v1

type ClusterReference struct {
	// Name of the LinstorCluster resource controlling this satellite.
	Name string `json:"name,omitempty"`

	// ClientSecretName references the secret used by the operator to validate the https endpoint.
	ClientSecretName string `json:"clientSecretName,omitempty"`

	// ExternalController references an external controller.
	// When set, the Operator uses the external cluster to register satellites.
	// +kubebuilder:validation:Optional
	ExternalController *LinstorExternalControllerRef `json:"externalController,omitempty"`
}

type ComponentSpec struct {
	// Enable the component.
	// +kubebuilder:default:=true
	// +kubebuilder:validation:Optional
	Enabled bool `json:"enabled,omitempty"`

	// Template to apply to Pods of the component.
	//
	// The template is applied as a patch to the default deployment, so it can be "sparse", not listing any
	// containers or volumes that should remain unchanged.
	// See https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:validation:Type=object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +structType=atomic
	PodTemplate json.RawMessage `json:"podTemplate,omitempty"`
}

type LinstorCluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LinstorClusterSpec   `json:"spec,omitempty"`
	Status LinstorClusterStatus `json:"status,omitempty"`
}

type LinstorClusterApiTLS struct {
	// ApiSecretName references a secret holding the TLS key and certificate used to protect the API.
	// Defaults to "linstor-api-tls".
	//+kubebuilder:validation:Optional
	ApiSecretName string `json:"apiSecretName,omitempty"`

	// ClientSecretName references a secret holding the TLS key and certificate used by the operator to configure
	// the cluster. Defaults to "linstor-client-tls".
	//+kubebuilder:validation:Optional
	ClientSecretName string `json:"clientSecretName,omitempty"`

	// CsiControllerSecretName references a secret holding the TLS key and certificate used by the CSI Controller
	// to provision volumes. Defaults to "linstor-csi-controller-tls".
	//+kubebuilder:validation:Optional
	CsiControllerSecretName string `json:"csiControllerSecretName,omitempty"`

	// CsiNodeSecretName references a secret holding the TLS key and certificate used by the CSI Nodes to query
	// the volume state. Defaults to "linstor-csi-node-tls".
	//+kubebuilder:validation:Optional
	CsiNodeSecretName string `json:"csiNodeSecretName,omitempty"`

	// CertManager references a cert-manager Issuer or ClusterIssuer.
	// If set, cert-manager.io/Certificate resources will be created, provisioning the secrets referenced in
	// *SecretName using the issuer configured here.
	//+kubebuilder:validation:Optional
	CertManager *cmmetav1.ObjectReference `json:"certManager,omitempty"`
}

type LinstorClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LinstorCluster `json:"items"`
}

type LinstorClusterSpec struct {
	// Repository used to pull workload images.
	// +kubebuilder:validation:Optional
	Repository string `json:"repository,omitempty"`

	// ExternalController references an external controller.
	// When set, the Operator will skip deploying a LINSTOR Controller and instead use the external cluster
	// to register satellites.
	// +kubebuilder:validation:Optional
	ExternalController *LinstorExternalControllerRef `json:"externalController,omitempty"`

	// NodeSelector selects the nodes on which LINSTOR Satellites will be deployed.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
	// +kubebuilder:validation:Optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// NodeAffinity selects the nodes on which LINSTOR Satellite will be deployed.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
	// +kubebuilder:validation:Optional
	NodeAffinity *corev1.NodeSelector `json:"nodeAffinity,omitempty"`

	// Properties to apply on the cluster level.
	//
	// Use to create default settings for DRBD that should apply to all resources or to configure some other cluster
	// wide default.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorControllerProperty `json:"properties,omitempty"`

	// Patches is a list of kustomize patches to apply.
	//
	// See https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/patches/ for how to create patches.
	// +kubebuilder:validation:Optional
	Patches []Patch `json:"patches,omitempty"`

	// LinstorPassphraseSecret used to configure the LINSTOR master passphrase.
	//
	// The referenced secret must contain a single key "MASTER_PASSPHRASE". The master passphrase is used to
	// * Derive encryption keys for volumes using the LUKS layer.
	// * Store credentials for accessing remotes for backups.
	// See https://linbit.com/drbd-user-guide/linstor-guide-1_0-en/#s-encrypt_commands for more information.
	// +kubebuilder:validation:Optional
	LinstorPassphraseSecret string `json:"linstorPassphraseSecret,omitempty"`

	// InternalTLS secures the connection between LINSTOR Controller and Satellite.
	//
	// This configures the client certificate used when the Controller connects to a Satellite. This only has an effect
	// when the Satellite is configured to for secure connections using `LinstorSatellite.spec.internalTLS`.
	// +kubebuilder:validation:Optional
	// + See LinstorSatelliteSpec.InternalTLS for why nullable is needed.
	// +nullable
	InternalTLS *TLSConfig `json:"internalTLS,omitempty"`

	// ApiTLS secures the LINSTOR API.
	//
	// This configures the TLS key and certificate used to secure the LINSTOR API.
	// +kubebuilder:validation:Optional
	// + See LinstorSatelliteSpec.InternalTLS for why nullable is needed.
	// +nullable
	ApiTLS *LinstorClusterApiTLS `json:"apiTLS,omitempty"`

	// Controller controls the deployment of the LINSTOR Controller Deployment.
	// +kubebuilder:validation:Optional
	Controller *ComponentSpec `json:"controller,omitempty"`

	// CSIController controls the deployment of the CSI Controller Deployment.
	// +kubebuilder:validation:Optional
	CSIController *ComponentSpec `json:"csiController,omitempty"`

	// CSINode controls the deployment of the CSI Node DaemonSet.
	// +kubebuilder:validation:Optional
	CSINode *ComponentSpec `json:"csiNode,omitempty"`

	// HighAvailabilityController controls the deployment of the High Availability Controller DaemonSet.
	// +kubebuilder:validation:Optional
	HighAvailabilityController *ComponentSpec `json:"highAvailabilityController,omitempty"`
}

type LinstorClusterStatus struct {
	// Current LINSTOR Cluster state
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type LinstorControllerProperty struct {
	// Name of the property to set.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	Name string `json:"name"`

	// Value to set the property to.
	Value string `json:"value,omitempty"`
}

type LinstorExternalControllerRef struct {
	// URL of the external controller.
	//+kubebuilder:validation:MinLength=3
	URL string `json:"url"`
}

type LinstorNodeConnection struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LinstorNodeConnectionSpec   `json:"spec,omitempty"`
	Status LinstorNodeConnectionStatus `json:"status,omitempty"`
}

type LinstorNodeConnectionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LinstorNodeConnection `json:"items"`
}

type LinstorNodeConnectionPath struct {
	// Name of the path.
	// +required
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Interface to use on both nodes.
	// +required
	// +kubebuilder:validation:Required
	Interface string `json:"interface"`
}

type LinstorNodeConnectionSpec struct {
	// Selector selects which pair of Satellites the connection should apply to.
	// If not given, the connection will be applied to all connections.
	// +kubebuilder:validation:Optional
	Selector []SelectorTerm `json:"selector,omitempty"`

	// Properties to apply for the node connection.
	//
	// Use to create default settings for DRBD that should apply to all resources connections between a set of
	// cluster nodes.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorControllerProperty `json:"properties,omitempty"`

	// Paths configure the network path used when connecting two nodes.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Paths []LinstorNodeConnectionPath `json:"paths,omitempty"`
}

type LinstorNodeConnectionStatus struct {
	// Current LINSTOR Node Connection state
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type LinstorNodeProperty struct {
	// Name of the property to set.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	Name string `json:"name"`

	// Value to set the property to.
	//+kubebuilder:validation:Optional
	Value string `json:"value,omitempty"`

	// ValueFrom sets the value from an existing resource.
	//+kubebuilder:validation:Optional
	ValueFrom *LinstorNodePropertyValueFrom `json:"valueFrom,omitempty"`

	// Optional values are only set if they have a non-empty value
	//+kubebuilder:validation:Optional
	Optional bool `json:"optional,omitempty"`
}

type LinstorNodePropertyValueFrom struct {
	// Select a field of the node. Supports `metadata.name`, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	NodeFieldRef string `json:"nodeFieldRef,omitempty"`
}

type LinstorSatellite struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LinstorSatelliteSpec   `json:"spec,omitempty"`
	Status LinstorSatelliteStatus `json:"status,omitempty"`
}

type LinstorSatelliteConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   LinstorSatelliteConfigurationSpec   `json:"spec,omitempty"`
	Status LinstorSatelliteConfigurationStatus `json:"status,omitempty"`
}

type LinstorSatelliteConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LinstorSatelliteConfiguration `json:"items"`
}

type LinstorSatelliteConfigurationSpec struct {
	// NodeSelector selects which LinstorSatellite resources this spec should be applied to.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
	// +kubebuilder:validation:Optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// NodeAffinity selects which LinstorSatellite resources this spec should be applied to.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
	// +kubebuilder:validation:Optional
	NodeAffinity *corev1.NodeSelector `json:"nodeAffinity,omitempty"`

	// Patches is a list of kustomize patches to apply.
	//
	// See https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/patches/ for how to create patches.
	// +kubebuilder:validation:Optional
	Patches []Patch `json:"patches,omitempty"`

	// StoragePools is a list of storage pools to configure on the node.
	// +kubebuilder:validation:Optional
	StoragePools []LinstorStoragePool `json:"storagePools,omitempty"`

	// Properties is a list of properties to set on the node.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorNodeProperty `json:"properties,omitempty"`

	// InternalTLS configures secure communication for the LINSTOR Satellite.
	//
	// If set, the control traffic between LINSTOR Controller and Satellite will be encrypted using mTLS.
	// +kubebuilder:validation:Optional
	// + See LinstorSatelliteSpec.InternalTLS for why nullable is needed.
	// +nullable
	InternalTLS *TLSConfigWithHandshakeDaemon `json:"internalTLS,omitempty"`

	// Template to apply to Satellite Pods.
	//
	// The template is applied as a patch to the default resource, so it can be "sparse", not listing any
	// containers or volumes that should remain unchanged.
	// See https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:validation:Type=object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +structType=atomic
	PodTemplate json.RawMessage `json:"podTemplate,omitempty"`
}

type LinstorSatelliteConfigurationStatus struct {
	// Current LINSTOR Satellite Config state
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type LinstorSatelliteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LinstorSatellite `json:"items"`
}

type LinstorSatelliteSpec struct {
	// ClusterRef references the LinstorCluster used to create this LinstorSatellite.
	ClusterRef ClusterReference `json:"clusterRef"`

	// Repository used to pull workload images.
	// +kubebuilder:validation:Optional
	Repository string `json:"repository,omitempty"`

	// Patches is a list of kustomize patches to apply.
	//
	// See https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/patches/ for how to create patches.
	// +kubebuilder:validation:Optional
	Patches []Patch `json:"patches,omitempty"`

	// StoragePools is a list of storage pools to configure on the node.
	// +kubebuilder:validation:Optional
	StoragePools []LinstorStoragePool `json:"storagePools,omitempty"`

	// Properties is a list of properties to set on the node.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorNodeProperty `json:"properties,omitempty"`

	// InternalTLS configures secure communication for the LINSTOR Satellite.
	//
	// If set, the control traffic between LINSTOR Controller and Satellite will be encrypted using mTLS.
	// The Controller will use the client key from `LinstorCluster.spec.internalTLS` when connecting.
	// +kubebuilder:validation:Optional
	// + Without "nullable" the k8s API does not accept patches with 'internalTLS: {}', which seems to be a bug.
	// +nullable
	InternalTLS *TLSConfigWithHandshakeDaemon `json:"internalTLS,omitempty"`
}

type LinstorSatelliteStatus struct {
	// Current LINSTOR Satellite state
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type LinstorStoragePool struct {
	// Name of the storage pool in linstor.
	//+kubebuilder:validation:MinLength=3
	Name string `json:"name"`

	// Properties to set on the storage pool.
	// +listType=map
	// +listMapKey=name
	// +patchMergeKey=name
	// +patchStrategy=merge
	Properties []LinstorNodeProperty `json:"properties,omitempty"`

	// Configures a LVM Volume Group as storage pool.
	// +kubebuilder:validation:Optional
	LvmPool *LinstorStoragePoolLvm `json:"lvmPool,omitempty"`
	// Configures a LVM Thin Pool as storage pool.
	// +kubebuilder:validation:Optional
	LvmThinPool *LinstorStoragePoolLvmThin `json:"lvmThinPool,omitempty"`
	// Configures a file system based storage pool, allocating a regular file per volume.
	// +kubebuilder:validation:Optional
	FilePool *LinstorStoragePoolFile `json:"filePool,omitempty"`
	// Configures a file system based storage pool, allocating a sparse file per volume.
	// +kubebuilder:validation:Optional
	FileThinPool *LinstorStoragePoolFile `json:"fileThinPool,omitempty"`

	Source *LinstorStoragePoolSource `json:"source,omitempty"`
}

type LinstorStoragePoolFile struct {
	// Directory is the path to the host directory used to store volume data.
	Directory string `json:"directory,omitempty"`
}

type LinstorStoragePoolLvm struct {
	VolumeGroup string `json:"volumeGroup,omitempty"`
}

type LinstorStoragePoolLvmThin struct {
	VolumeGroup string `json:"volumeGroup,omitempty"`
	// ThinPool is the name of the thinpool LV (without VG prefix).
	ThinPool string `json:"thinPool,omitempty"`
}

type LinstorStoragePoolSource struct {
	// HostDevices is a list of device paths used to configure the given pool.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MinItems:=1
	HostDevices []string `json:"hostDevices,omitempty"`
}

type MatchLabelSelector struct {
	// Key is the name of a node label.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	Key string `json:"key"`
	// Op to apply to the label.
	// Exists (default) checks for the presence of the label on both nodes in the pair.
	// DoesNotExist checks that the label is not present on either node in the pair.
	// In checks for the presence of the label value given by Values on both nodes in the pair.
	// NotIn checks that both nodes in the pair do not have any of the label values given by Values.
	// Same checks that the label value is equal in the node pair.
	// NotSame checks that the label value is not equal in the node pair.
	// +kubebuilder:default:=Exists
	// +kubebuilder:validation:Enum:=Exists;DoesNotExist;In;NotIn;Same;NotSame
	// +kubebuilder:validation:Optional
	Op MatchLabelSelectorOperator `json:"op,omitempty"`
	// Values to match on, using the provided Op.
	// +kubebuilder:validation:Optional
	Values []string `json:"values,omitempty"`
}

type MatchLabelSelectorOperator string

type Patch struct {
	// Patch is the content of a patch.
	//+kubebuilder:validation:MinLength=1
	//+kubebuilder:validation:Required
	Patch string `json:"patch,omitempty" yaml:"patch,omitempty"`

	// Target points to the resources that the patch is applied to
	Target *Selector `json:"target,omitempty" yaml:"target,omitempty"`

	// Options is a list of options for the patch
	// +kubebuilder:validation:Optional
	Options map[string]bool `json:"options,omitempty" yaml:"options,omitempty"`
}

type Selector struct {
	Group   string `json:"group,omitempty" yaml:"group,omitempty"`
	Version string `json:"version,omitempty" yaml:"version,omitempty"`
	Kind    string `json:"kind,omitempty" yaml:"kind,omitempty"`

	// Name of the resource.
	Name string `json:"name,omitempty" yaml:"name,omitempty"`

	// Namespace the resource belongs to, if it can belong to a namespace.
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

	// AnnotationSelector is a string that follows the label selection expression
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
	// It matches against the resource annotations.
	AnnotationSelector string `json:"annotationSelector,omitempty" yaml:"annotationSelector,omitempty"`

	// LabelSelector is a string that follows the label selection expression
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
	// It matches against the resource labels.
	LabelSelector string `json:"labelSelector,omitempty" yaml:"labelSelector,omitempty"`
}

type SelectorTerm struct {
	// MatchLabels is a list of match expressions that the node pairs must meet.
	//+kubebuilder:validation:Required
	MatchLabels []MatchLabelSelector `json:"matchLabels,omitempty"`
}

type TLSConfig struct {
	// SecretName references a secret holding the TLS key and certificates.
	//+kubebuilder:validation:Optional
	SecretName string `json:"secretName,omitempty"`

	// CertManager references a cert-manager Issuer or ClusterIssuer.
	// If set, a Certificate resource will be created, provisioning the secret references in SecretName using the
	// issuer configured here.
	//+kubebuilder:validation:Optional
	CertManager *cmmetav1.ObjectReference `json:"certManager,omitempty"`
}

type TLSConfigWithHandshakeDaemon struct {
	TLSConfig `json:",inline"`

	// TLSHandshakeDaemon enables tlshd for establishing TLS sessions for use by DRBD.
	//
	// If enabled, adds a new sidecar to the LINSTOR Satellite that runs the tlshd handshake daemon.
	// The daemon uses the TLS certificate and key to establish secure connections on behalf of DRBD.
	//+kubebuilder:validation:Optional
	TLSHandshakeDaemon bool `json:"tlsHandshakeDaemon,omitempty"`
}