v1alpha1

type AgentCredential struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentCredentialSpec   `json:"spec,omitempty"`
	Status AgentCredentialStatus `json:"status,omitempty"`
}

type AgentCredentialList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentCredential `json:"items"`
}

type AgentCredentialSpec struct {
	// Backend is the observability backend this credential grants access to
	// (metrics → Mimir, logs → Loki, traces → Tempo). Drives which gateway's
	// htpasswd Secret this credential is aggregated into.
	Backend CredentialBackend `json:"backend"`

	// AgentName identifies the telemetry agent this credential belongs to.
	// Used as the basic-auth username in the generated Secret and htpasswd entry.
	// RFC 7617 forbids ':' in basic-auth usernames.
	// +kubebuilder:validation:Pattern="^[a-zA-Z0-9][a-zA-Z0-9_-]{0,252}$"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	AgentName string `json:"agentName"`

	// SecretName overrides the generated Secret name. Defaults to metadata.name.
	// Must be a valid DNS-1123 subdomain.
	// +optional
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern="^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
	SecretName string `json:"secretName,omitempty"`
}

type AgentCredentialStatus struct {
	// SecretRef points to the rendered Secret in the same namespace.
	// +optional
	SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`

	// Conditions represent the latest available observations of the credential's state.
	// Types: Ready (secret rendered), GatewaySynced (htpasswd aggregated).
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type CredentialBackend string

type CronitorProvider struct {
	// CredentialsRef names a Secret holding the Cronitor API keys, with keys
	// managementKey and pingKey:
	//
	//   - managementKey authenticates monitor create, update and delete against
	//     the Cronitor monitor API.
	//   - pingKey is used to ping the monitor once, which is what associates it
	//     with an environment; Cronitor has no API field for that.
	//
	// Both are required. This is the contract between this resource and whatever
	// ships it -- the keys are read from a Secret rather than the operator's own
	// environment precisely so the monitor definition can be shipped by another
	// application.
	//
	// The Secret is read from THIS resource's namespace; cross-namespace
	// references are not possible.
	CredentialsRef corev1.LocalObjectReference `json:"credentialsRef"`

	// Key is the monitor's unique identifier in Cronitor. Defaults to metadata.name.
	//
	// Whatever pings this monitor must use the same key: it is the last path
	// segment of https://cronitor.link/p/<pingKey>/<key>. A mismatch is silent
	// until the grace period expires and the monitor pages.
	//
	// Uniqueness is NOT enforced. Two Heartbeat resources naming one key both
	// write the same monitor, last writer wins; status.monitorKey on each of them
	// is what makes that visible.
	// +optional
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern="^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
	Key string `json:"key,omitempty"`

	// Schedule is how often the monitor expects to be pinged, in Cronitor
	// schedule syntax: a cron expression or an interval phrase.
	// +kubebuilder:example="every 30 minutes"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	Schedule string `json:"schedule"`

	// GraceSeconds is how long Cronitor waits past a missed ping before alerting.
	// +kubebuilder:validation:Minimum=0
	GraceSeconds int `json:"graceSeconds"`

	// RealertInterval is how often Cronitor re-notifies while the monitor stays
	// failed. Empty means it notifies once.
	// +optional
	// +kubebuilder:example="every 24 hours"
	// +kubebuilder:validation:MaxLength=256
	RealertInterval string `json:"realertInterval,omitempty"`

	// Notify lists the Cronitor notification lists alerted when the monitor
	// fails. These lists, and any integration behind them, exist only in the
	// Cronitor account -- this field references them by name and cannot create
	// them. Empty means Cronitor's account default.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MaxItems=32
	// +kubebuilder:validation:items:MinLength=1
	// +kubebuilder:validation:items:MaxLength=256
	Notify []string `json:"notify,omitempty"`

	// Tags are set on the monitor in Cronitor, for grouping and filtering there.
	//
	// Order is significant to the operator, not to Cronitor: the list is compared
	// as-is against the monitor's current tags to decide whether an update is
	// needed, so an unstable order causes a needless write on every reconcile.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:items:MinLength=1
	// +kubebuilder:validation:items:MaxLength=256
	Tags []string `json:"tags,omitempty"`

	// Note is free text shown on the monitor in Cronitor and carried into its
	// alerts, which makes it the place to put a runbook link.
	// +optional
	// +kubebuilder:validation:MaxLength=2048
	Note string `json:"note,omitempty"`
}

type DataSource struct {
	// ID is the unique id of the data source.
	ID int64 `json:"ID"`

	// Name is the name of the data source.
	Name string `json:"name"`
}

type GrafanaOrganization struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GrafanaOrganizationSpec   `json:"spec,omitempty"`
	Status GrafanaOrganizationStatus `json:"status,omitempty"`
}

type GrafanaOrganizationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GrafanaOrganization `json:"items"`
}

type GrafanaOrganizationSpec struct {
	// DisplayName is the name displayed when viewing the organization in Grafana. It can be different from the actual org's name.
	// +kubebuilder:example="Giant Swarm"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:unique=true
	DisplayName string `json:"displayName"`

	// Access rules defines user permissions for interacting with the organization in Grafana.
	RBAC *RBAC `json:"rbac"`

	// Tenants is a list of tenants that are associated with the Grafana organization.
	// +kubebuilder:example={"giantswarm"}
	// +kube:validation:MinItems=1
	Tenants []TenantID `json:"tenants"`
}

type GrafanaOrganizationStatus struct {
	// OrgID is the actual organisation ID in grafana.
	// +optional
	OrgID int64 `json:"orgID"`

	// DataSources is a list of grafana data sources that are available to the Grafana organization.
	// +optional
	DataSources []DataSource `json:"dataSources"`

	// DisplayName records the last display name successfully applied to the Grafana
	// organization referenced by OrgID.
	// +optional
	DisplayName string `json:"displayName,omitempty"`
}

type Heartbeat struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   HeartbeatSpec   `json:"spec,omitempty"`
	Status HeartbeatStatus `json:"status,omitempty"`
}

type HeartbeatList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Heartbeat `json:"items"`
}

type HeartbeatProvider struct {
	// Type selects the provider variant.
	Type HeartbeatProviderType `json:"type"`

	// Cronitor configures a Cronitor heartbeat monitor. Required when type is "cronitor".
	// +optional
	Cronitor *CronitorProvider `json:"cronitor,omitempty"`
}

type HeartbeatProviderType string

type HeartbeatSpec struct {
	// Provider is the external service the monitor is created in.
	Provider HeartbeatProvider `json:"provider"`
}

type HeartbeatStatus struct {
	// ObservedGeneration is the .metadata.generation this status was set from.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// MonitorKey is the key of the monitor this resource last wrote.
	//
	// Keys are not unique across resources by design, so this reports what was
	// actually written rather than what was asked for. Listing it across
	// namespaces is how a collision between two Heartbeat resources is spotted.
	// +optional
	// +kubebuilder:validation:MaxLength=253
	MonitorKey string `json:"monitorKey,omitempty"`

	// Conditions represent the latest available observations of the heartbeat's state.
	// Types: Ready (the provider holds a monitor matching this spec).
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type LogExport struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LogExportSpec   `json:"spec,omitempty"`
	Status LogExportStatus `json:"status,omitempty"`
}

type LogExportDestination struct {
	// Type selects the destination variant.
	Type LogExportDestinationType `json:"type"`

	// S3 configures an S3 or S3-compatible bucket. Required when type is "s3".
	// +optional
	S3 *S3Destination `json:"s3,omitempty"`

	// Loki configures a Loki-compatible push endpoint. Required when type is "loki".
	// +optional
	Loki *LokiDestination `json:"loki,omitempty"`
}

type LogExportDestinationType string

type LogExportList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LogExport `json:"items"`
}

type LogExportSpec struct {
	// Selector chooses which log lines are exported, using LogQL syntax.
	//
	// Only a subset the exporter can render is accepted: a stream selector, optional
	// line filters, an optional "| json", and optional label filters comparing a single
	// label to a string. Aggregations and time ranges are rejected -- an export is a
	// continuous tee, not a query, so it has no start or end.
	//
	// As in Loki, the stream selector must name at least one label it can match on, so
	// {job=~".*"} is rejected while {job=~".+"} is accepted.
	//
	// The same expression can be pasted into Grafana Explore to see exactly which
	// lines it matches before committing it.
	//
	// This is NOT limited by the namespace of this resource: a selector matches
	// against every log line arriving at the installation's write path, from any
	// cluster. See the LogExport type documentation.
	// +kubebuilder:example="{scrape_job=\"audit-logs\"}"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=4096
	Selector string `json:"selector"`

	// Destination is where the selected lines are written.
	Destination LogExportDestination `json:"destination"`
}

type LogExportStatus struct {
	// ObservedGeneration is the .metadata.generation this status was set from.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the latest available observations of the export's state.
	// Types: Ready (the pipeline is configured), ExporterAvailable (alloy-logexporter
	// is running on this installation).
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type LokiDestination struct {
	// URL is the push endpoint, including the path.
	// +kubebuilder:example="https://logs.example.com/loki/api/v1/push"
	// +kubebuilder:validation:Pattern="^https?://.+$"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	URL string `json:"url"`

	// TenantID is sent as the X-Scope-OrgID header. Required by multi-tenant Loki
	// deployments, ignored by single-tenant ones.
	// +optional
	// +kubebuilder:validation:MaxLength=150
	TenantID string `json:"tenantID,omitempty"`

	// CredentialsRef names a Secret holding basic-auth credentials, with keys
	// username and password.
	//
	// The Secret is read from THIS resource's namespace; cross-namespace
	// references are not possible.
	// +optional
	CredentialsRef *corev1.LocalObjectReference `json:"credentialsRef,omitempty"`
}

type RBAC struct {
	// Admins is a list of user organizations that have admin access to the grafanaorganization.
	Admins []string `json:"admins"`

	// Editors is a list of user organizations that have editor access to the grafanaorganization.
	// +optional
	Editors []string `json:"editors"`

	// Viewers is a list of user organizations that have viewer access to the grafanaorganization.
	// +optional
	Viewers []string `json:"viewers"`
}

type S3Destination struct {
	// Bucket is the destination bucket name.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Bucket string `json:"bucket"`

	// Region is the bucket's region.
	// +kubebuilder:example="eu-west-2"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Region string `json:"region"`

	// Prefix is the key prefix objects are written under. Object keys are
	// <prefix>/year=…/month=…/day=…/hour=…/minute=…/logs_<uuidv7>.txt.gz, using the
	// time the object was uploaded rather than the time of the events in it.
	// +optional
	// +kubebuilder:example="giantswarm/audit"
	// +kubebuilder:validation:MaxLength=512
	Prefix string `json:"prefix,omitempty"`

	// Endpoint overrides the S3 endpoint. Leave empty for AWS; set it to target an
	// S3-compatible store.
	// +optional
	// +kubebuilder:validation:MaxLength=2048
	Endpoint string `json:"endpoint,omitempty"`

	// ForcePathStyle addresses the bucket as a path rather than a subdomain.
	// S3-compatible stores generally require this; AWS generally does not.
	// +optional
	ForcePathStyle bool `json:"forcePathStyle,omitempty"`

	// RoleARN is an IAM role to assume before writing, for cross-account delivery.
	// When set, CredentialsRef is usually unnecessary: the exporter authenticates
	// with its own ServiceAccount identity and assumes this role.
	// +optional
	// +kubebuilder:validation:Pattern="^$|^arn:aws[a-zA-Z-]*:iam::[0-9]{12}:role/.+$"
	// +kubebuilder:validation:MaxLength=2048
	RoleARN string `json:"roleARN,omitempty"`

	// Format selects how each record is written into AWS S3 object storage.
	//
	// "otlp" wraps each batch in an OTLP document, keeping the labels as record attributes.
	// "raw" writes the log lines alone, newline-delimited and unaltered: smaller and
	// directly queryable, but with no labels and so no way to tell which cluster or pod a
	// line came from.
	// +optional
	// +kubebuilder:default=otlp
	Format S3Format `json:"format,omitempty"`

	// CredentialsRef names a Secret holding static credentials, with keys
	// AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
	//
	// The Secret is read from THIS resource's namespace; cross-namespace
	// references are not possible. Omit it to authenticate by workload identity
	// (IRSA) instead, optionally combined with RoleARN.
	// +optional
	CredentialsRef *corev1.LocalObjectReference `json:"credentialsRef,omitempty"`
}

type S3Format string

type TenantID string