v1alpha1

type APIBindingLifecycleMode string

type APIExportReference struct {
	// path is the fully-qualified path to the workspace containing the APIExport. If it is
	// empty, the current workspace is assumed.
	//
	// +optional
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Pattern:="^[a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
	Path string `json:"path,omitempty"`

	// export is the name of the APIExport.
	//
	// +required
	// +kubebuilder:validation:Required
	// +kube:validation:MinLength=1
	Export string `json:"export"`
}

type AudienceMatchPolicyType string

type AuthenticationConfigurationReference struct {
	// name is the name of the WorkspaceAuthenticationConfiguration.
	//
	// +required
	// +kubebuilder:validation:Required
	// +kube:validation:MinLength=1
	Name string `json:"name"`
}

type ClaimMappings struct {
	Username PrefixedClaimOrExpression `json:"username,omitempty"`
	Groups   PrefixedClaimOrExpression `json:"groups,omitempty"`
	// +optional
	UID ClaimOrExpression `json:"uid,omitempty"`
	// +optional
	Extra []ExtraMapping `json:"extra,omitempty"`
}

type ClaimOrExpression struct {
	// +optional
	// +kubebuilder:validation:MinLength=1
	Claim string `json:"claim,omitempty"`
	// +optional
	// +kubebuilder:validation:MinLength=1
	Expression string `json:"expression,omitempty"`
}

type ClaimValidationRule struct {
	// +optional
	// +kubebuilder:validation:MinLength=1
	Claim string `json:"claim,omitempty"`
	// +optional
	// +kubebuilder:validation:MinLength=1
	RequiredValue string `json:"requiredValue,omitempty"`

	// +optional
	// +kubebuilder:validation:MinLength=1
	Expression string `json:"expression,omitempty"`
	// +optional
	// +kubebuilder:validation:MinLength=1
	Message string `json:"message,omitempty"`
}

type ExtraMapping struct {
	Key             string `json:"key"`
	ValueExpression string `json:"valueExpression"`
}

type Issuer struct {
	// url points to the issuer URL in a format https://url or https://url/path.
	// This must match the "iss" claim in the presented JWT, and the issuer returned from discovery.
	// Same value as the --oidc-issuer-url flag.
	// Discovery information is fetched from "{url}/.well-known/openid-configuration" unless overridden by discoveryURL.
	// Required to be unique across all JWT authenticators.
	// Note that egress selection configuration is not used for this network connection.
	// +required
	URL string `json:"url"`
	// discoveryURL, if specified, overrides the URL used to fetch discovery
	// information instead of using "{url}/.well-known/openid-configuration".
	// The exact value specified is used, so "/.well-known/openid-configuration"
	// must be included in discoveryURL if needed.
	//
	// The "issuer" field in the fetched discovery information must match the "issuer.url" field
	// in the AuthenticationConfiguration and will be used to validate the "iss" claim in the presented JWT.
	// This is for scenarios where the well-known and jwks endpoints are hosted at a different
	// location than the issuer (such as locally in the cluster).
	//
	// Example:
	// A discovery url that is exposed using kubernetes service 'oidc' in namespace 'oidc-namespace'
	// and discovery information is available at '/.well-known/openid-configuration'.
	// discoveryURL: "https://oidc.oidc-namespace/.well-known/openid-configuration"
	// certificateAuthority is used to verify the TLS connection and the hostname on the leaf certificate
	// must be set to 'oidc.oidc-namespace'.
	//
	// curl https://oidc.oidc-namespace/.well-known/openid-configuration (.discoveryURL field)
	// {
	//     issuer: "https://oidc.example.com" (.url field)
	// }
	//
	// discoveryURL must be different from url.
	// Required to be unique across all JWT authenticators.
	// Note that egress selection configuration is not used for this network connection.
	// +optional
	DiscoveryURL string `json:"discoveryURL,omitempty"`
	// +optional
	CertificateAuthority string `json:"certificateAuthority,omitempty"`
	// +optional
	Audiences []string `json:"audiences,omitempty"`
	// +optional
	AudienceMatchPolicy AudienceMatchPolicyType `json:"audienceMatchPolicy,omitempty"`
}

type JWTAuthenticator struct {
	Issuer Issuer `json:"issuer"`
	// +optional
	ClaimValidationRules []ClaimValidationRule `json:"claimValidationRules,omitempty"`
	ClaimMappings        ClaimMappings         `json:"claimMappings"`
	// +optional
	UserValidationRules []UserValidationRule `json:"userValidationRules,omitempty"`
}

type Mount struct {
	// Reference is an ObjectReference to the object that is mounted.
	//
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="has(oldSelf.apiVersion) == has(self.apiVersion)",message="apiVersion is immutable"
	// +kubebuilder:validation:XValidation:rule="has(oldSelf.kind) == has(self.kind)",message="kind is immutable"
	// +kubebuilder:validation:XValidation:rule="has(oldSelf.name) == has(self.name)",message="name is immutable"
	Reference ObjectReference `json:"ref"`
}

type MountPhaseType string

type ObjectReference struct {
	// APIVersion is the API group and version of the object.
	//
	// +required
	APIVersion string `json:"apiVersion"`
	// Kind is the kind of the object.
	//
	// +required
	Kind string `json:"kind"`
	// Name is the name of the object.
	//
	// +required
	Name string `json:"name"`
	// Namespace is the namespace of the object.
	//
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type PrefixedClaimOrExpression struct {
	// +optional
	// +kubebuilder:validation:MinLength=1
	Claim string `json:"claim,omitempty"`
	// +optional
	Prefix *string `json:"prefix,omitempty"`
	// +optional
	// +kubebuilder:validation:MinLength=1
	Expression string `json:"expression,omitempty"`
}

type UserValidationRule struct {
	Expression string `json:"expression"`
	Message    string `json:"message"`
}

type VirtualWorkspace struct {
	// url is a WorkspaceType initialization virtual workspace URL.
	//
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:format:URL
	// +required
	URL string `json:"url"`
}

type Workspace struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec WorkspaceSpec `json:"spec"`

	// +optional
	Status WorkspaceStatus `json:"status,omitempty"`
}

type WorkspaceAuthenticationConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata"`

	Spec WorkspaceAuthenticationConfigurationSpec `json:"spec"`
}

type WorkspaceAuthenticationConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []WorkspaceAuthenticationConfiguration `json:"items"`
}

type WorkspaceAuthenticationConfigurationSpec struct {
	JWT []JWTAuthenticator `json:"jwt"`
}

type WorkspaceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []Workspace `json:"items"`
}

type WorkspaceLocation struct {

	// selector is a label selector that filters workspace scheduling targets.
	//
	// +optional
	Selector *metav1.LabelSelector `json:"selector,omitempty"`
}

type WorkspaceSpec struct {
	// type defines properties of the workspace both on creation (e.g. initial
	// resources and initially installed APIs) and during runtime (e.g. permissions).
	// If no type is provided, the default type for the workspace in which this workspace
	// is nesting will be used.
	//
	// The type is a reference to a WorkspaceType in the listed workspace, but
	// lower-cased. The WorkspaceType existence is validated at admission during
	// creation. The type is immutable after creation. The use of a type is gated via
	// the RBAC workspacetypes/use resource permission.
	//
	// +optional
	// +kubebuilder:validation:XValidation:rule="self.name == oldSelf.name",message="name is immutable"
	// +kubebuilder:validation:XValidation:rule="has(oldSelf.path) == has(self.path)",message="path is immutable"
	// +kubebuilder:validation:XValidation:rule="!has(oldSelf.path) || !has(self.path) || self.path == oldSelf.path",message="path is immutable"
	Type *WorkspaceTypeReference `json:"type,omitempty"`

	// location constraints where this workspace can be scheduled to.
	//
	// If the no location is specified, an arbitrary location is chosen.
	//
	// +optional
	Location *WorkspaceLocation `json:"location,omitempty"`

	// cluster is the name of the logical cluster this workspace is stored under.
	//
	// Set by the system.
	//
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="cluster is immutable"
	Cluster string `json:"cluster,omitempty"`

	// URL is the address under which the Kubernetes-cluster-like endpoint
	// can be found. This URL can be used to access the workspace with standard Kubernetes
	// client libraries and command line tools.
	//
	// Set by the system.
	//
	// +kubebuilder:format:uri
	URL string `json:"URL,omitempty"`

	// Mount is a reference to an object implementing a mounting feature. It is used to orchestrate
	// where the traffic, intended for the workspace, is sent.
	// If specified, logicalcluster will not be created and the workspace will be mounted
	// using reference mount object.
	//
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="mount is immutable"
	Mount *Mount `json:"mount,omitempty"`
}

type WorkspaceStatus struct {
	// Phase of the workspace (Scheduling, Initializing, Ready).
	//
	// +kubebuilder:default=Scheduling
	Phase corev1alpha1.LogicalClusterPhaseType `json:"phase,omitempty"`

	// Current processing state of the Workspace.
	// +optional
	Conditions conditionsv1alpha1.Conditions `json:"conditions,omitempty"`

	// initializers must be cleared by a controller before the workspace is ready
	// and can be used.
	//
	// +optional
	Initializers []corev1alpha1.LogicalClusterInitializer `json:"initializers,omitempty"`

	// terminators must be cleared by a controller before the workspace is being
	// deleted.
	//
	// +optional
	Terminators []corev1alpha1.LogicalClusterTerminator `json:"terminators,omitempty"`
}

type WorkspaceType struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +optional
	Spec WorkspaceTypeSpec `json:"spec,omitempty"`

	// +optional
	Status WorkspaceTypeStatus `json:"status,omitempty"`
}

type WorkspaceTypeExtension struct {
	// with are WorkspaceTypes whose initializers are added to the list
	// for the owning type, and for whom the owning type becomes an alias, as long
	// as all of their required types are not mentioned in without.
	//
	// +optional
	With []WorkspaceTypeReference `json:"with,omitempty"`
}

type WorkspaceTypeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []WorkspaceType `json:"items"`
}

type WorkspaceTypeName string

type WorkspaceTypeReference struct {
	// name is the name of the WorkspaceType
	//
	// +required
	// +kubebuilder:validation:Required
	Name WorkspaceTypeName `json:"name"`

	// path is an absolute reference to the workspace that owns this type, e.g. root:org:ws.
	//
	// +optional
	// +kubebuilder:validation:Pattern:="^[a-z0-9]([-a-z0-9]*[a-z0-9])?(:[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
	Path string `json:"path,omitempty"`
}

type WorkspaceTypeSelector struct {
	// none means that no type matches.
	//
	// +kuberbuilders:Enum=true
	None bool `json:"none,omitempty"`

	// types is a list of WorkspaceTypes that match. A workspace type extending
	// another workspace type automatically is considered as that extended type as well
	// (even transitively).
	//
	// An empty list matches all types.
	//
	// +optional
	// +kubebuilder:validation:MinItems=1
	Types []WorkspaceTypeReference `json:"types,omitempty"`
}

type WorkspaceTypeSpec struct {
	// initializer determines if this WorkspaceType has an associated initializing
	// controller. These controllers are used to add functionality to a Workspace;
	// all controllers must finish their work before the Workspace becomes ready
	// for use.
	//
	// One initializing controller is supported per WorkspaceType; the identifier
	// for this initializer will be a colon-delimited string using the workspace in which
	// the WorkspaceType is defined, and the type's name. For example, if a
	// WorkspaceType `example` is created in the `root:org` workspace, the implicit
	// initializer name is `root:org:example`.
	//
	// +optional
	Initializer bool `json:"initializer,omitempty"`

	// Terminator determines if this WorkspaceType has an associated terminating
	// controller. These controllers are used to add functionality to a Workspace;
	// all controllers must finish their work before the Workspace is being deleted.
	//
	// One terminating controller is supported per WorkspaceType; the identifier
	// for this terminator will be a colon-delimited string using the workspace in which
	// the WorkspaceType is defined, and the type's name. For example, if a
	// WorkspaceType `example` is created in the `root:org` workspace, the implicit
	// terminator name is `root:org:example`.
	//
	// +optional
	Terminator bool `json:"terminator,omitempty"`

	// extend is a list of other WorkspaceTypes whose initializers and limitAllowedChildren
	// and limitAllowedParents this WorkspaceType is inheriting. By (transitively) extending
	// another WorkspaceType, this WorkspaceType will be considered as that
	// other type in evaluation of limitAllowedChildren and limitAllowedParents constraints.
	//
	// A dependency cycle stop this WorkspaceType from being admitted as the type
	// of a Workspace.
	//
	// A non-existing dependency stop this WorkspaceType from being admitted as the type
	// of a Workspace.
	//
	// +optional
	Extend WorkspaceTypeExtension `json:"extend,omitempty"`

	// additionalWorkspaceLabels are a set of labels that will be added to a
	// Workspace on creation.
	//
	// +optional
	AdditionalWorkspaceLabels map[string]string `json:"additionalWorkspaceLabels,omitempty"`

	// defaultChildWorkspaceType is the WorkspaceType that will be used
	// by default if another, nested Workspace is created in a workspace
	// of this type. When this field is unset, the user must specify a type when
	// creating nested workspaces. Extending another WorkspaceType does
	// not inherit its defaultChildWorkspaceType.
	//
	// +optional
	DefaultChildWorkspaceType *WorkspaceTypeReference `json:"defaultChildWorkspaceType,omitempty"`

	// limitAllowedChildren specifies constraints for sub-workspaces created in workspaces
	// of this type. These are in addition to child constraints of types this one extends.
	//
	// +optional
	LimitAllowedChildren *WorkspaceTypeSelector `json:"limitAllowedChildren,omitempty"`

	// limitAllowedParents specifies constraints for the parent workspace that workspaces
	// of this type are created in. These are in addition to parent constraints of types this one
	// extends.
	//
	// +optional
	LimitAllowedParents *WorkspaceTypeSelector `json:"limitAllowedParents,omitempty"`

	// defaultAPIBindings are the APIs to bind during initialization of workspaces created from this type.
	// The APIBinding names will be generated dynamically.
	//
	// +optional
	DefaultAPIBindings []APIExportReference `json:"defaultAPIBindings,omitempty"`

	// Configure the lifecycle behaviour of defaultAPIBindings.
	//
	// +optional
	// +kubebuilder:validation:Enum=InitializeOnly;Maintain
	DefaultAPIBindingLifecycle *APIBindingLifecycleMode `json:"defaultAPIBindingLifecycle,omitempty"`

	// authenticationConfigurations are additional authentication options that should apply to any
	// workspace using this workspace type.
	//
	// +optional
	AuthenticationConfigurations []AuthenticationConfigurationReference `json:"authenticationConfigurations,omitempty"`
}

type WorkspaceTypeStatus struct {
	// conditions is a list of conditions that apply to the APIExport.
	//
	// +optional
	Conditions conditionsv1alpha1.Conditions `json:"conditions,omitempty"`

	// virtualWorkspaces contains all APIExport virtual workspace URLs.
	// +optional
	VirtualWorkspaces []VirtualWorkspace `json:"virtualWorkspaces,omitempty"`
}