v1alpha1

type BFBRegistryConfiguration struct {
	// Disable ensures the BFB Registry is not deployed when set to true.
	// +optional
	Disable *bool `json:"disable,omitempty"`

	// Port is the port on which the BFB Registry will listen
	// +optional
	Port *int `json:"port,omitempty"`
}

type BaseComponentConfig struct {
	// Disable ensures the component is not deployed when set to true.
	// +optional
	Disable *bool `json:"disable,omitempty"`
}

type BaseControllerConfig struct {
	// Replicas is the number of replicas for the controller deployment.
	// Used for High Availability via leader election.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=3
	// +kubebuilder:default=2
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`
}

type CNIInstallerConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Installer contains the configuration for the CNI-Installer component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Installer *DefaultOverridesConfiguration `json:"installer,omitempty"`
}

type ComponentConfigurable interface {
	Name() string
	Disabled() bool
}

type ComponentName string

type ConfigMapKeyRef struct {
	// Name is the name of the ConfigMap.
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name,omitempty"`

	// Key is the key within the ConfigMap data to select.
	// +kubebuilder:validation:MinLength=1
	// +required
	Key string `json:"key,omitempty"`
}

type ContainerName string

type CoreDNSConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Deployment contains the configuration for the CoreDNS deployment.
	// It contains the image for the CoreDNS container and its resource requirements.
	// +optional
	Deployment *CoreDNSDeployment `json:"deployment,omitempty"`

	// UpstreamNameservers is passed to the CoreDNS forward plugin for names outside the cluster domain.
	// It accepts the same space-separated nameserver or resolv.conf path syntax as the CoreDNS chart.
	// +kubebuilder:validation:MinLength=1
	// +optional
	UpstreamNameservers string `json:"upstreamNameservers,omitempty"`
}

type CoreDNSDeployment struct {
	ImageComponentConfig    `json:",inline"`
	ResourceComponentConfig `json:",inline"`
}

type DPFOperatorConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DPFOperatorConfigSpec   `json:"spec,omitempty"`
	Status DPFOperatorConfigStatus `json:"status,omitempty"`
}

type DPFOperatorConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPFOperatorConfig `json:"items"`
}

type DPFOperatorConfigSpec struct {
	// +optional
	Overrides *Overrides `json:"overrides,omitempty"`

	// +kubebuilder:default={controlPlaneMTU: 1500}
	// +optional
	Networking *Networking `json:"networking,omitempty"`
	// Monitoring is the configuration for monitoring resources.
	// +optional
	Monitoring *MonitoringConfiguration `json:"monitoring,omitempty"`

	// Security groups configuration for security-related components managed by the DPF Operator.
	// +optional
	Security *SecurityConfiguration `json:"security,omitempty"`

	// List of secret names which are used to pull images for DPF system components and DPUServices.
	// These secrets must be in the same namespace as the DPF Operator Config and should be created before the config is created.
	// System reconciliation will not proceed until these secrets are available.
	// +optional
	ImagePullSecrets []string `json:"imagePullSecrets,omitempty"`

	// DeploymentMode selects zero-trust vs host-trusted deployment alignment.
	// Required: operators must set this explicitly; provisioning controllers propagate this to DPU.status.deploymentMode.
	// +required
	DeploymentMode DeploymentMode `json:"deploymentMode"`

	// DPUServiceController is the configuration for the DPUServiceController
	// +optional
	DPUServiceController *DPUServiceControllerConfiguration `json:"dpuServiceController,omitempty"`
	// ProvisioningController is the configuration for the ProvisioningController
	ProvisioningController *ProvisioningControllerConfiguration `json:"provisioningController"`
	// ServiceSetController is the configuration for the ServiceSetController
	// +optional
	ServiceSetController *ServiceSetControllerConfiguration `json:"serviceSetController,omitempty"`
	// DPUDetector is the configuration for the DPUDetector.
	// +optional
	DPUDetector *DPUDetectorConfiguration `json:"dpuDetector,omitempty"`
	// Multus is the configuration for Multus
	// +optional
	Multus *MultusConfiguration `json:"multus,omitempty"`
	// SRIOVDevicePlugin is the configuration for the SRIOVDevicePlugin
	// +optional
	SRIOVDevicePlugin *SRIOVDevicePluginConfiguration `json:"sriovDevicePlugin,omitempty"`
	// Flannel is the configuration for Flannel
	// +optional
	Flannel *FlannelConfiguration `json:"flannel,omitempty"`
	// OVSCNI is the configuration for OVSCNI
	//
	// Deprecated: OVS CNI is installed by CNIInstaller. Remove in 27.1.
	// +optional
	OVSCNI *OVSCNIConfiguration `json:"ovsCNI,omitempty"`
	// NVIPAM is the configuration for NVIPAM
	// +optional
	NVIPAM *NVIPAMConfiguration `json:"nvipam,omitempty"`
	// CNIInstaller is the configuration for the cni-installer
	// +optional
	CNIInstaller *CNIInstallerConfiguration `json:"cniInstaller,omitempty"`
	// CoreDNS is the configuration for CoreDNS serving Kamaji DPU clusters with a Keepalived endpoint.
	// +optional
	CoreDNS *CoreDNSConfiguration `json:"coreDNS,omitempty"`
	// SFCController is the configuration for the SFCController
	// +optional
	SFCController *SFCControllerConfiguration `json:"sfcController,omitempty"`
	// KamajiClusterManager is the configuration for the kamaji-cluster-manager
	// +optional
	KamajiClusterManager *KamajiClusterManagerConfiguration `json:"kamajiClusterManager,omitempty"`
	// StaticClusterManager is the configuration for the static-cluster-manager
	// +optional
	StaticClusterManager *StaticClusterManagerConfiguration `json:"staticClusterManager,omitempty"`
	// NodeSRIOVDevicePluginController is the configuration for the NodeSRIOVDevicePlugin controller.
	// This controller manages per-node SRIOV device plugin pods based on DPU configurations.
	// The controller is disabled by default.
	// +optional
	NodeSRIOVDevicePluginController *NodeSRIOVDevicePluginControllerConfiguration `json:"nodeSRIOVDevicePluginController,omitempty"`
}

type DPFOperatorConfigStatus struct {
	// Conditions exposes the current state of the OperatorConfig.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration records the Generation observed on the object the last time it was patched.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Version is the version of the DPF Operator that is currently deployed.
	// +optional
	Version *string `json:"version,omitempty"`

	// TargetVersion is the version of the DPF Operator that is being deployed. It differs from
	// Version while an upgrade is in progress.
	// +optional
	TargetVersion *string `json:"targetVersion,omitempty"`
}

type DPUDetectorConfiguration struct {
	BaseComponentConfig `json:",inline"`

	// Image overrides the container image used by the DPUDetector Container.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `daemon` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// Daemon contains the configuration for the DPU Detector component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Daemon *DefaultOverridesConfiguration `json:"daemon,omitempty"`
}

type DPUServiceControllerConfiguration struct {
	BaseComponentConfig  `json:",inline"`
	BaseControllerConfig `json:",inline"`

	// Image overrides the container image used by the DPUService controller.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `controller` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// Controller contains the configuration for the DPU Service controller component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Controller *DefaultOverridesConfiguration `json:"controller,omitempty"`

	// DisableDPUReadyTaints is a full taint kill-switch for the DPUReady controller.
	// When set to true, no taint managed by this controller (NoSchedule for critical
	// DPUServices, or NoExecute for HostNetworkReady) is added, removed, or otherwise
	// touched on host worker nodes.
	// +optional
	DisableDPUReadyTaints *bool `json:"disableDPUReadyTaints,omitempty"`

	// DisableHostNetworkReadyNoExecuteTaints disables NoExecute taints on host worker nodes
	// based on HostNetworkReady. When unset or true, the feature is disabled (safe default).
	// Set to false to enable NoExecute tainting when HostNetworkReady != True.
	// +optional
	DisableHostNetworkReadyNoExecuteTaints *bool `json:"disableHostNetworkReadyNoExecuteTaints,omitempty"`
}

type DefaultOverridesConfiguration struct {
	ImageComponentConfig    `json:",inline"`
	ResourceComponentConfig `json:",inline"`
}

type DeploymentMode string

type EtcdEncryptionAtRestConfiguration struct {
	// Provider selects the encryption-at-rest provider.
	// +required
	Provider EtcdEncryptionAtRestProvider `json:"provider,omitempty"`

	// StaticKey configures the staticKey provider. It is required when provider is staticKey and
	// must not be set otherwise.
	// +optional
	StaticKey *StaticKeyConfiguration `json:"staticKey,omitempty"`
}

type EtcdEncryptionAtRestProvider string

type FlannelCNI struct {
	ImageComponentConfig `json:",inline"`
}

type FlannelConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// CNI is the configuration for the Flannel CNI component.
	// It contains the image for the CNI init container.
	// Note: The resources for the CNI container are not configurable.
	// +optional
	CNI *FlannelCNI `json:"cni,omitempty"`

	// Daemon is the configuration for the Flannel Daemon component.
	// It contains the image for the Flannel Daemon container and its resource requirements.
	// +optional
	Daemon *FlannelDaemon `json:"daemon,omitempty"`

	// Images overrides the container images used by flannel
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new fields `cni` and `daemon` instead.
	// +optional
	Images *FlannelImages `json:"image,omitempty"`

	// PodCIDR is the pod cidr for flannel.
	// +optional
	PodCIDR *string `json:"podCIDR,omitempty"`
}

type FlannelDaemon struct {
	ImageComponentConfig    `json:",inline"`
	ResourceComponentConfig `json:",inline"`
}

type FlannelImages struct {
	// FlannelCNI must be set if FlannelImages is set.
	// +kubebuilder:validation:MinLength=1
	// +required
	FlannelCNI string `json:"flannelCNI,omitempty"`
	// KubeFlannel must be set if FlannelImages is set.
	// +kubebuilder:validation:MinLength=1
	// +required
	KubeFlannel string `json:"kubeFlannel,omitempty"`
}

type HelmChart *string

type HelmComponentConfig struct {
	// HelmChart overrides the helm chart used by the ServiceSet controller.
	// The URL must begin with either 'oci://' or 'https://', ensuring it points to a valid
	// OCI registry or a web-based repository.
	// +optional
	HelmChart HelmChart `json:"helmChart,omitempty"`
}

type HelmComponentConfigurable interface {
	GetHelmChart() *string
}

type Image *string // Validation is the same as the implementation at https://github.com/containers/image/blob/93fa49b0f1fb78470512e0484012ca7ad3c5c804/docker/reference/regexp.go

type ImageComponentConfig struct {
	// +optional
	Image Image `json:"image,omitempty"`
}

type ImageComponentConfigurable interface {
	// GetImages returns a map of container names to their images.
	GetImages() map[ContainerName]*string
}

type InstallViaGNOI struct{}

type InstallViaHostAgent struct{}

type InstallViaRedfish struct {
	// BFBRegistryAddress is the address of the BFB Registry
	//
	// Deprecated: Use RegistryConfiguration instead.
	// +kubebuilder:validation:MinLength=1
	BFBRegistryAddress string `json:"bfbRegistryAddress,omitempty"`
	// BFBRegistry is the configuration for the BFB Registry
	//
	// Deprecated: Use RegistryConfiguration instead.
	// +optional
	BFBRegistry *BFBRegistryConfiguration `json:"bfbRegistry,omitempty"`
	// SkipDPUNodeDiscovery is a flag to skip the DPU node discovery.
	// +optional
	// +kubebuilder:default=true
	SkipDPUNodeDiscovery *bool `json:"skipDPUNodeDiscovery,omitempty"`
	// DiscoveredDPUDeviceBMCFactoryResetPolicy is the BMC factory reset policy DPUDiscovery
	// sets on the DPUDevices it creates. It is applied at creation time only: changing it
	// does not affect DPUDevices that already exist, and it is not consulted when a
	// DPUDevice is reconciled. When unset, the discovery controller uses OnInitialization.
	// +kubebuilder:validation:Enum=OnInitialization;Never
	// +optional
	DiscoveredDPUDeviceBMCFactoryResetPolicy provisioningv1.BMCFactoryResetPolicy `json:"discoveredDPUDeviceBMCFactoryResetPolicy,omitempty"`
}

type KamajiClusterManagerConfiguration struct {
	BaseComponentConfig  `json:",inline"`
	BaseControllerConfig `json:",inline"`

	// Image overrides the container image used by the Kamaji Cluster Manager.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `controller` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// Controller contains the configuration for the Kamaji Cluster Manager component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Controller *DefaultOverridesConfiguration `json:"controller,omitempty"`

	// EtcdEncryptionAtRest configures encryption at rest for the etcd datastore of
	// Kamaji-managed DPU clusters. The provider selection is applied only when a
	// Kamaji cluster is first created and is not changed for existing clusters.
	// +optional
	EtcdEncryptionAtRest *EtcdEncryptionAtRestConfiguration `json:"etcdEncryptionAtRest,omitempty"`
}

type KataContainersConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Daemon contains the configuration for the kata-deploy component.
	// It contains the image for the kata-deploy container.
	// +optional
	Daemon *ImageComponentConfig `json:"daemon,omitempty"`

	// NodeSelector restricts which nodes kata-deploy runs on.
	// This is passed as the Helm chart's nodeSelector value.
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Shims selects which Kata hypervisor shims to enable.
	// Defaults to ["qemu"] if empty.
	// +optional
	// +kubebuilder:validation:items:Enum=qemu
	Shims []KataShim `json:"shims,omitempty"`

	// ContainerdConfigFileName overrides the containerd config file name
	// on the target nodes. Defaults to "config-mlnx.toml".
	// +optional
	ContainerdConfigFileName string `json:"containerdConfigFileName,omitempty"`
}

type KataShim string

type KubeStateMetricsConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Daemon contains the configuration for the kube-state-metrics component.
	// It contains the image for kube-state-metrics and its resource requirements.
	// +optional
	Daemon *DefaultOverridesConfiguration `json:"daemon,omitempty"`
}

type MonitoringConfiguration struct {
	// Disable controls whether monitoring resources are installed.
	// When enabled (default), the controller:
	// - Creates ServiceMonitors for Kamaji clusters to scrape control-plane metrics.
	// - Deploys kube-state-metrics as a DPUService to expose metrics for custom resources.
	// - Deploys node-problem-detector as a DaemonSet on DPU nodes to detect and report node-level problems.
	// - Deploys opentelemetry-collector as a DaemonSet on DPU nodes to collect and forward logs.
	// +optional
	Disable *bool `json:"disable,omitempty"`

	// KubeStateMetrics is the configuration for kube-state-metrics
	// +optional
	KubeStateMetrics *KubeStateMetricsConfiguration `json:"kubeStateMetrics,omitempty"`

	// NodeProblemDetector is the configuration for node-problem-detector
	// +optional
	NodeProblemDetector *NodeProblemDetectorConfiguration `json:"nodeProblemDetector,omitempty"`

	// OpenTelemetryCollector is the configuration for opentelemetry-collector
	// +optional
	OpenTelemetryCollector *OpenTelemetryCollectorConfiguration `json:"openTelemetryCollector,omitempty"`
}

type MultusConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Image overrides the container image used by the Multus Container.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `cni` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// CNI contains the configuration for the Multus CNI component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	CNI *DefaultOverridesConfiguration `json:"cni,omitempty"`
}

type NVIPAMConfiguration struct {
	BaseComponentConfig  `json:",inline"`
	HelmComponentConfig  `json:",inline"`
	BaseControllerConfig `json:",inline"`

	// Image overrides the container image used by the NVIPAM controller.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `controller` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// Controller contains the configuration for the NVIPAM controller component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Controller *NVIPAMController `json:"controller,omitempty"`

	// Node contains the configuration for the NVIPAM node component.
	// It contains the image for the node and its resource requirements.
	Node *NVIPAMNode `json:"node,omitempty"`
}

type NVIPAMController struct {
	ImageComponentConfig    `json:",inline"`
	ResourceComponentConfig `json:",inline"`
}

type NVIPAMNode struct {
	ImageComponentConfig    `json:",inline"`
	ResourceComponentConfig `json:",inline"`
}

type Networking struct {
	// ControlPlaneMTU is the MTU value to be set on the management network.
	// In zero-trust mode this value is applied to the DPU OOB interface (oob_net0), which does not
	// support jumbo frames; it must not exceed 1500 when deploymentMode is zero-trust.
	// The default is 1500.
	// +kubebuilder:validation:Minimum=1280
	// +kubebuilder:validation:Maximum=9216
	// +kubebuilder:default=1500
	// +optional
	ControlPlaneMTU *int `json:"controlPlaneMTU,omitempty"`

	// HighSpeedMTU is the MTU value to be set on the high-speed interface.
	// The default is 1500.
	// +kubebuilder:validation:Minimum=1280
	// +kubebuilder:validation:Maximum=9216
	// +kubebuilder:default=1500
	// +optional
	HighSpeedMTU *int `json:"highSpeedMTU,omitempty"`

	// DPUNodeOOBBridgeName is the name of the Linux bridge on the host used for
	// out-of-band DPU management traffic. If not specified, defaults to "br-dpu".
	// This setting applies only to host-trusted deployments.
	// +kubebuilder:default="br-dpu"
	// +kubebuilder:validation:Pattern=`^[a-z][a-z0-9-]*$`
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=15
	// +optional
	DPUNodeOOBBridgeName *string `json:"dpuNodeOOBBridgeName,omitempty"`
}

type NodeProblemDetectorConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Daemon contains the configuration for the node-problem-detector component.
	// It contains the image for node-problem-detector and its resource requirements.
	// +optional
	Daemon *DefaultOverridesConfiguration `json:"daemon,omitempty"`
}

type NodeSRIOVDevicePluginControllerConfiguration struct {
	BaseComponentConfig  `json:",inline"`
	BaseControllerConfig `json:",inline"`

	// Controller contains the configuration for the NodeSRIOVDevicePlugin controller component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Controller *DefaultOverridesConfiguration `json:"controller,omitempty"`

	// DevicePlugin contains the configuration for the SRIOV device plugin pods
	// managed by this controller.
	// +optional
	DevicePlugin *NodeSRIOVDevicePluginSettings `json:"devicePlugin,omitempty"`
}

type NodeSRIOVDevicePluginSettings struct {
	// Image overrides the container image for the SRIOV device plugin.
	// +optional
	Image Image `json:"image,omitempty"`

	// InitImage overrides the container image for the init container
	// that generates device plugin configuration.
	// +optional
	InitImage Image `json:"initImage,omitempty"`

	// DefaultResourcePrefix is the default resource prefix for the SRIOV device plugin resources.
	// Defaults to "nvidia.com".
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	// +optional
	DefaultResourcePrefix *string `json:"defaultResourcePrefix,omitempty"`
}

type OVSCNIConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Image overrides the container image used by the OVS CNI.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `cni` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// CNI contains the configuration for the OVS CNI component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	CNI *DefaultOverridesConfiguration `json:"cni,omitempty"`
}

type OpenTelemetryCollectorCASecretReference struct {
	// Name is the name of the Secret holding the CA certificate bundle.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +required
	Name string `json:"name,omitempty"`

	// Namespace is the namespace of the Secret holding the CA certificate bundle.
	// If unset, the DPFOperatorConfig namespace is used.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +optional
	Namespace *string `json:"namespace,omitempty"`

	// Key is the Secret data key that holds the PEM-encoded CA certificate bundle.
	// If unset, "ca.crt" is used, matching the key that cert-manager writes.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +optional
	Key *string `json:"key,omitempty"`
}

type OpenTelemetryCollectorConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Daemon contains the configuration for the opentelemetry-collector component.
	// It contains the image for opentelemetry-collector and its resource requirements.
	// +optional
	Daemon *DefaultOverridesConfiguration `json:"daemon,omitempty"`

	// Logging contains the configuration for the opentelemetry-collector logging component.
	// If not specified, logging will not be streamed.
	// +optional
	Logging *OpenTelemetryCollectorLoggingConfiguration `json:"logging,omitempty"`

	// Metrics contains the configuration for the opentelemetry-collector metrics component.
	// If not specified, metrics will not be streamed from DPU clusters.
	// +optional
	Metrics *OpenTelemetryCollectorMetricsConfiguration `json:"metrics,omitempty"`
}

type OpenTelemetryCollectorLoggingConfiguration struct {
	// Endpoint is the OTLP endpoint where the DPU cluster opentelemetry-collector sends data to.
	// This could be the management cluster's opentelemetry-collector endpoint.
	// If not specified, nothing will be forwarded from DPU clusters.
	// For the http transport the endpoint must include the scheme, e.g. "https://host:4318".
	// For the grpc transport the endpoint is "host:4317", optionally prefixed with a
	// scheme ("https://host:4317") to enforce TLS.
	// +required
	Endpoint string `json:"endpoint,omitempty"`

	// Transport is the OTLP transport used to export data to the endpoint.
	// +kubebuilder:validation:Enum=http;grpc
	// +optional
	Transport *OpenTelemetryCollectorTransport `json:"transport,omitempty"`

	// CASecretRef references a Secret that contains the PEM-encoded CA certificate bundle
	// (under the "ca.crt" key) used to verify the endpoint's TLS certificate. Set it when the
	// endpoint serves a certificate issued by a private CA. The Secret may live in any namespace,
	// for example alongside the endpoint's cert-manager Certificate; if its namespace is empty,
	// the DPFOperatorConfig namespace is used.
	// If not specified, TLS endpoints are verified against the system CA pool.
	// Changes to the Secret content are applied on the next reconciliation of the DPFOperatorConfig.
	// +optional
	CASecretRef *OpenTelemetryCollectorCASecretReference `json:"caSecretRef,omitempty"`
}

type OpenTelemetryCollectorMetricsConfiguration struct {
	// Endpoint is the OTLP endpoint where the DPU cluster opentelemetry-collector sends metrics to.
	// This could be the management cluster's opentelemetry-collector endpoint.
	// If not specified, metrics will not be forwarded from DPU clusters.
	// For the http transport the endpoint must include the scheme, e.g. "https://host:4318".
	// For the grpc transport the endpoint is "host:4317", optionally prefixed with a
	// scheme ("https://host:4317") to enforce TLS.
	// +required
	Endpoint string `json:"endpoint,omitempty"`

	// Transport is the OTLP transport used to export data to the endpoint.
	// +kubebuilder:validation:Enum=http;grpc
	// +optional
	Transport *OpenTelemetryCollectorTransport `json:"transport,omitempty"`

	// CASecretRef references a Secret that contains the PEM-encoded CA certificate bundle
	// (under the "ca.crt" key) used to verify the endpoint's TLS certificate. Set it when the
	// endpoint serves a certificate issued by a private CA. The Secret may live in any namespace,
	// for example alongside the endpoint's cert-manager Certificate; if its namespace is empty,
	// the DPFOperatorConfig namespace is used.
	// If not specified, TLS endpoints are verified against the system CA pool.
	// Changes to the Secret content are applied on the next reconciliation of the DPFOperatorConfig.
	// +optional
	CASecretRef *OpenTelemetryCollectorCASecretReference `json:"caSecretRef,omitempty"`
}

type OpenTelemetryCollectorTransport string

type Overrides struct {
	// Paused disables all reconciliation of the DPFOperatorConfig when set to true.
	// +optional
	Paused *bool `json:"paused,omitempty"`

	// DPUCNIBinPath is the path at which the CNI binaries will be installed to on the DPU.
	// This is /opt/cni/bin by default.
	// This setting does not change where kubelet is configured to use the CNI from.
	// +optional
	DPUCNIBinPath *string `json:"dpuCNIBinPath,omitempty"`

	// DPUCNIConfigPath is the path to which the CNI config files will be installed on the DPU.
	// This is /etc/cni/net.d by default.
	// This setting does not change where kubelet is configured to read the CNI config from.
	// +optional
	DPUCNIConfigPath *string `json:"dpuCNIPath,omitempty"`

	// DPUOpenvSwitchPath is the path at which the openvSwitch run directory can be found on the DPU.
	// This is /var/run/openvswitch by default.
	// This setting does not change where components are installed. Installation location fixed in the BFB.
	// +optional
	DPUOpenvSwitchRunPath *string `json:"dpuOpenvSwitchRunPath,omitempty"`

	// DPUOpenvSwitchBinPath is the path at which the openvSwitch bin directory can be found on the DPU node.
	// This is /usr/bin/ by default.
	// This setting does not change where components are installed. Installation location fixed in the BFB.
	// +optional
	DPUOpenvSwitchBinPath *string `json:"dpuOpenvSwitchBinPath,omitempty"`

	// DPUOpenvSwitchSystemSharedLibPath is the path at which the system lib used by OVS components can be found on the DPU.
	// This is /lib by default.
	// This setting does not change where components are installed. Installation location fixed in the BFB.
	// +optional
	DPUOpenvSwitchSystemSharedLibPath *string `json:"dpuOpenvSwitchSystemSharedPath,omitempty"`

	// FlannelSkipCNIConfigInstallation controls whether Flannel should skip CNI config installation.
	// This is true by default, meaning Flannel does not manage its own CNI configuration.
	// Set to false if you want Flannel to install a CNI configuration.
	// +optional
	FlannelSkipCNIConfigInstallation *bool `json:"flannelSkipCNIConfigInstallation,omitempty"`

	// DPUOpenvSwitchSystemSharedLib64Path is the path at which the system lib64 used by OVS components can be found on the DPU.
	// If this field is not set, no lib64 volume mount will be configured in the SFC Controller component.
	// This setting does not change where components are installed. Installation location fixed in the BFB.
	// +optional
	// +kubebuilder:validation:MinLength=1
	DPUOpenvSwitchSystemSharedLib64Path *string `json:"dpuOpenvSwitchSystemSharedLib64Path,omitempty"`

	// DPULinkerCachePath is the path on the DPU at which the prebuilt dynamic-linker cache
	// file can be found. When set, this file is mounted read-only into the SFC Controller
	// container so that host OVS binaries can resolve shared libraries using the DPU's
	// linker configuration. If not set, no linker cache mount is added.
	// This setting does not change where components are installed. Installation location fixed in the BFB.
	// +optional
	// +kubebuilder:validation:MinLength=1
	DPULinkerCachePath *string `json:"dpuLinkerCachePath,omitempty"`

	// DPUOptLibraryPath is the path on the DPU at which an additional library directory
	// can be found. When set, this directory is mounted read-only into the SFC Controller
	// container. Useful on distributions that install vendor libraries outside the standard
	// paths (e.g. /usr/opt on RHCOS BFB). If not set, no additional library directory is mounted.
	// This setting does not change where components are installed. Installation location fixed in the BFB.
	// +optional
	// +kubebuilder:validation:MinLength=1
	DPUOptLibraryPath *string `json:"dpuOptLibraryPath,omitempty"`

	// KubernetesAPIServerVIP is the VIP the Kubernetes API server is accessible at.
	// This setting enables specific underlying components deployed directly or indirectly by the DPF Operator to reach
	// the Kubernetes API Server when the ClusterIP Kubernetes Service is not functional.
	// If set, it should be set to an IP to ensure that components work even if DNS is not available in the cluster.
	// +optional
	KubernetesAPIServerVIP *string `json:"kubernetesAPIServerVIP,omitempty"`

	// KubernetesAPIServerPort is the port the Kubernetes API server is accessible at.
	// This setting is usually used together with the kubernetesAPIServerVIP setting. It enables specific underlying
	// components deployed directly or indirectly by the DPF Operator to reach the Kubernetes API Server when the
	// ClusterIP Kubernetes Service is not functional.
	// +optional
	KubernetesAPIServerPort *int `json:"kubernetesAPIServerPort,omitempty"`

	// ArgoCDNamespace is the namespace where ArgoCD is deployed.
	// AppProjects and cluster secrets required by DPF will be created in this namespace.
	// Defaults to the namespace of the DPFOperatorConfig.
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	ArgoCDNamespace *string `json:"argoCDNamespace,omitempty"`

	// ProvisioningIssuerCASecretName overrides the CA secret used by the provisioning Issuer during
	// controlled CA rotation workflows. When unset, the default issuer secret is used.
	// +optional
	// +kubebuilder:validation:MinLength=1
	ProvisioningIssuerCASecretName *string `json:"provisioningIssuerCASecretName,omitempty"`
}

type ProvisioningControllerConfiguration struct {
	BaseComponentConfig  `json:",inline"`
	BaseControllerConfig `json:",inline"`

	// Image overrides the container image used by the Provisioning controller.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `controller` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// Controller contains the configuration for the Provisioning controller component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Controller *DefaultOverridesConfiguration `json:"controller,omitempty"`

	// BFCFGTemplateConfigMap is the name of a configMap containing a template for the BF.cfg file used by the DPU controller.
	// By default the provisioning controller use a hardcoded BF.cfg e.g. https://github.com/NVIDIA/doca-platform/blob/release-v24.10/internal/provisioning/controllers/dpu/bfcfg/bf.cfg.template
	// Note: Replacing the bf.cfg is an advanced use case. The default bf.cfg is designed for most use cases.
	//
	// Deprecated: BFCFGTemplateConfigMap is deprecated and will be removed in a future release.
	// Use enableDynamicBFCFGTemplates instead for custom bf.cfg templates.
	// +optional
	BFCFGTemplateConfigMap *string `json:"bfCFGTemplateConfigMap,omitempty"`

	// EnableDynamicBFCFGTemplates enables runtime discovery of bf.cfg templates via ConfigMaps.
	// When enabled, the provisioning controller discovers ConfigMaps by matching labels for BFB
	// name/namespace and DPUCluster name/namespace. Mutually exclusive with bfCFGTemplateConfigMap.
	// +optional
	EnableDynamicBFCFGTemplates bool `json:"enableDynamicBFCFGTemplates,omitempty"`

	// BFBPersistentVolumeClaimName is the name of the PersistentVolumeClaim used by dpf-provisioning-controller
	// If not provided, the controller will use local host storage (hostPath)
	// +optional
	BFBPersistentVolumeClaimName *string `json:"bfbPVCName,omitempty"`

	// DMSTimeout is the max time in seconds within which a DMS API must respond, 0 is unlimited
	// +kubebuilder:validation:Minimum=1
	// +optional
	DMSTimeout *int `json:"dmsTimeout,omitempty"`

	// CustomCASecretName indicates the name of the Kubernetes secret object
	// which containing the custom CA certificate
	// +optional
	CustomCASecretName *string `json:"customCASecretName,omitempty"`

	// InstallInterface is the interface through which the BFB is installed
	// +optional
	InstallInterface *ProvisioningInstallInterface `json:"installInterface,omitempty"`

	// Registry is the configuration for the BFB Registry
	// +optional
	Registry *RegistryConfiguration `json:"registry,omitempty"`

	// MaxDPUParallelInstallations specifies the maximum number of DPUs that can be provisioned concurrently.
	// A DPU is removed from the concurrent provisioning count as soon as it finishes the "OS Installing" phase and
	// enters the "Rebooting" phase of its provisioning lifecycle.
	// +kubebuilder:default=50
	// +kubebuilder:validation:Minimum=1
	// +optional
	MaxDPUParallelInstallations *int32 `json:"maxDPUParallelInstallations,omitempty"`

	// MultiDPUOperationsSyncWaitTime is the wait time between DPUs sync operations on the same node.
	// It would take effect only on DPUNode objects which contain more than one DPU.
	// +kubebuilder:default="30s"
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^([0-9]+(h|m|s|ms|us|µs|ns))+$`
	// +kubebuilder:validation:Format=duration
	// +optional
	MultiDPUOperationsSyncWaitTime *metav1.Duration `json:"multiDPUOperationsSyncWaitTime,omitempty"`

	// MaxUnavailableDPUNodes is the maximum number of DPUNodes that are unavailable during the node effect period.
	// It is also used as the maximum number of unavailable DPUs when controlling DPUSet rolling-update deletion.
	// +kubebuilder:default=50
	// +kubebuilder:validation:Minimum=1
	// +optional
	MaxUnavailableDPUNodes *int32 `json:"maxUnavailableDPUNodes,omitempty"`

	// OSInstallRetries is the maximum number of retryable OS installation attempts in zero-trust mode
	// before the DPU transitions to Error. Attempts are counted in-process and reset on controller restart.
	// When unset, the provisioning controller defaults to 2.
	// +kubebuilder:validation:Minimum=1
	// +optional
	OSInstallRetries int32 `json:"osInstallRetries,omitempty"`

	// OSInstallTimeout is the maximum time allowed for OS installation.
	// If the installation exceeds this timeout, the DPU will transition to an error state.
	// When unset, the provisioning controller defaults to 60m.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^([0-9]+(h|m|s|ms|us|µs|ns))+$`
	// +kubebuilder:validation:Format=duration
	// +optional
	OSInstallTimeout *metav1.Duration `json:"osInstallTimeout,omitempty"`

	// NodeJoinTokenTTL is the lifetime of the kubeadm bootstrap token created for
	// a DPU node to join its DPUCluster. When unset, the provisioning controller
	// defaults to 3h.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^([0-9]+(h|m|s|ms|us|µs|ns))+$`
	// +kubebuilder:validation:Format=duration
	// +kubebuilder:validation:XValidation:rule="self == null || duration(self) > duration('0s')",message="must be greater than zero"
	// +optional
	NodeJoinTokenTTL *metav1.Duration `json:"nodeJoinTokenTTL,omitempty"`

	// FirmwareUpdateTimeout is the maximum time allowed for BF4 firmware update in zero-trust mode.
	// If the update exceeds this timeout, the DPU will transition to an error state.
	// When unset, the provisioning controller defaults to 45m.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^([0-9]+(h|m|s|ms|us|µs|ns))+$`
	// +kubebuilder:validation:Format=duration
	// +optional
	FirmwareUpdateTimeout *metav1.Duration `json:"firmwareUpdateTimeout,omitempty"`

	// PreInstallAgentRegistrationTimeout is how long Initializing waits for the in-band dpu-agent
	// to set preInstall.agentReported on a recreated DPU CR (reprovision). When the timeout elapses,
	// provisioning continues without agent-assisted pre-install for this cycle.
	// +kubebuilder:default="30s"
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^([0-9]+(h|m|s|ms|us|µs|ns))+$`
	// +kubebuilder:validation:Format=duration
	// +optional
	PreInstallAgentRegistrationTimeout *metav1.Duration `json:"preInstallAgentRegistrationTimeout,omitempty"`

	// NodeEffectRemovalTimeout is the maximum time allowed for the Node Effect Removal phase.
	// If the DPUNodeMaintenance CR still has requestors after this timeout, the DPU will transition to an error state.
	// When unset, the provisioning controller defaults to 0s (timeout disabled).
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^([0-9]+(h|m|s|ms|us|µs|ns))+$`
	// +kubebuilder:validation:Format=duration
	// +optional
	NodeEffectRemovalTimeout *metav1.Duration `json:"nodeEffectRemovalTimeout,omitempty"`

	// HostAgentDNSPolicy sets the DNS policy for the hostagent pod.
	// Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'.
	// Defaults to 'ClusterFirstWithHostNet'.
	// +kubebuilder:validation:Enum=ClusterFirstWithHostNet;ClusterFirst;Default;None
	// +optional
	HostAgentDNSPolicy *corev1.DNSPolicy `json:"hostAgentDNSPolicy,omitempty"`

	// BMCServerCertRenewBefore is how long before expiry DPF rotates the DPU BMC mTLS
	// server certificate.
	// When unset, the provisioning controller defaults to 720h (30 days).
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^([0-9]+(h|m|s|ms|us|µs|ns))+$`
	// +kubebuilder:validation:Format=duration
	// +optional
	BMCServerCertRenewBefore *metav1.Duration `json:"bmcServerCertRenewBefore,omitempty"`
}

type ProvisioningInstallInterface struct {
	// InstallViaGNOI is the interface used to install the BFB via GNOI
	//
	// Deprecated: Use InstallViaHostAgent instead.
	// +optional
	InstallViaGNOI *InstallViaGNOI `json:"installViaGNOI,omitempty"`
	// InstallViaHostAgent is the interface used to install the BFB via HostAgent
	// +optional
	InstallViaHostAgent *InstallViaHostAgent `json:"installViaHostAgent,omitempty"`
	// InstallViaRedfish is the interface used to install the BFB via Redfish
	// +optional
	InstallViaRedfish *InstallViaRedfish `json:"installViaRedfish,omitempty"`
}

type RegistryConfiguration struct {
	// Address is the address used to access the BFB Registry. The address must start with "http://" or "https://".
	// By default, the BFB Registry can be accessed via its Service.
	// For non-kubernetes environments, this must be set due to the lack of kubelet on worker nodes.
	// For zero-trust environments, this must be set so that the BFB Registry can be accessed from DPU BMC.
	// +kubebuilder:validation:Pattern="^https?://"
	// +optional
	// Deprecated: Address is deprecated and will be removed in a future release.
	Address *string `json:"address,omitempty"`

	// Port is the port on which the registry instances will listen
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +optional
	// Deprecated: Address is deprecated and will be removed in a future release.
	Port *int `json:"port,omitempty"`

	// LoadBalancerAddress is the address of the load balancer for the BFB Registry which the hostagent/redfish use to fetch the BFB and generated bf.cfg.
	// To enable the load balancer, you need to deploy your own load balancer controller and configure the LoadBalancerAddress field.
	// Then check the bfb-registry nodeport service and make your load balancer controller to distribute the requests to the bfb-registry nodeport.
	// +kubebuilder:validation:Pattern="^https?://"
	// +optional
	LoadBalancerAddress *string `json:"loadBalancerAddress,omitempty"`
}

type ResourceComponentConfig struct {
	// Resources defines the memory and CPU resource requests and limits for the component.
	// This field is optional, and if not set, the component will use the default resource.
	// +optional
	Resources *ResourceRequirements `json:"resources,omitempty"`
}

type ResourceRequirements struct {
	// Requests defines the resource requests for the component.
	Requests *Resources `json:"requests,omitempty"`

	// Limits defines the resource limits for the component.
	Limits *Resources `json:"limits,omitempty"`
}

type Resources struct {
	// CPU is the amount of CPU requested by the component.
	// +optional
	CPU *resource.Quantity `json:"cpu,omitempty"`

	// Memory is the amount of Memory requested by the component.
	// +optional
	Memory *resource.Quantity `json:"memory,omitempty"`
}

type ResourcesComponentConfigurable interface {
	// GetResources returns a map of container names to their resource requirements.
	GetResources() map[ContainerName]*corev1.ResourceRequirements
}

type SFCControllerConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Image overrides the container image used by the SFC controller.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `controller` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// Controller contains the configuration for the SFC controller component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Controller *DefaultOverridesConfiguration `json:"controller,omitempty"`

	// SecureFlowDeletionTimeout controls the timeout for which the API server is unreachable after which all the flows
	// are deleted to prevent unintended packet leaks. It has effect when is greater than zero.
	// Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
	// +optional
	SecureFlowDeletionTimeout *metav1.Duration `json:"secureFlowDeletionTimeout,omitempty"`
}

type SPIFFEConfiguration struct {
	// SPIREServerAddress is the address of the pre-installed SPIRE Server in host:port form
	// (e.g. "spire-server.spire-system.svc:8081").
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=263
	// +required
	SPIREServerAddress string `json:"spireServerAddress,omitempty"`

	// SPIRETrustDomain is the SPIRE-internal trust domain (e.g. "cs.internal") embedded in the
	// DPU Agent SVID URI.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	// +required
	SPIRETrustDomain string `json:"spireTrustDomain,omitempty"`

	// DPUAgentSPIFFEIDTemplate renders the local SPIFFE workload identity registered with SPIRE.
	// It uses Go text/template syntax and receives TrustDomain, normalized SerialNumber, DPUMeta,
	// DPUSpec, DPUDeviceMeta, and DPUDeviceSpec. Metadata labels and annotations can be accessed
	// with the built-in index function.
	// The rendered identity must use SPIRETrustDomain and depend on the DPU serial.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	// +optional
	DPUAgentSPIFFEIDTemplate string `json:"dpuAgentSPIFFEIDTemplate,omitempty"`

	// DPUAgentExchangedSPIFFEIDTemplate renders the post-exchange SPIFFE ID subject. It receives
	// the same Go template data as DPUAgentSPIFFEIDTemplate.
	// The rendered identity may use a different trust domain and must depend on the DPU serial.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	// +optional
	DPUAgentExchangedSPIFFEIDTemplate string `json:"dpuAgentExchangedSPIFFEIDTemplate,omitempty"`

	// DPUServiceSPIFFEIDTemplate renders the identity registered with SPIRE for a DPUService that
	// opts in through its own spec.security.spiffe. It receives TrustDomain, normalized
	// SerialNumber, Namespace and ServiceID, plus DPUMeta, DPUSpec, DPUServiceMeta and
	// DPUServiceSpec.
	// The rendered identity must use SPIRETrustDomain and depend on the namespace, the service ID
	// and the DPU serial, which together identify one DPUService workload. Dropping any of them
	// hands a single SVID to distinct workloads, and nothing detects that later: SPIRE keys
	// entries on the identity, the parent and the selectors, so two DPUServices differing only in
	// namespace produce two entries carrying the same identity. A label cannot stand in for the
	// namespace, since nothing ties one to the other.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	// +optional
	DPUServiceSPIFFEIDTemplate string `json:"dpuServiceSPIFFEIDTemplate,omitempty"`

	// DPUServiceExchangedSPIFFEIDTemplate renders the post-exchange DPUService subject. It
	// receives the same template data as DPUServiceSPIFFEIDTemplate and may use a different trust
	// domain.
	// DPF renders and validates it so the identity layout is declared in one place, but does not
	// consume it: unlike the DPU Agent, a DPUService identity is never presented back to DPF.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	// +optional
	DPUServiceExchangedSPIFFEIDTemplate string `json:"dpuServiceExchangedSPIFFEIDTemplate,omitempty"`

	// KubeAPIAudience is the audience claim the DPU Agent's JWT-SVID must carry; it must match an
	// entry in the kube-apiserver AuthenticationConfiguration.audiences[] (owned out-of-band).
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +required
	KubeAPIAudience string `json:"kubeAPIAudience,omitempty"`

	// tokenExchangeEndpoint exchanges the SPIRE JWT-SVID before the DSX SPIFFE Helper writes it.
	// When omitted, the DSX SPIFFE Helper writes the SPIRE JWT-SVID directly.
	// The returned token's audience must match kubeAPIAudience, or the kube-apiserver rejects the
	// DPU Agent. Only https: the JWT-SVID is sent here as a bearer credential.
	// +kubebuilder:validation:Pattern=`^https://[^[:space:]"\\]+$`
	// +kubebuilder:validation:MaxLength=2048
	// +optional
	TokenExchangeEndpoint *string `json:"tokenExchangeEndpoint,omitempty"`

	// SPIREOIDCURL is the OIDC discovery (issuer) URL of the pre-installed SPIRE Server.
	// The matching kube-apiserver AuthenticationConfiguration.jwt[].issuer value is applied out-of-band.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	// +required
	SPIREOIDCURL string `json:"spireOIDCURL,omitempty"`

	// spireControllerManagerClassName selects the SPIRE controller-manager instance that renders
	// DPF ClusterStaticEntries.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +required
	SPIREControllerManagerClassName string `json:"spireControllerManagerClassName,omitempty"`

	// trustBundle references a ConfigMap holding the initial SPIRE trust bundle.
	// +required
	TrustBundle SPIFFETrustBundleConfigMapReference `json:"trustBundle,omitzero"`
}

type SPIFFETrustBundleConfigMapReference struct {
	// Name is the name of the ConfigMap holding the SPIRE trust bundle.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +required
	Name string `json:"name,omitempty"`

	// Namespace is the namespace of the ConfigMap holding the SPIRE trust bundle.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +required
	Namespace string `json:"namespace,omitempty"`

	// Format selects data["bundle.pem"] or data["bundle.spiffe"] and the matching SPIRE Agent parser.
	// +kubebuilder:validation:Enum=pem;spiffe
	// +kubebuilder:default=pem
	// +optional
	Format SPIFFETrustBundleFormat `json:"format,omitempty"`
}

type SPIFFETrustBundleFormat string

type SRIOVDevicePluginConfiguration struct {
	BaseComponentConfig `json:",inline"`
	HelmComponentConfig `json:",inline"`

	// Image overrides the container image used by the SRIOV Device Plugin container.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `deviceplugin` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// DevicePlugin contains the configuration for the SRIOV Device Plugin component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	DevicePlugin *DefaultOverridesConfiguration `json:"deviceplugin,omitempty"`

	// ConfigInit contains the configuration for the SR-IOV Device Plugin config-init container.
	// It contains the image for the init container and its resource requirements.
	// +optional
	ConfigInit *DefaultOverridesConfiguration `json:"configInit,omitempty"`
}

type SecretKeyRef struct {
	// Name is the name of the Secret.
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name,omitempty"`

	// Key is the key within the Secret data to select.
	// +kubebuilder:validation:MinLength=1
	// +required
	Key string `json:"key,omitempty"`
}

type SecurityConfiguration struct {
	// PrivilegedPodEnforcement controls whether privileged pods are rejected
	// unless explicitly allowed by the workload API. The DPUService controller
	// currently implements this by applying the PrivilegedPodEnforcement
	// ValidatingAdmissionPolicy to DPUService workloads.
	//
	// Setting it to false does not fully opt out of enforcement: the policy and its
	// binding are kept, but the binding is switched from Deny to Audit, so privileged
	// pods are no longer denied and are only recorded in the audit log. The allowlist
	// is kept populated so the audit log only flags pods that would otherwise be
	// denied.
	//
	// The objects are intentionally not deleted to avoid a Kubernetes paramRef
	// informer bug (https://github.com/kubernetes/kubernetes/issues/133827).
	//
	// Defaults to true.
	// +kubebuilder:default=true
	// +optional
	PrivilegedPodEnforcement *bool `json:"privilegedPodEnforcement,omitempty"`

	// Kata is the configuration for Kata Containers.
	// Kata Containers provides VM-based isolation for untrusted workloads on DPU nodes.
	// This component is disabled by default; set disable to false to enable.
	// +optional
	Kata *KataContainersConfiguration `json:"kata,omitempty"`

	// spiffe configures the SPIFFE-based DPU Agent identity flow. Edits are accepted post-bootstrap
	// but do NOT retro-apply to already-provisioned DPUs.
	// +optional
	SPIFFE *SPIFFEConfiguration `json:"spiffe,omitempty"`

	// VaultKMS is the configuration for the standalone Vault/OpenBao KMS plugin component.
	// It is deployed as a DaemonSet on control-plane nodes and is disabled by default.
	// The plugin is used for encryption at rest for DPUClusters.
	// +optional
	VaultKMS *VaultKMSConfiguration `json:"vaultKMS,omitempty"`
}

type ServiceSetControllerConfiguration struct {
	BaseComponentConfig  `json:",inline"`
	BaseControllerConfig `json:",inline"`
	HelmComponentConfig  `json:",inline"`

	// Image overrides the container image used by the ServiceChainSet Controller.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `controller` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// Controller contains the configuration for the ServiceChainSet controller component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Controller *DefaultOverridesConfiguration `json:"controller,omitempty"`
}

type StaticClusterManagerConfiguration struct {
	BaseComponentConfig  `json:",inline"`
	BaseControllerConfig `json:",inline"`

	// Image overrides the container image used by the Static Cluster Manager.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// Use the new field `controller` instead.
	// +optional
	Image Image `json:"image,omitempty"`

	// Controller contains the configuration for the Static Cluster Manager controller component.
	// It contains the image for the controller and its resource requirements.
	// +optional
	Controller *DefaultOverridesConfiguration `json:"controller,omitempty"`
}

type StaticKeyConfiguration struct {
	// KeySecretRef selects the AES-GCM key from a Secret in the DPFOperatorConfig namespace.
	// The referenced Secret value must be base64-encoded AES key text whose decoded length is 16,
	// 24, or 32 bytes. For Kubernetes manifests, use stringData.key with the output of
	// `openssl rand -base64 32`. For External Secrets, configure the external value or template so
	// the resulting Kubernetes Secret data decodes to that base64 text, not to raw key bytes.
	// The referenced key is used as the desired static key source. Changing the referenced
	// Secret value triggers automatic rotation for existing staticKey-encrypted Kamaji clusters.
	// The per-cluster rendered encryption configuration must be backed up together with the
	// cluster etcd backup because Kubernetes encrypted data references encryption config key names.
	// +required
	KeySecretRef SecretKeyRef `json:"keySecretRef,omitzero"`

	// AutomaticRotationDisabled disables automatic staticKey rotation for existing Kamaji clusters.
	// In-flight rotations stop at the next stable checkpoint; encryption at rest remains enabled.
	// +optional
	AutomaticRotationDisabled *bool `json:"automaticRotationDisabled,omitempty"`
}

type VaultKMSAppRoleAuth struct {
	// SecretName is the name of the Secret holding the AppRole role ID and secret ID.
	// +kubebuilder:validation:MinLength=1
	// +required
	SecretName string `json:"secretName,omitempty"`

	// AuthEngineMountPath optionally overrides the Vault auth engine mount path. It is not the transit mount.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +optional
	AuthEngineMountPath *string `json:"authEngineMountPath,omitempty"`

	// RoleIDKey is the Secret data key holding the AppRole role ID.
	// +kubebuilder:validation:MinLength=1
	// +required
	RoleIDKey string `json:"roleIDKey,omitempty"`

	// SecretIDKey is the Secret data key holding the AppRole secret ID.
	// +kubebuilder:validation:MinLength=1
	// +required
	SecretIDKey string `json:"secretIDKey,omitempty"`
}

type VaultKMSAuth struct {
	// Method selects the Vault auth method.
	// +required
	Method VaultKMSAuthMethod `json:"method,omitempty"`

	// Token configures token auth.
	// +optional
	Token *VaultKMSTokenAuth `json:"token,omitempty"`

	// AppRole configures AppRole auth.
	// +optional
	AppRole *VaultKMSAppRoleAuth `json:"appRole,omitempty"`

	// Userpass configures userpass auth.
	// +optional
	Userpass *VaultKMSUserpassAuth `json:"userpass,omitempty"`

	// Kubernetes configures Kubernetes auth.
	// +optional
	Kubernetes *VaultKMSKubernetesAuth `json:"kubernetes,omitempty"`

	// JWT configures JWT auth.
	// +optional
	JWT *VaultKMSJWTAuth `json:"jwt,omitempty"`
}

type VaultKMSAuthMethod string

type VaultKMSConfiguration struct {
	BaseComponentConfig `json:",inline"`

	// Daemon contains the image and resource overrides for the KMS plugin DaemonSet.
	// +optional
	Daemon *DefaultOverridesConfiguration `json:"daemon,omitempty"`

	// TLS configures TLS settings used to connect to Vault/OpenBao.
	// +optional
	TLS *VaultKMSTLS `json:"tls,omitempty"`

	// Auth configures how the plugin authenticates to Vault/OpenBao.
	// +required
	Auth VaultKMSAuth `json:"auth,omitzero"`

	// TokenCheckIntervalSeconds optionally overrides how often the plugin checks and renews the current Vault token, in seconds.
	// This is an advanced setting. The plugin default should work for most environments.
	// Must be at least 5 seconds.
	// +kubebuilder:validation:Minimum=5
	// +optional
	TokenCheckIntervalSeconds *int32 `json:"tokenCheckIntervalSeconds,omitempty"`

	// LoginTimeoutSeconds optionally overrides the maximum time for one Vault token check cycle, including authentication, in seconds.
	// This is an advanced setting. The plugin default should work for most environments.
	// Must be at least 1 second.
	// +kubebuilder:validation:Minimum=1
	// +optional
	LoginTimeoutSeconds *int32 `json:"loginTimeoutSeconds,omitempty"`

	// Address is the Vault/OpenBao server address.
	// WARNING: Changing this field does not automatically rotate the encryption key or
	// re-encrypt existing DPU cluster secrets. Do not change it while active DPU clusters
	// depend on this KMS plugin unless the new endpoint provides access to the key material
	// used by the previous endpoint. Otherwise, those clusters will be unable to decrypt
	// their existing secrets, causing an outage.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	// +kubebuilder:validation:Pattern=`^https://.+$`
	// +required
	Address string `json:"address,omitempty"`

	// Transit configures the Vault Transit secrets engine used for encrypt/decrypt.
	// WARNING: Changing this field does not automatically rotate the encryption key or
	// re-encrypt existing DPU cluster secrets. Do not change it while active DPU clusters
	// depend on this KMS plugin unless the new Transit configuration provides access to all
	// key material used by the previous configuration. Otherwise, those clusters will be
	// unable to decrypt their existing secrets, causing an outage.
	// +required
	Transit VaultKMSTransit `json:"transit,omitzero"`

	// Namespace optionally configures the Vault/OpenBao namespace used for requests.
	// This is a Vault/OpenBao namespace, not a Kubernetes namespace.
	// WARNING: Changing this field does not automatically rotate the encryption key or
	// re-encrypt existing DPU cluster secrets. Do not change it while active DPU clusters
	// depend on this KMS plugin unless the new namespace provides access to the key material
	// used by the previous namespace. Otherwise, those clusters will be unable to decrypt
	// their existing secrets, causing an outage.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +optional
	Namespace *string `json:"namespace,omitempty"`
}

type VaultKMSJWTAuth struct {
	// Role is the Vault JWT auth role name.
	// +kubebuilder:validation:MinLength=1
	// +required
	Role string `json:"role,omitempty"`

	// JWTSecretRef selects the JWT presented to Vault from a Secret in the DPFOperatorConfig namespace.
	// +required
	JWTSecretRef SecretKeyRef `json:"jwtSecretRef,omitzero"`

	// AuthEngineMountPath optionally overrides the Vault auth engine mount path. It is not the transit mount.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +optional
	AuthEngineMountPath *string `json:"authEngineMountPath,omitempty"`
}

type VaultKMSKubernetesAuth struct {
	// Role is the Vault Kubernetes auth role name (not a Kubernetes RBAC role).
	// +kubebuilder:validation:MinLength=1
	// +required
	Role string `json:"role,omitempty"`

	// Audience optionally sets the audience for the projected Kubernetes service account token.
	// Use this when the Vault Kubernetes auth role is configured with bound audiences.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +optional
	Audience *string `json:"audience,omitempty"`

	// AuthEngineMountPath optionally overrides the Vault auth engine mount path. It is not the transit mount.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +optional
	AuthEngineMountPath *string `json:"authEngineMountPath,omitempty"`
}

type VaultKMSTLS struct {
	// CACertConfigMapRef selects a CA bundle key from a ConfigMap used to verify the
	// Vault/OpenBao server certificate. It is mounted as a file.
	// +optional
	CACertConfigMapRef *ConfigMapKeyRef `json:"caConfigMapRef,omitempty"`
}

type VaultKMSTokenAuth struct {
	// TokenSecretRef selects the Vault token from a Secret in the DPFOperatorConfig namespace.
	// +required
	TokenSecretRef SecretKeyRef `json:"tokenSecretRef,omitzero"`
}

type VaultKMSTransit struct {
	// KeyName is the Transit key used for encrypt and decrypt operations.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:Pattern=`^\w(([\w-.]+)?\w)?$`
	// +required
	KeyName string `json:"keyName,omitempty"`

	// Mount is the Transit secrets engine mount path. Defaults to "transit".
	// +kubebuilder:default="transit"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +kubebuilder:validation:Pattern=`^/?[^/\s][^\s]*$`
	// +optional
	Mount *string `json:"mount,omitempty"`
}

type VaultKMSUserpassAuth struct {
	// SecretName is the name of the Secret holding the username and password.
	// +kubebuilder:validation:MinLength=1
	// +required
	SecretName string `json:"secretName,omitempty"`

	// AuthEngineMountPath optionally overrides the Vault auth engine mount path. It is not the transit mount.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	// +optional
	AuthEngineMountPath *string `json:"authEngineMountPath,omitempty"`

	// UsernameKey is the Secret data key holding the username.
	// +kubebuilder:validation:MinLength=1
	// +required
	UsernameKey string `json:"usernameKey,omitempty"`

	// PasswordKey is the Secret data key holding the password.
	// +kubebuilder:validation:MinLength=1
	// +required
	PasswordKey string `json:"passwordKey,omitempty"`
}