v1

type Access struct {
	// Name is an optional name that is used for this access rule
	// +optional
	Name string `json:"name,omitempty"`

	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds.
	Verbs []string `json:"verbs"`

	// Subresources defines the sub resources that are allowed by this access rule
	// +optional
	Subresources []string `json:"subresources,omitempty"`

	// Users specifies which users should be able to access this secret with the aforementioned verbs
	// +optional
	Users []string `json:"users,omitempty"`

	// Teams specifies which teams should be able to access this secret with the aforementioned verbs
	// +optional
	Teams []string `json:"teams,omitempty"`
}

type AccessAccessor interface {
	GetAccess() []Access
	SetAccess(access []Access)

	GetOwner() *UserOrTeam
	SetOwner(userOrTeam *UserOrTeam)
}

type AccessKey struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessKeySpec   `json:"spec,omitempty"`
	Status AccessKeyStatus `json:"status,omitempty"`
}

type AccessKeyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessKey `json:"items"`
}

type AccessKeyOIDC struct {
	// The current id token that was created during login
	// +optional
	IDToken []byte `json:"idToken,omitempty"`

	// The current access token that was created during login
	// +optional
	AccessToken []byte `json:"accessToken,omitempty"`

	// The current refresh token that was created during login
	// +optional
	RefreshToken []byte `json:"refreshToken,omitempty"`

	// The last time the id token was refreshed
	// +optional
	LastRefresh *metav1.Time `json:"lastRefresh,omitempty"`
}

type AccessKeyOIDCProvider struct {
	// ClientId the token was generated for
	// +optional
	ClientId string `json:"clientId,omitempty"`

	// Nonce to use
	// +optional
	Nonce string `json:"nonce,omitempty"`

	// RedirectUri to use
	// +optional
	RedirectUri string `json:"redirectUri,omitempty"`

	// Scopes to use
	// +optional
	Scopes string `json:"scopes,omitempty"`
}

type AccessKeyScope struct {
	// Roles is a set of managed permissions to apply to the access key.
	// +optional
	Roles []AccessKeyScopeRole `json:"roles,omitempty"`

	// Projects specifies the projects the access key should have access to.
	// +optional
	Projects []AccessKeyScopeProject `json:"projects,omitempty"`

	// Spaces specifies the spaces the access key is allowed to access.
	// +optional
	Spaces []AccessKeyScopeSpace `json:"spaces,omitempty"`

	// VirtualClusters specifies the virtual clusters the access key is allowed to access.
	// +optional
	VirtualClusters []AccessKeyScopeVirtualCluster `json:"virtualClusters,omitempty"`

	// Clusters specifies the project cluster the access key is allowed to access.
	// +optional
	Clusters []AccessKeyScopeCluster `json:"clusters,omitempty"`

	// DEPRECATED: Use Projects, Spaces and VirtualClusters instead
	// Rules specifies the rules that should apply to the access key.
	// +optional
	Rules []AccessKeyScopeRule `json:"rules,omitempty"`

	// AllowLoftCLI allows certain read-only management requests to
	// make sure loft cli works correctly with this specific access key.
	//
	// Deprecated: Use the `roles` field instead
	//  “`yaml
	//  # Example:
	//  roles:
	//    - role: loftCLI
	//  “`
	// +optional
	AllowLoftCLI bool `json:"allowLoftCli,omitempty"`
}

type AccessKeyScopeCluster struct {
	// Cluster is the name of the cluster to access. You can specify * to select all clusters.
	// +optional
	Cluster string `json:"cluster,omitempty"`
}

type AccessKeyScopeProject struct {
	// Project is the name of the project. You can specify * to select all projects.
	// +optional
	Project string `json:"project,omitempty"`
}

type AccessKeyScopeRole struct {
	// Role is the name of the role to apply to the access key scope.
	// +optional
	Role AccessKeyScopeRoleName `json:"role,omitempty"`

	// Projects specifies the projects the access key should have access to.
	// +optional
	Projects []string `json:"projects,omitempty"`

	// VirtualClusters specifies the virtual clusters the access key is allowed to access.
	// +optional
	VirtualClusters []string `json:"virtualClusters,omitempty"`
}

type AccessKeyScopeRoleName string

type AccessKeyScopeRule struct {
	// The verbs that match this rule.
	// An empty list implies every verb.
	// +optional
	Verbs []string `json:"verbs,omitempty"`

	// Resources that this rule matches. An empty list implies all kinds in all API groups.
	// +optional
	Resources []GroupResources `json:"resources,omitempty"`

	// Namespaces that this rule matches.
	// The empty string "" matches non-namespaced resources.
	// An empty list implies every namespace.
	// +optional
	Namespaces []string `json:"namespaces,omitempty"`

	// NonResourceURLs is a set of URL paths that should be checked.
	// *s are allowed, but only as the full, final step in the path.
	// Examples:
	//  "/metrics" - Log requests for apiserver metrics
	//  "/healthz*" - Log all health checks
	// +optional
	NonResourceURLs []string `json:"nonResourceURLs,omitempty"`

	// RequestTargets is a list of request targets that are allowed.
	// An empty list implies every request.
	// +optional
	RequestTargets []RequestTarget `json:"requestTargets,omitempty"`

	// Cluster that this rule matches. Only applies to cluster requests.
	// If this is set, no requests for non cluster requests are allowed.
	// An empty cluster means no restrictions will apply.
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// VirtualClusters that this rule matches. Only applies to virtual cluster requests.
	// An empty list means no restrictions will apply.
	// +optional
	VirtualClusters []AccessKeyVirtualCluster `json:"virtualClusters,omitempty"`
}

type AccessKeyScopeSpace struct {
	// Project is the name of the project.
	// +optional
	Project string `json:"project,omitempty"`

	// Space is the name of the space. You can specify * to select all spaces.
	// +optional
	Space string `json:"space,omitempty"`
}

type AccessKeyScopeVirtualCluster struct {
	// Project is the name of the project.
	// +optional
	Project string `json:"project,omitempty"`

	// VirtualCluster is the name of the virtual cluster to access. You can specify * to select all virtual clusters.
	// +optional
	VirtualCluster string `json:"virtualCluster,omitempty"`
}

type AccessKeySpec struct {
	// The display name shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// The user this access key refers to
	// +optional
	User string `json:"user,omitempty"`

	// The team this access key refers to
	// +optional
	Team string `json:"team,omitempty"`

	// Subject is a generic subject that can be used
	// instead of user or team
	// +optional
	Subject string `json:"subject,omitempty"`

	// Groups specifies extra groups to apply when using
	// this access key
	// +optional
	Groups []string `json:"groups,omitempty"`

	// The actual access key that will be used as a bearer token
	// +optional
	Key string `json:"key,omitempty"`

	// If this field is true, the access key is still allowed to exist,
	// however will not work to access the api
	// +optional
	Disabled bool `json:"disabled,omitempty"`

	// The time to life for this access key
	// +optional
	TTL int64 `json:"ttl,omitempty"`

	// If this is specified, the time to life for this access key will
	// start after the lastActivity instead of creation timestamp
	// +optional
	TTLAfterLastActivity bool `json:"ttlAfterLastActivity,omitempty"`

	// Scope defines the scope of the access key.
	// +optional
	Scope *AccessKeyScope `json:"scope,omitempty"`

	// The type of an access key, which basically describes if the access
	// key is user managed or managed by loft itself.
	// +optional
	Type AccessKeyType `json:"type,omitempty"`

	// If available, contains information about the sso login data for this
	// access key
	// +optional
	Identity *SSOIdentity `json:"identity,omitempty"`

	// The last time the identity was refreshed
	// +optional
	IdentityRefresh *metav1.Time `json:"identityRefresh,omitempty"`

	// If the token is a refresh token, contains information about it
	// +optional
	OIDCProvider *AccessKeyOIDCProvider `json:"oidcProvider,omitempty"`

	// DEPRECATED: do not use anymore
	// Parent is used to share OIDC and external token information
	// with multiple access keys. Since copying an OIDC refresh token
	// would result in the other access keys becoming invalid after a refresh
	// parent allows access keys to share that information.
	//
	// The use case for this is primarily user generated access keys,
	// which will have the users current access key as parent if it contains
	// an OIDC token.
	// +optional
	Parent string `json:"parent,omitempty"`

	// DEPRECATED: Use identity instead
	// If available, contains information about the oidc login data for this
	// access key
	// +optional
	OIDCLogin *AccessKeyOIDC `json:"oidcLogin,omitempty"`
}

type AccessKeyStatus struct {
	// The last time this access key was used to access the api
	// +optional
	LastActivity *metav1.Time `json:"lastActivity,omitempty"`
}

type AccessKeyType string

type AccessKeyVirtualCluster struct {
	// Name of the virtual cluster. Empty means all virtual clusters.
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace of the virtual cluster. Empty means all namespaces.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type AllowedCluster struct {
	// Name is the name of the cluster that is allowed to create an environment in.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedClusterAccountTemplate struct {
	// Name is the name of a cluster account template
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedRunner struct {
	// Name is the name of the runner that is allowed to create an environment in.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedTemplate struct {
	// Kind of the template that is allowed. Currently only supports DevPodWorkspaceTemplate, VirtualClusterTemplate & SpaceTemplate
	// +optional
	Kind string `json:"kind,omitempty"`

	// Group of the template that is allowed. Currently only supports storage.loft.sh
	// +optional
	Group string `json:"group,omitempty"`

	// Name of the template
	// +optional
	Name string `json:"name,omitempty"`

	// IsDefault specifies if the template should be used as a default
	// +optional
	IsDefault bool `json:"isDefault,omitempty"`
}

type App struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AppSpec   `json:"spec,omitempty"`
	Status AppStatus `json:"status,omitempty"`
}

type AppConfig struct {
	// DefaultNamespace is the default namespace this app should installed
	// in.
	// +optional
	DefaultNamespace string `json:"defaultNamespace,omitempty"`

	// Readme is a longer markdown string that describes the app.
	// +optional
	Readme string `json:"readme,omitempty"`

	// Icon holds an URL to the app icon
	// +optional
	Icon string `json:"icon,omitempty"`

	// Config is the helm config to use to deploy the helm release
	// +optional
	Config clusterv1.HelmReleaseConfig `json:"config,omitempty"`

	// Wait determines if Loft should wait during deploy for the app to become ready
	// +optional
	Wait bool `json:"wait,omitempty"`

	// Timeout is the time to wait for any individual Kubernetes operation (like Jobs for hooks) (default 5m0s)
	// +optional
	Timeout string `json:"timeout,omitempty"`

	// Parameters define additional app parameters that will set helm values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// DEPRECATED: Use config.bash instead
	// StreamContainer can be used to stream a containers logs instead of the helm output.
	// +optional
	// +internal
	StreamContainer *StreamContainer `json:"streamContainer,omitempty"`
}

type AppList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []App `json:"items"`
}

type AppParameter struct {
	// Variable is the path of the variable. Can be foo or foo.bar for nested objects.
	// +optional
	Variable string `json:"variable,omitempty"`

	// Label is the label to show for this parameter
	// +optional
	Label string `json:"label,omitempty"`

	// Description is the description to show for this parameter
	// +optional
	Description string `json:"description,omitempty"`

	// Type of the parameter. Can be one of:
	// string, multiline, boolean, number and password
	// +optional
	Type string `json:"type,omitempty"`

	// Options is a slice of strings, where each string represents a mutually exclusive choice.
	// +optional
	Options []string `json:"options,omitempty"`

	// Min is the minimum number if type is number
	// +optional
	Min *int `json:"min,omitempty"`

	// Max is the maximum number if type is number
	// +optional
	Max *int `json:"max,omitempty"`

	// Required specifies if this parameter is required
	// +optional
	Required bool `json:"required,omitempty"`

	// DefaultValue is the default value if none is specified
	// +optional
	DefaultValue string `json:"defaultValue,omitempty"`

	// Placeholder shown in the UI
	// +optional
	Placeholder string `json:"placeholder,omitempty"`

	// Invalidation regex that if matched will reject the input
	// +optional
	Invalidation string `json:"invalidation,omitempty"`

	// Validation regex that if matched will allow the input
	// +optional
	Validation string `json:"validation,omitempty"`

	// Section where this app should be displayed. Apps with the same section name will be grouped together
	// +optional
	Section string `json:"section,omitempty"`
}

type AppReference struct {
	// Name of the target app
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace specifies in which target namespace the app should
	// get deployed in
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// ReleaseName is the name of the app release
	// +optional
	ReleaseName string `json:"releaseName,omitempty"`

	// Version of the app
	// +optional
	Version string `json:"version,omitempty"`

	// Hash is the hash of the app configuration
	// +optional
	Hash string `json:"hash,omitempty"`

	// Parameters to use for the app
	// +optional
	Parameters string `json:"parameters,omitempty"`
}

type AppSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this app can be installed in.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// RecommendedApp specifies where this app should show up as recommended app
	// +optional
	RecommendedApp []RecommendedApp `json:"recommendedApp,omitempty"`

	// AppConfig is the app configuration
	AppConfig `json:",inline"`

	// Versions are different app versions that can be referenced
	// +optional
	Versions []AppVersion `json:"versions,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// DEPRECATED: Use config instead
	// manifest represents kubernetes resources that will be deployed into the target namespace
	// +optional
	Manifests string `json:"manifests,omitempty"`

	// DEPRECATED: Use config instead
	// helm defines the configuration for a helm deployment
	// +optional
	Helm *HelmConfiguration `json:"helm,omitempty"`
}

type AppStatus struct {
}

type AppTask struct {
	// Type is the task type. Defaults to Upgrade
	// +optional
	Type HelmTaskType `json:"type,omitempty"`

	// RollbackRevision is the revision to rollback to
	// +optional
	RollbackRevision string `json:"rollbackRevision,omitempty"`

	// AppReference is the reference to the app to deploy
	// +optional
	AppReference AppReference `json:"appReference,omitempty"`
}

type AppVersion struct {
	// AppConfig is the app configuration
	AppConfig `json:",inline"`

	// Version is the version. Needs to be in X.X.X format.
	// +optional
	Version string `json:"version,omitempty"`
}

type ArgoIntegrationSpec struct {
	// Enabled indicates if the ArgoCD Integration is enabled for the project -- this knob only
	// enables the syncing of virtualclusters, but does not enable SSO integration or project
	// creation (see subsequent spec sections!).
	// +optional
	Enabled bool `json:"enabled,omitempty"`

	// Cluster defines the name of the cluster that ArgoCD is deployed into -- if not provided this
	// will default to 'loft-cluster'.
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// VirtualClusterInstance defines the name of *virtual cluster* (instance) that ArgoCD is
	// deployed into. If provided, Cluster will be ignored and Loft will assume that ArgoCD is
	// running in the specified virtual cluster.
	// +optional
	VirtualClusterInstance string `json:"virtualClusterInstance,omitempty"`

	// Namespace defines the namespace in which ArgoCD is running in the cluster.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// SSO defines single-sign-on related values for the ArgoCD Integration. Enabling SSO will allow
	// users to authenticate to ArgoCD via Loft.
	// +optional
	SSO *ArgoSSOSpec `json:"sso,omitempty"`

	// Project defines project related values for the ArgoCD Integration. Enabling Project
	// integration will cause Loft to generate and manage an ArgoCD appProject that corresponds to
	// the Loft Project.
	// +optional
	Project *ArgoProjectSpec `json:"project,omitempty"`
}

type ArgoProjectPolicyRule struct {
	// Action is one of "*", "get", "create", "update", "delete", "sync", or "override".
	// +optional
	Action string `json:"action,omitempty"`
	// Application is the ArgoCD project/repository to apply the rule to.
	// +optional
	Application string `json:"application,omitempty"`
	// Allow applies the "allow" permission to the rule, if allow is not set, the permission will
	// always be set to "deny".
	// +optional
	Allow bool `json:"permission,omitempty"`
}

type ArgoProjectRole struct {
	// Name of the ArgoCD role to attach to the project.
	Name string `json:"name,omitempty"`
	// Description to add to the ArgoCD project.
	// +optional
	Description string `json:"description,omitempty"`
	// Rules ist a list of policy rules to attach to the role.
	Rules []ArgoProjectPolicyRule `json:"rules,omitempty"`
	// Groups is a list of OIDC group names to bind to the role.
	Groups []string `json:"groups,omitempty"`
}

type ArgoProjectSpec struct {
	// Enabled indicates if the ArgoCD Project Integration is enabled for this project. Enabling
	// this will cause Loft to create an appProject in ArgoCD that is associated with the Loft
	// Project. When Project integration is enabled Loft will override the default assigned role
	// set in the SSO integration spec.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// Metadata defines additional metadata to attach to the loft created project in ArgoCD.
	// +optional
	Metadata ArgoProjectSpecMetadata `json:"metadata,omitempty"`
	// SourceRepos is a list of source repositories to attach/allow on the project, if not specified
	// will be "*" indicating all source repositories.
	// +optional
	SourceRepos []string `json:"sourceRepos,omitempty"`
	// Roles is a list of roles that should be attached to the ArgoCD project. If roles are provided
	// no loft default roles will be set. If no roles are provided *and* SSO is enabled, loft will
	// configure sane default values.
	// +optional
	Roles []ArgoProjectRole `json:"roles,omitempty"`
}

type ArgoProjectSpecMetadata struct {
	// ExtraAnnotations are optional annotations that can be attached to the project in ArgoCD.
	// +optional
	ExtraAnnotations map[string]string `json:"extraAnnotations,omitempty"`
	// ExtraLabels are optional labels that can be attached to the project in ArgoCD.
	// +optional
	ExtraLabels map[string]string `json:"extraLabels,omitempty"`
	// Description to add to the ArgoCD project.
	// +optional
	Description string `json:"description,omitempty"`
}

type ArgoSSOSpec struct {
	// Enabled indicates if the ArgoCD SSO Integration is enabled for this project. Enabling this
	// will cause Loft to configure SSO authentication via Loft in ArgoCD. If Projects are *not*
	// enabled, all users associated with this Project will be assigned either the 'read-only'
	// (default) role, *or* the roles set under the AssignedRoles field.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// Host defines the ArgoCD host address that will be used for OIDC authentication between loft
	// and ArgoCD. If not specified OIDC integration will be skipped, but vclusters/spaces will
	// still be synced to ArgoCD.
	// +optional
	Host string `json:"host,omitempty"`
	// AssignedRoles is a list of roles to assign for users who authenticate via Loft -- by default
	// this will be the `read-only` role. If any roles are provided this will override the default
	// setting.
	// +optional
	AssignedRoles []string `json:"assignedRoles,omitempty"`
}

type BCMNodeTypeSpec struct {
	NamedNodeTypeSpec `json:",inline"`

	// Nodes specifies nodes.
	Nodes []string `json:"nodes,omitempty"`

	// NodeGroups is the name of the node groups to use for this provider.
	NodeGroups []string `json:"nodeGroups,omitempty"`
}

type Chart struct {
	// Name is the chart name in the repository
	Name string `json:"name,omitempty"`

	// Version is the chart version in the repository
	// +optional
	Version string `json:"version,omitempty"`

	// RepoURL is the repo url where the chart can be found
	// +optional
	RepoURL string `json:"repoURL,omitempty"`

	// The username that is required for this repository
	// +optional
	Username string `json:"username,omitempty"`

	// The password that is required for this repository
	// +optional
	Password string `json:"password,omitempty"`
}

type ChartStatus struct {
	// Name of the chart that was applied
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace of the chart that was applied
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// LastAppliedChartConfigHash is the last applied configuration
	// +optional
	LastAppliedChartConfigHash string `json:"lastAppliedChartConfigHash,omitempty"`
}

type Cluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterSpec   `json:"spec,omitempty"`
	Status ClusterStatus `json:"status,omitempty"`
}

type ClusterAPINodeTypeSpec struct {
	NamedNodeTypeSpec `json:",inline"`
	ClusterAPIObjects `json:",inline"`

	// MergeInfrastructureMachineTemplate will be merged into base InfrastructureMachine template for this NodeProvider.
	// This allows overwriting of specific fields from top level template by individual NodeTypes
	// This is mutually exclusive with InfrastructureMachineTemplate
	MergeInfrastructureMachineTemplate *runtime.RawExtension `json:"mergeInfrastructureMachineTemplate,omitempty"`

	// MergeBootstrapConfigTemplate will be merged into base BootstrapConfig template for this NodeProvider.
	// This allows overwriting of specific fields from top level template by individual NodeTypes
	// This is mutually exclusive with BootstrapConfigTemplate
	MergeBootstrapConfigTemplate *runtime.RawExtension `json:"mergeBootstrapConfigTemplate,omitempty"`

	// MaxCapacity is the maximum number of nodes that can be created for this NodeType.
	MaxCapacity int `json:"maxCapacity,omitempty"`
}

type ClusterAPIObjects struct {
	// InfrastructureMachineTemplate is a template for the infrastructure machine, e.g. AWSMachine
	InfrastructureMachineTemplate *runtime.RawExtension `json:"infrastructureMachineTemplate,omitempty"`

	// BootstrapConfigTemplate is a template for the bootstrap config. Currently only KubeadmConfig is supported.
	BootstrapConfigTemplate *runtime.RawExtension `json:"bootstrapConfigTemplate,omitempty"`
}

type ClusterAccess struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterAccessSpec   `json:"spec,omitempty"`
	Status ClusterAccessStatus `json:"status,omitempty"`
}

type ClusterAccessList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterAccess `json:"items"`
}

type ClusterAccessSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster access object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this template should be applied on.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// LocalClusterAccessTemplate holds the cluster access template
	// +omitempty
	LocalClusterAccessTemplate LocalClusterAccessTemplate `json:"localClusterAccessTemplate,omitempty"`
}

type ClusterAccessStatus struct {
}

type ClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Cluster `json:"items"`
}

type ClusterRef struct {
	// Cluster is the connected cluster the space will be created in
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// Namespace is the namespace inside the connected cluster holding the space
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type ClusterRoleRef struct {
	// Name is the cluster role to assign
	// +optional
	Name string `json:"name,omitempty"`
}

type ClusterRoleTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterRoleTemplateSpec   `json:"spec,omitempty"`
	Status ClusterRoleTemplateStatus `json:"status,omitempty"`
}

type ClusterRoleTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterRoleTemplate `json:"items"`
}

type ClusterRoleTemplateSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster role template object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this template should be applied on.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// Management defines if this cluster role should be created in the management instance.
	// +optional
	Management bool `json:"management,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// ClusterRoleTemplate holds the cluster role template
	// +optional
	ClusterRoleTemplate ClusterRoleTemplateTemplate `json:"clusterRoleTemplate,omitempty"`

	// DEPRECATED: Use ClusterRoleTemplate instead
	// LocalClusterRoleTemplate holds the cluster role template
	// +omitempty
	LocalClusterRoleTemplate *LocalClusterRoleTemplate `json:"localClusterRoleTemplate,omitempty"`
}

type ClusterRoleTemplateStatus struct {
}

type ClusterRoleTemplateTemplate struct {
	// Standard object's metadata.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Rules holds all the PolicyRules for this ClusterRole
	// +optional
	Rules []rbacv1.PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`

	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
	// stomped by the controller.
	// +optional
	AggregationRule *rbacv1.AggregationRule `json:"aggregationRule,omitempty" protobuf:"bytes,3,opt,name=aggregationRule"`
}

type ClusterSpec struct {
	// If specified this name is displayed in the UI instead of the metadata name
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster access object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Holds a reference to a secret that holds the kube config to access this cluster
	// +optional
	Config SecretRef `json:"config,omitempty"`

	// Local specifies if it is the local cluster that should be connected, when this is specified, config is optional
	// +optional
	Local bool `json:"local,omitempty"`

	// NetworkPeer specifies if the cluster is connected via tailscale, when this is specified, config is optional
	// +optional
	NetworkPeer bool `json:"networkPeer,omitempty"`

	// The namespace where the cluster components will be installed in
	// +optional
	ManagementNamespace string `json:"managementNamespace,omitempty"`

	// If unusable is true, no spaces or virtual clusters can be scheduled on this cluster.
	// +optional
	Unusable bool `json:"unusable,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// Metrics holds the cluster's metrics backend configuration
	Metrics *Metrics `json:"metrics,omitempty"`

	// OpenCost holds the cluster's OpenCost backend configuration
	OpenCost *OpenCost `json:"opencost,omitempty"`
}

type ClusterStatus struct {
	// +optional
	Phase ClusterStatusPhase `json:"phase,omitempty"`

	// +optional
	Reason string `json:"reason,omitempty"`

	// +optional
	Message string `json:"message,omitempty"`

	// Conditions holds several conditions the cluster might be in
	// +optional
	Conditions agentstoragev1.Conditions `json:"conditions,omitempty"`
}

type ClusterStatusPhase string

type EntityInfo struct {
	// Name is the kubernetes name of the object
	Name string `json:"name,omitempty"`

	// The display name shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Icon is the icon of the user / team
	// +optional
	Icon string `json:"icon,omitempty"`

	// The username that is used to login
	// +optional
	Username string `json:"username,omitempty"`

	// The users email address
	// +optional
	Email string `json:"email,omitempty"`

	// The user subject
	// +optional
	Subject string `json:"subject,omitempty"`
}

type GroupResources struct {
	// Group is the name of the API group that contains the resources.
	// The empty string represents the core API group.
	// +optional
	Group string `json:"group,omitempty" protobuf:"bytes,1,opt,name=group"`
	// Resources is a list of resources this rule applies to.
	//
	// For example:
	// 'pods' matches pods.
	// 'pods/log' matches the log subresource of pods.
	// '*' matches all resources and their subresources.
	// 'pods/*' matches all subresources of pods.
	// '*/scale' matches all scale subresources.
	//
	// If wildcard is present, the validation rule will ensure resources do not
	// overlap with each other.
	//
	// An empty list implies all resources and subresources in this API groups apply.
	// +optional
	Resources []string `json:"resources,omitempty" protobuf:"bytes,2,rep,name=resources"`
	// ResourceNames is a list of resource instance names that the policy matches.
	// Using this field requires Resources to be specified.
	// An empty list implies that every instance of the resource is matched.
	// +optional
	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,3,rep,name=resourceNames"`
}

type HelmChart struct {
	// Metadata provides information about a chart
	// +optional
	Metadata clusterv1.Metadata `json:"metadata,omitempty"`

	// Versions holds all chart versions
	// +optional
	Versions []string `json:"versions,omitempty"`

	// Repository is the repository name of this chart
	// +optional
	Repository HelmChartRepository `json:"repository,omitempty"`
}

type HelmChartRepository struct {
	// Name is the name of the repository
	// +optional
	Name string `json:"name,omitempty"`

	// URL is the repository url
	// +optional
	URL string `json:"url,omitempty"`

	// Username of the repository
	// +optional
	Username string `json:"username,omitempty"`

	// Password of the repository
	// +optional
	Password string `json:"password,omitempty"`

	// Insecure specifies if the chart should be retrieved without TLS
	// verification
	// +optional
	Insecure bool `json:"insecure,omitempty"`
}

type HelmConfiguration struct {
	// Name of the chart to deploy
	Name string `json:"name"`

	// The additional helm values to use. Expected block string
	// +optional
	Values string `json:"values,omitempty"`

	// Version is the version of the chart to deploy
	// +optional
	Version string `json:"version,omitempty"`

	// The repo url to use
	// +optional
	RepoURL string `json:"repoUrl,omitempty"`

	// The username to use for the selected repository
	// +optional
	Username string `json:"username,omitempty"`

	// The password to use for the selected repository
	// +optional
	Password string `json:"password,omitempty"`

	// Determines if the remote location uses an insecure
	// TLS certificate.
	// +optional
	Insecure bool `json:"insecure,omitempty"`
}

type HelmTask struct {
	// Release holds the release information
	// +optional
	Release HelmTaskRelease `json:"release,omitempty"`

	// Type is the task type. Defaults to Upgrade
	// +optional
	Type HelmTaskType `json:"type,omitempty"`

	// RollbackRevision is the revision to rollback to
	// +optional
	RollbackRevision string `json:"rollbackRevision,omitempty"`
}

type HelmTaskRelease struct {
	// Name is the name of the release
	Name string `json:"name,omitempty"`

	// Namespace of the release, if empty will use the target namespace
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Config is the helm config to use to deploy the release
	// +optional
	Config clusterv1.HelmReleaseConfig `json:"config,omitempty"`

	// Labels are additional labels for the helm release.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`
}

type HelmTaskType string

type ImportVirtualClustersSpec struct {
	// RoleMapping indicates an optional role mapping from a rancher project role to a rancher cluster role. Map to an empty role to exclude users and groups with that role from
	// being synced.
	// +optional
	RoleMapping map[string]string `json:"roleMapping,omitempty"`
}

type InstanceAccess struct {
	// Specifies which cluster role should get applied to users or teams that do not
	// match a rule below.
	// +optional
	DefaultClusterRole string `json:"defaultClusterRole,omitempty"`

	// Rules defines which users and teams should have which access to the virtual
	// cluster. If no rule matches an authenticated incoming user, the user will get cluster admin
	// access.
	// +optional
	Rules []InstanceAccessRule `json:"rules,omitempty"`
}

type InstanceAccessRule struct {
	// Users this rule matches. * means all users.
	// +optional
	Users []string `json:"users,omitempty"`

	// Teams that this rule matches.
	// +optional
	Teams []string `json:"teams,omitempty"`

	// ClusterRole is the cluster role that should be assigned to the
	// +optional
	ClusterRole string `json:"clusterRole,omitempty"`
}

type InstanceDeployedAppPhase string

type InstanceDeployedAppStatus struct {
	// Name of the app that should get deployed
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace specifies in which target namespace the app should
	// get deployed in. Only used for virtual cluster apps.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// ReleaseName of the target app
	// +optional
	ReleaseName string `json:"releaseName,omitempty"`

	// Version of the app that should get deployed
	// +optional
	Version string `json:"version,omitempty"`

	// Phase describes the current phase the app deployment is in
	// +optional
	Phase InstanceDeployedAppPhase `json:"phase,omitempty"`

	// Reason describes the reason in machine-readable form
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message describes the reason in human-readable form
	// +optional
	Message string `json:"message,omitempty"`
}

type InstancePhase string

type KindSecretRef struct {
	// APIGroup is the api group of the secret
	APIGroup string `json:"apiGroup,omitempty"`
	// Kind is the kind of the secret
	Kind string `json:"kind,omitempty"`
	// +optional
	SecretName string `json:"secretName,omitempty"`
	// +optional
	SecretNamespace string `json:"secretNamespace,omitempty"`
	// +optional
	Key string `json:"key,omitempty"`
}

type KubeVirtNodeTypeSpec struct {
	NamedNodeTypeSpec `json:",inline"`

	// VirtualMachineTemplate is a full KubeVirt VirtualMachine template to use for this NodeType.
	// This is mutually exclusive with MergeVirtualMachineTemplate
	VirtualMachineTemplate *runtime.RawExtension `json:"virtualMachineTemplate,omitempty"`

	// MergeVirtualMachineTemplate will be merged into base VirtualMachine template for this NodeProvider.
	// This allows overwriting of specific fields from top level template by individual NodeTypes
	// This is mutually exclusive with VirtualMachineTemplate
	MergeVirtualMachineTemplate *runtime.RawExtension `json:"mergeVirtualMachineTemplate,omitempty"`

	// MaxCapacity is the maximum number of nodes that can be created for this NodeType.
	MaxCapacity int `json:"maxCapacity,omitempty"`
}

type LocalClusterAccessSpec struct {
	// DisplayName is the name that should be shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description is the description of this object in
	// human-readable text.
	// +optional
	Description string `json:"description,omitempty"`

	// Users are the users affected by this cluster access object
	// +optional
	Users []UserOrTeam `json:"users,omitempty"`

	// Teams are the teams affected by this cluster access object
	// +optional
	Teams []string `json:"teams,omitempty"`

	// ClusterRoles define the cluster roles that the users should have assigned in the cluster.
	// +optional
	ClusterRoles []ClusterRoleRef `json:"clusterRoles,omitempty"`

	// Priority is a unique value that specifies the priority of this cluster access
	// for the space constraints and quota. A higher priority means the cluster access object
	// will override the space constraints of lower priority cluster access objects
	// +optional
	Priority int `json:"priority,omitempty"`
}

type LocalClusterAccessTemplate struct {
	// Metadata is the metadata of the cluster access object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Metadata metav1.ObjectMeta `json:"metadata,omitempty"`

	// LocalClusterAccessSpec holds the spec of the cluster access in the cluster
	// +optional
	LocalClusterAccessSpec LocalClusterAccessSpec `json:"spec,omitempty"`
}

type LocalClusterRoleTemplate struct {
	// Metadata is the metadata of the cluster role template object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Metadata metav1.ObjectMeta `json:"metadata,omitempty"`

	// LocalClusterRoleTemplateSpec holds the spec of the cluster role template in the cluster
	// +optional
	LocalClusterRoleTemplateSpec LocalClusterRoleTemplateSpec `json:"spec,omitempty"`
}

type LocalClusterRoleTemplateSpec struct {
	// DisplayName is the name that should be shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description is the description of this object in
	// human-readable text.
	// +optional
	Description string `json:"description,omitempty"`

	// ClusterRoleTemplate holds the cluster role template
	// +optional
	ClusterRoleTemplate ClusterRoleTemplateTemplate `json:"clusterRoleTemplate,omitempty"`
}

type ManagedNodeTypeObjectMeta struct {
	// Labels holds labels to add to this managed NodeType.
	Labels map[string]string `json:"labels,omitempty"`

	// Annotations holds annotations to add to this managed NodeType.
	Annotations map[string]string `json:"annotations,omitempty"`
}

type Member struct {
	// Kind is the kind of the member. Currently either User or Team
	// +optional
	Kind string `json:"kind,omitempty"`

	// Group of the member. Currently only supports storage.loft.sh
	// +optional
	Group string `json:"group,omitempty"`

	// Name of the member
	// +optional
	Name string `json:"name,omitempty"`

	// ClusterRole is the assigned role for the above member
	ClusterRole string `json:"clusterRole"`
}

type Metrics struct {
	// Replicas is the number of desired replicas.
	Replicas *int32 `json:"replicas,omitempty"`

	// Resources are compute resource required by the metrics backend
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

	// Retention is the metrics data retention period. Default is 1y
	Retention string `json:"retention,omitempty"`

	// Storage contains settings related to the metrics backend's persistent volume configuration
	Storage `json:"storage,omitempty"`
}

type NamedNodeTypeSpec struct {
	NodeTypeSpec `json:",inline"`

	// Name is the name of this node type.
	Name string `json:"name"`

	// Metadata holds metadata to add to this managed NodeType.
	Metadata ManagedNodeTypeObjectMeta `json:"metadata,omitempty"`
}

type NamespacePattern struct {
	// Space holds the namespace pattern to use for space instances
	// +optional
	Space string `json:"space,omitempty"`

	// VirtualCluster holds the namespace pattern to use for virtual cluster instances
	// +optional
	VirtualCluster string `json:"virtualCluster,omitempty"`
}

type NamespacedRef struct {
	// Name is the name of this resource
	Name string `json:"name"`
	// Namespace is the namespace of this resource
	Namespace string `json:"namespace"`
}

type NetworkPeer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NetworkPeerSpec   `json:"spec,omitempty"`
	Status NetworkPeerStatus `json:"status,omitempty"`
}

type NetworkPeerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NetworkPeer `json:"items"`
}

type NetworkPeerSpec struct {
	// DiscoKey is a key used for DERP discovery
	DiscoKey string `json:"discoKey,omitempty"`
	// MachineKey is used to identify a network peer
	MachineKey string `json:"machineKey,omitempty"`
	// NodeKey is used to identify a session
	NodeKey string `json:"nodeKey,omitempty"`
	// Addresses is a list of IP addresses of this Node directly.
	Addresses []string `json:"addresses,omitempty"`
	// AllowedIPs is a range of IP addresses to route to this node.
	AllowedIPs []string `json:"allowedIPs,omitempty"`
	// Endpoints is a list of IP+port (public via STUN, and local LANs) where
	// this node can be reached.
	Endpoints []string `json:"endpoints,omitempty"`
}

type NetworkPeerStatus struct {
	// LastSeen is when the network peer was last online. It is not updated when
	// Online is true.
	LastSeen string `json:"lastSeen,omitempty"`
	// HomeDerpRegion is the currently preferred DERP region by the network peer
	HomeDerpRegion int `json:"homeDerpRegion,omitempty"`
	// Online is whether the node is currently connected to the coordination
	// server.
	Online bool `json:"online,omitempty"`
}

type NodeClaim struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NodeClaimSpec   `json:"spec,omitempty"`
	Status NodeClaimStatus `json:"status,omitempty"`
}