v1

type Access struct {
	// Name is an optional name that is used for this access rule
	// +optional
	Name string `json:"name,omitempty"`

	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds.
	Verbs []string `json:"verbs"`

	// Subresources defines the sub resources that are allowed by this access rule
	// +optional
	Subresources []string `json:"subresources,omitempty"`

	// Users specifies which users should be able to access this secret with the aforementioned verbs
	// +optional
	Users []string `json:"users,omitempty"`

	// Teams specifies which teams should be able to access this secret with the aforementioned verbs
	// +optional
	Teams []string `json:"teams,omitempty"`
}

type AccessAccessor interface {
	GetAccess() []Access
	SetAccess(access []Access)

	GetOwner() *UserOrTeam
	SetOwner(userOrTeam *UserOrTeam)
}

type AccessKey struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessKeySpec   `json:"spec,omitempty"`
	Status AccessKeyStatus `json:"status,omitempty"`
}

type AccessKeyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessKey `json:"items"`
}

type AccessKeyOIDC struct {
	// The current id token that was created during login
	// +optional
	IDToken []byte `json:"idToken,omitempty"`

	// The current access token that was created during login
	// +optional
	AccessToken []byte `json:"accessToken,omitempty"`

	// The current refresh token that was created during login
	// +optional
	RefreshToken []byte `json:"refreshToken,omitempty"`

	// The last time the id token was refreshed
	// +optional
	LastRefresh *metav1.Time `json:"lastRefresh,omitempty"`
}

type AccessKeyOIDCProvider struct {
	// ClientId the token was generated for
	// +optional
	ClientId string `json:"clientId,omitempty"`

	// Nonce to use
	// +optional
	Nonce string `json:"nonce,omitempty"`

	// RedirectUri to use
	// +optional
	RedirectUri string `json:"redirectUri,omitempty"`

	// Scopes to use
	// +optional
	Scopes string `json:"scopes,omitempty"`
}

type AccessKeyScope struct {
	// Roles is a set of managed permissions to apply to the access key.
	// +optional
	Roles []AccessKeyScopeRole `json:"roles,omitempty"`

	// Projects specifies the projects the access key should have access to.
	// +optional
	Projects []AccessKeyScopeProject `json:"projects,omitempty"`

	// Spaces specifies the spaces the access key is allowed to access.
	// +optional
	Spaces []AccessKeyScopeSpace `json:"spaces,omitempty"`

	// VirtualClusters specifies the tenant clusters the access key is allowed to access.
	// +optional
	VirtualClusters []AccessKeyScopeVirtualCluster `json:"virtualClusters,omitempty"`

	// Clusters specifies the project cluster the access key is allowed to access.
	// +optional
	Clusters []AccessKeyScopeCluster `json:"clusters,omitempty"`

	// DEPRECATED: Use Projects, Spaces and VirtualClusters instead
	// Rules specifies the rules that should apply to the access key.
	// +optional
	Rules []AccessKeyScopeRule `json:"rules,omitempty"`

	// AllowLoftCLI allows certain read-only management requests to
	// make sure loft cli works correctly with this specific access key.
	//
	// Deprecated: Use the `roles` field instead
	//  “`yaml
	//  # Example:
	//  roles:
	//    - role: loftCLI
	//  “`
	// +optional
	AllowLoftCLI bool `json:"allowLoftCli,omitempty"`
}

type AccessKeyScopeCluster struct {
	// Cluster is the name of the cluster to access. You can specify * to select all clusters.
	// +optional
	Cluster string `json:"cluster,omitempty"`
}

type AccessKeyScopeProject struct {
	// Project is the name of the project. You can specify * to select all projects.
	// +optional
	Project string `json:"project,omitempty"`
}

type AccessKeyScopeRole struct {
	// Role is the name of the role to apply to the access key scope.
	// +optional
	Role AccessKeyScopeRoleName `json:"role,omitempty"`

	// Projects specifies the projects the access key should have access to.
	// +optional
	Projects []string `json:"projects,omitempty"`

	// VirtualClusters specifies the tenant clusters the access key is allowed to access.
	// +optional
	VirtualClusters []string `json:"virtualClusters,omitempty"`
}

type AccessKeyScopeRoleName string

type AccessKeyScopeRule struct {
	// The verbs that match this rule.
	// An empty list implies every verb.
	// +optional
	Verbs []string `json:"verbs,omitempty"`

	// Resources that this rule matches. An empty list implies all kinds in all API groups.
	// +optional
	Resources []GroupResources `json:"resources,omitempty"`

	// Namespaces that this rule matches.
	// The empty string "" matches non-namespaced resources.
	// An empty list implies every namespace.
	// +optional
	Namespaces []string `json:"namespaces,omitempty"`

	// NonResourceURLs is a set of URL paths that should be checked.
	// *s are allowed, but only as the full, final step in the path.
	// Examples:
	//  "/metrics" - Log requests for apiserver metrics
	//  "/healthz*" - Log all health checks
	// +optional
	NonResourceURLs []string `json:"nonResourceURLs,omitempty"`

	// RequestTargets is a list of request targets that are allowed.
	// An empty list implies every request.
	// +optional
	RequestTargets []RequestTarget `json:"requestTargets,omitempty"`

	// Cluster that this rule matches. Only applies to cluster requests.
	// If this is set, no requests for non cluster requests are allowed.
	// An empty cluster means no restrictions will apply.
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// VirtualClusters that this rule matches. Only applies to tenant cluster requests.
	// An empty list means no restrictions will apply.
	// +optional
	VirtualClusters []AccessKeyVirtualCluster `json:"virtualClusters,omitempty"`
}

type AccessKeyScopeSpace struct {
	// Project is the name of the project.
	// +optional
	Project string `json:"project,omitempty"`

	// Space is the name of the space. You can specify * to select all spaces.
	// +optional
	Space string `json:"space,omitempty"`
}

type AccessKeyScopeVirtualCluster struct {
	// Project is the name of the project.
	// +optional
	Project string `json:"project,omitempty"`

	// VirtualCluster is the name of the tenant cluster to access. You can specify * to select all tenant clusters.
	// +optional
	VirtualCluster string `json:"virtualCluster,omitempty"`
}

type AccessKeySpec struct {
	// The display name shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// The user this access key refers to
	// +optional
	User string `json:"user,omitempty"`

	// The team this access key refers to
	// +optional
	Team string `json:"team,omitempty"`

	// Subject is a generic subject that can be used
	// instead of user or team
	// +optional
	Subject string `json:"subject,omitempty"`

	// Groups specifies extra groups to apply when using
	// this access key
	// +optional
	Groups []string `json:"groups,omitempty"`

	// The actual access key that will be used as a bearer token
	// +optional
	Key string `json:"key,omitempty"`

	// If this field is true, the access key is still allowed to exist,
	// however will not work to access the api
	// +optional
	Disabled bool `json:"disabled,omitempty"`

	// The time to live for this access key
	// +optional
	TTL int64 `json:"ttl,omitempty"`

	// If this is specified, the time to live for this access key will
	// start after the lastActivity instead of creation timestamp
	// +optional
	TTLAfterLastActivity bool `json:"ttlAfterLastActivity,omitempty"`

	// Scope defines the scope of the access key.
	// +optional
	Scope *AccessKeyScope `json:"scope,omitempty"`

	// The type of an access key, which basically describes if the access
	// key is user managed or managed by loft itself.
	// +optional
	Type AccessKeyType `json:"type,omitempty"`

	// If available, contains information about the sso login data for this
	// access key
	// +optional
	Identity *SSOIdentity `json:"identity,omitempty"`

	// The last time the identity was refreshed
	// +optional
	IdentityRefresh *metav1.Time `json:"identityRefresh,omitempty"`

	// If the token is a refresh token, contains information about it
	// +optional
	OIDCProvider *AccessKeyOIDCProvider `json:"oidcProvider,omitempty"`

	// DEPRECATED: do not use anymore
	// Parent is used to share OIDC and external token information
	// with multiple access keys. Since copying an OIDC refresh token
	// would result in the other access keys becoming invalid after a refresh
	// parent allows access keys to share that information.
	//
	// The use case for this is primarily user generated access keys,
	// which will have the users current access key as parent if it contains
	// an OIDC token.
	// +optional
	Parent string `json:"parent,omitempty"`

	// DEPRECATED: Use identity instead
	// If available, contains information about the oidc login data for this
	// access key
	// +optional
	OIDCLogin *AccessKeyOIDC `json:"oidcLogin,omitempty"`
}

type AccessKeyStatus struct {
	// The last time this access key was used to access the api
	// +optional
	LastActivity *metav1.Time `json:"lastActivity,omitempty"`
}

type AccessKeyType string

type AccessKeyVirtualCluster struct {
	// Name of the tenant cluster. Empty means all tenant clusters.
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace of the tenant cluster. Empty means all namespaces.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type AllowedCluster struct {
	// Name is the name of the cluster that is allowed to create an environment in.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedClusterAccountTemplate struct {
	// Name is the name of a cluster account template
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedNodeProfile struct {
	// Name of the NodeProfile, or "<owner>.*" to allow all NodeProfiles
	// with the given owner prefix.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedNodeType struct {
	// Name of the NodeType, or "<provider>.*" to allow all NodeTypes
	// of the given provider.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedRunner struct {
	// Name is the name of the runner that is allowed to create an environment in.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedTemplate struct {
	// Kind of the template that is allowed. Currently only supports DevPodWorkspaceTemplate, VirtualClusterTemplate & SpaceTemplate
	// +optional
	Kind string `json:"kind,omitempty"`

	// Group of the template that is allowed. Currently only supports storage.loft.sh
	// +optional
	Group string `json:"group,omitempty"`

	// Name of the template
	// +optional
	Name string `json:"name,omitempty"`

	// IsDefault specifies if the template should be used as a default
	// +optional
	IsDefault bool `json:"isDefault,omitempty"`
}

type App struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AppSpec   `json:"spec,omitempty"`
	Status AppStatus `json:"status,omitempty"`
}

type AppConfig struct {
	// DefaultNamespace is the default namespace this app should installed
	// in.
	// +optional
	DefaultNamespace string `json:"defaultNamespace,omitempty"`

	// Readme is a longer markdown string that describes the app.
	// +optional
	Readme string `json:"readme,omitempty"`

	// Icon holds an URL to the app icon
	// +optional
	Icon string `json:"icon,omitempty"`

	// Config is the helm config to use to deploy the helm release
	// +optional
	Config clusterv1.HelmReleaseConfig `json:"config,omitempty"`

	// Wait determines if Loft should wait during deploy for the app to become ready
	// +optional
	Wait bool `json:"wait,omitempty"`

	// Timeout is the time to wait for any individual Kubernetes operation (like Jobs for hooks) (default 5m0s)
	// +optional
	Timeout string `json:"timeout,omitempty"`

	// Parameters define additional app parameters that will set helm values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// DEPRECATED: Use config.bash instead
	// StreamContainer can be used to stream a containers logs instead of the helm output.
	// +optional
	// +internal
	StreamContainer *StreamContainer `json:"streamContainer,omitempty"`
}

type AppList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []App `json:"items"`
}

type AppParameter struct {
	// Variable is the path of the variable. Can be foo or foo.bar for nested objects.
	// +optional
	Variable string `json:"variable,omitempty"`

	// Label is the label to show for this parameter
	// +optional
	Label string `json:"label,omitempty"`

	// Description is the description to show for this parameter
	// +optional
	Description string `json:"description,omitempty"`

	// Type of the parameter. Can be one of:
	// string, multiline, boolean, number and password
	// +optional
	Type string `json:"type,omitempty"`

	// Options is a slice of strings, where each string represents a mutually exclusive choice.
	// +optional
	Options []string `json:"options,omitempty"`

	// Min is the minimum number if type is number
	// +optional
	Min *int `json:"min,omitempty"`

	// Max is the maximum number if type is number
	// +optional
	Max *int `json:"max,omitempty"`

	// Required specifies if this parameter is required
	// +optional
	Required bool `json:"required,omitempty"`

	// DefaultValue is the default value if none is specified
	// +optional
	DefaultValue string `json:"defaultValue,omitempty"`

	// Placeholder shown in the UI
	// +optional
	Placeholder string `json:"placeholder,omitempty"`

	// Invalidation regex that if matched will reject the input
	// +optional
	Invalidation string `json:"invalidation,omitempty"`

	// Validation regex that if matched will allow the input
	// +optional
	Validation string `json:"validation,omitempty"`

	// Section where this app should be displayed. Apps with the same section name will be grouped together
	// +optional
	Section string `json:"section,omitempty"`

	// Hidden specifies that this parameter should not be rendered in the UI
	// because its value is filled in and wired up automatically
	// +optional
	Hidden bool `json:"hidden,omitempty"`
}

type AppReference struct {
	// Name of the target app
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace specifies in which target namespace the app should
	// get deployed in
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// ReleaseName is the name of the app release
	// +optional
	ReleaseName string `json:"releaseName,omitempty"`

	// Version of the app
	// +optional
	Version string `json:"version,omitempty"`

	// Hash is the hash of the app configuration
	// +optional
	Hash string `json:"hash,omitempty"`

	// Parameters to use for the app
	// +optional
	Parameters string `json:"parameters,omitempty"`
}

type AppSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this app can be installed in.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// RecommendedApp specifies where this app should show up as recommended app
	// +optional
	RecommendedApp []RecommendedApp `json:"recommendedApp,omitempty"`

	// AppConfig is the app configuration
	AppConfig `json:",inline"`

	// Versions are different app versions that can be referenced
	// +optional
	Versions []AppVersion `json:"versions,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// DEPRECATED: Use config instead
	// manifest represents kubernetes resources that will be deployed into the target namespace
	// +optional
	Manifests string `json:"manifests,omitempty"`

	// DEPRECATED: Use config instead
	// helm defines the configuration for a helm deployment
	// +optional
	Helm *HelmConfiguration `json:"helm,omitempty"`
}

type AppStatus struct {
}

type AppTask struct {
	// Type is the task type. Defaults to Upgrade
	// +optional
	Type HelmTaskType `json:"type,omitempty"`

	// RollbackRevision is the revision to rollback to
	// +optional
	RollbackRevision string `json:"rollbackRevision,omitempty"`

	// AppReference is the reference to the app to deploy
	// +optional
	AppReference AppReference `json:"appReference,omitempty"`
}

type AppVersion struct {
	// AppConfig is the app configuration
	AppConfig `json:",inline"`

	// Version is the version. Needs to be in X.X.X format.
	// +optional
	Version string `json:"version,omitempty"`
}

type ArgoCD struct {
	// Enabled defines if argo cd is enabled
	// +optional
	Enabled bool `json:"enabled,omitempty"`

	// Connector specifies the argo cd connector name
	// +optional
	Connector string `json:"connector,omitempty"`
}

type ArgoCDApplication struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ArgoCDApplicationSpec   `json:"spec,omitempty"`
	Status ArgoCDApplicationStatus `json:"status,omitempty"`
}

type ArgoCDApplicationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ArgoCDApplication `json:"items"`
}

type ArgoCDApplicationSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an OS image
	// +optional
	Description string `json:"description,omitempty"`

	// TemplateRef holds the Argo CD application template reference
	TemplateRef *ArgoCDApplicationTemplateRef `json:"templateRef,omitempty"`

	// Template is the Argo CD application template definition
	// +optional
	Template *ArgoCDApplicationTemplateDefinition `json:"template,omitempty"`

	// Parameters are values to pass to the template.
	// The values should be encoded as YAML string where each parameter is represented as a top-level field key.
	// +optional
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// Destination holds the Argo CD target reference
	Destination ArgoCDDestination `json:"destination,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`
}

type ArgoCDApplicationStatus struct {
	// Conditions holds several conditions the tenant cluster might be in
	// +optional
	Conditions agentstoragev1.Conditions `json:"conditions,omitempty"`

	// Host of the Argo CD server
	// +optional
	Host string `json:"host,omitempty"`

	// Application holds the status of the Argo CD application
	// +optional
	Application *argoapplicationsv1alpha1.ApplicationStatus `json:"application,omitempty"`
}

type ArgoCDApplicationTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ArgoCDApplicationTemplateSpec   `json:"spec,omitempty"`
	Status ArgoCDApplicationTemplateStatus `json:"status,omitempty"`
}

type ArgoCDApplicationTemplateDefinition struct {
	// Metadata is the metadata of the Argo CD application
	// +optional
	TemplateMetadata `json:"metadata,omitempty"`

	// Spec is the spec of the Argo CD application
	// +optional
	Spec argoapplicationsv1alpha1.ApplicationSpec `json:"spec,omitempty"`
}

type ArgoCDApplicationTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ArgoCDApplicationTemplate `json:"items"`
}

type ArgoCDApplicationTemplateRef struct {
	// Name holds the name of the blueprint template to reference.
	// +optional
	Name string `json:"name,omitempty"`
}

type ArgoCDApplicationTemplateSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an OS image
	// +optional
	Description string `json:"description,omitempty"`

	// Template is the blueprint template definition
	// +optional
	Template ArgoCDApplicationTemplateDefinition `json:"template,omitempty"`

	// Parameters define additional app parameters that will set helm values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`
}

type ArgoCDApplicationTemplateStatus struct{}

type ArgoCDDestination struct {
	// VirtualCluster name. Mutually exclusive with Cluster.
	// +optional
	VirtualCluster *ArgoCDDestinationVirtualCluster `json:"virtualCluster,omitempty"`

	// Cluster name. Mutually exclusive with VirtualCluster.
	// +optional
	Cluster *ArgoCDDestinationCluster `json:"cluster,omitempty"`
}

type ArgoCDDestinationCluster struct {
	// Name of the cluster
	// +optional
	Name string `json:"name,omitempty"`
}

type ArgoCDDestinationVirtualCluster struct {
	// Name of the tenant cluster
	// +optional
	Name string `json:"name,omitempty"`

	// Target of the tenant cluster
	// +optional
	Target ArgoCDDestinationVirtualClusterTarget `json:"target,omitempty"`
}

type ArgoCDDestinationVirtualClusterTarget string

type ArgoIntegrationSpec struct {
	// Enabled indicates if the ArgoCD Integration is enabled for the project -- this knob only
	// enables the syncing of virtualclusters, but does not enable SSO integration or project
	// creation (see subsequent spec sections!).
	// +optional
	Enabled bool `json:"enabled,omitempty"`

	// Cluster defines the name of the cluster that ArgoCD is deployed into -- if not provided this
	// will default to 'loft-cluster'.
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// VirtualClusterInstance defines the name of *tenant cluster* (instance) that ArgoCD is
	// deployed into. If provided, Cluster will be ignored and Loft will assume that ArgoCD is
	// running in the specified tenant cluster.
	// +optional
	VirtualClusterInstance string `json:"virtualClusterInstance,omitempty"`

	// Namespace defines the namespace in which ArgoCD is running in the cluster.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// SSO defines single-sign-on related values for the ArgoCD Integration. Enabling SSO will allow
	// users to authenticate to ArgoCD via Loft.
	// +optional
	SSO *ArgoSSOSpec `json:"sso,omitempty"`

	// Project defines project related values for the ArgoCD Integration. Enabling Project
	// integration will cause Loft to generate and manage an ArgoCD appProject that corresponds to
	// the Loft Project.
	// +optional
	Project *ArgoProjectSpec `json:"project,omitempty"`
}

type ArgoProjectPolicyRule struct {
	// Action is one of "*", "get", "create", "update", "delete", "sync", or "override".
	// +optional
	Action string `json:"action,omitempty"`
	// Application is the ArgoCD project/repository to apply the rule to.
	// DEPRECATED: Wasn't used. Kind provides a more flexible way to specify the resource type.
	// +optional
	Application string `json:"application,omitempty"`
	// Kind is the kind to apply the rule to
	// +optional
	Kind string `json:"kind,omitempty"`
	// Allow applies the "allow" permission to the rule, if allow is not set, the permission will
	// always be set to "deny".
	// +optional
	Allow bool `json:"permission,omitempty"`
}

type ArgoProjectRole struct {
	// Name of the ArgoCD role to attach to the project.
	Name string `json:"name,omitempty"`
	// Description to add to the ArgoCD project.
	// +optional
	Description string `json:"description,omitempty"`
	// Rules ist a list of policy rules to attach to the role.
	Rules []ArgoProjectPolicyRule `json:"rules,omitempty"`
	// Groups is a list of OIDC group names to bind to the role.
	Groups []string `json:"groups,omitempty"`
}

type ArgoProjectSpec struct {
	// Enabled indicates if the ArgoCD Project Integration is enabled for this project. Enabling
	// this will cause Loft to create an appProject in ArgoCD that is associated with the Loft
	// Project. When Project integration is enabled Loft will override the default assigned role
	// set in the SSO integration spec.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// Metadata defines additional metadata to attach to the loft created project in ArgoCD.
	// +optional
	Metadata ArgoProjectSpecMetadata `json:"metadata,omitempty"`
	// SourceRepos is a list of source repositories to attach/allow on the project, if not specified
	// will be "*" indicating all source repositories.
	// +optional
	SourceRepos []string `json:"sourceRepos,omitempty"`
	// Destinations contains list of destinations available for deployment
	Destinations []argoapplicationsv1alpha1.ApplicationDestination `json:"destinations,omitempty"`
	// Roles is a list of roles that should be attached to the ArgoCD project. If roles are provided
	// no loft default roles will be set. If no roles are provided *and* SSO is enabled, loft will
	// configure sane default values.
	// +optional
	Roles []ArgoProjectRole `json:"roles,omitempty"`
	// ClusterResourceWhitelist contains a list of whitelisted cluster level resources
	// If not specified or empty, deny all cluster-scope resources.
	// +optional
	ClusterResourceWhitelist []argoapplicationsv1alpha1.ClusterResourceRestrictionItem `json:"clusterResourceWhitelist,omitempty"`
	// NamespaceResourceWhitelist contains a list of whitelisted namespace level resources
	// If not specified or empty, allow all namespace-scope resources.
	// +optional
	NamespaceResourceWhitelist []metav1.GroupKind `json:"namespaceResourceWhitelist,omitempty"`
	// ClusterResourceBlacklist contains a list of blacklisted cluster level resources
	// +optional
	ClusterResourceBlacklist []argoapplicationsv1alpha1.ClusterResourceRestrictionItem `json:"clusterResourceBlacklist,omitempty"`
	// NamespaceResourceBlacklist contains a list of blacklisted namespace level resources
	// +optional
	NamespaceResourceBlacklist []metav1.GroupKind `json:"namespaceResourceBlacklist,omitempty"`
	// SourceNamespaces defines the namespaces application resources are allowed to be created in
	// +optional
	SourceNamespaces []string `json:"sourceNamespaces,omitempty"`
}

type ArgoProjectSpecMetadata struct {
	// ExtraAnnotations are optional annotations that can be attached to the project in ArgoCD.
	// +optional
	ExtraAnnotations map[string]string `json:"extraAnnotations,omitempty"`
	// ExtraLabels are optional labels that can be attached to the project in ArgoCD.
	// +optional
	ExtraLabels map[string]string `json:"extraLabels,omitempty"`
	// Description to add to the ArgoCD project.
	// +optional
	Description string `json:"description,omitempty"`
}

type ArgoSSOSpec struct {
	// Enabled indicates if the ArgoCD SSO Integration is enabled for this project. Enabling this
	// will cause Loft to configure SSO authentication via Loft in ArgoCD. If Projects are *not*
	// enabled, all users associated with this Project will be assigned either the 'read-only'
	// (default) role, *or* the roles set under the AssignedRoles field.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// Host defines the ArgoCD host address that will be used for OIDC authentication between loft
	// and ArgoCD. If not specified OIDC integration will be skipped, but vclusters/spaces will
	// still be synced to ArgoCD.
	// +optional
	Host string `json:"host,omitempty"`
	// AssignedRoles is a list of roles to assign for users who authenticate via Loft -- by default
	// this will be the `read-only` role. If any roles are provided this will override the default
	// setting.
	// +optional
	AssignedRoles []string `json:"assignedRoles,omitempty"`
}

type Authentication struct {
	Connector `json:",inline"`

	// Password holds password authentication relevant information
	// +optional
	Password *AuthenticationPassword `json:"password,omitempty"`

	// Connectors are optional additional connectors for Loft.
	// +optional
	Connectors []ConnectorWithName `json:"connectors,omitempty"`

	// Prevents from team creation for the new groups associated with the user at the time of logging in through sso,
	// Default behaviour is false, this means that teams will be created for new groups.
	// +optional
	DisableTeamCreation bool `json:"disableTeamCreation,omitempty"`

	// DisableUserCreation prevents the SSO connectors from creating a new user on a users initial signin through sso.
	// Default behaviour is false, this means that a new user object will be created once a user without
	// a Kubernetes user object logs in.
	// +optional
	DisableUserCreation bool `json:"disableUserCreation,omitempty"`

	// AccessKeyMaxTTLSeconds is the global maximum lifespan of an accesskey in seconds.
	// Leaving it 0 or unspecified will disable it.
	// Specifying 2592000 will mean all keys have a Time-To-Live of 30 days.
	// +optional
	AccessKeyMaxTTLSeconds int64 `json:"accessKeyMaxTTLSeconds,omitempty"`

	// LoginAccessKeyTTLSeconds is the time in seconds an access key is kept
	// until it is deleted.
	// Leaving it unspecified will default to 20 days.
	// Setting it to zero will disable the ttl.
	// Specifying 2592000 will mean all keys have a  default Time-To-Live of 30 days.
	// +optional
	LoginAccessKeyTTLSeconds *int64 `json:"loginAccessKeyTTLSeconds,omitempty"`

	// CustomHttpHeaders are additional headers that should be set for the authentication endpoints
	// +optional
	CustomHttpHeaders map[string]string `json:"customHttpHeaders,omitempty"`

	// GroupsFilters is a regex expression to only save matching sso groups into the user resource
	GroupsFilters []string `json:"groupsFilters,omitempty"`
}

type AuthenticationGithub struct {
	// ClientID holds the github client id
	ClientID string `json:"clientId,omitempty"`

	// ClientID holds the github client secret
	ClientSecret string `json:"clientSecret"`

	// RedirectURI holds the redirect URI. Should be https://loft.domain.tld/auth/github/callback
	RedirectURI string `json:"redirectURI"`

	// Loft queries the following organizations for group information.
	// Group claims are formatted as "(org):(team)".
	// For example if a user is part of the "engineering" team of the "coreos"
	// org, the group claim would include "coreos:engineering".
	//
	// If orgs are specified in the config then user MUST be a member of at least one of the specified orgs to
	// authenticate with loft.
	// +optional
	Orgs []AuthenticationGithubOrg `json:"orgs,omitempty"`

	// Required ONLY for GitHub Enterprise.
	// This is the Hostname of the GitHub Enterprise account listed on the
	// management console. Ensure this domain is routable on your network.
	// +optional
	HostName string `json:"hostName,omitempty"`

	// ONLY for GitHub Enterprise. Optional field.
	// Used to support self-signed or untrusted CA root certificates.
	// +optional
	RootCA string `json:"rootCA,omitempty"`
}

type AuthenticationGithubOrg struct {
	// Organization name in github (not slug, full name). Only users in this github
	// organization can authenticate.
	// +optional
	Name string `json:"name"`

	// Names of teams in a github organization. A user will be able to
	// authenticate if they are members of at least one of these teams. Users
	// in the organization can authenticate if this field is omitted from the
	// config file.
	// +optional
	Teams []string `json:"teams,omitempty"`
}

type AuthenticationGitlab struct {
	// Gitlab client id
	ClientID string `json:"clientId"`

	// Gitlab client secret
	ClientSecret string `json:"clientSecret"`

	// Redirect URI
	RedirectURI string `json:"redirectURI"`

	// BaseURL is optional, default = https://gitlab.com
	// +optional
	BaseURL string `json:"baseURL,omitempty"`

	// Optional groups whitelist, communicated through the "groups" scope.
	// If `groups` is omitted, all of the user's GitLab groups are returned.
	// If `groups` is provided, this acts as a whitelist - only the user's GitLab groups that are in the configured `groups` below will go into the groups claim. Conversely, if the user is not in any of the configured `groups`, the user will not be authenticated.
	// +optional
	Groups []string `json:"groups,omitempty"`
}

type AuthenticationGoogle struct {
	// Google client id
	ClientID string `json:"clientId"`

	// Google client secret
	ClientSecret string `json:"clientSecret"`

	// loft redirect uri. E.g. https://loft.my.domain/auth/google/callback
	RedirectURI string `json:"redirectURI"`

	// defaults to "profile" and "email"
	// +optional
	Scopes []string `json:"scopes,omitempty"`

	// Optional list of whitelisted domains
	// If this field is nonempty, only users from a listed domain will be allowed to log in
	// +optional
	HostedDomains []string `json:"hostedDomains,omitempty"`

	// Optional list of whitelisted groups
	// If this field is nonempty, only users from a listed group will be allowed to log in
	// +optional
	Groups []string `json:"groups,omitempty"`

	// Optional path to service account json
	// If nonempty, and groups claim is made, will use authentication from file to
	// check groups with the admin directory api
	// +optional
	ServiceAccountFilePath string `json:"serviceAccountFilePath,omitempty"`

	// Required if ServiceAccountFilePath
	// The email of a GSuite super user which the service account will impersonate
	// when listing groups
	// +optional
	AdminEmail string `json:"adminEmail,omitempty"`
}

type AuthenticationMicrosoft struct {
	// Microsoft client id
	ClientID string `json:"clientId"`

	// Microsoft client secret
	ClientSecret string `json:"clientSecret"`

	// loft redirect uri. Usually https://loft.my.domain/auth/microsoft/callback
	RedirectURI string `json:"redirectURI"`

	// tenant configuration parameter controls what kinds of accounts may be authenticated in loft.
	// By default, all types of Microsoft accounts (consumers and organizations) can authenticate in loft via Microsoft.
	// To change this, set the tenant parameter to one of the following:
	//
	// common - both personal and business/school accounts can authenticate in loft via Microsoft (default)
	// consumers - only personal accounts can authenticate in loft
	// organizations - only business/school accounts can authenticate in loft
	// tenant uuid or tenant name - only accounts belonging to specific tenant identified by either tenant uuid or tenant name can authenticate in loft
	// +optional
	Tenant string `json:"tenant,omitempty"`

	// It is possible to require a user to be a member of a particular group in order to be successfully authenticated in loft.
	// +optional
	Groups []string `json:"groups,omitempty"`

	// configuration option restricts the list to include only security groups. By default all groups (security, Office 365, mailing lists) are included.
	// +optional
	OnlySecurityGroups bool `json:"onlySecurityGroups,omitempty"`

	// Restrict the groups claims to include only the user’s groups that are in the configured groups
	// +optional
	UseGroupsAsWhitelist bool `json:"useGroupsAsWhitelist,omitempty"`
}

type AuthenticationOIDC struct {
	// IssuerURL is the URL the provider signs ID Tokens as. This will be the "iss"
	// field of all tokens produced by the provider and is used for configuration
	// discovery.
	//
	// The URL is usually the provider's URL without a path, for example
	// "https://accounts.google.com" or "https://login.salesforce.com".
	//
	// The provider must implement configuration discovery.
	// See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
	IssuerURL string `json:"issuerUrl,omitempty"`

	// ClientID the JWT must be issued for, the "sub" field. This plugin only trusts a single
	// client to ensure the plugin can be used with public providers.
	//
	// The plugin supports the "authorized party" OpenID Connect claim, which allows
	// specialized providers to issue tokens to a client for a different client.
	// See: https://openid.net/specs/openid-connect-core-1_0.html#IDToken
	ClientID string `json:"clientId,omitempty"`

	// ClientSecret to issue tokens from the OIDC provider
	ClientSecret string `json:"clientSecret,omitempty"`

	// loft redirect uri. E.g. https://loft.my.domain/auth/oidc/callback
	RedirectURI string `json:"redirectURI,omitempty"`

	// Loft URI to be redirected to after successful logout by OIDC Provider
	// +optional
	PostLogoutRedirectURI string `json:"postLogoutRedirectURI,omitempty"`

	// Path to a PEM encoded root certificate of the provider. Optional
	// +optional
	CAFile string `json:"caFile,omitempty"`

	// Specify whether to communicate without validating SSL certificates
	// +optional
	InsecureCA bool `json:"insecureCa,omitempty"`

	// Configurable key which contains the preferred username claims
	// +optional
	PreferredUsernameClaim string `json:"preferredUsername,omitempty"`

	// LoftUsernameClaim is the JWT field to use as the user's username.
	// +optional
	LoftUsernameClaim string `json:"loftUsernameClaim,omitempty"`

	// UsernameClaim is the JWT field to use as the user's id.
	// +optional
	UsernameClaim string `json:"usernameClaim,omitempty"`

	// EmailClaim is the JWT field to use as the user's email.
	// +optional
	EmailClaim string `json:"emailClaim,omitempty"`

	// AllowedExtraClaims are claims of interest that are not part of User by default but may be provided by the OIDC provider.
	// +optional
	AllowedExtraClaims []string `json:"allowedExtraClaims,omitempty"`

	// UsernamePrefix, if specified, causes claims mapping to username to be prefix with
	// the provided value. A value "oidc:" would result in usernames like "oidc:john".
	// +optional
	UsernamePrefix string `json:"usernamePrefix,omitempty"`

	// GroupsClaim, if specified, causes the OIDCAuthenticator to try to populate the user's
	// groups with an ID Token field. If the GroupsClaim field is present in an ID Token the value
	// must be a string or list of strings.
	// +optional
	GroupsClaim string `json:"groupsClaim,omitempty"`

	// If required groups is non empty, access is denied if the user is not part of at least one
	// of the specified groups.
	// +optional
	Groups []string `json:"groups,omitempty"`

	// Scopes that should be sent to the server. If empty, defaults to "email" and "profile".
	// +optional
	Scopes []string `json:"scopes,omitempty"`

	// GetUserInfo, if specified, tells the OIDCAuthenticator to try to populate the user's
	// information from the UserInfo.
	// +optional
	GetUserInfo bool `json:"getUserInfo,omitempty"`

	// GroupsPrefix, if specified, causes claims mapping to group names to be prefixed with the
	// value. A value "oidc:" would result in groups like "oidc:engineering" and "oidc:marketing".
	// +optional
	GroupsPrefix string `json:"groupsPrefix,omitempty"`

	// Type of the OIDC to show in the UI. Only for displaying purposes
	// +optional
	Type string `json:"type,omitempty"`

	// Resource, if specified, is the value that is set for the "resource" URL parameter when making a request to the /token endpoint of the
	// OIDC provider.
	// +optional
	Resource string `json:"resource,omitempty"`
}

type AuthenticationPassword struct {
	// If true login via password is disabled
	Disabled bool `json:"disabled,omitempty"`
}

type AuthenticationSAML struct {
	// If the response assertion status value contains a Destination element, it
	// must match this value exactly.
	// Usually looks like https://your-loft-domain/auth/saml/callback
	RedirectURI string `json:"redirectURI,omitempty"`
	// SSO URL used for POST value.
	SSOURL string `json:"ssoURL,omitempty"`
	// CAData is a base64 encoded string that holds the ca certificate for validating the signature of the SAML response.
	// Either CAData, CA or InsecureSkipSignatureValidation needs to be defined.
	// +optional
	CAData []byte `json:"caData,omitempty"`

	// Name of attribute in the returned assertions to map to username
	UsernameAttr string `json:"usernameAttr,omitempty"`
	// Name of attribute in the returned assertions to map to email
	EmailAttr string `json:"emailAttr,omitempty"`
	// Name of attribute in the returned assertions to map to groups
	// +optional
	GroupsAttr string `json:"groupsAttr,omitempty"`

	// CA to use when validating the signature of the SAML response.
	// +optional
	CA string `json:"ca,omitempty"`
	// Ignore the ca cert
	// +optional
	InsecureSkipSignatureValidation bool `json:"insecureSkipSignatureValidation,omitempty"`

	// When provided Loft will include this as the Issuer value during AuthnRequest.
	// It will also override the redirectURI as the required audience when evaluating
	// AudienceRestriction elements in the response.
	// +optional
	EntityIssuer string `json:"entityIssuer,omitempty"`
	// Issuer value expected in the SAML response. Optional.
	// +optional
	SSOIssuer string `json:"ssoIssuer,omitempty"`

	// If GroupsDelim is supplied the connector assumes groups are returned as a
	// single string instead of multiple attribute values. This delimiter will be
	// used split the groups string.
	// +optional
	GroupsDelim string `json:"groupsDelim,omitempty"`
	// List of groups to filter access based on membership
	// +optional
	AllowedGroups []string `json:"allowedGroups,omitempty"`
	// If used with allowed groups, only forwards the allowed groups and not all
	// groups specified.
	// +optional
	FilterGroups bool `json:"filterGroups,omitempty"`

	// Requested format of the NameID. The NameID value is is mapped to the ID Token
	// 'sub' claim.
	//
	// This can be an abbreviated form of the full URI with just the last component. For
	// example, if this value is set to "emailAddress" the format will resolve to:
	//
	//		urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
	//
	// If no value is specified, this value defaults to:
	//
	//		urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
	//
	// +optional
	NameIDPolicyFormat string `json:"nameIDPolicyFormat,omitempty"`
}

type BCMNodeTypeSpec struct {
	NamedNodeTypeSpec `json:",inline"`

	// Nodes specifies nodes.
	Nodes []string `json:"nodes,omitempty"`

	// NodeGroups is the name of the node groups to use for this provider.
	NodeGroups []string `json:"nodeGroups,omitempty"`
}

type Chart struct {
	// Name is the chart name in the repository
	Name string `json:"name,omitempty"`

	// Version is the chart version in the repository
	// +optional
	Version string `json:"version,omitempty"`

	// RepoURL is the repo url where the chart can be found
	// +optional
	RepoURL string `json:"repoURL,omitempty"`

	// The username that is required for this repository
	// +optional
	Username string `json:"username,omitempty"`

	// The password that is required for this repository
	// +optional
	Password string `json:"password,omitempty"`
}

type ChartStatus struct {
	// Name of the chart that was applied
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace of the chart that was applied
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// LastAppliedChartConfigHash is the last applied configuration
	// +optional
	LastAppliedChartConfigHash string `json:"lastAppliedChartConfigHash,omitempty"`
}

type Cluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterSpec   `json:"spec,omitempty"`
	Status ClusterStatus `json:"status,omitempty"`
}

type ClusterAPINodeTypeSpec struct {
	NamedNodeTypeSpec `json:",inline"`
	ClusterAPIObjects `json:",inline"`

	// MergeInfrastructureMachineTemplate will be merged into base InfrastructureMachine template for this NodeProvider.
	// This allows overwriting of specific fields from top level template by individual NodeTypes
	// This is mutually exclusive with InfrastructureMachineTemplate
	MergeInfrastructureMachineTemplate *runtime.RawExtension `json:"mergeInfrastructureMachineTemplate,omitempty"`

	// MergeBootstrapConfigTemplate will be merged into base BootstrapConfig template for this NodeProvider.
	// This allows overwriting of specific fields from top level template by individual NodeTypes
	// This is mutually exclusive with BootstrapConfigTemplate
	MergeBootstrapConfigTemplate *runtime.RawExtension `json:"mergeBootstrapConfigTemplate,omitempty"`

	// MaxCapacity is the maximum number of nodes that can be created for this NodeType.
	MaxCapacity int `json:"maxCapacity,omitempty"`
}