v1

type Access struct {
	// Name is an optional name that is used for this access rule
	// +optional
	Name string `json:"name,omitempty"`

	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds.
	Verbs []string `json:"verbs"`

	// Subresources defines the sub resources that are allowed by this access rule
	// +optional
	Subresources []string `json:"subresources,omitempty"`

	// Users specifies which users should be able to access this secret with the aforementioned verbs
	// +optional
	Users []string `json:"users,omitempty"`

	// Teams specifies which teams should be able to access this secret with the aforementioned verbs
	// +optional
	Teams []string `json:"teams,omitempty"`
}

type AccessAccessor interface {
	GetAccess() []Access
	SetAccess(access []Access)

	GetOwner() *UserOrTeam
	SetOwner(userOrTeam *UserOrTeam)
}

type AccessKey struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessKeySpec   `json:"spec,omitempty"`
	Status AccessKeyStatus `json:"status,omitempty"`
}

type AccessKeyIdentity struct {
	// The subject of the user
	// +optional
	UserID string `json:"userId,omitempty"`

	// The username
	// +optional
	Username string `json:"username,omitempty"`

	// The preferred username / display name
	// +optional
	PreferredUsername string `json:"preferredUsername,omitempty"`

	// The user email
	// +optional
	Email string `json:"email,omitempty"`

	// If the user email was verified
	// +optional
	EmailVerified bool `json:"emailVerified,omitempty"`

	// The groups from the identity provider
	// +optional
	Groups []string `json:"groups,omitempty"`

	// Connector is the name of the connector this access key was created from
	// +optional
	Connector string `json:"connector,omitempty"`

	// ConnectorData holds data used by the connector for subsequent requests after initial
	// authentication, such as access tokens for upstream providers.
	//
	// This data is never shared with end users, OAuth clients, or through the API.
	// +optional
	ConnectorData []byte `json:"connectorData,omitempty"`
}

type AccessKeyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessKey `json:"items"`
}

type AccessKeyOIDC struct {
	// The current id token that was created during login
	// +optional
	IDToken []byte `json:"idToken,omitempty"`

	// The current access token that was created during login
	// +optional
	AccessToken []byte `json:"accessToken,omitempty"`

	// The current refresh token that was created during login
	// +optional
	RefreshToken []byte `json:"refreshToken,omitempty"`

	// The last time the id token was refreshed
	// +optional
	LastRefresh *metav1.Time `json:"lastRefresh,omitempty"`
}

type AccessKeyOIDCProvider struct {
	// ClientId the token was generated for
	// +optional
	ClientId string `json:"clientId,omitempty"`

	// Nonce to use
	// +optional
	Nonce string `json:"nonce,omitempty"`

	// RedirectUri to use
	// +optional
	RedirectUri string `json:"redirectUri,omitempty"`

	// Scopes to use
	// +optional
	Scopes string `json:"scopes,omitempty"`
}

type AccessKeyScope struct {
	// Roles is a set of managed permissions to apply to the access key.
	// +optional
	Roles []AccessKeyScopeRole `json:"roles,omitempty"`

	// Projects specifies the projects the access key should have access to.
	// +optional
	Projects []AccessKeyScopeProject `json:"projects,omitempty"`

	// Spaces specifies the spaces the access key is allowed to access.
	// +optional
	Spaces []AccessKeyScopeSpace `json:"spaces,omitempty"`

	// VirtualClusters specifies the virtual clusters the access key is allowed to access.
	// +optional
	VirtualClusters []AccessKeyScopeVirtualCluster `json:"virtualClusters,omitempty"`

	// Clusters specifies the project cluster the access key is allowed to access.
	// +optional
	Clusters []AccessKeyScopeCluster `json:"clusters,omitempty"`

	// DEPRECATED: Use Projects, Spaces and VirtualClusters instead
	// Rules specifies the rules that should apply to the access key.
	// +optional
	Rules []AccessKeyScopeRule `json:"rules,omitempty"`

	// AllowLoftCLI allows certain read-only management requests to
	// make sure loft cli works correctly with this specific access key.
	//
	// Deprecated: Use the `roles` field instead
	//  “`yaml
	//  # Example:
	//  roles:
	//    - role: loftCLI
	//  “`
	// +optional
	AllowLoftCLI bool `json:"allowLoftCli,omitempty"`
}

type AccessKeyScopeCluster struct {
	// Cluster is the name of the cluster to access. You can specify * to select all clusters.
	// +optional
	Cluster string `json:"cluster,omitempty"`
}

type AccessKeyScopeProject struct {
	// Project is the name of the project. You can specify * to select all projects.
	// +optional
	Project string `json:"project,omitempty"`
}

type AccessKeyScopeRole struct {
	// Role is the name of the role to apply to the access key scope.
	// +optional
	Role AccessKeyScopeRoleName `json:"role,omitempty"`

	// Projects specifies the projects the access key should have access to.
	// +optional
	Projects []string `json:"projects,omitempty"`

	// VirtualClusters specifies the virtual clusters the access key is allowed to access.
	// +optional
	VirtualClusters []string `json:"virtualClusters,omitempty"`
}

type AccessKeyScopeRoleName string

type AccessKeyScopeRule struct {
	// The verbs that match this rule.
	// An empty list implies every verb.
	// +optional
	Verbs []string `json:"verbs,omitempty"`

	// Resources that this rule matches. An empty list implies all kinds in all API groups.
	// +optional
	Resources []GroupResources `json:"resources,omitempty"`

	// Namespaces that this rule matches.
	// The empty string "" matches non-namespaced resources.
	// An empty list implies every namespace.
	// +optional
	Namespaces []string `json:"namespaces,omitempty"`

	// NonResourceURLs is a set of URL paths that should be checked.
	// *s are allowed, but only as the full, final step in the path.
	// Examples:
	//  "/metrics" - Log requests for apiserver metrics
	//  "/healthz*" - Log all health checks
	// +optional
	NonResourceURLs []string `json:"nonResourceURLs,omitempty"`

	// RequestTargets is a list of request targets that are allowed.
	// An empty list implies every request.
	// +optional
	RequestTargets []RequestTarget `json:"requestTargets,omitempty"`

	// Cluster that this rule matches. Only applies to cluster requests.
	// If this is set, no requests for non cluster requests are allowed.
	// An empty cluster means no restrictions will apply.
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// VirtualClusters that this rule matches. Only applies to virtual cluster requests.
	// An empty list means no restrictions will apply.
	// +optional
	VirtualClusters []AccessKeyVirtualCluster `json:"virtualClusters,omitempty"`
}

type AccessKeyScopeSpace struct {
	// Project is the name of the project.
	// +optional
	Project string `json:"project,omitempty"`

	// Space is the name of the space. You can specify * to select all spaces.
	// +optional
	Space string `json:"space,omitempty"`
}

type AccessKeyScopeVirtualCluster struct {
	// Project is the name of the project.
	// +optional
	Project string `json:"project,omitempty"`

	// VirtualCluster is the name of the virtual cluster to access. You can specify * to select all virtual clusters.
	// +optional
	VirtualCluster string `json:"virtualCluster,omitempty"`
}

type AccessKeySpec struct {
	// The display name shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// The user this access key refers to
	// +optional
	User string `json:"user,omitempty"`

	// The team this access key refers to
	// +optional
	Team string `json:"team,omitempty"`

	// Subject is a generic subject that can be used
	// instead of user or team
	// +optional
	Subject string `json:"subject,omitempty"`

	// Groups specifies extra groups to apply when using
	// this access key
	// +optional
	Groups []string `json:"groups,omitempty"`

	// The actual access key that will be used as a bearer token
	// +optional
	Key string `json:"key,omitempty"`

	// If this field is true, the access key is still allowed to exist,
	// however will not work to access the api
	// +optional
	Disabled bool `json:"disabled,omitempty"`

	// The time to life for this access key
	// +optional
	TTL int64 `json:"ttl,omitempty"`

	// If this is specified, the time to life for this access key will
	// start after the lastActivity instead of creation timestamp
	// +optional
	TTLAfterLastActivity bool `json:"ttlAfterLastActivity,omitempty"`

	// Scope defines the scope of the access key.
	// +optional
	Scope *AccessKeyScope `json:"scope,omitempty"`

	// The type of an access key, which basically describes if the access
	// key is user managed or managed by loft itself.
	// +optional
	Type AccessKeyType `json:"type,omitempty"`

	// If available, contains information about the sso login data for this
	// access key
	// +optional
	Identity *AccessKeyIdentity `json:"identity,omitempty"`

	// The last time the identity was refreshed
	// +optional
	IdentityRefresh *metav1.Time `json:"identityRefresh,omitempty"`

	// If the token is a refresh token, contains information about it
	// +optional
	OIDCProvider *AccessKeyOIDCProvider `json:"oidcProvider,omitempty"`

	// DEPRECATED: do not use anymore
	// Parent is used to share OIDC and external token information
	// with multiple access keys. Since copying an OIDC refresh token
	// would result in the other access keys becoming invalid after a refresh
	// parent allows access keys to share that information.
	//
	// The use case for this is primarily user generated access keys,
	// which will have the users current access key as parent if it contains
	// an OIDC token.
	// +optional
	Parent string `json:"parent,omitempty"`

	// DEPRECATED: Use identity instead
	// If available, contains information about the oidc login data for this
	// access key
	// +optional
	OIDCLogin *AccessKeyOIDC `json:"oidcLogin,omitempty"`
}

type AccessKeyStatus struct {
	// The last time this access key was used to access the api
	// +optional
	LastActivity *metav1.Time `json:"lastActivity,omitempty"`
}

type AccessKeyType string

type AccessKeyVirtualCluster struct {
	// Name of the virtual cluster. Empty means all virtual clusters.
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace of the virtual cluster. Empty means all namespaces.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type AllowedCluster struct {
	// Name is the name of the cluster that is allowed to create an environment in.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedClusterAccountTemplate struct {
	// Name is the name of a cluster account template
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedRunner struct {
	// Name is the name of the runner that is allowed to create an environment in.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedTemplate struct {
	// Kind of the template that is allowed. Currently only supports DevPodWorkspaceTemplate, VirtualClusterTemplate & SpaceTemplate
	// +optional
	Kind string `json:"kind,omitempty"`

	// Group of the template that is allowed. Currently only supports storage.loft.sh
	// +optional
	Group string `json:"group,omitempty"`

	// Name of the template
	// +optional
	Name string `json:"name,omitempty"`

	// IsDefault specifies if the template should be used as a default
	// +optional
	IsDefault bool `json:"isDefault,omitempty"`
}

type App struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AppSpec   `json:"spec,omitempty"`
	Status AppStatus `json:"status,omitempty"`
}

type AppConfig struct {
	// DefaultNamespace is the default namespace this app should installed
	// in.
	// +optional
	DefaultNamespace string `json:"defaultNamespace,omitempty"`

	// Readme is a longer markdown string that describes the app.
	// +optional
	Readme string `json:"readme,omitempty"`

	// Icon holds an URL to the app icon
	// +optional
	Icon string `json:"icon,omitempty"`

	// Config is the helm config to use to deploy the helm release
	// +optional
	Config clusterv1.HelmReleaseConfig `json:"config,omitempty"`

	// Wait determines if Loft should wait during deploy for the app to become ready
	// +optional
	Wait bool `json:"wait,omitempty"`

	// Timeout is the time to wait for any individual Kubernetes operation (like Jobs for hooks) (default 5m0s)
	// +optional
	Timeout string `json:"timeout,omitempty"`

	// Parameters define additional app parameters that will set helm values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// DEPRECATED: Use config.bash instead
	// StreamContainer can be used to stream a containers logs instead of the helm output.
	// +optional
	// +internal
	StreamContainer *StreamContainer `json:"streamContainer,omitempty"`
}

type AppList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []App `json:"items"`
}

type AppParameter struct {
	// Variable is the path of the variable. Can be foo or foo.bar for nested objects.
	// +optional
	Variable string `json:"variable,omitempty"`

	// Label is the label to show for this parameter
	// +optional
	Label string `json:"label,omitempty"`

	// Description is the description to show for this parameter
	// +optional
	Description string `json:"description,omitempty"`

	// Type of the parameter. Can be one of:
	// string, multiline, boolean, number and password
	// +optional
	Type string `json:"type,omitempty"`

	// Options is a slice of strings, where each string represents a mutually exclusive choice.
	// +optional
	Options []string `json:"options,omitempty"`

	// Min is the minimum number if type is number
	// +optional
	Min *int `json:"min,omitempty"`

	// Max is the maximum number if type is number
	// +optional
	Max *int `json:"max,omitempty"`

	// Required specifies if this parameter is required
	// +optional
	Required bool `json:"required,omitempty"`

	// DefaultValue is the default value if none is specified
	// +optional
	DefaultValue string `json:"defaultValue,omitempty"`

	// Placeholder shown in the UI
	// +optional
	Placeholder string `json:"placeholder,omitempty"`

	// Invalidation regex that if matched will reject the input
	// +optional
	Invalidation string `json:"invalidation,omitempty"`

	// Validation regex that if matched will allow the input
	// +optional
	Validation string `json:"validation,omitempty"`

	// Section where this app should be displayed. Apps with the same section name will be grouped together
	// +optional
	Section string `json:"section,omitempty"`
}

type AppReference struct {
	// Name of the target app
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace specifies in which target namespace the app should
	// get deployed in
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// ReleaseName is the name of the app release
	// +optional
	ReleaseName string `json:"releaseName,omitempty"`

	// Version of the app
	// +optional
	Version string `json:"version,omitempty"`

	// Parameters to use for the app
	// +optional
	Parameters string `json:"parameters,omitempty"`
}

type AppSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this app can be installed in.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// RecommendedApp specifies where this app should show up as recommended app
	// +optional
	RecommendedApp []RecommendedApp `json:"recommendedApp,omitempty"`

	// AppConfig is the app configuration
	AppConfig `json:",inline"`

	// Versions are different app versions that can be referenced
	// +optional
	Versions []AppVersion `json:"versions,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// DEPRECATED: Use config instead
	// manifest represents kubernetes resources that will be deployed into the target namespace
	// +optional
	Manifests string `json:"manifests,omitempty"`

	// DEPRECATED: Use config instead
	// helm defines the configuration for a helm deployment
	// +optional
	Helm *HelmConfiguration `json:"helm,omitempty"`
}

type AppStatus struct {
}

type AppTask struct {
	// Type is the task type. Defaults to Upgrade
	// +optional
	Type HelmTaskType `json:"type,omitempty"`

	// RollbackRevision is the revision to rollback to
	// +optional
	RollbackRevision string `json:"rollbackRevision,omitempty"`

	// AppReference is the reference to the app to deploy
	// +optional
	AppReference AppReference `json:"appReference,omitempty"`
}

type AppVersion struct {
	// AppConfig is the app configuration
	AppConfig `json:",inline"`

	// Version is the version. Needs to be in X.X.X format.
	// +optional
	Version string `json:"version,omitempty"`
}

type ArgoIntegrationSpec struct {
	// Enabled indicates if the ArgoCD Integration is enabled for the project -- this knob only
	// enables the syncing of virtualclusters, but does not enable SSO integration or project
	// creation (see subsequent spec sections!).
	// +optional
	Enabled bool `json:"enabled,omitempty"`

	// Cluster defines the name of the cluster that ArgoCD is deployed into -- if not provided this
	// will default to 'loft-cluster'.
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// VirtualClusterInstance defines the name of *virtual cluster* (instance) that ArgoCD is
	// deployed into. If provided, Cluster will be ignored and Loft will assume that ArgoCD is
	// running in the specified virtual cluster.
	// +optional
	VirtualClusterInstance string `json:"virtualClusterInstance,omitempty"`

	// Namespace defines the namespace in which ArgoCD is running in the cluster.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// SSO defines single-sign-on related values for the ArgoCD Integration. Enabling SSO will allow
	// users to authenticate to ArgoCD via Loft.
	// +optional
	SSO *ArgoSSOSpec `json:"sso,omitempty"`

	// Project defines project related values for the ArgoCD Integration. Enabling Project
	// integration will cause Loft to generate and manage an ArgoCD appProject that corresponds to
	// the Loft Project.
	// +optional
	Project *ArgoProjectSpec `json:"project,omitempty"`
}

type ArgoProjectPolicyRule struct {
	// Action is one of "*", "get", "create", "update", "delete", "sync", or "override".
	// +optional
	Action string `json:"action,omitempty"`
	// Application is the ArgoCD project/repository to apply the rule to.
	// +optional
	Application string `json:"application,omitempty"`
	// Allow applies the "allow" permission to the rule, if allow is not set, the permission will
	// always be set to "deny".
	// +optional
	Allow bool `json:"permission,omitempty"`
}

type ArgoProjectRole struct {
	// Name of the ArgoCD role to attach to the project.
	Name string `json:"name,omitempty"`
	// Description to add to the ArgoCD project.
	// +optional
	Description string `json:"description,omitempty"`
	// Rules ist a list of policy rules to attach to the role.
	Rules []ArgoProjectPolicyRule `json:"rules,omitempty"`
	// Groups is a list of OIDC group names to bind to the role.
	Groups []string `json:"groups,omitempty"`
}

type ArgoProjectSpec struct {
	// Enabled indicates if the ArgoCD Project Integration is enabled for this project. Enabling
	// this will cause Loft to create an appProject in ArgoCD that is associated with the Loft
	// Project. When Project integration is enabled Loft will override the default assigned role
	// set in the SSO integration spec.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// Metadata defines additional metadata to attach to the loft created project in ArgoCD.
	// +optional
	Metadata ArgoProjectSpecMetadata `json:"metadata,omitempty"`
	// SourceRepos is a list of source repositories to attach/allow on the project, if not specified
	// will be "*" indicating all source repositories.
	// +optional
	SourceRepos []string `json:"sourceRepos,omitempty"`
	// Roles is a list of roles that should be attached to the ArgoCD project. If roles are provided
	// no loft default roles will be set. If no roles are provided *and* SSO is enabled, loft will
	// configure sane default values.
	// +optional
	Roles []ArgoProjectRole `json:"roles,omitempty"`
}

type ArgoProjectSpecMetadata struct {
	// ExtraAnnotations are optional annotations that can be attached to the project in ArgoCD.
	// +optional
	ExtraAnnotations map[string]string `json:"extraAnnotations,omitempty"`
	// ExtraLabels are optional labels that can be attached to the project in ArgoCD.
	// +optional
	ExtraLabels map[string]string `json:"extraLabels,omitempty"`
	// Description to add to the ArgoCD project.
	// +optional
	Description string `json:"description,omitempty"`
}

type ArgoSSOSpec struct {
	// Enabled indicates if the ArgoCD SSO Integration is enabled for this project. Enabling this
	// will cause Loft to configure SSO authentication via Loft in ArgoCD. If Projects are *not*
	// enabled, all users associated with this Project will be assigned either the 'read-only'
	// (default) role, *or* the roles set under the AssignedRoles field.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// Host defines the ArgoCD host address that will be used for OIDC authentication between loft
	// and ArgoCD. If not specified OIDC integration will be skipped, but vclusters/spaces will
	// still be synced to ArgoCD.
	// +optional
	Host string `json:"host,omitempty"`
	// AssignedRoles is a list of roles to assign for users who authenticate via Loft -- by default
	// this will be the `read-only` role. If any roles are provided this will override the default
	// setting.
	// +optional
	AssignedRoles []string `json:"assignedRoles,omitempty"`
}

type Chart struct {
	// Name is the chart name in the repository
	Name string `json:"name,omitempty"`

	// Version is the chart version in the repository
	// +optional
	Version string `json:"version,omitempty"`

	// RepoURL is the repo url where the chart can be found
	// +optional
	RepoURL string `json:"repoURL,omitempty"`

	// The username that is required for this repository
	// +optional
	Username string `json:"username,omitempty"`

	// The password that is required for this repository
	// +optional
	Password string `json:"password,omitempty"`
}

type ChartStatus struct {
	// Name of the chart that was applied
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace of the chart that was applied
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// LastAppliedChartConfigHash is the last applied configuration
	// +optional
	LastAppliedChartConfigHash string `json:"lastAppliedChartConfigHash,omitempty"`
}

type Cluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterSpec   `json:"spec,omitempty"`
	Status ClusterStatus `json:"status,omitempty"`
}

type ClusterAccess struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterAccessSpec   `json:"spec,omitempty"`
	Status ClusterAccessStatus `json:"status,omitempty"`
}

type ClusterAccessList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterAccess `json:"items"`
}

type ClusterAccessSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster access object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this template should be applied on.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// LocalClusterAccessTemplate holds the cluster access template
	// +omitempty
	LocalClusterAccessTemplate LocalClusterAccessTemplate `json:"localClusterAccessTemplate,omitempty"`
}

type ClusterAccessStatus struct {
}

type ClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Cluster `json:"items"`
}

type ClusterRef struct {
	// Cluster is the connected cluster the space will be created in
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// Namespace is the namespace inside the connected cluster holding the space
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type ClusterRoleRef struct {
	// Name is the cluster role to assign
	// +optional
	Name string `json:"name,omitempty"`
}

type ClusterRoleTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterRoleTemplateSpec   `json:"spec,omitempty"`
	Status ClusterRoleTemplateStatus `json:"status,omitempty"`
}

type ClusterRoleTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterRoleTemplate `json:"items"`
}

type ClusterRoleTemplateSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster role template object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this template should be applied on.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// Management defines if this cluster role should be created in the management instance.
	// +optional
	Management bool `json:"management,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// ClusterRoleTemplate holds the cluster role template
	// +optional
	ClusterRoleTemplate ClusterRoleTemplateTemplate `json:"clusterRoleTemplate,omitempty"`

	// DEPRECATED: Use ClusterRoleTemplate instead
	// LocalClusterRoleTemplate holds the cluster role template
	// +omitempty
	LocalClusterRoleTemplate *LocalClusterRoleTemplate `json:"localClusterRoleTemplate,omitempty"`
}

type ClusterRoleTemplateStatus struct {
}

type ClusterRoleTemplateTemplate struct {
	// Standard object's metadata.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Rules holds all the PolicyRules for this ClusterRole
	// +optional
	Rules []rbacv1.PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`

	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
	// stomped by the controller.
	// +optional
	AggregationRule *rbacv1.AggregationRule `json:"aggregationRule,omitempty" protobuf:"bytes,3,opt,name=aggregationRule"`
}

type ClusterSpec struct {
	// If specified this name is displayed in the UI instead of the metadata name
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster access object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Holds a reference to a secret that holds the kube config to access this cluster
	// +optional
	Config SecretRef `json:"config,omitempty"`

	// Local specifies if it is the local cluster that should be connected, when this is specified, config is optional
	// +optional
	Local bool `json:"local,omitempty"`

	// NetworkPeer specifies if the cluster is connected via tailscale, when this is specified, config is optional
	// +optional
	NetworkPeer bool `json:"networkPeer,omitempty"`

	// The namespace where the cluster components will be installed in
	// +optional
	ManagementNamespace string `json:"managementNamespace,omitempty"`

	// If unusable is true, no spaces or virtual clusters can be scheduled on this cluster.
	// +optional
	Unusable bool `json:"unusable,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// Metrics holds the cluster's metrics backend configuration
	Metrics *Metrics `json:"metrics,omitempty"`

	// OpenCost holds the cluster's OpenCost backend configuration
	OpenCost *OpenCost `json:"opencost,omitempty"`
}

type ClusterStatus struct {
	// +optional
	Phase ClusterStatusPhase `json:"phase,omitempty"`

	// +optional
	Reason string `json:"reason,omitempty"`

	// +optional
	Message string `json:"message,omitempty"`

	// Conditions holds several conditions the cluster might be in
	// +optional
	Conditions agentstoragev1.Conditions `json:"conditions,omitempty"`
}

type ClusterStatusPhase string

type CredentialForwarding struct {
	// Docker specifies controls for how workspaces created by this template forward docker credentials
	// +optional
	Docker *DockerCredentialForwarding `json:"docker,omitempty"`

	// Git specifies controls for how workspaces created by this template forward git credentials
	// +optional
	Git *GitCredentialForwarding `json:"git,omitempty"`
}

type DevPodCommandDeleteOptions struct {
	IgnoreNotFound bool   `json:"ignoreNotFound,omitempty"`
	Force          bool   `json:"force,omitempty"`
	GracePeriod    string `json:"gracePeriod,omitempty"`
}

type DevPodCommandStatusOptions struct {
	ContainerStatus bool `json:"containerStatus,omitempty"`
}

type DevPodCommandStopOptions struct{}

type DevPodCommandUpOptions struct {
	// up options
	ID                   string   `json:"id,omitempty"`
	Source               string   `json:"source,omitempty"`
	IDE                  string   `json:"ide,omitempty"`
	IDEOptions           []string `json:"ideOptions,omitempty"`
	PrebuildRepositories []string `json:"prebuildRepositories,omitempty"`
	DevContainerPath     string   `json:"devContainerPath,omitempty"`
	WorkspaceEnv         []string `json:"workspaceEnv,omitempty"`
	Recreate             bool     `json:"recreate,omitempty"`
	Proxy                bool     `json:"proxy,omitempty"`
	DisableDaemon        bool     `json:"disableDaemon,omitempty"`
	DaemonInterval       string   `json:"daemonInterval,omitempty"`

	// build options
	Repository string   `json:"repository,omitempty"`
	SkipPush   bool     `json:"skipPush,omitempty"`
	Platform   []string `json:"platform,omitempty"`

	// TESTING
	ForceBuild            bool `json:"forceBuild,omitempty"`
	ForceInternalBuildKit bool `json:"forceInternalBuildKit,omitempty"`
}

type DevPodEnvironmentTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DevPodEnvironmentTemplateSpec   `json:"spec,omitempty"`
	Status DevPodEnvironmentTemplateStatus `json:"status,omitempty"`
}

type DevPodEnvironmentTemplateDefinition struct {
	// Git holds configuration for git environment spec source
	// +optional
	Git *GitEnvironmentTemplate `json:"git,omitempty"`

	// Inline holds an inline devcontainer.json definition
	// +optional
	Inline string `json:"inline,omitempty"`
}

type DevPodEnvironmentTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DevPodEnvironmentTemplate `json:"items"`
}

type DevPodEnvironmentTemplateSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes the environment template
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Access to the DevPod machine instance object itself
	// +optional
	Access []Access `json:"access,omitempty"`

	// Template is the inline template to use for DevPod environments
	// +optional
	Template *DevPodEnvironmentTemplateDefinition `json:"template,omitempty"`

	// Versions are different versions of the template that can be referenced as well
	// +optional
	Versions []DevPodEnvironmentTemplateVersion `json:"versions,omitempty"`
}

type DevPodEnvironmentTemplateStatus struct {
}

type DevPodEnvironmentTemplateVersion struct {
	// Template holds the environment template definition
	// +optional
	Template DevPodEnvironmentTemplateDefinition `json:"template,omitempty"`

	// Version is the version. Needs to be in X.X.X format.
	// +optional
	Version string `json:"version,omitempty"`
}

type DevPodProjectSpec struct {
	// Git defines additional git related settings like credentials
	// +optional
	Git *GitProjectSpec `json:"git,omitempty"`

	// FallbackImage defines an image all workspace will fall back to if no devcontainer.json could be detected
	// +optional
	FallbackImage string `json:"fallbackImage,omitempty"`

	// RegistryPattern specifies a template pattern to use for building images on the fly.
	// Requires the platform pods to be authenticated against the registry.
	// +optional
	RegistryPattern string `json:"registryPattern,omitempty"`
}

type DevPodProviderOption struct {
	// Value of this option.
	// +optional
	Value string `json:"value,omitempty"`

	// ValueFrom specifies a secret where this value should be taken from.
	// +optional
	ValueFrom *DevPodProviderOptionFrom `json:"valueFrom,omitempty"`
}

type DevPodProviderOptionFrom struct {
	// ProjectSecretRef is the project secret to use for this value.
	// +optional
	ProjectSecretRef *corev1.SecretKeySelector `json:"projectSecretRef,omitempty"`

	// SharedSecretRef is the shared secret to use for this value.
	// +optional
	SharedSecretRef *corev1.SecretKeySelector `json:"sharedSecretRef,omitempty"`
}

type DevPodProviderSource struct {
	// Github source for the provider
	Github string `json:"github,omitempty"`

	// File source for the provider
	File string `json:"file,omitempty"`

	// URL where the provider was downloaded from
	URL string `json:"url,omitempty"`
}

type DevPodWorkspaceContainer struct {
	// Name of the container specified as a DNS_LABEL.
	Name string `json:"name"`
	// Container image name.
	// +optional
	Image string `json:"image,omitempty"`
	// Entrypoint array. Not executed within a shell.
	// +optional
	// +listType=atomic
	Command []string `json:"command,omitempty"`
	// Arguments to the entrypoint.
	// +optional
	// +listType=atomic
	Args []string `json:"args,omitempty"`
	// Container's working directory.
	// +optional
	WorkingDir string `json:"workingDir,omitempty"`
	// List of ports to expose from the container. Not specifying a port here
	// +optional
	Ports []corev1.ContainerPort `json:"ports,omitempty"`
	// +optional
	// +listType=atomic
	EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`
	// List of environment variables to set in the container.
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`
	// Compute Resources required by this container.
	// +optional
	Resources DevPodWorkspaceResourceRequirements `json:"resources,omitempty"`
	// Resources resize policy for the container.
	// +optional
	// +listType=atomic
	ResizePolicy []corev1.ContainerResizePolicy `json:"resizePolicy,omitempty"`
	// RestartPolicy defines the restart behavior of individual containers in a pod.
	// +optional
	RestartPolicy *corev1.ContainerRestartPolicy `json:"restartPolicy,omitempty"`
	// Pod volumes to mount into the container's filesystem.
	// +optional
	VolumeMounts []corev1.VolumeMount `json:"volumeMounts,omitempty"`
	// volumeDevices is the list of block devices to be used by the container.
	// +optional
	VolumeDevices []corev1.VolumeDevice `json:"volumeDevices,omitempty"`
	// Periodic probe of container liveness.
	// +optional
	LivenessProbe *corev1.Probe `json:"livenessProbe,omitempty"`
	// Periodic probe of container service readiness.
	// +optional
	ReadinessProbe *corev1.Probe `json:"readinessProbe,omitempty"`
	// StartupProbe indicates that the Pod has successfully initialized.
	// +optional
	StartupProbe *corev1.Probe `json:"startupProbe,omitempty"`
	// Actions that the management system should take in response to container lifecycle events.
	// +optional
	Lifecycle *corev1.Lifecycle `json:"lifecycle,omitempty"`
	// Optional: Path at which the file to which the container's termination message
	// +optional
	TerminationMessagePath string `json:"terminationMessagePath,omitempty"`
	// Indicate how the termination message should be populated. File will use the contents of
	// +optional
	TerminationMessagePolicy corev1.TerminationMessagePolicy `json:"terminationMessagePolicy,omitempty"`
	// Image pull policy.
	// +optional
	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
	// SecurityContext defines the security options the container should be run with.
	// +optional
	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`

	// Whether this container should allocate a buffer for stdin in the container runtime.
	// +optional
	Stdin bool `json:"stdin,omitempty"`
	// StdinOnce default is false
	// +optional
	StdinOnce bool `json:"stdinOnce,omitempty"`
	// TTY default is false.
	// +optional
	TTY bool `json:"tty,omitempty"`
}

type DevPodWorkspaceInstance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DevPodWorkspaceInstanceSpec   `json:"spec,omitempty"`
	Status DevPodWorkspaceInstanceStatus `json:"status,omitempty"`
}

type DevPodWorkspaceInstanceContainerResource struct {
	// Name is the name of the container
	// +optional
	Name string `json:"name,omitempty"`
	// Resources is the resources of the container
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`
}

type DevPodWorkspaceInstanceEvent struct {
	// This should be a short, machine understandable string that gives the reason
	// for the transition into the object's current status.
	// TODO: provide exact specification for format.
	// +optional
	Reason string `json:"reason,omitempty" protobuf:"bytes,3,opt,name=reason"`

	// A human-readable description of the status of this operation.
	// TODO: decide on maximum length.
	// +optional
	Message string `json:"message,omitempty" protobuf:"bytes,4,opt,name=message"`

	// The time at which the most recent occurrence of this event was recorded.
	// +optional
	LastTimestamp metav1.Time `json:"lastTimestamp,omitempty" protobuf:"bytes,7,opt,name=lastTimestamp"`

	// Type of this event (Normal, Warning), new types could be added in the future
	// +optional
	Type string `json:"type,omitempty" protobuf:"bytes,9,opt,name=type"`
}

type DevPodWorkspaceInstanceKubernetesStatus struct {
	// Last time the condition transitioned from one status to another.
	// +required
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`

	// PodStatus is the status of the pod that is running the workspace
	// +optional
	PodStatus *DevPodWorkspaceInstancePodStatus `json:"podStatus,omitempty"`

	// PersistentVolumeClaimStatus is the pvc that is used to store the workspace
	// +optional
	PersistentVolumeClaimStatus *DevPodWorkspaceInstancePersistentVolumeClaimStatus `json:"persistentVolumeClaimStatus,omitempty"`
}

type DevPodWorkspaceInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DevPodWorkspaceInstance `json:"items"`
}

type DevPodWorkspaceInstancePersistentVolumeClaimStatus struct {
	// phase represents the current phase of PersistentVolumeClaim.
	// +optional
	Phase corev1.PersistentVolumeClaimPhase `json:"phase,omitempty" protobuf:"bytes,1,opt,name=phase,casttype=PersistentVolumeClaimPhase"`
	// capacity represents the actual resources of the underlying volume.
	// +optional
	Capacity corev1.ResourceList `json:"capacity,omitempty" protobuf:"bytes,3,rep,name=capacity,casttype=ResourceList,castkey=ResourceName"`
	// conditions is the current Condition of persistent volume claim. If underlying persistent volume is being
	// resized then the Condition will be set to 'Resizing'.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []corev1.PersistentVolumeClaimCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,4,rep,name=conditions"`
	// Events are the events of the pod that is running the workspace. This will only be filled if the persistent volume claim is not bound.
	// +optional
	Events []DevPodWorkspaceInstanceEvent `json:"events,omitempty"`
}

type DevPodWorkspaceInstancePodStatus struct {
	// The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle.
	// The conditions array, the reason and message fields, and the individual container status
	// arrays contain more detail about the pod's status.
	// There are five possible phase values:
	//
	// Pending: The pod has been accepted by the Kubernetes system, but one or more of the
	// container images has not been created. This includes time before being scheduled as
	// well as time spent downloading images over the network, which could take a while.
	// Running: The pod has been bound to a node, and all of the containers have been created.
	// At least one container is still running, or is in the process of starting or restarting.
	// Succeeded: All containers in the pod have terminated in success, and will not be restarted.
	// Failed: All containers in the pod have terminated, and at least one container has
	// terminated in failure. The container either exited with non-zero status or was terminated
	// by the system.
	// Unknown: For some reason the state of the pod could not be obtained, typically due to an
	// error in communicating with the host of the pod.
	//
	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase
	// +optional
	Phase corev1.PodPhase `json:"phase,omitempty" protobuf:"bytes,1,opt,name=phase,casttype=PodPhase"`
	// Current service state of pod.
	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []corev1.PodCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,2,rep,name=conditions"`
	// A human readable message indicating details about why the pod is in this condition.
	// +optional
	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
	// A brief CamelCase message indicating details about why the pod is in this state.
	// e.g. 'Evicted'
	// +optional
	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
	// Statuses of init containers in this pod. The most recent successful non-restartable
	// init container will have ready = true, the most recently started container will have
	// startTime set.
	// Each init container in the pod should have at most one status in this list,
	// and all statuses should be for containers in the pod.
	// However this is not enforced.
	// If a status for a non-existent container is present in the list, or the list has duplicate names,
	// the behavior of various Kubernetes components is not defined and those statuses might be
	// ignored.
	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-and-container-status
	// +listType=atomic
	InitContainerStatuses []corev1.ContainerStatus `json:"initContainerStatuses,omitempty" protobuf:"bytes,10,rep,name=initContainerStatuses"`
	// Statuses of containers in this pod.
	// Each container in the pod should have at most one status in this list,
	// and all statuses should be for containers in the pod.
	// However this is not enforced.
	// If a status for a non-existent container is present in the list, or the list has duplicate names,
	// the behavior of various Kubernetes components is not defined and those statuses might be
	// ignored.
	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status
	// +optional
	// +listType=atomic
	ContainerStatuses []corev1.ContainerStatus `json:"containerStatuses,omitempty" protobuf:"bytes,8,rep,name=containerStatuses"`
	// NodeName is the name of the node that is running the workspace
	// +optional
	NodeName string `json:"nodeName,omitempty"`
	// Events are the events of the pod that is running the workspace. This will only be filled if the pod is not running.
	// +optional
	Events []DevPodWorkspaceInstanceEvent `json:"events,omitempty"`
	// ContainerResources are the resources of the containers that are running the workspace
	// +optional
	ContainerResources []DevPodWorkspaceInstanceContainerResource `json:"containerResources,omitempty"`
	// ContainerMetrics are the metrics of the pod that is running the workspace
	// +optional
	ContainerMetrics []metricsv1beta1.ContainerMetrics `json:"containerMetrics,omitempty"`
}

type DevPodWorkspaceInstanceSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a DevPod machine instance
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// PresetRef holds the DevPodWorkspacePreset template reference
	// +optional
	PresetRef *PresetRef `json:"presetRef,omitempty"`

	// TemplateRef holds the DevPod machine template reference
	// +optional
	TemplateRef *TemplateRef `json:"templateRef,omitempty"`

	// EnvironmentRef is the reference to DevPodEnvironmentTemplate that should be used
	// +optional
	EnvironmentRef *EnvironmentRef `json:"environmentRef,omitempty"`

	// Template is the inline template to use for DevPod machine creation. This is mutually
	// exclusive with templateRef.
	// +optional
	Template *DevPodWorkspaceTemplateDefinition `json:"template,omitempty"`

	// Target is the reference to the cluster holding this workspace
	// +optional
	Target WorkspaceTarget `json:"target,omitempty"`

	// Deprecated: Use TargetRef instead
	// RunnerRef is the reference to the runner holding this workspace
	// +optional
	RunnerRef RunnerRef `json:"runnerRef,omitempty"`

	// Parameters are values to pass to the template.
	// The values should be encoded as YAML string where each parameter is represented as a top-level field key.
	// +optional
	Parameters string `json:"parameters,omitempty"`

	// Access to the DevPod machine instance object itself
	// +optional
	Access []Access `json:"access,omitempty"`

	// PreventWakeUpOnConnection is used to prevent workspace that uses sleep mode from waking up on incomming ssh connection.
	// +optional
	PreventWakeUpOnConnection bool `json:"preventWakeUpOnConnection,omitempty"`
}

type DevPodWorkspaceInstanceStatus struct {
	// ResolvedTarget is the resolved target of the workspace
	// +optional
	ResolvedTarget WorkspaceResolvedTarget `json:"resolvedTarget,omitempty"`

	// LastWorkspaceStatus is the last workspace status reported by the runner.
	// +optional
	LastWorkspaceStatus WorkspaceStatus `json:"lastWorkspaceStatus,omitempty"`

	// Phase describes the current phase the DevPod machine instance is in
	// +optional
	Phase InstancePhase `json:"phase,omitempty"`

	// Reason describes the reason in machine-readable form why the cluster is in the current
	// phase
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message describes the reason in human-readable form why the DevPod machine is in the current
	// phase
	// +optional
	Message string `json:"message,omitempty"`

	// Conditions holds several conditions the DevPod machine might be in
	// +optional
	Conditions agentstoragev1.Conditions `json:"conditions,omitempty"`

	// Instance is the template rendered with all the parameters
	// +optional
	Instance *DevPodWorkspaceTemplateDefinition `json:"instance,omitempty"`

	// IgnoreReconciliation ignores reconciliation for this object
	// +optional
	IgnoreReconciliation bool `json:"ignoreReconciliation,omitempty"`

	// Kubernetes is the status of the workspace on kubernetes
	// +optional
	Kubernetes *DevPodWorkspaceInstanceKubernetesStatus `json:"kubernetes,omitempty"`
}

type DevPodWorkspaceInstanceTemplateDefinition struct {
	// The workspace instance metadata
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	TemplateMetadata `json:"metadata,omitempty"`
}

type DevPodWorkspaceKubernetesSpec struct {
	// Pod holds the definition for workspace pod.
	//
	// Defaults will be applied for fields that aren't specified.
	// +optional
	Pod *DevPodWorkspacePodTemplate `json:"pod,omitempty"`

	// VolumeClaim holds the definition for the main workspace persistent volume.
	// This volume is guaranteed to exist for the lifespan of the workspace.
	//
	// Defaults will be applied for fields that aren't specified.
	// +optional
	VolumeClaim *DevPodWorkspaceVolumeClaimTemplate `json:"volumeClaim,omitempty"`

	// PodTimeout specifies a maximum duration to wait for the workspace pod to start up before failing.
	// Default: 10m
	// +optional
	PodTimeout string `json:"podTimeout,omitempty"`

	// NodeArchitecture specifies the node architecture the workspace image will be built for.
	// Only necessary if you need to build workspace images on the fly in the kubernetes cluster and your cluster is mixed architecture.
	// +optional
	NodeArchitecure string `json:"nodeArchitecture,omitempty"`

	// SpaceTemplateRef is a reference to the space that should get created for this DevPod.
	// If this is specified, the kubernetes provider will be selected automatically.
	// +optional
	SpaceTemplateRef *TemplateRef `json:"spaceTemplateRef,omitempty"`

	// SpaceTemplate is the inline template for a space that should get created for this DevPod.
	// If this is specified, the kubernetes provider will be selected automatically.
	// +optional
	SpaceTemplate *SpaceTemplateDefinition `json:"spaceTemplate,omitempty"`

	// VirtualClusterTemplateRef is a reference to the virtual cluster that should get created for this DevPod.
	// If this is specified, the kubernetes provider will be selected automatically.
	// +optional
	VirtualClusterTemplateRef *TemplateRef `json:"virtualClusterTemplateRef,omitempty"`

	// VirtualClusterTemplate is the inline template for a virtual cluster that should get created for this DevPod.
	// If this is specified, the kubernetes provider will be selected automatically.
	// +optional
	VirtualClusterTemplate *VirtualClusterTemplateDefinition `json:"virtualClusterTemplate,omitempty"`
}

type DevPodWorkspacePodTemplate struct {
	// The pods metadata
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	TemplateMetadata `json:"metadata,omitempty"`

	Spec DevPodWorkspacePodTemplateSpec `json:"spec,omitempty"`
}

type DevPodWorkspacePodTemplateSpec struct {
	// List of volumes that can be mounted by containers belonging to the pod.
	// +optional
	Volumes []corev1.Volume `json:"volumes,omitempty"`

	// List of initialization containers belonging to the pod.
	// +optional
	InitContainers []DevPodWorkspaceContainer `json:"initContainers,omitempty"`

	// List of containers belonging to the pod.
	// +optional
	Containers []DevPodWorkspaceContainer `json:"containers,omitempty"`

	// Restart policy for all containers within the pod.
	// +optional
	RestartPolicy corev1.RestartPolicy `json:"restartPolicy,omitempty"`

	// Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request.
	// +optional
	TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty"`

	// Optional duration in seconds the pod may be active on the node relative to
	// +optional
	ActiveDeadlineSeconds *int64 `json:"activeDeadlineSeconds,omitempty"`

	// Set DNS policy for the pod.
	// +optional
	DNSPolicy corev1.DNSPolicy `json:"dnsPolicy,omitempty"`

	// NodeSelector is a selector which must be true for the pod to fit on a node.
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// ServiceAccountName is the name of the ServiceAccount to use to run this pod.
	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
	// +optional
	AutomountServiceAccountToken *bool `json:"automountServiceAccountToken,omitempty"`

	// NodeName indicates in which node this pod is scheduled.
	// +optional
	NodeName string `json:"nodeName,omitempty"`

	// Host networking requested for this pod. Use the host's network namespace.
	// +optional
	HostNetwork bool `json:"hostNetwork,omitempty"`

	// Use the host's pid namespace.
	// +optional
	HostPID bool `json:"hostPID,omitempty"`

	// Use the host's ipc namespace.
	// +optional
	HostIPC bool `json:"hostIPC,omitempty"`

	// Share a single process namespace between all of the containers in a pod.
	// +optional
	ShareProcessNamespace *bool `json:"shareProcessNamespace,omitempty"`

	// SecurityContext holds pod-level security attributes and common container settings.
	// +optional
	SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`

	// ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
	// +optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`

	// Specifies the hostname of the Pod
	// +optional
	Hostname string `json:"hostname,omitempty"`

	// If specified, the fully qualified Pod hostname will be "<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>".
	// +optional
	Subdomain string `json:"subdomain,omitempty"`

	// If specified, the pod's scheduling constraints
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`

	// If specified, the pod will be dispatched by specified scheduler.
	// If not specified, the pod will be dispatched by default scheduler.
	// +optional
	SchedulerName string `json:"schedulerName,omitempty"`

	// If specified, the pod's tolerations.
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts
	// +optional
	HostAliases []corev1.HostAlias `json:"hostAliases,omitempty"`

	// If specified, indicates the pod's priority.
	// +optional
	PriorityClassName string `json:"priorityClassName,omitempty"`

	// +optional
	Priority *int32 `json:"priority,omitempty"`

	// Specifies the DNS parameters of a pod.
	// +optional
	DNSConfig *corev1.PodDNSConfig `json:"dnsConfig,omitempty"`

	// If specified, all readiness gates will be evaluated for pod readiness.
	// +optional
	ReadinessGates []corev1.PodReadinessGate `json:"readinessGates,omitempty"`

	// RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run this pod
	// +optional
	RuntimeClassName *string `json:"runtimeClassName,omitempty"`

	// EnableServiceLinks indicates whether information about services should be injected into pod's
	// environment variables, matching the syntax of Docker links.
	// +optional
	EnableServiceLinks *bool `json:"enableServiceLinks,omitempty"`

	// PreemptionPolicy is the Policy for preempting pods with lower priority.
	// +optional
	PreemptionPolicy *corev1.PreemptionPolicy `json:"preemptionPolicy,omitempty"`

	// Overhead represents the resource overhead associated with running a pod for a given RuntimeClass.
	// +optional
	Overhead corev1.ResourceList `json:"overhead,omitempty"`

	// TopologySpreadConstraints describes how a group of pods ought to spread across topology domains.
	// +optional
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`

	// If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default).
	// In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname).
	// In Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters to FQDN.
	// +optional
	SetHostnameAsFQDN *bool `json:"setHostnameAsFQDN,omitempty"`

	// Specifies the OS of the containers in the pod.
	// +optional
	OS *corev1.PodOS `json:"os,omitempty"`

	// Use the host's user namespace.
	// +optional
	HostUsers *bool `json:"hostUsers,omitempty"`

	// SchedulingGates is an opaque list of values that if specified will block scheduling the pod.
	// If schedulingGates is not empty, the pod will stay in the SchedulingGated state and the
	// scheduler will not attempt to schedule the pod.
	// +optional
	SchedulingGates []corev1.PodSchedulingGate `json:"schedulingGates,omitempty"`

	// ResourceClaims defines which ResourceClaims must be allocated
	// and reserved before the Pod is allowed to start. The resources
	// will be made available to those containers which consume them
	// by name.
	// +optional
	ResourceClaims []corev1.PodResourceClaim `json:"resourceClaims,omitempty"`

	// Resources is the total amount of CPU and Memory resources required by all
	// containers in the pod. It supports specifying Requests and Limits for
	// "cpu" and "memory" resource names only. ResourceClaims are not supported.
	// +optional
	Resources *DevPodWorkspaceResourceRequirements `json:"resources,omitempty"`
}

type DevPodWorkspacePreset struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DevPodWorkspacePresetSpec   `json:"spec,omitempty"`
	Status DevPodWorkspacePresetStatus `json:"status,omitempty"`
}

type DevPodWorkspacePresetList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DevPodWorkspacePreset `json:"items"`
}

type DevPodWorkspacePresetSource struct {
	// Git stores path to git repo to use as workspace source
	// +optional
	Git string `json:"git,omitempty"`

	// Image stores container image to use as workspace source
	// +optional
	Image string `json:"image,omitempty"`
}

type DevPodWorkspacePresetSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Source stores inline path of project source
	Source *DevPodWorkspacePresetSource `json:"source"`

	// InfrastructureRef stores reference to DevPodWorkspaceTemplate to use
	InfrastructureRef *TemplateRef `json:"infrastructureRef"`

	// EnvironmentRef stores reference to DevPodEnvironmentTemplate
	// +optional
	EnvironmentRef *EnvironmentRef `json:"environmentRef,omitempty"`

	// UseProjectGitCredentials specifies if the project git credentials should be used instead of local ones for this environment
	// +optional
	UseProjectGitCredentials bool `json:"useProjectGitCredentials,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Access to the DevPod machine instance object itself
	// +optional
	Access []Access `json:"access,omitempty"`

	// Versions are different versions of the template that can be referenced as well
	// +optional
	Versions []DevPodWorkspacePresetVersion `json:"versions,omitempty"`
}

type DevPodWorkspacePresetStatus struct {
}

type DevPodWorkspacePresetVersion struct {
	// Version is the version. Needs to be in X.X.X format.
	// +optional
	Version string `json:"version,omitempty"`

	// Source stores inline path of project source
	// +optional
	Source *DevPodWorkspacePresetSource `json:"source,omitempty"`

	// InfrastructureRef stores reference to DevPodWorkspaceTemplate to use
	// +optional
	InfrastructureRef *TemplateRef `json:"infrastructureRef,omitempty"`

	// EnvironmentRef stores reference to DevPodEnvironmentTemplate
	// +optional
	EnvironmentRef *EnvironmentRef `json:"environmentRef,omitempty"`
}

type DevPodWorkspaceProvider struct {
	// Name is the name of the provider. This can also be an url.
	// +optional
	Name string `json:"name,omitempty"`

	// Options are the provider option values
	// +optional
	Options map[string]DevPodProviderOption `json:"options,omitempty"`

	// Env are environment options to set when using the provider.
	// +optional
	Env map[string]DevPodProviderOption `json:"env,omitempty"`
}

type DevPodWorkspaceResourceRequirements struct {
	// Limits describes the maximum amount of compute resources allowed.
	// +optional
	Limits map[corev1.ResourceName]string `json:"limits,omitempty"`

	// Requests describes the minimum amount of compute resources required.
	// +optional
	Requests map[corev1.ResourceName]string `json:"requests,omitempty"`

	// Claims lists the names of resources, defined in spec.resourceClaims,
	// that are used by this container.
	// +optional
	Claims []corev1.ResourceClaim `json:"claims,omitempty"`
}

type DevPodWorkspaceTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DevPodWorkspaceTemplateSpec   `json:"spec,omitempty"`
	Status DevPodWorkspaceTemplateStatus `json:"status,omitempty"`
}

type DevPodWorkspaceTemplateDefinition struct {
	// Kubernetes holds the definition for kubernetes based workspaces
	Kubernetes *DevPodWorkspaceKubernetesSpec `json:"kubernetes,omitempty"`

	// WorkspaceEnv are environment variables that should be available within the created workspace.
	// +optional
	WorkspaceEnv map[string]DevPodProviderOption `json:"workspaceEnv,omitempty"`

	// InstanceTemplate holds the workspace instance template
	// +optional
	InstanceTemplate DevPodWorkspaceInstanceTemplateDefinition `json:"instanceTemplate,omitempty"`

	// CredentialForwarding specifies controls for how workspaces created by this template forward credentials into the workspace
	// +optional
	CredentialForwarding *CredentialForwarding `json:"credentialForwarding,omitempty"`

	// Provider holds the legacy VM provider configuration
	//
	// Deprecated: use fields on template instead
	// +optional
	Provider *DevPodWorkspaceProvider `json:"provider,omitempty"`
}

type DevPodWorkspaceTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DevPodWorkspaceTemplate `json:"items"`
}

type DevPodWorkspaceTemplateSpec struct {
	// DisplayName is the name that is shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes the virtual cluster template
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Parameters define additional app parameters that will set provider values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// Template holds the DevPod workspace template
	Template DevPodWorkspaceTemplateDefinition `json:"template,omitempty"`

	// Versions are different versions of the template that can be referenced as well
	// +optional
	Versions []DevPodWorkspaceTemplateVersion `json:"versions,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`
}

type DevPodWorkspaceTemplateStatus struct {
}

type DevPodWorkspaceTemplateVersion struct {
	// Template holds the DevPod template
	// +optional
	Template DevPodWorkspaceTemplateDefinition `json:"template,omitempty"`

	// Parameters define additional app parameters that will set provider values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// Version is the version. Needs to be in X.X.X format.
	// +optional
	Version string `json:"version,omitempty"`
}

type DevPodWorkspaceVolumeClaimTemplate struct {
	// The pods metadata
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	TemplateMetadata `json:"metadata,omitempty"`

	Spec corev1.PersistentVolumeClaimSpec `json:"spec,omitempty"`
}

type DockerCredentialForwarding struct {
	// Disabled prevents all workspaces created by this template from forwarding credentials into the workspace
	// +optional
	Disabled bool `json:"disabled,omitempty"`
}