v1alpha1

type CertSecretSelector struct {
	// Name is the Secret name.
	Name string `json:"name"`
	// Key is the key within the Secret data map.
	Key string `json:"key"`
}

type CertsSpec struct {
	// Secrets lists Secret key selectors for CA certificates.
	// Each is mounted at `/etc/ssl/certs/{name}.crt`.
	Secrets []CertSecretSelector `json:"secrets,omitempty"`
}

type CoderControlPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CoderControlPlaneSpec   `json:"spec,omitempty"`
	Status CoderControlPlaneStatus `json:"status,omitempty"`
}

type CoderControlPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CoderControlPlane `json:"items"`
}

type CoderControlPlaneSpec struct {
	// Image is the container image used for the Coder control plane pod.
	// +kubebuilder:default="ghcr.io/coder/coder:latest"
	Image string `json:"image,omitempty"`
	// Replicas is the desired number of control plane pods.
	// +kubebuilder:default=1
	Replicas *int32 `json:"replicas,omitempty"`
	// Service controls the service created in front of the control plane.
	// +kubebuilder:default={}
	Service ServiceSpec `json:"service,omitempty"`
	// ExtraArgs are appended to the default Coder server arguments.
	ExtraArgs []string `json:"extraArgs,omitempty"`
	// ExtraEnv are injected into the Coder control plane container.
	ExtraEnv []corev1.EnvVar `json:"extraEnv,omitempty"`
	// ImagePullSecrets are used by the pod to pull private images.
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
	// OperatorAccess configures bootstrap API access to the coderd instance.
	// +kubebuilder:default={}
	OperatorAccess OperatorAccessSpec `json:"operatorAccess,omitempty"`
	// LicenseSecretRef references a Secret key containing a Coder Enterprise
	// license JWT. When set, the controller uploads the license after the
	// control plane is ready and re-uploads when the Secret value changes.
	// +optional
	LicenseSecretRef *SecretKeySelector `json:"licenseSecretRef,omitempty"`

	// ServiceAccount configures the ServiceAccount for the control plane pod.
	// +kubebuilder:default={}
	ServiceAccount ServiceAccountSpec `json:"serviceAccount,omitempty"`
	// RBAC configures namespace-scoped RBAC for workspace provisioning.
	// +kubebuilder:default={}
	RBAC RBACSpec `json:"rbac,omitempty"`

	// Resources sets resource requests/limits for the control plane container.
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
	// SecurityContext sets the container security context.
	// +optional
	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`
	// PodSecurityContext sets the pod-level security context.
	// +optional
	PodSecurityContext *corev1.PodSecurityContext `json:"podSecurityContext,omitempty"`

	// TLS configures Coder built-in TLS.
	// +kubebuilder:default={}
	TLS TLSSpec `json:"tls,omitempty"`

	// ReadinessProbe configures the readiness probe for the control plane container.
	// +kubebuilder:default={enabled:true}
	ReadinessProbe ProbeSpec `json:"readinessProbe,omitempty"`
	// LivenessProbe configures the liveness probe for the control plane container.
	// +kubebuilder:default={enabled:false}
	LivenessProbe ProbeSpec `json:"livenessProbe,omitempty"`

	// EnvUseClusterAccessURL injects a default CODER_ACCESS_URL when not explicitly set.
	// +kubebuilder:default=true
	EnvUseClusterAccessURL *bool `json:"envUseClusterAccessURL,omitempty"`

	// Expose configures external exposure via Ingress or Gateway API.
	// +optional
	Expose *ExposeSpec `json:"expose,omitempty"`

	// +kubebuilder:validation:XValidation:rule="self.all(e, !(has(e.configMapRef) && has(e.secretRef)))",message="each envFrom entry may specify at most one of configMapRef or secretRef"
	// EnvFrom injects environment variables from ConfigMaps/Secrets.
	EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`
	// Volumes are additional volumes to add to the pod.
	Volumes []corev1.Volume `json:"volumes,omitempty"`
	// VolumeMounts are additional volume mounts for the control plane container.
	VolumeMounts []corev1.VolumeMount `json:"volumeMounts,omitempty"`
	// Certs configures additional CA certificate mounts.
	// +kubebuilder:default={}
	Certs CertsSpec `json:"certs,omitempty"`

	// NodeSelector constrains pod scheduling to nodes matching labels.
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
	// Tolerations are applied to the control plane pod.
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
	// Affinity configures pod affinity/anti-affinity rules.
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`
	// TopologySpreadConstraints control pod topology spread.
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
}

type CoderControlPlaneStatus struct {
	// ObservedGeneration tracks the spec generation this status reflects.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// ReadyReplicas is the number of ready pods observed in the deployment.
	ReadyReplicas int32 `json:"readyReplicas,omitempty"`
	// URL is the in-cluster URL for the control plane service.
	URL string `json:"url,omitempty"`
	// OperatorTokenSecretRef points to the Secret key containing the `coder-k8s-operator` API token.
	OperatorTokenSecretRef *SecretKeySelector `json:"operatorTokenSecretRef,omitempty"`
	// OperatorAccessReady reports whether operator API access bootstrap succeeded.
	OperatorAccessReady bool `json:"operatorAccessReady,omitempty"`
	// LicenseLastApplied is the timestamp of the most recent successful
	// operator-managed license upload.
	// +optional
	LicenseLastApplied *metav1.Time `json:"licenseLastApplied,omitempty"`
	// LicenseLastAppliedHash is the SHA-256 hex hash of the trimmed license JWT
	// that LicenseLastApplied refers to.
	// +optional
	LicenseLastAppliedHash string `json:"licenseLastAppliedHash,omitempty"`
	// LicenseTier is a best-effort classification of the currently applied license.
	// Values: none, trial, enterprise, premium, unknown.
	// +optional
	LicenseTier string `json:"licenseTier,omitempty"`
	// EntitlementsLastChecked is when the operator last queried coderd entitlements.
	// +optional
	EntitlementsLastChecked *metav1.Time `json:"entitlementsLastChecked,omitempty"`
	// ExternalProvisionerDaemonsEntitlement is the entitlement value for feature
	// "external_provisioner_daemons".
	// Values: entitled, grace_period, not_entitled, unknown.
	// +optional
	ExternalProvisionerDaemonsEntitlement string `json:"externalProvisionerDaemonsEntitlement,omitempty"`
	// Phase is a high-level readiness indicator.
	Phase string `json:"phase,omitempty"`
	// Conditions are Kubernetes-standard conditions for this resource.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type CoderProvisioner struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CoderProvisionerSpec   `json:"spec,omitempty"`
	Status CoderProvisionerStatus `json:"status,omitempty"`
}

type CoderProvisionerKeySpec struct {
	// Name is the provisioner key name in coderd. Defaults to the CR name.
	// +kubebuilder:validation:MaxLength=128
	Name string `json:"name,omitempty"`
	// SecretName is the Kubernetes Secret to store the key. Defaults to "{crName}-provisioner-key".
	// +kubebuilder:validation:MaxLength=253
	SecretName string `json:"secretName,omitempty"`
	// SecretKey is the data key in the Secret. Defaults to "key".
	// +kubebuilder:validation:MaxLength=253
	SecretKey string `json:"secretKey,omitempty"`
}

type CoderProvisionerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CoderProvisioner `json:"items"`
}

type CoderProvisionerSpec struct {
	// ControlPlaneRef identifies which CoderControlPlane instance to join.
	// Provisioner key management uses operator-managed access from this
	// control plane's status.operatorTokenSecretRef.
	ControlPlaneRef corev1.LocalObjectReference `json:"controlPlaneRef"`
	// OrganizationName is the Coder organization. Defaults to "default".
	// +kubebuilder:validation:MaxLength=128
	OrganizationName string `json:"organizationName,omitempty"`
	// Key configures provisioner key naming and secret storage.
	Key CoderProvisionerKeySpec `json:"key,omitempty"`
	// Replicas is the desired number of provisioner pods.
	Replicas *int32 `json:"replicas,omitempty"`
	// Tags are attached to the provisioner key for job routing.
	Tags map[string]string `json:"tags,omitempty"`
	// Image is the container image. Defaults to the control plane image.
	Image string `json:"image,omitempty"`
	// ExtraArgs are appended after "provisioner start".
	ExtraArgs []string `json:"extraArgs,omitempty"`
	// ExtraEnv are injected into the provisioner container.
	ExtraEnv []corev1.EnvVar `json:"extraEnv,omitempty"`
	// Resources for the provisioner container.
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`
	// ImagePullSecrets are used by the pod to pull private images.
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
	// TerminationGracePeriodSeconds for the provisioner pods.
	TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty"`
}

type CoderProvisionerStatus struct {
	// ObservedGeneration tracks the spec generation this status reflects.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// ReadyReplicas is the number of ready pods observed in the deployment.
	ReadyReplicas int32 `json:"readyReplicas,omitempty"`
	// Phase is a high-level readiness indicator.
	Phase string `json:"phase,omitempty"`
	// Conditions are Kubernetes-standard conditions for this resource.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// OrganizationID is the organization ID last applied to the provisioner key.
	OrganizationID string `json:"organizationID,omitempty"`
	// OrganizationName is the organization name last applied to the provisioner key.
	OrganizationName string `json:"organizationName,omitempty"`
	// ProvisionerKeyID is the provisioner key ID last applied in coderd.
	ProvisionerKeyID string `json:"provisionerKeyID,omitempty"`
	// ProvisionerKeyName is the provisioner key name last applied in coderd.
	ProvisionerKeyName string `json:"provisionerKeyName,omitempty"`
	// TagsHash is a deterministic hash of spec.tags last applied to the provisioner key.
	TagsHash string `json:"tagsHash,omitempty"`
	// ControlPlaneRefName is the control plane ref name last applied to the provisioner key.
	ControlPlaneRefName string `json:"controlPlaneRefName,omitempty"`
	// ControlPlaneURL is the control plane URL last applied to the provisioner key.
	ControlPlaneURL string `json:"controlPlaneURL,omitempty"`
	// SecretRef references the provisioner key secret data currently in use.
	SecretRef *SecretKeySelector `json:"secretRef,omitempty"`
}

type CoderWorkspaceProxy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   WorkspaceProxySpec   `json:"spec,omitempty"`
	Status WorkspaceProxyStatus `json:"status,omitempty"`
}

type CoderWorkspaceProxyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CoderWorkspaceProxy `json:"items"`
}

type ExposeSpec struct {
	// Ingress configures a networking.k8s.io/v1 Ingress.
	// +optional
	Ingress *IngressExposeSpec `json:"ingress,omitempty"`
	// Gateway configures a gateway.networking.k8s.io/v1 HTTPRoute.
	// +optional
	Gateway *GatewayExposeSpec `json:"gateway,omitempty"`
}

type GatewayExposeSpec struct {
	// Host is the primary hostname for the HTTPRoute.
	Host string `json:"host"`
	// WildcardHost is an optional wildcard hostname.
	WildcardHost string `json:"wildcardHost,omitempty"`
	// ParentRefs are Gateways that the HTTPRoute attaches to.
	// At least one parentRef is required when gateway exposure is configured.
	// +kubebuilder:validation:MinItems=1
	ParentRefs []GatewayParentRef `json:"parentRefs"`
}

type GatewayParentRef struct {
	// Name is the Gateway name.
	Name string `json:"name"`
	// Namespace is the Gateway namespace.
	// +optional
	Namespace *string `json:"namespace,omitempty"`
	// SectionName is the listener name within the Gateway.
	// +optional
	SectionName *string `json:"sectionName,omitempty"`
}

type IngressExposeSpec struct {
	// ClassName is the Ingress class name.
	ClassName *string `json:"className,omitempty"`
	// Host is the primary hostname for the Ingress rule.
	Host string `json:"host"`
	// WildcardHost is an optional wildcard hostname (e.g., for workspace apps).
	WildcardHost string `json:"wildcardHost,omitempty"`
	// Annotations are applied to the managed Ingress.
	Annotations map[string]string `json:"annotations,omitempty"`
	// TLS configures TLS termination at the Ingress.
	// +optional
	TLS *IngressTLSExposeSpec `json:"tls,omitempty"`
}

type IngressTLSExposeSpec struct {
	// SecretName is the TLS Secret for the primary host.
	SecretName string `json:"secretName,omitempty"`
	// WildcardSecretName is the TLS Secret for the wildcard host.
	WildcardSecretName string `json:"wildcardSecretName,omitempty"`
}

type OperatorAccessSpec struct {
	// Disabled turns off creation and management of the `coder-k8s-operator`
	// user and API token.
	// +kubebuilder:default=false
	Disabled bool `json:"disabled,omitempty"`
	// GeneratedTokenSecretName stores the generated operator API token.
	GeneratedTokenSecretName string `json:"generatedTokenSecretName,omitempty"`
}

type ProbeSpec struct {
	// Enabled toggles the probe on or off.
	// When omitted, readiness defaults to enabled while liveness defaults to disabled.
	Enabled *bool `json:"enabled,omitempty"`
	// InitialDelaySeconds is the delay before the probe starts.
	// +kubebuilder:default=0
	InitialDelaySeconds int32 `json:"initialDelaySeconds,omitempty"`
	// PeriodSeconds controls how often the probe is performed.
	PeriodSeconds *int32 `json:"periodSeconds,omitempty"`
	// TimeoutSeconds is the probe timeout.
	TimeoutSeconds *int32 `json:"timeoutSeconds,omitempty"`
	// SuccessThreshold is the minimum consecutive successes for the probe to be considered successful.
	SuccessThreshold *int32 `json:"successThreshold,omitempty"`
	// FailureThreshold is the minimum consecutive failures for the probe to be considered failed.
	FailureThreshold *int32 `json:"failureThreshold,omitempty"`
}

type ProxyBootstrapSpec struct {
	// CoderURL is the URL for the primary Coder control plane API.
	CoderURL string `json:"coderURL"`
	// CredentialsSecretRef points to a Secret containing a Coder session token.
	CredentialsSecretRef SecretKeySelector `json:"credentialsSecretRef"`
	// ProxyName is the name used when registering the proxy in Coder.
	ProxyName string `json:"proxyName,omitempty"`
	// DisplayName is the human-readable name for the proxy region.
	DisplayName string `json:"displayName,omitempty"`
	// Icon is the optional icon URL or emoji path for the proxy region.
	Icon string `json:"icon,omitempty"`
	// GeneratedTokenSecretName stores the generated proxy token.
	GeneratedTokenSecretName string `json:"generatedTokenSecretName,omitempty"`
}

type RBACSpec struct {
	// WorkspacePerms enables Role/RoleBinding creation for workspace resources.
	// When omitted, the default is true.
	// +kubebuilder:default=true
	WorkspacePerms *bool `json:"workspacePerms,omitempty"`
	// EnableDeployments grants apps/deployments permissions (only when WorkspacePerms is true).
	// When omitted, the default is true.
	// +kubebuilder:default=true
	EnableDeployments *bool `json:"enableDeployments,omitempty"`
	// ExtraRules are appended to the managed Role rules.
	ExtraRules []rbacv1.PolicyRule `json:"extraRules,omitempty"`
	// WorkspaceNamespaces lists additional namespaces for Role/RoleBinding creation.
	WorkspaceNamespaces []string `json:"workspaceNamespaces,omitempty"`
}

type SecretKeySelector struct {
	// Name is the Kubernetes Secret name.
	Name string `json:"name"`
	// Key is the key inside the Secret data map.
	Key string `json:"key,omitempty"`
}

type ServiceAccountSpec struct {
	// DisableCreate skips ServiceAccount creation (use an existing SA).
	// +kubebuilder:default=false
	DisableCreate bool `json:"disableCreate,omitempty"`
	// Name overrides the ServiceAccount name. Defaults to the CoderControlPlane name.
	Name string `json:"name,omitempty"`
	// Annotations are applied to the managed ServiceAccount.
	Annotations map[string]string `json:"annotations,omitempty"`
	// Labels are applied to the managed ServiceAccount.
	Labels map[string]string `json:"labels,omitempty"`
}

type ServiceSpec struct {
	// Type controls the Kubernetes service type.
	// +kubebuilder:default="ClusterIP"
	Type corev1.ServiceType `json:"type,omitempty"`
	// Port controls the exposed service port.
	// +kubebuilder:default=80
	Port int32 `json:"port,omitempty"`
	// Annotations are applied to the reconciled service object.
	Annotations map[string]string `json:"annotations,omitempty"`
}

type TLSSpec struct {
	// SecretNames lists TLS secrets to mount for built-in TLS.
	// When non-empty, TLS is enabled on the Coder control plane.
	SecretNames []string `json:"secretNames,omitempty"`
}

type WorkspaceProxySpec struct {
	// Image is the container image used for the workspace proxy pod.
	Image string `json:"image,omitempty"`
	// Replicas is the desired number of proxy pods.
	Replicas *int32 `json:"replicas,omitempty"`
	// Service controls the service created in front of the workspace proxy.
	// +kubebuilder:default={}
	Service ServiceSpec `json:"service,omitempty"`
	// PrimaryAccessURL is the coderd URL the proxy should connect to.
	PrimaryAccessURL string `json:"primaryAccessURL,omitempty"`
	// ProxySessionTokenSecretRef points to a Secret key containing the proxy token.
	ProxySessionTokenSecretRef *SecretKeySelector `json:"proxySessionTokenSecretRef,omitempty"`
	// Bootstrap optionally registers the proxy and mints a proxy token.
	Bootstrap *ProxyBootstrapSpec `json:"bootstrap,omitempty"`
	// DerpOnly configures the workspace proxy to only serve DERP traffic.
	DerpOnly bool `json:"derpOnly,omitempty"`
	// ExtraArgs are appended to the default workspace proxy arguments.
	ExtraArgs []string `json:"extraArgs,omitempty"`
	// ExtraEnv are injected into the workspace proxy container.
	ExtraEnv []corev1.EnvVar `json:"extraEnv,omitempty"`
	// ImagePullSecrets are used by the pod to pull private images.
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
}

type WorkspaceProxyStatus struct {
	// ObservedGeneration tracks the spec generation this status reflects.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// ReadyReplicas is the number of ready pods observed in the deployment.
	ReadyReplicas int32 `json:"readyReplicas,omitempty"`
	// Registered reports whether bootstrap registration completed successfully.
	Registered bool `json:"registered,omitempty"`
	// ProxyTokenSecretRef is the Secret used for the proxy session token.
	ProxyTokenSecretRef *SecretKeySelector `json:"proxyTokenSecretRef,omitempty"`
	// Phase is a high-level readiness indicator.
	Phase string `json:"phase,omitempty"`
	// Conditions are Kubernetes-standard conditions for this resource.
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}