v1alpha2

type AgentLogLevel string

type AutoscalingSpec struct {
	// Behavior configures the scaling behavior of the target
	// in both Up and Down directions (scaleUp and scaleDown fields respectively).
	// If not set, the default HPAScalingRules for scale up and scale down are used.
	//
	// +optional
	Behavior *autoscalingv2.HorizontalPodAutoscalerBehavior `json:"behavior,omitempty"`

	// Target cpu utilization percentage of HPA.
	//
	// +optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=100
	TargetCPUUtilizationPercentage *int32 `json:"targetCPUUtilizationPercentage,omitempty"`

	// Target memory utilization percentage of HPA.
	//
	// +optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=100
	TargetMemoryUtilizationPercentage *int32 `json:"targetMemoryUtilizationPercentage,omitempty"`

	// Minimum number of replicas.
	//
	// +optional
	// +kubebuilder:validation:Minimum=1
	MinReplicas *int32 `json:"minReplicas,omitempty"`

	// Metrics configures additional metrics options.
	//
	// +optional
	Metrics []autoscalingv2.MetricSpec `json:"metrics,omitempty"`

	// Maximum number of replicas.
	//
	// +kubebuilder:validation:Minimum=1
	MaxReplicas int32 `json:"maxReplicas"`

	// Enable or disable Horizontal Pod Autoscaler.
	Enable bool `json:"enable"`
}

type ContainerSpec struct {
	// Debug enables debugging for NGINX by using the nginx-debug binary.
	//
	// +optional
	Debug *bool `json:"debug,omitempty"`

	// Image is the NGINX image to use.
	//
	// +optional
	Image *Image `json:"image,omitempty"`

	// Resources describes the compute resource requirements.
	//
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

	// Lifecycle describes actions that the management system should take in response to container lifecycle
	// events. For the PostStart and PreStop lifecycle handlers, management of the container blocks
	// until the action is complete, unless the container process fails, in which case the handler is aborted.
	//
	// +optional
	Lifecycle *corev1.Lifecycle `json:"lifecycle,omitempty"`

	// ReadinessProbe defines the readiness probe for the NGINX container.
	//
	// +optional
	ReadinessProbe *ReadinessProbeSpec `json:"readinessProbe,omitempty"`

	// HostPorts are the list of ports to expose on the host.
	//
	// +optional
	HostPorts []HostPort `json:"hostPorts,omitempty"`

	// VolumeMounts describe the mounting of Volumes within a container.
	//
	// +optional
	VolumeMounts []corev1.VolumeMount `json:"volumeMounts,omitempty"`
}

type DaemonSetSpec struct {
	// Container defines container fields for the NGINX container.
	//
	// +optional
	Container ContainerSpec `json:"container"`

	// Pod defines Pod-specific fields.
	//
	// +optional
	Pod PodSpec `json:"pod"`

	// Patches are custom patches to apply to the NGINX DaemonSet.
	//
	// +optional
	Patches []Patch `json:"patches,omitempty"`
}

type DeploymentSpec struct {
	// Number of desired Pods.
	//
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`

	// Autoscaling defines the configuration for Horizontal Pod Autoscaling.
	//
	// +optional
	Autoscaling *AutoscalingSpec `json:"autoscaling,omitempty"`

	// Pod defines Pod-specific fields.
	//
	// +optional
	Pod PodSpec `json:"pod"`

	// Container defines container fields for the NGINX container.
	//
	// +optional
	Container ContainerSpec `json:"container"`

	// Patches are custom patches to apply to the NGINX Deployment.
	//
	// +optional
	Patches []Patch `json:"patches,omitempty"`
}

type DisableTelemetryFeature string

type ExternalTrafficPolicy corev1.ServiceExternalTrafficPolicy

type HostPort struct {
	// Port to expose on the host.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port int32 `json:"port"`

	// ContainerPort is the port on the nginx container to map to the HostPort.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	ContainerPort int32 `json:"containerPort"`
}

type IPFamilyType string

type Image struct {
	// Repository is the image path.
	// Default is ghcr.io/nginx/nginx-gateway-fabric/nginx.
	//
	// +optional
	Repository *string `json:"repository,omitempty"`
	// Tag is the image tag to use. Default matches the tag of the control plane.
	//
	// +optional
	Tag *string `json:"tag,omitempty"`
	// PullPolicy describes a policy for if/when to pull a container image.
	//
	// +optional
	// +kubebuilder:default:=IfNotPresent
	PullPolicy *PullPolicy `json:"pullPolicy,omitempty"`
}

type KubernetesSpec struct {
	// Deployment is the configuration for the NGINX Deployment.
	// This is the default deployment option.
	//
	// +optional
	Deployment *DeploymentSpec `json:"deployment,omitempty"`

	// DaemonSet is the configuration for the NGINX DaemonSet.
	//
	// +optional
	DaemonSet *DaemonSetSpec `json:"daemonSet,omitempty"`

	// Service is the configuration for the NGINX Service.
	//
	// +optional
	Service *ServiceSpec `json:"service,omitempty"`
}

type Metrics struct {
	// Port where the Prometheus metrics are exposed.
	//
	// +optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port *int32 `json:"port,omitempty"`

	// Disable serving Prometheus metrics on the listen port.
	//
	// +optional
	Disable *bool `json:"disable,omitempty"`
}

type NginxErrorLogLevel string

type NginxLogging struct {
	// ErrorLevel defines the error log level. Possible log levels listed in order of increasing severity are
	// debug, info, notice, warn, error, crit, alert, and emerg. Setting a certain log level will cause all messages
	// of the specified and more severe log levels to be logged. For example, the log level 'error' will cause error,
	// crit, alert, and emerg messages to be logged. https://nginx.org/en/docs/ngx_core_module.html#error_log
	//
	// +optional
	// +kubebuilder:default=info
	ErrorLevel *NginxErrorLogLevel `json:"errorLevel,omitempty"`

	// AgentLevel defines the log level of the NGINX agent process. Changing this value results in a
	// re-roll of the NGINX deployment.
	//
	// +optional
	// +kubebuilder:default=info
	AgentLevel *AgentLogLevel `json:"agentLevel,omitempty"`
}

type NginxPlus struct {
	// AllowedAddresses specifies IPAddresses or CIDR blocks to the allow list for accessing the NGINX Plus API.
	//
	// +optional
	AllowedAddresses []NginxPlusAllowAddress `json:"allowedAddresses,omitempty"`
}

type NginxPlusAllowAddress struct {
	// Type specifies the type of address.
	Type NginxPlusAllowAddressType `json:"type"`

	// Value specifies the address value.
	Value string `json:"value"`
}

type NginxPlusAllowAddressType string

type NginxProxy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec defines the desired state of the NginxProxy.
	Spec NginxProxySpec `json:"spec"`
}

type NginxProxyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NginxProxy `json:"items"`
}

type NginxProxySpec struct {
	// IPFamily specifies the IP family to be used by the NGINX.
	// Default is "dual", meaning the server will use both IPv4 and IPv6.
	//
	// +optional
	// +kubebuilder:default:=dual
	IPFamily *IPFamilyType `json:"ipFamily,omitempty"`
	// Telemetry specifies the OpenTelemetry configuration.
	//
	// +optional
	Telemetry *Telemetry `json:"telemetry,omitempty"`
	// Metrics defines the configuration for Prometheus scraping metrics. Changing this value results in a
	// re-roll of the NGINX deployment.
	//
	// +optional
	Metrics *Metrics `json:"metrics,omitempty"`
	// RewriteClientIP defines configuration for rewriting the client IP to the original client's IP.
	// +kubebuilder:validation:XValidation:message="if mode is set, trustedAddresses is a required field",rule="!(has(self.mode) && (!has(self.trustedAddresses) || size(self.trustedAddresses) == 0))"
	//
	// +optional
	//nolint:lll
	RewriteClientIP *RewriteClientIP `json:"rewriteClientIP,omitempty"`
	// Logging defines logging related settings for NGINX.
	//
	// +optional
	Logging *NginxLogging `json:"logging,omitempty"`
	// NginxPlus specifies NGINX Plus additional settings.
	//
	// +optional
	NginxPlus *NginxPlus `json:"nginxPlus,omitempty"`
	// DisableHTTP2 defines if http2 should be disabled for all servers.
	// If not specified, or set to false, http2 will be enabled for all servers.
	//
	// +optional
	DisableHTTP2 *bool `json:"disableHTTP2,omitempty"`
	// DisableSNIHostValidation disables the validation that ensures the SNI hostname
	// matches the Host header in HTTPS requests. When disabled, HTTPS connections can
	// be reused for requests to different hostnames covered by the same certificate.
	// This resolves HTTP/2 connection coalescing issues with wildcard certificates but
	// introduces security risks as described in Gateway API GEP-3567.
	// If not specified, defaults to false (validation enabled).
	//
	// +optional
	DisableSNIHostValidation *bool `json:"disableSNIHostValidation,omitempty"`
	// Kubernetes contains the configuration for the NGINX Deployment and Service Kubernetes objects.
	//
	// +optional
	Kubernetes *KubernetesSpec `json:"kubernetes,omitempty"`
	// WorkerConnections specifies the maximum number of simultaneous connections that can be opened by a worker process.
	// Default is 1024.
	//
	// +optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	WorkerConnections *int32 `json:"workerConnections,omitempty"`
}

type NodePort struct {
	// Port is the NodePort to expose.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port int32 `json:"port"`

	// ListenerPort is the Gateway listener port that this NodePort maps to.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	ListenerPort int32 `json:"listenerPort"`
}

type ObservabilityPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec defines the desired state of the ObservabilityPolicy.
	Spec ObservabilityPolicySpec `json:"spec"`

	// Status defines the state of the ObservabilityPolicy.
	Status gatewayv1alpha2.PolicyStatus `json:"status,omitempty"`
}

type ObservabilityPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ObservabilityPolicy `json:"items"`
}

type ObservabilityPolicySpec struct {
	// Tracing allows for enabling and configuring tracing.
	//
	// +optional
	Tracing *Tracing `json:"tracing,omitempty"`

	// TargetRefs identifies the API object(s) to apply the policy to.
	// Objects must be in the same namespace as the policy.
	// Support: HTTPRoute, GRPCRoute.
	//
	// TargetRefs must be _distinct_. This means that the multi-part key defined by `kind` and `name` must
	// be unique across all targetRef entries in the ObservabilityPolicy.
	//
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=16
	// +kubebuilder:validation:XValidation:message="TargetRef Kind must be: HTTPRoute or GRPCRoute",rule="(self.exists(t, t.kind=='HTTPRoute') || self.exists(t, t.kind=='GRPCRoute'))"
	// +kubebuilder:validation:XValidation:message="TargetRef Group must be gateway.networking.k8s.io",rule="self.all(t, t.group=='gateway.networking.k8s.io')"
	// +kubebuilder:validation:XValidation:message="TargetRef Kind and Name combination must be unique",rule="self.all(p1, self.exists_one(p2, (p1.name == p2.name) && (p1.kind == p2.kind)))"
	//nolint:lll
	TargetRefs []gatewayv1alpha2.LocalPolicyTargetReference `json:"targetRefs"`
}

type Patch struct {
	// Type is the type of patch. Defaults to StrategicMerge.
	//
	// +optional
	// +kubebuilder:default:=StrategicMerge
	Type *PatchType `json:"type,omitempty"`

	// Value is the patch data as raw JSON.
	// For StrategicMerge and Merge patches, this should be a JSON object.
	// For JSONPatch patches, this should be a JSON array of patch operations.
	//
	// +optional
	// +kubebuilder:validation:XPreserveUnknownFields
	Value *apiextv1.JSON `json:"value,omitempty"`
}

type PatchType string

type PodSpec struct {
	// TerminationGracePeriodSeconds is the optional duration in seconds the pod needs to terminate gracefully.
	// Value must be non-negative integer. The value zero indicates stop immediately via
	// the kill signal (no opportunity to shut down).
	// If this value is nil, the default grace period will be used instead.
	// The grace period is the duration in seconds after the processes running in the pod are sent
	// a termination signal and the time when the processes are forcibly halted with a kill signal.
	// Set this value longer than the expected cleanup time for your process.
	// Defaults to 30 seconds.
	//
	// +optional
	TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty"`

	// Affinity is the pod's scheduling constraints.
	//
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`

	// NodeSelector is a selector which must be true for the pod to fit on a node.
	// Selector which must match a node's labels for the pod to be scheduled on that node.
	//
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Tolerations allow the scheduler to schedule Pods with matching taints.
	//
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// Volumes represents named volumes in a pod that may be accessed by any container in the pod.
	//
	// +optional
	Volumes []corev1.Volume `json:"volumes,omitempty"`

	// TopologySpreadConstraints describes how a group of Pods ought to spread across topology
	// domains. Scheduler will schedule Pods in a way which abides by the constraints.
	// All topologySpreadConstraints are ANDed.
	//
	// +optional
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
}

type PullPolicy corev1.PullPolicy

type ReadinessProbeSpec struct {
	// Port is the port on which the readiness endpoint is exposed.
	// If not specified, the default port is 8081.
	//
	// +optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port *int32 `json:"port,omitempty"`

	// InitialDelaySeconds is the number of seconds after the container has
	// started before the readiness probe is initiated.
	// If not specified, the default is 3 seconds.
	//
	// +optional
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=3600
	InitialDelaySeconds *int32 `json:"initialDelaySeconds,omitempty"`
}

type RewriteClientIP struct {
	// Mode defines how NGINX will rewrite the client's IP address.
	// There are two possible modes:
	// - ProxyProtocol: NGINX will rewrite the client's IP using the PROXY protocol header.
	// - XForwardedFor: NGINX will rewrite the client's IP using the X-Forwarded-For header.
	// Sets NGINX directive real_ip_header: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
	//
	// +optional
	Mode *RewriteClientIPModeType `json:"mode,omitempty"`

	// SetIPRecursively configures whether recursive search is used when selecting the client's address from
	// the X-Forwarded-For header. It is used in conjunction with TrustedAddresses.
	// If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
	// to start of array and select the first untrusted IP.
	// For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
	// and TrustedAddresses is set to 55.55.55.1/32, NGINX will rewrite the client IP to 22.22.22.22.
	// If disabled, NGINX will select the IP at the end of the array.
	// In the previous example, 55.55.55.1 would be selected.
	// Sets NGINX directive real_ip_recursive: https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive
	//
	// +optional
	SetIPRecursively *bool `json:"setIPRecursively,omitempty"`

	// TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
	// If a request comes from a trusted address, NGINX will rewrite the client IP information,
	// and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
	// If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
	// To trust all addresses (not recommended for production), set to 0.0.0.0/0.
	// If no addresses are provided, NGINX will not rewrite the client IP information.
	// Sets NGINX directive set_real_ip_from: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
	// This field is required if mode is set.
	//
	// +optional
	// +kubebuilder:validation:MaxItems=16
	TrustedAddresses []RewriteClientIPAddress `json:"trustedAddresses,omitempty"`
}

type RewriteClientIPAddress struct {
	// Type specifies the type of address.
	Type RewriteClientIPAddressType `json:"type"`

	// Value specifies the address value.
	Value string `json:"value"`
}

type RewriteClientIPAddressType string

type RewriteClientIPModeType string

type ServiceSpec struct {
	// ServiceType describes ingress method for the Service.
	//
	// +optional
	// +kubebuilder:default:=LoadBalancer
	ServiceType *ServiceType `json:"type,omitempty"`

	// ExternalTrafficPolicy describes how nodes distribute service traffic they
	// receive on one of the Service's "externally-facing" addresses (NodePorts, ExternalIPs,
	// and LoadBalancer IPs.
	//
	// +optional
	// +kubebuilder:default:=Local
	ExternalTrafficPolicy *ExternalTrafficPolicy `json:"externalTrafficPolicy,omitempty"`

	// LoadBalancerIP is a static IP address for the load balancer. Requires service type to be LoadBalancer.
	//
	// +optional
	LoadBalancerIP *string `json:"loadBalancerIP,omitempty"`

	// LoadBalancerClass is the class of the load balancer implementation this Service belongs to.
	// Requires service type to be LoadBalancer.
	//
	// +optional
	LoadBalancerClass *string `json:"loadBalancerClass,omitempty"`

	// LoadBalancerSourceRanges are the IP ranges (CIDR) that are allowed to access the load balancer.
	// Requires service type to be LoadBalancer.
	//
	// +optional
	LoadBalancerSourceRanges []string `json:"loadBalancerSourceRanges,omitempty"`

	// NodePorts are the list of NodePorts to expose on the NGINX data plane service.
	// Each NodePort MUST map to a Gateway listener port, otherwise it will be ignored.
	// The default NodePort range enforced by Kubernetes is 30000-32767.
	//
	// +optional
	NodePorts []NodePort `json:"nodePorts,omitempty"`

	// Patches are custom patches to apply to the NGINX Service.
	//
	// +optional
	Patches []Patch `json:"patches,omitempty"`
}

type ServiceType corev1.ServiceType

type Telemetry struct {
	// DisabledFeatures specifies OpenTelemetry features to be disabled.
	//
	// +optional
	DisabledFeatures []DisableTelemetryFeature `json:"disabledFeatures,omitempty"`

	// Exporter specifies OpenTelemetry export parameters.
	//
	// +optional
	Exporter *TelemetryExporter `json:"exporter,omitempty"`

	// ServiceName is the "service.name" attribute of the OpenTelemetry resource.
	// Default is 'ngf:<gateway-namespace>:<gateway-name>'. If a value is provided by the user,
	// then the default becomes a prefix to that value.
	//
	// +optional
	// +kubebuilder:validation:MaxLength=127
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9_-]+$`
	ServiceName *string `json:"serviceName,omitempty"`

	// SpanAttributes are custom key/value attributes that are added to each span.
	//
	// +optional
	// +listType=map
	// +listMapKey=key
	// +kubebuilder:validation:MaxItems=64
	SpanAttributes []v1alpha1.SpanAttribute `json:"spanAttributes,omitempty"`
}

type TelemetryExporter struct {
	// Interval is the maximum interval between two exports.
	// Default: https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter
	//
	// +optional
	Interval *v1alpha1.Duration `json:"interval,omitempty"`

	// BatchSize is the maximum number of spans to be sent in one batch per worker.
	// Default: https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter
	//
	// +optional
	// +kubebuilder:validation:Minimum=0
	BatchSize *int32 `json:"batchSize,omitempty"`

	// BatchCount is the number of pending batches per worker, spans exceeding the limit are dropped.
	// Default: https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter
	//
	// +optional
	// +kubebuilder:validation:Minimum=0
	BatchCount *int32 `json:"batchCount,omitempty"`

	// Endpoint is the address of OTLP/gRPC endpoint that will accept telemetry data.
	// Format: alphanumeric hostname with optional http scheme and optional port.
	//
	//nolint:lll
	// +optional
	// +kubebuilder:validation:Pattern=`^(?:http?:\/\/)?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*(?::\d{1,5})?$`
	Endpoint *string `json:"endpoint,omitempty"`
}

type TraceContext string

type TraceStrategy string

type Tracing struct {
	// Strategy defines if tracing is ratio-based or parent-based.
	Strategy TraceStrategy `json:"strategy"`

	// Ratio is the percentage of traffic that should be sampled. Integer from 0 to 100.
	// By default, 100% of http requests are traced. Not applicable for parent-based tracing.
	// If ratio is set to 0, tracing is disabled.
	//
	// +optional
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=100
	Ratio *int32 `json:"ratio,omitempty"`

	// Context specifies how to propagate traceparent/tracestate headers.
	// Default: https://nginx.org/en/docs/ngx_otel_module.html#otel_trace_context
	//
	// +optional
	Context *TraceContext `json:"context,omitempty"`

	// SpanName defines the name of the Otel span. By default is the name of the location for a request.
	// If specified, applies to all locations that are created for a route.
	// Format: must have all '"' escaped and must not contain any '$' or end with an unescaped '\'
	// Examples of invalid names: some-$value, quoted-"value"-name, unescaped\
	//
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=255
	// +kubebuilder:validation:Pattern=`^([^"$\\]|\\[^$])*$`
	SpanName *string `json:"spanName,omitempty"`

	// SpanAttributes are custom key/value attributes that are added to each span.
	//
	// +optional
	// +listType=map
	// +listMapKey=key
	// +kubebuilder:validation:MaxItems=64
	SpanAttributes []ngfAPIv1alpha1.SpanAttribute `json:"spanAttributes,omitempty"`
}