v1alpha1

type Condition struct {
	// Type of condition.
	// +required
	Type ConditionType `json:"type" description:"type of status condition"`

	// Status of the condition, one of True, False, Unknown.
	// +required
	Status corev1.ConditionStatus `json:"status" description:"status of the condition, one of True, False, Unknown"`

	// LastTransitionTime is the last time the condition transitioned from one status to another.
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" description:"last time the condition transitioned from one status to another"`

	// The reason for the condition's last transition.
	// +optional
	Reason string `json:"reason,omitempty" description:"one-word CamelCase reason for the condition's last transition"`

	// A human readable message indicating details about the transition.
	// +optional
	Message string `json:"message,omitempty" description:"human-readable message indicating details about last transition"`
}

type ConditionType string

type Conditions []Condition

type CookieConfig struct {
	// Session determines whether to generate a session cookie with no expiration.
	Session bool `json:"session,omitempty"`

	// TTL is the ttl for generated cookies. Cannot be specified for session cookies.
	TTL metav1.Duration `json:"ttl,omitempty"`

	// Path is the path to set for the cookie.
	Path string `json:"path,omitempty"`
}

type Destination struct {
	// Name is the destination of all intentions defined in this config entry.
	// This may be set to the wildcard character (*) to match
	// all services that don't otherwise have intentions defined.
	Name string `json:"name,omitempty"`
	// Namespace specifies the namespace the config entry will apply to.
	// This may be set to the wildcard character (*) to match all services
	// in all namespaces that don't otherwise have intentions defined.
	Namespace string `json:"namespace,omitempty"`
}

type Expose struct {
	// Checks defines whether paths associated with Consul checks will be exposed.
	// This flag triggers exposing all HTTP and GRPC check paths registered for the service.
	Checks bool `json:"checks,omitempty"`

	// Paths is the list of paths exposed through the proxy.
	Paths []ExposePath `json:"paths,omitempty"`
}

type ExposePath struct {
	// ListenerPort defines the port of the proxy's listener for exposed paths.
	ListenerPort int `json:"listenerPort,omitempty"`

	// Path is the path to expose through the proxy, ie. "/metrics".
	Path string `json:"path,omitempty"`

	// LocalPathPort is the port that the service is listening on for the given path.
	LocalPathPort int `json:"localPathPort,omitempty"`

	// Protocol describes the upstream's service protocol.
	// Valid values are "http" and "http2", defaults to "http".
	Protocol string `json:"protocol,omitempty"`
}

type GatewayTLSConfig struct {
	// Indicates that TLS should be enabled for this gateway service.
	Enabled bool `json:"enabled"`
}

type HashPolicy struct {
	// Field is the attribute type to hash on.
	// Must be one of "header", "cookie", or "query_parameter".
	// Cannot be specified along with sourceIP.
	Field string `json:"field,omitempty"`

	// FieldValue is the value to hash.
	// ie. header name, cookie name, URL query parameter name
	// Cannot be specified along with sourceIP.
	FieldValue string `json:"fieldValue,omitempty"`

	// CookieConfig contains configuration for the "cookie" hash policy type.
	CookieConfig *CookieConfig `json:"cookieConfig,omitempty"`

	// SourceIP determines whether the hash should be of the source IP rather than of a field and field value.
	// Cannot be specified along with field or fieldValue.
	SourceIP bool `json:"sourceIP,omitempty"`

	// Terminal will short circuit the computation of the hash when multiple hash policies are present.
	// If a hash is computed when a Terminal policy is evaluated,
	// then that hash will be used and subsequent hash policies will be ignored.
	Terminal bool `json:"terminal,omitempty"`
}

type IngressGateway struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IngressGatewaySpec `json:"spec,omitempty"`
	Status `json:"status,omitempty"`
}

type IngressGatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IngressGateway `json:"items"`
}

type IngressGatewaySpec struct {
	// TLS holds the TLS configuration for this gateway.
	TLS GatewayTLSConfig `json:"tls,omitempty"`
	// Listeners declares what ports the ingress gateway should listen on, and
	// what services to associated to those ports.
	Listeners []IngressListener `json:"listeners,omitempty"`
}

type IngressGatewayWebhook struct {
	ConsulClient *capi.Client
	Logger       logr.Logger

	// EnableConsulNamespaces indicates that a user is running Consul Enterprise
	// with version 1.7+ which supports namespaces.
	EnableConsulNamespaces bool

	// EnableNSMirroring causes Consul namespaces to be created to match the
	// k8s namespace of any config entry custom resource. Config entries will
	// be created in the matching Consul namespace.
	EnableNSMirroring bool

	// ConsulDestinationNamespace is the namespace in Consul that the config entry created
	// in k8s will get mapped into. If the Consul namespace does not already exist, it will
	// be created.
	ConsulDestinationNamespace string

	// NSMirroringPrefix works in conjunction with Namespace Mirroring.
	// It is the prefix added to the Consul namespace to map to a specific.
	// k8s namespace. For example, if `mirroringK8SPrefix` is set to "k8s-", a
	// service in the k8s `staging` namespace will be registered into the
	// `k8s-staging` Consul namespace.
	NSMirroringPrefix string

	client.Client
	// contains filtered or unexported fields
}

type IngressListener struct {
	// Port declares the port on which the ingress gateway should listen for traffic.
	Port int `json:"port,omitempty"`

	// Protocol declares what type of traffic this listener is expected to
	// receive. Depending on the protocol, a listener might support multiplexing
	// services over a single port, or additional discovery chain features. The
	// current supported values are: (tcp | http | http2 | grpc).
	Protocol string `json:"protocol,omitempty"`

	// Services declares the set of services to which the listener forwards
	// traffic.
	//
	// For "tcp" protocol listeners, only a single service is allowed.
	// For "http" listeners, multiple services can be declared.
	Services []IngressService `json:"services,omitempty"`
}

type IngressService struct {
	// Name declares the service to which traffic should be forwarded.
	//
	// This can either be a specific service, or the wildcard specifier,
	// "*". If the wildcard specifier is provided, the listener must be of "http"
	// protocol and means that the listener will forward traffic to all services.
	//
	// A name can be specified on multiple listeners, and will be exposed on both
	// of the listeners.
	Name string `json:"name,omitempty"`

	// Hosts is a list of hostnames which should be associated to this service on
	// the defined listener. Only allowed on layer 7 protocols, this will be used
	// to route traffic to the service by matching the Host header of the HTTP
	// request.
	//
	// If a host is provided for a service that also has a wildcard specifier
	// defined, the host will override the wildcard-specifier-provided
	// "<service-name>.*" domain for that listener.
	//
	// This cannot be specified when using the wildcard specifier, "*", or when
	// using a "tcp" listener.
	Hosts []string `json:"hosts,omitempty"`

	// Namespace is the namespace where the service is located.
	// Namespacing is a Consul Enterprise feature.
	Namespace string `json:"namespace,omitempty"`
}

type IntentionAction string

type IntentionHTTPHeaderPermission struct {
	// Name is the name of the header to match.
	Name string `json:"name,omitempty"`
	// Present matches if the header with the given name is present with any value.
	Present bool `json:"present,omitempty"`
	// Exact matches if the header with the given name is this value.
	Exact string `json:"exact,omitempty"`
	// Prefix matches if the header with the given name has this prefix.
	Prefix string `json:"prefix,omitempty"`
	// Suffix matches if the header with the given name has this suffix.
	Suffix string `json:"suffix,omitempty"`
	// Regex matches if the header with the given name matches this pattern.
	Regex string `json:"regex,omitempty"`
	// Invert inverts the logic of the match.
	Invert bool `json:"invert,omitempty"`
}

type IntentionHTTPHeaderPermissions []IntentionHTTPHeaderPermission

type IntentionHTTPPermission struct {
	// PathExact is the exact path to match on the HTTP request path.
	PathExact string `json:"pathExact,omitempty"`
	// PathPrefix is the path prefix to match on the HTTP request path.
	PathPrefix string `json:"pathPrefix,omitempty"`
	// PathRegex is the regular expression to match on the HTTP request path.
	PathRegex string `json:"pathRegex,omitempty"`
	// Header is a set of criteria that can match on HTTP request headers.
	// If more than one is configured all must match for the overall match to apply.
	Header IntentionHTTPHeaderPermissions `json:"header,omitempty"`
	// Methods is a list of HTTP methods for which this match applies. If unspecified
	// all HTTP methods are matched. If provided the names must be a valid method.
	Methods []string `json:"methods,omitempty"`
}

type IntentionPermission struct {
	// Action is one of "allow" or "deny" for the action that
	// should be taken if this permission matches a request.
	Action IntentionAction `json:"action,omitempty"`
	// HTTP is a set of HTTP-specific authorization criteria.
	HTTP *IntentionHTTPPermission `json:"http,omitempty"`
}

type IntentionPermissions []*IntentionPermission

type LeastRequestConfig struct {
	// ChoiceCount determines the number of random healthy hosts from which to select the one with the least requests.
	ChoiceCount uint32 `json:"choiceCount,omitempty"`
}

type LinkedService struct {
	// The namespace the service is registered in.
	Namespace string `json:"namespace,omitempty"`

	// Name is the name of the service, as defined in Consul's catalog.
	Name string `json:"name,omitempty"`

	// CAFile is the optional path to a CA certificate to use for TLS connections
	// from the gateway to the linked service.
	CAFile string `json:"caFile,omitempty"`

	// CertFile is the optional path to a client certificate to use for TLS connections
	// from the gateway to the linked service.
	CertFile string `json:"certFile,omitempty"`

	// KeyFile is the optional path to a private key to use for TLS connections
	// from the gateway to the linked service.
	KeyFile string `json:"keyFile,omitempty"`

	// SNI is the optional name to specify during the TLS handshake with a linked service.
	SNI string `json:"sni,omitempty"`
}

type LoadBalancer struct {
	// Policy is the load balancing policy used to select a host.
	Policy string `json:"policy,omitempty"`

	// RingHashConfig contains configuration for the "ringHash" policy type.
	RingHashConfig *RingHashConfig `json:"ringHashConfig,omitempty"`

	// LeastRequestConfig contains configuration for the "leastRequest" policy type.
	LeastRequestConfig *LeastRequestConfig `json:"leastRequestConfig,omitempty"`

	// HashPolicies is a list of hash policies to use for hashing load balancing algorithms.
	// Hash policies are evaluated individually and combined such that identical lists
	// result in the same hash.
	// If no hash policies are present, or none are successfully evaluated,
	// then a random backend host will be selected.
	HashPolicies []HashPolicy `json:"hashPolicies,omitempty"`
}

type Mesh struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   MeshSpec `json:"spec,omitempty"`
	Status `json:"status,omitempty"`
}

type MeshGateway struct {
	// Mode is the mode that should be used for the upstream connection.
	// One of none, local, or remote.
	Mode string `json:"mode,omitempty"`
}

type MeshGatewayMode string

type MeshList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Mesh `json:"items"`
}

type MeshSpec struct {
	TransparentProxy TransparentProxyMeshConfig `json:"transparentProxy,omitempty"`
}

type MeshWebhook struct {
	client.Client
	ConsulClient *capi.Client
	Logger       logr.Logger

	EnableConsulNamespaces bool
	EnableNSMirroring      bool
	// contains filtered or unexported fields
}

type PassiveHealthCheck struct {
	// Interval between health check analysis sweeps. Each sweep may remove
	// hosts or return hosts to the pool.
	Interval metav1.Duration `json:"interval,omitempty"`
	// MaxFailures is the count of consecutive failures that results in a host
	// being removed from the pool.
	MaxFailures uint32 `json:"maxFailures,omitempty"`
}

type ProxyDefaults struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ProxyDefaultsSpec `json:"spec,omitempty"`
	Status            `json:"status,omitempty"`
}

type ProxyDefaultsList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ProxyDefaults `json:"items"`
}

type ProxyDefaultsSpec struct {
	// Config is an arbitrary map of configuration values used by Connect proxies.
	// Any values that your proxy allows can be configured globally here.
	// Supports JSON config values. See https://www.consul.io/docs/connect/proxies/envoy#configuration-formatting
	// +kubebuilder:validation:Type=object
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:pruning:PreserveUnknownFields
	Config json.RawMessage `json:"config,omitempty"`
	// MeshGateway controls the default mesh gateway configuration for this service.
	MeshGateway MeshGateway `json:"meshGateway,omitempty"`
	// Expose controls the default expose path configuration for Envoy.
	Expose Expose `json:"expose,omitempty"`
	// TransparentProxy controls configuration specific to proxies in transparent mode.
	// Note: This cannot be set using the CRD and should be set using annotations on the
	// services that are part of the mesh.
	TransparentProxy *TransparentProxy `json:"transparentProxy,omitempty"`
	// Mode can be one of "direct" or "transparent". "transparent" represents that inbound and outbound
	// application traffic is being captured and redirected through the proxy. This mode does not
	// enable the traffic redirection itself. Instead it signals Consul to configure Envoy as if
	// traffic is already being redirected. "direct" represents that the proxy's listeners must be
	// dialed directly by the local application and other proxies.
	// Note: This cannot be set using the CRD and should be set using annotations on the
	// services that are part of the mesh.
	Mode *ProxyMode `json:"mode,omitempty"`
}

type ProxyDefaultsWebhook struct {
	client.Client
	ConsulClient *capi.Client
	Logger       logr.Logger

	EnableConsulNamespaces bool
	EnableNSMirroring      bool
	// contains filtered or unexported fields
}

type ProxyMode string

type RingHashConfig struct {
	// MinimumRingSize determines the minimum number of entries in the hash ring.
	MinimumRingSize uint64 `json:"minimumRingSize,omitempty"`

	// MaximumRingSize determines the maximum number of entries in the hash ring.
	MaximumRingSize uint64 `json:"maximumRingSize,omitempty"`
}

type ServiceDefaults struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ServiceDefaultsSpec `json:"spec,omitempty"`
	Status            `json:"status,omitempty"`
}

type ServiceDefaultsList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceDefaults `json:"items"`
}

type ServiceDefaultsSpec struct {
	// Protocol sets the protocol of the service. This is used by Connect proxies for
	// things like observability features and to unlock usage of the
	// service-splitter and service-router config entries for a service.
	Protocol string `json:"protocol,omitempty"`
	// MeshGateway controls the default mesh gateway configuration for this service.
	MeshGateway MeshGateway `json:"meshGateway,omitempty"`
	// Expose controls the default expose path configuration for Envoy.
	Expose Expose `json:"expose,omitempty"`
	// ExternalSNI is an optional setting that allows for the TLS SNI value
	// to be changed to a non-connect value when federating with an external system.
	ExternalSNI string `json:"externalSNI,omitempty"`
	// TransparentProxy controls configuration specific to proxies in transparent mode.
	// Note: This cannot be set using the CRD and should be set using annotations on the
	// services that are part of the mesh.
	TransparentProxy *TransparentProxy `json:"transparentProxy,omitempty"`
	// Mode can be one of "direct" or "transparent". "transparent" represents that inbound and outbound
	// application traffic is being captured and redirected through the proxy. This mode does not
	// enable the traffic redirection itself. Instead it signals Consul to configure Envoy as if
	// traffic is already being redirected. "direct" represents that the proxy's listeners must be
	// dialed directly by the local application and other proxies.
	// Note: This cannot be set using the CRD and should be set using annotations on the
	// services that are part of the mesh.
	Mode *ProxyMode `json:"mode,omitempty"`
	// UpstreamConfig controls default configuration settings that apply across all upstreams,
	// and per-upstream configuration overrides. Note that per-upstream configuration applies
	// across all federated datacenters to the pairing of source and upstream destination services.
	UpstreamConfig *Upstreams `json:"upstreamConfig,omitempty"`
}

type ServiceDefaultsWebhook struct {
	ConsulClient *capi.Client
	Logger       logr.Logger

	// EnableConsulNamespaces indicates that a user is running Consul Enterprise
	// with version 1.7+ which supports namespaces.
	EnableConsulNamespaces bool

	// EnableNSMirroring causes Consul namespaces to be created to match the
	// k8s namespace of any config entry custom resource. Config entries will
	// be created in the matching Consul namespace.
	EnableNSMirroring bool

	// ConsulDestinationNamespace is the namespace in Consul that the config entry created
	// in k8s will get mapped into. If the Consul namespace does not already exist, it will
	// be created.
	ConsulDestinationNamespace string

	// NSMirroringPrefix works in conjunction with Namespace Mirroring.
	// It is the prefix added to the Consul namespace to map to a specific.
	// k8s namespace. For example, if `mirroringK8SPrefix` is set to "k8s-", a
	// service in the k8s `staging` namespace will be registered into the
	// `k8s-staging` Consul namespace.
	NSMirroringPrefix string

	client.Client
	// contains filtered or unexported fields
}

type ServiceIntentions struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ServiceIntentionsSpec `json:"spec,omitempty"`
	Status `json:"status,omitempty"`
}

type ServiceIntentionsList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceIntentions `json:"items"`
}

type ServiceIntentionsSpec struct {
	// Destination is the intention destination that will have the authorization granted to.
	Destination Destination `json:"destination,omitempty"`
	// Sources is the list of all intention sources and the authorization granted to those sources.
	// The order of this list does not matter, but out of convenience Consul will always store this
	// reverse sorted by intention precedence, as that is the order that they will be evaluated at enforcement time.
	Sources SourceIntentions `json:"sources,omitempty"`
}

type ServiceIntentionsWebhook struct {
	client.Client
	ConsulClient *capi.Client
	Logger       logr.Logger

	EnableConsulNamespaces     bool
	EnableNSMirroring          bool
	ConsulDestinationNamespace string
	NSMirroringPrefix          string
	// contains filtered or unexported fields
}

type ServiceResolver struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ServiceResolverSpec `json:"spec,omitempty"`
	Status            `json:"status,omitempty"`
}

type ServiceResolverFailover struct {
	// Service is the service to resolve instead of the default as the failover
	// group of instances during failover.
	Service string `json:"service,omitempty"`
	// ServiceSubset is the named subset of the requested service to resolve as
	// the failover group of instances. If empty the default subset for the
	// requested service is used.
	ServiceSubset string `json:"serviceSubset,omitempty"`
	// Namespace is the namespace to resolve the requested service from to form
	// the failover group of instances. If empty the current namespace is used.
	Namespace string `json:"namespace,omitempty"`
	// Datacenters is a fixed list of datacenters to try during failover.
	Datacenters []string `json:"datacenters,omitempty"`
}

type ServiceResolverFailoverMap map[string]ServiceResolverFailover

type ServiceResolverList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceResolver `json:"items"`
}

type ServiceResolverRedirect struct {
	// Service is a service to resolve instead of the current service.
	Service string `json:"service,omitempty"`
	// ServiceSubset is a named subset of the given service to resolve instead
	// of one defined as that service's DefaultSubset If empty the default
	// subset is used.
	ServiceSubset string `json:"serviceSubset,omitempty"`
	// Namespace is the namespace to resolve the service from instead of the
	// current one.
	Namespace string `json:"namespace,omitempty"`
	// Datacenter is the datacenter to resolve the service from instead of the
	// current one.
	Datacenter string `json:"datacenter,omitempty"`
}

type ServiceResolverSpec struct {
	// DefaultSubset is the subset to use when no explicit subset is requested.
	// If empty the unnamed subset is used.
	DefaultSubset string `json:"defaultSubset,omitempty"`
	// Subsets is map of subset name to subset definition for all usable named
	// subsets of this service. The map key is the name of the subset and all
	// names must be valid DNS subdomain elements.
	// This may be empty, in which case only the unnamed default subset will
	// be usable.
	Subsets ServiceResolverSubsetMap `json:"subsets,omitempty"`
	// Redirect when configured, all attempts to resolve the service this
	// resolver defines will be substituted for the supplied redirect
	// EXCEPT when the redirect has already been applied.
	// When substituting the supplied redirect, all other fields besides
	// Kind, Name, and Redirect will be ignored.
	Redirect *ServiceResolverRedirect `json:"redirect,omitempty"`
	// Failover controls when and how to reroute traffic to an alternate pool of
	// service instances.
	// The map is keyed by the service subset it applies to and the special
	// string "*" is a wildcard that applies to any subset not otherwise
	// specified here.
	Failover ServiceResolverFailoverMap `json:"failover,omitempty"`
	// ConnectTimeout is the timeout for establishing new network connections
	// to this service.
	ConnectTimeout metav1.Duration `json:"connectTimeout,omitempty"`
	// LoadBalancer determines the load balancing policy and configuration for services
	// issuing requests to this upstream service.
	LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty"`
}

type ServiceResolverSubset struct {
	// Filter is the filter expression to be used for selecting instances of the
	// requested service. If empty all healthy instances are returned. This
	// expression can filter on the same selectors as the Health API endpoint.
	Filter string `json:"filter,omitempty"`
	// OnlyPassing specifies the behavior of the resolver's health check
	// interpretation. If this is set to false, instances with checks in the
	// passing as well as the warning states will be considered healthy. If this
	// is set to true, only instances with checks in the passing state will be
	// considered healthy.
	OnlyPassing bool `json:"onlyPassing,omitempty"`
}

type ServiceResolverSubsetMap map[string]ServiceResolverSubset

type ServiceResolverWebhook struct {
	ConsulClient *capi.Client
	Logger       logr.Logger

	// EnableConsulNamespaces indicates that a user is running Consul Enterprise
	// with version 1.7+ which supports namespaces.
	EnableConsulNamespaces bool

	// EnableNSMirroring causes Consul namespaces to be created to match the
	// k8s namespace of any config entry custom resource. Config entries will
	// be created in the matching Consul namespace.
	EnableNSMirroring bool

	// ConsulDestinationNamespace is the namespace in Consul that the config entry created
	// in k8s will get mapped into. If the Consul namespace does not already exist, it will
	// be created.
	ConsulDestinationNamespace string

	// NSMirroringPrefix works in conjunction with Namespace Mirroring.
	// It is the prefix added to the Consul namespace to map to a specific.
	// k8s namespace. For example, if `mirroringK8SPrefix` is set to "k8s-", a
	// service in the k8s `staging` namespace will be registered into the
	// `k8s-staging` Consul namespace.
	NSMirroringPrefix string

	client.Client
	// contains filtered or unexported fields
}

type ServiceRoute struct {
	// Match is a set of criteria that can match incoming L7 requests.
	// If empty or omitted it acts as a catch-all.
	Match *ServiceRouteMatch `json:"match,omitempty"`
	// Destination controls how to proxy the matching request(s) to a service.
	Destination *ServiceRouteDestination `json:"destination,omitempty"`
}

type ServiceRouteDestination struct {
	// Service is the service to resolve instead of the default service.
	// If empty then the default service name is used.
	Service string `json:"service,omitempty"`
	// ServiceSubset is a named subset of the given service to resolve instead
	// of the one defined as that service's DefaultSubset.
	// If empty, the default subset is used.
	ServiceSubset string `json:"serviceSubset,omitempty"`
	// Namespace is the Consul namespace to resolve the service from instead of
	// the current namespace. If empty the current namespace is assumed.
	Namespace string `json:"namespace,omitempty"`
	// PrefixRewrite defines how to rewrite the HTTP request path before proxying
	// it to its final destination.
	// This requires that either match.http.pathPrefix or match.http.pathExact
	// be configured on this route.
	PrefixRewrite string `json:"prefixRewrite,omitempty"`
	// RequestTimeout is the total amount of time permitted for the entire
	// downstream request (and retries) to be processed.
	RequestTimeout metav1.Duration `json:"requestTimeout,omitempty"`
	// NumRetries is the number of times to retry the request when a retryable result occurs
	NumRetries uint32 `json:"numRetries,omitempty"`
	// RetryOnConnectFailure allows for connection failure errors to trigger a retry.
	RetryOnConnectFailure bool `json:"retryOnConnectFailure,omitempty"`
	// RetryOnStatusCodes is a flat list of http response status codes that are eligible for retry.
	RetryOnStatusCodes []uint32 `json:"retryOnStatusCodes,omitempty"`
}

type ServiceRouteHTTPMatch struct {
	// PathExact is an exact path to match on the HTTP request path.
	PathExact string `json:"pathExact,omitempty"`
	// PathPrefix is a path prefix to match on the HTTP request path.
	PathPrefix string `json:"pathPrefix,omitempty"`
	// PathRegex is a regular expression to match on the HTTP request path.
	PathRegex string `json:"pathRegex,omitempty"`

	// Header is a set of criteria that can match on HTTP request headers.
	// If more than one is configured all must match for the overall match to apply.
	Header []ServiceRouteHTTPMatchHeader `json:"header,omitempty"`
	// QueryParam is a set of criteria that can match on HTTP query parameters.
	// If more than one is configured all must match for the overall match to apply.
	QueryParam []ServiceRouteHTTPMatchQueryParam `json:"queryParam,omitempty"`
	// Methods is a list of HTTP methods for which this match applies.
	// If unspecified all http methods are matched.
	Methods []string `json:"methods,omitempty"`
}

type ServiceRouteHTTPMatchHeader struct {
	// Name is the name of the header to match.
	Name string `json:"name"`
	// Present will match if the header with the given name is present with any value.
	Present bool `json:"present,omitempty"`
	// Exact will match if the header with the given name is this value.
	Exact string `json:"exact,omitempty"`
	// Prefix will match if the header with the given name has this prefix.
	Prefix string `json:"prefix,omitempty"`
	// Suffix will match if the header with the given name has this suffix.
	Suffix string `json:"suffix,omitempty"`
	// Regex will match if the header with the given name matches this pattern.
	Regex string `json:"regex,omitempty"`
	// Invert inverts the logic of the match.
	Invert bool `json:"invert,omitempty"`
}

type ServiceRouteHTTPMatchQueryParam struct {
	// Name is the name of the query parameter to match on.
	Name string `json:"name"`
	// Present will match if the query parameter with the given name is present
	// with any value.
	Present bool `json:"present,omitempty"`
	// Exact will match if the query parameter with the given name is this value.
	Exact string `json:"exact,omitempty"`
	// Regex will match if the query parameter with the given name matches this pattern.
	Regex string `json:"regex,omitempty"`
}

type ServiceRouteMatch struct {
	// HTTP is a set of http-specific match criteria.
	HTTP *ServiceRouteHTTPMatch `json:"http,omitempty"`
}

type ServiceRouter struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ServiceRouterSpec `json:"spec,omitempty"`
	Status `json:"status,omitempty"`
}

type ServiceRouterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceRouter `json:"items"`
}

type ServiceRouterSpec struct {
	// Routes are the list of routes to consider when processing L7 requests.
	// The first route to match in the list is terminal and stops further
	// evaluation. Traffic that fails to match any of the provided routes will
	// be routed to the default service.
	Routes []ServiceRoute `json:"routes,omitempty"`
}

type ServiceRouterWebhook struct {
	ConsulClient *capi.Client
	Logger       logr.Logger

	// EnableConsulNamespaces indicates that a user is running Consul Enterprise
	// with version 1.7+ which supports namespaces.
	EnableConsulNamespaces bool

	// EnableNSMirroring causes Consul namespaces to be created to match the
	// k8s namespace of any config entry custom resource. Config entries will
	// be created in the matching Consul namespace.
	EnableNSMirroring bool

	// ConsulDestinationNamespace is the namespace in Consul that the config entry created
	// in k8s will get mapped into. If the Consul namespace does not already exist, it will
	// be created.
	ConsulDestinationNamespace string

	// NSMirroringPrefix works in conjunction with Namespace Mirroring.
	// It is the prefix added to the Consul namespace to map to a specific.
	// k8s namespace. For example, if `mirroringK8SPrefix` is set to "k8s-", a
	// service in the k8s `staging` namespace will be registered into the
	// `k8s-staging` Consul namespace.
	NSMirroringPrefix string

	client.Client
	// contains filtered or unexported fields
}

type ServiceSplit struct {
	// Weight is a value between 0 and 100 reflecting what portion of traffic should be directed to this split.
	// The smallest representable weight is 1/10000 or .01%.
	Weight float32 `json:"weight,omitempty"`
	// Service is the service to resolve instead of the default.
	Service string `json:"service,omitempty"`
	// ServiceSubset is a named subset of the given service to resolve instead of one defined
	// as that service's DefaultSubset. If empty the default subset is used.
	ServiceSubset string `json:"serviceSubset,omitempty"`
	// The namespace to resolve the service from instead of the current namespace.
	// If empty the current namespace is assumed.
	Namespace string `json:"namespace,omitempty"`
}

type ServiceSplits []ServiceSplit

type ServiceSplitter struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ServiceSplitterSpec `json:"spec,omitempty"`
	Status `json:"status,omitempty"`
}

type ServiceSplitterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServiceSplitter `json:"items"`
}

type ServiceSplitterSpec struct {
	// Splits defines how much traffic to send to which set of service instances during a traffic split.
	// The sum of weights across all splits must add up to 100.
	Splits ServiceSplits `json:"splits,omitempty"`
}

type ServiceSplitterWebhook struct {
	ConsulClient *capi.Client
	Logger       logr.Logger

	// EnableConsulNamespaces indicates that a user is running Consul Enterprise
	// with version 1.7+ which supports namespaces.
	EnableConsulNamespaces bool

	// EnableNSMirroring causes Consul namespaces to be created to match the
	// k8s namespace of any config entry custom resource. Config entries will
	// be created in the matching Consul namespace.
	EnableNSMirroring bool

	// ConsulDestinationNamespace is the namespace in Consul that the config entry created
	// in k8s will get mapped into. If the Consul namespace does not already exist, it will
	// be created.
	ConsulDestinationNamespace string

	// NSMirroringPrefix works in conjunction with Namespace Mirroring.
	// It is the prefix added to the Consul namespace to map to a specific.
	// k8s namespace. For example, if `mirroringK8SPrefix` is set to "k8s-", a
	// service in the k8s `staging` namespace will be registered into the
	// `k8s-staging` Consul namespace.
	NSMirroringPrefix string

	client.Client
	// contains filtered or unexported fields
}

type SourceIntention struct {
	// Name is the source of the intention. This is the name of a
	// Consul service. The service doesn't need to be registered.
	Name string `json:"name,omitempty"`
	// Namespace is the namespace for the Name parameter.
	Namespace string `json:"namespace,omitempty"`
	// Action is required for an L4 intention, and should be set to one of
	// "allow" or "deny" for the action that should be taken if this intention matches a request.
	Action IntentionAction `json:"action,omitempty"`
	// Permissions is the list of all additional L7 attributes that extend the intention match criteria.
	// Permission precedence is applied top to bottom. For any given request the first permission to match
	// in the list is terminal and stops further evaluation. As with L4 intentions, traffic that fails to
	// match any of the provided permissions in this intention will be subject to the default intention
	// behavior is defined by the default ACL policy. This should be omitted for an L4 intention
	// as it is mutually exclusive with the Action field.
	Permissions IntentionPermissions `json:"permissions,omitempty"`
	// Description for the intention. This is not used by Consul, but is presented in API responses to assist tooling.
	Description string `json:"description,omitempty"`
}

type SourceIntentions []*SourceIntention

type Status struct {
	// Conditions indicate the latest available observations of a resource's current state.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions Conditions `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// LastSyncedTime is the last time the resource successfully synced with Consul.
	// +optional
	LastSyncedTime *metav1.Time `json:"lastSyncedTime,omitempty" description:"last time the condition transitioned from one status to another"`
}

type TerminatingGateway struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   TerminatingGatewaySpec `json:"spec,omitempty"`
	Status `json:"status,omitempty"`
}

type TerminatingGatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []TerminatingGateway `json:"items"`
}

type TerminatingGatewaySpec struct {
	// Services is a list of service names represented by the terminating gateway.
	Services []LinkedService `json:"services,omitempty"`
}

type TerminatingGatewayWebhook struct {
	ConsulClient *capi.Client
	Logger       logr.Logger

	// EnableConsulNamespaces indicates that a user is running Consul Enterprise
	// with version 1.7+ which supports namespaces.
	EnableConsulNamespaces bool

	// EnableNSMirroring causes Consul namespaces to be created to match the
	// k8s namespace of any config entry custom resource. Config entries will
	// be created in the matching Consul namespace.
	EnableNSMirroring bool

	// ConsulDestinationNamespace is the namespace in Consul that the config entry created
	// in k8s will get mapped into. If the Consul namespace does not already exist, it will
	// be created.
	ConsulDestinationNamespace string

	// NSMirroringPrefix works in conjunction with Namespace Mirroring.
	// It is the prefix added to the Consul namespace to map to a specific.
	// k8s namespace. For example, if `mirroringK8SPrefix` is set to "k8s-", a
	// service in the k8s `staging` namespace will be registered into the
	// `k8s-staging` Consul namespace.
	NSMirroringPrefix string

	client.Client
	// contains filtered or unexported fields
}

type TransparentProxy struct {
	// OutboundListenerPort is the port of the listener where outbound application
	// traffic is being redirected to.
	OutboundListenerPort int `json:"outboundListenerPort,omitempty"`

	// DialedDirectly indicates whether transparent proxies can dial this proxy instance directly.
	// The discovery chain is not considered when dialing a service instance directly.
	// This setting is useful when addressing stateful services, such as a database cluster with a leader node.
	DialedDirectly bool `json:"dialedDirectly,omitempty"`
}

type TransparentProxyMeshConfig struct {
	// MeshDestinationsOnly determines whether sidecar proxies operating in "transparent" mode can proxy traffic
	// to IP addresses not registered in Consul's catalog. If enabled, traffic will only be proxied to upstreams
	// with service registrations in the catalog.
	MeshDestinationsOnly bool `json:"meshDestinationsOnly,omitempty"`
}

type Upstream struct {
	// Name is only accepted within a service-defaults config entry.
	Name string `json:"name,omitempty"`
	// Namespace is only accepted within a service-defaults config entry.
	Namespace string `json:"namespace,omitempty"`
	// EnvoyListenerJSON is a complete override ("escape hatch") for the upstream's
	// listener.
	// Note: This escape hatch is NOT compatible with the discovery chain and
	// will be ignored if a discovery chain is active.
	EnvoyListenerJSON string `json:"envoyListenerJSON,omitempty"`
	// EnvoyClusterJSON is a complete override ("escape hatch") for the upstream's
	// cluster. The Connect client TLS certificate and context will be injected
	// overriding any TLS settings present.
	// Note: This escape hatch is NOT compatible with the discovery chain and
	// will be ignored if a discovery chain is active.
	EnvoyClusterJSON string `json:"envoyClusterJSON,omitempty"`
	// Protocol describes the upstream's service protocol. Valid values are "tcp",
	// "http" and "grpc". Anything else is treated as tcp. This enables protocol
	// aware features like per-request metrics and connection pooling, tracing,
	// routing etc.
	Protocol string `json:"protocol,omitempty"`
	// ConnectTimeoutMs is the number of milliseconds to timeout making a new
	// connection to this upstream. Defaults to 5000 (5 seconds) if not set.
	ConnectTimeoutMs int `json:"connectTimeoutMs,omitempty"`
	// Limits are the set of limits that are applied to the proxy for a specific upstream of a
	// service instance.
	Limits *UpstreamLimits `json:"limits,omitempty"`
	// PassiveHealthCheck configuration determines how upstream proxy instances will
	// be monitored for removal from the load balancing pool.
	PassiveHealthCheck *PassiveHealthCheck `json:"passiveHealthCheck,omitempty"`
	// MeshGatewayConfig controls how Mesh Gateways are configured and used.
	MeshGateway MeshGateway `json:"meshGateway,omitempty"`
}

type UpstreamLimits struct {
	// MaxConnections is the maximum number of connections the local proxy can
	// make to the upstream service.
	MaxConnections *int `json:"maxConnections,omitempty"`
	// MaxPendingRequests is the maximum number of requests that will be queued
	// waiting for an available connection. This is mostly applicable to HTTP/1.1
	// clusters since all HTTP/2 requests are streamed over a single
	// connection.
	MaxPendingRequests *int `json:"maxPendingRequests,omitempty"`
	// MaxConcurrentRequests is the maximum number of in-flight requests that will be allowed
	// to the upstream cluster at a point in time. This is mostly applicable to HTTP/2
	// clusters since all HTTP/1.1 requests are limited by MaxConnections.
	MaxConcurrentRequests *int `json:"maxConcurrentRequests,omitempty"`
}

type Upstreams struct {
	// Defaults contains default configuration for all upstreams of a given
	// service. The name field must be empty.
	Defaults *Upstream `json:"defaults,omitempty"`
	// Overrides is a slice of per-service configuration. The name field is
	// required.
	Overrides []*Upstream `json:"overrides,omitempty"`
}