v1

type ESTAuthorizedClient struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ESTAuthorizedClientSpec   `json:"spec,omitempty"`
	Status ESTAuthorizedClientStatus `json:"status,omitempty"`
}

type ESTAuthorizedClientList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ESTAuthorizedClient `json:"items"`
}

type ESTAuthorizedClientSpec struct {
	// Subject is the Common Name (CN) of the client certificate.
	// It is used to identify the client when requesting a certificate from the EST server.
	// +kubebuilder:validation:Required
	Subject string `json:"subject"`

	// SubjectAltNames is an optional field that allows you to specify additional
	// subject alternative names for the certificate. These names can be used to identify the client
	// in addition to the main subject DN.
	SubjectAltNames []string `json:"subjectAltNames,omitempty"`

	// PresharedKeyRef is a reference to a secret that contains the pre-shared key
	// used for authentication. The secret must be in the same namespace as the ESTAuthorizedClient resource.
	// The secret should contain a key named "username" for the username and "password" for the password.
	PresharedKeyRef SecretRef `json:"presharedKeyRef,omitempty"`

	// TrustAnchor is a reference to a secret that contains the CA certificate used to verify the EST client's certificate.
	// When present, client certificate validation relies on the specified CA certificate instead of using the system's CA certificates.
	// The secret must be in the same namespace as the ESTAuthorizedClient resource and contain a key named "ca.crt" with the CA certificate in PEM format.
	TrustAnchor SecretRef `json:"trustAnchor,omitempty"`

	// SignerName is the name of the Issuer or ClusterIssuer
	// that will be used to sign the certificate.
	// It should be in the format "issuers.cert-manager.io/<namespace>.<issuer-name>" or
	// "clusterissuers.cert-manager.io/<cluster-issuer-name>".
	// See https://cert-manager.io/docs/usage/kube-csr/#signer-name for more details.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^(issuers|clusterissuers)\.cert-manager\.io/([a-z][a-z-]*\.)?[a-z][a-z-]*$`
	SignerName string `json:"signerName"`

	// CSRAutoApprove indicates whether the Certificate Signing Request (CSR) should be automatically approved.
	// If set to true, the CSR will be automatically approved by the controller.
	// If set to false, the CSR will need to be manually approved by a user with the appropriate permissions.
	// This field defaults to true.
	// +kubebuilder:default=true
	CSRAutoApprove bool `json:"csrAutoApprove"`

	// Duration is the duration for which the certificate will be valid.
	// Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
	// +kubebuilder:default="1128h"
	Duration *metav1.Duration `json:"duration"`
}

type ESTAuthorizedClientStatus struct {
	// CurrentCSRName is the name of the latest CertificateSigningRequest.
	CurrentCSRName string `json:"latestCSRName,omitempty"`

	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type SecretRef struct {
	// SecretName is the name of the secret.
	// +kubebuilder:validation:Required
	SecretName string `json:"secretName"`
}