v1

type ClusterwideNetworkPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   PolicySpec   `json:"spec,omitempty"`
	Status PolicyStatus `json:"status,omitempty"`
}

type ClusterwideNetworkPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterwideNetworkPolicy `json:"items"`
}

type EgressRule struct {
	// List of destination ports for outgoing traffic.
	// Each item in this list is combined using a logical OR. If this field is
	// empty or missing, this rule matches all ports (traffic not restricted by port).
	// If this field is present and contains at least one item, then this rule allows
	// traffic only if the traffic matches at least one port in the list.
	// +optional
	Ports []networking.NetworkPolicyPort `json:"ports,omitempty"`

	// List of destinations for outgoing traffic of a cluster for this rule.
	// Items in this list are combined using a logical OR operation. If this field is
	// empty or missing, this rule matches all destinations (traffic not restricted by
	// destination). If this field is present and contains at least one item, this rule
	// allows traffic only if the traffic matches at least one item in the to list.
	// To rules can't contain ToFQDNs rules.
	// +optional
	To []networking.IPBlock `json:"to,omitempty"`

	// List of FQDNs (fully qualified domain names) for outgoing traffic of a cluster for this rule.
	// Items in this list are combined using a logical OR operation. This field is used as
	// whitelist for DNS names. If none specified, no rule will be applied.
	// ToFQDNs rules can't contain To rules.
	// +optional
	ToFQDNs []FQDNSelector `json:"toFQDNs,omitempty"`
}

type FQDNSelector struct {
	// MatchName matches FQDN.
	// +kubebuilder:validation:Pattern=`^([-a-zA-Z0-9_]+[.]?)+$`
	MatchName string `json:"matchName,omitempty"`

	// MatchPattern allows using "*" to match DNS names.
	// "*" matches 0 or more valid characters.
	// +kubebuilder:validation:Pattern=`^([-a-zA-Z0-9_*]+[.]?)+$`
	MatchPattern string `json:"matchPattern,omitempty"`
}

type FQDNState map[string][]IPSet

type IPSet struct {
	// FQDN which this IP set is for.
	FQDN string `json:"fqdn,omitempty"`
	//  A hash value merely used for reference.
	SetName string `json:"setName,omitempty"`
	// Deprecated: use `IPExpirationTimes` instead.
	IPs []string `json:"ips,omitempty"`
	// Deprecated: use `IPExpirationTimes` instead.
	ExpirationTime metav1.Time `json:"expirationTime,omitempty"`
	// Maps IP addresses to their expiration times.
	IPExpirationTimes map[string]metav1.Time `json:"ipExpirationTimes,omitempty"`
	// Whether this is a IPv4 or a IPv6 set.
	Version IPVersion `json:"version,omitempty"`
}

type IPVersion string

type IngressRule struct {
	// List of ports which should be made accessible on the cluster for this
	// rule. Each item in this list is combined using a logical OR. If this field is
	// empty or missing, this rule matches all ports (traffic not restricted by port).
	// If this field is present and contains at least one item, then this rule allows
	// traffic only if the traffic matches at least one port in the list.
	// +optional
	Ports []networking.NetworkPolicyPort `json:"ports,omitempty"`

	// List of sources which should be able to access the cluster for this rule.
	// Items in this list are combined using a logical OR operation. If this field is
	// empty or missing, this rule matches all sources (traffic not restricted by
	// source). If this field is present and contains at least one item, this rule
	// allows traffic only if the traffic matches at least one item in the from list.
	// +optional
	From []networking.IPBlock `json:"from,omitempty"`
}

type PolicyDeploymentState string

type PolicySpec struct {
	// Description is a free form string, it can be used by the creator of
	// the rule to store human-readable explanation of the purpose of this
	// rule. Rules cannot be identified by comment.
	//
	// +optional
	Description string `json:"description,omitempty"`

	// List of ingress rules to be applied. Traffic is allowed to
	// a cluster if there is a ClusterwideNetworkPolicy that allows it, OR there is a service
	// exposed with type Loadbalancer. Clusters are isolated by default.
	// +optional
	Ingress []IngressRule `json:"ingress,omitempty"`

	// List of egress rules to be applied. Outgoing traffic is
	// allowed if there is a ClusterwideNetworkPolicy that allows it.
	// Clusters are isolated by default.
	// +optional
	Egress []EgressRule `json:"egress,omitempty"`
}

type PolicyStatus struct {
	// FQDNState stores mapping from FQDN rules to nftables sets used for a firewall rule.
	// Key is either MatchName or MatchPattern
	// +optional
	FQDNState FQDNState `json:"fqdn_state,omitempty"`
	// State of the CWNP, can be either deployed or ignored
	State PolicyDeploymentState `json:"state,omitempty"`
	// Message describes why the state changed
	Message string `json:"message,omitempty"`
}