v1

type CAReference struct {
	// Kind of the resource containing the CA Certificate, either a ConfigMap or Secret.
	// +kubebuilder:default:=Secret
	// +kubebuilder:validation:Enum:=ConfigMap;Secret
	// +kubebuilder:validation:Optional
	Kind string `json:"kind,omitempty"`
	// Name of the resource containing the CA Certificate.
	// +kubebuilder:validation:Required
	Name string `json:"name"`
	// Key to select in the resource.
	// Defaults to ca.crt if not specified.
	// +kubebuilder:default:=ca.crt
	// +kubebuilder:validation:Optional
	Key string `json:"key,omitempty"`
	// Optional specifies whether the resource and its key must exist.
	// +kubebuilder:validation:Optional
	Optional *bool `json:"optional,omitempty"`
}

type ClusterReference struct {
	// Name of the LinstorCluster resource controlling this satellite.
	Name string `json:"name,omitempty"`

	// ClientSecretName references the secret used by the operator to validate the https endpoint.
	ClientSecretName string `json:"clientSecretName,omitempty"`

	// CAReference configures the CA certificate to use when validating TLS certificates.
	// If not set, the TLS secret is expected to contain a "ca.crt" containing the CA certificate.
	//+kubebuilder:validation:Optional
	CAReference *CAReference `json:"caReference,omitempty"`

	// ExternalController references an external controller.
	// When set, the Operator uses the external cluster to register satellites.
	// +kubebuilder:validation:Optional
	ExternalController *LinstorExternalControllerRef `json:"externalController,omitempty"`
}

type ComponentSpec struct {
	// Enable the component.
	// +kubebuilder:default:=true
	// +kubebuilder:validation:Optional
	Enabled bool `json:"enabled,omitempty"`

	// Template to apply to Pods of the component.
	//
	// The template is applied as a patch to the default deployment, so it can be "sparse", not listing any
	// containers or volumes that should remain unchanged.
	// See https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:validation:Type=object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +structType=atomic
	PodTemplate json.RawMessage `json:"podTemplate,omitempty"`
}

type DeletionPolicy string

type DeploymentComponentSpec struct {
	ComponentSpec `json:",inline"`

	// Number of desired pods. Defaults to 1.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=0
	Replicas *int32 `json:"replicas,omitempty"`
}

type EvacuationStrategy struct {
	// AttachedVolumeReattachTimeout configures how long evacuation waits for attached volumes to reattach on
	// different nodes. Setting this to 0 disable this evacuation step.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:="5m"
	AttachedVolumeReattachTimeout metav1.Duration `json:"attachedVolumeReattachTimeout"`
	// UnattachedVolumeAttachTimeout configures how long evacuation waits for unattached volumes to attach on
	// different nodes. Setting this to 0 disable this evacuation step.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:="5m"
	UnattachedVolumeAttachTimeout metav1.Duration `json:"unattachedVolumeAttachTimeout"`
}

type IPFamily corev1.IPFamily

type LinstorCluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LinstorClusterSpec   `json:"spec,omitempty"`
	Status LinstorClusterStatus `json:"status,omitempty"`
}

type LinstorClusterApiTLS struct {
	// ApiSecretName references a secret holding the TLS key and certificate used to protect the API.
	// Defaults to "linstor-api-tls".
	//+kubebuilder:validation:Optional
	ApiSecretName string `json:"apiSecretName,omitempty"`

	// ClientSecretName references a secret holding the TLS key and certificate used by the operator to configure
	// the cluster. Defaults to "linstor-client-tls".
	//+kubebuilder:validation:Optional
	ClientSecretName string `json:"clientSecretName,omitempty"`

	// CsiControllerSecretName references a secret holding the TLS key and certificate used by the CSI Controller
	// to provision volumes. Defaults to "linstor-csi-controller-tls".
	//+kubebuilder:validation:Optional
	CsiControllerSecretName string `json:"csiControllerSecretName,omitempty"`

	// CsiNodeSecretName references a secret holding the TLS key and certificate used by the CSI Nodes to query
	// the volume state. Defaults to "linstor-csi-node-tls".
	//+kubebuilder:validation:Optional
	CsiNodeSecretName string `json:"csiNodeSecretName,omitempty"`

	// AffinityControllerSecretName references a secret holding the TLS key and certificate used by the Affinity
	// Controller to monitor volume state. Defaults to "linstor-affinity-controller-tls".
	//+kubebuilder:validation:Optional
	AffinityControllerSecretName string `json:"affinityControllerSecretName,omitempty"`

	// NFSServerSecretName references a secret holding the TLS key and certificate used by the NFS Server to query
	// the cluster state. Defaults to "linstor-csi-nfs-server-tls".
	//+kubebuilder:validation:Optional
	NFSServerSecretName string `json:"nfsServerSecretName,omitempty"`

	// CertManager references a cert-manager Issuer or ClusterIssuer.
	// If set, cert-manager.io/Certificate resources will be created, provisioning the secrets referenced in
	// *SecretName using the issuer configured here.
	//+kubebuilder:validation:Optional
	CertManager *cmmetav1.ObjectReference `json:"certManager,omitempty"`

	// CAReference configures the CA certificate to use when validating TLS certificates.
	// If not set, the TLS secret is expected to contain a "ca.crt" containing the CA certificate.
	//+kubebuilder:validation:Optional
	CAReference *CAReference `json:"caReference,omitempty"`
}

type LinstorClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LinstorCluster `json:"items"`
}

type LinstorClusterSpec struct {
	// Repository used to pull workload images.
	// +kubebuilder:validation:Optional
	Repository string `json:"repository,omitempty"`

	// ExternalController references an external controller.
	// When set, the Operator will skip deploying a LINSTOR Controller and instead use the external cluster
	// to register satellites.
	// +kubebuilder:validation:Optional
	ExternalController *LinstorExternalControllerRef `json:"externalController,omitempty"`

	// NodeSelector selects the nodes on which LINSTOR Satellites will be deployed.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
	// +kubebuilder:validation:Optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// NodeAffinity selects the nodes on which LINSTOR Satellites will be deployed.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
	// +kubebuilder:validation:Optional
	NodeAffinity *corev1.NodeSelector `json:"nodeAffinity,omitempty"`

	// Tolerations selects the nodes on which LINSTOR Satellites will be deployed.
	//
	// The default tolerations for DaemonSets are automatically added.
	// +kubebuilder:validation:Optional
	// +listType=atomic
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// Properties to apply on the cluster level.
	//
	// Use to create default settings for DRBD that should apply to all resources or to configure some other cluster
	// wide default.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorControllerProperty `json:"properties,omitempty"`

	// Patches is a list of kustomize patches to apply.
	//
	// See https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/patches/ for how to create patches.
	// +kubebuilder:validation:Optional
	Patches []Patch `json:"patches,omitempty"`

	// LinstorPassphraseSecret used to configure the LINSTOR master passphrase.
	//
	// The referenced secret must contain a single key "MASTER_PASSPHRASE". The master passphrase is used to
	// * Derive encryption keys for volumes using the LUKS layer.
	// * Store credentials for accessing remotes for backups.
	// See https://linbit.com/drbd-user-guide/linstor-guide-1_0-en/#s-encrypt_commands for more information.
	// +kubebuilder:validation:Optional
	LinstorPassphraseSecret string `json:"linstorPassphraseSecret,omitempty"`

	// InternalTLS secures the connection between LINSTOR Controller and Satellite.
	//
	// This configures the client certificate used when the Controller connects to a Satellite. This only has an effect
	// when the Satellite is configured to for secure connections using `LinstorSatellite.spec.internalTLS`.
	// +kubebuilder:validation:Optional
	// + See LinstorSatelliteSpec.InternalTLS for why nullable is needed.
	// +nullable
	InternalTLS *TLSConfig `json:"internalTLS,omitempty"`

	// ApiTLS secures the LINSTOR API.
	//
	// This configures the TLS key and certificate used to secure the LINSTOR API.
	// +kubebuilder:validation:Optional
	// + See LinstorSatelliteSpec.InternalTLS for why nullable is needed.
	// +nullable
	ApiTLS *LinstorClusterApiTLS `json:"apiTLS,omitempty"`

	// Controller controls the deployment of the LINSTOR Controller Deployment.
	// +kubebuilder:validation:Optional
	Controller *ComponentSpec `json:"controller,omitempty"`

	// CSIController controls the deployment of the CSI Controller Deployment.
	// +kubebuilder:validation:Optional
	CSIController *DeploymentComponentSpec `json:"csiController,omitempty"`

	// CSINode controls the deployment of the CSI Node DaemonSet.
	// +kubebuilder:validation:Optional
	CSINode *ComponentSpec `json:"csiNode,omitempty"`

	// HighAvailabilityController controls the deployment of the High Availability Controller DaemonSet.
	// +kubebuilder:validation:Optional
	HighAvailabilityController *ComponentSpec `json:"highAvailabilityController,omitempty"`

	// AffinityController controls the deployment of the Affinity Controller Deployment.
	// +kubebuilder:validation:Optional
	AffinityController *DeploymentComponentSpec `json:"affinityController,omitempty"`

	// NFSServer controls the deployment of the LINSTOR CSI NFS Server DaemonSet.
	// +kubebuilder:validation:Optional
	NFSServer *ComponentSpec `json:"nfsServer,omitempty"`
}

type LinstorClusterStatus struct {
	// Current LINSTOR Cluster state
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// The Version of the LINSTOR Cluster.
	//+kubebuilder:validation:Optional
	Version string `json:"version,omitempty"`

	// The number of LINSTOR Satellites that are expected to run.
	//+kubebuilder:validation:Optional
	ScheduledSatellites *int32 `json:"scheduledSatellites"`

	// The number of LINSTOR Satellites currently running.
	//+kubebuilder:validation:Optional
	RunningSatellites *int32 `json:"runningSatellites"`

	// The number of volumes in the LINSTOR Cluster.
	//+kubebuilder:validation:Optional
	NumberOfVolumes *int32 `json:"numberOfVolumes"`

	// The number of snapshots in the LINSTOR Cluster.
	//+kubebuilder:validation:Optional
	NumberOfSnapshots *int32 `json:"numberOfSnapshots"`

	// The number of bytes in total in all storage pools in the LINSTOR Cluster.
	//+kubebuilder:validation:Optional
	TotalCapacityBytes *int64 `json:"availableCapacityBytes"`

	// The number of bytes free in all storage pools in the LINSTOR Cluster.
	//+kubebuilder:validation:Optional
	FreeCapacityBytes *int64 `json:"freeCapacityBytes"`

	// Satellites mirrors the information from ScheduledSatellites and RunningSatellites in a human-readable string
	//+kubebuilder:validation:Optional
	Satellites string `json:"satellites"`

	// Capacity mirrors the information from TotalCapacityBytes and FreeCapacityBytes in a human-readable string
	//+kubebuilder:validation:Optional
	Capacity string `json:"capacity"`
}

type LinstorControllerProperty struct {
	// Name of the property to set.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	Name string `json:"name"`

	// Value to set the property to.
	Value string `json:"value,omitempty"`
}

type LinstorExternalControllerRef struct {
	// URL of the external controller.
	//+kubebuilder:validation:MinLength=3
	URL string `json:"url"`
}

type LinstorNodeConnection struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LinstorNodeConnectionSpec   `json:"spec,omitempty"`
	Status LinstorNodeConnectionStatus `json:"status,omitempty"`
}

type LinstorNodeConnectionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LinstorNodeConnection `json:"items"`
}

type LinstorNodeConnectionPath struct {
	// Name of the path.
	// +required
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Interface to use on both nodes.
	// +required
	// +kubebuilder:validation:Required
	Interface string `json:"interface"`
}

type LinstorNodeConnectionSpec struct {
	// Selector selects which pair of Satellites the connection should apply to.
	// If not given, the connection will be applied to all connections.
	// +kubebuilder:validation:Optional
	Selector []SelectorTerm `json:"selector,omitempty"`

	// Properties to apply for the node connection.
	//
	// Use to create default settings for DRBD that should apply to all resources connections between a set of
	// cluster nodes.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorControllerProperty `json:"properties,omitempty"`

	// Paths configure the network path used when connecting two nodes.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Paths []LinstorNodeConnectionPath `json:"paths,omitempty"`
}

type LinstorNodeConnectionStatus struct {
	// Current LINSTOR Node Connection state
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type LinstorNodeProperty struct {
	// Name of the property to set.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	Name string `json:"name"`

	// Value to set the property to.
	//+kubebuilder:validation:Optional
	Value string `json:"value,omitempty"`

	// ValueFrom sets the value from an existing resource.
	//+kubebuilder:validation:Optional
	ValueFrom *LinstorNodePropertyValueFrom `json:"valueFrom,omitempty"`

	// ExpandFrom can reference multiple resource fields at once.
	// It either sets the property to an aggregate value based on matched resource fields, or expands to multiple
	// properties.
	//+kubebuilder:validation:Optional
	ExpandFrom *LinstorNodePropertyExpandFrom `json:"expandFrom,omitempty"`

	// Optional values are only set if they have a non-empty value
	//+kubebuilder:validation:Optional
	Optional bool `json:"optional,omitempty"`
}

type LinstorNodePropertyExpandFrom struct {
	LinstorNodePropertyValueFrom `json:",inline"`

	// NameTemplate defines how the property key is expanded.
	// If set, the template is appended to the defined property name, creating multiple properties instead of one
	// aggregate.
	// * $1 is replaced with the matched key.
	// * $2 is replaced with the matched value.
	//+kubebuilder:validation:Optional
	NameTemplate string `json:"nameTemplate,omitempty"`

	// ValueTemplate defines how the property value is expanded.
	// * $1 is replaced with the matched key.
	// * $2 is replaced with the matched value.
	//+kubebuilder:validation:Optional
	ValueTemplate string `json:"valueTemplate,omitempty"`

	// Delimiter used to join multiple key and value pairs together.
	//+kubebuilder:validation:Optional
	Delimiter string `json:"delimiter,omitempty"`
}

type LinstorNodePropertyValueFrom struct {
	// Select a field of the node. Supports `metadata.name`, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	NodeFieldRef string `json:"nodeFieldRef,omitempty"`
}

type LinstorSatellite struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LinstorSatelliteSpec   `json:"spec,omitempty"`
	Status LinstorSatelliteStatus `json:"status,omitempty"`
}

type LinstorSatelliteConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LinstorSatelliteConfigurationSpec   `json:"spec,omitempty"`
	Status LinstorSatelliteConfigurationStatus `json:"status,omitempty"`
}

type LinstorSatelliteConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LinstorSatelliteConfiguration `json:"items"`
}

type LinstorSatelliteConfigurationSpec struct {
	// NodeSelector selects which LinstorSatellite resources this spec should be applied to.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
	// +kubebuilder:validation:Optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// NodeAffinity selects which LinstorSatellite resources this spec should be applied to.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
	// +kubebuilder:validation:Optional
	NodeAffinity *corev1.NodeSelector `json:"nodeAffinity,omitempty"`

	// Patches is a list of kustomize patches to apply.
	//
	// See https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/patches/ for how to create patches.
	// +kubebuilder:validation:Optional
	Patches []Patch `json:"patches,omitempty"`

	// StoragePools is a list of storage pools to configure on the node.
	// +kubebuilder:validation:Optional
	StoragePools []LinstorStoragePool `json:"storagePools,omitempty"`

	// Properties is a list of properties to set on the node.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorNodeProperty `json:"properties,omitempty"`

	// InternalTLS configures secure communication for the LINSTOR Satellite.
	//
	// If set, the control traffic between LINSTOR Controller and Satellite will be encrypted using mTLS.
	// +kubebuilder:validation:Optional
	// + See LinstorSatelliteSpec.InternalTLS for why nullable is needed.
	// +nullable
	InternalTLS *TLSConfigWithHandshakeDaemon `json:"internalTLS,omitempty"`

	// IPFamilies configures the IP Family (IPv4 or IPv6) to use to connect to the LINSTOR Satellite.
	//
	// If set, the control traffic between LINSTOR Controller and Satellite will use only the given IP Family.
	// If not set, the Operator will configure all families found in the Satellites Pods' Status.
	// +kubebuilder:validation:Optional
	IPFamilies []IPFamily `json:"ipFamilies,omitempty"`

	// +kubebuilder:validation:Optional
	DeletionPolicy DeletionPolicy `json:"deletionPolicy,omitempty"`

	// +kubebuilder:validation:Optional
	// +nullable
	EvacuationStrategy *EvacuationStrategy `json:"evacuationStrategy,omitempty"`

	// Template to apply to Satellite Pods.
	//
	// The template is applied as a patch to the default resource, so it can be "sparse", not listing any
	// containers or volumes that should remain unchanged.
	// See https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:validation:Type=object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +structType=atomic
	PodTemplate json.RawMessage `json:"podTemplate,omitempty"`
}

type LinstorSatelliteConfigurationStatus struct {
	// Current LINSTOR Satellite Config state
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// AppliedTo lists the LinstorSatellite resource this configuration was applied to
	// +kubebuilder:validation:Optional
	AppliedTo []string `json:"appliedTo"`

	// Number of configured LinstorSatellite resource.
	// +kubebuilder:validation:Optional
	Matched *int64 `json:"matched"`
}

type LinstorSatelliteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LinstorSatellite `json:"items"`
}

type LinstorSatelliteSpec struct {
	// ClusterRef references the LinstorCluster used to create this LinstorSatellite.
	ClusterRef ClusterReference `json:"clusterRef"`

	// Repository used to pull workload images.
	// +kubebuilder:validation:Optional
	Repository string `json:"repository,omitempty"`

	// Patches is a list of kustomize patches to apply.
	//
	// See https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/patches/ for how to create patches.
	// +kubebuilder:validation:Optional
	Patches []Patch `json:"patches,omitempty"`

	// StoragePools is a list of storage pools to configure on the node.
	// +kubebuilder:validation:Optional
	StoragePools []LinstorStoragePool `json:"storagePools,omitempty"`

	// Properties is a list of properties to set on the node.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorNodeProperty `json:"properties,omitempty"`

	// InternalTLS configures secure communication for the LINSTOR Satellite.
	//
	// If set, the control traffic between LINSTOR Controller and Satellite will be encrypted using mTLS.
	// The Controller will use the client key from `LinstorCluster.spec.internalTLS` when connecting.
	// +kubebuilder:validation:Optional
	// + Without "nullable" the k8s API does not accept patches with 'internalTLS: {}', which seems to be a bug.
	// +nullable
	InternalTLS *TLSConfigWithHandshakeDaemon `json:"internalTLS,omitempty"`

	// IPFamilies configures the IP Family (IPv4 or IPv6) to use to connect to the LINSTOR Satellite.
	//
	// If set, the control traffic between LINSTOR Controller and Satellite will use only the given IP Family.
	// If not set, the Operator will configure all families found in the Satellites Pods' Status.
	// +kubebuilder:validation:Optional
	IPFamilies []IPFamily `json:"ipFamilies,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=Retain
	DeletionPolicy DeletionPolicy `json:"deletionPolicy,omitempty"`

	// +kubebuilder:validation:Optional
	EvacuationStrategy EvacuationStrategy `json:"evacuationStrategy,omitempty"`
}

type LinstorSatelliteStatus struct {
	// Current LINSTOR Satellite state
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// The number of volumes on this Satellite.
	//+kubebuilder:validation:Optional
	NumberOfVolumes *int32 `json:"numberOfVolumes"`

	// The number of snapshots on this Satellite.
	//+kubebuilder:validation:Optional
	NumberOfSnapshots *int32 `json:"numberOfSnapshots"`

	// The number of bytes in total in all storage pools on this Satellite.
	//+kubebuilder:validation:Optional
	TotalCapacityBytes *int64 `json:"availableCapacityBytes"`

	// The number of bytes free in all storage pools on this Satellite.
	//+kubebuilder:validation:Optional
	FreeCapacityBytes *int64 `json:"freeCapacityBytes"`

	// Capacity mirrors the information from TotalCapacityBytes and FreeCapacityBytes in a human-readable string.
	//+kubebuilder:validation:Optional
	Capacity string `json:"capacity"`

	// StorageProviders lists the storage providers (LVM, ZFS, etc...) this Satellite supports.
	//+kubebuilder:validation:Optional
	StorageProviders []string `json:"storageProviders,omitempty"`

	// DeviceLayers lists the device layers (LUKS, CACHE, etc...) this Satellite supports.
	//+kubebuilder:validation:Optional
	DeviceLayers []string `json:"deviceLayers,omitempty"`
}

type LinstorStoragePool struct {
	// Name of the storage pool in linstor.
	//+kubebuilder:validation:MinLength=3
	Name string `json:"name"`

	// Properties to set on the storage pool.
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorNodeProperty `json:"properties,omitempty"`

	// Configures a LVM Volume Group as storage pool.
	// +kubebuilder:validation:Optional
	LvmPool *LinstorStoragePoolLvm `json:"lvmPool,omitempty"`
	// Configures a LVM Thin Pool as storage pool.
	// +kubebuilder:validation:Optional
	LvmThinPool *LinstorStoragePoolLvmThin `json:"lvmThinPool,omitempty"`
	// Configures a file system based storage pool, allocating a regular file per volume.
	// +kubebuilder:validation:Optional
	FilePool *LinstorStoragePoolFile `json:"filePool,omitempty"`
	// Configures a file system based storage pool, allocating a sparse file per volume.
	// +kubebuilder:validation:Optional
	FileThinPool *LinstorStoragePoolFile `json:"fileThinPool,omitempty"`
	// Configures a ZFS system based storage pool, allocating zvols from the given zpool.
	// +kubebuilder:validation:Optional
	ZfsPool *LinstorStoragePoolZfs `json:"zfsPool,omitempty"`
	// Configures a ZFS system based storage pool, allocating sparse zvols from the given zpool.
	// +kubebuilder:validation:Optional
	ZfsThinPool *LinstorStoragePoolZfs `json:"zfsThinPool,omitempty"`

	Source *LinstorStoragePoolSource `json:"source,omitempty"`
}

type LinstorStoragePoolFile struct {
	// Directory is the path to the host directory used to store volume data.
	Directory string `json:"directory,omitempty"`
}

type LinstorStoragePoolLvm struct {
	VolumeGroup string `json:"volumeGroup,omitempty"`
}

type LinstorStoragePoolLvmThin struct {
	VolumeGroup string `json:"volumeGroup,omitempty"`
	// ThinPool is the name of the thinpool LV (without VG prefix).
	ThinPool string `json:"thinPool,omitempty"`
}

type LinstorStoragePoolSource struct {
	// HostDevices is a list of device paths used to configure the given pool.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MinItems:=1
	HostDevices []string `json:"hostDevices,omitempty"`
}

type LinstorStoragePoolZfs struct {
	// ZPool is the name of the ZFS zpool.
	ZPool string `json:"zPool,omitempty"`
}

type MatchLabelSelector struct {
	// Key is the name of a node label.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	Key string `json:"key"`
	// Op to apply to the label.
	// Exists (default) checks for the presence of the label on both nodes in the pair.
	// DoesNotExist checks that the label is not present on either node in the pair.
	// In checks for the presence of the label value given by Values on both nodes in the pair.
	// NotIn checks that both nodes in the pair do not have any of the label values given by Values.
	// Same checks that the label value is equal in the node pair.
	// NotSame checks that the label value is not equal in the node pair.
	// +kubebuilder:default:=Exists
	// +kubebuilder:validation:Enum:=Exists;DoesNotExist;In;NotIn;Same;NotSame
	// +kubebuilder:validation:Optional
	Op MatchLabelSelectorOperator `json:"op,omitempty"`
	// Values to match on, using the provided Op.
	// +kubebuilder:validation:Optional
	Values []string `json:"values,omitempty"`
}

type MatchLabelSelectorOperator string

type Patch struct {
	// Patch is the content of a patch.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	Patch string `json:"patch,omitempty" yaml:"patch,omitempty"`

	// Target points to the resources that the patch is applied to
	Target *Selector `json:"target,omitempty" yaml:"target,omitempty"`

	// Options is a list of options for the patch
	// +kubebuilder:validation:Optional
	Options *PatchArgs `json:"options,omitempty" yaml:"options,omitempty"`
}

type PatchArgs struct {
	// AllowNameChange allows name changes to the resource.
	AllowNameChange bool `json:"allowNameChange,omitempty" yaml:"allowNameChange,omitempty"`

	// AllowKindChange allows kind changes to the resource.
	AllowKindChange bool `json:"allowKindChange,omitempty" yaml:"allowKindChange,omitempty"`
}

type Selector struct {
	Group   string `json:"group,omitempty" yaml:"group,omitempty"`
	Version string `json:"version,omitempty" yaml:"version,omitempty"`
	Kind    string `json:"kind,omitempty" yaml:"kind,omitempty"`

	// Name of the resource.
	Name string `json:"name,omitempty" yaml:"name,omitempty"`

	// Namespace the resource belongs to, if it can belong to a namespace.
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

	// AnnotationSelector is a string that follows the label selection expression
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
	// It matches against the resource annotations.
	AnnotationSelector string `json:"annotationSelector,omitempty" yaml:"annotationSelector,omitempty"`

	// LabelSelector is a string that follows the label selection expression
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
	// It matches against the resource labels.
	LabelSelector string `json:"labelSelector,omitempty" yaml:"labelSelector,omitempty"`
}

type SelectorTerm struct {
	// MatchLabels is a list of match expressions that the node pairs must meet.
	//+kubebuilder:validation:Required
	MatchLabels []MatchLabelSelector `json:"matchLabels,omitempty"`
}

type TLSConfig struct {
	// SecretName references a secret holding the TLS key and certificates.
	//+kubebuilder:validation:Optional
	SecretName string `json:"secretName,omitempty"`

	// CertManager references a cert-manager Issuer or ClusterIssuer.
	// If set, a Certificate resource will be created, provisioning the secret references in SecretName using the
	// issuer configured here.
	//+kubebuilder:validation:Optional
	CertManager *cmmetav1.ObjectReference `json:"certManager,omitempty"`

	// CAReference configures the CA certificate to use when validating TLS certificates.
	// If not set, the TLS secret is expected to contain a "ca.crt" containing the CA certificate.
	//+kubebuilder:validation:Optional
	CAReference *CAReference `json:"caReference,omitempty"`
}

type TLSConfigWithHandshakeDaemon struct {
	TLSConfig `json:",inline"`

	// TLSHandshakeDaemon enables tlshd for establishing TLS sessions for use by DRBD.
	//
	// If enabled, adds a new sidecar to the LINSTOR Satellite that runs the tlshd handshake daemon.
	// The daemon uses the TLS certificate and key to establish secure connections on behalf of DRBD.
	//+kubebuilder:validation:Optional
	TLSHandshakeDaemon bool `json:"tlsHandshakeDaemon,omitempty"`
}