string]string `json:"labels,omitempty"`
}

type ServiceOverrides struct {
	// +optional
	PodTemplate *PodTemplateOverride `json:"podTemplate,omitempty"`
}

type ServiceSpec struct {
	// +kubebuilder:default=1
	// +kubebuilder:validation:Minimum=1
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`
	// +optional
	PodTemplate *PodTemplateOverride `json:"podTemplate,omitempty"`
	// +optional
	Service *ServiceExposureSpec `json:"service,omitempty"`
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`
	// +optional
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
}

type ServiceStatus struct {
	// +optional
	Ready int32 `json:"ready"`
	// +optional
	Desired int32 `json:"desired"`
	// +optional
	Version string `json:"version,omitempty"`
}

type ServicesSpec struct {
	// +optional
	Frontend *ServiceSpec `json:"frontend,omitempty"`
	// +optional
	History *ServiceSpec `json:"history,omitempty"`
	// +optional
	Matching *ServiceSpec `json:"matching,omitempty"`
	// +optional
	Worker *ServiceSpec `json:"worker,omitempty"`
	// +optional
	InternalFrontend *InternalFrontendSpec `json:"internalFrontend,omitempty"`
	// Overrides are applied to every service unless overridden per-service.
	// +optional
	Overrides *ServiceOverrides `json:"overrides,omitempty"`
}

type TemporalCluster struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of TemporalCluster
	// +required
	Spec TemporalClusterSpec `json:"spec"`

	// status defines the observed state of TemporalCluster
	// +optional
	Status TemporalClusterStatus `json:"status,omitzero"`
}

type TemporalClusterClient struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of TemporalClusterClient
	// +required
	Spec TemporalClusterClientSpec `json:"spec"`

	// status defines the observed state of TemporalClusterClient
	// +optional
	Status TemporalClusterClientStatus `json:"status,omitzero"`
}

type TemporalClusterClientList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []TemporalClusterClient `json:"items"`
}

type TemporalClusterClientSpec struct {
	// ClusterRef references the TemporalCluster to generate client credentials for.
	ClusterRef corev1.LocalObjectReference `json:"clusterRef"`

	// SecretName is the name of the Secret to write generated client credentials into.
	// Defaults to the resource name when empty.
	// +optional
	SecretName string `json:"secretName,omitempty"`
}

type TemporalClusterClientStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// SecretRef references the generated credentials Secret.
	// +optional
	SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`

	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type TemporalClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []TemporalCluster `json:"items"`
}

type TemporalClusterSpec struct {
	// Version is the Temporal server version, e.g. "1.31.1".
	// +kubebuilder:validation:Pattern=`^\d+\.\d+\.\d+$`
	Version string `json:"version"`

	// NumHistoryShards is the number of history shards. IMMUTABLE after creation.
	// Choose carefully: 512 small prod, 4096 large prod.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=16384
	// +kubebuilder:default=512
	NumHistoryShards int32 `json:"numHistoryShards"`

	// Image is the Temporal server image. Default: temporalio/server:<Version>.
	// +optional
	Image string `json:"image,omitempty"`

	// ImagePullSecrets references secrets for pulling the server image.
	// +optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`

	// Services configures each Temporal service.
	// +optional
	Services ServicesSpec `json:"services,omitempty"`

	// Persistence configures the default and visibility datastores. Required.
	Persistence PersistenceSpec `json:"persistence"`

	// MTLS configures mutual TLS (cert-manager-driven by default).
	// +optional
	MTLS *MTLSSpec `json:"mtls,omitempty"`

	// DynamicConfig is a passthrough for Temporal's dynamic config.
	// +optional
	DynamicConfig *DynamicConfigSpec `json:"dynamicConfig,omitempty"`

	// UI configures temporal-ui as part of this cluster.
	// +optional
	UI *UISpec `json:"ui,omitempty"`

	// Metrics configures Prometheus integration.
	// +optional
	Metrics *MetricsSpec `json:"metrics,omitempty"`

	// Archival configures cluster-wide archival enablement.
	// +optional
	Archival *ArchivalSpec `json:"archival,omitempty"`

	// Authorization configures the authorizer and claim mapper.
	// +optional
	Authorization *AuthorizationSpec `json:"authorization,omitempty"`

	// ClusterMetadata is a passthrough for multi-cluster setup.
	// +optional
	ClusterMetadata *ClusterMetadataSpec `json:"clusterMetadata,omitempty"`

	// PreventDeletion, when true, blocks deletion of the cluster via the
	// validating webhook as a safety measure.
	// +optional
	PreventDeletion bool `json:"preventDeletion,omitempty"`
}

type TemporalClusterStatus struct {
	// Phase is a coarse, human-friendly summary of the cluster lifecycle.
	// +optional
	Phase string `json:"phase,omitempty"`

	// ObservedGeneration is the most recent generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the TemporalCluster resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Version is the currently-running Temporal server version.
	// +optional
	Version string `json:"version,omitempty"`

	// NumHistoryShards as observed from the database, not the spec.
	// +optional
	NumHistoryShards int32 `json:"numHistoryShards,omitempty"`

	// Services reports per-service readiness keyed by service name.
	// +optional
	Services map[string]ServiceStatus `json:"services,omitempty"`

	// Persistence reports datastore reachability and schema state.
	// +optional
	Persistence PersistenceStatus `json:"persistence,omitempty"`

	// Endpoints reports the resolved service endpoints.
	// +optional
	Endpoints EndpointsStatus `json:"endpoints,omitempty"`

	// Upgrade reports the state of an in-progress version upgrade, if any.
	// +optional
	Upgrade *UpgradeStatus `json:"upgrade,omitempty"`
}

type TemporalNamespace struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of TemporalNamespace
	// +required
	Spec TemporalNamespaceSpec `json:"spec"`

	// status defines the observed state of TemporalNamespace
	// +optional
	Status TemporalNamespaceStatus `json:"status,omitzero"`
}

type TemporalNamespaceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []TemporalNamespace `json:"items"`
}

type TemporalNamespaceSpec struct {
	// ClusterRef references the TemporalCluster that owns this namespace.
	ClusterRef corev1.LocalObjectReference `json:"clusterRef"`

	// RetentionPeriod is how long closed workflows are retained.
	// +kubebuilder:default="72h"
	// +optional
	RetentionPeriod *metav1.Duration `json:"retentionPeriod,omitempty"`

	// Description is a human-friendly description of the namespace.
	// +optional
	Description string `json:"description,omitempty"`

	// OwnerEmail is the owner contact for the namespace.
	// +optional
	OwnerEmail string `json:"ownerEmail,omitempty"`

	// AllowDeletion permits the operator to delete the Temporal namespace when
	// the CR is deleted. When false, the namespace is left in place.
	// +optional
	AllowDeletion bool `json:"allowDeletion,omitempty"`

	// DriftDetection controls whether the operator reconciles drift between the
	// spec and the live namespace.
	// +kubebuilder:validation:Enum=reconcile;ignore
	// +kubebuilder:default=reconcile
	// +optional
	DriftDetection string `json:"driftDetection,omitempty"`
}

type TemporalNamespaceStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Registered indicates whether the namespace exists in the Temporal cluster.
	// +optional
	Registered bool `json:"registered,omitempty"`

	// NamespaceID is the Temporal-assigned namespace UUID.
	// +optional
	NamespaceID string `json:"namespaceID,omitempty"`

	// LastUpdated is when the operator last reconciled the namespace.
	// +optional
	LastUpdated *metav1.Time `json:"lastUpdated,omitempty"`

	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type TemporalSearchAttribute struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of TemporalSearchAttribute
	// +required
	Spec TemporalSearchAttributeSpec `json:"spec"`

	// status defines the observed state of TemporalSearchAttribute
	// +optional
	Status TemporalSearchAttributeStatus `json:"status,omitzero"`
}

type TemporalSearchAttributeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []TemporalSearchAttribute `json:"items"`
}

type TemporalSearchAttributeSpec struct {
	// ClusterRef references the TemporalCluster this search attribute belongs to.
	ClusterRef corev1.LocalObjectReference `json:"clusterRef"`

	// Namespace is the Temporal namespace to register the attribute in.
	Namespace string `json:"namespace"`

	// Name is the search attribute name.
	Name string `json:"name"`

	// Type is the search attribute type. Immutable once created.
	// +kubebuilder:validation:Enum=Keyword;Text;Int;Double;Bool;Datetime;KeywordList
	Type string `json:"type"`

	// AllowDeletion permits the operator to remove the search attribute from the
	// namespace when the CR is deleted.
	// +optional
	AllowDeletion bool `json:"allowDeletion,omitempty"`
}

type TemporalSearchAttributeStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Registered indicates whether the attribute has been registered with the cluster.
	// +optional
	Registered bool `json:"registered,omitempty"`

	// RegisteredAt is when the attribute was registered.
	// +optional
	RegisteredAt *metav1.Time `json:"registeredAt,omitempty"`

	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type UICodecServerSpec struct {
	Endpoint string `json:"endpoint"`
	// +optional
	PassAccessToken bool `json:"passAccessToken,omitempty"`
	// +optional
	IncludeCredentials bool `json:"includeCredentials,omitempty"`
}

type UIIngressSpec struct {
	// +kubebuilder:default=false
	Enabled bool `json:"enabled"`
	// +optional
	IngressClassName string `json:"ingressClassName,omitempty"`
	// +optional
	Host string `json:"host,omitempty"`
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
	// +optional
	TLSSecretName string `json:"tlsSecretName,omitempty"`
}

type UISpec struct {
	// +kubebuilder:default=false
	Enabled bool `json:"enabled"`

	// +optional
	Version string `json:"version,omitempty"`

	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=1
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`

	// +optional
	Ingress *UIIngressSpec `json:"ingress,omitempty"`

	// Auth is a passthrough for temporal-ui authentication config.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Auth *runtime.RawExtension `json:"auth,omitempty"`

	// +optional
	CodecServer *UICodecServerSpec `json:"codecServer,omitempty"`
}

type UpgradeStatus struct {
	// +optional
	FromVersion string `json:"fromVersion,omitempty"`
	// +optional
	ToVersion string `json:"toVersion,omitempty"`
	// +optional
	Phase string `json:"phase,omitempty"`
	// Rollbackable is true until schema migration begins, after which a
	// rollback is no longer safe.
	// +optional
	Rollbackable bool `json:"rollbackable,omitempty"`
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`
}