v1alpha1

type Action struct {
	// Add specify taint on the DPU node
	// +optional
	Taint *corev1.Taint `json:"taint,omitempty"`

	// Do not do any action on the DPU node
	// +optional
	NoEffect *bool `json:"noEffect,omitempty"`

	// Add specify labels on the DPU node
	// +optional
	CustomLabel map[string]string `json:"customLabel,omitempty"`

	// Drain the K8s host node by NodeMaintenance operator
	// +optional
	Drain *bool `json:"drain,omitempty"`

	// Name of a config map which contains a pod yaml definition to run which will apply the nodeEffect.
	// The pod is expected to exit when node effect is done, if pod terminates with error then DPU would move to an error phase.
	// The DPUNode's name will be exported as an environment variable, named as DPUNODE_NAME, to each container and init container in the pod.
	// The labels and annotations of DPUNode will be exported in `/etc/dpu/dpf-pod-info/labels` and `/etc/dpu/dpf-pod-info/annotations` accordingly; the volume name `dpf-pod-info` is used to mount the labels and annotations.
	// If any name confliction for env or volume, the controller will not export the name or labels/annotations of DPUNode accordingly.
	// +optional
	CustomAction *string `json:"customAction,omitempty"`

	// Places annotation `wait-for-external-nodeeffect` and waits for it to be removed
	// this is the default behavior in a non K8S environment
	// +optional
	Hold *bool `json:"hold,omitempty"`

	// Force is the flag to indicate if the node effect should be applied immediately.
	// If true, dpfOperatorConfig.multiDPUOperationsSyncWaitTime and dpfOperatorConfig.maxUnavailableDPUNodes will be ignored when applying node effect for DPUNodeMaintenance CR
	// +kubebuilder:default=false
	// +optional
	Force *bool `json:"force,omitempty"`
}

type AgentPreInstallStatus struct {
	// AgentReported is set with a timestamp when dpu-agent detects a new DPU CR is created for reprovisioning.
	// +optional
	AgentReported *metav1.Time `json:"agentReported,omitempty"`

	// Conditions contains pre-install conditions (e.g. NVConfigApplied for reprovisioning).
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type AgentStatus struct {
	// LastStartupTime is the time when the DPU was last started
	// +optional
	LastStartupTime *metav1.Time `json:"lastStartupTime,omitempty"`

	// InitialBootID is the boot ID of the DPU OS during the first boot
	InitialBootID *string `json:"initialBootID,omitempty"`

	// RebootMethod is the type of reset/reboot set by the DPU agent
	// See enum values in RebootMethodType.
	// No default is set intentionally: nil means "check not run or not applicable"
	// (e.g. legacy flow, or agent has not run the check yet);
	// a non-nil value means the check ran and this is the result.
	// +optional
	RebootMethod *RebootMethodType `json:"rebootMethod,omitempty"`

	// LastObservedPendingNVConfig stores the last pending NVConfig parameters seen
	// during reboot-method discovery on this boot. It is used on the next boot to
	// ignore repeated parameters that remained unchanged across boots.
	// +optional
	LastObservedPendingNVConfig *PendingNVConfigState `json:"lastObservedPendingNvconfig,omitempty"`

	// RebootSequenceCount is the length of the current non-NoAction RebootMethod sequence:
	// it increments on each agent run that reports a RebootMethod other than NoAction and
	// resets to 0 when the agent reports NoAction. Used with RebootMethod to bound host reboot loops.
	// +optional
	// +kubebuilder:validation:Minimum=0
	RebootSequenceCount *int32 `json:"rebootSequenceCount,omitempty"`

	// KubeletVersion represents the kubelet version running on the DPU.
	KubeletVersion *string `json:"kubeletVersion,omitempty"`

	// Version is set by an agent that can GET the live DPUFlavor and start a second Run().
	// Empty means an old agent; do not start in-place reconfig for this DPU.
	// +optional
	// +kubebuilder:validation:MinLength=1
	Version string `json:"version,omitempty"`

	// AppliedFlavorResourceVersion is the resourceVersion of the DPUFlavor this Run() GETed.
	// Debug only. It is not used to decide whether to start in-place reconfig.
	// +optional
	// +kubebuilder:validation:MinLength=1
	AppliedFlavorResourceVersion string `json:"appliedFlavorResourceVersion,omitempty"`

	// PreInstall holds agent-reported status for work done before OS install in the reprovisioning process.
	// +optional
	PreInstall *AgentPreInstallStatus `json:"preInstall,omitempty"`
	// TrustBundleHash is the bundle-hash value last applied by the DPU agent.
	// +optional
	TrustBundleHash *string `json:"trustBundleHash,omitempty"`

	// TrustBundleLastUpdateTime is when the trust bundle was last updated by the DPU agent.
	// +optional
	TrustBundleLastUpdateTime *metav1.Time `json:"trustBundleLastUpdateTime,omitempty"`

	// Clock is the DPU clock compared against the host clock, recorded while the DPU agent was
	// acquiring its identity. A DPU whose clock is skewed cannot verify the API server certificate,
	// so it never obtains the identity it would need to report this itself. Set by the host agent,
	// in trusted-host mode only.
	// +optional
	Clock *ClockStatus `json:"clock,omitempty"`

	// Conditions contains the conditions reported from inside the DPU
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Spiffe contains the SPIFFE heartbeat status reported by the DPU Agent when running in
	// SPIFFE identity mode.
	// +optional
	Spiffe *SpiffeStatus `json:"spiffe,omitempty"`

	// hostOSInit reports terminal host OS init release status from the DPU agent.
	// Unset while the agent is polling or has not reached ReleaseHostOSInit.
	// +optional
	HostOSInit *HostOSInitStatus `json:"hostOSInit,omitempty"`
}

type BFB struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec BFBSpec `json:"spec,omitempty"`

	// +kubebuilder:default={phase: Initializing}
	// +optional
	Status BFBStatus `json:"status,omitzero"`
}

type BFBList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []BFB `json:"items"`
}

type BFBPhase string

type BFBReference struct {
	// Specifies name of the bfb CR to use for this DPU
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name,omitempty"`
}

type BFBSpec struct {
	// Specifies the file name where the BFB is downloaded on the volume.
	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9\_\-\.]+\.bfb$`
	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="Value is immutable"
	// +optional
	FileName *string `json:"fileName,omitempty"`

	// The url of the bfb image to download.
	// +kubebuilder:validation:Pattern=`^(http|https)://.+$`
	// +required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="Value is immutable"
	URL string `json:"url"`

	// Optionally specify BFB component versions. When set, these versions are
	// used directly in status instead of being extracted from the BFB file.
	// If set, all four fields (BSP, DOCA, UEFI, ATF) must be provided.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self.bsp != ” && self.doca != ” && self.uefi != ” && self.atf != ”",message="all four version fields (bsp, doca, uefi, atf) must be provided when versions is set"
	Versions *BFBVersions `json:"versions,omitempty"`
}

type BFBStatus struct {
	// Filename is the name of the file where the BFB can be accessed on its volume.
	// This is the same as `.spec.Filename` if set.
	// +optional
	FileName string `json:"fileName,omitempty"`
	// The current state of BFB.
	// +kubebuilder:default=Initializing
	// +optional
	Phase BFBPhase `json:"phase,omitempty"`
	// BFB versions - BSP, DOCA, UEFI and ATF
	// Holds detailed version information for each component within the BFB
	// +optional
	Versions BFBVersions `json:"versions,omitempty"`
	// ObservedGeneration records the Generation observed on the object the last time it was patched.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Conditions represent the latest available observations of BFB state
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type BFBVersions struct {
	// BSP (Board Support Package) version.
	// This field stores the version of the BSP, which provides essential
	// support and drivers for the hardware platform.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="BSP version is immutable"
	BSP string `json:"bsp,omitempty"`

	// DOCA version
	// Specifies the version of NVIDIA's Data Center-on-a-Chip Architecture (DOCA),
	// a platform for developing applications on DPUs
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="DOCA version is immutable"
	DOCA string `json:"doca,omitempty"`

	// UEFI (Unified Extensible Firmware Interface) version.
	// Indicates the UEFI firmware version, which is responsible for booting
	// the operating system and initializing hardware components
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="UEFI version is immutable"
	UEFI string `json:"uefi,omitempty"`

	// ATF (Arm Trusted Firmware) version.
	// Contains the version of ATF, which provides a secure runtime environment
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ATF version is immutable"
	ATF string `json:"atf,omitempty"`
}

type BMCFactoryResetPolicy string

type BlueFieldSoftware struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec BlueFieldSpec `json:"spec,omitempty"`

	// +kubebuilder:default={phase: Initializing}
	// +optional
	Status BlueFieldSoftwareStatus `json:"status,omitzero"`
}

type BlueFieldSoftwareList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []BlueFieldSoftware `json:"items"`
}

type BlueFieldSoftwarePhase string

type BlueFieldSoftwareReference struct {
	// Specifies name of the BlueFieldSoftware CR to use for this DPU
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name,omitempty"`
}

type BlueFieldSoftwareStatus struct {
	// The current state of BlueFieldSoftware.
	// +kubebuilder:default=Initializing
	// +optional
	Phase BlueFieldSoftwarePhase `json:"phase,omitempty"`
	// Versions tracks the versions of the components
	// +optional
	Versions *BluefieldSoftwareVersions `json:"versions,omitempty"`
	// DownloadedComponents tracks which components have been successfully downloaded
	// +optional
	DownloadedComponents DownloadedComponents `json:"downloadedComponents,omitempty"`
	// ObservedGeneration records the Generation observed on the object the last time it was patched.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Conditions represent the latest available observations of BlueFieldSoftware state
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type BlueFieldSpec struct {
	// OS ISO points to the OS ISO used by DPU OS installation flow.
	// +required
	// +kubebuilder:validation:MinLength=1
	OsIso string `json:"osIso"`

	// PldmFwBundle maps each PSID to the PLDM firmware bundle URL used for that DPU model's
	// baseline firmware updates. Each PSID's bundle is a complete PLDM package for that device.
	// Keys are matched case-insensitively against the BMC-reported DPUDevice status PSID.
	// +optional
	// +kubebuilder:validation:MinProperties=1
	// +kubebuilder:validation:XValidation:rule="self.all(k, size(k) > 0 && size(self[k]) > 0)",message="pldmFwBundle entries must have non-empty PSID keys and non-empty bundle URLs"
	PldmFwBundle map[string]string `json:"pldmFwBundle,omitempty"`

	// PlatformPldmFwBundle points to the platform PLDM firmware bundle used for E/W NIC
	// firmware updates.
	// +optional
	// +kubebuilder:validation:MinLength=1
	PlatformPldmFwBundle *string `json:"platformPldmFwBundle,omitempty"`

	// NicFw points to the NIC firmware binary used for E/W NIC firmware updates.
	// Use this when a specific NIC firmware binary is required and is not included in the
	// platform PLDM firmware bundle.
	// In production, prefer using PlatformPldmFwBundle.
	// +optional
	// +kubebuilder:validation:MinLength=1
	NicFw *string `json:"nicFw,omitempty"`
}

type BluefieldDeviceVersions struct {
	// BMCVersion is the DPU BMC firmware version shipped in the bundle.
	// +optional
	// +kubebuilder:validation:MinLength=1
	BMCVersion string `json:"bmcVersion,omitempty"`

	// BMCErotVersion is the BMC ERoT (External Root of Trust) firmware version shipped in the bundle.
	// +optional
	// +kubebuilder:validation:MinLength=1
	BMCErotVersion string `json:"bmcErotVersion,omitempty"`

	// SBIOSVersion is the DPU SBIOS firmware version shipped in the bundle.
	// +optional
	// +kubebuilder:validation:MinLength=1
	SBIOSVersion string `json:"sbiosVersion,omitempty"`

	// BFNicFwVersion is the BlueField NIC firmware version shipped in the bundle.
	// +optional
	// +kubebuilder:validation:MinLength=1
	BFNicFwVersion string `json:"bfNicFwVersion,omitempty"`
}

type BluefieldSoftwareVersions struct {
	// DOCA is the formatted, user-facing DOCA version derived from the OS ISO.
	// +optional
	DOCA string `json:"doca,omitempty"`

	// OSISOVersion is the raw DOCA version for the OS ISO, taken from the ISO filename
	// +optional
	OSISOVersion string `json:"osISOVersion,omitempty"`

	// EWNicFwVersion is the E/W NIC firmware version taken from the platform PLDM bundle.
	// It is not keyed by PSID because a BlueFieldSoftware carries a single platform bundle.
	EWNicFwVersion string `json:"ewNicFwVersion,omitempty"`

	// BluefieldSoftwareVersions maps each PSID to the firmware versions from that device's
	// PLDM bundle. Keys are matched case-insensitively against the BMC-reported DPUDevice PSID.
	// +optional
	BluefieldSoftwareVersions map[string]BluefieldDeviceVersions `json:"bluefieldSoftwareVersions,omitempty"`
}

type CertificateStatus struct {
	// NotAfter is the expiry time of the certificate currently installed. It is taken
	// from the issued certificate at rotation time.
	// +optional
	NotAfter *metav1.Time `json:"notAfter,omitempty"`

	// IssuedForBMCIP is the BMC address the installed certificate was issued for. When it differs
	// from status.bmcIp, the identity bound into the certificate no longer matches the address the
	// controller talks to and the certificate must be re-established. It is empty on devices
	// provisioned before this field existed; the controller records it on the next successful
	// rotation or expiry backfill.
	// +optional
	IssuedForBMCIP *string `json:"issuedForBMCIP,omitempty"`

	// LastRotationTime is the time DPF last successfully rotated the certificate.
	// +optional
	LastRotationTime *metav1.Time `json:"lastRotationTime,omitempty"`

	// ObservedManualTrigger records the value of the manual rotation annotation that
	// was last honored, so the same trigger is not processed twice.
	// +optional
	ObservedManualTrigger *string `json:"observedManualTrigger,omitempty"`
}

type ClockStatus struct {
	// dpuTime is the DPU clock as reported by the DPU agent.
	DPUTime metav1.Time `json:"dpuTime"`

	// hostTime is the host clock when that report arrived. The host is the trusted side of the
	// comparison, so a difference is attributed to the DPU.
	HostTime metav1.Time `json:"hostTime"`
}

type ClusterEndpointSpec struct {
	// Keepalived configures the keepalived that will be deployed for the cluster control-plane
	// +optional
	Keepalived *KeepalivedSpec `json:"keepalived,omitempty"`
}

type ClusterPhase string

type ClusterSpec struct {
	// NodeLabels specifies the labels to be added to the node.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`
	// NodeAnnotations specifies the annotations to be added to the node.
	// +optional
	NodeAnnotations map[string]string `json:"nodeAnnotations,omitempty"`
	// Selector defines the selector of the DPUClusters the produced DPUs should join
	// +optional
	Selector *metav1.LabelSelector `json:"selector,omitempty"`
}

type ClusterType string

type ConditionType string

type ConfigFile struct {
	// Type controls when the file content is materialized.
	// cloud-init files use raw inline content and are written during cloud-init.
	// agent-applied files use contentFrom and are written later by dpu-agent.
	// Defaults to cloud-init when omitted.
	// +kubebuilder:default=cloud-init
	// +optional
	Type *ConfigFileType `json:"type,omitempty"`
	// Path is the path of the file to be written.
	// +required
	Path string `json:"path"`
	// Operation is the operation to be performed on the file.
	// +optional
	Operation DPUFlavorFileOp `json:"operation,omitempty"`
	// Raw is the inline file content.
	// Supported only when type is cloud-init. When type is omitted, type defaults
	// to cloud-init and raw must be set.
	// +optional
	Raw *string `json:"raw,omitempty"`
	// ContentFrom references external content for the file.
	// Supported only when type is agent-applied.
	// +optional
	ContentFrom *ConfigFileContentSource `json:"contentFrom,omitempty"`
	// Permissions are the permissions to be set on the file.
	// +optional
	Permissions string `json:"permissions,omitempty"`
}

type ConfigFileContentSource struct {
	// ConfigMapKeyRef selects a key from a ConfigMap in the DPU namespace.
	// +optional
	ConfigMapKeyRef *corev1.ConfigMapKeySelector `json:"configMapKeyRef,omitempty"`
}

type ConfigFileType string

type ContainerdConfig struct {
	// RegistryEndpoint is the endpoint of the container registry.
	// +optional
	RegistryEndpoint string `json:"registryEndpoint,omitempty"`
}

type DMSAddress struct {
	// IP address in IPv4 format.
	// +kubebuilder:validation:Format=ipv4
	IP string `json:"ip"`

	// Port number.
	// +kubebuilder:validation:Minimum=1
	Port uint16 `json:"port"`
}

type DPU struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec DPUSpec `json:"spec,omitempty"`

	// +kubebuilder:default={phase: Initializing}
	// +optional
	Status DPUStatus `json:"status,omitzero"`
}

type DPUCluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +required
	Spec DPUClusterSpec `json:"spec,omitempty"`

	// +kubebuilder:default={phase: Pending}
	// +optional
	Status DPUClusterStatus `json:"status,omitzero"`
}

type DPUClusterEtcdEncryptionAtRestStatus struct {
	// Provider is the committed encryption-at-rest provider for the cluster.
	// +kubebuilder:validation:Enum=staticKey;vaultKMS
	// +required
	Provider string `json:"provider,omitempty"`

	// StaticKey exposes staticKey-specific observed state.
	// +optional
	StaticKey *DPUClusterStaticKeyEncryptionStatus `json:"staticKey,omitempty"`
}

type DPUClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPUCluster `json:"items"`
}

type DPUClusterSpec struct {
	// Type of the cluster with few supported values
	// static - existing cluster that is deployed by user. For DPUCluster of this type, the kubeconfig field must be set.
	// kamaji - DPF managed cluster. The kamaji-cluster-manager will create a DPU cluster on behalf of this CR.
	// $(others) - any string defined by ISVs, such type names must start with a prefix.
	// +kubebuilder:validation:Pattern="kamaji|static|[^/]+/.*"
	// +required
	Type string `json:"type"`

	// MaxNodes is the max amount of node in the cluster
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=3000
	// +kubebuilder:default=1000
	// +optional
	MaxNodes int `json:"maxNodes,omitempty"`

	// Kubeconfig is the secret that contains the admin kubeconfig
	// +kubebuilder:validation:XValidation:rule="oldSelf==\"\"||self==oldSelf",message="kubeconfig is immutable"
	// +optional
	Kubeconfig string `json:"kubeconfig,omitempty"`

	// ClusterEndpoint contains configurations of the cluster entry point
	// +optional
	ClusterEndpoint *ClusterEndpointSpec `json:"clusterEndpoint,omitempty"`
}

type DPUClusterStaticKeyEncryptionStatus struct {
	// ActiveKeyRef is the source Secret observed for the currently active key.
	// This field is informational and must not be used by controllers to select desired key material.
	// +optional
	ActiveKeyRef *ObservedSecretKeyRef `json:"activeKeyRef,omitempty"`
}

type DPUClusterStatus struct {
	// +kubebuilder:default="Pending"
	// +optional
	Phase ClusterPhase `json:"phase,omitempty"`

	// Version is the K8s control-plane version of the cluster
	// +optional
	Version string `json:"version"`

	// NodesCount is the number of DPUs assigned to the cluster
	// +kubebuilder:validation:Minimum=0
	// +optional
	NodesCount int `json:"nodesCount"`

	// EtcdEncryptionAtRest exposes the observed encryption-at-rest state for the cluster.
	// +optional
	EtcdEncryptionAtRest *DPUClusterEtcdEncryptionAtRestStatus `json:"etcdEncryptionAtRest,omitempty"`

	// +optional
	Conditions []metav1.Condition `json:"conditions"`
}

type DPUConditionMessage string

type DPUConditionType string

type DPUDevice struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DPUDeviceSpec   `json:"spec,omitempty"`
	Status DPUDeviceStatus `json:"status,omitempty"`
}

type DPUDeviceClusterSpec struct {
	// NodeLabels specifies labels to be added to the DPU cluster node for this device.
	// +optional
	NodeLabels map[string]string `json:"nodeLabels,omitempty"`
	// NodeAnnotations specifies annotations to be added to the DPU cluster node for this device.
	// +optional
	NodeAnnotations map[string]string `json:"nodeAnnotations,omitempty"`
}

type DPUDeviceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPUDevice `json:"items"`
}

type DPUDeviceSpec struct {
	// PSID is the Product Serial ID of the device.
	// It's used to track the device's lifecycle and for inventory management.
	// This value is immutable and should not be changed once set.
	// Example: "MT_0001234567", "MT25066004C7"
	//
	// Deprecated: This field is deprecated and will be removed in a future version. Use status.psid instead.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="PSID is immutable"
	// +optional
	PSID *string `json:"psid,omitempty"`

	// SerialNumber is the serial number of the device.
	// It's used to track the device's lifecycle and for inventory management.
	// This value is immutable and should not be changed once set.
	// Example: "MT_0001234567", "MT25066004C7"
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Serial Number is immutable"
	// +kubebuilder:validation:MinLength=1
	// +required
	SerialNumber string `json:"serialNumber,omitempty"`

	// OPN is the Ordering Part Number of the device.
	// It's used to track the device's compatibility with different software versions.
	// This value is immutable and should not be changed once set.
	// Example: "900-9D3B4-00SV-EA0"
	//
	// Deprecated: This field is deprecated and will be removed in a future version. Use status.opn instead.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="OPN is immutable"
	// +optional
	OPN *string `json:"opn,omitempty"`

	// BMCIP is the IP address of the BMC (Base Management Controller) on the device.
	// This is used for remote management and monitoring of the device.
	// When this value changes, the controller re-establishes secure communication with the BMC
	// and re-issues the IP-bound BMC server certificate without reprovisioning the DPU.
	// Example: "10.1.2.3"
	// +kubebuilder:validation:Format=ipv4
	// +optional
	BMCIP *string `json:"bmcIp,omitempty"`

	// BMCPort is the port number of the BMC (Base Management Controller) on the device.
	// This is used for remote management and monitoring of the device.
	// This value is immutable and should not be changed once set.
	// Example: 443
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="BMCPort is immutable"
	// +kubebuilder:default=443
	// +optional
	BMCPort *uint32 `json:"bmcPort,omitempty"`

	// NumberOfPFs is the number of PFs on the device.
	// This value is immutable and should not be changed once set.
	// Example: 1
	// +kubebuilder:default:=1
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Number of PFs is immutable"
	// +optional
	NumberOfPFs *int `json:"numberOfPFs,omitempty"`

	// NICDeviceCount is the expected number of NIC devices used by dpu-agent provisioning.
	// Valid range is 1 to 8. When unspecified, it defaults to 8.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=8
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="NICDeviceCount is immutable"
	// +optional
	NICDeviceCount *int `json:"nicDeviceCount,omitempty"`

	// PF0Name is the name of the PF0 on the device.
	// This value is immutable and should not be changed once set.
	// Example: "eth0"
	//
	// Deprecated: This field is deprecated and will be removed in a future version. Use status.pf0Name instead.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="PF0 Name is immutable"
	// +optional
	PF0Name *string `json:"pf0Name,omitempty"`

	// BMCCredentialSecretName is the name of a Secret in the same namespace containing
	// per-device BMC credentials. The secret must contain a "password" key with the BMC credential value.
	// If specified, this password takes precedence over the shared bmc-shared-password secret.
	// +optional
	BMCCredentialSecretName *string `json:"bmcCredentialSecretName,omitempty"`

	// BMCFactoryResetPolicy controls whether DPF resets this DPU BMC to factory defaults
	// while initializing the DPUDevice. The reset clears all BMC configuration, including
	// network settings, so the BMC must obtain its address via DHCP.
	// - OnInitialization (default): reset the BMC once, while the DPUDevice is initialized.
	// - Never: never reset.
	// The value is honored only until the factory reset step finishes; changing it
	// after BMCFactoryResetReady is True has no effect.
	// +kubebuilder:validation:Enum=OnInitialization;Never
	// +kubebuilder:default=OnInitialization
	// +optional
	BMCFactoryResetPolicy BMCFactoryResetPolicy `json:"bmcFactoryResetPolicy,omitempty"`

	// Specifies details on the K8S cluster to join
	// +optional
	Cluster *DPUDeviceClusterSpec `json:"cluster,omitempty"`

	// Values contains free-form per-device values used to render a DPUFlavorTemplate
	// into a concrete generated DPUFlavor for this device.
	// +optional
	Values *runtime.RawExtension `json:"values,omitempty"`
}

type DPUDeviceStatus struct {
	// PSID is the Product Serial ID of the device.
	// It's used to track the device's lifecycle and for inventory management.
	// This value is discovered and should not be changed once set.
	// Example: "MT_0001234567", "MT25066004C7"
	// +optional
	PSID *string `json:"psid,omitempty"`

	// SerialNumber is the serial number of the device.
	// It's used to track the device's lifecycle and for inventory management.
	// This value is discovered and should not be changed once set.
	// Example: "MT_0001234567", "MT25066004C7"
	// +optional
	SerialNumber *string `json:"serialNumber,omitempty"`

	// OPN is the Ordering Part Number of the device.
	// It's used to track the device's compatibility with different software versions.
	// This value is discovered and should not be changed once set.
	// Example: "900-9D3B4-00SV-EA0"
	// +optional
	OPN *string `json:"opn,omitempty"`

	// BMCIP is the IP address of the BMC (Base Management Controller) on the device.
	// This is used for remote management and monitoring of the device.
	// The controller synchronizes this value from spec.bmcIp after reconciling an address change.
	// Example: "10.1.2.3"
	// +kubebuilder:validation:Format=ipv4
	// +optional
	BMCIP *string `json:"bmcIp,omitempty"`

	// BMCPort is the port number of the BMC (Base Management Controller) on the device.
	// This is used for remote management and monitoring of the device.
	// This value is immutable and should not be changed once set.
	// Example: 443
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=443
	// +optional
	BMCPort *uint32 `json:"bmcPort,omitempty"`

	// PCIAddress is the PCI address of the device in the host system.
	// Example: "0000-03-00", "03-00"
	// +optional
	PCIAddress *string `json:"pciAddress,omitempty"`

	// PF0Name is the name of the PF0 on the device.
	// Example: "eth0"
	// +optional
	PF0Name *string `json:"pf0Name,omitempty"`

	// PF0MAC is the MAC address of the PF0 on the device.
	// Example: "00:00:00:00:00:00"
	// +kubebuilder:validation:Pattern=`^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$`
	// +optional
	PF0MAC *string `json:"pf0Mac,omitempty"`

	// DPUType is the type of the DPU.
	// +kubebuilder:validation:Enum=Unknown;BlueField2;BlueField3;BlueField4
	// +kubebuilder:default=Unknown
	// +optional
	DPUType DPUType `json:"dpuType,omitempty"`

	// DPUMode is the mode of the DPU.
	// +kubebuilder:default=dpu
	// +optional
	DPUMode DpuModeType `json:"dpuMode,omitempty"`

	// SecureBoot indicates the current UEFI Secure Boot state.
	// +optional
	SecureBoot *SecureBootStatus `json:"secureBoot,omitempty"`

	// BMCCredentialSecretName is the name of the Secret last used successfully for BMC authentication.
	// +optional
	BMCCredentialSecretName *string `json:"bmcCredentialSecretName,omitempty"`

	// BMCFactoryResetRequestTime is when DPF submitted ResetToDefaults to the BMC.
	// It is nil until the request has been accepted, and once set it is never cleared:
	// it is what keeps the BMC from being reset again for this DPUDevice.
	// +optional
	BMCFactoryResetRequestTime *metav1.Time `json:"bmcFactoryResetRequestTime,omitempty"`

	// BMCServerCertificate reports the BMC mTLS server certificate rotation state.
	// +optional
	BMCServerCertificate *CertificateStatus `json:"bmcServerCertificate,omitempty"`
	// CATrustBundle stores trust bundle reconciliation progress for the DPUDevice.
	// +optional
	CATrustBundle *TrustBundleStatus `json:"caTrustBundle,omitempty"`

	// +optional
	Conditions []metav1.Condition `json:"conditions"`
}

type DPUDiscovery struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DPUDiscoverySpec   `json:"spec,omitempty"`
	Status DPUDiscoveryStatus `json:"status,omitempty"`
}

type DPUDiscoveryList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPUDiscovery `json:"items"`
}

type DPUDiscoverySpec struct {
	// IPRange defines the range of IP addresses to scan
	IPRangeSpec IPRangeValidationSpec `json:"ipRangeSpec"`
	// ScanInterval defines how often to perform the scan
	// +kubebuilder:default="1h"
	ScanInterval metav1.Duration `json:"scanInterval,omitempty"`
	// Workers defines the number of workers to use for the scan (default 1 worker for each 255 IPs in the range)
	// +optional
	Workers *int `json:"workers,omitempty"`
}

type DPUDiscoveryStatus struct {
	// ObservedGeneration is the generation of the spec that was last applied by a successful scan.
	// When spec (e.g. IP range) changes, reconciliation runs a scan immediately instead of waiting for the next interval.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// LastScanTime is the timestamp of the last successful scan
	// +optional
	LastScanTime *metav1.Time `json:"lastScanTime,omitempty"`
	// FoundDPUs is the list of discovered DPU BMC IPs
	// +optional
	FoundDPUs int `json:"foundDPUs,omitempty"`
}

type DPUFLavorSysctl struct {
	// Parameters are the sysctl parameters to be set.
	// +optional
	Parameters []string `json:"parameters,omitempty"`
}

type DPUFlavor struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec DPUFlavorSpec `json:"spec,omitempty"`
}

type DPUFlavorDMA struct {
	// Enabled creates the SNAP DMA SF on BlueField-4 socket-direct systems.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`
}

type DPUFlavorFileOp string

type DPUFlavorGrub struct {
	// KernelParameters are the kernel parameters to be set in the grub configuration.
	// +optional
	KernelParameters []string `json:"kernelParameters,omitempty"`
}

type DPUFlavorList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPUFlavor `json:"items"`
}

type DPUFlavorOVS struct {
	// RawConfigScript is the raw configuration script for OVS.
	// The DPU agent runs this script once per boot. A restart of the agent in the
	// same boot does not re-run it; a reboot or power cycle does.
	// +optional
	RawConfigScript string `json:"rawConfigScript,omitempty"`
}

type DPUFlavorSpec struct {
	// Grub contains the grub configuration for the DPUFlavor.
	// +optional
	Grub DPUFlavorGrub `json:"grub,omitempty"`
	// Sysctl contains the sysctl configuration for the DPUFlavor.
	// +optional
	Sysctl DPUFLavorSysctl `json:"sysctl,omitempty"`
	// NVConfig contains the device-specific configuration (firmware settings, device parameters).
	// Each entry specifies a device (wildcard '*', or port identifiers 'p0'/'P0'/'p1'/'P1') and its parameters.
	// If device is '*' or unspecified (defaults to '*'), it applies to all devices and must be the only entry.
	// Each device (including unspecified as '*') must be unique across all nvconfig entries (case-insensitive).
	// Validation enforces: device enum values, parameter format (KEY=VALUE), case-insensitive uniqueness, and size limits.
	// +kubebuilder:validation:MaxItems=3
	// +kubebuilder:validation:XValidation:rule="size(self) == 0 || !self.exists(x, has(x.device) && x.device == '*') || size(self) == 1",message="when device is '*', it must be the only nvconfig entry"
	// +kubebuilder:validation:XValidation:rule="size(self) == 0 || !self.exists(x, !has(x.device)) || size(self) == 1",message="when device is unspecified (defaults to '*'), it must be the only nvconfig entry"
	// +kubebuilder:validation:XValidation:rule="self.all(p1, self.exists_one(p2, (has(p1.device) ? p1.device.lowerAscii() : '*') == (has(p2.device) ? p2.device.lowerAscii() : '*')))",message="each nvconfig.device (including unspecified as '*') must be unique (case-insensitive)"
	// +listType=atomic
	// +optional
	NVConfig []NVConfig `json:"nvconfig,omitempty"`

	// ScalableFunctions is the list of SF groups to create on the DPU, or on the host when
	// hostDevice is set. Count is per selected device. Over-subscribe can trigger failures at
	// create time. Editing this field reprovisions the DPU. For backward compatibility, when
	// both this SF list and VF list are empty, SF counts are still derived from PF_TOTAL_SF
	// (removed in a future release).
	// +kubebuilder:validation:MaxItems=16
	// +listType=atomic
	// +optional
	ScalableFunctions []ScalableFunction `json:"scalableFunctions,omitempty"`

	// VirtualFunctions is the list of VF groups to create. Count is per selected
	// device. Groups ending up on the same device sum to a single `sriov_numvfs` and then
	// list order assigns contiguous index ranges. Over-subscribe can trigger failures at
	// create time. Editing this field reprovisions the DPU.
	// +kubebuilder:validation:MaxItems=16
	// +listType=atomic
	// +optional
	VirtualFunctions []VirtualFunction `json:"virtualFunctions,omitempty"`

	// DMA configures the SNAP DMA SF. The agent picks the ECPF; sfnum is 8000 and MAC is derived.
	// Ignored except on BlueField-4.
	// +optional
	DMA *DPUFlavorDMA `json:"dma,omitempty"`

	// OVS contains the OVS configuration for the DPUFlavor.
	// +optional
	OVS DPUFlavorOVS `json:"ovs,omitempty"`
	// BFCfgParameters are the parameters to be set in the bf.cfg file.
	// +optional
	BFCfgParameters []string `json:"bfcfgParameters,omitempty"`
	// ConfigFiles are the files to be written on the DPU.
	// +optional
	ConfigFiles []ConfigFile `json:"configFiles,omitempty"`
	// Packages are the packages to reconcile on the node.
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x.name == y.name))",message="package names must be unique"
	// +optional
	Packages []PackageSpec `json:"packages,omitempty"`
	// SystemdServices are the systemd services to manage on the node.
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x.name == y.name))",message="systemd service names must be unique"
	// +optional
	SystemdServices []SystemdServiceSpec `json:"systemdServices,omitempty"`
	// ContainerdConfig contains the configuration for containerd.
	// +optional
	ContainerdConfig ContainerdConfig `json:"containerdConfig,omitempty"`
	// DPUResources indicates the minimum amount of resources needed for a BFB with that flavor to be installed on a
	// DPU. Using this field, the controller can understand if that flavor can be installed on a particular DPU. It
	// should be set to the total amount of resources the system needs + the resources that should be made available for
	// DPUServices to consume.
	// +optional
	DPUResources corev1.ResourceList `json:"dpuResources,omitempty"`
	// SystemReservedResources indicates the resources that are consumed by the system (OS, OVS, DPF system etc) and are
	// not made available for DPUServices to consume. DPUServices can consume the difference between DPUResources and
	// SystemReservedResources. This field must not be specified if dpuResources are not specified.
	// +optional
	SystemReservedResources corev1.ResourceList `json:"systemReservedResources,omitempty"`

	// DpuMode is deprecated and no longer used by provisioning workflows.
	// Deployment mode is sourced from DPFOperatorConfig and exposed on DPU.status.deploymentMode.
	// +optional
	DpuMode DpuModeType `json:"dpuMode,omitempty"`

	// HostNetworkInterfaceConfigs contains the configuration for the host-side network interfaces.
	// +optional
	HostNetworkInterfaceConfigs []NetworkInterfaceConfig `json:"hostNetworkInterfaceConfigs,omitempty"`

	// EWNicConfigurations lists per-NIC configuration for the E/W NICs.
	// Only the first entry is applied in this release; additional entries are ignored until a future
	// release adds multi-NIC support. The field is modeled as a list now so the API shape does not
	// need to change when multiple entries are supported.
	// +kubebuilder:validation:MaxItems=16
	// +listType=atomic
	// +optional
	EWNicConfigurations []NicConfiguration `json:"ewNicConfigurations,omitempty"`

	// serviceReadiness configures the Service Readiness phase.
	// +optional
	ServiceReadiness *ServiceReadiness `json:"serviceReadiness,omitempty"`
}

type DPUFlavorTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec DPUFlavorTemplateSpec `json:"spec,omitempty"`
}

type DPUFlavorTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPUFlavorTemplate `json:"items"`
}

type DPUFlavorTemplateSpec struct {
	// Template is the DPUFlavor body as a YAML/JSON string with Go template actions
	// (delimited by double curly braces). It is rendered against DPUDevice.spec.values and the result is
	// unmarshalled into a typed DPUFlavor and validated by DPUFlavor admission when
	// the generated flavor is created. Referencing a key that is absent from the device
	// values fails the render, and the "define", "block" and "template" actions are
	// rejected. It should not contain dpuResources or systemReservedResources: the
	// structured fields below take precedence and, when set, override anything the
	// rendered body contains.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=1048576
	// +required
	Template string `json:"template"`

	// DPUResources is resource-fitting metadata mirrored from DPUFlavor. It is NOT
	// templated: when set it is stamped onto every generated DPUFlavor and takes
	// precedence over anything in the rendered body.
	// +optional
	DPUResources corev1.ResourceList `json:"dpuResources,omitempty"`

	// SystemReservedResources is resource-fitting metadata mirrored from DPUFlavor. It is
	// NOT templated: when set it is stamped onto every generated DPUFlavor and takes
	// precedence over anything in the rendered body.
	// +optional
	SystemReservedResources corev1.ResourceList `json:"systemReservedResources,omitempty"`
}

type DPUInfoConditionType string

type DPUInstallInterfaceType string

type DPUList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPU `json:"items"`
}

type DPUNode struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DPUNodeSpec   `json:"spec,omitempty"`
	Status DPUNodeStatus `json:"status,omitempty"`
}

type DPUNodeConditionType string

type DPUNodeInstallInterfaceType string

type DPUNodeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPUNode `json:"items"`
}

type DPUNodeMaintenance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DPUNodeMaintenanceSpec   `json:"spec,omitempty"`
	Status DPUNodeMaintenanceStatus `json:"status,omitempty"`
}

type DPUNodeMaintenanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPUNodeMaintenance `json:"items"`
}

type DPUNodeMaintenanceSpec struct {
	// DPUNodeName is the name of the DPUNode that is being maintained.
	// +required
	DPUNodeName string `json:"dpuNodeName"`
	// NodeEffect is the effect to be applied to the node.
	// +optional
	NodeEffect *NodeEffect `json:"nodeEffect,omitempty"`
	// Requestor is the list of consumers for the maintenance.
	// +optional
	Requestor []string `json:"requestor,omitempty"`
}

type DPUNodeMaintenanceStatus struct {
	// Conditions reflect the status of the object
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// NodeEffectSyncStartTime is the time when the node effect sync started.
	// +optional
	NodeEffectSyncStartTime *metav1.Time `json:"nodeEffectSyncStartTime,omitempty"`
	// MultiDPUOperationsSyncWaitTime  is the wait time between DPUs on the same node.
	// +optional
	MultiDPUOperationsSyncWaitTime *metav1.Duration `json:"multiDPUOperationsSyncWaitTime,omitempty"`
	// MaxUnavailableDPUNodes is the maximum number of DPUNodes that are unavailable during the node effect period.
	// +kubebuilder:validation:Minimum=1
	// +optional
	MaxUnavailableDPUNodes *int32 `json:"maxUnavailableDPUNodes,omitempty"`
}

type DPUNodeSpec struct {
	// Defines the method for rebooting the host.
	// One of the following options can be chosen for this field:
	//    - "external": Reboot the host via an external means, not controlled by the
	//      DPU controller.
	//    - "script": Reboot the host by executing a custom script.
	//    - "hostAgent": Use the host agent to reboot the host.
	//    - "none": Do not reboot a host through the DPUNode.
	// "hostAgent" is the default value.
	// +kubebuilder:default={hostAgent:{}}
	// +optional
	NodeRebootMethod *NodeRebootMethod `json:"nodeRebootMethod,omitempty"`

	// The IP address and port where the DMS is exposed. Only applicable if dpuInstallInterface is set to gNOI.
	//
	// Deprecated: this field is no longer used.
	// +optional
	NodeDMSAddress *DMSAddress `json:"nodeDMSAddress,omitempty"`

	// A map containing names of each DPUDevice attached to the node.
	// +optional
	DPUs []DPURef `json:"dpus,omitempty"`
}

type DPUNodeStatus struct {
	// Conditions represent the latest available observations of an object's state.
	// +kubebuilder:validation:Type=array
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// The name of the interface which will be used to install the bfb image, can be one of hostAgent,redfish
	// +kubebuilder:validation:Enum=gNOI;hostAgent;redfish
	// +optional
	DPUInstallInterface *string `json:"dpuInstallInterface,omitempty"`
	// The name of the Kubernetes Node object that this DPUNode represents.
	// This field is optional and only relevant if the x86 host is part of the DPF Kubernetes cluster.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="KubeNodeRef is immutable"
	// +optional
	KubeNodeRef *string `json:"kubeNodeRef,omitempty"`
	// RebootInProgress indicates if the node is in the process of rebooting.
	// +optional
	RebootInProgress *bool `json:"rebootInProgress,omitempty"`
	// RebootMethod is the host operation required by the child DPUs in
	// DPURebooting phase: PowerCycle or SystemLevelReset.
	// +optional
	RebootMethod *RebootMethodType `json:"rebootMethod,omitempty"`
}

type DPUOperationalConditionType string

type DPUOutdated struct {
	// TimeStamp records when this drift was first observed for the current Reason.
	// It is preserved across reconciles as long as Reason is unchanged.
	// +required
	TimeStamp metav1.Time `json:"timeStamp"`

	// Reason is the machine-readable drift code (e.g. OutdatedBFB). When more
	// than one template field has drifted, Reason reports the first in fixed
	// precedence order: BFB -> DPUFlavor -> SecureBoot -> BlueFieldSoftware.
	// +required
	Reason string `json:"reason"`

	// Message is a human-readable summary that lists every drifted field,
	// e.g. "DPU template has changed (BFB: bfb-v1 -> bfb-v2, DPUFlavor: ...)".
	// +required
	Message string `json:"message"`
}

type DPUPhase string

type DPUReconfigStatus struct {
	// InProgress permits the DPU controller to jump to Node Effect. It is cleared when
	// this DPU is Ready again for this round. Do not set it together with Outdated.
	// +optional
	InProgress *bool `json:"inProgress,omitempty"`

	// Round is the DPUSet round assigned when InProgress was set.
	// Zero means InProgress has not been set for a round.
	// +optional
	// +kubebuilder:validation:Minimum=1
	Round int32 `json:"round,omitempty"`

	// CompletedRound is the last round that reached Ready. Zero means this DPU has not
	// finished an in-place round. While it equals DPUSet status.dpuReconfig.round, this
	// DPU is not started again for the same annotation.
	// +optional
	// +kubebuilder:validation:Minimum=1
	CompletedRound int32 `json:"completedRound,omitempty"`
}

type DPURef struct {
	// Name of the DPU device.
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name"`
}

type DPUSet struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DPUSetSpec   `json:"spec,omitempty"`
	Status DPUSetStatus `json:"status,omitempty"`
}

type DPUSetList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DPUSet `json:"items"`
}

type DPUSetReconfigStatus struct {
	// Round identifies the current or last round. It increases by one when a new
	// annotation round starts and is not reset when the annotation is removed.
	// Zero means no round has started.
	// +optional
	// +kubebuilder:validation:Minimum=1
	Round int32 `json:"round,omitempty"`

	// Active is true while this annotation round is not finished.
	// +optional
	Active *bool `json:"active,omitempty"`

	// StartedAt is when this round became active. It distinguishes a DPU that was
	// already Ready before the round from one that first becomes Ready during it.
	// The controller sets it with round and active, and never leaves it zero.
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`
}

type DPUSetSpec struct {
	// The rolling update strategy to use to updating existing DPUs with new ones.
	// +required
	Strategy DPUSetStrategy `json:"strategy"`

	// Select the DPUNodes with specific labels
	// +optional
	DPUNodeSelector *metav1.LabelSelector `json:"dpuNodeSelector,omitempty"`

	// Select the DPU with specific labels
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0. Use DPUDeviceSelector instead.
	// +optional
	DPUSelector map[string]string `json:"dpuSelector,omitempty"`

	// DPUDeviceSelector defines the selector for DPUDevices that the DPUSet should target and should create a DPU for.
	// +optional
	DPUDeviceSelector *metav1.LabelSelector `json:"dpuDeviceSelector,omitempty"`

	// Object that describes the DPU that will be created if insufficient replicas are detected
	// +required
	DPUTemplate DPUTemplate `json:"dpuTemplate"`
}

type DPUSetStatus struct {
	// DPUStatistics is a map of DPUPhase to the number of DPUs in that phase.
	// +optional
	DPUStatistics map[DPUPhase]int `json:"dpuStatistics,omitempty"`
	// Conditions reflect the status of the object
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// ObservedGeneration records the Generation observed on the object the last time it was patched.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// DPUReconfig is the in-place reconfig round owned by the DPUSet controller.
	// The user starts a round with annotation provisioning.dpu.nvidia.com/inplace-reconfig=true.
	// Nil means no round has started.
	// +optional
	DPUReconfig *DPUSetReconfigStatus `json:"dpuReconfig,omitempty,omitzero"`
}

type DPUSetStrategy struct {
	// Can be "OnDelete" or "RollingUpdate".
	// +required
	Type StrategyType `json:"type"`

	// Rolling update config params. Present only if StrategyType = RollingUpdate.
	// +optional
	RollingUpdate *RollingUpdateDPU `json:"rollingUpdate,omitempty"`
}

type DPUSpec struct {
	// Specifies the DPUNode this DPU belongs to
	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="Value is immutable"
	// +required
	DPUNodeName string `json:"dpuNodeName"`

	// Specifies the name of the DPUDevice this DPU is associated with
	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="Value is immutable"
	// +kubebuilder:validation:MinLength=1
	// +required
	DPUDeviceName string `json:"dpuDeviceName"`

	// Specifies name of the bfb CR to use for this DPU
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +optional
	BFB *string `json:"bfb,omitempty"`

	// Specifies the name of the BlueFieldSoftware CR to use for this DPU
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +optional
	BlueFieldSoftware *string `json:"blueFieldSoftware,omitempty"`

	// The serial number of the DPU
	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="Value is immutable"
	// +kubebuilder:validation:MinLength=1
	// +required
	SerialNumber string `json:"serialNumber"`

	// The PCI device related DPU
	// Example: "0000-03-00", "03-00"
	// +kubebuilder:validation:Pattern=`^([0-9a-fA-F]{4}[-])?[0-9a-fA-F]{2}[-][0-9a-fA-F]{2}$`
	// +optional
	PCIAddress *string `json:"pciAddress,omitempty"`

	// Specifies how changes to the DPU should affect the Node
	// +required
	NodeEffect NodeEffect `json:"nodeEffect"`

	// Specifies details on the K8S cluster to join
	// +optional
	Cluster K8sCluster `json:"cluster,omitempty"`

	// DPUFlavor is the name of the DPUFlavor that will be used to deploy the DPU.
	// +kubebuilder:validation:XValidation:rule="self==oldSelf", message="Value is immutable"
	// +kubebuilder:validation:MinLength=1
	// +required
	DPUFlavor string `json:"dpuFlavor"`

	// AstraEnabled indicates whether E/W NIC configuration (Astra) is enabled
	// +optional
	AstraEnabled *bool `json:"astraEnabled,omitempty"`

	// SecureBoot specifies whether UEFI Secure Boot should be enabled.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="Value is immutable"
	SecureBoot *bool `json:"secureBoot,omitempty"`

	// BMCIP is the ip address of the DPU BMC
	//
	// Deprecated: Use BMCIP from DPUDevice instead.
	// +optional
	BMCIP string `json:"bmcIP,omitempty"`
}

type DPUStatus struct {
	// The current state of DPU.
	// +kubebuilder:default=Initializing
	// +optional
	Phase DPUPhase `json:"phase,omitempty"`

	// PreviousPhase is the last non-empty Phase before the current Phase, set by the controller
	// when Phase transitions. It may be unset during early initialization (empty Phase) or until
	// the first transition from a non-empty Phase. Internal controller tracking only.
	// +optional
	PreviousPhase DPUPhase `json:"previousPhase,omitempty"`

	// Outdated, when present, indicates the DPU has drifted from its owning
	// DPUSet's DPUTemplate and needs to be reprovisioned. Set by the DPUSet
	// controller; absent when the DPU matches the template.
	// +optional
	Outdated *DPUOutdated `json:"outdated,omitempty"`

	// Conditions represents the provisioning lifecycle conditions.
	// +optional
	Conditions []metav1.Condition `json:"conditions"`

	// OperationalConditions represents aggregated operational readiness conditions.
	// These conditions reflect the runtime health and readiness of DPU services and node health,
	// separate from the provisioning lifecycle represented by Conditions.
	// +listType=map
	// +listMapKey=type
	// +optional
	OperationalConditions []metav1.Condition `json:"operationalConditions,omitempty"`

	// BFBFile is the path to the BFB file
	// +optional
	BFBFile string `json:"bfbFile,omitempty"`

	// BFCFGFile is the path to the bf.cfg
	// +optional
	BFCFGFile string `json:"bfCFGFile,omitempty"`

	// bfb version of this DPU
	// +optional
	BFBVersion string `json:"bfbVersion,omitempty"`

	// DPF version used to install this DPU
	// +kubebuilder:validation:XValidation:rule="self==oldSelf", message="Value is immutable"
	// +optional
	DPFVersion *string `json:"dpfVersion,omitempty"`

	// pci device information of this DPU
	// +optional
	PCIDevice string `json:"pciDevice,omitempty"`

	// whether require reset of DPU
	// +optional
	RequiredReset *bool `json:"requiredReset,omitempty"`

	// the firmware information of DPU
	// +optional
	Firmware Firmware `json:"firmware,omitempty"`

	// The DPU node's IP addresses
	// +optional
	Addresses []corev1.NodeAddress `json:"addresses,omitempty"`

	// the name of the interface which will be used to install the bfb image,
	// and communicate with DPU, can be one of hostAgent,redfish
	// +kubebuilder:validation:Enum=gNOI;hostAgent;redfish
	// +optional
	DPUInstallInterface *string `json:"dpuInstallInterface,omitempty"`

	// Indicates that node effect was triggered by post-provisioning label changes
	// +optional
	PostProvisioningNodeEffect *bool `json:"postProvisioningNodeEffect,omitempty"`

	// PostProvisioningDPUConfig must be set before entering Node Effect for an in-place
	// flavor reconfig, so Node Effect exits to DPU Config instead of Initialize Interface.
	// The DPU controller owns this field. If both this and PostProvisioningNodeEffect would
	// be set, only this one is set.
	// +optional
	PostProvisioningDPUConfig *bool `json:"postProvisioningDPUConfig,omitempty"`

	// DPUReconfig is the in-place reconfig round state for this DPU. DPUSet writes it.
	// The DPU controller reads inProgress and does not write these fields.
	// Nil means no round has been assigned.
	// +optional
	DPUReconfig *DPUReconfigStatus `json:"dpuReconfig,omitempty,omitzero"`

	// ObservedGeneration records the Generation observed on the object the last time it was patched.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// The type of the DPU
	// +kubebuilder:validation:Enum=Unknown;BlueField2;BlueField3;BlueField4
	// +kubebuilder:default=Unknown
	// +optional
	DPUType DPUType `json:"dpuType,omitempty"`

	// AgentLastStartupTime is the time when the DPU agent was last started. This is copied from agentStatus.lastStartupTime.
	// +optional
	AgentLastStartupTime *metav1.Time `json:"agentLastStartupTime,omitempty"`

	// AgentStatus contains the information reported from inside the DPU
	// +optional
	AgentStatus *AgentStatus `json:"agentStatus,omitempty"`

	// RebootStatus contains host reboot progress.
	// DPU controller derives user-facing DPUCondRebooted from this status.
	// +optional
	RebootStatus *RebootStatus `json:"rebootStatus,omitempty"`

	// The mode of the DPU
	// +kubebuilder:default=dpu
	// +optional
	DPUMode DpuModeType `json:"dpuMode,omitempty"`

	// DeploymentMode is copied from DPFOperatorConfig.spec.deploymentMode by the controller.
	// This field is read-only for users.
	// +kubebuilder:validation:Enum=zero-trust;host-trusted
	// +optional
	DeploymentMode DeploymentMode `json:"deploymentMode,omitempty"`

	// Hostless indicates that the DPU is attached to a system-managed synthetic
	// DPUNode rather than a physical host.
	// +optional
	Hostless bool `json:"hostless,omitempty"`

	// SecureBoot indicates the current UEFI Secure Boot state.
	// +optional
	SecureBoot *SecureBootStatus `json:"secureBoot,omitempty"`

	// IdentityMode records which authentication mechanism the DPU Agent uses to reach the
	// management-cluster kube-apiserver. Stamped exactly once by the DPU controller during phase
	// Initializing (nil guard); immutable thereafter. Pre-SPIFFE legacy DPUs have IdentityMode
	// unset (nil) which consumers MUST treat semantically as bootstrap-token.
	// +kubebuilder:validation:Enum=spiffe;bootstrap-token
	// +optional
	IdentityMode *IdentityMode `json:"identityMode,omitempty"`

	// The task ID of the last task performed on the DPU BMC
	// +optional
	RedfishTaskID *string `json:"redfishTaskId,omitempty"`
}

type DPUTemplate struct {
	// Annotations specifies annotations which are added to the DPU.
	Annotations map[string]string `json:"annotations,omitempty"`
	// Spec specifies the DPU specification.
	Spec DPUTemplateSpec `json:"spec,omitempty"`
}

type DPUTemplateSpec struct {
	// Specifies a BFB CR
	// +optional
	BFB *BFBReference `json:"bfb,omitempty"`
	// Specifies a BlueFieldSoftware CR
	// +optional
	BlueFieldSoftware *BlueFieldSoftwareReference `json:"blueFieldSoftware,omitempty"`
	// Specifies how changes to the DPU should affect the Node
	// +required
	NodeEffect NodeEffect `json:"nodeEffect"`
	// Specifies details on the K8S cluster to join
	// +optional
	Cluster *ClusterSpec `json:"cluster,omitempty"`
	// DPUFlavor is the name of the DPUFlavor that will be used to deploy the DPU.
	// Mutually exclusive with DPUFlavorTemplate.
	// +kubebuilder:validation:MinLength=1
	// +optional
	DPUFlavor *string `json:"dpuFlavor,omitempty"`
	// DPUFlavorTemplate is the name of a DPUFlavorTemplate that is rendered per-DPU
	// (against DPUDevice.spec.values) into a generated DPUFlavor. Mutually exclusive
	// with DPUFlavor.
	// +kubebuilder:validation:MinLength=1
	// +optional
	DPUFlavorTemplate *string `json:"dpuFlavorTemplate,omitempty"`
	// AstraEnabled indicates whether E/W NIC configuration (Astra) is enabled
	// +optional
	AstraEnabled *bool `json:"astraEnabled,omitempty"`
	// SecureBoot specifies whether UEFI Secure Boot should be enabled.
	// +optional
	SecureBoot *bool `json:"secureBoot,omitempty"`
}

type DPUType string

type DeploymentMode string

type DownloadedComponents struct {
	// PldmFwBundle maps each PSID to the local path of its downloaded PLDM firmware bundle.
	// Keys are matched case-insensitively against the BMC-reported DPUDevice PSID.
	PldmFwBundle map[string]string `json:"pldmFwBundle,omitempty"`

	// PlatformPldmFwBundle is the local path of the downloaded platform PLDM firmware bundle.
	PlatformPldmFwBundle string `json:"platformPldmFwBundle,omitempty"`

	// OsIso is the local path of the downloaded OS ISO.
	OsIso string `json:"osIso,omitempty"`

	// NicFw is the local path of the E/W NIC firmware binary, either downloaded from
	// spec.nicFw or unpacked from the platform PLDM firmware bundle.
	NicFw string `json:"nicFw,omitempty"`
}

type DpuModeType string

type External struct{}

type Firmware struct {
	// BMC is the used BMC firmware version
	BMC string `json:"bmc,omitempty"`
	// NIC is the used NIC firmware version
	NIC string `json:"nic,omitempty"`
	// UEFI is the used UEFI firmware version
	UEFI string `json:"uefi,omitempty"`
}

type GNOI struct{}

type HostAgent struct{}

type HostOSInitSkipped struct {
	// reason is a stable machine-readable outcome code.
	// +optional
	Reason *string `json:"reason,omitempty"`
	// message is a human-readable explanation.
	// +optional
	Message *string `json:"message,omitempty"`
}

type HostOSInitStatus struct {
	// skipped indicates release was not required for this DPU.
	// +optional
	Skipped *HostOSInitSkipped `json:"skipped,omitempty"`
	// succeeded indicates host OS init was released or was already cleared.
	// +optional
	Succeeded *HostOSInitSucceeded `json:"succeeded,omitempty"`
}

type HostOSInitSucceeded struct {
	// gate echoes the effective gate used for release.
	// +optional
	Gate ServiceReadinessGate `json:"gate,omitempty"`
}

type IPRange struct {
	StartIP string `json:"startIP"`

	EndIP string `json:"endIP"`

	// +optional
	// Port defines the port to on which BMC is listening
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +kubebuilder:default=443
	Port *uint32 `json:"port,omitempty"`
}

type IPRangeValidationSpec struct {
	IPRange IPRange `json:"ipRange"`
}

type IdentityMode string

type K8sCluster struct {
	// Name is the name of the DPUs Kubernetes cluster
	// +kubebuilder:validation:XValidation:rule="self==oldSelf", message="Value is immutable"
	// +optional
	Name string `json:"name,omitempty"`
	// Namespace is the tenants namespace name where the Kubernetes cluster will be deployed
	// +kubebuilder:validation:XValidation:rule="self==oldSelf", message="Value is immutable"
	// +optional
	Namespace string `json:"namespace,omitempty"`

	ClusterSpec `json:",inline"`
}

type KeepalivedSpec struct {
	// VIP is the virtual IP owned by the keepalived instances
	VIP string `json:"vip"`

	// VirtualRouterID is the virtual_router_id in keepalived.conf
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=255
	VirtualRouterID int `json:"virtualRouterID"`

	// Interface specifies on which interface the VIP should be assigned
	// +kubebuilder:validation:MinLength=1
	Interface string `json:"interface"`

	// NodeSelector is used to specify a subnet of control plane nodes to deploy keepalived instances.
	// Note: keepalived instances are always deployed on control plane nodes
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
}

type NVConfig struct {
	// Device is the device to which the configuration applies. If not specified, the configuration applies to all.
	// Supported values: "*" (wildcard for all devices), "p0"/"P0" (port 0), "p1"/"P1" (port 1). Case-insensitive.
	// +kubebuilder:validation:Enum={"*","p0","p1","P0","P1"}
	// +optional
	Device *string `json:"device,omitempty"`
	// Parameters are the parameters to be set for the device.
	// DELAY_HOST_OS_INIT=ENABLE_USER (0x3) holds the host at UEFI and is rejected by the DPU agent
	// outside zero-trust, where the agent needs the host to reach the kube-apiserver.
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:validation:items:Pattern=`^[^=\s]+=[^\s]*$`
	// +kubebuilder:validation:items:MaxLength=200
	// +listType=atomic
	// +optional
	Parameters []string `json:"parameters,omitempty"`
	// force applies the parameters with `mlxconfig --force` and skips the `mlxconfig q` filter,
	// so parameters firmware does not yet expose are applied now instead of deferred to a later
	// reboot. Required when a parameter is gated behind another parameter in the same batch.
	// Requires DOCA 3.5.0 or later; on an older DOCA version the operation fails.
	// `--force` skips validation for the whole batch, so an invalid value is applied silently.
	// Ignored under `spec.hostNetworkInterfaceConfigs[].nvconfig`.
	// +optional
	Force *bool `json:"force,omitempty"`
}

type NetworkInterfaceConfig struct {
	// MTU is the MTU value to be set on the network interface.
	// +kubebuilder:validation:Minimum=1280
	// +kubebuilder:validation:Maximum=9216
	// +optional
	MTU *int32 `json:"mtu,omitempty"`

	// DHCP is the DHCP configuration for the network interface.
	// +optional
	DHCP *bool `json:"dhcp,omitempty"`

	// PortNumber identifies which port this configuration applies to.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=1
	// +required
	PortNumber int32 `json:"portNumber"`

	// NVConfig contains port-specific configuration for this network interface.
	// This configuration is applied in addition to the global NVConfig settings in DPUFlavorSpec.
	// Both global and per-interface NVConfig settings can coexist without collision.
	// +optional
	NVConfig *NVConfig `json:"nvconfig,omitempty"`
}

type NicConfiguration struct {
	// Number of VFs to be configured
	// +required
	NumVfs int `json:"numVfs"`
	// LinkType to be configured, Ethernet|Infiniband. Required unless networkBay is configured;
	// for Network Bay the link type is governed by the system configuration and must not be set.
	// +kubebuilder:validation:Enum=Ethernet;Infiniband
	// +optional
	LinkType nicconfigv1alpha1.LinkTypeEnum `json:"linkType,omitempty"`
	// Spectrum-X optimization settings. Works only with linkType==Ethernet && numVfs==1. RawNvConfig parameters, if provided, are merged as overrides on top of Spectrum-X calculated params.
	SpectrumXOptimized *nicconfigv1alpha1.SpectrumXOptimizedSpec `json:"spectrumXOptimized,omitempty"`
	// List of arbitrary nv config parameters
	RawNvConfig []nicconfigv1alpha1.NvConfigParam `json:"rawNvConfig,omitempty"`
	// NetworkBay configures a ConnectX-9 Network Bay card (per-ASIC set_system_conf). Allowed only for ConnectX-9 (nicType 1025).
	// +optional
	NetworkBay *nicconfigv1alpha1.NetworkBaySpec `json:"networkBay,omitempty"`
	// Force passes `--force` to mlxconfig set commands. When set, the daemon
	// applies the nv config batch and set_system_conf with --force, letting
	// mlxconfig accept a batch it would otherwise refuse due to implicit
	// parameter dependencies.
	// +optional
	// +kubebuilder:default:=false
	Force bool `json:"force,omitempty"`
}

type NodeEffect struct {
	Action        `json:",inline"`
	UpgradePolicy `json:",inline"`
}

type NodeRebootMethod struct {
	// Use the DPU's DMS interface to reboot the host.
	//
	// Deprecated: Use HostAgent instead.
	// +optional
	GNOI *GNOI `json:"gNOI,omitempty"`
	// Use the HostAgent to reboot the host.
	// +optional
	HostAgent *HostAgent `json:"hostAgent,omitempty"`
	// Reboot the host via an external means, not controlled by the DPU controller.
	// +optional
	External *External `json:"external,omitempty"`
	// Reboot the host by executing a custom script. This field defined which ConfigMap store the custom script.
	// The ConfigMap should include a pod template of Job object under the `pod-template` key.
	// That pod template will be put in a Job object to be executed.
	// +optional
	Script *Script `json:"script,omitempty"`
	// Do not reboot a host through the DPUNode. Used for hostless devices where
	// DPF manages the DPU reboot directly through Redfish.
	// +optional
	None *None `json:"none,omitempty"`
}

type None struct{}

type ObservedSecretKeyRef struct {
	// Name is the name of the Secret.
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name,omitempty"`

	// Key is the key within the Secret data.
	// +kubebuilder:validation:MinLength=1
	// +required
	Key string `json:"key,omitempty"`

	// Namespace is the namespace of the Secret.
	// +kubebuilder:validation:MinLength=1
	// +required
	Namespace string `json:"namespace,omitempty"`

	// UID is the UID of the Secret.
	// +kubebuilder:validation:MinLength=1
	// +required
	UID string `json:"uid,omitempty"`

	// ResourceVersion is the resourceVersion of the Secret.
	// +kubebuilder:validation:MinLength=1
	// +required
	ResourceVersion string `json:"resourceVersion,omitempty"`
}

type PackageSpec struct {
	// Name is the package name.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	Name string `json:"name"`
	// Version constrains the package version.
	// If empty, any installed version satisfies the spec.
	// +optional
	Version *PackageVersionSpec `json:"version,omitempty"`
	// RepoFileRef constrains package resolution to a specific repository file available on the node.
	// If empty, any configured repository may satisfy the package.
	// If specified, only the referenced repository file may provide candidates.
	// If that repository file does not provide the package or requested version, the dpu-agent flow does not continue.
	// +optional
	RepoFileRef string `json:"repoFileRef,omitempty"`
}

type PackageVersionMatchPolicy string

type PackageVersionSpec struct {
	// Value is the package version to compare against.
	// +kubebuilder:validation:MinLength=1
	Value string `json:"value"`
	// MatchPolicy controls how Value is matched.
	// If omitted, AtLeast is used.
	// +kubebuilder:validation:Enum=Exact;AtLeast
	// +kubebuilder:default=AtLeast
	// +optional
	MatchPolicy PackageVersionMatchPolicy `json:"matchPolicy,omitempty"`
}

type PendingNVConfigDevice struct {
	Device  string                 `json:"device,omitempty"`
	Entries []PendingNVConfigEntry `json:"entries"`
}

type PendingNVConfigEntry struct {
	Name    string `json:"name,omitempty"`
	Default string `json:"default,omitempty"`
	Current string `json:"current,omitempty"`
	// NextBoot uses the "next_boot" so this type can be reused for parsing mlxfwrest output
	NextBoot string `json:"next_boot,omitempty"`
}

type PendingNVConfigState struct {
	BootID  string                  `json:"bootID,omitempty"`
	Devices []PendingNVConfigDevice `json:"devices,omitempty"`
}

type RebootMethodType string

type RebootStatus struct {
	// Phase is the current host reboot progress.
	Phase RebootStatusPhase `json:"phase,omitempty"`
	// Method is the recommended reboot method.
	// +optional
	Method *RebootMethodType `json:"method,omitempty"`
	// Reason indicates machine-readable reason for current phase.
	// +optional
	Reason string `json:"reason,omitempty"`
	// Message provides human-readable details for current phase.
	// +optional
	Message string `json:"message,omitempty"`
	// LastTransitionTime is the last update time for reboot status.
	// +optional
	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
}

type RebootStatusPhase string

type RollingUpdateDPU struct {
	// MaxUnavailable is the maximum number of DPUs that can be unavailable during the update.
	//
	// Deprecated: This field is deprecated and will be removed with v27.1.0.
	// +optional
	MaxUnavailable *intstr.IntOrString `json:"maxUnavailable,omitempty"`
}

type ScalableFunction struct {
	// Count is SFs to create per selected device. With device "*", count 20 is 20 SFs
	// on each port. Zero creates nothing.
	// +kubebuilder:validation:Minimum=0
	// +required
	Count *int32 `json:"count,omitempty"`

	// Device is the target port: "*", a name such as p0, or a PCI address. Defaults to "*".
	// +kubebuilder:validation:Pattern=`^(\*|[pP][0-9]+|[0-9a-fA-F]{4}:[0-9a-fA-F]{2}:[0-9a-fA-F]{2}\.[0-7])$`
	// +optional
	Device *string `json:"device,omitempty"`

	// HostDevice creates the SFs on the host (representors on the DPU). Implies
	// controller 1; options.controller overrides. Host SFs use the host firmware
	// budget and must not set poolName.
	// +optional
	HostDevice *bool `json:"hostDevice,omitempty"`

	// PoolName is the device-plugin resource (for example bf_sf). Unset: created in
	// hardware only. Forbidden with hostDevice.
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9][A-Za-z0-9_.-]*$`
	// +optional
	PoolName *string `json:"poolName,omitempty"`

	// Options are creation settings for this group.
	// +optional
	Options *ScalableFunctionOptions `json:"options,omitempty"`
}

type ScalableFunctionOptions struct {
	// MACAddress pins the SF MAC (colon-separated 48-bit). Requires count 1.
	// +kubebuilder:validation:Pattern=`^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$`
	// +optional
	MACAddress *string `json:"macAddress,omitempty"`

	// SFNumStart is the first sfnum of the group; the rest are sequential from it.
	// Reserved before agent-numbered groups, which fill from 0 around them.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=65535
	// +optional
	SFNumStart *int32 `json:"sfNumStart,omitempty"`

	// Trusted creates the SFs as trusted functions.
	// +optional
	Trusted *bool `json:"trusted,omitempty"`

	// Controller is the external controller to create on. Overrides hostDevice.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=15
	// +optional
	Controller *int32 `json:"controller,omitempty"`

	// CPUList pins the SFs to CPUs in mlnx-sf list form, for example 0-3 or 0,2,4.
	// +kubebuilder:validation:MaxLength=200
	// +kubebuilder:validation:Pattern=`^[0-9]+(-[0-9]+)?(,[0-9]+(-[0-9]+)?)*$`
	// +optional
	CPUList *string `json:"cpuList,omitempty"`

	// DisableRoCE creates the SFs with RoCE disabled.
	// +optional
	DisableRoCE *bool `json:"disableRoCE,omitempty"`

	// DisableNetdev leaves the SFs without an ethernet netdev.
	// +optional
	DisableNetdev *bool `json:"disableNetdev,omitempty"`
}

type Script struct {
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name"`
}

type SecureBootStatus struct {
	// Enabled indicates whether UEFI Secure Boot is currently enabled on the DPU.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`
}

type ServiceReadiness struct {
	// gate is the DPU.status.operationalConditions entry that must be True before the DPU leaves
	// the Service Readiness phase. When unset the phase does not wait, and a host hold requested
	// via DELAY_HOST_OS_INIT is released on DPUServiceCriticalPodsReady.
	// +optional
	Gate ServiceReadinessGate `json:"gate,omitempty"`
}