v1alpha1

type ArgoAction string

type ArgoAddon struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ArgoAddonSpec   `json:"spec,omitempty"`
	Status ArgoAddonStatus `json:"status,omitempty"`
}

type ArgoAddonList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ArgoAddon `json:"items"`
}

type ArgoAddonSpec struct {
	// When force is enabled, appprojects which already exist with the same name as a tenant will be adopted
	// and overwritten. When disabled the appprojects will not be changed or adopted.
	// This is true for any other resource as well. This can also be set on a per-tenant basis via annotations.
	//+kubebuilder:default=false
	Force bool `json:"force"`
	// When decouple is enabled, appprojects are preserved even in the case when the origin tenant is deleted.
	// This can also be set on a per-tenant basis via annotations.
	//+kubebuilder:default=true
	Decouple bool `json:"decouple"`
	// All appprojects, which are collected by this controller, are set into ready-only mode
	// That means only properties from matching translators are respected. Any changes from users are
	// overwritten. This can also be set on a per-tenant basis via annotations.
	//+kubebuilder:default=false
	ReadOnly bool `json:"readonly"`

	// Argo configuration
	Argo ControllerArgoCDConfig `json:"argo"`

	// Allows the creation of argo repository secrets which are then replicated to the argocd namespace.
	// This makes sense when users create repository via gitops and don't have access to the GUI (or where you prevent them from doing that on the GUI)
	//+kubebuilder:default=false
	AllowRepositoryCreation bool `json:"allowRepositoryCreation"`
}

type ArgoAddonStatus struct {
	// Last applied valid configuration
	Config ArgoAddonSpec `json:"loaded,omitempty"`
}

type ArgoResource string

type ArgoTranslator struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ArgoTranslatorSpec   `json:"spec,omitempty"`
	Status ArgoTranslatorStatus `json:"status,omitempty"`
}

type ArgoTranslatorList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ArgoTranslator `json:"items"`
}

type ArgoTranslatorSpec struct {
	// Selector to match tenants which are used for the translator
	Selector *metav1.LabelSelector `json:"selector,omitempty"`

	// Application-Project Roles for the tenant
	ProjectRoles []ArgocdProjectRolesTranslator `json:"roles,omitempty"`

	// Additional settings for the argocd project
	ProjectSettings *ArgocdProjectProperties `json:"settings,omitempty"`

	// In this field you can define custom policies. It must result in a valid argocd policy format (CSV)
	// You can use Sprig Templating with this field
	CustomPolicy string `json:"customPolicy,omitempty"`
}

type ArgoTranslatorStatus struct {
	// List of tenants selected by this translator
	Tenants []TenantStatus `json:"tenants,omitempty"`
	// Amount of tenants selected by this translator
	Size uint `json:"size,omitempty"`
	// Ready field indicating overall readiness of the translator
	Ready string `json:"ready,omitempty"`
}

type ArgoVerb string

type ArgocdPolicyDefinition struct {
	// Name for permission mapping
	Resource ArgoResource `json:"resource,omitempty"`

	// Allowed actions for this permission. You may specify multiple actions. To allow all actions use "*"
	// +kubebuilder:default={get}
	Action []string `json:"action,omitempty"`

	// Verb for this permission (can be allow, deny)
	// +kubebuilder:default=allow
	Verb ArgoVerb `json:"verb,omitempty"`

	// You may specify a custom path for the resource. The available path for argo is <app-project>/<app-ns>/<app-name>
	// however <app-project> is already set to the argocd project name. Therefor you can only add <app-ns>/<app-name>
	// +kubebuilder:default="*"
	Path string `json:"path,omitempty"`
}

type ArgocdProjectPropertieMeta struct {
	// Labels for the project
	//+kubebuilder:optional
	Labels map[string]string `json:"labels,omitempty"`

	// Annotations for the project
	//+kubebuilder:optional
	Annotations map[string]string `json:"annotations,omitempty"`

	// Finalizers for the project
	//+kubebuilder:optional
	Finalizers []string `json:"finalizers,omitempty"`
}

type ArgocdProjectProperties struct {
	// Structured Properties for the argocd project
	Structured *ArgocdProjectStructuredProperties `json:"structured,omitempty"`
	// Use a template to generate to argo project settings
	Template string `json:"template,omitempty"`
}

type ArgocdProjectRolesTranslator struct {
	// Name for permission mapping
	Name string `json:"name,omitempty"`

	// TenantRoles selects tenant users based on their cluster roles to this Permission
	ClusterRoles []string `json:"clusterRoles,omitempty"`

	// Roles are reflected in the argocd rbac configmap
	Policies []ArgocdPolicyDefinition `json:"policies,omitempty"`

	// Define if the selected users are owners of the appproject. Being owner allows the users
	// to update the project and effectively manage everything. By default the selected users get
	// read-only access to the project.
	// +kubebuilder:default=false
	Owner bool `json:"owner,omitempty"`
}

type ArgocdProjectStructuredProperties struct {
	// Project Metadata
	ProjectMeta *ArgocdProjectPropertieMeta `json:"meta,omitempty"`
	// Application Project Spec (Upstream ArgoCD)
	ProjectSpec argocdv1alpha1.AppProjectSpec `json:"spec,omitempty"`
}

type ControllerArgoCDConfig struct {
	// Namespace where the ArgoCD instance is running
	// +kubebuilder:default=argocd
	Namespace string `json:"namespace,omitempty"`

	// Name of the ArgoCD rbac configmap (required for the controller)
	// +kubebuilder:default=argocd-rbac-cm
	RBACConfigMap string `json:"rbacConfigMap,omitempty"`

	// If you are not using the capsule-proxy integration this destination is registered
	// for each appproject.
	// +kubebuilder:default="https://kubernetes.default.svc"
	Destination string `json:"destination,omitempty"`

	// This is a feature which will be released with argocd +v2.13.0
	// If you are not yet on that version, you can't use this feature. Currently Feature is in state Alpha
	// +kubebuilder:default=true
	DestinationServiceAccounts bool `json:"destinationServiceAccounts,omitempty"`

	// Default Namespace to create ServiceAccounts used by arog-cd
	// The namespace must be part of capsuleUsers and have "list", "get" and "watch" privileges for the entire cluster
	// It's best to have a dedicated namespace for these serviceaccounts
	ServiceAccountNamespace string `json:"serviceAccountNamespace"`

	// ClusterRoles assigned to serviceaccounts generated by the addon and added as owners to the capsule tenant
	// +kubebuilder:default={admin,capsule-namespace-deletor}
	ServiceAccountClusterRoles []string `json:"serviceAccountClusterRoles"`
}

type TenantStatus struct {
	// List of tenants selected by this translator
	Name string `json:"name,omitempty"`
	// UID of the tracked Tenant to pin point tracking
	k8stypes.UID `json:"uid,omitempty" protobuf:"bytes,5,opt,name=uid"`
	// Conditions represent the latest available observations of an object's state
	Condition metav1.Condition `json:"condition,omitempty"`
	// Serving  Settings for this Tenant
	Serving *ArgocdProjectProperties `json:"serving,omitempty"`
}