v1

type AuthSpec struct {
	// SecretName is the name of the Kubernetes Secret containing the password.
	// +optional
	SecretName string `json:"secretName,omitempty"`

	// SecretPasswordKey is the key within the Secret that holds the password.
	// +kubebuilder:default=password
	// +optional
	SecretPasswordKey string `json:"secretPasswordKey,omitempty"`
}

type CertManagerIssuerSpec struct {
	// Group is the API group of the issuer (defaults to cert-manager.io).
	// +kubebuilder:default="cert-manager.io"
	// +optional
	Group string `json:"group,omitempty"`

	// Kind is the kind of the issuer (Issuer or ClusterIssuer).
	// +kubebuilder:validation:Enum=Issuer;ClusterIssuer
	Kind string `json:"kind"`

	// Name is the name of the issuer resource.
	Name string `json:"name"`
}

type CertManagerSpec struct {
	// Issuer references the cert-manager issuer to use.
	Issuer CertManagerIssuerSpec `json:"issuer"`

	// ExtraDNSNames specifies additional DNS names to include in the certificate
	// beyond the automatically generated ones (pod DNS names, service names).
	// +optional
	ExtraDNSNames []string `json:"extraDnsNames,omitempty"`
}

type ConditionType = string

type MetricsSpec struct {
	// Enabled activates the metrics exporter sidecar.
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`
}

type NetworkPolicySpec struct {
	// Enabled activates NetworkPolicy creation.
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// NamePrefix is prepended to generated NetworkPolicy names.
	// +optional
	NamePrefix string `json:"namePrefix,omitempty"`
}

type ObserverLogLevel string

type ObserverMTLSSpec struct {
	// Valkey controls whether the observer sends a client certificate to Valkey pods.
	// Set to true to enable mTLS; when nil or false, no client certificate is sent.
	// Default: false.
	// +optional
	Valkey *bool `json:"valkey,omitempty"`

	// Sentinel controls whether the observer sends a client certificate to Sentinel pods.
	// When nil or false, only the CA certificate is used (no client certificate).
	// Set to true to enable mTLS for Sentinel connections.
	// Default: false.
	// +optional
	Sentinel *bool `json:"sentinel,omitempty"`
}

type ObserverSpec struct {
	// Enabled activates the observer deployment.
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// DB is the Valkey database number used for the health check key.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=15
	// +optional
	DB *int `json:"db,omitempty"`

	// MTLS configures mutual TLS behaviour for the observer's outbound connections.
	// Only effective when spec.tls.enabled is true.
	// +optional
	MTLS *ObserverMTLSSpec `json:"mtls,omitempty"`

	// Resources defines the compute resource requirements for the observer container.
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

	// LogLevel sets the verbosity of observer log output.
	// At debug level, stack traces are included for all errors.
	// At info, warn, and error levels, stack traces are suppressed.
	// +kubebuilder:validation:Enum=debug;info;warn;error
	// +kubebuilder:default=info
	// +optional
	LogLevel ObserverLogLevel `json:"logLevel,omitempty"`

	// UnreadyWhen configures which check failures cause the observer to report
	// unReady. Omitting a field is equivalent to true (failure causes unReady).
	// Failures are always logged regardless of this setting.
	// +optional
	UnreadyWhen *ObserverUnreadyWhenSpec `json:"unreadyWhen,omitempty"`
}

type ObserverUnreadyWhenSpec struct {
	// MasterUnreachable: PING to the master node fails.
	// +kubebuilder:default=true
	// +optional
	MasterUnreachable *bool `json:"masterUnreachable,omitempty"`

	// WriteTestFailure: health key cannot be written to the master.
	// +kubebuilder:default=true
	// +optional
	WriteTestFailure *bool `json:"writeTestFailure,omitempty"`

	// ReadTestFailure: health key cannot be read back from the master.
	// +kubebuilder:default=true
	// +optional
	ReadTestFailure *bool `json:"readTestFailure,omitempty"`

	// ReplicaSyncFailure: a replica is disconnected or bulk sync is in progress.
	// +kubebuilder:default=true
	// +optional
	ReplicaSyncFailure *bool `json:"replicaSyncFailure,omitempty"`

	// ReplicaReadTestFailure: a replica returns stale or missing health key data.
	// +kubebuilder:default=true
	// +optional
	ReplicaReadTestFailure *bool `json:"replicaReadTestFailure,omitempty"`

	// SentinelUnreachable: one or more Sentinel instances do not respond to PING.
	// +kubebuilder:default=true
	// +optional
	SentinelUnreachable *bool `json:"sentinelUnreachable,omitempty"`

	// SentinelQuorumFailure: Sentinels disagree on the current master address.
	// +kubebuilder:default=true
	// +optional
	SentinelQuorumFailure *bool `json:"sentinelQuorumFailure,omitempty"`

	// SentinelMasterDown: Sentinel reports s_down or o_down flags on the master.
	// +kubebuilder:default=true
	// +optional
	SentinelMasterDown *bool `json:"sentinelMasterDown,omitempty"`

	// SentinelMasterHostnameInvalid: Sentinel reports a bare IP instead of a
	// DNS hostname for the master.
	// +kubebuilder:default=true
	// +optional
	SentinelMasterHostnameInvalid *bool `json:"sentinelMasterHostnameInvalid,omitempty"`

	// SentinelReplicaHostnamesInvalid: Sentinel reports bare IPs instead of
	// DNS hostnames for one or more replicas.
	// +kubebuilder:default=true
	// +optional
	SentinelReplicaHostnamesInvalid *bool `json:"sentinelReplicaHostnamesInvalid,omitempty"`
}

type PersistenceMode string

type PersistenceSpec struct {
	// Enabled activates persistent storage for Valkey data.
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// Mode selects the persistence strategy: rdb, aof, or both.
	// +kubebuilder:default=rdb
	// +optional
	Mode PersistenceMode `json:"mode,omitempty"`

	// StorageClass is the name of the StorageClass to use. Empty string means default.
	// +optional
	StorageClass string `json:"storageClass,omitempty"`

	// Size is the requested storage size.
	// +kubebuilder:default="1Gi"
	// +optional
	Size resource.Quantity `json:"size,omitempty"`
}

type RollingUpdateSpec struct {
	// SyncTimeout is the maximum duration to wait for a replaced pod to
	// complete replication sync before pausing the rolling update.
	// Default: 5m.
	// +optional
	SyncTimeout *metav1.Duration `json:"syncTimeout,omitempty"`
}

type SentinelSpec struct {
	// Enabled activates Sentinel-based HA mode.
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// Replicas is the number of Sentinel instances to run.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=3
	Replicas int32 `json:"replicas,omitempty"`

	// PodLabels are additional labels applied to Sentinel pods.
	// +optional
	PodLabels map[string]string `json:"podLabels,omitempty"`

	// PodAnnotations are additional annotations applied to Sentinel pods.
	// +optional
	PodAnnotations map[string]string `json:"podAnnotations,omitempty"`

	// AllowUnencrypted keeps the plaintext Sentinel port (26379) open alongside the TLS port (36379).
	// Only effective when spec.tls.enabled is true. Default: false.
	// +kubebuilder:default=false
	// +optional
	AllowUnencrypted bool `json:"allowUnencrypted,omitempty"`

	// DisableAuth disables password authentication for Sentinel client connections.
	// When true, Sentinel does not require a password from connecting clients
	// (no requirepass directive), but still uses sentinel auth-pass to
	// authenticate with Valkey nodes. Only effective when spec.auth is configured.
	// Default: false (Sentinel requires the same password as Valkey).
	// +kubebuilder:default=false
	// +optional
	DisableAuth bool `json:"disableAuth,omitempty"`
}

type TLSSpec struct {
	// Enabled activates TLS encryption.
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// CertManager configures cert-manager integration for automatic certificate management.
	// Mutually exclusive with SecretName.
	// +optional
	CertManager *CertManagerSpec `json:"certManager,omitempty"`

	// SecretName references an existing Kubernetes Secret containing TLS certificates.
	// The Secret must contain keys: tls.crt, tls.key, and ca.crt.
	// Mutually exclusive with CertManager.
	// +optional
	SecretName string `json:"secretName,omitempty"`

	// AllowUnencrypted keeps the plaintext Valkey port (6379) open alongside the TLS port (16379).
	// Internal replication always uses TLS. Default: false (plaintext port disabled when TLS is active).
	// +kubebuilder:default=false
	// +optional
	AllowUnencrypted bool `json:"allowUnencrypted,omitempty"`

	// UnifiedCertificate, when true, makes Valkey and Sentinel share a single
	// TLS certificate / Secret that covers both sets of hostnames. With
	// cert-manager, the operator issues one Certificate (instead of one per
	// component) and migrates existing clusters by deleting the legacy
	// <name>-sentinel-tls Certificate and Secret once the Sentinel StatefulSet
	// has switched to the unified Secret. With a user-provided Secret, both
	// StatefulSets already mount that Secret, so the flag is informational.
	// This avoids TLS verification errors in clients (e.g., go-redis Sentinel
	// mode) that share one tls.Config across the Sentinel discovery and the
	// Valkey master connection.
	// +kubebuilder:default=false
	// +optional
	UnifiedCertificate bool `json:"unifiedCertificate,omitempty"`
}

type Valkey struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ValkeySpec   `json:"spec,omitempty"`
	Status ValkeyStatus `json:"status,omitempty"`
}

type ValkeyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Valkey `json:"items"`
}

type ValkeyPhase string

type ValkeySpec struct {
	// Replicas is the number of Valkey instances to run.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=1
	Replicas int32 `json:"replicas,omitempty"`

	// Image is the Valkey container image to use.
	// +kubebuilder:validation:MinLength=1
	Image string `json:"image"`

	// Sentinel configures Sentinel-based HA mode.
	// +optional
	Sentinel *SentinelSpec `json:"sentinel,omitempty"`

	// Auth configures authentication.
	// +optional
	Auth *AuthSpec `json:"auth,omitempty"`

	// TLS configures TLS encryption.
	// +optional
	TLS *TLSSpec `json:"tls,omitempty"`

	// Metrics configures the metrics exporter.
	// +optional
	Metrics *MetricsSpec `json:"metrics,omitempty"`

	// NetworkPolicy configures network policies.
	// +optional
	NetworkPolicy *NetworkPolicySpec `json:"networkPolicy,omitempty"`

	// Persistence configures data persistence.
	// +optional
	Persistence *PersistenceSpec `json:"persistence,omitempty"`

	// Observer configures the observer deployment for cluster health monitoring.
	// +optional
	Observer *ObserverSpec `json:"observer,omitempty"`

	// PodLabels are additional labels applied to Valkey pods.
	// +optional
	PodLabels map[string]string `json:"podLabels,omitempty"`

	// PodAnnotations are additional annotations applied to Valkey pods.
	// +optional
	PodAnnotations map[string]string `json:"podAnnotations,omitempty"`

	// Resources defines the compute resource requirements for Valkey containers.
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// RollingUpdate configures rolling update behaviour.
	// +optional
	RollingUpdate *RollingUpdateSpec `json:"rollingUpdate,omitempty"`
}

type ValkeyStatus struct {
	// ReadyReplicas is the number of ready Valkey instances.
	ReadyReplicas int32 `json:"readyReplicas,omitempty"`

	// MasterPod is the name of the current master pod.
	// +optional
	MasterPod string `json:"masterPod,omitempty"`

	// Phase describes the current lifecycle phase of the Valkey cluster.
	// +optional
	Phase ValkeyPhase `json:"phase,omitempty"`

	// Message is a human-readable description of the current state.
	// +optional
	Message string `json:"message,omitempty"`

	// OperatorVersion is the version of the operator that last reconciled this resource.
	// +optional
	OperatorVersion string `json:"operatorVersion,omitempty"`

	// ObserverReady indicates whether the observer deployment is ready.
	// Only set when observer is enabled.
	// +optional
	ObserverReady *bool `json:"observerReady,omitempty"`

	// Conditions represent the latest available observations of the Valkey state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}