azure

type BootDiagnostics struct {
	// Type specifies the boot diagnostics type for the machines created.
	// Defaults as disabled for compute nodes and as managed for control plane
	// nodes.
	// Values allowed are Disabled, Managed and UserManaged.
	// +kubebuilder:validation:Enum=Disabled;Managed;UserManaged
	Type capz.BootDiagnosticsStorageAccountType `json:"type"`

	// ResourceGroup specifies the name of the resource group where the
	// storage account to be used for diagnostics storage is present.
	// Only used if the type is set to UserManaged.
	ResourceGroup string `json:"resourceGroup"`

	// StorageAccountName specifies the storage account where the diagnostics
	// logs need to be stored.
	// Only used if the type is set to UserManaged.
	StorageAccountName string `json:"storageAccountName"`
}

type CloudEnvironment string

type ConfidentialVM struct {
	// UEFISettings specifies the security settings like secure boot and vTPM used while creating the virtual machine.
	// +kubebuilder:validation:Required
	UEFISettings *UEFISettings `json:"uefiSettings,omitempty"`
}

type CustomerManagedKey struct {
	// KeyVault is the keyvault used for the customer created key required for encryption.
	KeyVault KeyVault `json:"keyVault,omitempty"`
	// UserAssignedIdentityKey is the name of the user identity that has access to the managed key.
	UserAssignedIdentityKey string `json:"userAssignedIdentityKey,omitempty"`
}

type DiskEncryptionSet struct {
	// SubscriptionID defines the Azure subscription the disk encryption
	// set is in.
	SubscriptionID string `json:"subscriptionId"`
	// ResourceGroup defines the Azure resource group used by the disk
	// encryption set.
	ResourceGroup string `json:"resourceGroup"`
	// Name is the name of the disk encryption set.
	Name string `json:"name"`
}

type ImagePurchasePlan string

type KeyVault struct {
	// ResourceGroup defines the Azure resource group used by the key
	// vault.
	ResourceGroup string `json:"resourceGroup"`
	// Name is the name of the key vault.
	Name string `json:"name"`
	// KeyName is the name of the key vault key.
	KeyName string `json:"keyName"`
}

type MachinePool struct {
	// Zones is list of availability zones that can be used.
	// eg. ["1", "2", "3"]
	//
	// +optional
	Zones []string `json:"zones,omitempty"`

	// InstanceType defines the azure instance type.
	// eg. Standard_DS_V2
	//
	// +optional
	InstanceType string `json:"type"`

	// EncryptionAtHost enables encryption at the VM host.
	//
	// +optional
	EncryptionAtHost bool `json:"encryptionAtHost,omitempty"`

	// OSDisk defines the storage for instance.
	//
	// +optional
	OSDisk `json:"osDisk"`

	// ultraSSDCapability defines if the instance should use Ultra SSD disks.
	//
	// +optional
	// +kubebuilder:validation:Enum=Enabled;Disabled
	UltraSSDCapability string `json:"ultraSSDCapability,omitempty"`

	// VMNetworkingType specifies whether to enable accelerated networking.
	// Accelerated networking enables single root I/O virtualization (SR-IOV) to a VM, greatly improving its
	// networking performance.
	// eg. values: "Accelerated", "Basic"
	//
	// +kubebuilder:validation:Enum="Accelerated"; "Basic"
	// +optional
	VMNetworkingType string `json:"vmNetworkingType,omitempty"`

	// BootDiagnostics has the value for the storage account URI where the
	// machine log information of the control plane is sent to.
	// Defaults to managed for control plane if no value is mentioned.
	// +optional
	BootDiagnostics *BootDiagnostics `json:"bootDiagnostics,omitempty"`

	// OSImage defines the image to use for the OS.
	// +optional
	OSImage OSImage `json:"osImage,omitempty"`

	// Settings specify the security type and the UEFI settings of the virtual machine. This field can
	// be set for Confidential VMs and Trusted Launch for VMs.
	// +optional
	Settings *SecuritySettings `json:"settings,omitempty"`

	// Identity is the type of identity used for the virtual machine.
	// The type 'UserAssigned' is a standalone Azure resource provided by the user
	// and assigned to the VM.
	// The default identity is a user-assigned identity, generated by the installer.
	// This default is expected to change in future releases.
	// +kubebuilder:default=UserAssigned
	// +optional
	Identity *VMIdentity `json:"identity,omitempty"`

	// DataDisk specifies the parameters that are used to add one or more data disks to the machine.
	// +optional
	DataDisks []capz.DataDisk `json:"dataDisks,omitempty"`
}

type Metadata struct {
	ARMEndpoint                 string           `json:"armEndpoint"`
	CloudName                   CloudEnvironment `json:"cloudName"`
	Region                      string           `json:"region"`
	ResourceGroupName           string           `json:"resourceGroupName"`
	BaseDomainResourceGroupName string           `json:"baseDomainResourceGroupName"`
}

type OSDisk struct {
	// DiskSizeGB defines the size of disk in GB.
	//
	// +kubebuilder:validation:Minimum=0
	DiskSizeGB int32 `json:"diskSizeGB"`
	// DiskType defines the type of disk.
	// For control plane nodes, the valid values are Premium_LRS and StandardSSD_LRS.
	// Default is Premium_LRS.
	// +optional
	// +kubebuilder:validation:Enum=Standard_LRS;Premium_LRS;StandardSSD_LRS
	DiskType string `json:"diskType"`
	// DiskEncryptionSet defines a disk encryption set.
	//
	// +optional
	*DiskEncryptionSet `json:"diskEncryptionSet,omitempty"`
	// SecurityProfile specifies the security profile for the managed disk.
	// +optional
	SecurityProfile *VMDiskSecurityProfile `json:"securityProfile,omitempty"`
}

type OSImage struct {
	// Plan is the purchase plan of the image.
	// If omitted, it defaults to "WithPurchasePlan".
	// +optional
	Plan ImagePurchasePlan `json:"plan"`
	// Publisher is the publisher of the image.
	Publisher string `json:"publisher"`
	// Offer is the offer of the image.
	Offer string `json:"offer"`
	// SKU is the SKU of the image.
	SKU string `json:"sku"`
	// Version is the version of the image.
	Version string `json:"version"`
}

type OutboundType string

type Platform struct {
	// Region specifies the Azure region where the cluster will be created.
	Region string `json:"region"`

	// ARMEndpoint is the endpoint for the Azure API when installing on Azure Stack.
	ARMEndpoint string `json:"armEndpoint,omitempty"`

	// ClusterOSImage is the url of a storage blob in the Azure Stack environment containing an RHCOS VHD. This field is required for Azure Stack and not applicable to Azure.
	ClusterOSImage string `json:"clusterOSImage,omitempty"`

	// BaseDomainResourceGroupName specifies the resource group where the Azure DNS zone for the base domain is found. This field is optional when creating a private cluster, otherwise required.
	//
	// +optional
	BaseDomainResourceGroupName string `json:"baseDomainResourceGroupName,omitempty"`

	// DefaultMachinePlatform is the default configuration used when
	// installing on Azure for machine pools which do not define their own
	// platform configuration.
	// +optional
	DefaultMachinePlatform *MachinePool `json:"defaultMachinePlatform,omitempty"`

	// NetworkResourceGroupName specifies the network resource group that contains an existing VNet
	//
	// +optional
	NetworkResourceGroupName string `json:"networkResourceGroupName,omitempty"`

	// VirtualNetwork specifies the name of an existing VNet for the installer to use
	//
	// +optional
	VirtualNetwork string `json:"virtualNetwork,omitempty"`

	// ControlPlaneSubnet specifies an existing subnet for use by the control plane nodes
	//
	// Deprecated: use platform.Azure.Subnets section
	// +optional
	DeprecatedControlPlaneSubnet string `json:"controlPlaneSubnet,omitempty"`

	// ComputeSubnet specifies an existing subnet for use by compute nodes
	//
	// Deprecated: use platform.Azure.Subnets section
	// +optional
	DeprecatedComputeSubnet string `json:"computeSubnet,omitempty"`

	// cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK
	// with the appropriate Azure API endpoints.
	// If empty, the value is equal to "AzurePublicCloud".
	// +optional
	CloudName CloudEnvironment `json:"cloudName,omitempty"`

	// OutboundType is a strategy for how egress from cluster is achieved. When not specified default is "Loadbalancer".
	//
	// +kubebuilder:default=Loadbalancer
	// +optional
	OutboundType OutboundType `json:"outboundType"`

	// Subnets is the list of subnets the user can bring into the cluster to be used.
	//
	// +optional
	Subnets []SubnetSpec `json:"subnets,omitempty"`

	// ResourceGroupName is the name of an already existing resource group where the cluster should be installed.
	// This resource group should only be used for this specific cluster and the cluster components will assume
	// ownership of all resources in the resource group. Destroying the cluster using installer will delete this
	// resource group.
	// This resource group must be empty with no other resources when trying to use it for creating a cluster.
	// If empty, a new resource group will created for the cluster.
	//
	// +optional
	ResourceGroupName string `json:"resourceGroupName,omitempty"`

	// UserTags has additional keys and values that the installer will add
	// as tags to all resources that it creates on AzurePublicCloud alone.
	// Resources created by the cluster itself may not include these tags.
	// +optional
	UserTags map[string]string `json:"userTags,omitempty"`

	// CustomerManagedKey has the keys needed to encrypt the storage account.
	CustomerManagedKey *CustomerManagedKey `json:"customerManagedKey,omitempty"`

	// UserProvisionedDNS indicates if the customer is providing their own DNS solution in place of the default
	// provisioned by the Installer.
	// +kubebuilder:default:="Disabled"
	// +default="Disabled"
	// +kubebuilder:validation:Enum="Enabled";"Disabled"
	UserProvisionedDNS dns.UserProvisionedDNS `json:"userProvisionedDNS,omitempty"`
}

type SecurityEncryptionTypes string

type SecuritySettings struct {
	// SecurityType specifies the SecurityType of the virtual machine. It has to be set to any specified value to
	// enable secure boot and vTPM. The default behavior is: secure boot and vTPM will not be enabled unless this property is set.
	// +kubebuilder:validation:Enum=ConfidentialVM;TrustedLaunch
	// +kubebuilder:validation:Required
	SecurityType SecurityTypes `json:"securityType,omitempty"`

	// ConfidentialVM specifies the security configuration of the virtual machine.
	// For more information regarding Confidential VMs, please refer to:
	// https://learn.microsoft.com/azure/confidential-computing/confidential-vm-overview
	// +optional
	ConfidentialVM *ConfidentialVM `json:"confidentialVM,omitempty"`

	// TrustedLaunch specifies the security configuration of the virtual machine.
	// For more information regarding TrustedLaunch for VMs, please refer to:
	// https://learn.microsoft.com/azure/virtual-machines/trusted-launch
	// +optional
	TrustedLaunch *TrustedLaunch `json:"trustedLaunch,omitempty"`
}

type SecurityTypes string

type SubnetSpec struct {
	// Name of the subnet.
	Name string `json:"name"`
	// Role specifies the actual role which the subnet should be used in.
	// +kubebuilder:validation:Enum=node;control-plane
	Role capz.SubnetRole `json:"role"`
}

type TrustedLaunch struct {
	// UEFISettings specifies the security settings like secure boot and vTPM used while creating the virtual machine.
	// +kubebuilder:validation:Required
	UEFISettings *UEFISettings `json:"uefiSettings,omitempty"`
}

type UEFISettings struct {
	// SecureBoot specifies whether secure boot should be enabled on the virtual machine.
	// Secure Boot verifies the digital signature of all boot components and halts the boot process if
	// signature verification fails.
	// If omitted, the platform chooses a default, which is subject to change over time, currently that default is disabled.
	// +kubebuilder:validation:Enum=Enabled;Disabled
	// +optional
	SecureBoot *string `json:"secureBoot,omitempty"`

	// VirtualizedTrustedPlatformModule specifies whether vTPM should be enabled on the virtual machine.
	// When enabled the virtualized trusted platform module measurements are used to create a known good boot integrity policy baseline.
	// The integrity policy baseline is used for comparison with measurements from subsequent VM boots to determine if anything has changed.
	// This is required to be set to enabled if the SecurityEncryptionType is defined.
	// If omitted, the platform chooses a default, which is subject to change over time, currently that default is disabled.
	// +kubebuilder:validation:Enum=Enabled;Disabled
	// +optional
	VirtualizedTrustedPlatformModule *string `json:"virtualizedTrustedPlatformModule,omitempty"`
}

type UserAssignedIdentity struct {
	// Name is the name of the user-assigned identity to be assigned to the node.
	Name string `json:"name"`

	// Subscription is the subscription that contains the user-assigned identity.
	Subscription string `json:"subscription"`

	// ResourceGroup is the resource group that contains the user-assigned identity.
	ResourceGroup string `json:"resourceGroup"`
}

type VMDiskSecurityProfile struct {
	// DiskEncryptionSet specifies the customer managed disk encryption set resource id for the
	// managed disk that is used for Customer Managed Key encrypted ConfidentialVM OS Disk and
	// VMGuestState blob.
	// +optional
	DiskEncryptionSet *DiskEncryptionSet `json:"diskEncryptionSet,omitempty"`
	// SecurityEncryptionType specifies the encryption type of the managed disk.
	// It is set to DiskWithVMGuestState to encrypt the managed disk along with the VMGuestState
	// blob, and to VMGuestStateOnly to encrypt the VMGuestState blob only.
	// When set to VMGuestStateOnly, the VTpmEnabled should be set to true.
	// When set to DiskWithVMGuestState, both SecureBootEnabled and VTpmEnabled should be set to true.
	// It can be set only for Confidential VMs.
	// +kubebuilder:validation:Enum=VMGuestStateOnly;DiskWithVMGuestState
	// +optional
	SecurityEncryptionType SecurityEncryptionTypes `json:"securityEncryptionType,omitempty"`
}

type VMIdentity struct {
	// Type specifies the type of identity to be used.
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=None;UserAssigned
	Type capz.VMIdentity `json:"type"`

	// UserAssignedIdentities is a list of identities to be attached to a node.
	// Only one user-assigned identity may be supplied.
	// Supplying more than one user-assigned identity is an experimental feature
	// which may be enabled with the MachineAPIMigration feature gate.
	UserAssignedIdentities []UserAssignedIdentity `json:"userAssignedIdentities"`
}

type VMNetworkingCapability string