v1alpha1

type BGPCommunity string

type BGPVIPConfig struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is the standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	// +required
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec is the desired BGP VIP peering configuration.
	// +required
	Spec BGPVIPConfigSpec `json:"spec,omitempty,omitzero"`

	// status reports the consumers' progress applying the configuration.
	// +optional
	Status BGPVIPConfigStatus `json:"status,omitempty,omitzero"`
}

type BGPVIPConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []BGPVIPConfig `json:"items"`
}

type BGPVIPConfigSpec struct {
	// localASN is the BGP autonomous system number (ASN) the cluster's BGP
	// speakers present to the configured peers. Use the ASN your network
	// administrator assigned to the cluster - the peer routers must expect
	// it or no session establishes; private-range ASNs (e.g. 64512-65534)
	// are typical for datacenter fabrics. Must be at least 1 and must not
	// exceed 4294967295.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=4294967295
	// +required
	LocalASN int64 `json:"localASN,omitempty"`

	// defaultPeers are the BGP peers every node establishes sessions with,
	// unless the node is named in hostOverrides. Must have at least 1 entry
	// and must not exceed 16 entries, unique by peerAddress.
	// +listType=map
	// +listMapKey=peerAddress
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=16
	// +required
	DefaultPeers []BGPVIPPeer `json:"defaultPeers,omitempty"`

	// communities are BGP community strings attached to the VIP
	// advertisements: "n:n" classic communities (RFC 1997) where each
	// segment is a 16-bit value of at least 0 and not exceeding 65535, or
	// "n:n:n" large communities (RFC 8092) where each segment is a 32-bit
	// value of at least 0 and not exceeding 4294967295. When omitted, no
	// communities are attached. Entries are unique; when set, must have at
	// least 1 entry and must not exceed 8 entries.
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=8
	// +optional
	Communities []BGPCommunity `json:"communities,omitempty"`

	// hostOverrides replaces (does not merge with) defaultPeers for the
	// named nodes. Only the per-node peer file rendered by the
	// machine-config-operator consumes overrides; the cluster-wide session
	// configuration rendered by the cluster-network-operator uses
	// defaultPeers. When omitted, all nodes use defaultPeers; when set, must
	// have at least 1 entry and must not exceed 256 entries, unique by
	// hostname.
	// +listType=map
	// +listMapKey=hostname
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=256
	// +optional
	HostOverrides []BGPVIPHostPeers `json:"hostOverrides,omitempty"`
}

type BGPVIPConfigStatus struct {
	// conditions reports the state of processing the configuration; when
	// set, must have at least 1 entry and must not exceed 8 entries. Known
	// condition types are "Rendered" (the machine-config-operator has
	// rendered the per-node peer configuration) and "SessionsConfigured"
	// (the cluster-network-operator has rendered the FRR session
	// configuration for application). SessionsConfigured does not assert
	// that the generated FRRConfiguration was accepted by the frr-k8s
	// admission webhook or applied on the nodes. Each condition's
	// observedGeneration reports the generation of the spec most recently
	// processed by the operator that writes it.
	// +listType=map
	// +listMapKey=type
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=8
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type BGPVIPHostPeers struct {
	// hostname of the node this override applies to, as a non-empty RFC
	// 1123 subdomain of at most 253 characters with dot-separated labels of
	// at most 63 characters each. It is compared verbatim against
	// the hostname the node resolves for itself (as rendered into the
	// per-node peer file), so a short name and its fully qualified form are
	// distinct entries and only the exact match applies.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?)*$')",message="hostname must be an RFC 1123 subdomain with labels of at most 63 characters"
	// +required
	Hostname string `json:"hostname,omitempty"`

	// peers replaces defaultPeers for this node. Must have at least 1 entry
	// and must not exceed 16 entries, unique by peerAddress.
	// +listType=map
	// +listMapKey=peerAddress
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=16
	// +required
	Peers []BGPVIPPeer `json:"peers,omitempty"`
}

type BGPVIPPasswordSecret struct {
	// name is the metadata.name of the referenced Secret in the
	// openshift-config namespace. Must be a non-empty RFC 1123 subdomain of
	// at most 253 characters, matching what Kubernetes accepts as a Secret
	// name.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$')",message="name must be a lowercase RFC 1123 subdomain"
	// +required
	Name string `json:"name,omitempty"`
}

type BGPVIPPeer struct {
	// peerAddress is the IP address of the BGP peer (IPv4 or IPv6) in
	// canonical form (lowercase, no leading zeros, IPv6 zero-compressed);
	// must be at least 2 characters in length and must not exceed 45
	// characters. The session's address family follows the address family
	// of this value. Canonical form is required so that two
	// spellings of one address cannot form duplicate peers.
	// +kubebuilder:validation:MinLength=2
	// +kubebuilder:validation:MaxLength=45
	// +kubebuilder:validation:XValidation:rule="isIP(self) && ip.isCanonical(self)",message="peerAddress must be a valid IP address in canonical form"
	// +required
	PeerAddress string `json:"peerAddress,omitempty"`

	// peerASN is the autonomous system number of the peer. Must be at
	// least 1 and must not exceed 4294967295.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=4294967295
	// +required
	PeerASN int64 `json:"peerASN,omitempty"`

	// passwordSecret references the Secret carrying the TCP MD5 password
	// (RFC 2385) for the session. The Secret must be of type
	// kubernetes.io/basic-auth, live in the openshift-config namespace, and
	// carry the password in its "password" key (at most 80 bytes, the
	// kernel's TCP MD5 limit). The Secret type, key, and size requirements
	// are not validated by the API server; the consumers validate them when
	// resolving the reference and must never surface the Secret contents in
	// status, events, or logs. Passwords are never stored in this API. When
	// omitted, the session is unauthenticated.
	// +optional
	PasswordSecret BGPVIPPasswordSecret `json:"passwordSecret,omitempty,omitzero"`

	// port is the TCP port of the BGP session; must be at least 1 and must
	// not exceed 65535. When omitted, port 179 is used.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +optional
	Port int32 `json:"port,omitempty"`

	// failureDetection determines how a failed peer is detected. When set
	// to "BFD", a BFD session is established with the peer and BGP reacts
	// to BFD failure detection. When set to "HoldTimer", failure detection
	// relies on the BGP hold timer alone. When omitted, failure detection
	// relies on the BGP hold timer.
	// +optional
	FailureDetection FailureDetectionMode `json:"failureDetection,omitempty"`

	// peerReachability describes how the peer is reached. When set to
	// "MultiHop", the session may be established with a peer several
	// router hops away. When set to "DirectlyConnected", the peer must be
	// on a directly connected network. When omitted, the peer must be
	// directly connected.
	// +optional
	PeerReachability PeerReachabilityMode `json:"peerReachability,omitempty"`

	// holdTimeSeconds is the BGP hold time in seconds; must be at least 3
	// (the RFC 4271 minimum for a non-zero hold time) and must not exceed
	// 65535. When omitted, no hold time is configured and the FRR default
	// (180 seconds) applies.
	// When both holdTimeSeconds and keepaliveTimeSeconds are set,
	// holdTimeSeconds must be at least 3 times keepaliveTimeSeconds.
	// +kubebuilder:validation:Minimum=3
	// +kubebuilder:validation:Maximum=65535
	// +optional
	HoldTimeSeconds int32 `json:"holdTimeSeconds,omitempty"`

	// keepaliveTimeSeconds is the BGP keepalive interval in seconds; must
	// be at least 1 and must not exceed 65535. When omitted, no keepalive
	// interval is configured and the FRR default (60 seconds) applies. When both
	// holdTimeSeconds and keepaliveTimeSeconds are set, holdTimeSeconds
	// must be at least 3 times keepaliveTimeSeconds.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +optional
	KeepaliveTimeSeconds int32 `json:"keepaliveTimeSeconds,omitempty"`
}

type FailureDetectionMode string

type ImageDigestFormat string

type InternalReleaseImage struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is the standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	// +required
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec describes the configuration of this internal release image.
	// +required
	Spec InternalReleaseImageSpec `json:"spec,omitempty,omitzero"`

	// status describes the last observed state of this internal release image.
	// +optional
	Status InternalReleaseImageStatus `json:"status,omitempty,omitzero"`
}

type InternalReleaseImageBundleStatus struct {
	// conditions represent the observations of an internal release image current state. Valid types are:
	// Mounted, Installing, Available, Removing and Degraded.
	//
	// If Mounted is true, that means that a valid ISO has been discovered and mounted on one of the cluster nodes.
	// If Installing is true, that means that a new release bundle is currently being copied on one (or more) cluster nodes, and not yet completed.
	// If Available is true, it means that the release has been previously installed on all the cluster nodes, and it can be used.
	// If Removing is true, it means that a release deletion is in progress on one (or more) cluster nodes, and not yet completed.
	// If Degraded is true, that means something has gone wrong (possibly on one or more cluster nodes).
	//
	// In general, after installing a new release bundle, it is required to wait for the Conditions "Available" to become "True" (and all
	// the other conditions to be equal to "False") before being able to pull its content.
	//
	// +listType=map
	// +listMapKey=type
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=5
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// name indicates the desired release bundle identifier. This field is required and must be between 1 and 64 characters long.
	// The expected name format is ocp-release-bundle-<version>-<arch|stream>.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=64
	// +kubebuilder:validation:XValidation:rule=`self.matches('^ocp-release-bundle-[0-9]+\\.[0-9]+\\.[0-9]+-[A-Za-z0-9._-]+$')`,message="must be ocp-release-bundle-<version>-<arch|stream> and <= 64 chars"
	// +required
	Name string `json:"name,omitempty"`
	// image is an OCP release image referenced by digest.
	// The format of the image pull spec is: host[:port][/namespace]/name@sha256:<digest>,
	// where the digest must be 64 characters long, and consist only of lowercase hexadecimal characters, a-f and 0-9.
	// The length of the whole spec must be between 1 to 447 characters.
	// The field is optional, and it will be provided after a release will be successfully installed.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=447
	// +kubebuilder:validation:XValidation:rule=`(self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))`,message="the OCI Image reference must end with a valid '@sha256:<digest>' suffix, where '<digest>' is 64 characters long"
	// +kubebuilder:validation:XValidation:rule=`(self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?/([a-zA-Z0-9-_]{0,61}/)?[a-zA-Z0-9-_.]*?$'))`,message="the OCI Image name should follow the host[:port][/namespace]/name format, resembling a valid URL without the scheme"
	// +optional
	Image string `json:"image,omitempty"`
}

type InternalReleaseImageConditionType string

type InternalReleaseImageList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is the standard list's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	metav1.ListMeta `json:"metadata"`

	Items []InternalReleaseImage `json:"items"`
}

type InternalReleaseImageRef struct {
	// name indicates the desired release bundle identifier. This field is required and must be between 1 and 64 characters long.
	// The expected name format is ocp-release-bundle-<version>-<arch|stream>.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=64
	// +kubebuilder:validation:XValidation:rule=`self.matches('^ocp-release-bundle-[0-9]+\\.[0-9]+\\.[0-9]+-[A-Za-z0-9._-]+$')`,message="must be ocp-release-bundle-<version>-<arch|stream> and <= 64 chars"
	Name string `json:"name,omitempty"`
}

type InternalReleaseImageSpec struct {
	// releases is a list of release bundle identifiers that the user wants to
	// add/remove to/from the control plane nodes.
	// Entries must be unique, keyed on the name field.
	// releases must contain at least one entry and must not exceed 16 entries.
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=16
	// +listType=map
	// +listMapKey=name
	// +required
	Releases []InternalReleaseImageRef `json:"releases,omitempty"`
}

type InternalReleaseImageStatus struct {
	// conditions represent the observations of the InternalReleaseImage controller current state.
	// Valid types are: Degraded.
	// If Degraded is true, that means something has gone wrong in the controller.
	// +listType=map
	// +listMapKey=type
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=20
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// releases is a list of the release bundles currently owned and managed by the
	// cluster.
	// A release bundle content could be safely pulled only when its Conditions field
	// contains at least an Available entry set to "True" and Degraded to "False".
	// Entries must be unique, keyed on the name field.
	// releases must contain at least one entry and must not exceed 32 entries.
	// +listType=map
	// +listMapKey=name
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=32
	// +required
	Releases []InternalReleaseImageBundleStatus `json:"releases,omitempty"`
}

type InternalReleaseImageStatusConditionType string

type OSImageStream struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is the standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec contains the desired OSImageStream config configuration.
	// +required
	Spec *OSImageStreamSpec `json:"spec,omitempty"`

	// status describes the last observed state of this OSImageStream.
	// Populated by the MachineConfigOperator after reading release metadata.
	// When not present, the controller has not yet reconciled this resource.
	// +optional
	Status OSImageStreamStatus `json:"status,omitempty,omitzero"`
}

type OSImageStreamList struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is the standard list's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	metav1.ListMeta `json:"metadata"`

	Items []OSImageStream `json:"items"`
}

type OSImageStreamSet struct {
	// name is the required identifier of the stream.
	//
	// name is determined by the operator based on the OCI label of the
	// discovered OS or Extension Image.
	//
	// Must be a valid RFC 1123 subdomain between 1 and 253 characters in length,
	// consisting of lowercase alphanumeric characters, hyphens ('-'), and periods ('.').
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="a RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character."
	Name string `json:"name,omitempty"`

	// osImage is a required OS Image referenced by digest.
	//
	// osImage contains the immutable, fundamental operating system components, including the kernel
	// and base utilities, that define the core environment for the node's host operating system.
	//
	// The format of the image pull spec is: host[:port][/namespace]/name@sha256:<digest>,
	// where the digest must be 64 characters long, and consist only of lowercase hexadecimal characters, a-f and 0-9.
	// The length of the whole spec must be between 1 to 447 characters.
	// +required
	OSImage ImageDigestFormat `json:"osImage,omitempty"`

	// osExtensionsImage is a required OS Extensions Image referenced by digest.
	//
	// osExtensionsImage bundles the extra repositories used to enable extensions, augmenting
	// the base operating system without modifying the underlying immutable osImage.
	//
	// The format of the image pull spec is: host[:port][/namespace]/name@sha256:<digest>,
	// where the digest must be 64 characters long, and consist only of lowercase hexadecimal characters, a-f and 0-9.
	// The length of the whole spec must be between 1 to 447 characters.
	// +required
	OSExtensionsImage ImageDigestFormat `json:"osExtensionsImage,omitempty"`
}

type OSImageStreamSpec struct {
	// defaultStream is the desired name of the stream that should be used as the
	// default when no specific stream is requested by a MachineConfigPool.
	//
	// This field is set by the installer during installation. Users may need to
	// update it if the currently selected stream is no longer available, for
	// example when the stream has reached its End of Life.
	// The MachineConfigOperator uses this value to determine which stream from
	// status.availableStreams to apply as the default for MachineConfigPools
	// that do not specify a stream override.
	//
	// When status.availableStreams has been populated by the operator, updating
	// this field requires that the new value references the name of one of the
	// streams in status.availableStreams. Status-only updates by the operator
	// are not subject to this constraint, allowing the operator to update
	// availableStreams independently of this field.
	// During initial creation, before the operator has populated status, any
	// valid value is accepted.
	//
	// When omitted, the operator determines the default stream automatically.
	// Once set, this field cannot be removed.
	//
	// It must be a valid RFC 1123 subdomain between 1 and 253 characters in length,
	// consisting of lowercase alphanumeric characters, hyphens ('-'), and periods ('.').
	//
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="a RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character."
	DefaultStream string `json:"defaultStream,omitempty"`
}

type OSImageStreamStatus struct {

	// availableStreams is a list of the available OS Image Streams that can be
	// used as the base image for MachineConfigPools.
	// availableStreams is required, must have at least one item, must not exceed
	// 100 items, and must have unique entries keyed on the name field.
	//
	// +required
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	// +listType=map
	// +listMapKey=name
	AvailableStreams []OSImageStreamSet `json:"availableStreams,omitempty"`

	// defaultStream is the name of the stream that should be used as the default
	// when no specific stream is requested by a MachineConfigPool.
	//
	// It must be a valid RFC 1123 subdomain between 1 and 253 characters in length,
	// consisting of lowercase alphanumeric characters, hyphens ('-'), and periods ('.'),
	// and must reference the name of one of the streams in availableStreams.
	//
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="a RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character."
	DefaultStream string `json:"defaultStream,omitempty"`
}

type PeerReachabilityMode string