v1alpha1

type AWSProviderCredentials struct {
	// Region is the name of the AWS region cluster lives in.
	// +kubebuilder:validation:Required
	Region string `json:"region"`

	// AccessKeyID is your access key ID used to authenticate against AWS API.
	// +kubebuilder:validation:Optional
	AccessKeyID *string `json:"accessKeyID,omitempty"`

	// SecretAccessKeyRef is a reference to the secret that contains secret access key.
	// Since UpgradeInsights is a cluster-scoped resource we can't use local reference.
	//
	// SecretAccessKey must be stored in a key named "secretAccessKey".
	//
	// An example secret can look like this:
	//	apiVersion: v1
	//	kind: Secret
	//	metadata:
	//    name: eks-credentials
	//    namespace: upgrade-insights-test
	//	stringData:
	//    secretAccessKey: "changeme"
	//
	// Then it can be referenced like this:
	//    ...
	//    secretAccessKeyRef:
	//      name: eks-credentials
	//      namespace: upgrade-insights-test
	//
	// +kubebuilder:validation:Optional
	SecretAccessKeyRef *corev1.SecretReference `json:"secretAccessKeyRef,omitempty"`
}

type AgentConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentConfigurationSpec `json:"spec,omitempty"`
	Status Status                 `json:"status,omitempty"`
}

type AgentConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentConfiguration `json:"items"`
}

type AgentConfigurationSpec struct {
	// ServicePollInterval defines how often the agent polls for services.
	// Expected format is a duration string (e.g., "30s", "5m").
	// Set to "0s" to disable service polling.
	ServicePollInterval *string `json:"servicePollInterval,omitempty"`

	// ClusterPingInterval specifies the interval at which the agent pings the cluster.
	// Set to "0s" to disable cluster pings.
	ClusterPingInterval *string `json:"clusterPingInterval,omitempty"`

	// CompatibilityUploadInterval determines how frequently the agent uploads compatibility data.
	// Set to "0s" to disable compatibility uploads.
	CompatibilityUploadInterval *string `json:"compatibilityUploadInterval,omitempty"`

	// StackPollInterval sets how often the agent polls for stack updates or changes.
	// Set to "0s" to disable stack polling.
	StackPollInterval *string `json:"stackPollInterval,omitempty"`

	// PipelineGateInterval specifies how frequently the agent checks pipeline gates.
	// Set to "0s" to disable pipeline gate checks.
	PipelineGateInterval *string `json:"pipelineGateInterval,omitempty"`

	// MaxConcurrentReconciles controls the maximum number of concurrent reconcile loops.
	// Higher values can increase throughput at the cost of resource usage.
	MaxConcurrentReconciles *int `json:"maxConcurrentReconciles,omitempty"`

	// VulnerabilityReportUploadInterval sets how often vulnerability reports are uploaded.
	// Set to "0s" to disable vulnerability report uploads.
	VulnerabilityReportUploadInterval *string `json:"vulnerabilityReportUploadInterval,omitempty"`

	// BaseRegistryURL allows overriding the default base registry URL.
	// For stack run jobs, agent run pods, sentinel run jobs.
	BaseRegistryURL *string `json:"baseRegistryURL,omitempty"`

	// MaxSentinelRunJobs limits the number of concurrent SentinelRunJobs that can be active at any given time.
	// Must be greater than 0. Set this field to nil (omit) to disable the limit.
	// +kubebuilder:validation:Minimum=1
	MaxSentinelRunJobs *int `json:"maxSentinelRunJobs,omitempty"`

	// MaxStackRunJobs limits the number of concurrent StackRunJobs that can be active at any given time.
	// Must be greater than 0. Set this field to nil (omit) to disable the limit.
	// +kubebuilder:validation:Minimum=1
	MaxStackRunJobs *int `json:"maxStackRunJobs,omitempty"`

	// MaxAgentRunPods limits the number of concurrent agent run pods that can be active at any given time.
	// Must be greater than 0. Set this field to nil (omit) to disable the limit.
	// +kubebuilder:validation:Minimum=1
	MaxAgentRunPods *int `json:"maxAgentRunPods,omitempty"`

	// DisableWebsocket disables the cluster websocket connection to the Console.
	// When enabled, the agent will rely exclusively on polling instead of receiving
	// push updates. This is useful in large-scale edge deployments where maintaining
	// persistent websocket connections has an infeasible network cost.
	DisableWebsocket *bool `json:"disableWebsocket,omitempty"`
}

type AgentHelmConfiguration struct {
	HelmConfiguration `json:",inline"`
}

type AgentRun struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentRunSpec   `json:"spec,omitempty"`
	Status AgentRunStatus `json:"status,omitempty"`
}

type AgentRunList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentRun `json:"items"`
}

type AgentRunPhase string

type AgentRunSpec struct {
	// +kubebuilder:validation:Required
	RuntimeRef AgentRuntimeReference `json:"runtimeRef"`

	// Prompt is the task/prompt given to the agent
	// +kubebuilder:validation:Required
	Prompt string `json:"prompt"`

	// Repository is the git repository the agent will work with
	// +kubebuilder:validation:Required
	Repository string `json:"repository"`

	// Mode defines how the agent should run (ANALYZE, WRITE)
	// +kubebuilder:validation:Required
	Mode console.AgentRunMode `json:"mode"`

	// FlowID is the flow this agent run is associated with (optional)
	// +kubebuilder:validation:Optional
	FlowID *string `json:"flowId,omitempty"`

	// Language is the programming language used in the agent run.
	//
	// Deprecated: No longer used for image selection. Enable dind on the AgentRuntime instead.
	// +kubebuilder:validation:Optional
	Language *console.AgentRunLanguage `json:"language,omitempty"`

	// LanguageVersion is the version of the language to use, if you wish to specify.
	//
	// Deprecated: No longer used for image selection. Enable dind on the AgentRuntime instead.
	// +kubebuilder:validation:Optional
	LanguageVersion *string `json:"languageVersion,omitempty"`
}

type AgentRunStatus struct {
	// PodRef references the pod running this agent
	// +kubebuilder:validation:Optional
	PodRef *corev1.ObjectReference `json:"podRef,omitempty"`

	// Phase represents the current phase of the agent run
	// +kubebuilder:validation:Optional
	Phase AgentRunPhase `json:"phase,omitempty"`

	// StartTime is when the agent run started
	// +kubebuilder:validation:Optional
	StartTime *metav1.Time `json:"startTime,omitempty"`

	// EndTime is when the agent run completed
	// +kubebuilder:validation:Optional
	EndTime *metav1.Time `json:"endTime,omitempty"`

	// Error message if the run failed
	// +kubebuilder:validation:Optional
	Error *string `json:"error,omitempty"`

	// Standard status fields (includes ID field for console API)
	Status `json:",inline"`
}

type AgentRuntime struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentRuntimeSpec `json:"spec,omitempty"`
	Status Status           `json:"status,omitempty"`
}

type AgentRuntimeBindings struct {
	// Create bindings control who can generate new agent runtimes.
	// +kubebuilder:validation:Optional
	Create []Binding `json:"create,omitempty"`
}

type AgentRuntimeConfig struct {
	// Config for Claude CLI runtime.
	// +kubebuilder:validation:Optional
	Claude *ClaudeConfig `json:"claude,omitempty"`

	// Config for OpenCode CLI runtime.
	// +kubebuilder:validation:Optional
	OpenCode *OpenCodeConfig `json:"opencode,omitempty"`

	// Config for Gemini CLI runtime.
	// +kubebuilder:validation:Optional
	Gemini *GeminiConfig `json:"gemini,omitempty"`

	// Codex config for Codex CLI runtime.
	// +kubebuilder:validation:Optional
	Codex *CodexConfig `json:"codex,omitempty"`
}

type AgentRuntimeConfigRaw struct {
	// Claude is the raw configuration for the Claude runtime.
	// +kubebuilder:validation:Optional
	Claude *ClaudeConfigRaw `json:"claude,omitempty"`

	// OpenCode is the raw configuration for the OpenCode runtime.
	// +kubebuilder:validation:Optional
	OpenCode *OpenCodeConfigRaw `json:"opencode,omitempty"`

	// Gemini is the raw configuration for the Gemini runtime.
	// +kubebuilder:validation:Optional
	Gemini *GeminiConfigRaw `json:"gemini,omitempty"`

	// Codex is the raw configuration for the Codex runtime.
	// +kubebuilder:validation:Optional
	Codex *CodexConfigRaw `json:"codex,omitempty"`
}

type AgentRuntimeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentRuntime `json:"items"`
}

type AgentRuntimeReference struct {
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type AgentRuntimeSpec struct {
	// Name of this AgentRuntime.
	// If not provided, the name from AgentRuntime.ObjectMeta will be used.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty"`

	// Default indicates whether this is the default agent runtime for coding agents.
	// +kubebuilder:validation:Optional
	Default *bool `json:"default,omitempty"`

	// +kubebuilder:validation:Required
	TargetNamespace string `json:"targetNamespace"`

	// Type specifies the agent runtime to use for executing the stack.
	// One of CLAUDE, OPENCODE, GEMINI, CODEX, CUSTOM.
	// +kubebuilder:validation:Enum=CLAUDE;OPENCODE;GEMINI;CODEX;CUSTOM
	// +kubebuilder:validation:Required
	Type console.AgentRuntimeType `json:"type"`

	// Bindings define the creation permissions for this agent runtime.
	// +kubebuilder:validation:Optional
	Bindings *AgentRuntimeBindings `json:"bindings,omitempty"`

	// Template defines the pod template for this agent runtime.
	Template *corev1.PodTemplateSpec `json:"template,omitempty"`

	// Config contains typed configuration depending on the chosen runtime type.
	// +kubebuilder:validation:Optional
	Config *AgentRuntimeConfig `json:"config,omitempty"`

	// AiProxy routes LLM requests through the Console AI proxy (/ext/ai) using the deploy token,
	// so provider API keys in spec.config are optional.
	//
	// Set the model on the runtime-specific config block (for example spec.config.codex.model).
	// The proxy expects models in provider/name format (for example openai/gpt-5.4,
	// anthropic/claude-sonnet-4-5, vertex/gemini-2.5-pro). Values that already include a "/"
	// are passed through unchanged.
	//
	// When only a bare model id is given, the harness may prefix it by runtime type:
	//   - CLAUDE: anthropic/{model} (for example claude-sonnet-4-5 -> anthropic/claude-sonnet-4-5)
	//   - CODEX, OPENCODE: openai/{model} (for example gpt-5.4 -> openai/gpt-5.4)
	//   - GEMINI: vertex/{model}
	//   - CUSTOM: no automatic prefix; use provider/name explicitly
	AiProxy *bool `json:"aiProxy,omitempty"`

	// Dind enables Docker-in-Docker for this agent runtime.
	// When true, the runtime will be configured to run with DinD support.
	// +kubebuilder:validation:Optional
	Dind *bool `json:"dind,omitempty"`

	// AllowedRepositories the git repositories allowed to be used with this runtime.
	// +kubebuilder:validation:Optional
	AllowedRepositories []string `json:"allowedRepositories,omitempty"`

	// Browser configuration augments agent runtime with a headless browser.
	// When provided, the runtime will be configured to run with a headless browser available
	// for the agent to use.
	// +kubebuilder:validation:Optional
	Browser *BrowserConfig `json:"browser,omitempty"`

	// BootstrapScript is a bash script that will be executed inside the cloned repository
	// directory before the coding agent starts. It can be used to install dependencies,
	// configure tooling, or perform any other setup required by the agent.
	// +kubebuilder:validation:Optional
	BootstrapScript *string `json:"bootstrapScript,omitempty"`

	// Git configure commit signing on agent run. When provided, the runtime will be configured to sign git commits using the provided key reference.
	Git *GitSpec `json:"git,omitempty"`

	// BabysitInterval configures the interval for the operator to check on the health of the agent runtime and perform necessary babysitting actions (e.g. restarting unhealthy runtimes). When not provided, a default interval of 1 minute will be used.
	BabysitInterval *metav1.Duration `json:"babysitInterval,omitempty"`

	// ScmConnection is the name of an ScmConnection in Console to use for git operations on agent runs using this runtime.
	// This should match the name of an existing ScmConnection resource or connection created in the Plural UI.
	// +kubebuilder:validation:Optional
	ScmConnection *string `json:"scmConnection,omitempty"`

	// ExaConnection enables Exa web search and content retrieval tools on the Plural MCP server.
	ExaConnection *ExaConnection `json:"exaConnection,omitempty"`
}

type Binding struct {
	// +kubebuilder:validation:Optional
	ID *string `json:"id,omitempty"`

	// +kubebuilder:validation:Optional
	UserID *string `json:"UserID,omitempty"`

	// +kubebuilder:validation:Optional
	UserEmail *string `json:"userEmail,omitempty"`

	// +kubebuilder:validation:Optional
	GroupID *string `json:"groupID,omitempty"`

	// +kubebuilder:validation:Optional
	GroupName *string `json:"groupName,omitempty"`
}

type Bindings struct {
	// Read bindings.
	// +kubebuilder:validation:Optional
	Read []Binding `json:"read,omitempty"`

	// Write bindings.
	// +kubebuilder:validation:Optional
	Write []Binding `json:"write,omitempty"`
}

type Browser string

type BrowserConfig struct {
	// Enabled controls whether the browser runtime is enabled for this agent runtime.
	//
	// +kubebuilder:validation:Required
	Enabled bool `json:"enabled"`

	// Browser defines the browser to use. When using non-custom options,
	// predefined images with validated configurations will be used. Default configuration
	// can be overridden by specifying a custom Container. When using a "custom" browser,
	// a custom Container configuration must be provided.
	//
	// Available options are:
	// - chrome - uses browserless/chrome image
	// - chromium - uses browserless/chromium image
	// - firefox - uses browserless/firefox image
	// - selenium-chrome - uses selenium/standalone-chrome image
	// - selenium-chromium - uses selenium/standalone-chromium image
	// - selenium-firefox - uses selenium/standalone-firefox image
	// - selenium-edge - uses selenium/standalone-edge image
	// - puppeteer - uses browserless/chromium image
	// - custom
	//
	// Default: chrome
	//
	// +kubebuilder:validation:Enum:=chrome;chromium;firefox;selenium-chrome;selenium-chromium;selenium-firefox;selenium-edge;puppeteer;custom
	// +kubebuilder:default:=chrome
	// +kubebuilder:validation:Optional
	Browser *Browser `json:"browser,omitempty"`

	// Container defines the container to use for the browser runtime.
	// For custom images, ensure the container starts a browser server and binds to
	// the predetermined port 3000 for remote access from the main agent container.
	// When using a predefined image, only partial overrides are allowed, including:
	// - environment variables
	// - resource limits
	// - image pull policy
	//
	//
	// # Examples
	//
	// Selenium:
	//   name: browser
	//   image: selenium/standalone-chrome:144.0
	//   env:
	//   - name: SE_OPTS
	//     value: "--port 3000"
	//
	// +kubebuilder:validation:Optional
	Container *corev1.Container `json:"container,omitempty"`
}

type CapiConfigurationClusterSpec struct {
	// Cluster is a simplified representation of the Console API cluster
	// object. See [ClusterSpec] for more information.
	// +kubebuilder:validation:Optional
	Cluster *ClusterSpec `json:"cluster,omitempty"`

	// TokenSecretRef contains the reference to the secret holding the token to access the Console API
	// +kubebuilder:validation:Required
	ConsoleTokenSecretRef corev1.SecretKeySelector `json:"consoleTokenSecretRef"`

	// CapiClusterRef contains the reference to the CAPI cluster
	// +kubebuilder:validation:Required
	CapiClusterRef corev1.ObjectReference `json:"capiClusterRef"`

	// Agent allows configuring agent specific helm chart options.
	// +kubebuilder:validation:Optional
	Agent *AgentHelmConfiguration `json:"agent,omitempty"`
}

type ClaudeConfig struct {
	// ApiKeySecretRef references a Secret containing the Claude API key.
	// Optional when aiProxy is enabled; authentication uses the Console deploy token instead.
	// +kubebuilder:validation:Optional
	ApiKeySecretRef *corev1.SecretKeySelector `json:"apiKeySecretRef,omitempty"`

	// Model Name of the model to use.
	Model *string `json:"model,omitempty"`

	// Endpoint is the base URL for the Claude API (supports Bedrock/Anthropic-compatible endpoints).
	// +kubebuilder:validation:Optional
	Endpoint *string `json:"endpoint,omitempty"`

	// ExtraArgs CLI args for advanced flags not modeled here
	ExtraArgs []string `json:"extraArgs,omitempty"`

	// Timeout bounds a single claude CLI run invocation.
	// +kubebuilder:validation:Optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`

	// BashTimeout is the default timeout for any bash command Claude execute.
	// +kubebuilder:validation:Optional
	BashTimeout *metav1.Duration `json:"bashTimeout,omitempty"`

	// BashMaxTimeout is the maximum time Claude is permitted to wait
	// for a command before it is terminated.
	// +kubebuilder:validation:Optional
	BashMaxTimeout *metav1.Duration `json:"bashMaxTimeout,omitempty"`
}

type ClaudeConfigRaw struct {
	// ApiKey is the raw API key to use.
	ApiKey string `json:"apiKey,omitempty"`

	// Model Name of the model to use.
	Model *string `json:"model,omitempty"`

	// Endpoint is the base URL for the Claude API (supports Bedrock/Anthropic-compatible endpoints).
	// +kubebuilder:validation:Optional
	Endpoint *string `json:"endpoint,omitempty"`

	// ExtraArgs CLI args for advanced flags not modeled here
	ExtraArgs []string `json:"extraArgs,omitempty"`

	// Timeout bounds a single claude CLI run invocation.
	// +kubebuilder:validation:Optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`

	// BashTimeout is the default timeout for any bash command Claude executes.
	// +kubebuilder:validation:Optional
	BashTimeout *metav1.Duration `json:"bashTimeout,omitempty"`

	// BashMaxTimeout is the maximum time Claude is permitted to wait
	// for a command before it is terminated.
	// +kubebuilder:validation:Optional
	BashMaxTimeout *metav1.Duration `json:"bashMaxTimeout,omitempty"`
}

type ClusterDrain struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterDrainSpec   `json:"spec,omitempty"`
	Status ClusterDrainStatus `json:"status,omitempty"`
}

type ClusterDrainList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterDrain `json:"items"`
}

type ClusterDrainSpec struct {
	FlowControl   FlowControl           `json:"flowControl"`
	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
}

type ClusterDrainStatus struct {
	// Represents the observations of a HealthConvert current state.
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
	Progress   []Progress         `json:"progress,omitempty"`
}

type ClusterSpec struct {
	// Handle is a short, unique human-readable name used to identify this cluster.
	// Does not necessarily map to the cloud resource name.
	// +kubebuilder:validation:Optional
	// +kubebuilder:example:=myclusterhandle
	Handle *string `json:"handle,omitempty"`

	// Tags used to filter clusters.
	// +kubebuilder:validation:Optional
	Tags map[string]string `json:"tags,omitempty"`

	// Metadata for the cluster
	// +kubebuilder:validation:Optional
	Metadata *runtime.RawExtension `json:"metadata,omitempty"`

	// Bindings contain read and write policies of this cluster
	// +kubebuilder:validation:Optional
	Bindings *Bindings `json:"bindings,omitempty"`
}

type CodexConfig struct {
	// ApiKeySecretRef references a Secret containing the Codex API key.
	// Optional when aiProxy is enabled; authentication uses the Console deploy token instead.
	// +kubebuilder:validation:Optional
	ApiKeySecretRef *corev1.SecretKeySelector `json:"apiKeySecretRef,omitempty"`

	// Model to use.
	Model *string `json:"model,omitempty"`

	// Endpoint is the base URL for the Codex API (supports OpenAI/Azure-compatible endpoints).
	// +kubebuilder:validation:Optional
	Endpoint *string `json:"endpoint,omitempty"`

	// Timeout bounds a single codex run invocation.
	// +kubebuilder:validation:Optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
}

type CodexConfigRaw struct {
	// ApiKey is the raw API key to use.
	ApiKey string `json:"apiKey,omitempty"`

	// Model to use.
	Model *string `json:"model,omitempty"`

	// Endpoint is the base URL for the Codex API (supports OpenAI/Azure-compatible endpoints).
	// +kubebuilder:validation:Optional
	Endpoint *string `json:"endpoint,omitempty"`

	// Timeout bounds a single codex run invocation.
	// +kubebuilder:validation:Optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
}

type ConditionMessage string

type ConditionReason string

type ConditionType string

type CustomHealth struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CustomHealthSpec   `json:"spec,omitempty"`
	Status CustomHealthStatus `json:"status,omitempty"`
}

type CustomHealthList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CustomHealth `json:"items"`
}

type CustomHealthSpec struct {
	Script string `json:"script,omitempty"`
}

type CustomHealthStatus struct {
	// Represents the observations of a HealthConvert current state.
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type ExaConnection struct {
	// URL is the Exa API base URL. Defaults to https://api.exa.ai when unset.
	// +kubebuilder:validation:Optional
	URL *string `json:"url,omitempty"`

	// ApiKeySecretRef references a Secret containing the Exa API key.
	// +kubebuilder:validation:Optional
	ApiKeySecretRef *corev1.SecretKeySelector `json:"apiKeySecretRef,omitempty"`

	// ProxyURL is an HTTP proxy URL used for Exa API requests.
	// +kubebuilder:validation:Optional
	ProxyURL *string `json:"proxyUrl,omitempty"`
}

type ExaConnectionRaw struct {
	URL *string `json:"url,omitempty"`

	// ApiKey is the raw Exa API key.
	ApiKey *string `json:"apiKey,omitempty"`

	ProxyURL *string `json:"proxyUrl,omitempty"`
}

type FlowControl struct {
	Percentage     *int `json:"percentage,omitempty"`
	MaxConcurrency *int `json:"maxConcurrency,omitempty"`
}

type GateSpec struct {
	// resuse JobSpec type from the kubernetes api
	JobSpec *batchv1.JobSpec `json:"job"`
}

type GateState console.GateState

type GateType console.GateType

type GeminiConfig struct {
	// APIKeySecretRef references a Secret containing the Gemini API key.
	// Optional when aiProxy is enabled; authentication uses the Console deploy token instead.
	// +kubebuilder:validation:Optional
	APIKeySecretRef *corev1.SecretKeySelector `json:"apiKeySecretRef,omitempty"`

	// Model is the name of the model to use.
	// NOTE: gemini flash lite models and are not fit for the write (agent) mode, and
	// should only be used for analysis.
	// +kubebuilder:validation:Optional
	Model *string `json:"model,omitempty"`

	// Timeout bounds a single gemini run invocation.
	// +kubebuilder:validation:Optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`

	// InactivityTimeout is the timeout for inactivity during a gemini run.
	// +kubebuilder:validation:Optional
	InactivityTimeout *metav1.Duration `json:"inactivityTimeout,omitempty"`

	// +kubebuilder:validation:Optional
	Endpoint *string `json:"endpoint,omitempty"`
}

type GeminiConfigRaw struct {
	// APIKey is the raw Gemini API key to use.
	APIKey string `json:"apiKey,omitempty"`

	// Model is the name of the model to use.
	Model *string `json:"model,omitempty"`

	// Timeout bounds a single gemini run invocation.
	// +kubebuilder:validation:Optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`

	// InactivityTimeout is the timeout for inactivity during gemini run.
	// +kubebuilder:validation:Optional
	InactivityTimeout *metav1.Duration `json:"inactivityTimeout,omitempty"`

	// +kubebuilder:validation:Optional
	Endpoint *string `json:"endpoint,omitempty"`
}

type GitSpec struct {
	Proxy         *string                   `json:"proxy,omitempty"`
	SigningKeyRef *corev1.SecretKeySelector `json:"signingKeyRef,omitempty"`
}

type Hasher func(interface{}) (string, error)

type HelmConfiguration struct {
	// ChartName is a helm chart name.
	ChartName *string `json:"chartName,omitempty"`

	// RepoUrl is a url that points to this helm chart.
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:validation:Optional
	RepoUrl *string `json:"repoUrl,omitempty"`

	// Values allows defining arbitrary YAML values to pass to the helm as values.yaml file.
	// Use only one of:
	// 	- Values
	//	- ValuesSecretRef
	//	- ValuesConfigMapRef
	// +kubebuilder:validation:Optional
	Values *runtime.RawExtension `json:"values,omitempty"`

	// ValuesSecretRef fetches helm values from a secret in this cluster.
	// Use only one of:
	// 	- Values
	//	- ValuesSecretRef
	//	- ValuesConfigMapRef
	// +kubebuilder:validation:Optional
	ValuesSecretRef *corev1.SecretKeySelector `json:"valuesSecretRef,omitempty"`

	// ValuesConfigMapRef fetches helm values from a config map in this cluster.
	// Use only one of:
	// 	- Values
	//	- ValuesSecretRef
	//	- ValuesConfigMapRef
	// +kubebuilder:validation:Optional
	ValuesConfigMapRef *corev1.ConfigMapKeySelector `json:"valuesConfigMapRef,omitempty"`
}

type HelmSpec struct {
	// Agent allows configuring agent specific helm chart options.
	// +kubebuilder:validation:Optional
	Agent *AgentHelmConfiguration `json:"agent,omitempty"`

	// VCluster allows configuring vcluster specific helm chart options.
	// +kubebuilder:validation:Optional
	VCluster *VClusterHelmConfiguration `json:"vcluster,omitempty"`
}

type IngressReplica struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec of the IngressReplica
	// +kubebuilder:validation:Required
	Spec IngressReplicaSpec `json:"spec"`

	// Status of the IngressReplica
	// +kubebuilder:validation:Optional
	Status Status `json:"status,omitempty"`
}

type IngressReplicaList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IngressReplica `json:"items"`
}

type IngressReplicaSpec struct {
	// +kubebuilder:validation:Required
	IngressRef corev1.ObjectReference `json:"ingressRef"`

	// +kubebuilder:validation:Optional
	IngressClassName *string `json:"ingressClassName,omitempty"`

	// +kubebuilder:validation:Optional
	TLS []v1.IngressTLS `json:"tls,omitempty"`

	// +kubebuilder:validation:Required
	HostMappings map[string]string `json:"hostMappings"`
}

type KubecostExtractor struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec KubecostExtractorSpec `json:"spec"`

	// Status of the MetricsAggregate
	Status Status `json:"status,omitempty"`
}

type KubecostExtractorList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []KubecostExtractor `json:"items"`
}

type KubecostExtractorSpec struct {
	// +kubebuilder:default="1h"
	// +kubebuilder:validation:Optional
	Interval           *string                `json:"interval,omitempty"`
	KubecostServiceRef corev1.ObjectReference `json:"kubecostServiceRef"`
	// +kubebuilder:validation:Optional
	KubecostPort *int32 `json:"kubecostPort,omitempty"`
	// RecommendationThreshold float value for example: `1.2 or 0.001`
	RecommendationThreshold string `json:"recommendationThreshold"`
	// +kubebuilder:validation:Optional
	RecommendationsSettings *RecommendationsSettings `json:"recommendationsSettings,omitempty"`
}

type MetricsAggregate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Status of the MetricsAggregate
	// +kubebuilder:validation:Optional
	// +kubebuilder:printcolumn:name="Nodes",type=integer,JSONPath=".status.nodes",description="Number of Cluster Nodes"
	// +kubebuilder:printcolumn:name="MemoryTotalBytes",type=integer,JSONPath=".status.memoryTotalBytes",description="Memory total bytes"
	// +kubebuilder:printcolumn:name="MemoryAvailableBytes",type=integer,JSONPath=".status.memoryAvailableBytes",description="Memory available bytes"
	// +kubebuilder:printcolumn:name="MemoryUsedPercentage",type=integer,JSONPath=".status.memoryUsedPercentage",description="Memory used percentage"
	// +kubebuilder:printcolumn:name="CPUTotalMillicores",type=integer,JSONPath=".status.cpuTotalMillicores",description="CPU total millicores"
	// +kubebuilder:printcolumn:name="CPUAvailableMillicores",type=integer,JSONPath=".status.cpuAvailableMillicores",description="CPU available millicores"
	// +kubebuilder:printcolumn:name="CPUUsedPercentage",type=integer,JSONPath=".status.cpuUsedPercentage",description="CPU used percentage"
	Status MetricsAggregateStatus `json:"status,omitempty"`
}

type MetricsAggregateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []MetricsAggregate `json:"items"`
}

type MetricsAggregateStatus struct {
	Nodes int `json:"nodes,omitempty"`
	// MemoryTotalBytes current memory usage in bytes
	MemoryTotalBytes int64 `json:"memoryTotalBytes,omitempty"`
	// MemoryAvailableBytes available memory for node
	MemoryAvailableBytes int64 `json:"memoryAvailableBytes,omitempty"`
	// MemoryUsedPercentage in percentage
	MemoryUsedPercentage int64 `json:"memoryUsedPercentage,omitempty"`
	// CPUTotalMillicores in m cores
	CPUTotalMillicores int64 `json:"cpuTotalMillicores,omitempty"`
	// CPUAvailableMillicores in m cores
	CPUAvailableMillicores int64 `json:"cpuAvailableMillicores,omitempty"`
	// CPUUsedPercentage in percentage
	CPUUsedPercentage int64 `json:"cpuUsedPercentage,omitempty"`

	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type OpenCodeConfig struct {
	// OpenAICompatible configures a custom OpenAI-compatible provider block in opencode.json.
	// When set (and aiProxy is false), provider and endpoint on this struct are ignored in favor
	// of the nested openaiCompatible fields.
	// +kubebuilder:validation:Optional
	OpenAICompatible *OpenCodeOpenAICompatibleConfig `json:"openaiCompatible,omitempty"`

	// Provider is the OpenCode provider id from https://models.dev (for example openai, anthropic,
	// amazon-bedrock, google-vertex, google). Optional.
	//
	// When the parent AgentRuntime has spec.aiProxy enabled, the harness ignores this field and
	// autowires provider "plural", routing requests through the Console AI proxy at /ext/ai/v1
	// using the deploy token. Set spec.config.opencode.model to a bare model id; the harness
	// prefixes it for proxy routing based on runtime type (for example gpt-5.4 -> openai/gpt-5.4).
	//
	// When aiProxy is false, this selects the native OpenCode provider block; credentials come from
	// tokenSecretRef or the provider's usual environment variables. Defaults to plural when omitted.
	// Use exact models.dev slugs (for example amazon-bedrock, google-vertex, google).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=128
	Provider *string `json:"provider,omitempty"`

	// Endpoint optionally overrides the provider baseURL in opencode.json.
	// When omitted, the harness omits baseURL so OpenCode uses the models.dev default for the provider.
	// +kubebuilder:validation:Optional
	Endpoint *string `json:"endpoint,omitempty"`

	// Model is the LLM model to use.
	// +kubebuilder:validation:Optional
	Model *string `json:"model,omitempty"`

	// TokenSecretRef references a Secret containing the API token for OpenCode.
	// Optional when aiProxy is enabled; authentication uses the Console deploy token instead.
	// +kubebuilder:validation:Optional
	TokenSecretRef *corev1.SecretKeySelector `json:"tokenSecretRef,omitempty"`

	// ExtraArgs args for advanced or experimental CLI flags.
	//
	// Deprecated: It is being ignored by the agent harness.
	ExtraArgs []string `json:"extraArgs,omitempty"`

	// Timeout bounds a single opencode run invocation.
	// +kubebuilder:validation:Optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
}

type OpenCodeConfigRaw struct {
	// OpenAICompatible is true when spec.config.opencode.openaiCompatible was set on the AgentRuntime.
	OpenAICompatible bool `json:"openaiCompatible,omitempty"`

	// Provider is the OpenCode provider id from https://models.dev.
	Provider *string `json:"provider,omitempty"`

	// Endpoint API endpoint for the OpenCode service.
	Endpoint *string `json:"endpoint,omitempty"`

	// Model is the LLM model to use.
	Model *string `json:"model,omitempty"`

	// Token is the raw API token for OpenCode.
	Token string `json:"token,omitempty"`

	// Timeout bounds a single opencode run invocation.
	// +kubebuilder:validation:Optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
}

type OpenCodeOpenAICompatibleConfig struct {
	// Endpoint is the OpenAI-compatible API base URL (for example https://litellm.example/v1).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Endpoint string `json:"endpoint"`

	// Model is the model id exposed by that endpoint.
	// +kubebuilder:validation:Optional
	Model *string `json:"model,omitempty"`

	// TokenSecretRef references a Secret containing the API key for the endpoint.
	// +kubebuilder:validation:Optional
	TokenSecretRef *corev1.SecretKeySelector `json:"tokenSecretRef,omitempty"`
}

type PipelineGate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   PipelineGateSpec   `json:"spec,omitempty"`
	Status PipelineGateStatus `json:"status,omitempty"`
}

type PipelineGateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []PipelineGate `json:"items"`
}

type PipelineGateSpec struct {
	ID       string    `json:"id"`
	Name     string    `json:"name"`
	Type     GateType  `json:"type"`
	GateSpec *GateSpec `json:"gateSpec,omitempty"`
}

type PipelineGateStatus struct {
	State  *GateState              `json:"state,omitempty"`
	JobRef *console.NamespacedName `json:"jobRef,omitempty"`
	SHA    *string                 `json:"sha,omitempty"`
}

type PluralCAPICluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec of the CAPI cluster configuration
	// +kubebuilder:validation:Required
	Spec CapiConfigurationClusterSpec `json:"spec"`

	// Status of the CAPI cluster configuration
	// +kubebuilder:validation:Optional
	Status Status `json:"status,omitempty"`
}

type PluralCAPIClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []PluralCAPICluster `json:"items"`
}

type PodTemplateSpec struct {
	// Labels to apply to the job for organization and selection.
	// +kubebuilder:validation:Optional
	Labels map[string]string `json:"labels,omitempty"`

	// Annotations to apply to the job for additional metadata.
	// +kubebuilder:validation:Optional
	Annotations map[string]string `json:"annotations,omitempty"`

	// Specification of the desired behavior of the pod.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	// +optional
	Spec corev1.PodSpec `json:"spec,omitempty"`
}

type Progress struct {
	Wave       int                      `json:"wave"`
	Percentage int                      `json:"percentage"`
	Count      int                      `json:"count"`
	Failures   []corev1.ObjectReference `json:"failures,omitempty"`
	Cursor     *corev1.ObjectReference  `json:"cursor,omitempty"`
}

type ProviderCredentials struct {
	// AWS defines attributes required to auth with AWS API.
	// +kubebuilder:validation:Optional
	AWS *AWSProviderCredentials `json:"aws,omitempty"`
}

type RecommendationsSettings struct {
	ExcludeNamespaces  []string          `json:"excludeNamespaces,omitempty"`
	RequireAnnotations map[string]string `json:"requireAnnotations,omitempty"`
}

type SentinelRunJob struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   SentinelRunJobSpec   `json:"spec,omitempty"`
	Status SentinelRunJobStatus `json:"status,omitempty"`
}

type SentinelRunJobList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SentinelRunJob `json:"items"`
}

type SentinelRunJobSpec struct {
	// RunID from Console API
	RunID string `json:"runId"`
}

type SentinelRunJobStatus struct {
	Status `json:",inline"`

	// JobRef Reference to the created Job
	JobRef *v1.LocalObjectReference `json:"jobRef,omitempty"`

	// JobStatus is the status of the Job.
	JobStatus string `json:"jobStatus,omitempty"`
}

type StackRunJob struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   StackRunJobSpec   `json:"spec,omitempty"`
	Status StackRunJobStatus `json:"status,omitempty"`
}

type StackRunJobList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []StackRunJob `json:"items"`
}

type StackRunJobSpec struct {
	// RunID from Console API
	RunID string `json:"runId"`
}

type StackRunJobStatus struct {
	Status `json:",inline"`

	// JobRef Reference to the created Job
	JobRef *v1.LocalObjectReference `json:"jobRef,omitempty"`

	// JobStatus is the status of the Job.
	JobStatus string `json:"jobStatus,omitempty"`
}

type Status struct {
	// ID of the resource in the Console API.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	ID *string `json:"id,omitempty"`
	// SHA of last applied configuration.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	SHA *string `json:"sha,omitempty"`
	// Represents the observations of a PrAutomation's current state.
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type UpgradeInsights struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   UpgradeInsightsSpec `json:"spec,omitempty"`
	Status Status              `json:"status,omitempty"`
}

type UpgradeInsightsDistro string

type UpgradeInsightsList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []UpgradeInsights `json:"items"`
}

type UpgradeInsightsSpec struct {
	// Distro defines which provider API should be used to fetch latest upgrade insights.
	// If not provided, we get the distro from the Plural API cluster tied to this operator deploy token.
	// +kubebuilder:validation:Enum=EKS
	// +kubebuilder:validation:Optional
	Distro *console.ClusterDistro `json:"distro,omitempty"`

	// ClusterName is your cloud provider cluster identifier (usually name) that is used
	// to fetch latest upgrade insights information from the cloud provider API.
	// If not provided, we get the cluster name from the Plural API cluster tied to this
	// operator deploy token and assume that it is the same as the cluster name in your cloud provider.
	// +kubebuilder:validation:Optional
	ClusterName *string `json:"clusterName,omitempty"`

	// Interval defines how often should the upgrade insights information be fetched.
	// +kubebuilder:default="10m"
	// +kubebuilder:validation:Optional
	Interval *string `json:"interval,omitempty"`

	// Credentials allow overriding default provider credentials bound to the operator.
	// +kubebuilder:validation:Optional
	Credentials *ProviderCredentials `json:"credentials,omitempty"`
}

type VClusterHelmConfiguration struct {
	HelmConfiguration `json:",inline"`
}

type VirtualCluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec ...
	// +kubebuilder:validation:Required
	Spec VirtualClusterSpec `json:"spec"`

	// Status ...
	// +kubebuilder:validation:Optional
	Status VirtualClusterStatus `json:"status,omitempty"`
}

type VirtualClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []VirtualCluster `json:"items"`
}

type VirtualClusterSpec struct {
	// KubeconfigRef is a reference to the secret created by the
	// vcluster helm chart. It contains kubeconfig with information
	// on how to access created virtual cluster.
	// +kubebuilder:validation:Required
	KubeconfigRef corev1.LocalObjectReference `json:"kubeconfigRef"`

	// CredentialsRef is a reference to the secret pointing to the
	// key that holds Console API access token. It allows to communicate
	// with the standard Console API.
	// +kubebuilder:validation:Required
	CredentialsRef corev1.SecretKeySelector `json:"credentialsRef"`

	// Cluster is a simplified representation of the Console API cluster
	// object. See [ClusterSpec] for more information.
	// +kubebuilder:validation:Optional
	Cluster *ClusterSpec `json:"cluster,omitempty"`

	// External marks this virtual cluster as external one, meaning
	// that the vcluster deployment will not be automatically created.
	// User has to pre-provision vcluster and provide a valid KubeconfigRef
	// pointing to an existing vcluster installation.
	// +kubebuilder:validation:Optional
	External *bool `json:"external,omitempty"`

	// Helm allows configuring helm chart options of both agent and vcluster.
	// It is then deployed by the [VirtualCluster] CRD controller.
	// +kubebuilder:validation:Optional
	Helm *HelmSpec `json:"helm,omitempty"`
}

type VirtualClusterStatus struct {
	Status `json:",inline"`
}