v1alpha1

type CABundleSpec struct {
	// ConfigMapName of the ConfigMap (key ca.crt) the ClusterIssuer
	// controller maintains in every namespace that has a Certificate of
	// this issuer.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	ConfigMapName string `json:"configMapName"`
}

type Certificate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CertificateSpec   `json:"spec"`
	Status CertificateStatus `json:"status,omitempty"`
}

type CertificateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Certificate `json:"items"`
}

type CertificateSpec struct {
	// IssuerRef names the ClusterIssuer that signs the certificate.
	IssuerRef IssuerReference `json:"issuerRef"`
	// Profile of the issuer; default the issuer's defaultProfile. It must
	// be one the ClusterIssuer exposes.
	Profile string `json:"profile,omitempty"`
	// SecretName of the kubernetes.io/tls Secret; default metadata.name.
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="secretName is immutable"
	SecretName string `json:"secretName,omitempty"`
	// CommonName of the subject; not added to the SAN automatically. The
	// issuer policy checks it against allowedDNSNames.
	// +kubebuilder:validation:MaxLength=64
	CommonName string `json:"commonName,omitempty"`
	// DNSNames, IPAddresses, URIs and EmailAddresses are the subject
	// alternative names; validated with xpki csr.ParseSAN, duplicates
	// dropped.
	DNSNames       []string `json:"dnsNames,omitempty"`
	IPAddresses    []string `json:"ipAddresses,omitempty"`
	URIs           []string `json:"uris,omitempty"`
	EmailAddresses []string `json:"emailAddresses,omitempty"`
	// KubernetesNames adds the names of Services in the namespace.
	KubernetesNames *KubernetesNames `json:"kubernetesNames,omitempty"`
	// Duration of the certificate; default the profile expiry. Bounded at
	// issuance by the profile expiry and the issuer policy's maxDuration.
	// +kubebuilder:validation:XValidation:rule="duration(self) >= duration('1m')",message="duration must be at least 1m"
	Duration *metav1.Duration `json:"duration,omitempty"`
	// RenewBefore is how long before notAfter the certificate is renewed;
	// default a third of the duration.
	// +kubebuilder:validation:XValidation:rule="duration(self) >= duration('30s')",message="renewBefore must be at least 30s"
	RenewBefore *metav1.Duration `json:"renewBefore,omitempty"`
	// PrivateKey parameters; default ECDSA P-256, rotated on every issuance.
	PrivateKey *PrivateKeySpec `json:"privateKey,omitempty"`
	// SecretTemplate adds labels and annotations to the Secret.
	SecretTemplate *SecretTemplate `json:"secretTemplate,omitempty"`
}

type CertificateStatus struct {
	// Conditions: Ready and Issuing. observedGeneration tracks
	// metadata.generation.
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// NotBefore and NotAfter of the stored certificate.
	NotBefore *metav1.Time `json:"notBefore,omitempty"`
	NotAfter  *metav1.Time `json:"notAfter,omitempty"`
	// RenewalTime is notAfter − renewBefore − jitter.
	RenewalTime *metav1.Time `json:"renewalTime,omitempty"`
	// SerialNumber of the stored certificate, hex with colons.
	SerialNumber string `json:"serialNumber,omitempty"`
	// IssuerLabel and IssuerKeyID identify the xpki issuer that signed it.
	IssuerLabel string `json:"issuerLabel,omitempty"`
	IssuerKeyID string `json:"issuerKeyID,omitempty"`
	// Revision counts the issuances; the Secret carries the same value.
	Revision int64 `json:"revision,omitempty"`
	// FailedAttempts since the last successful issuance, with the time of
	// the last failure.
	FailedAttempts  int32        `json:"failedAttempts,omitempty"`
	LastFailureTime *metav1.Time `json:"lastFailureTime,omitempty"`
	// LastRenewRequest is the renew-requested annotation value the last
	// issuance honoured.
	LastRenewRequest string `json:"lastRenewRequest,omitempty"`
}

type ClusterIssuer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterIssuerSpec   `json:"spec"`
	Status ClusterIssuerStatus `json:"status,omitempty"`
}

type ClusterIssuerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterIssuer `json:"items"`
}

type ClusterIssuerSpec struct {
	// IssuerLabel is the label of the issuer in the CA configuration
	// (authority.issuers[].label). Immutable.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="issuerLabel is immutable"
	IssuerLabel string `json:"issuerLabel"`
	// Profiles this ClusterIssuer exposes; empty exposes every profile the
	// issuer serves. Unknown entries make the issuer not Ready.
	Profiles []string `json:"profiles,omitempty"`
	// DefaultProfile is used by Certificates and Pods that omit the profile.
	DefaultProfile string `json:"defaultProfile,omitempty"`
	// SPIFFE enables the SPIFFE URI of the Pod flow.
	SPIFFE *SPIFFESpec `json:"spiffe,omitempty"`
	// Policy for the Certificates of this issuer; nil allows everything the
	// profile allows.
	Policy *IssuerPolicy `json:"policy,omitempty"`
	// CABundle publishes the root bundle into a ConfigMap per namespace.
	CABundle *CABundleSpec `json:"caBundle,omitempty"`
}

type ClusterIssuerStatus struct {
	// Conditions: Ready.
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// IssuerKeyID is the subject key identifier of the issuing certificate.
	IssuerKeyID string `json:"issuerKeyID,omitempty"`
	// CACertificate is the issuing certificate and its chain, PEM.
	CACertificate string `json:"caCertificate,omitempty"`
	// RootCertificate is the root bundle, PEM (what ca.crt carries).
	RootCertificate string `json:"rootCertificate,omitempty"`
	// CANotAfter is the expiry of the issuing certificate.
	CANotAfter *metav1.Time `json:"caNotAfter,omitempty"`
	// Profiles the ClusterIssuer exposes, sorted by name.
	Profiles []ProfileStatus `json:"profiles,omitempty"`
}

type IssuerPolicy struct {
	// NamespaceSelector limits the namespaces whose Certificates may use
	// this issuer; nil allows all.
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
	// MaxDuration is the upper bound of Certificate.spec.duration; the
	// profile expiry bounds it as well.
	// +kubebuilder:validation:XValidation:rule="duration(self) >= duration('1m')",message="maxDuration must be at least 1m"
	MaxDuration *metav1.Duration `json:"maxDuration,omitempty"`
	// AllowedDNSNames, AllowedURIs and AllowedEmailAddresses are RE2
	// regexes a name must match; the subject common name must match
	// AllowedDNSNames. ${NAMESPACE}, ${NAME}, ${SERVICE_ACCOUNT} and
	// ${CLUSTER_DOMAIN} are substituted, regex-quoted, with the
	// Certificate's namespace, name, the ServiceAccount of the Pod it
	// belongs to (empty for a Certificate that no Pod owns) and the
	// cluster domain of the operator (-cluster-domain). An absent list
	// allows every name of that type; an empty list denies the type
	// (pointers keep the two apart).
	AllowedDNSNames       *[]string `json:"allowedDNSNames,omitempty"`
	AllowedURIs           *[]string `json:"allowedURIs,omitempty"`
	AllowedEmailAddresses *[]string `json:"allowedEmailAddresses,omitempty"`
	// AllowIPAddresses permits IP SANs; default false.
	AllowIPAddresses bool `json:"allowIPAddresses,omitempty"`
}

type IssuerReference struct {
	// Name of the ClusterIssuer.
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type KeyAlgorithm string

type KubernetesNames struct {
	// Services in the same namespace whose DNS names (`<svc>.<ns>.svc.<domain>`)
	// are added; a missing Service is a PolicyViolation (ServiceNotFound).
	// +kubebuilder:validation:items:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	Services []string `json:"services,omitempty"`
	// IncludeUnqualified also adds the `<svc>.<ns>.svc` form.
	IncludeUnqualified bool `json:"includeUnqualified,omitempty"`
	// IncludeClusterIP also adds the Services' cluster addresses (both
	// families of a dual-stack Service) as IP SANs.
	IncludeClusterIP bool `json:"includeClusterIP,omitempty"`
}

type PrivateKeySpec struct {
	// Algorithm of the key; default ECDSA.
	// +kubebuilder:default=ECDSA
	Algorithm KeyAlgorithm `json:"algorithm,omitempty"`
	// Size: the ECDSA curve (256, 384, 521) or the RSA modulus bits (2048,
	// 3072, 4096); default 256 for ECDSA and 2048 for RSA.
	// +kubebuilder:validation:Enum=256;384;521;2048;3072;4096
	Size int `json:"size,omitempty"`
	// RotationPolicy: Always (default) generates a new key for every
	// issuance; Never reuses the key stored in the Secret.
	// +kubebuilder:default=Always
	RotationPolicy RotationPolicy `json:"rotationPolicy,omitempty"`
}

type ProfileStatus struct {
	Name     string          `json:"name"`
	Expiry   metav1.Duration `json:"expiry,omitempty"`
	Backdate metav1.Duration `json:"backdate,omitempty"`
	Usages   []string        `json:"usages,omitempty"`
}

type RotationPolicy string

type SPIFFESpec struct {
	// TrustDomain of the URIs `spiffe://<trustDomain>/ns/<ns>/sa/<sa>` the
	// Pod controller adds.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	TrustDomain string `json:"trustDomain"`
}

type SecretTemplate struct {
	Labels      map[string]string `json:"labels,omitempty"`
	Annotations map[string]string `json:"annotations,omitempty"`
}