v1alpha1

type AgentCredential struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentCredentialSpec   `json:"spec,omitempty"`
	Status AgentCredentialStatus `json:"status,omitempty"`
}

type AgentCredentialList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentCredential `json:"items"`
}

type AgentCredentialSpec struct {
	// Backend is the observability backend this credential grants access to
	// (metrics → Mimir, logs → Loki, traces → Tempo). Drives which gateway's
	// htpasswd Secret this credential is aggregated into.
	Backend CredentialBackend `json:"backend"`

	// AgentName identifies the telemetry agent this credential belongs to.
	// Used as the basic-auth username in the generated Secret and htpasswd entry.
	// RFC 7617 forbids ':' in basic-auth usernames.
	// +kubebuilder:validation:Pattern="^[a-zA-Z0-9][a-zA-Z0-9_-]{0,252}$"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	AgentName string `json:"agentName"`

	// SecretName overrides the generated Secret name. Defaults to metadata.name.
	// Must be a valid DNS-1123 subdomain.
	// +optional
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern="^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
	SecretName string `json:"secretName,omitempty"`
}

type AgentCredentialStatus struct {
	// SecretRef points to the rendered Secret in the same namespace.
	// +optional
	SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`

	// Conditions represent the latest available observations of the credential's state.
	// Types: Ready (secret rendered), GatewaySynced (htpasswd aggregated).
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type CredentialBackend string

type DataSource struct {
	// ID is the unique id of the data source.
	ID int64 `json:"ID"`

	// Name is the name of the data source.
	Name string `json:"name"`
}

type GrafanaOrganization struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GrafanaOrganizationSpec   `json:"spec,omitempty"`
	Status GrafanaOrganizationStatus `json:"status,omitempty"`
}

type GrafanaOrganizationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GrafanaOrganization `json:"items"`
}

type GrafanaOrganizationSpec struct {
	// DisplayName is the name displayed when viewing the organization in Grafana. It can be different from the actual org's name.
	// +kubebuilder:example="Giant Swarm"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:unique=true
	DisplayName string `json:"displayName"`

	// Access rules defines user permissions for interacting with the organization in Grafana.
	RBAC *RBAC `json:"rbac"`

	// Tenants is a list of tenants that are associated with the Grafana organization.
	// +kubebuilder:example={"giantswarm"}
	// +kube:validation:MinItems=1
	Tenants []TenantID `json:"tenants"`
}

type GrafanaOrganizationStatus struct {
	// OrgID is the actual organisation ID in grafana.
	// +optional
	OrgID int64 `json:"orgID"`

	// DataSources is a list of grafana data sources that are available to the Grafana organization.
	// +optional
	DataSources []DataSource `json:"dataSources"`

	// DisplayName records the last display name successfully applied to the Grafana
	// organization referenced by OrgID.
	// +optional
	DisplayName string `json:"displayName,omitempty"`
}

type LogExport struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LogExportSpec   `json:"spec,omitempty"`
	Status LogExportStatus `json:"status,omitempty"`
}

type LogExportDestination struct {
	// Type selects the destination variant.
	Type LogExportDestinationType `json:"type"`

	// S3 configures an S3 or S3-compatible bucket. Required when type is "s3".
	// +optional
	S3 *S3Destination `json:"s3,omitempty"`

	// Loki configures a Loki-compatible push endpoint. Required when type is "loki".
	// +optional
	Loki *LokiDestination `json:"loki,omitempty"`
}

type LogExportDestinationType string

type LogExportList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LogExport `json:"items"`
}

type LogExportSpec struct {
	// Selector chooses which log lines are exported, using LogQL syntax.
	//
	// Only a subset of LogQL is supported: a stream selector, optional line
	// filters, and an optional parse-and-filter clause. Aggregations and time
	// ranges are rejected -- an export is a continuous tee, not a query, so it has
	// no start or end.
	//
	// The same expression can be pasted into Grafana Explore to see exactly which
	// lines it matches before committing it.
	//
	// This is NOT limited by the namespace of this resource: a selector matches
	// against every log line arriving at the installation's write path, from any
	// cluster. See the LogExport type documentation.
	// +kubebuilder:example="{scrape_job=\"audit-logs\"}"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=4096
	Selector string `json:"selector"`

	// Destination is where the selected lines are written.
	Destination LogExportDestination `json:"destination"`
}

type LogExportStatus struct {
	// ObservedGeneration is the .metadata.generation this status was set from.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the latest available observations of the export's state.
	// Types: Ready (the pipeline is configured), ExporterAvailable (alloy-logexporter
	// is running on this installation).
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type LokiDestination struct {
	// URL is the push endpoint, including the path.
	// +kubebuilder:example="https://logs.example.com/loki/api/v1/push"
	// +kubebuilder:validation:Pattern="^https?://.+$"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	URL string `json:"url"`

	// TenantID is sent as the X-Scope-OrgID header. Required by multi-tenant Loki
	// deployments, ignored by single-tenant ones.
	// +optional
	// +kubebuilder:validation:MaxLength=150
	TenantID string `json:"tenantID,omitempty"`

	// CredentialsRef names a Secret holding basic-auth credentials, with keys
	// username and password.
	//
	// The Secret is read from THIS resource's namespace; cross-namespace
	// references are not possible.
	// +optional
	CredentialsRef *corev1.LocalObjectReference `json:"credentialsRef,omitempty"`
}

type RBAC struct {
	// Admins is a list of user organizations that have admin access to the grafanaorganization.
	Admins []string `json:"admins"`

	// Editors is a list of user organizations that have editor access to the grafanaorganization.
	// +optional
	Editors []string `json:"editors"`

	// Viewers is a list of user organizations that have viewer access to the grafanaorganization.
	// +optional
	Viewers []string `json:"viewers"`
}

type S3Destination struct {
	// Bucket is the destination bucket name.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Bucket string `json:"bucket"`

	// Region is the bucket's region.
	// +kubebuilder:example="eu-west-2"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Region string `json:"region"`

	// Prefix is the key prefix objects are written under. Object keys are
	// <prefix>/year=…/month=…/day=…/hour=…/minute=…/logs_<uuidv7>.txt.gz, using the
	// time the object was uploaded rather than the time of the events in it.
	// +optional
	// +kubebuilder:example="giantswarm/audit"
	// +kubebuilder:validation:MaxLength=512
	Prefix string `json:"prefix,omitempty"`

	// Endpoint overrides the S3 endpoint. Leave empty for AWS; set it to target an
	// S3-compatible store.
	// +optional
	// +kubebuilder:validation:MaxLength=2048
	Endpoint string `json:"endpoint,omitempty"`

	// ForcePathStyle addresses the bucket as a path rather than a subdomain.
	// S3-compatible stores generally require this; AWS generally does not.
	// +optional
	ForcePathStyle bool `json:"forcePathStyle,omitempty"`

	// RoleARN is an IAM role to assume before writing, for cross-account delivery.
	// When set, CredentialsRef is usually unnecessary: the exporter authenticates
	// with its own ServiceAccount identity and assumes this role.
	// +optional
	// +kubebuilder:validation:Pattern="^$|^arn:aws[a-zA-Z-]*:iam::[0-9]{12}:role/.+$"
	// +kubebuilder:validation:MaxLength=2048
	RoleARN string `json:"roleARN,omitempty"`

	// CredentialsRef names a Secret holding static credentials, with keys
	// AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
	//
	// The Secret is read from THIS resource's namespace; cross-namespace
	// references are not possible. Omit it to authenticate by workload identity
	// (IRSA) instead, optionally combined with RoleARN.
	// +optional
	CredentialsRef *corev1.LocalObjectReference `json:"credentialsRef,omitempty"`
}

type TenantID string