v1alpha1

type Address struct {
	// ip contains a fixed IP address assigned to the port. It must belong
	// to the referenced subnet's CIDR. If not specified, OpenStack
	// allocates an available IP from the referenced subnet.
	// +optional
	IP *IPvAny `json:"ip,omitempty"`

	// subnetRef references the subnet from which to allocate the IP
	// address.
	// +required
	// +orc:kustomize:ref=Subnet
	SubnetRef KubernetesNameRef `json:"subnetRef,omitempty"`
}

type AddressScope struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec specifies the desired state of the resource.
	// +required
	Spec AddressScopeSpec `json:"spec,omitzero"`

	// status defines the observed state of the resource.
	// +optional
	Status AddressScopeStatus `json:"status,omitempty"`
}

type AddressScopeFilter struct {
	// name of the existing resource
	// +optional
	Name *OpenStackName `json:"name,omitempty"`

	// projectRef is a reference to the ORC Project which this resource is associated with.
	// +optional
	// +orc:kustomize:ref=Project
	ProjectRef *KubernetesNameRef `json:"projectRef,omitempty"`

	// ipVersion is the IP protocol version.
	// +optional
	IPVersion IPVersion `json:"ipVersion,omitempty"`

	// shared indicates whether this resource is shared across all
	// projects or not. By default, only admin users can change set
	// this value.
	// +optional
	Shared *bool `json:"shared,omitempty"`
}

type AddressScopeImport struct {
	// id contains the unique identifier of an existing OpenStack resource. Note
	// that when specifying an import by ID, the resource MUST already exist.
	// The ORC object will enter an error state if the resource does not exist.
	// +kubebuilder:validation:Format:=uuid
	// +kubebuilder:validation:MaxLength:=36
	// +optional
	ID *string `json:"id,omitempty"` //nolint:kubeapilinter

	// filter contains a resource query which is expected to return a single
	// result. The controller will continue to retry if filter returns no
	// results. If filter returns multiple results the controller will set an
	// error state and will not continue to retry.
	// +optional
	Filter *AddressScopeFilter `json:"filter,omitempty"`
}

type AddressScopeList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the list metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// items contains a list of AddressScope.
	// +required
	Items []AddressScope `json:"items"`
}

type AddressScopeResourceSpec struct {
	// name will be the name of the created resource. If not specified, the
	// name of the ORC object will be used.
	// +optional
	Name *OpenStackName `json:"name,omitempty"`

	// projectRef is a reference to the ORC Project which this resource is associated with.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="projectRef is immutable"
	// +orc:kustomize:ref=Project
	ProjectRef *KubernetesNameRef `json:"projectRef,omitempty"`

	// ipVersion is the IP protocol version.
	// +required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ipVersion is immutable"
	IPVersion IPVersion `json:"ipVersion"`

	// shared indicates whether this resource is shared across all
	// projects or not. By default, only admin users can change set
	// this value. We can't unshared a shared address scope; Neutron
	// enforces this.
	// +optional
	// +kubebuilder:validation:XValidation:rule="!(oldSelf && !self)",message="shared address scope can't be unshared"
	Shared *bool `json:"shared,omitempty"`
}

type AddressScopeResourceStatus struct {
	// name is a Human-readable name for the resource. Might not be unique.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Name string `json:"name,omitempty"`

	// projectID is the ID of the Project to which the resource is associated.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	ProjectID string `json:"projectID,omitempty"`

	// ipVersion is the IP protocol version.
	// +optional
	IPVersion int32 `json:"ipVersion,omitempty"`

	// shared indicates whether this resource is shared across all
	// projects or not. By default, only admin users can change set
	// this value.
	// +optional
	Shared *bool `json:"shared,omitempty"`
}

type AddressScopeSpec struct {
	// import refers to an existing OpenStack resource which will be imported instead of
	// creating a new one.
	// +optional
	Import *AddressScopeImport `json:"import,omitempty"`

	// resource specifies the desired state of the resource.
	//
	// resource may not be specified if the management policy is `unmanaged`.
	//
	// resource must be specified if the management policy is `managed`.
	// +optional
	Resource *AddressScopeResourceSpec `json:"resource,omitempty"`

	// managementPolicy defines how ORC will treat the object. Valid values are
	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
	// ORC will import an existing resource, and will not apply updates to it or
	// delete it.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
	// +kubebuilder:default:=managed
	// +optional
	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`

	// managedOptions specifies options which may be applied to managed objects.
	// +optional
	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`

	// resyncPeriod defines how frequently the controller will re-reconcile
	// this resource even when no changes have been detected. This overrides
	// the global default resync period. The value must be a valid Go duration
	// string, e.g. "10m", "1h". Set to "0s" to disable periodic resync for
	// this resource. Very low values may cause excessive OpenStack API load.
	// +optional
	ResyncPeriod *metav1.Duration `json:"resyncPeriod,omitempty"` //nolint:kubeapilinter // metav1.Duration is appropriate for user-facing duration config

	// cloudCredentialsRef points to a secret containing OpenStack credentials
	// +required
	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef,omitzero"`
}

type AddressScopeStatus struct {
	// conditions represents the observed status of the object.
	// Known .status.conditions.type are: "Available", "Progressing"
	//
	// Available represents the availability of the OpenStack resource. If it is
	// true then the resource is ready for use.
	//
	// Progressing indicates whether the controller is still attempting to
	// reconcile the current state of the OpenStack resource to the desired
	// state. Progressing will be False either because the desired state has
	// been achieved, or because some terminal error prevents it from ever being
	// achieved and the controller is no longer attempting to reconcile. If
	// Progressing is True, an observer waiting on the resource should continue
	// to wait.
	//
	// +kubebuilder:validation:MaxItems:=32
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// id is the unique identifier of the OpenStack resource.
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// resource contains the observed state of the OpenStack resource.
	// +optional
	Resource *AddressScopeResourceStatus `json:"resource,omitempty"`

	// lastSyncTime is the timestamp of the last successful reconciliation
	// that fetched state from OpenStack. It is updated each time the
	// controller successfully reads the resource state from the OpenStack
	// API.
	// +optional
	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}

type AllocationPool struct {
	// start is the first IP address in the allocation pool.
	// +required
	Start IPvAny `json:"start,omitempty"`

	// end is the last IP address in the allocation pool.
	// +required
	End IPvAny `json:"end,omitempty"`
}

type AllocationPoolStatus struct {
	// start is the first IP address in the allocation pool.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Start string `json:"start,omitempty"`

	// end is the last IP address in the allocation pool.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	End string `json:"end,omitempty"`
}

type AllowedAddressPair struct {
	// ip contains an IP address which a server connected to the port can
	// send packets with. It can be an IP Address or a CIDR (if supported
	// by the underlying extension plugin).
	// +required
	IP IPvAny `json:"ip,omitempty"`

	// mac contains a MAC address which a server connected to the port can
	// send packets with. Defaults to the MAC address of the port.
	// +optional
	MAC *MAC `json:"mac,omitempty"`
}

type AllowedAddressPairStatus struct {
	// ip contains an IP address which a server connected to the port can
	// send packets with.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	IP string `json:"ip,omitempty"`

	// mac contains a MAC address which a server connected to the port can
	// send packets with.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	MAC string `json:"mac,omitempty"`
}

type ApplicationCredential struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec specifies the desired state of the resource.
	// +required
	Spec ApplicationCredentialSpec `json:"spec,omitzero"`

	// status defines the observed state of the resource.
	// +optional
	Status ApplicationCredentialStatus `json:"status,omitempty"`
}

type ApplicationCredentialAccessRule struct {
	// path that the application credential is permitted to access
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Path *string `json:"path,omitempty"`

	// method that the application credential is permitted to use for a given API endpoint
	// +optional
	Method *HTTPMethod `json:"method,omitempty"`

	// serviceRef identifier for the service that the application credential is permitted to access
	// +optional
	// +orc:kustomize:ref=Service
	ServiceRef *KubernetesNameRef `json:"serviceRef,omitempty"`
}

type ApplicationCredentialAccessRuleStatus struct {
	// id is the ID of this access rule
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// path that the application credential is permitted to access
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	Path *string `json:"path,omitempty"`

	// method that the application credential is permitted to use for a given API endpoint
	// +kubebuilder:validation:MaxLength=32
	// +optional
	Method *string `json:"method,omitempty"`

	// service type identifier for the service that the application credential is permitted to access
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	Service *string `json:"service,omitempty"`
}

type ApplicationCredentialFilter struct {
	// userRef is a reference to the ORC User which this resource is associated with.
	// Note: Due to the nature of the OpenStack API, managing application credentials for a user different than the one ORC is authenticated against can be computationally expensive. In the worst case, all application credentials of all users have to be queried.
	// +required
	// +orc:kustomize:ref=User
	UserRef KubernetesNameRef `json:"userRef,omitempty"`

	// name of the existing resource
	// +optional
	Name *OpenStackName `json:"name,omitempty"`

	// description of the existing resource
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	Description *string `json:"description,omitempty"`
}

type ApplicationCredentialImport struct {
	// id contains the unique identifier of an existing OpenStack resource. Note
	// that when specifying an import by ID, the resource MUST already exist.
	// The ORC object will enter an error state if the resource does not exist.
	// +kubebuilder:validation:Format:=uuid
	// +kubebuilder:validation:MaxLength:=36
	// +optional
	ID *string `json:"id,omitempty"` //nolint:kubeapilinter

	// filter contains a resource query which is expected to return a single
	// result. The controller will continue to retry if filter returns no
	// results. If filter returns multiple results the controller will set an
	// error state and will not continue to retry.
	// +optional
	Filter *ApplicationCredentialFilter `json:"filter,omitempty"`
}

type ApplicationCredentialList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the list metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// items contains a list of ApplicationCredential.
	// +required
	Items []ApplicationCredential `json:"items"`
}

type ApplicationCredentialResourceSpec struct {
	// name will be the name of the created resource. If not specified, the
	// name of the ORC object will be used.
	// +optional
	Name *OpenStackName `json:"name,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Description *string `json:"description,omitempty"`

	// userRef is a reference to the ORC User which this resource is associated with.
	// Note: Due to the nature of the OpenStack API, managing application credentials for a user different than the one ORC is authenticated against can be computationally expensive. In the worst case, all application credentials of all users have to be queried.
	// +required
	// +orc:kustomize:ref=User
	UserRef KubernetesNameRef `json:"userRef,omitempty"`

	// unrestricted is a flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts
	// +optional
	Unrestricted *bool `json:"unrestricted,omitempty"`

	// secretRef is a reference to a Secret containing the application credential secret
	// +required
	// +orc:kustomize:ref=Secret
	SecretRef KubernetesNameRef `json:"secretRef,omitempty"`

	// roleRefs may only contain roles that the user has assigned on the project. If not provided, the roles assigned to the application credential will be the same as the roles in the current token.
	// +kubebuilder:validation:MaxItems:=256
	// +listType=atomic
	// +optional
	// +orc:kustomize:ref=Role
	RoleRefs []KubernetesNameRef `json:"roleRefs,omitempty"`

	// accessRules is a list of fine grained access control rules
	// +kubebuilder:validation:MaxItems:=256
	// +listType=atomic
	// +optional
	AccessRules []ApplicationCredentialAccessRule `json:"accessRules,omitempty"`

	// expiresAt is the time of expiration for the application credential. If unset, the application credential does not expire.
	// +optional
	ExpiresAt *metav1.Time `json:"expiresAt,omitempty"`
}

type ApplicationCredentialResourceStatus struct {
	// name is a Human-readable name for the resource. Might not be unique.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Name string `json:"name,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Description string `json:"description,omitempty"`

	// unrestricted is a flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts
	// +optional
	Unrestricted *bool `json:"unrestricted,omitempty"`

	// projectID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	ProjectID string `json:"projectID,omitempty"`

	// roles is a list of role objects may only contain roles that the user has assigned on the project
	// +kubebuilder:validation:MaxItems:=64
	// +listType=atomic
	// +optional
	Roles []ApplicationCredentialRoleStatus `json:"roles"`

	// expiresAt is the time of expiration for the application credential. If unset, the application credential does not expire.
	// +optional
	ExpiresAt *metav1.Time `json:"expiresAt"`

	// accessRules is a list of fine grained access control rules
	// +kubebuilder:validation:MaxItems:=64
	// +listType=atomic
	// +optional
	AccessRules []ApplicationCredentialAccessRuleStatus `json:"accessRules,omitempty"`
}

type ApplicationCredentialRoleStatus struct {
	// name of an existing role
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	Name *string `json:"name,omitempty"`

	// id is the ID of a role
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// domainID of the domain of this role
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	DomainID *string `json:"domainID,omitempty"`
}

type ApplicationCredentialSpec struct {
	// import refers to an existing OpenStack resource which will be imported instead of
	// creating a new one.
	// +optional
	Import *ApplicationCredentialImport `json:"import,omitempty"`

	// resource specifies the desired state of the resource.
	//
	// resource may not be specified if the management policy is `unmanaged`.
	//
	// resource must be specified if the management policy is `managed`.
	// +optional
	Resource *ApplicationCredentialResourceSpec `json:"resource,omitempty"`

	// managementPolicy defines how ORC will treat the object. Valid values are
	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
	// ORC will import an existing resource, and will not apply updates to it or
	// delete it.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
	// +kubebuilder:default:=managed
	// +optional
	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`

	// managedOptions specifies options which may be applied to managed objects.
	// +optional
	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`

	// resyncPeriod defines how frequently the controller will re-reconcile
	// this resource even when no changes have been detected. This overrides
	// the global default resync period. The value must be a valid Go duration
	// string, e.g. "10m", "1h". Set to "0s" to disable periodic resync for
	// this resource. Very low values may cause excessive OpenStack API load.
	// +optional
	ResyncPeriod *metav1.Duration `json:"resyncPeriod,omitempty"` //nolint:kubeapilinter // metav1.Duration is appropriate for user-facing duration config

	// cloudCredentialsRef points to a secret containing OpenStack credentials
	// +required
	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef,omitzero"`
}

type ApplicationCredentialStatus struct {
	// conditions represents the observed status of the object.
	// Known .status.conditions.type are: "Available", "Progressing"
	//
	// Available represents the availability of the OpenStack resource. If it is
	// true then the resource is ready for use.
	//
	// Progressing indicates whether the controller is still attempting to
	// reconcile the current state of the OpenStack resource to the desired
	// state. Progressing will be False either because the desired state has
	// been achieved, or because some terminal error prevents it from ever being
	// achieved and the controller is no longer attempting to reconcile. If
	// Progressing is True, an observer waiting on the resource should continue
	// to wait.
	//
	// +kubebuilder:validation:MaxItems:=32
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// id is the unique identifier of the OpenStack resource.
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// resource contains the observed state of the OpenStack resource.
	// +optional
	Resource *ApplicationCredentialResourceStatus `json:"resource,omitempty"`

	// lastSyncTime is the timestamp of the last successful reconciliation
	// that fetched state from OpenStack. It is updated each time the
	// controller successfully reads the resource state from the OpenStack
	// API.
	// +optional
	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}

type AvailabilityZoneHint string

type CIDR string

type CloudCredentialsRefProvider interface {
	GetCloudCredentialsRef() (*string, *CloudCredentialsReference)
}

type CloudCredentialsReference struct {
	// secretName is the name of a secret in the same namespace as the resource being provisioned.
	// The secret must contain a key named `clouds.yaml` which contains an OpenStack clouds.yaml file.
	// The secret may optionally contain a key named `cacert` containing a PEM-encoded CA certificate.
	// +required
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=253
	// +orc:kustomize:ref=Secret
	SecretName string `json:"secretName,omitempty"`

	// cloudName specifies the name of the entry in the clouds.yaml file to use.
	// +required
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=256
	CloudName string `json:"cloudName,omitempty"`
}

type DNSDomain string

type DNSZone struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec specifies the desired state of the resource.
	// +required
	Spec DNSZoneSpec `json:"spec,omitzero"`

	// status defines the observed state of the resource.
	// +optional
	Status DNSZoneStatus `json:"status,omitempty"`
}

type DNSZoneFilter struct {
	// name of the existing resource
	// +optional
	Name *DesignateFQDN `json:"name,omitempty"`

	// email of the existing resource
	// +kubebuilder:validation:Format:=email
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Email *string `json:"email,omitempty"`

	// description of the existing resource
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Description *string `json:"description,omitempty"`

	// type of the existing resource
	// +optional
	Type *DNSZoneType `json:"type,omitempty"`
}

type DNSZoneImport struct {
	// id contains the unique identifier of an existing OpenStack resource. Note
	// that when specifying an import by ID, the resource MUST already exist.
	// The ORC object will enter an error state if the resource does not exist.
	// +kubebuilder:validation:Format:=uuid
	// +kubebuilder:validation:MaxLength:=36
	// +optional
	ID *string `json:"id,omitempty"` //nolint:kubeapilinter

	// filter contains a resource query which is expected to return a single
	// result. The controller will continue to retry if filter returns no
	// results. If filter returns multiple results the controller will set an
	// error state and will not continue to retry.
	// +optional
	Filter *DNSZoneFilter `json:"filter,omitempty"`
}

type DNSZoneList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the list metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// items contains a list of DNSZone.
	// +required
	Items []DNSZone `json:"items"`
}

type DNSZoneResourceSpec struct {
	// name is the name of the zone, e.g. "example.com.". Must end with a period, per Designate's
	// own convention.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="name is immutable"
	// +required
	Name *DesignateFQDN `json:"name,omitempty"` //nolint:kubeapilinter // always populated; pointer kept so the shared getResourceName helper compiles

	// email is the email address of the administrator for the zone. Required for PRIMARY zones,
	// not applicable to SECONDARY zones.
	// +kubebuilder:validation:Format:=email
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Email *string `json:"email,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Description *string `json:"description,omitempty"`

	// ttl is the default Time To Live for the zone's recordsets, in seconds.
	// +kubebuilder:validation:Minimum:=1
	// +kubebuilder:validation:Maximum:=2147483647
	// +optional
	TTL *int32 `json:"ttl,omitempty"`

	// type is PRIMARY (this zone's data is authoritative here) or SECONDARY (replicated from
	// masters over AXFR).
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="type is immutable"
	// +kubebuilder:default:="PRIMARY"
	// +optional
	Type DNSZoneType `json:"type,omitempty"`

	// masters are the master server IPs to transfer a SECONDARY zone's records from over AXFR.
	// Required when type is SECONDARY, must not be set when type is PRIMARY.
	// +kubebuilder:validation:MaxItems:=32
	// +listType=set
	// +optional
	Masters []IPvAny `json:"masters,omitempty"`
}

type DNSZoneResourceStatus struct {
	// name is the name of the zone, e.g. "example.com.".
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Name string `json:"name,omitempty"`

	// email is the email contact of the zone.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Email string `json:"email,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Description string `json:"description,omitempty"`

	// ttl is the default Time To Live for the zone's recordsets, in seconds.
	// +optional
	TTL *int32 `json:"ttl,omitempty"`

	// type is PRIMARY or SECONDARY.
	// +kubebuilder:validation:MaxLength=255
	// +optional
	Type string `json:"type,omitempty"`

	// masters are the master server IPs this SECONDARY zone transfers its records from.
	// +kubebuilder:validation:MaxItems:=32
	// +kubebuilder:validation:items:MaxLength=1024
	// +listType=set
	// +optional
	Masters []string `json:"masters,omitempty"`

	// serial is the zone's current SOA serial number.
	// +optional
	Serial *int64 `json:"serial,omitempty"`

	// transferredAt is the last time this SECONDARY zone's records were refreshed from its
	// masters. Unset for PRIMARY zones.
	// +optional
	TransferredAt *metav1.Time `json:"transferredAt,omitempty"`

	// projectID is the ID of the OpenStack project that owns this zone. Not to be confused with
	// a DNSZoneShare's targetProjectID, which grants a *different* project access without
	// changing ownership.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	ProjectID string `json:"projectID,omitempty"`
}

type DNSZoneSpec struct {
	// import refers to an existing OpenStack resource which will be imported instead of
	// creating a new one.
	// +optional
	Import *DNSZoneImport `json:"import,omitempty"`

	// resource specifies the desired state of the resource.
	//
	// resource may not be specified if the management policy is `unmanaged`.
	//
	// resource must be specified if the management policy is `managed`.
	// +optional
	Resource *DNSZoneResourceSpec `json:"resource,omitempty"`

	// managementPolicy defines how ORC will treat the object. Valid values are
	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
	// ORC will import an existing resource, and will not apply updates to it or
	// delete it.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
	// +kubebuilder:default:=managed
	// +optional
	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`

	// managedOptions specifies options which may be applied to managed objects.
	// +optional
	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`

	// resyncPeriod defines how frequently the controller will re-reconcile
	// this resource even when no changes have been detected. This overrides
	// the global default resync period. The value must be a valid Go duration
	// string, e.g. "10m", "1h". Set to "0s" to disable periodic resync for
	// this resource. Very low values may cause excessive OpenStack API load.
	// +optional
	ResyncPeriod *metav1.Duration `json:"resyncPeriod,omitempty"` //nolint:kubeapilinter // metav1.Duration is appropriate for user-facing duration config

	// cloudCredentialsRef points to a secret containing OpenStack credentials
	// +required
	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef,omitzero"`
}

type DNSZoneStatus struct {
	// conditions represents the observed status of the object.
	// Known .status.conditions.type are: "Available", "Progressing"
	//
	// Available represents the availability of the OpenStack resource. If it is
	// true then the resource is ready for use.
	//
	// Progressing indicates whether the controller is still attempting to
	// reconcile the current state of the OpenStack resource to the desired
	// state. Progressing will be False either because the desired state has
	// been achieved, or because some terminal error prevents it from ever being
	// achieved and the controller is no longer attempting to reconcile. If
	// Progressing is True, an observer waiting on the resource should continue
	// to wait.
	//
	// +kubebuilder:validation:MaxItems:=32
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// id is the unique identifier of the OpenStack resource.
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// resource contains the observed state of the OpenStack resource.
	// +optional
	Resource *DNSZoneResourceStatus `json:"resource,omitempty"`

	// lastSyncTime is the timestamp of the last successful reconciliation
	// that fetched state from OpenStack. It is updated each time the
	// controller successfully reads the resource state from the OpenStack
	// API.
	// +optional
	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}

type DNSZoneType string

type DesignateFQDN string

type Domain struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec specifies the desired state of the resource.
	// +required
	Spec DomainSpec `json:"spec,omitzero"`

	// status defines the observed state of the resource.
	// +optional
	Status DomainStatus `json:"status,omitempty"`
}

type DomainFilter struct {
	// name of the existing resource
	// +optional
	Name *KeystoneName `json:"name,omitempty"`

	// enabled defines whether a domain is enabled or not. Default is true.
	// Note: Users can only authorize against an enabled domain (and any of its projects).
	// +optional
	Enabled *bool `json:"enabled,omitempty"`
}

type DomainImport struct {
	// id contains the unique identifier of an existing OpenStack resource. Note
	// that when specifying an import by ID, the resource MUST already exist.
	// The ORC object will enter an error state if the resource does not exist.
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9-]+$`
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=64
	// +optional
	ID *string `json:"id,omitempty"` //nolint:kubeapilinter

	// filter contains a resource query which is expected to return a single
	// result. The controller will continue to retry if filter returns no
	// results. If filter returns multiple results the controller will set an
	// error state and will not continue to retry.
	// +optional
	Filter *DomainFilter `json:"filter,omitempty"`
}

type DomainList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the list metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// items contains a list of Domain.
	// +required
	Items []Domain `json:"items"`
}

type DomainResourceSpec struct {
	// name will be the name of the created resource. If not specified, the
	// name of the ORC object will be used.
	// +optional
	Name *KeystoneName `json:"name,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Description *string `json:"description,omitempty"`

	// enabled defines whether a domain is enabled or not. Default is true.
	// Note: Users can only authorize against an enabled domain (and any of its projects).
	// +optional
	Enabled *bool `json:"enabled,omitempty"`
}

type DomainResourceStatus struct {
	// name is a Human-readable name for the resource. Might not be unique.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Name string `json:"name,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Description string `json:"description,omitempty"`

	// enabled defines whether a domain is enabled or not. Default is true.
	// Note: Users can only authorize against an enabled domain (and any of its projects).
	// +optional
	Enabled *bool `json:"enabled,omitempty"`
}

type DomainSpec struct {
	// import refers to an existing OpenStack resource which will be imported instead of
	// creating a new one.
	// +optional
	Import *DomainImport `json:"import,omitempty"`

	// resource specifies the desired state of the resource.
	//
	// resource may not be specified if the management policy is `unmanaged`.
	//
	// resource must be specified if the management policy is `managed`.
	// +optional
	Resource *DomainResourceSpec `json:"resource,omitempty"`

	// managementPolicy defines how ORC will treat the object. Valid values are
	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
	// ORC will import an existing resource, and will not apply updates to it or
	// delete it.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
	// +kubebuilder:default:=managed
	// +optional
	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`

	// managedOptions specifies options which may be applied to managed objects.
	// +optional
	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`

	// resyncPeriod defines how frequently the controller will re-reconcile
	// this resource even when no changes have been detected. This overrides
	// the global default resync period. The value must be a valid Go duration
	// string, e.g. "10m", "1h". Set to "0s" to disable periodic resync for
	// this resource. Very low values may cause excessive OpenStack API load.
	// +optional
	ResyncPeriod *metav1.Duration `json:"resyncPeriod,omitempty"` //nolint:kubeapilinter // metav1.Duration is appropriate for user-facing duration config

	// cloudCredentialsRef points to a secret containing OpenStack credentials
	// +required
	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef,omitzero"`
}

type DomainStatus struct {
	// conditions represents the observed status of the object.
	// Known .status.conditions.type are: "Available", "Progressing"
	//
	// Available represents the availability of the OpenStack resource. If it is
	// true then the resource is ready for use.
	//
	// Progressing indicates whether the controller is still attempting to
	// reconcile the current state of the OpenStack resource to the desired
	// state. Progressing will be False either because the desired state has
	// been achieved, or because some terminal error prevents it from ever being
	// achieved and the controller is no longer attempting to reconcile. If
	// Progressing is True, an observer waiting on the resource should continue
	// to wait.
	//
	// +kubebuilder:validation:MaxItems:=32
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// id is the unique identifier of the OpenStack resource.
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// resource contains the observed state of the OpenStack resource.
	// +optional
	Resource *DomainResourceStatus `json:"resource,omitempty"`

	// lastSyncTime is the timestamp of the last successful reconciliation
	// that fetched state from OpenStack. It is updated each time the
	// controller successfully reads the resource state from the OpenStack
	// API.
	// +optional
	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}

type Endpoint struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec specifies the desired state of the resource.
	// +required
	Spec EndpointSpec `json:"spec,omitzero"`

	// status defines the observed state of the resource.
	// +optional
	Status EndpointStatus `json:"status,omitempty"`
}

type EndpointFilter struct {
	// interface of the existing endpoint.
	// +kubebuilder:validation:Enum:=admin;internal;public
	// +optional
	Interface string `json:"interface,omitempty"`

	// serviceRef is a reference to the ORC Service which this resource is associated with.
	// +optional
	// +orc:kustomize:ref=Service
	ServiceRef *KubernetesNameRef `json:"serviceRef,omitempty"`

	// regionRef is a reference to the ORC Region which this resource is associated with.
	// +optional
	// +orc:kustomize:ref=Region
	RegionRef *KubernetesNameRef `json:"regionRef,omitempty"`

	// url is the URL of the existing endpoint.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	URL string `json:"url,omitempty"`
}

type EndpointImport struct {
	// id contains the unique identifier of an existing OpenStack resource. Note
	// that when specifying an import by ID, the resource MUST already exist.
	// The ORC object will enter an error state if the resource does not exist.
	// +kubebuilder:validation:Format:=uuid
	// +kubebuilder:validation:MaxLength:=36
	// +optional
	ID *string `json:"id,omitempty"` //nolint:kubeapilinter

	// filter contains a resource query which is expected to return a single
	// result. The controller will continue to retry if filter returns no
	// results. If filter returns multiple results the controller will set an
	// error state and will not continue to retry.
	// +optional
	Filter *EndpointFilter `json:"filter,omitempty"`
}

type EndpointList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the list metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// items contains a list of Endpoint.
	// +required
	Items []Endpoint `json:"items"`
}

type EndpointResourceSpec struct {
	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="description is immutable"
	Description *string `json:"description,omitempty"`

	// enabled indicates whether the endpoint is enabled or not.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`

	// interface indicates the visibility of the endpoint.
	// +kubebuilder:validation:Enum:=admin;internal;public
	// +required
	Interface string `json:"interface,omitempty"`

	// url is the endpoint URL.
	// +kubebuilder:validation:MaxLength=1024
	// +required
	URL string `json:"url"`

	// serviceRef is a reference to the ORC Service which this resource is associated with.
	// +required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="serviceRef is immutable"
	// +orc:kustomize:ref=Service
	ServiceRef KubernetesNameRef `json:"serviceRef,omitempty"`

	// regionRef is a reference to the ORC Region which this resource is associated with.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="regionRef is immutable"
	// +orc:kustomize:ref=Region
	RegionRef *KubernetesNameRef `json:"regionRef,omitempty"`
}

type EndpointResourceStatus struct {
	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Description string `json:"description,omitempty"`

	// enabled indicates whether the endpoint is enabled or not.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`

	// interface indicates the visibility of the endpoint.
	// +kubebuilder:validation:MaxLength=128
	// +optional
	Interface string `json:"interface,omitempty"`

	// url is the endpoint URL.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	URL string `json:"url,omitempty"`

	// serviceID is the ID of the Service to which the resource is associated.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	ServiceID string `json:"serviceID,omitempty"`

	// regionID is the name and ID of the Region to which the resource is associated.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	RegionID string `json:"regionID,omitempty"`
}

type EndpointSpec struct {
	// import refers to an existing OpenStack resource which will be imported instead of
	// creating a new one.
	// +optional
	Import *EndpointImport `json:"import,omitempty"`

	// resource specifies the desired state of the resource.
	//
	// resource may not be specified if the management policy is `unmanaged`.
	//
	// resource must be specified if the management policy is `managed`.
	// +optional
	Resource *EndpointResourceSpec `json:"resource,omitempty"`

	// managementPolicy defines how ORC will treat the object. Valid values are
	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
	// ORC will import an existing resource, and will not apply updates to it or
	// delete it.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
	// +kubebuilder:default:=managed
	// +optional
	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`

	// managedOptions specifies options which may be applied to managed objects.
	// +optional
	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`

	// resyncPeriod defines how frequently the controller will re-reconcile
	// this resource even when no changes have been detected. This overrides
	// the global default resync period. The value must be a valid Go duration
	// string, e.g. "10m", "1h". Set to "0s" to disable periodic resync for
	// this resource. Very low values may cause excessive OpenStack API load.
	// +optional
	ResyncPeriod *metav1.Duration `json:"resyncPeriod,omitempty"` //nolint:kubeapilinter // metav1.Duration is appropriate for user-facing duration config

	// cloudCredentialsRef points to a secret containing OpenStack credentials
	// +required
	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef,omitzero"`
}

type EndpointStatus struct {
	// conditions represents the observed status of the object.
	// Known .status.conditions.type are: "Available", "Progressing"
	//
	// Available represents the availability of the OpenStack resource. If it is
	// true then the resource is ready for use.
	//
	// Progressing indicates whether the controller is still attempting to
	// reconcile the current state of the OpenStack resource to the desired
	// state. Progressing will be False either because the desired state has
	// been achieved, or because some terminal error prevents it from ever being
	// achieved and the controller is no longer attempting to reconcile. If
	// Progressing is True, an observer waiting on the resource should continue
	// to wait.
	//
	// +kubebuilder:validation:MaxItems:=32
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// id is the unique identifier of the OpenStack resource.
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// resource contains the observed state of the OpenStack resource.
	// +optional
	Resource *EndpointResourceStatus `json:"resource,omitempty"`

	// lastSyncTime is the timestamp of the last successful reconciliation
	// that fetched state from OpenStack. It is updated each time the
	// controller successfully reads the resource state from the OpenStack
	// API.
	// +optional
	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}

type Ethertype string

type ExternalGateway struct {
	// networkRef is a reference to the ORC Network which the external
	// gateway is on.
	// +required
	// +orc:kustomize:ref=Network
	NetworkRef KubernetesNameRef `json:"networkRef,omitempty"`
}

type ExternalGatewayStatus struct {
	// networkID is the ID of the network the gateway is on.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	NetworkID string `json:"networkID,omitempty"`
}

type FilterByKeystoneTags struct {
	// tags is a list of tags to filter by. If specified, the resource must
	// have all of the tags specified to be included in the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=80
	Tags []KeystoneTag `json:"tags,omitempty"`

	// tagsAny is a list of tags to filter by. If specified, the resource
	// must have at least one of the tags specified to be included in the
	// result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=80
	TagsAny []KeystoneTag `json:"tagsAny,omitempty"`

	// notTags is a list of tags to filter by. If specified, resources which
	// contain all of the given tags will be excluded from the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=80
	NotTags []KeystoneTag `json:"notTags,omitempty"`

	// notTagsAny is a list of tags to filter by. If specified, resources
	// which contain any of the given tags will be excluded from the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=80
	NotTagsAny []KeystoneTag `json:"notTagsAny,omitempty"`
}

type FilterByNeutronTags struct {
	// tags is a list of tags to filter by. If specified, the resource must
	// have all of the tags specified to be included in the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=64
	Tags []NeutronTag `json:"tags,omitempty"`

	// tagsAny is a list of tags to filter by. If specified, the resource
	// must have at least one of the tags specified to be included in the
	// result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=64
	TagsAny []NeutronTag `json:"tagsAny,omitempty"`

	// notTags is a list of tags to filter by. If specified, resources which
	// contain all of the given tags will be excluded from the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=64
	NotTags []NeutronTag `json:"notTags,omitempty"`

	// notTagsAny is a list of tags to filter by. If specified, resources
	// which contain any of the given tags will be excluded from the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=64
	NotTagsAny []NeutronTag `json:"notTagsAny,omitempty"`
}

type FilterByServerTags struct {
	// tags is a list of tags to filter by. If specified, the resource must
	// have all of the tags specified to be included in the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=50
	Tags []ServerTag `json:"tags,omitempty"`

	// tagsAny is a list of tags to filter by. If specified, the resource
	// must have at least one of the tags specified to be included in the
	// result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=50
	TagsAny []ServerTag `json:"tagsAny,omitempty"`

	// notTags is a list of tags to filter by. If specified, resources which
	// contain all of the given tags will be excluded from the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=50
	NotTags []ServerTag `json:"notTags,omitempty"`

	// notTagsAny is a list of tags to filter by. If specified, resources
	// which contain any of the given tags will be excluded from the result.
	// +listType=set
	// +optional
	// +kubebuilder:validation:MaxItems:=50
	NotTagsAny []ServerTag `json:"notTagsAny,omitempty"`
}

type FixedIPStatus struct {
	// ip contains a fixed IP address assigned to the port.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	IP string `json:"ip,omitempty"`

	// subnetID is the ID of the subnet this IP is allocated from.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	SubnetID string `json:"subnetID,omitempty"`
}

type Flavor struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec specifies the desired state of the resource.
	// +required
	Spec FlavorSpec `json:"spec,omitzero"`

	// status defines the observed state of the resource.
	// +optional
	Status FlavorStatus `json:"status,omitempty"`
}

type FlavorExtraSpec struct {
	// name is the name of the extraspec
	// +kubebuilder:validation:Pattern="^[a-zA-Z0-9-_:. ]+$"
	// +kubebuilder:validation:MaxLength:=255
	// +required
	Name string `json:"name"`

	// value is the value of the extraspec
	// +kubebuilder:validation:MaxLength:=255
	// +required
	Value string `json:"value"`
}

type FlavorExtraSpecStatus struct {
	// name is the name of the extraspec
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Name string `json:"name,omitempty"`

	// value is the value of the extraspec
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Value string `json:"value,omitempty"`
}

type FlavorFilter struct {
	// name of the existing resource
	// +optional
	Name *OpenStackName `json:"name,omitempty"`

	// ram is the memory of the flavor, measured in MB.
	// +kubebuilder:validation:Minimum=1
	// +optional
	RAM *int32 `json:"ram,omitempty"`

	// vcpus is the number of vcpus for the flavor.
	// +kubebuilder:validation:Minimum=1
	// +optional
	Vcpus *int32 `json:"vcpus,omitempty"`

	// disk is the size of the root disk in GiB.
	// +kubebuilder:validation:Minimum=0
	// +optional
	Disk *int32 `json:"disk,omitempty"`
}

type FlavorImport struct {
	// id contains the unique identifier of an existing OpenStack resource. Note
	// that when specifying an import by ID, the resource MUST already exist.
	// The ORC object will enter an error state if the resource does not exist.
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9._-]([a-zA-Z0-9. _-]*[a-zA-Z0-9._-])?$`
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=255
	// +optional
	ID *string `json:"id,omitempty"` //nolint:kubeapilinter

	// filter contains a resource query which is expected to return a single
	// result. The controller will continue to retry if filter returns no
	// results. If filter returns multiple results the controller will set an
	// error state and will not continue to retry.
	// +optional
	Filter *FlavorFilter `json:"filter,omitempty"`
}

type FlavorList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the list metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// items contains a list of Flavor.
	// +required
	Items []Flavor `json:"items"`
}

type FlavorResourceSpec struct {
	// name will be the name of the created resource. If not specified, the
	// name of the ORC object will be used.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="name is immutable"
	// +optional
	Name *OpenStackName `json:"name,omitempty"`

	// id will be the id of the created resource. If not specified, a random
	// UUID will be generated by OpenStack.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=255
	// +kubebuilder:validation:Pattern=^[a-zA-Z0-9._-]([a-zA-Z0-9. _-]*[a-zA-Z0-9._-])?$
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="id is immutable"
	// +optional
	ID string `json:"id,omitempty"` //nolint:kubeapilinter // intentionally allow raw ID

	// description contains a free form description of the flavor.
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=65535
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="description is immutable"
	// +optional
	Description *string `json:"description,omitempty"`

	// ram is the memory of the flavor, measured in MB.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ram is immutable"
	// +required
	RAM int32 `json:"ram,omitempty"`

	// vcpus is the number of vcpus for the flavor.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="vcpus is immutable"
	// +required
	Vcpus int32 `json:"vcpus,omitempty"`

	// disk is the size of the root disk that will be created in GiB. If 0
	// the root disk will be set to exactly the size of the image used to
	// deploy the instance. However, in this case the scheduler cannot
	// select the compute host based on the virtual image size. Therefore,
	// 0 should only be used for volume booted instances or for testing
	// purposes. Volume-backed instances can be enforced for flavors with
	// zero root disk via the
	// os_compute_api:servers:create:zero_disk_flavor policy rule.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="disk is immutable"
	// +required
	Disk int32 `json:"disk"`

	// swap is the size of a dedicated swap disk that will be allocated, in
	// MiB. If 0 (the default), no dedicated swap disk will be created.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="swap is immutable"
	// +optional
	Swap int32 `json:"swap,omitempty"`

	// extraSpecs is a list of key-value pairs that define extra specifications for the flavor.
	// +kubebuilder:validation:MaxItems:=128
	// +listType=map
	// +listMapKey=name
	// +optional
	ExtraSpecs []FlavorExtraSpec `json:"extraSpecs,omitempty"`

	// isPublic flags a flavor as being available to all projects or not.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="isPublic is immutable"
	// +optional
	IsPublic *bool `json:"isPublic,omitempty"`

	// ephemeral is the size of the ephemeral disk that will be created, in GiB.
	// Ephemeral disks may be written over on server state changes. So should only
	// be used as a scratch space for applications that are aware of its
	// limitations. Defaults to 0.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ephemeral is immutable"
	// +optional
	Ephemeral int32 `json:"ephemeral,omitempty"`
}

type FlavorResourceStatus struct {
	// name is a Human-readable name for the flavor. Might not be unique.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Name string `json:"name,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MaxLength:=65535
	// +optional
	Description string `json:"description,omitempty"`

	// ram is the memory of the flavor, measured in MB.
	// +optional
	RAM *int32 `json:"ram,omitempty"`

	// vcpus is the number of vcpus for the flavor.
	// +optional
	Vcpus *int32 `json:"vcpus,omitempty"`

	// disk is the size of the root disk that will be created in GiB.
	// +optional
	Disk *int32 `json:"disk,omitempty"`

	// swap is the size of a dedicated swap disk that will be allocated, in
	// MiB.
	// +optional
	Swap *int32 `json:"swap,omitempty"`

	// extraSpecs is a map of key-value pairs that define extra specifications for the flavor.
	// +kubebuilder:validation:MaxItems:=128
	// +listType=atomic
	// +optional
	ExtraSpecs []FlavorExtraSpecStatus `json:"extraSpecs"`

	// isPublic flags a flavor as being available to all projects or not.
	// +optional
	IsPublic *bool `json:"isPublic,omitempty"`

	// ephemeral is the size of the ephemeral disk, in GiB.
	// +optional
	Ephemeral *int32 `json:"ephemeral,omitempty"`
}

type FlavorSpec struct {
	// import refers to an existing OpenStack resource which will be imported instead of
	// creating a new one.
	// +optional
	Import *FlavorImport `json:"import,omitempty"`

	// resource specifies the desired state of the resource.
	//
	// resource may not be specified if the management policy is `unmanaged`.
	//
	// resource must be specified if the management policy is `managed`.
	// +optional
	Resource *FlavorResourceSpec `json:"resource,omitempty"`

	// managementPolicy defines how ORC will treat the object. Valid values are
	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
	// ORC will import an existing resource, and will not apply updates to it or
	// delete it.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
	// +kubebuilder:default:=managed
	// +optional
	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`

	// managedOptions specifies options which may be applied to managed objects.
	// +optional
	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`

	// resyncPeriod defines how frequently the controller will re-reconcile
	// this resource even when no changes have been detected. This overrides
	// the global default resync period. The value must be a valid Go duration
	// string, e.g. "10m", "1h". Set to "0s" to disable periodic resync for
	// this resource. Very low values may cause excessive OpenStack API load.
	// +optional
	ResyncPeriod *metav1.Duration `json:"resyncPeriod,omitempty"` //nolint:kubeapilinter // metav1.Duration is appropriate for user-facing duration config

	// cloudCredentialsRef points to a secret containing OpenStack credentials
	// +required
	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef,omitzero"`
}

type FlavorStatus struct {
	// conditions represents the observed status of the object.
	// Known .status.conditions.type are: "Available", "Progressing"
	//
	// Available represents the availability of the OpenStack resource. If it is
	// true then the resource is ready for use.
	//
	// Progressing indicates whether the controller is still attempting to
	// reconcile the current state of the OpenStack resource to the desired
	// state. Progressing will be False either because the desired state has
	// been achieved, or because some terminal error prevents it from ever being
	// achieved and the controller is no longer attempting to reconcile. If
	// Progressing is True, an observer waiting on the resource should continue
	// to wait.
	//
	// +kubebuilder:validation:MaxItems:=32
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// id is the unique identifier of the OpenStack resource.
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// resource contains the observed state of the OpenStack resource.
	// +optional
	Resource *FlavorResourceStatus `json:"resource,omitempty"`

	// lastSyncTime is the timestamp of the last successful reconciliation
	// that fetched state from OpenStack. It is updated each time the
	// controller successfully reads the resource state from the OpenStack
	// API.
	// +optional
	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}

type FloatingIP struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec specifies the desired state of the resource.
	// +required
	Spec FloatingIPSpec `json:"spec,omitzero"`

	// status defines the observed state of the resource.
	// +optional
	Status FloatingIPStatus `json:"status,omitempty"`
}

type FloatingIPFilter struct {
	// floatingIP is the floatingip address.
	// +optional
	FloatingIP *IPvAny `json:"floatingIP,omitempty"`

	// description of the existing resource
	// +optional
	Description *NeutronDescription `json:"description,omitempty"`

	// floatingNetworkRef is a reference to the ORC Network which this resource is associated with.
	// +optional
	// +orc:kustomize:ref=Network
	FloatingNetworkRef *KubernetesNameRef `json:"floatingNetworkRef,omitempty"`

	// portRef is a reference to the ORC Port which this resource is associated with.
	// +optional
	// +orc:kustomize:ref=Port
	PortRef *KubernetesNameRef `json:"portRef,omitempty"`

	// projectRef is a reference to the ORC Project this resource is associated with.
	// Typically, only used by admin.
	// +optional
	// +orc:kustomize:ref=Project
	ProjectRef *KubernetesNameRef `json:"projectRef,omitempty"`

	// status is the status of the floatingip.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Status string `json:"status,omitempty"`

	FilterByNeutronTags `json:",inline"`
}

type FloatingIPImport struct {
	// id contains the unique identifier of an existing OpenStack resource. Note
	// that when specifying an import by ID, the resource MUST already exist.
	// The ORC object will enter an error state if the resource does not exist.
	// +kubebuilder:validation:Format:=uuid
	// +kubebuilder:validation:MaxLength:=36
	// +optional
	ID *string `json:"id,omitempty"` //nolint:kubeapilinter

	// filter contains a resource query which is expected to return a single
	// result. The controller will continue to retry if filter returns no
	// results. If filter returns multiple results the controller will set an
	// error state and will not continue to retry.
	// +optional
	Filter *FloatingIPFilter `json:"filter,omitempty"`
}

type FloatingIPList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the list metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// items contains a list of FloatingIP.
	// +required
	Items []FloatingIP `json:"items"`
}

type FloatingIPResourceSpec struct {
	// description is a human-readable description for the resource.
	// +optional
	Description *NeutronDescription `json:"description,omitempty"`

	// tags is a list of tags which will be applied to the floatingip.
	// +kubebuilder:validation:MaxItems:=64
	// +listType=set
	// +optional
	Tags []NeutronTag `json:"tags,omitempty"`

	// floatingNetworkRef references the network to which the floatingip is associated.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="floatingNetworkRef is immutable"
	// +orc:kustomize:ref=Network
	FloatingNetworkRef *KubernetesNameRef `json:"floatingNetworkRef,omitempty"`

	// floatingSubnetRef references the subnet to which the floatingip is associated.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="floatingSubnetRef is immutable"
	// +orc:kustomize:ref=Subnet
	FloatingSubnetRef *KubernetesNameRef `json:"floatingSubnetRef,omitempty"`

	// floatingIP is the IP that will be assigned to the floatingip. If not set, it will
	// be assigned automatically.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="floatingIP is immutable"
	FloatingIP *IPvAny `json:"floatingIP,omitempty"`

	// portRef is a reference to the ORC Port which this resource is associated with.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="portRef is immutable"
	// +orc:kustomize:ref=Port
	PortRef *KubernetesNameRef `json:"portRef,omitempty"`

	// fixedIP is the IP address of the port to which the floatingip is associated.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="fixedIP is immutable"
	FixedIP *IPvAny `json:"fixedIP,omitempty"`

	// projectRef is a reference to the ORC Project this resource is associated with.
	// Typically, only used by admin.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="projectRef is immutable"
	// +orc:kustomize:ref=Project
	ProjectRef *KubernetesNameRef `json:"projectRef,omitempty"`
}

type FloatingIPResourceStatus struct {
	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Description string `json:"description,omitempty"`

	// floatingNetworkID is the ID of the network to which the floatingip is associated.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	FloatingNetworkID string `json:"floatingNetworkID,omitempty"`

	// floatingIP is the IP address of the floatingip.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	FloatingIP string `json:"floatingIP,omitempty"`

	// portID is the ID of the port to which the floatingip is associated.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	PortID string `json:"portID,omitempty"`

	// fixedIP is the IP address of the port to which the floatingip is associated.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	FixedIP string `json:"fixedIP,omitempty"`

	// tenantID is the project owner of the resource.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	TenantID string `json:"tenantID,omitempty"`

	// projectID is the project owner of the resource.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	ProjectID string `json:"projectID,omitempty"`

	// status indicates the current status of the resource.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Status string `json:"status,omitempty"`

	// routerID is the ID of the router to which the floatingip is associated.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	RouterID string `json:"routerID,omitempty"`

	// tags is the list of tags on the resource.
	// +kubebuilder:validation:MaxItems:=64
	// +kubebuilder:validation:items:MaxLength=1024
	// +listType=atomic
	// +optional
	Tags []string `json:"tags,omitempty"`

	NeutronStatusMetadata `json:",inline"`
}

type FloatingIPSpec struct {
	// import refers to an existing OpenStack resource which will be imported instead of
	// creating a new one.
	// +optional
	Import *FloatingIPImport `json:"import,omitempty"`

	// resource specifies the desired state of the resource.
	//
	// resource may not be specified if the management policy is `unmanaged`.
	//
	// resource must be specified if the management policy is `managed`.
	// +optional
	Resource *FloatingIPResourceSpec `json:"resource,omitempty"`

	// managementPolicy defines how ORC will treat the object. Valid values are
	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
	// ORC will import an existing resource, and will not apply updates to it or
	// delete it.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
	// +kubebuilder:default:=managed
	// +optional
	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`

	// managedOptions specifies options which may be applied to managed objects.
	// +optional
	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`

	// resyncPeriod defines how frequently the controller will re-reconcile
	// this resource even when no changes have been detected. This overrides
	// the global default resync period. The value must be a valid Go duration
	// string, e.g. "10m", "1h". Set to "0s" to disable periodic resync for
	// this resource. Very low values may cause excessive OpenStack API load.
	// +optional
	ResyncPeriod *metav1.Duration `json:"resyncPeriod,omitempty"` //nolint:kubeapilinter // metav1.Duration is appropriate for user-facing duration config

	// cloudCredentialsRef points to a secret containing OpenStack credentials
	// +required
	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef,omitzero"`
}

type FloatingIPStatus struct {
	// conditions represents the observed status of the object.
	// Known .status.conditions.type are: "Available", "Progressing"
	//
	// Available represents the availability of the OpenStack resource. If it is
	// true then the resource is ready for use.
	//
	// Progressing indicates whether the controller is still attempting to
	// reconcile the current state of the OpenStack resource to the desired
	// state. Progressing will be False either because the desired state has
	// been achieved, or because some terminal error prevents it from ever being
	// achieved and the controller is no longer attempting to reconcile. If
	// Progressing is True, an observer waiting on the resource should continue
	// to wait.
	//
	// +kubebuilder:validation:MaxItems:=32
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// id is the unique identifier of the OpenStack resource.
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// resource contains the observed state of the OpenStack resource.
	// +optional
	Resource *FloatingIPResourceStatus `json:"resource,omitempty"`

	// lastSyncTime is the timestamp of the last successful reconciliation
	// that fetched state from OpenStack. It is updated each time the
	// controller successfully reads the resource state from the OpenStack
	// API.
	// +optional
	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}

type Group struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec specifies the desired state of the resource.
	// +required
	Spec GroupSpec `json:"spec,omitzero"`

	// status defines the observed state of the resource.
	// +optional
	Status GroupStatus `json:"status,omitempty"`
}

type GroupFilter struct {
	// name of the existing resource
	// +optional
	Name *KeystoneName `json:"name,omitempty"`

	// domainRef is a reference to the ORC Domain which this resource is associated with.
	// +optional
	// +orc:kustomize:ref=Domain
	DomainRef *KubernetesNameRef `json:"domainRef,omitempty"`
}

type GroupImport struct {
	// id contains the unique identifier of an existing OpenStack resource. Note
	// that when specifying an import by ID, the resource MUST already exist.
	// The ORC object will enter an error state if the resource does not exist.
	// +kubebuilder:validation:Format:=uuid
	// +kubebuilder:validation:MaxLength:=36
	// +optional
	ID *string `json:"id,omitempty"` //nolint:kubeapilinter

	// filter contains a resource query which is expected to return a single
	// result. The controller will continue to retry if filter returns no
	// results. If filter returns multiple results the controller will set an
	// error state and will not continue to retry.
	// +optional
	Filter *GroupFilter `json:"filter,omitempty"`
}

type GroupList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata contains the list metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// items contains a list of Group.
	// +required
	Items []Group `json:"items"`
}

type GroupResourceSpec struct {
	// name will be the name of the created resource. If not specified, the
	// name of the ORC object will be used.
	// +optional
	Name *KeystoneName `json:"name,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MinLength:=1
	// +kubebuilder:validation:MaxLength:=255
	// +optional
	Description *string `json:"description,omitempty"`

	// domainRef is a reference to the ORC Domain which this resource is associated with.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="domainRef is immutable"
	// +orc:kustomize:ref=Domain
	DomainRef *KubernetesNameRef `json:"domainRef,omitempty"`
}

type GroupResourceStatus struct {
	// name is a Human-readable name for the resource. Might not be unique.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Name string `json:"name,omitempty"`

	// description is a human-readable description for the resource.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	Description string `json:"description,omitempty"`

	// domainID is the ID of the Domain to which the resource is associated.
	// +kubebuilder:validation:MaxLength=1024
	// +optional
	DomainID string `json:"domainID,omitempty"`
}

type GroupSpec struct {
	// import refers to an existing OpenStack resource which will be imported instead of
	// creating a new one.
	// +optional
	Import *GroupImport `json:"import,omitempty"`

	// resource specifies the desired state of the resource.
	//
	// resource may not be specified if the management policy is `unmanaged`.
	//
	// resource must be specified if the management policy is `managed`.
	// +optional
	Resource *GroupResourceSpec `json:"resource,omitempty"`

	// managementPolicy defines how ORC will treat the object. Valid values are
	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
	// ORC will import an existing resource, and will not apply updates to it or
	// delete it.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
	// +kubebuilder:default:=managed
	// +optional
	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`

	// managedOptions specifies options which may be applied to managed objects.
	// +optional
	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`

	// resyncPeriod defines how frequently the controller will re-reconcile
	// this resource even when no changes have been detected. This overrides
	// the global default resync period. The value must be a valid Go duration
	// string, e.g. "10m", "1h". Set to "0s" to disable periodic resync for
	// this resource. Very low values may cause excessive OpenStack API load.
	// +optional
	ResyncPeriod *metav1.Duration `json:"resyncPeriod,omitempty"` //nolint:kubeapilinter // metav1.Duration is appropriate for user-facing duration config

	// cloudCredentialsRef points to a secret containing OpenStack credentials
	// +required
	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef,omitzero"`
}

type GroupStatus struct {
	// conditions represents the observed status of the object.
	// Known .status.conditions.type are: "Available", "Progressing"
	//
	// Available represents the availability of the OpenStack resource. If it is
	// true then the resource is ready for use.
	//
	// Progressing indicates whether the controller is still attempting to
	// reconcile the current state of the OpenStack resource to the desired
	// state. Progressing will be False either because the desired state has
	// been achieved, or because some terminal error prevents it from ever being
	// achieved and the controller is no longer attempting to reconcile. If
	// Progressing is True, an observer waiting on the resource should continue
	// to wait.
	//
	// +kubebuilder:validation:MaxItems:=32
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// id is the unique identifier of the OpenStack resource.
	// +kubebuilder:validation:MaxLength:=1024
	// +optional
	ID *string `json:"id,omitempty"`

	// resource contains the observed state of the OpenStack resource.
	// +optional
	Resource *GroupResourceStatus `json:"resource,omitempty"`

	// lastSyncTime is the timestamp of the last successful reconciliation
	// that fetched state from OpenStack. It is updated each time the
	// controller successfully reads the resource state from the OpenStack
	// API.
	// +optional
	LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}