v1

type AWSProviderSpec struct {
	metav1.TypeMeta `json:",inline"`
	// StatementEntries contains a list of policy statements that should be associated with this credentials access key.
	StatementEntries []StatementEntry `json:"statementEntries"`
	// stsIAMRoleARN is the Amazon Resource Name (ARN) of an IAM Role which was created manually for the associated
	// CredentialsRequest.
	// The presence of an stsIAMRoleARN within the AWSProviderSpec initiates creation of a secret containing IAM
	// Role details necessary for assuming the IAM Role via Amazon's Secure Token Service.
	// +optional
	STSIAMRoleARN string `json:"stsIAMRoleARN,omitempty"`
}

type AWSProviderStatus struct {
	metav1.TypeMeta `json:",inline"`
	// User is the name of the User created in AWS for these credentials.
	User string `json:"user"`
	// Policy is the name of the policy attached to the user in AWS.
	Policy string `json:"policy"`
}

type AccessPolicy struct {
	// Attributes identify the resources to which this policy applies
	Attributes []ResourceAttribute `json:"attributes"`

	// Roles are the IAM roles assigned to this policy
	Roles []string `json:"roles"`
}

type AzureProviderSpec struct {
	metav1.TypeMeta `json:",inline"`

	// RoleBindings contains a list of roles that should be associated with the minted credential.
	RoleBindings []RoleBinding `json:"roleBindings"`

	// Permissions is the list of Azure permissions required to create a more fine-grained custom role to
	// satisfy the CredentialsRequest.
	// The Permissions field may be provided in addition to RoleBindings. When both fields are specified,
	// the user-assigned managed identity will have union of permissions defined from both Permissions
	// and RoleBindings.
	// +optional
	Permissions []string `json:"permissions,omitempty"`

	// DataPermissions is the list of Azure data permissions required to create a more fine-grained custom
	// role to satisfy the CredentialsRequest.
	// The DataPermissions field may be provided in addition to RoleBindings. When both fields are specified,
	// the user-assigned managed identity will have union of permissions defined from both DataPermissions
	// and RoleBindings.
	// +optional
	DataPermissions []string `json:"dataPermissions,omitempty"`

	// The following fields are only required for Azure Workload Identity.
	// AzureClientID is the ID of the specific application you created in Azure
	// +optional
	AzureClientID string `json:"azureClientID,omitempty"`

	// AzureRegion is the geographic region of the Azure service.
	// +optional
	AzureRegion string `json:"azureRegion,omitempty"`

	// Each Azure subscription has an ID associated with it, as does the tenant to which a subscription belongs.
	// AzureSubscriptionID is the ID of the subscription.
	// +optional
	AzureSubscriptionID string `json:"azureSubscriptionID,omitempty"`

	// AzureTenantID is the ID of the tenant to which the subscription belongs.
	// +optional
	AzureTenantID string `json:"azureTenantID,omitempty"`
}

type AzureProviderStatus struct {
	metav1.TypeMeta `json:",inline"`

	// ServicePrincipalName is the name of the service principal created in Azure for these credentials.
	ServicePrincipalName string `json:"name"`

	// AppID is the application id of the service principal created in Azure for these credentials.
	AppID string `json:"appID"`

	// SecretLastResourceVersion is the resource version of the secret resource
	// that was last synced. Used to determine if the object has changed and
	// requires a sync.
	SecretLastResourceVersion string `json:"secretLastResourceVersion"`
}

type CredentialsRequest struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +kubebuilder:validation:Required
	// +required
	Spec   CredentialsRequestSpec   `json:"spec"`
	Status CredentialsRequestStatus `json:"status,omitempty"`
}

type CredentialsRequestCondition struct {
	// Type is the specific type of the condition
	// +kubebuilder:validation:Required
	// +required
	Type CredentialsRequestConditionType `json:"type"`
	// Status is the status of the condition
	// +kubebuilder:validation:Required
	// +required
	Status corev1.ConditionStatus `json:"status"`
	// LastProbeTime is the last time we probed the condition
	LastProbeTime metav1.Time `json:"lastProbeTime,omitempty"`
	// LastTransitionTime is the last time the condition transitioned from one status to another.
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
	// Reason is a unique, one-word, CamelCase reason for the condition's last transition
	Reason string `json:"reason,omitempty"`
	// Message is a human-readable message indicating details about the last transition
	Message string `json:"message,omitempty"`
}

type CredentialsRequestConditionType string

type CredentialsRequestList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CredentialsRequest `json:"items"`
}

type CredentialsRequestSpec struct {
	// SecretRef points to the secret where the credentials should be stored once generated.
	// +kubebuilder:validation:Required
	// +required
	SecretRef corev1.ObjectReference `json:"secretRef"`

	// ProviderSpec contains the cloud provider specific credentials specification.
	// +kubebuilder:pruning:PreserveUnknownFields
	ProviderSpec *runtime.RawExtension `json:"providerSpec,omitempty"`

	// ServiceAccountNames contains a list of ServiceAccounts that will use permissions associated with this
	// CredentialsRequest. This is not used by CCO, but the information is needed for being able to properly
	// set up access control in the cloud provider when the ServiceAccounts are used as part of the cloud
	// credentials flow.
	// +optional
	ServiceAccountNames []string `json:"serviceAccountNames,omitempty"`

	// cloudTokenPath is the path where the Kubernetes ServiceAccount token (JSON Web Token) is mounted
	// on the deployment for the workload requesting a credentials secret.
	// The presence of this field in combination with fields such as spec.providerSpec.stsIAMRoleARN
	// indicate that CCO should broker creation of a credentials secret containing fields necessary for
	// token based authentication methods such as with the AWS Secure Token Service (STS).
	//
	// cloudTokenPath may also be used to specify the azure_federated_token_file path used
	// in Azure configuration secrets generated by ccoctl.
	// Defaults to "/var/run/secrets/openshift/serviceaccount/token".
	// +optional
	CloudTokenPath string `json:"cloudTokenPath,omitempty"`
}

type CredentialsRequestStatus struct {
	// Provisioned is true once the credentials have been initially provisioned.
	// +kubebuilder:validation:Required
	// +required
	Provisioned bool `json:"provisioned"`

	// LastSyncTimestamp is the time that the credentials were last synced.
	LastSyncTimestamp *metav1.Time `json:"lastSyncTimestamp,omitempty"`

	// LastSyncGeneration is the generation of the credentials request resource
	// that was last synced. Used to determine if the object has changed and
	// requires a sync.
	// +kubebuilder:validation:Required
	// +required
	LastSyncGeneration int64 `json:"lastSyncGeneration"`

	// LastSyncCloudCredsSecretResourceVersion is the resource version of the
	// cloud credentials secret resource when the credentials request resource
	// was last synced. Used to determine if the cloud credentials have
	// been updated since the last sync.
	// +optional
	LastSyncCloudCredsSecretResourceVersion string `json:"lastSyncCloudCredsSecretResourceVersion,omitempty"`

	// LastSyncInfrastructureResourceVersion is the resource version of the
	// Infrastructure resource. It is used to determine if the user provided tags have
	// been updated since the last sync.
	// +optional
	LastSyncInfrastructureResourceVersion string `json:"lastSyncInfrastructureResourceVersion,omitempty"`

	// ProviderStatus contains cloud provider specific status.
	// +kubebuilder:pruning:PreserveUnknownFields
	ProviderStatus *runtime.RawExtension `json:"providerStatus,omitempty"`

	// Conditions includes detailed status for the CredentialsRequest
	// +optional
	Conditions []CredentialsRequestCondition `json:"conditions,omitempty"`
}

type GCPProviderSpec struct {
	metav1.TypeMeta `json:",inline"`
	// PredefinedRoles is the list of GCP pre-defined roles
	// that the CredentialsRequest requires.
	PredefinedRoles []string `json:"predefinedRoles"`
	// Permissions is the list of GCP permissions required to create a more fine-grained custom role to
	// satisfy the CredentialsRequest.
	// The Permissions field may be provided in addition to PredefinedRoles. When both fields are specified,
	// the service account will have union of permissions defined from both Permissions and PredefinedRoles.
	// +optional
	Permissions []string `json:"permissions,omitempty"`
	// SkipServiceCheck can be set to true to skip the check whether the requested roles or permissions
	// have the necessary services enabled
	// +optional
	SkipServiceCheck bool `json:"skipServiceCheck,omitempty"`

	// ServiceAccountEmail that will be impersonated during Workload Identity Federation.
	// +optional
	ServiceAccountEmail string `json:"serviceAccountEmail,omitempty"`

	// Audience that will be used with Workload Identity Federation.
	// It should be formatted as follows:
	// "//iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<POOL_ID>/providers/<PROVIDER_ID>"
	// For more information see https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#create-credential-config
	Audience string `json:"audience,omitempty"`
}

type GCPProviderStatus struct {
	metav1.TypeMeta `json:",inline"`
	// ServiceAccountID is the ID of the service account created in GCP for the requested credentials.
	ServiceAccountID string `json:"serviceAccountID"`
	// RoleID is the ID of the custom role created in GCP for the requested permissions apart from
	// permissions granted by the pre-defined roles.
	// RoleID is set by the Cloud Credential Operator controllers and should not be set manually.
	// +optional
	RoleID string `json:"roleID,omitempty"`
}

type IAMPolicyCondition map[string]IAMPolicyConditionKeyValue

type IAMPolicyConditionKeyValue map[string]interface{}

type IBMCloudPowerVSProviderSpec struct {
	metav1.TypeMeta `json:",inline"`

	// Policies are a list of access policies to create for the generated credentials
	Policies []AccessPolicy `json:"policies"`
}

type IBMCloudPowerVSProviderStatus struct {
	metav1.TypeMeta `json:",inline"`
}

type IBMCloudProviderSpec struct {
	metav1.TypeMeta `json:",inline"`

	// Policies are a list of access policies to create for the generated credentials
	Policies []AccessPolicy `json:"policies"`
}

type IBMCloudProviderStatus struct {
	metav1.TypeMeta `json:",inline"`
}

type KubevirtProviderSpec struct {
	metav1.TypeMeta `json:",inline"`
}

type KubevirtProviderStatus struct {
	metav1.TypeMeta `json:",inline"`
}

type NutanixProviderSpec struct {
	metav1.TypeMeta `json:",inline"`
}

type NutanixProviderStatus struct {
	metav1.TypeMeta `json:",inline"`
}

type OpenStackProviderSpec struct {
	metav1.TypeMeta `json:",inline"`
}

type OpenStackProviderStatus struct {
	metav1.TypeMeta `json:",inline"`
}

type OvirtProviderSpec struct {
	metav1.TypeMeta `json:",inline"`
}

type OvirtProviderStatus struct {
	metav1.TypeMeta `json:",inline"`
}

type ProviderCodec struct {
	// contains filtered or unexported fields
}

type ResourceAttribute struct {
	// Name is the name of an attribute.
	Name string `json:"name"`

	// Value is the value of an attribute.
	Value string `json:"value"`

	// Operator is the operator of an attribute.
	Operator string `json:"operator,omitempty"`
}

type RoleBinding struct {
	// Role defines a set of permissions that should be associated with the minted credential.
	Role string `json:"role"`
}

type StatementEntry struct {
	// Effect indicates if this policy statement is to Allow or Deny.
	Effect string `json:"effect"`
	// Action describes the particular AWS service actions that should be allowed or denied. (i.e. ec2:StartInstances, iam:ChangePassword)
	Action []string `json:"action"`
	// Resource specifies the object(s) this statement should apply to. (or "*" for all)
	Resource string `json:"resource"`
	// PolicyCondition specifies under which condition StatementEntry will apply
	PolicyCondition IAMPolicyCondition `json:"policyCondition,omitempty"`
}

type VSpherePermission struct {
	// Privileges is the list of access being requested.
	Privileges []string `json:"privileges"`
}

type VSphereProviderSpec struct {
	metav1.TypeMeta `json:",inline"`

	// Permissions contains a list of groups of privileges that are being requested.
	Permissions []VSpherePermission `json:"permissions"`
}

type VSphereProviderStatus struct {
	metav1.TypeMeta `json:",inline"`

	// SecretLastResourceVersion is the resource version of the secret resource
	// that was last synced. Used to determine if the object has changed and
	// requires a sync.
	SecretLastResourceVersion string `json:"secretLastResourceVersion"`
}