v1alpha1

type ClusterNetworkSpec struct {
	// PodCIDR is the CIDR for the cluster's pod network.
	// Defaults to 10.128.0.0/14 if not specified.
	// +kubebuilder:validation:Optional
	// Coarse format check only — full CIDR validation (e.g. net.ParseCIDR) is done server-side.
	// +kubebuilder:validation:Pattern=`^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$`
	PodCIDR string `json:"podCIDR,omitempty"`
	// ServiceCIDR is the CIDR for the cluster's service network.
	// Defaults to 172.30.0.0/16 if not specified.
	// +kubebuilder:validation:Optional
	// Coarse format check only — full CIDR validation (e.g. net.ParseCIDR) is done server-side.
	// +kubebuilder:validation:Pattern=`^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$`
	ServiceCIDR string `json:"serviceCIDR,omitempty"`
}

type ClusterOrder struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterOrderSpec   `json:"spec,omitempty"`
	Status ClusterOrderStatus `json:"status,omitempty"`
}

type ClusterOrderClusterReferenceType struct {
	// Namespace that contains the HostedCluster resource
	Namespace          string `json:"namespace"`
	HostedClusterName  string `json:"hostedClusterName"`
	ServiceAccountName string `json:"serviceAccountName"`
	RoleBindingName    string `json:"roleBindingName"`
}

type ClusterOrderConditionType string

type ClusterOrderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterOrder `json:"items"`
}

type ClusterOrderPhaseType string

type ClusterOrderSpec struct {
	// TemplateID is the unique identigier of the cluster template to use when creating this cluster
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=^[a-zA-Z_][a-zA-Z0-9._]*$
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="templateID is immutable"
	TemplateID string `json:"templateID,omitempty"`
	// TemplateParameters is a JSON-encoded map of the parameter values for the
	// selected cluster template.
	// +kubebuilder:validation:Optional
	TemplateParameters string `json:"templateParameters,omitempty"`
	// NodeRequests defines the types of nodes and number of each type of node that will be used
	// to build the cluster. This value is optional and if not provided will be filled in with template-provided
	// defaults. The selected template may limit what node types you can request.
	// +kubebuilder:validation:Optional
	NodeRequests []NodeRequest `json:"nodeRequests,omitempty"`

	// PullSecret contains credentials for authenticating to container image repositories.
	// If not provided, the provider's default pull secret is used.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=262144
	PullSecret string `json:"pullSecret,omitempty"`
	// SSHPublicKey is an SSH public key installed on cluster worker nodes.
	// If not provided, the provider's default SSH key is used.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=16384
	SSHPublicKey string `json:"sshPublicKey,omitempty"`
	// ReleaseImage is the OCP release image URL that controls the OpenShift version.
	// If not provided, the template's default release image is used.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=512
	// +kubebuilder:validation:Pattern=`^.+/.+:.+$`
	ReleaseImage string `json:"releaseImage,omitempty"`
	// Network contains cluster networking configuration.
	// +kubebuilder:validation:Optional
	Network *ClusterNetworkSpec `json:"network,omitempty"`
}

type ClusterOrderStatus struct {
	// Phase provides a single-value overview of the state of the ClusterOrder
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Failed;Ready;Deleting
	Phase ClusterOrderPhaseType `json:"phase,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the ClusterOrder
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Reference to the namespace that contains the HostedCluster resource
	// +kubebuilder:validation:Optional
	ClusterReference *ClusterOrderClusterReferenceType `json:"clusterReference,omitempty"`

	// NodeRequests reflects how many nodes are currently associated with the ClusterOrder
	NodeRequests []NodeRequest `json:"nodeRequests,omitempty"`

	// ProvisioningJobs tracks the history of provision and deprovision operations
	// Ordered chronologically, with latest operations at the end
	// Limited to the last N jobs (configurable via OSAC_MAX_JOB_HISTORY, default 10)
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// ClusterStorageJobs holds the history of cluster storage provisioning/deprovisioning jobs
	// +kubebuilder:validation:Optional
	ClusterStorageJobs []JobStatus `json:"clusterStorageJobs,omitempty"`

	// DesiredConfigVersion is a hash of the current spec, used to detect spec changes
	// that require re-provisioning.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`
}

type ClusterStorageStatus struct {
	// ClusterName identifies the target cluster.
	ClusterName string `json:"clusterName"`
	// Ready indicates whether StorageClasses are installed on this cluster.
	Ready bool `json:"ready"`
	// Reason provides a machine-readable reason for the current state.
	Reason string `json:"reason,omitempty"`
}

type ComputeInstance struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of ComputeInstance
	// +required
	Spec ComputeInstanceSpec `json:"spec"`

	// status defines the observed state of ComputeInstance
	// +optional
	Status ComputeInstanceStatus `json:"status,omitempty,omitzero"`
}

type ComputeInstanceConditionType string

type ComputeInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComputeInstance `json:"items"`
}

type ComputeInstancePhaseType string

type ComputeInstanceSpec struct {
	// TemplateID is the unique identifier of the compute instance template to use when creating this compute instance
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=^[a-zA-Z_][a-zA-Z0-9._]*$
	TemplateID string `json:"templateID"`

	// TemplateParameters allows passing additional template-specific parameters as JSON-encoded key-value pairs.
	// This complements the explicit fields (cores, memoryGiB, etc.) and is used for:
	// - Template-specific parameters not covered by explicit fields (e.g., exposed_ports)
	// - Custom parameters defined by specific templates
	// +kubebuilder:validation:Optional
	TemplateParameters string `json:"templateParameters,omitempty"`

	// Image defines the VM image configuration
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="image is immutable"
	Image ImageSpec `json:"image"`

	// GuestOSFamily specifies the guest operating system family for the VM.
	// To support future OS families, this field is a freeform string.
	// Currently, any value other than "windows" will be treated as "linux".
	// This field is immutable after creation.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="guestOSFamily is immutable"
	GuestOSFamily string `json:"guestOSFamily,omitempty"`

	// Cores is the number of CPU cores
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=128
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="cores is immutable"
	Cores int32 `json:"cores"`

	// MemoryGiB is the memory in gibibytes
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="memoryGiB is immutable"
	MemoryGiB int32 `json:"memoryGiB"`

	// BootDisk is the primary boot disk
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="bootDisk is immutable"
	BootDisk DiskSpec `json:"bootDisk"`

	// AdditionalDisks are supplementary disks
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="additionalDisks is immutable"
	AdditionalDisks []DiskSpec `json:"additionalDisks,omitempty"`

	// RunStrategy controls VM running state (MUTABLE)
	// +kubebuilder:validation:Required
	RunStrategy RunStrategyType `json:"runStrategy"`

	// UserDataSecretRef references cloud-init user data
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="userDataSecretRef is immutable"
	UserDataSecretRef *corev1.LocalObjectReference `json:"userDataSecretRef,omitempty"`

	// SSHKey is the SSH public key
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="sshKey is immutable"
	SSHKey string `json:"sshKey,omitempty"`

	// NetworkAttachments defines multiple NICs when more than one subnet (and optional security groups per NIC) is required.
	// The first entry is the primary subnet for VM placement (subnet-namespace annotation).
	// Subnet references (per NetworkAttachment) are immutable but security groups can be changed.
	//
	// Why immutability is required:
	// Currently, ComputeInstances are created with a single NIC. The VM instance must be created in the namespace
	// of the subnet it uses (the subnet-namespace annotation determines VM placement). This architectural constraint
	// means that changing the subnet would require recreating the VM in a different namespace, which is not supported.
	// Similarly, the array size cannot change because adding/removing NICs would require changing the primary subnet
	// or the VM's namespace, both of which are immutable after VM creation.
	//
	// Immutability enforcement:
	// - The +listType=map with +listMapKey=subnetRef markers correlate entries by subnetRef for updates
	// - The size check below prevents adding or removing entries
	// - The per-item subnetRef validation (self == oldSelf) prevents changing keys of existing entries
	// Combined, these ensure only securityGroupRefs can be modified.
	//
	// MaxItems is required for CEL cost budget calculation: NetworkAttachment.SubnetRef has a CEL validation
	// rule (self == oldSelf for immutability). Without maxItems, Kubernetes cannot bound the cost of iterating
	// over array items to validate this rule, causing CRD installation to fail with "estimated rule cost exceeds budget".
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxItems=8
	// +kubebuilder:validation:XValidation:rule="size(oldSelf) == 0 || (size(self) == size(oldSelf) && self.all(na, oldSelf.exists(old, old.subnetRef == na.subnetRef)))",message="cannot change or add/remove network attachments after initial assignment"
	// +listType=map
	// +listMapKey=subnetRef
	NetworkAttachments []NetworkAttachment `json:"networkAttachments,omitempty"`

	// RestartRequestedAt is a timestamp signal to request a VM restart (MUTABLE).
	//
	// Set this field to the current time (usually NOW) to request a restart.
	// The controller will execute the restart if this timestamp is greater than
	// status.lastRestartedAt.
	//
	// This is a declarative signal mechanism - the timestamp is a monotonically
	// increasing value to detect new restart requests, not a scheduled time.
	// Typically set to the current time for immediate restarts.
	//
	// External schedulers can set this field on a schedule to implement
	// scheduled maintenance windows if needed.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Format=date-time
	RestartRequestedAt *metav1.Time `json:"restartRequestedAt,omitempty"`
}

type ComputeInstanceStatus struct {
	// Phase provides a single-value overview of the state of the ComputeInstance
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Starting;Running;Failed;Deleting;Stopping;Stopped;Paused
	Phase ComputeInstancePhaseType `json:"phase,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the ComputeInstance
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Reference to the KubeVirt VirtualMachine CR created by this ComputeInstance
	// +kubebuilder:validation:Optional
	VirtualMachineReference *VirtualMachineReferenceType `json:"virtualMachineReference,omitempty"`

	// Reference to the tenant that contains the ComputeInstance resources
	// +kubebuilder:validation:Optional
	TenantReference *TenantReferenceType `json:"tenantReference,omitempty"`

	// DesiredConfigVersion is the version (hash) of the desired configuration of the ComputeInstance
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// LastRestartedAt records when the last restart was initiated by the controller.
	//
	// This is set to spec.restartRequestedAt when the controller processes a restart request.
	// It will be empty if no restart has been performed yet.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Format=date-time
	LastRestartedAt *metav1.Time `json:"lastRestartedAt,omitempty"`

	// ProvisioningJobs tracks the history of provision and deprovision operations
	// Ordered chronologically, with latest operations at the end
	// Limited to the last N jobs (configurable via OSAC_MAX_JOB_HISTORY, default 10)
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// IPAddress is the primary IP address of the running instance, taken from the KubeVirt VirtualMachineInstance.
	// Populated when the instance is ready (phase Running).
	// +kubebuilder:validation:Optional
	IPAddress string `json:"ipAddress,omitempty"`

	// PublicIPAddress is the public IP address attached to this instance via a PublicIP CR.
	// Populated when a PublicIP CR in state "Attached" references this ComputeInstance.
	// +kubebuilder:validation:Optional
	PublicIPAddress string `json:"publicIPAddress,omitempty"`
}

type DiskSpec struct {
	// SizeGiB is the size of the disk in gibibytes
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=1
	SizeGiB int32 `json:"sizeGiB"`
}

type ExternalIP struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of ExternalIP
	// +required
	Spec ExternalIPSpec `json:"spec"`

	// status defines the observed state of ExternalIP
	// +optional
	Status ExternalIPStatus `json:"status,omitempty,omitzero"`
}

type ExternalIPAttachment struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of ExternalIPAttachment
	// +required
	Spec ExternalIPAttachmentSpec `json:"spec"`

	// status defines the observed state of ExternalIPAttachment
	// +optional
	Status ExternalIPAttachmentStatus `json:"status,omitempty,omitzero"`
}

type ExternalIPAttachmentConditionType string

type ExternalIPAttachmentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ExternalIPAttachment `json:"items"`
}

type ExternalIPAttachmentPhaseType string

type ExternalIPAttachmentSpec struct {
	// ExternalIP is the name of the ExternalIP resource to attach.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ExternalIP string `json:"externalIP"`

	// ComputeInstance is the name of the ComputeInstance to attach to.
	// Exactly one target field must be set.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MinLength=1
	ComputeInstance *string `json:"computeInstance,omitempty"`
}

type ExternalIPAttachmentStatus struct {
	// Phase provides a single-value overview of the state of the ExternalIPAttachment
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Failed;Ready;Deleting
	Phase ExternalIPAttachmentPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the ExternalIPAttachment
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type ExternalIPConditionType string

type ExternalIPList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ExternalIP `json:"items"`
}

type ExternalIPPhaseType string

type ExternalIPPool struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of ExternalIPPool
	// +required
	Spec ExternalIPPoolSpec `json:"spec"`

	// status defines the observed state of ExternalIPPool
	// +optional
	Status ExternalIPPoolStatus `json:"status,omitempty,omitzero"`
}

type ExternalIPPoolConditionType string

type ExternalIPPoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ExternalIPPool `json:"items"`
}

type ExternalIPPoolPhaseType string

type ExternalIPPoolSpec struct {
	// CIDRs is the list of CIDR blocks for this pool. All CIDRs must match the declared IPFamily.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="cidrs is immutable"
	CIDRs []string `json:"cidrs"`

	// IPFamily indicates the IP address family for this pool (IPv4 or IPv6)
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=IPv4;IPv6
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ipFamily is immutable"
	IPFamily string `json:"ipFamily"`

	// ImplementationStrategy determines the backend used to advertise IPs (e.g., metallb-l2).
	// Defaults to metallb-l2 for v7.0.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=metallb-l2;netris
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="implementationStrategy is immutable"
	ImplementationStrategy string `json:"implementationStrategy,omitempty"`
}

type ExternalIPPoolStatus struct {
	// Phase provides a single-value overview of the state of the ExternalIPPool
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Failed;Ready;Deleting
	Phase ExternalIPPoolPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the ExternalIPPool
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Total is the total number of usable IP addresses across all CIDRs in this pool.
	// Uses int64 to accommodate large IPv6 CIDR ranges.
	// +kubebuilder:validation:Optional
	Total int64 `json:"total,omitempty"`

	// Allocated is the number of IPs currently allocated from the pool.
	// +kubebuilder:validation:Optional
	Allocated int64 `json:"allocated,omitempty"`

	// Available is the number of IPs available for allocation.
	// +kubebuilder:validation:Optional
	Available int64 `json:"available,omitempty"`
}

type ExternalIPSpec struct {
	// Pool is the name of the ExternalIPPool this IP is allocated from.
	// This field is immutable after creation.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="pool is immutable"
	Pool string `json:"pool"`
}

type ExternalIPStateType string

type ExternalIPStatus struct {
	// Phase provides a single-value overview of the state of the ExternalIP
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Failed;Ready;Deleting
	Phase ExternalIPPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the ExternalIP
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Address is the allocated external IP address
	// +kubebuilder:validation:Optional
	Address string `json:"address,omitempty"`

	// State tracks the attachment lifecycle of the ExternalIP
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Pending;Allocated;Failed
	State ExternalIPStateType `json:"state,omitempty"`

	// Attached indicates whether a ExternalIPAttachment has successfully attached this IP to a target.
	// +kubebuilder:validation:Optional
	Attached bool `json:"attached,omitempty"`
}

type ImageSourceType string

type ImageSpec struct {
	// SourceType specifies the type of image source (currently only "registry" supported)
	// +kubebuilder:validation:Required
	SourceType ImageSourceType `json:"sourceType"`

	// SourceRef is the OCI image reference for the VM
	// Example: "quay.io/fedora/fedora-coreos:stable"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	SourceRef string `json:"sourceRef"`
}

type JobState string

type JobStatus struct {
	// JobID is the AAP job identifier from the provisioning provider API response.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	JobID string `json:"jobID"`

	// Type indicates the operation type
	// +kubebuilder:validation:Required
	Type JobType `json:"type"`

	// Timestamp when this job was created/triggered
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Format=date-time
	Timestamp metav1.Time `json:"timestamp"`

	// State is the current state of the job
	// +kubebuilder:validation:Required
	State JobState `json:"state"`

	// Message provides human-readable status or error information
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	Message string `json:"message,omitempty"`

	// BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
	// AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
	// +kubebuilder:validation:Optional
	BlockDeletionOnFailure bool `json:"blockDeletionOnFailure,omitempty"`

	// ConfigVersion is the DesiredConfigVersion at the time this job was triggered.
	// Used to determine retry behavior on failure: if ConfigVersion differs from
	// the current DesiredConfigVersion, a new job is triggered immediately.
	// If they match, the controller retries with exponential backoff.
	// +kubebuilder:validation:Optional
	ConfigVersion string `json:"configVersion,omitempty"`
}

type JobType string

type NATGateway struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of NATGateway
	// +required
	Spec NATGatewaySpec `json:"spec"`

	// status defines the observed state of NATGateway
	// +optional
	Status NATGatewayStatus `json:"status,omitempty,omitzero"`
}

type NATGatewayConditionType string

type NATGatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NATGateway `json:"items"`
}

type NATGatewayPhaseType string

type NATGatewaySpec struct {
	// VirtualNetwork is the name of the parent VirtualNetwork whose egress
	// traffic is source-NATted through this gateway.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	VirtualNetwork string `json:"virtualNetwork"`

	// ExternalIP is the name of the ExternalIP resource to use as the SNAT
	// source address for outbound traffic.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ExternalIP string `json:"externalIP"`
}

type NATGatewayStatus struct {
	// Phase provides a single-value overview of the state of the NATGateway
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Ready;Failed;Deleting
	Phase NATGatewayPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the NATGateway
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type NetworkAttachment struct {
	// SubnetRef is the name of the Subnet CR in the same namespace as the ComputeInstance.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="subnetRef is immutable"
	SubnetRef string `json:"subnetRef"`

	// SecurityGroupRefs lists SecurityGroup CR names in the same namespace as the ComputeInstance.
	// Mutable - can be changed to add/remove security groups without recreating the VM.
	// +kubebuilder:validation:Optional
	SecurityGroupRefs []string `json:"securityGroupRefs,omitempty"`
}

type NodeRequest struct {
	// ResourceClass describes the type of node you are requesting
	// +kubebuilder:validation:Required
	ResourceClass string `json:"resourceClass"`
	// NumberOfNodes describes the number of nodes you want of the given resource class
	// +kubebuilder:validation:Required
	NumberOfNodes int `json:"numberOfNodes"`
}

type PublicIP struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of PublicIP
	// +required
	Spec PublicIPSpec `json:"spec"`

	// status defines the observed state of PublicIP
	// +optional
	Status PublicIPStatus `json:"status,omitempty,omitzero"`
}

type PublicIPAttachment struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of PublicIPAttachment
	// +required
	Spec PublicIPAttachmentSpec `json:"spec"`

	// status defines the observed state of PublicIPAttachment
	// +optional
	Status PublicIPAttachmentStatus `json:"status,omitempty,omitzero"`
}

type PublicIPAttachmentConditionType string

type PublicIPAttachmentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []PublicIPAttachment `json:"items"`
}

type PublicIPAttachmentPhaseType string

type PublicIPAttachmentSpec struct {
	// PublicIP is the name of the PublicIP resource to attach.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	PublicIP string `json:"publicIP"`

	// ComputeInstance is the name of the ComputeInstance to attach to.
	// Exactly one target field must be set.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MinLength=1
	ComputeInstance *string `json:"computeInstance,omitempty"`
}

type PublicIPAttachmentStatus struct {
	// Phase provides a single-value overview of the state of the PublicIPAttachment
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Failed;Ready;Deleting
	Phase PublicIPAttachmentPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the PublicIPAttachment
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type PublicIPConditionType string

type PublicIPList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []PublicIP `json:"items"`
}

type PublicIPPhaseType string

type PublicIPPool struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of PublicIPPool
	// +required
	Spec PublicIPPoolSpec `json:"spec"`

	// status defines the observed state of PublicIPPool
	// +optional
	Status PublicIPPoolStatus `json:"status,omitempty,omitzero"`
}

type PublicIPPoolConditionType string

type PublicIPPoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []PublicIPPool `json:"items"`
}

type PublicIPPoolPhaseType string

type PublicIPPoolSpec struct {
	// CIDRs is the list of CIDR blocks for this pool. All CIDRs must match the declared IPFamily.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="cidrs is immutable"
	CIDRs []string `json:"cidrs"`

	// IPFamily indicates the IP address family for this pool (IPv4 or IPv6)
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=IPv4;IPv6
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ipFamily is immutable"
	IPFamily string `json:"ipFamily"`

	// ImplementationStrategy determines the backend used to advertise IPs (e.g., metallb-l2).
	// Defaults to metallb-l2 for v7.0.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=metallb-l2;netris
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="implementationStrategy is immutable"
	ImplementationStrategy string `json:"implementationStrategy,omitempty"`
}

type PublicIPPoolStatus struct {
	// Phase provides a single-value overview of the state of the PublicIPPool
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Failed;Ready;Deleting
	Phase PublicIPPoolPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the PublicIPPool
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Total is the total number of usable IP addresses across all CIDRs in this pool.
	// Uses int64 to accommodate large IPv6 CIDR ranges.
	// +kubebuilder:validation:Optional
	Total int64 `json:"total,omitempty"`

	// Allocated is the number of IPs currently allocated from the pool.
	// +kubebuilder:validation:Optional
	Allocated int64 `json:"allocated,omitempty"`

	// Available is the number of IPs available for allocation.
	// +kubebuilder:validation:Optional
	Available int64 `json:"available,omitempty"`
}

type PublicIPSpec struct {
	// Pool is the name of the PublicIPPool this IP is allocated from.
	// This field is immutable after creation.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="pool is immutable"
	Pool string `json:"pool"`
}

type PublicIPStateType string

type PublicIPStatus struct {
	// Phase provides a single-value overview of the state of the PublicIP
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Failed;Ready;Deleting
	Phase PublicIPPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the PublicIP
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Address is the allocated public IP address
	// +kubebuilder:validation:Optional
	Address string `json:"address,omitempty"`

	// State tracks the attachment lifecycle of the PublicIP
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Pending;Allocated;Failed
	State PublicIPStateType `json:"state,omitempty"`

	// Attached indicates whether a PublicIPAttachment has successfully attached this IP to a target.
	// +kubebuilder:validation:Optional
	Attached bool `json:"attached,omitempty"`
}

type ResolvedStorageClass struct {
	// Name is the name of the resolved Kubernetes StorageClass.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Tier is the storage tier this StorageClass provides,
	// taken from the osac.openshift.io/storage-tier label.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([a-z0-9._-]*[a-z0-9])?$`
	Tier string `json:"tier"`
}

type RunStrategyType string

type SecurityGroup struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of SecurityGroup
	// +required
	Spec SecurityGroupSpec `json:"spec"`

	// status defines the observed state of SecurityGroup
	// +optional
	Status SecurityGroupStatus `json:"status,omitempty,omitzero"`
}

type SecurityGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SecurityGroup `json:"items"`
}

type SecurityGroupPhaseType string

type SecurityGroupProtocol string

type SecurityGroupSpec struct {
	// VirtualNetwork is the ID of the parent VirtualNetwork
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="virtualNetwork is immutable"
	VirtualNetwork string `json:"virtualNetwork"`

	// ImplementationStrategy determines the backend used to enforce security rules.
	// Set by the fulfillment-service; defaults to network_policy when empty.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="implementationStrategy is immutable"
	ImplementationStrategy string `json:"implementationStrategy,omitempty"`

	// IngressRules defines the ingress security rules
	// +kubebuilder:validation:Optional
	IngressRules []SecurityRule `json:"ingressRules,omitempty"`

	// EgressRules defines the egress security rules
	// +kubebuilder:validation:Optional
	EgressRules []SecurityRule `json:"egressRules,omitempty"`
}

type SecurityGroupStatus struct {
	// Phase provides a single-value overview of the state of the SecurityGroup
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Ready;Failed;Deleting
	Phase SecurityGroupPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// BackendSecurityGroupID stores provider-specific security group identifier
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	BackendSecurityGroupID string `json:"backendSecurityGroupId,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the SecurityGroup
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type SecurityRule struct {
	// Protocol specifies the network protocol
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=tcp;udp;icmp;all
	Protocol SecurityGroupProtocol `json:"protocol"`

	// PortFrom specifies the start of the port range
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	PortFrom *int32 `json:"portFrom,omitempty"`

	// PortTo specifies the end of the port range
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	PortTo *int32 `json:"portTo,omitempty"`

	// SourceCIDR specifies the source CIDR block for this rule
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	SourceCIDR string `json:"sourceCidr,omitempty"`

	// DestinationCIDR specifies the destination CIDR block for this rule
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	DestinationCIDR string `json:"destinationCidr,omitempty"`
}

type StorageBackendStatus struct {
	// Name is the storage backend identifier (e.g., "vast-1").
	Name string `json:"name"`
	// Provider is the storage provider type (e.g., "vast").
	Provider string `json:"provider"`
	// Ready indicates whether this backend is provisioned for the tenant.
	Ready bool `json:"ready"`
	// Message provides human-readable status or error information.
	Message string `json:"message,omitempty"`
}

type Subnet struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of Subnet
	// +required
	Spec SubnetSpec `json:"spec"`

	// status defines the observed state of Subnet
	// +optional
	Status SubnetStatus `json:"status,omitempty,omitzero"`
}

type SubnetConditionType string

type SubnetList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Subnet `json:"items"`
}

type SubnetPhaseType string

type SubnetSpec struct {
	// VirtualNetwork is the ID of the parent VirtualNetwork
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="virtualNetwork is immutable"
	VirtualNetwork string `json:"virtualNetwork"`

	// IPv4CIDR is the IPv4 CIDR block for this subnet
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ipv4Cidr is immutable"
	IPv4CIDR string `json:"ipv4Cidr,omitempty"`

	// IPv6CIDR is the IPv6 CIDR block for this subnet
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ipv6Cidr is immutable"
	IPv6CIDR string `json:"ipv6Cidr,omitempty"`
}

type SubnetStatus struct {
	// Phase provides a single-value overview of the state of the Subnet
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Failed;Ready;Deleting
	Phase SubnetPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the Subnet
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// BackendNetworkID stores provider-specific network identifier
	// +kubebuilder:validation:Optional
	BackendNetworkID string `json:"backendNetworkId,omitempty"`
}

type Tenant struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   TenantSpec   `json:"spec,omitempty"`
	Status TenantStatus `json:"status,omitempty"`
}

type TenantConditionType string

type TenantList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Tenant `json:"items"`
}

type TenantPhaseType string

type TenantReferenceType struct {
	// Name of the tenant
	Name string `json:"name"`
	// Namespace of the tenant
	Namespace string `json:"namespace"`
}

type TenantSpec struct {
}

type TenantStatus struct {
	// Phase is the phase of the tenant
	Phase TenantPhaseType `json:"phase,omitempty"`

	// Namespace is the namespace allocated to the tenant on the target cluster
	Namespace string `json:"namespace,omitempty"`

	// StorageClasses lists all resolved StorageClass mappings for the tenant,
	// one per storage tier.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=tier
	StorageClasses []ResolvedStorageClass `json:"storageClasses,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the Tenant
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// ProvisioningJobs holds the history of provisioning jobs triggered for this tenant
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// StorageBackendJobs holds the history of storage backend provisioning/deprovisioning jobs
	StorageBackendJobs []JobStatus `json:"storageBackendJobs,omitempty"`

	// ClusterStorageJobs holds the history of cluster storage provisioning/deprovisioning jobs
	ClusterStorageJobs []JobStatus `json:"clusterStorageJobs,omitempty"`

	// StorageBackends tracks per-backend provisioning status.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	StorageBackends []StorageBackendStatus `json:"storageBackends,omitempty"`

	// ClusterStorage tracks per-cluster StorageClass installation status.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=clusterName
	ClusterStorage []ClusterStorageStatus `json:"clusterStorage,omitempty"`
}

type VirtualMachineReferenceType struct {
	// Namespace that contains the VirtualMachine resources
	Namespace                  string `json:"namespace"`
	KubeVirtVirtualMachineName string `json:"kubeVirtVirtualMachineName"`
}

type VirtualNetwork struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of VirtualNetwork
	// +required
	Spec VirtualNetworkSpec `json:"spec"`

	// status defines the observed state of VirtualNetwork
	// +optional
	Status VirtualNetworkStatus `json:"status,omitempty,omitzero"`
}

type VirtualNetworkList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []VirtualNetwork `json:"items"`
}

type VirtualNetworkPhaseType string

type VirtualNetworkSpec struct {
	// Region is the cloud region where this VirtualNetwork will be provisioned
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="region is immutable"
	Region string `json:"region"`

	// IPv4CIDR is the IPv4 CIDR block for this virtual network
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ipv4Cidr is immutable"
	IPv4CIDR string `json:"ipv4Cidr,omitempty"`

	// IPv6CIDR is the IPv6 CIDR block for this virtual network
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ipv6Cidr is immutable"
	IPv6CIDR string `json:"ipv6Cidr,omitempty"`

	// NetworkClass is the name of the NetworkClass that defines implementation strategy.
	// When omitted, the platform default NetworkClass is used.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="networkClass is immutable"
	NetworkClass string `json:"networkClass,omitempty"`

	// ImplementationStrategy determines the underlying network backend and Ansible role to use.
	// This value is derived from the NetworkClass at creation time and stored here for direct
	// access by controllers and provisioning systems.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="implementationStrategy is immutable"
	ImplementationStrategy string `json:"implementationStrategy,omitempty"`
}

type VirtualNetworkStatus struct {
	// Phase provides a single-value overview of the state of the VirtualNetwork
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Enum=Progressing;Ready;Failed;Deleting
	Phase VirtualNetworkPhaseType `json:"phase,omitempty"`

	// DesiredConfigVersion is a hash of the spec, used to detect spec changes and control retry behavior.
	// +kubebuilder:validation:Optional
	DesiredConfigVersion string `json:"desiredConfigVersion,omitempty"`

	// ProvisioningJobs holds an array of JobStatus tracking provisioning and deprovisioning operations
	// +kubebuilder:validation:Optional
	ProvisioningJobs []JobStatus `json:"provisioningJobs,omitempty"`

	// BackendNetworkID stores provider-specific network identifier
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type=string
	BackendNetworkID string `json:"backendNetworkId,omitempty"`

	// Conditions holds an array of metav1.Condition that describe the state of the VirtualNetwork
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}