v1alpha1

type AgentConnectionStatus struct {
	// Connected indicates whether any cluster agent is currently connected
	Connected bool `json:"connected"`

	// ConnectedAgents is the number of cluster agents currently connected
	ConnectedAgents int `json:"connectedAgents"`

	// LastConnectedTime is when an agent last successfully connected
	// +optional
	LastConnectedTime *metav1.Time `json:"lastConnectedTime,omitempty"`

	// LastDisconnectedTime is when the last agent disconnected
	// +optional
	LastDisconnectedTime *metav1.Time `json:"lastDisconnectedTime,omitempty"`

	// LastHeartbeatTime is when the control plane last received any communication from an agent
	// +optional
	LastHeartbeatTime *metav1.Time `json:"lastHeartbeatTime,omitempty"`

	// Message provides additional information about the agent connection status
	// +optional
	Message string `json:"message,omitempty"`
}

type AuthzRole struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzRoleSpec `json:"spec,omitempty"`
}

type AuthzRoleBinding struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzRoleBindingSpec `json:"spec,omitempty"`
}

type AuthzRoleBindingList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzRoleBinding `json:"items"`
}

type AuthzRoleBindingSpec struct {
	// Entitlement defines the subject (from JWT claims) to grant the role to
	// +required
	Entitlement EntitlementClaim `json:"entitlement"`

	// RoleMappings is the list of role-scope pairs this binding grants
	// +required
	// +kubebuilder:validation:MinItems=1
	RoleMappings []RoleMapping `json:"roleMappings"`

	// Effect indicates whether this binding allows or denies access (default: allow)
	// +kubebuilder:default=allow
	// +optional
	Effect EffectType `json:"effect,omitempty"`
}

type AuthzRoleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzRole `json:"items"`
}

type AuthzRoleSpec struct {
	// Actions is the list of actions this role can perform
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:example:={"component:create"}
	// +required
	Actions []string `json:"actions"`

	// Description is a human-readable description of the role
	// +optional
	Description string `json:"description,omitempty"`
}

type ClusterAgentConfig struct {
	// ClientCA contains the CA certificate used to verify the agent's client certificate
	// This allows per-plane CA configuration for enhanced security
	ClientCA ValueFrom `json:"clientCA"`
}

type ClusterAuthzRole struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ClusterAuthzRoleSpec `json:"spec,omitempty"`
}

type ClusterAuthzRoleBinding struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ClusterAuthzRoleBindingSpec `json:"spec,omitempty"`
}

type ClusterAuthzRoleBindingList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []ClusterAuthzRoleBinding `json:"items"`
}

type ClusterAuthzRoleBindingSpec struct {
	// Entitlement defines the subject (from JWT claims) to grant the role to
	// +required
	Entitlement EntitlementClaim `json:"entitlement"`

	// RoleMappings is the list of cluster roles this binding grants
	// +required
	// +kubebuilder:validation:MinItems=1
	RoleMappings []ClusterRoleMapping `json:"roleMappings"`

	// Effect indicates whether this binding allows or denies access (default: allow)
	// +kubebuilder:default=allow
	// +optional
	Effect EffectType `json:"effect,omitempty"`
}

type ClusterAuthzRoleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []ClusterAuthzRole `json:"items"`
}

type ClusterAuthzRoleSpec struct {
	// Actions is the list of actions this role can perform
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:example:={"component:create"}
	// +required
	Actions []string `json:"actions"`

	// Description is a human-readable description of the role
	// +optional
	Description string `json:"description,omitempty"`
}

type ClusterComponentType struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterComponentTypeSpec   `json:"spec,omitempty"`
	Status ClusterComponentTypeStatus `json:"status,omitempty"`
}

type ClusterComponentTypeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterComponentType `json:"items"`
}

type ClusterComponentTypeSpec struct {
	// WorkloadType must be one of: deployment, statefulset, cronjob, job, proxy
	// This determines the primary workload resource type for this component type
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=deployment;statefulset;cronjob;job;proxy
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workloadType cannot be changed after creation"
	WorkloadType string `json:"workloadType"`

	// AllowedWorkflows restricts which ClusterWorkflow CRs developers can use
	// for building components of this type. If empty, no workflows are allowed.
	// References must point to ClusterWorkflow resources.
	// +optional
	AllowedWorkflows []ClusterWorkflowRef `json:"allowedWorkflows,omitempty"`

	// Parameters defines what developers can configure when creating components of this type.
	// +optional
	Parameters *SchemaSection `json:"parameters,omitempty"`

	// EnvironmentConfigs defines per-environment configurations developers can set via ReleaseBinding.
	// +optional
	EnvironmentConfigs *SchemaSection `json:"environmentConfigs,omitempty"`

	// Traits are pre-configured trait instances embedded in the ClusterComponentType.
	// Only ClusterTrait references are allowed since ClusterComponentType is cluster-scoped.
	// The PE binds trait parameters using concrete values or CEL expressions
	// referencing the ComponentType schema (e.g., "${parameters.storage.mountPath}").
	// These traits are automatically applied to all Components of this type.
	// +optional
	Traits []ClusterComponentTypeTrait `json:"traits,omitempty"`

	// AllowedTraits restricts which ClusterTrait CRs developers can attach to Components of this type.
	// When specified, only ClusterTraits listed here (matched by name) may be attached beyond those already embedded in spec.traits.
	// ClusterTrait references listed here must not overlap with traits already embedded in spec.traits.
	// If empty or omitted, no additional component-level traits are allowed.
	// +optional
	AllowedTraits []ClusterTraitRef `json:"allowedTraits,omitempty"`

	// Validations are CEL-based rules evaluated during rendering.
	// All rules must evaluate to true for rendering to proceed.
	// +optional
	Validations []ValidationRule `json:"validations,omitempty"`

	// Resources are templates that generate Kubernetes resources dynamically.
	// At least one resource template is required. For non-proxy workload types,
	// one resource must have an id matching the workloadType. When workloadType
	// is "proxy", a matching resource id is not required.
	// +kubebuilder:validation:MinItems=1
	Resources []ResourceTemplate `json:"resources"`
}

type ClusterComponentTypeStatus struct {
}

type ClusterComponentTypeTrait struct {
	// Kind is the kind of trait. Must be ClusterTrait.
	// +kubebuilder:default=ClusterTrait
	Kind ClusterTraitRefKind `json:"kind,omitempty"`

	// Name is the name of the ClusterTrait resource to use.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance.
	// Must be unique across all embedded traits in the ClusterComponentType
	// and must not collide with any component-level trait instance names.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains trait parameter bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${parameters.storage.mountPath}" or "app-data" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// EnvironmentConfigs contains trait environment config bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${environmentConfigs.storage.size}" or "local-path" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	EnvironmentConfigs *runtime.RawExtension `json:"environmentConfigs,omitempty"`
}

type ClusterDataPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterDataPlaneSpec   `json:"spec,omitempty"`
	Status ClusterDataPlaneStatus `json:"status,omitempty"`
}

type ClusterDataPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterDataPlane `json:"items"`
}

type ClusterDataPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterDataPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "prod-cluster", "shared-dataplane", "us-east-1"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all data planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// Gateway specifies the configuration for the API gateway in this DataPlane.
	// +optional
	Gateway GatewaySpec `json:"gateway,omitempty"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the data plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ClusterObservabilityPlane for this ClusterDataPlane.
	// Since this is a cluster-scoped resource, it can only reference cluster-scoped ClusterObservabilityPlane.
	// Namespace-scoped ObservabilityPlane references are NOT supported for cluster-scoped resources.
	//
	// Default behavior:
	// - If not specified, the system looks for a ClusterObservabilityPlane named "default"
	// - If "default" ClusterObservabilityPlane doesn't exist, observability features are disabled
	//
	// The kind field must be "ClusterObservabilityPlane".
	// +optional
	// +kubebuilder:validation:XValidation:rule="!has(self.kind) || self.kind == 'ClusterObservabilityPlane'",message="ClusterDataPlane can only reference ClusterObservabilityPlane"
	ObservabilityPlaneRef *ClusterObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type ClusterDataPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterDataPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterDataPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this data plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type ClusterObservabilityPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterObservabilityPlaneSpec   `json:"spec,omitempty"`
	Status ClusterObservabilityPlaneStatus `json:"status,omitempty"`
}

type ClusterObservabilityPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterObservabilityPlane `json:"items"`
}

type ClusterObservabilityPlaneRef struct {
	// Kind is the kind of observability plane. Must be ClusterObservabilityPlane.
	// +required
	Kind ClusterObservabilityPlaneRefKind `json:"kind"`

	// Name is the name of the ClusterObservabilityPlane resource
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	Name string `json:"name"`
}

type ClusterObservabilityPlaneRefKind string

type ClusterObservabilityPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterObservabilityPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "shared-obs", "monitoring-cluster", "eu-central-1"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all observability planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// ObserverURL is the base URL of the Observer API in the observability plane cluster
	// +required
	ObserverURL string `json:"observerURL"`

	// RCAAgentURL is the base URL of the RCA Agent API in the observability plane cluster
	// +optional
	RCAAgentURL string `json:"rcaAgentURL,omitempty"`
}

type ClusterObservabilityPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterObservabilityPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterObservabilityPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this observability plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type ClusterRoleMapping struct {
	// RoleRef references the ClusterAuthzRole to bind
	RoleRef RoleRef `json:"roleRef"`

	// Scope defines the target scope within the ownership hierarchy
	// +optional
	Scope ClusterTargetScope `json:"scope,omitempty"`
}

type ClusterTargetScope struct {
	// Namespace scopes to a specific namespace (optional)
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Project scopes to a specific project (optional, requires namespace)
	// +optional
	Project string `json:"project,omitempty"`

	// Component scopes to a specific component (optional, requires project)
	// +optional
	Component string `json:"component,omitempty"`
}

type ClusterTrait struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterTraitSpec   `json:"spec,omitempty"`
	Status ClusterTraitStatus `json:"status,omitempty"`
}

type ClusterTraitList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterTrait `json:"items"`
}

type ClusterTraitRef struct {
	// Kind is the kind of trait. Must be ClusterTrait.
	// +required
	Kind ClusterTraitRefKind `json:"kind"`

	// Name is the name of the ClusterTrait resource
	// +required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type ClusterTraitRefKind string

type ClusterTraitSpec struct {
	// Parameters defines developer-facing configuration options for this trait.
	// +optional
	Parameters *SchemaSection `json:"parameters,omitempty"`

	// EnvironmentConfigs defines per-environment configurations for this trait via ReleaseBinding.
	// +optional
	EnvironmentConfigs *SchemaSection `json:"environmentConfigs,omitempty"`

	// Validations are CEL-based rules evaluated during rendering.
	// All rules must evaluate to true for rendering to proceed.
	// +optional
	Validations []ValidationRule `json:"validations,omitempty"`

	// Creates defines new Kubernetes resources to create when this trait is applied
	// +optional
	Creates []TraitCreate `json:"creates,omitempty"`

	// Patches defines modifications to existing resources generated by the ComponentType
	// +optional
	Patches []TraitPatch `json:"patches,omitempty"`
}

type ClusterTraitStatus struct {
}

type ClusterWorkflow struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterWorkflowSpec   `json:"spec,omitempty"`
	Status ClusterWorkflowStatus `json:"status,omitempty"`
}

type ClusterWorkflowList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterWorkflow `json:"items"`
}

type ClusterWorkflowPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterWorkflowPlaneSpec   `json:"spec,omitempty"`
	Status ClusterWorkflowPlaneStatus `json:"status,omitempty"`
}

type ClusterWorkflowPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterWorkflowPlane `json:"items"`
}

type ClusterWorkflowPlaneRef struct {
	// Kind is the kind of workflow plane. Must be ClusterWorkflowPlane.
	// +required
	Kind ClusterWorkflowPlaneRefKind `json:"kind"`

	// Name is the name of the ClusterWorkflowPlane resource
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name"`
}

type ClusterWorkflowPlaneRefKind string

type ClusterWorkflowPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterWorkflowPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "shared-builder", "ci-cluster", "us-west-2"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all workflow planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the workflow plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ClusterObservabilityPlane for this ClusterWorkflowPlane.
	// Since this is a cluster-scoped resource, it can only reference cluster-scoped ClusterObservabilityPlane.
	// Namespace-scoped ObservabilityPlane references are NOT supported for cluster-scoped resources.
	//
	// Default behavior:
	// - If not specified, the controller defaults to a ClusterObservabilityPlane named "default"
	// - If the "default" ClusterObservabilityPlane does not exist, reconciliation fails with an error
	//
	// The kind field must be "ClusterObservabilityPlane".
	// +optional
	// +kubebuilder:validation:XValidation:rule="!has(self.kind) || self.kind == 'ClusterObservabilityPlane'",message="ClusterWorkflowPlane can only reference ClusterObservabilityPlane"
	ObservabilityPlaneRef *ClusterObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type ClusterWorkflowPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterWorkflowPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterWorkflowPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this workflow plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type ClusterWorkflowRef struct {
	// Kind is the kind of workflow. Must be ClusterWorkflow.
	// +required
	Kind ClusterWorkflowRefKind `json:"kind"`

	// Name is the name of the ClusterWorkflow resource
	// +required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type ClusterWorkflowRefKind string

type ClusterWorkflowSpec struct {
	// WorkflowPlaneRef references the ClusterWorkflowPlane for this workflow's operations.
	// Defaults to ClusterWorkflowPlane named "default" when omitted.
	// +optional
	// +kubebuilder:default={kind: "ClusterWorkflowPlane", name: "default"}
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workflowPlaneRef is immutable"
	WorkflowPlaneRef *ClusterWorkflowPlaneRef `json:"workflowPlaneRef,omitempty"`

	// Parameters defines the developer-facing parameters that can be configured
	// when creating a WorkflowRun instance.
	// +optional
	Parameters *SchemaSection `json:"parameters,omitempty"`

	// RunTemplate is the Kubernetes resource template to be rendered and applied to the cluster.
	// Template variables are substituted with context and parameter values.
	// Supported template variables:
	//   - ${metadata.workflowRunName} - WorkflowRun name (the execution instance)
	//   - ${metadata.namespaceName} - Namespace name
	//   - ${metadata.namespace} - Enforced workflow execution namespace (e.g., "workflows-<namespaceName>")
	//   - ${metadata.labels['key']} - WorkflowRun labels
	//   - ${parameters.*} - Developer-provided parameter values
	//   - ${workflowplane.secretStore} - ESO ClusterSecretStore name from the WorkflowPlane
	//   - ${externalRefs['<id>'].spec.*} - Resolved external CR specs (declared via externalRefs)
	//
	// +required
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	RunTemplate *runtime.RawExtension `json:"runTemplate"`

	// Resources are additional templates that generate Kubernetes resources dynamically.
	// +optional
	Resources []WorkflowResource `json:"resources,omitempty"`

	// ExternalRefs declares references to external CRs that are resolved at runtime.
	// +optional
	// +listType=map
	// +listMapKey=id
	ExternalRefs []ExternalRef `json:"externalRefs,omitempty"`

	// TTLAfterCompletion defines the time-to-live for WorkflowRun instances after completion.
	// +optional
	// +kubebuilder:validation:Pattern=`^(\d+d)?(\d+h)?(\d+m)?(\d+s)?$`
	TTLAfterCompletion string `json:"ttlAfterCompletion,omitempty"`
}

type ClusterWorkflowStatus struct {
	// conditions represent the current state of the ClusterWorkflow resource.
	// Each condition has a unique type and reflects the status of a specific aspect of the resource.
	//
	// The status of each condition is one of True, False, or Unknown.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type Component struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentSpec   `json:"spec,omitempty"`
	Status ComponentStatus `json:"status,omitempty"`
}

type ComponentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Component `json:"items"`
}

type ComponentOwner struct {
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`
}

type ComponentProfile struct {
	// Parameters holds the snapshot of parameter values from the Component spec
	// The schema for these values is defined in the ComponentType's parameters schema
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// Traits holds the snapshot of trait instances configured on the component at release time.
	// Each entry records the kind, name, and instanceName of the trait, along with any
	// user-supplied parameters, using the composite (kind, name) key to unambiguously identify
	// the trait spec in ComponentReleaseSpec.Traits.
	// +optional
	Traits []ComponentProfileTrait `json:"traits,omitempty"`
}

type ComponentProfileTrait struct {
	// Kind identifies whether this is a namespace-scoped Trait or a cluster-scoped ClusterTrait.
	// +kubebuilder:validation:Required
	Kind TraitRefKind `json:"kind"`

	// Name is the name of the Trait or ClusterTrait resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance within the component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains the trait parameter values supplied by the user.
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`
}

type ComponentRelease struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentReleaseSpec   `json:"spec,omitempty"`
	Status ComponentReleaseStatus `json:"status,omitempty"`
}

type ComponentReleaseComponentType struct {
	// Kind identifies whether this is a namespace-scoped ComponentType or a cluster-scoped ClusterComponentType.
	// +kubebuilder:validation:Required
	Kind ComponentTypeRefKind `json:"kind"`

	// Name is the component type reference in format: {workloadType}/{componentTypeName}
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Spec is the frozen specification of the component type at the time of this ComponentRelease.
	// +kubebuilder:validation:Required
	Spec ComponentTypeSpec `json:"spec"`
}

type ComponentReleaseList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComponentRelease `json:"items"`
}

type ComponentReleaseOwner struct {
	// ProjectName is the name of the project that owns this component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`

	// ComponentName is the name of the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ComponentName string `json:"componentName"`
}

type ComponentReleaseSpec struct {
	// Owner identifies the component and project this ComponentRelease belongs to
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.owner is immutable"
	Owner ComponentReleaseOwner `json:"owner"`

	// ComponentType is a frozen snapshot of the ComponentType resource at the time of component release.
	// It records the kind and name of the original resource alongside its full spec, enabling
	// the rendering pipeline to distinguish ComponentType from ClusterComponentType.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentType is immutable"
	ComponentType ComponentReleaseComponentType `json:"componentType"`

	// Traits holds frozen trait specifications at the time of ComponentRelease, ensuring immutability.
	// Each entry carries its kind (Trait or ClusterTrait), name, and spec, preserving the original
	// resource identity so that a Trait and ClusterTrait with the same name can coexist.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.traits is immutable"
	Traits []ComponentReleaseTrait `json:"traits,omitempty"`

	// ComponentProfile contains the immutable snapshot of parameter values and trait configs
	// specified for this component at release time
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentProfile is immutable"
	ComponentProfile *ComponentProfile `json:"componentProfile,omitempty"`

	// Workload is a full embedded copy of the Workload
	// This preserves the workload spec with the built image
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workload is immutable"
	Workload WorkloadTemplateSpec `json:"workload"`
}

type ComponentReleaseStatus struct {
}

type ComponentReleaseTrait struct {
	// Kind identifies whether this is a namespace-scoped Trait or a cluster-scoped ClusterTrait.
	// +kubebuilder:validation:Required
	Kind TraitRefKind `json:"kind"`

	// Name is the name of the Trait or ClusterTrait resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Spec is the frozen specification of the trait at the time of this ComponentRelease.
	// +kubebuilder:validation:Required
	Spec TraitSpec `json:"spec"`
}

type ComponentSource struct {
	// GitRepository specifies the configuration for the component source to be a Git repository indicating
	// that the component should be built from the source code.
	// This field is mutually exclusive with the other source types.
	GitRepository *GitRepository `json:"gitRepository,omitempty"`

	// ContainerRegistry specifies the configuration for the component source to be a container image indicating
	// that the component should be deployed using the provided image.
	// This field is mutually exclusive with the other source types.
	ContainerRegistry *ContainerRegistry `json:"containerRegistry,omitempty"`
}

type ComponentSpec struct {
	// Owner defines the ownership information for the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.owner is immutable"
	Owner ComponentOwner `json:"owner"`

	// ComponentType specifies the component type reference with kind and name.
	// Name is in the format: {workloadType}/{componentTypeName}
	// Example: kind=ComponentType, name="deployment/web-app"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentType cannot be changed after creation"
	ComponentType ComponentTypeRef `json:"componentType"`

	// AutoDeploy indicates whether the component should be deployed automatically when created
	// When not specified, defaults to false (zero value)
	// +optional
	AutoDeploy bool `json:"autoDeploy,omitempty"`

	// AutoBuild enables automatic builds when code is pushed to the repository
	// When enabled, webhook events will trigger builds automatically
	// Users must manually configure webhooks in their Git provider
	// +optional
	AutoBuild *bool `json:"autoBuild,omitempty"`

	// Parameters from ComponentType (oneOf schema based on componentType)
	// This is the merged schema of parameters + environmentConfigs from the ComponentType
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// Traits to compose into this component
	// Each trait can be instantiated multiple times with different instanceNames
	// +optional
	Traits []ComponentTrait `json:"traits,omitempty"`

	// Workflow defines the workflow configuration for building the component.
	// This references a Workflow CR and provides parameter values.
	// The Workflow must be in the allowedWorkflows list of the ComponentType.
	// +optional
	Workflow *ComponentWorkflowConfig `json:"workflow,omitempty"`
}

type ComponentStatus struct {
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`
	// LatestRelease keeps the information of the latest ComponentRelease created for this component
	// This is used to make sure the component's latest ComponentRelease is always
	// deployed to the first environment, if the autoDeploy flag is set to true
	// +optional
	LatestRelease *LatestRelease `json:"latestRelease,omitempty"`
}

type ComponentTrait struct {
	// Kind is the kind of trait (Trait or ClusterTrait)
	// +optional
	// +kubebuilder:default=Trait
	Kind TraitRefKind `json:"kind,omitempty"`

	// Name is the name of the Trait resource to use
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance within the component
	// Allows the same trait to be used multiple times with different configurations
	// Must be unique across all traits in the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains the trait parameter values
	// The schema for these values is defined in the Trait's parameters schema
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`
}

type ComponentType struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentTypeSpec   `json:"spec,omitempty"`
	Status ComponentTypeStatus `json:"status,omitempty"`
}

type ComponentTypeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComponentType `json:"items"`
}

type ComponentTypeRef struct {
	// Kind is the kind of component type (ComponentType or ClusterComponentType)
	// +optional
	// +kubebuilder:default=ComponentType
	Kind ComponentTypeRefKind `json:"kind,omitempty"`

	// Name is the component type reference in format: {workloadType}/{componentTypeName}
	// +required
	// +kubebuilder:validation:Pattern=`^(deployment|statefulset|cronjob|job|proxy)/[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	Name string `json:"name"`
}

type ComponentTypeRefKind string

type ComponentTypeSpec struct {
	// WorkloadType must be one of: deployment, statefulset, cronjob, job, proxy
	// This determines the primary workload resource type for this component type
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=deployment;statefulset;cronjob;job;proxy
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workloadType cannot be changed after creation"
	WorkloadType string `json:"workloadType"`

	// AllowedWorkflows restricts which workflow CRs developers can use
	// for building components of this type. If empty, no workflows are allowed.
	// Each entry is a WorkflowRef whose Kind defaults to ClusterWorkflow and
	// may be either Workflow (namespace-scoped) or ClusterWorkflow (cluster-scoped).
	// +optional
	AllowedWorkflows []WorkflowRef `json:"allowedWorkflows,omitempty"`

	// Parameters defines what developers can configure when creating components of this type.
	// +optional
	Parameters *SchemaSection `json:"parameters,omitempty"`

	// EnvironmentConfigs defines per-environment configs developers can set via ReleaseBinding.
	// +optional
	EnvironmentConfigs *SchemaSection `json:"environmentConfigs,omitempty"`

	// Traits are pre-configured trait instances embedded in the ComponentType.
	// The PE binds trait parameters using concrete values or CEL expressions
	// referencing the ComponentType schema (e.g., "${parameters.storage.mountPath}").
	// These traits are automatically applied to all Components of this type.
	// +optional
	Traits []ComponentTypeTrait `json:"traits,omitempty"`

	// AllowedTraits restricts which Trait or ClusterTrait CRs developers can attach to Components of this type.
	// When specified, only traits listed here (matched by kind and name) may be attached beyond those already embedded in spec.traits.
	// Trait references listed here must not overlap with traits already embedded in spec.traits.
	// If empty or omitted, no additional component-level traits are allowed.
	// +optional
	AllowedTraits []TraitRef `json:"allowedTraits,omitempty"`

	// Validations are CEL-based rules evaluated during rendering.
	// All rules must evaluate to true for rendering to proceed.
	// +optional
	Validations []ValidationRule `json:"validations,omitempty"`

	// Resources are templates that generate Kubernetes resources dynamically.
	// At least one resource template is required. For non-proxy workload types,
	// one resource must have an id matching the workloadType. When workloadType
	// is "proxy", a matching resource id is not required.
	// +kubebuilder:validation:MinItems=1
	Resources []ResourceTemplate `json:"resources"`
}

type ComponentTypeStatus struct {
}

type ComponentTypeTrait struct {
	// Kind is the kind of trait (Trait or ClusterTrait)
	// +optional
	// +kubebuilder:default=Trait
	Kind TraitRefKind `json:"kind,omitempty"`

	// Name is the name of the Trait resource to use.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance.
	// Must be unique across all embedded traits in the ComponentType
	// and must not collide with any component-level trait instance names.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains trait parameter bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${parameters.storage.mountPath}" or "app-data" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// EnvironmentConfigs contains trait environment config bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${environmentConfigs.storage.size}" or "local-path" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	EnvironmentConfigs *runtime.RawExtension `json:"environmentConfigs,omitempty"`
}

type ComponentWorkflowConfig struct {
	// Kind is the kind of workflow (Workflow or ClusterWorkflow).
	// +optional
	// +kubebuilder:default=ClusterWorkflow
	Kind WorkflowRefKind `json:"kind,omitempty"`

	// Name references the Workflow or ClusterWorkflow CR to use for building the component.
	// The Workflow must be in the allowedWorkflows list of the ComponentType.
	// +required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Parameters contains the developer-provided values for the flexible parameter schema
	// defined in the referenced Workflow CR.
	//
	// These values are validated against the Workflow's parameter schema.
	//
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`
}

type ConnectionEnvBindings struct {
	// Address is the env var name for the protocol-appropriate connection string.
	// For HTTP/HTTPS/WS/WSS: scheme://host:port/basePath
	// For gRPC/TCP/UDP: host:port
	// +optional
	Address string `json:"address,omitempty"`

	// Host is the optional env var name for just the hostname.
	// +optional
	Host string `json:"host,omitempty"`

	// Port is the optional env var name for just the port number.
	// +optional
	Port string `json:"port,omitempty"`

	// BasePath is the optional env var name for just the base path.
	// +optional
	BasePath string `json:"basePath,omitempty"`
}

type ConnectionTarget struct {
	// Namespace is the control plane namespace of the target component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Namespace string `json:"namespace"`

	// Project is the name of the project that owns the target component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Project string `json:"project"`

	// Component is the name of the target component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Component string `json:"component"`

	// Endpoint is the name of the endpoint on the target component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Endpoint string `json:"endpoint"`

	// Visibility is the desired visibility level for resolving the endpoint URL.
	// +kubebuilder:validation:Required
	Visibility EndpointVisibility `json:"visibility"`

	// Environment is the resolved target environment name for this connection.
	// This matches the consumer's environment.
	// +optional
	Environment string `json:"environment,omitempty"`
}

type Container struct {
	// OCI image to run (digest or tag).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Image string `json:"image"`

	// Container entrypoint & args.
	// +optional
	Command []string `json:"command,omitempty"`
	// +optional
	Args []string `json:"args,omitempty"`

	// Explicit environment variables.
	// +optional
	Env []EnvVar `json:"env,omitempty"`

	// File configurations.
	// +optional
	Files []FileVar `json:"files,omitempty"`
}

type ContainerOverride struct {
	// Explicit environment variables.
	// +optional
	Env []EnvVar `json:"env,omitempty"`

	// File configurations.
	// +optional
	Files []FileVar `json:"files,omitempty"`
}

type ContainerRegistry struct {
	// Image name of the container image. Format: <registry>/<image> without the tag.
	// Example: docker.io/library/nginx
	ImageName string `json:"imageName,omitempty"`
	// Authentication information to access the container registry.
	Authentication *RegistryAuthentication `json:"authentication,omitempty"`
}

type DataPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DataPlaneSpec   `json:"spec,omitempty"`
	Status DataPlaneStatus `json:"status,omitempty"`
}

type DataPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DataPlane `json:"items"`
}

type DataPlaneRef struct {
	// Kind is the kind of data plane (DataPlane or ClusterDataPlane)
	// +required
	Kind DataPlaneRefKind `json:"kind"`

	// Name is the name of the data plane resource
	// +required
	Name string `json:"name"`
}

type DataPlaneRefKind string

type DataPlaneSpec struct {

	// PlaneID identifies the logical plane this CR connects to.
	// Multiple DataPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// If not specified, defaults to the CR name for backwards compatibility.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "prod-cluster", "shared-dataplane", "us-east-1"
	// +optional
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID,omitempty"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all data planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// Gateway specifies the configuration for the API gateway in this DataPlane.
	// +optional
	Gateway GatewaySpec `json:"gateway,omitempty"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the data plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ObservabilityPlane or ClusterObservabilityPlane for this DataPlane.
	// If not specified, defaults to an ObservabilityPlane named "default" in the same namespace.
	// +optional
	ObservabilityPlaneRef *ObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type DataPlaneStatus struct {
	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
	// Important: Run "make" to regenerate code after modifying this file
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this data plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type DeploymentPipeline struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DeploymentPipelineSpec   `json:"spec,omitempty"`
	Status DeploymentPipelineStatus `json:"status,omitempty"`
}

type DeploymentPipelineList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeploymentPipeline `json:"items"`
}

type DeploymentPipelineRef struct {
	// Kind is the kind of deployment pipeline (DeploymentPipeline)
	// +optional
	// +kubebuilder:default=DeploymentPipeline
	Kind DeploymentPipelineRefKind `json:"kind,omitempty"`

	// Name is the name of the deployment pipeline resource
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name"`
}

type DeploymentPipelineRefKind string

type DeploymentPipelineSpec struct {

	// PromotionPaths defines the available paths for promotion between environments
	PromotionPaths []PromotionPath `json:"promotionPaths,omitempty"`
}

type DeploymentPipelineStatus struct {

	// ObservedGeneration represents the .metadata.generation that the condition was set based upon
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Conditions represent the latest available observations of an object's state
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type EffectType string

type EmailConfig struct {
	// From is the sender email address
	// Required when type is "email"
	// +kubebuilder:validation:Required
	From string `json:"from"`

	// To is the list of recipient email addresses
	// Required when type is "email"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	To []string `json:"to"`

	// SMTP configuration for sending emails
	// Required when type is "email"
	// +kubebuilder:validation:Required
	SMTP SMTPConfig `json:"smtp"`

	// Template defines the email template using CEL expressions
	// +kubebuilder:validation:Required
	Template *EmailTemplate `json:"template"`
}

type EmailTemplate struct {
	// Subject is the email subject line template using CEL expressions
	// Example: "[${alert.severity}] - ${alert.name} Triggered"
	// +kubebuilder:validation:Required
	Subject string `json:"subject"`

	// Body is the email body template using CEL expressions
	// Example: "Alert: ${alert.name} triggered at ${alert.startsAt}.\nSummary: ${alert.description}"
	// +kubebuilder:validation:Required
	Body string `json:"body"`
}

type EndpointAccess struct {
	// Host is the hostname or service name
	Host string `json:"host"`

	// Port is the port number
	Port int32 `json:"port"`

	// Scheme is the connection scheme (http, https, grpc, tcp)
	// +optional
	Scheme string `json:"scheme,omitempty"`

	// BasePath is the base URL path (for HTTP-based endpoints)
	// +optional
	BasePath string `json:"basePath,omitempty"`

	// URI is the computed URI for connecting to the endpoint
	// This field is automatically generated from host, port, scheme, and basePath
	// Examples: https://api.example.com:8080/v1, grpc://service:5050, tcp://localhost:9000
	// +optional
	URI string `json:"uri,omitempty"`
}

type EndpointGatewayURLs struct {
	// HTTP is the HTTP gateway URL.
	// +optional
	HTTP *EndpointURL `json:"http,omitempty"`

	// HTTPS is the HTTPS gateway URL.
	// +optional
	HTTPS *EndpointURL `json:"https,omitempty"`

	// TLS is the TLS gateway URL.
	// +optional
	TLS *EndpointURL `json:"tls,omitempty"`
}

type EndpointStatus struct {
	// Name is the endpoint identifier matching spec.endpoints
	Name string `json:"name"`

	// Type is the endpoint type (uses EndpointType from endpoint_types.go)
	Type EndpointType `json:"type"`

	// Project contains access info for project-level visibility
	// +optional
	Project *EndpointAccess `json:"project,omitempty"`

	// Organization contains access info for organization-level visibility
	// +optional
	Organization *EndpointAccess `json:"organization,omitempty"`

	// Public contains access info for public visibility
	// +optional
	Public *EndpointAccess `json:"public,omitempty"`
}

type EndpointType string

type EndpointURL struct {
	// Scheme is the URL scheme (e.g., http, https, tcp, udp, ws, wss, tls).
	// +optional
	Scheme string `json:"scheme,omitempty"`

	// Host is the hostname or IP address.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Host string `json:"host"`

	// Port is the port number.
	// +optional
	Port int32 `json:"port,omitempty"`

	// Path is the URL path.
	// +optional
	Path string `json:"path,omitempty"`
}

type EndpointURLStatus struct {
	// Name is the endpoint name as defined in the Workload spec.
	Name string `json:"name"`

	// Type is the endpoint type (HTTP, gRPC, GraphQL, Websocket, TCP, UDP).
	// +optional
	Type EndpointType `json:"type,omitempty"`

	// ServiceURL is the in-cluster service URL for this endpoint.
	// +optional
	ServiceURL *EndpointURL `json:"serviceURL,omitempty"`

	// InvokeURL is the resolved public URL for this endpoint, derived from the
	// rendered HTTPRoute whose backendRef port matches the endpoint port.
	// +optional
	InvokeURL string `json:"invokeURL,omitempty"`

	// InternalURLs holds the resolved internal gateway URLs.
	// +optional
	InternalURLs *EndpointGatewayURLs `json:"internalURLs,omitempty"`

	// ExternalURLs holds the resolved external gateway URLs.
	// +optional
	ExternalURLs *EndpointGatewayURLs `json:"externalURLs,omitempty"`
}

type EndpointVisibility string

type EntitlementClaim struct {
	// Claim is the JWT claim name (e.g., "groups", "sub", "email")
	// +required
	Claim string `json:"claim"`

	// Value is the entitlement value to match
	// +required
	Value string `json:"value"`
}

type EnvVar struct {
	// The environment variable key.
	// +required
	Key string `json:"key"`

	// The literal value of the environment variable.
	// Mutually exclusive with valueFrom.
	// +optional
	Value string `json:"value,omitempty"`

	// Extract the environment variable value from another resource.
	// Mutually exclusive with value.
	// +optional
	ValueFrom *EnvVarValueFrom `json:"valueFrom,omitempty"`
}

type EnvVarValueFrom struct {
	// Reference to a secret resource.
	// +optional
	SecretKeyRef *SecretKeyRef `json:"secretKeyRef,omitempty"`
}

type Environment struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   EnvironmentSpec   `json:"spec,omitempty"`
	Status EnvironmentStatus `json:"status,omitempty"`
}

type EnvironmentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Environment `json:"items"`
}

type EnvironmentRef struct {
	// Kind is the kind of environment (Environment)
	// +optional
	// +kubebuilder:default=Environment
	Kind EnvironmentRefKind `json:"kind,omitempty"`

	// Name is the name of the environment resource
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name"`
}

type EnvironmentRefKind string

type EnvironmentSpec struct {
	// DataPlaneRef references the DataPlane or ClusterDataPlane for this environment.
	// If not specified, defaults to a DataPlane named "default" in the same namespace.
	// Immutable once set.
	DataPlaneRef *DataPlaneRef `json:"dataPlaneRef,omitempty"`
	IsProduction bool          `json:"isProduction,omitempty"`
	Gateway      GatewaySpec   `json:"gateway,omitempty"`
}

type EnvironmentStatus struct {
	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
	// Important: Run "make" to regenerate code after modifying this file
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`
}

type ExternalRef struct {
	// ID uniquely identifies this external reference within the workflow.
	// The resolved CR's spec is injected into the CEL context under this name.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=2
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^[a-z][a-z0-9-]*[a-z0-9]$`
	ID string `json:"id"`

	// APIVersion is the API version of the referenced resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	APIVersion string `json:"apiVersion"`

	// Kind is the kind of the referenced resource.
	// Currently only SecretReference is supported.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=SecretReference
	Kind string `json:"kind"`

	// Name is the name of the referenced resource.
	// Supports CEL expressions (e.g., ${parameters.repository.secretRef}).
	// If the name evaluates to empty, the reference is silently skipped.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type FileVar struct {
	// The file key/name.
	// +kubebuilder:validation:Required
	Key string `json:"key"`

	// The mount path where the file will be mounted.
	// +kubebuilder:validation:Required
	MountPath string `json:"mountPath"`

	// The literal content of the file.
	// Mutually exclusive with valueFrom.
	// +optional
	Value string `json:"value,omitempty"`

	// Extract the environment variable value from another resource.
	// Mutually exclusive with value.
	// +optional
	ValueFrom *EnvVarValueFrom `json:"valueFrom,omitempty"`
}

type GatewayEndpointSpec struct {
	// Name is the name of the Gateway resource.
	Name string `json:"name"`
	// Namespace is the namespace of the Gateway resource.
	Namespace string `json:"namespace"`
	// HTTP defines the HTTP listener configuration.
	// +optional
	HTTP *GatewayListenerSpec `json:"http,omitempty"`
	// HTTPS defines the HTTPS listener configuration.
	// +optional
	HTTPS *GatewayListenerSpec `json:"https,omitempty"`
	// TLS defines the TLS listener configuration.
	// +optional
	TLS *GatewayListenerSpec `json:"tls,omitempty"`
}

type GatewayListenerSpec struct {
	// ListenerName is the name of the listener on the Gateway resource.
	// +optional
	ListenerName string `json:"listenerName,omitempty"`
	// Port is the port number for this listener.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port int32 `json:"port"`
	// Host is the virtual host for this listener.
	Host string `json:"host"`
}

type GatewayNetworkSpec struct {
	// External defines the externally accessible gateway endpoint.
	// +optional
	External *GatewayEndpointSpec `json:"external,omitempty"`
	// Internal defines the internally accessible gateway endpoint.
	// +optional
	Internal *GatewayEndpointSpec `json:"internal,omitempty"`
}

type GatewaySpec struct {
	// Ingress defines the ingress gateway configuration.
	// +optional
	Ingress *GatewayNetworkSpec `json:"ingress,omitempty"`
	// Egress defines the egress gateway configuration.
	// +optional
	Egress *GatewayNetworkSpec `json:"egress,omitempty"`
}

type GitAuthentication struct {
	// SecretRef is a reference to the secret containing Git credentials
	SecretRef string `json:"secretRef"`
}