v1beta2

type AdditionalRoleBindingsSpec struct {
	ClusterRoleName string `json:"clusterRoleName"`
	// kubebuilder:validation:Minimum=1
	Subjects []rbacv1.Subject `json:"subjects"`
}

type CapsuleConfiguration struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	Spec CapsuleConfigurationSpec `json:"spec"`

	// +optional
	Status CapsuleConfigurationStatus `json:"status,omitzero"`
}

type CapsuleConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []CapsuleConfiguration `json:"items"`
}

type CapsuleConfigurationSpec struct {
	// Define entities which are considered part of the Capsule construct
	// Users not mentioned here will be ignored by Capsule
	Users rbac.UserListSpec `json:"users,omitempty"`
	// Define groups which when found in the request of a user will be ignored by the Capsule
	// this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.
	IgnoreUserWithGroups []string `json:"ignoreUserWithGroups,omitempty"`
	// ServiceAccounts within tenant namespaces can be promoted to owners of the given tenant
	// this can be achieved by labeling the serviceaccount and then they are considered owners. This can only be done by other owners of the tenant.
	// However ServiceAccounts which have been promoted to owner can not promote further serviceAccounts.
	// +kubebuilder:default=false
	AllowServiceAccountPromotion bool `json:"allowServiceAccountPromotion,omitempty"`
	// Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix,
	// separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.
	// +kubebuilder:default=false
	ForceTenantPrefix bool `json:"forceTenantPrefix,omitempty"`
	// Disallow creation of namespaces, whose name matches this regexp
	ProtectedNamespaceRegexpString string `json:"protectedNamespaceRegex,omitempty"`
	// Allows to set different name rather than the canonical one for the Capsule configuration objects,
	// such as webhook secret or configurations.
	// +kubebuilder:default={TLSSecretName:"capsule-tls",mutatingWebhookConfigurationName:"capsule-mutating-webhook-configuration",validatingWebhookConfigurationName:"capsule-validating-webhook-configuration"}
	// +optional
	CapsuleResources CapsuleResources `json:"overrides,omitzero"`
	// Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant.
	// This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes.
	NodeMetadata *NodeMetadata `json:"nodeMetadata,omitempty"`
	// Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks
	// when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager.
	// +kubebuilder:default=false
	EnableTLSReconciler bool `json:"enableTLSReconciler"` //nolint:tagliatelle
	// Define entities which can act as Administrators in the capsule construct
	// These entities are automatically owners for all existing tenants. Meaning they can add namespaces to any tenant. However they must be specific by using the capsule label
	// for interacting with namespaces. Because if that label is not defined, it's assumed that namespace interaction was not targeted towards a tenant and will therefore
	// be ignored by capsule.
	Administrators rbac.UserListSpec `json:"administrators,omitempty"`
	// Configuration for dynamic Validating and Mutating Admission webhooks managed by Capsule.
	Admission DynamicAdmission `json:"admission,omitempty"`
	// Define Properties for managed ClusterRoles by Capsule
	// +kubebuilder:default={}
	RBAC *RBACConfiguration `json:"rbac"`
	// Define the period of time upon a cache invalidation is executed for all caches.
	// +kubebuilder:default="24h"
	CacheInvalidation metav1.Duration `json:"cacheInvalidation"`
	// Service Account Client configuration for impersonation properties
	// +optional
	Impersonation ServiceAccountClient `json:"impersonation,omitzero"`

	// Deprecated: use users property instead (https://projectcapsule.dev/docs/operating/setup/configuration/#users)
	//
	// Names of the users considered as Capsule users.
	UserNames []string `json:"userNames,omitempty"`
	// Deprecated: use users property instead (https://projectcapsule.dev/docs/operating/setup/configuration/#users)
	//
	// Names of the groups considered as Capsule users.
	UserGroups []string `json:"userGroups,omitempty"`
}

type CapsuleConfigurationStatus struct {
	// Users which are considered Capsule Users and are bound to the Capsule Tenant construct.
	Users rbac.UserListSpec `json:"users,omitempty"`
	// Conditions holds the reconciliation conditions for this CapsuleConfiguration.
	// Includes a Ready condition indicating whether the configuration was
	// successfully validated and applied.
	// +optional
	Conditions meta.ConditionList `json:"conditions,omitempty"`
	// Tenants is the sorted list of Tenant names currently present in the cluster.
	// The total count is available via len(Tenants).
	// +listType=atomic
	// +optional
	Tenants []string `json:"tenants,omitempty"`
	// ObservedGeneration is the most recent generation the controller has observed.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type CapsuleResources struct {
	// Defines the Secret name used for the webhook server.
	// Must be in the same Namespace where the Capsule Deployment is deployed.
	// +kubebuilder:default=capsule-tls
	TLSSecretName string `json:"TLSSecretName"` //nolint:tagliatelle
	// Deprecated: use dynamic admission instead
	//
	// Name of the MutatingWebhookConfiguration which contains the dynamic admission controller paths and resources.
	// +kubebuilder:default=capsule-mutating-webhook-configuration
	MutatingWebhookConfigurationName string `json:"mutatingWebhookConfigurationName"`
	// Deprecated: use dynamic admission instead
	//
	// Name of the ValidatingWebhookConfiguration which contains the dynamic admission controller paths and resources.
	// +kubebuilder:default=capsule-validating-webhook-configuration
	ValidatingWebhookConfigurationName string `json:"validatingWebhookConfigurationName"`
}

type CustomQuota struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	Spec CustomQuotaSpec `json:"spec"`

	// +optional
	Status CustomQuotaStatus `json:"status,omitzero"`
}

type CustomQuotaClaimItem struct {
	metav1.GroupVersionKind               `json:",inline"`
	meta.NamespacedObjectWithUIDReference `json:",inline"`

	// Resource Quantity for given item
	Usage resource.Quantity `json:"usage"`
}

type CustomQuotaList struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []CustomQuota `json:"items"`
}

type CustomQuotaOptionsSpec struct {
	// Additionally expose usage metrics for each claim contributing to the quota.
	// This is disabled by default to avoid high cardinality in the metrics, but can be enabled for more granular monitoring and alerting.
	// +kubebuilder:default:=false
	EmitPerClaimMetrics bool `json:"emitMetricPerClaimUsage,omitempty"`
}

type CustomQuotaSpec struct {
	// Select items governed by this quota
	ScopeSelectors []metav1.LabelSelector `json:"scopeSelectors,omitempty"`
	// Resource Quantity as limit
	Limit resource.Quantity `json:"limit"`
	// Target resource
	Sources []CustomQuotaSpecSource `json:"sources,omitzero"`
	// Additional Options for the CustomQuotaSpecification
	// +kubebuilder:default:={emitMetricPerClaimUsage:false}
	Options *CustomQuotaOptionsSpec `json:"options,omitzero"`
}

type CustomQuotaSpecSource struct {
	gvk.VersionKind             `json:",inline"`
	CustomQuotaSpecSourceConfig `json:",inline"`
}

type CustomQuotaSpecSourceConfig struct {
	// Path on GVK where usage is evaluated.
	// Must be empty when op is "count".
	// Required and non-empty for all other operations.
	// +optional
	Path string `json:"path,omitempty"`

	// Operation used to evaluate usage.
	// +kubebuilder:default:=add
	Operation quota.Operation `json:"op,omitempty"`

	// Provide more granular selectors for these sources
	// The ScopeSelector and NamespaceSelector are always applied
	// Allowing these selectors to make further selecting on the resulting subset.
	Selectors []selectors.SelectorWithFields `json:"selectors,omitempty"`
}

type CustomQuotaStatus struct {
	// ObservedGeneration is the most recent generation the controller has observed.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Usage measurements
	// +optional
	Usage CustomQuotaStatusUsage `json:"usage,omitempty"`
	// Objects regarding this policy
	Claims []CustomQuotaClaimItem `json:"claims,omitempty"`
	// Targeting GVK
	Targets []CustomQuotaStatusTarget `json:"targets"`
	// Conditions
	Conditions meta.ConditionList `json:"conditions"`
}

type CustomQuotaStatusTarget struct {
	metav1.GroupVersionKind     `json:",inline"`
	CustomQuotaSpecSourceConfig `json:",inline"`

	// Path on GVK where usage is evaluated
	Scope k8smeta.RESTScopeName `json:"scope,omitempty"`
}

type CustomQuotaStatusUsage struct {
	// Used is the current observed total usage of the resource.
	// +optional
	Used resource.Quantity `json:"used"`
	// Used is the current observed total available of the resource (limit - used).
	// +optional
	Available resource.Quantity `json:"available"`
}

type DynamicAdmission struct {
	// Service Name of the Admission Service
	// +kubebuilder:default=capsule-webhook-service
	ServiceName string `json:"serviceName,omitempty"`

	// Configure dynamic Mutating Admission for Capsule
	Mutating *DynamicMutatingAdmissionConfig `json:"mutating,omitempty"`

	// Configure dynamic Validating Admission for Capsule
	Validating *DynamicValidatingAdmissionConfig `json:"validating,omitempty"`
}

type DynamicMutatingAdmissionConfig struct {
	admission.DynamicAdmissionConfig `json:",inline"`

	// Define Dynamic Admission Webhooks
	// +optional
	Webhooks []*admission.MutatingWebhook `json:"webhooks,omitempty"`
}

type DynamicValidatingAdmissionConfig struct {
	admission.DynamicAdmissionConfig `json:",inline"`

	// Define Dynamic Admission Webhooks
	// +optional
	Webhooks []*admission.ValidatingWebhook `json:"webhooks,omitempty"`
}

type GatewayOptions struct {
	AllowedClasses *api.DefaultAllowedListSpec `json:"allowedClasses,omitempty"`
}

type GlobalCustomQuota struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	Spec GlobalCustomQuotaSpec `json:"spec"`

	// +optional
	Status GlobalCustomQuotaStatus `json:"status,omitzero"`
}

type GlobalCustomQuotaList struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []GlobalCustomQuota `json:"items"`
}

type GlobalCustomQuotaSpec struct {
	CustomQuotaSpec `json:",inline"`

	// Select specifc namespaces where this Quota selects items.
	NamespaceSelectors []selectors.NamespaceSelector `json:"namespaceSelectors,omitempty"`
}

type GlobalCustomQuotaStatus struct {
	CustomQuotaStatus `json:",inline"`

	// Observed Namespaces
	Namespaces []string `json:"namespaces,omitempty"`
}

type GlobalTenantResource struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	Spec GlobalTenantResourceSpec `json:"spec"`

	// +optional
	Status GlobalTenantResourceStatus `json:"status,omitzero"`
}

type GlobalTenantResourceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []GlobalTenantResource `json:"items"`
}

type GlobalTenantResourceSpec struct {
	TenantResourceCommonSpec `json:",inline"`

	// Local ServiceAccount which will perform all the actions defined in the TenantResource
	// You must provide permissions accordingly to that ServiceAccount
	//+optional
	ServiceAccount *meta.NamespacedRFC1123ObjectReferenceWithNamespace `json:"serviceAccount,omitzero"`
	// Resource Scope, Can either be
	// - Tenant: Create Resources for each tenant  in selected Tenants
	// - Namespace: Create Resources for each namespace in selected Tenants
	// +kubebuilder:default:=Namespace
	// +optional
	Scope api.ResourceScope `json:"scope"`
	// Defines the Tenant selector used target the tenants on which resources must be propagated.
	// +optional
	TenantSelector metav1.LabelSelector `json:"tenantSelector,omitzero"`
}

type GlobalTenantResourceStatus struct {
	TenantResourceCommonStatus `json:",inline"`

	// List of Tenants addressed by the GlobalTenantResource.
	SelectedTenants []string `json:"selectedTenants,omitempty"`
}

type IngressOptions struct {
	// Specifies the allowed IngressClasses assigned to the Tenant.
	// Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses.
	// A default value can be specified, and all the Ingress resources created will inherit the declared class.
	// Optional.
	AllowedClasses *api.DefaultAllowedListSpec `json:"allowedClasses,omitempty"`
	// Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames.
	//
	//
	// - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule.
	//
	// - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant.
	//
	// - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace.
	//
	//
	// Optional.
	// +kubebuilder:default=Disabled
	HostnameCollisionScope api.HostnameCollisionScope `json:"hostnameCollisionScope,omitempty"`
	// Specifies the allowed hostnames in Ingresses for the given Tenant. Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed hostnames. Optional.
	AllowedHostnames *api.AllowedListSpec `json:"allowedHostnames,omitempty"`
	// Toggles the ability for Ingress resources created in a Tenant to have a hostname wildcard.
	AllowWildcardHostnames bool `json:"allowWildcardHostnames,omitempty"`
}

type NamespaceOptions struct {
	// +kubebuilder:validation:Minimum=1
	// Specifies the maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.
	Quota *int32 `json:"quota,omitempty"`
	// Deprecated: Use additionalMetadataList instead (https://projectcapsule.dev/docs/tenants/metadata/#additionalmetadatalist)
	//
	// Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.
	AdditionalMetadata *api.AdditionalMetadataSpec `json:"additionalMetadata,omitempty"`
	// Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant via a list. Optional.
	AdditionalMetadataList []api.AdditionalMetadataSelectorSpec `json:"additionalMetadataList,omitempty"`
	// Required Metadata for namespace within this tenant
	// +optional
	RequiredMetadata *RequiredMetadata `json:"requiredMetadata,omitzero"`
	// Define the labels that a Tenant Owner cannot set for their Namespace resources.
	// +optional
	ForbiddenLabels api.ForbiddenListSpec `json:"forbiddenLabels,omitzero"`
	// Define the annotations that a Tenant Owner cannot set for their Namespace resources.
	// +optional
	ForbiddenAnnotations api.ForbiddenListSpec `json:"forbiddenAnnotations,omitzero"`
	// If enabled only metadata from additionalMetadata is reconciled to the namespaces.
	//+kubebuilder:default:=false
	ManagedMetadataOnly bool `json:"managedMetadataOnly,omitempty"`
}

type NodeMetadata struct {
	// Define the labels that a Tenant Owner cannot set for their nodes.
	// +optional
	ForbiddenLabels api.ForbiddenListSpec `json:"forbiddenLabels,omitzero"`
	// Define the annotations that a Tenant Owner cannot set for their nodes.
	// +optional
	ForbiddenAnnotations api.ForbiddenListSpec `json:"forbiddenAnnotations,omitzero"`
}

type NonLimitedResourceError struct {
	// contains filtered or unexported fields
}

type Permissions struct {
	// Matches TenantOwner objects which are promoted to owners of this tenant
	// The elements are OR operations and independent. You can see the resulting Tenant Owners
	// in the Status.Owners specification of the Tenant.
	MatchOwners []*metav1.LabelSelector `json:"matchOwners,omitempty"`

	// ClusterRoles granted to the promoted ServiceAccounts across the Tenant
	//+kubebuilder:default:=true
	AllowOwnerPromotion bool `json:"allowOwnerPromotion,omitempty"`
}

type QuantityLedger struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   QuantityLedgerSpec   `json:"spec,omitempty"`
	Status QuantityLedgerStatus `json:"status,omitempty"`
}

type QuantityLedgerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []QuantityLedger `json:"items"`
}

type QuantityLedgerObjectRef struct {
	// APIGroup of the tracked object.
	// +optional
	APIGroup string `json:"apiGroup,omitempty"`

	// APIVersion of the tracked object, for example "v1".
	// +kubebuilder:validation:MinLength=1
	APIVersion string `json:"apiVersion"`

	// Kind of the tracked object, for example "Pod".
	// +kubebuilder:validation:MinLength=1
	Kind string `json:"kind"`

	// Namespace of the tracked object.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Name of the tracked object.
	// +optional
	Name string `json:"name,omitempty"`

	// UID of the tracked object.
	// +optional
	UID types.UID `json:"uid,omitempty"`
}

type QuantityLedgerPendingDelete struct {
	ObjectRef QuantityLedgerObjectRef `json:"objectRef"`
	CreatedAt metav1.Time             `json:"createdAt"`
}

type QuantityLedgerReservation struct {
	// Unique reservation identifier.
	// +kubebuilder:validation:MinLength=1
	ID string `json:"id"`

	// Amount reserved for this request.
	Usage resource.Quantity `json:"usage"`

	// Object that this reservation is intended to create/update.
	ObjectRef QuantityLedgerObjectRef `json:"objectRef"`

	// Time the reservation was first created.
	CreatedAt metav1.Time `json:"createdAt"`

	// Time the reservation was last refreshed or updated.
	UpdatedAt metav1.Time `json:"updatedAt"`

	// Time after which the reservation may be considered stale.
	// +optional
	ExpiresAt *metav1.Time `json:"expiresAt,omitempty"`
}

type QuantityLedgerSpec struct {
	// TargetRef points to the quota object that this ledger belongs to.
	TargetRef QuantityLedgerTargetRef `json:"targetRef"`
}

type QuantityLedgerStatus struct {
	// Reserved is the aggregate sum of all active reservations.
	// Controllers/webhooks should treat this as derived data from Reservations.
	// +optional
	Reserved resource.Quantity `json:"reserved,omitempty"`

	// Active inflight reservations for this quota.
	// +optional
	Reservations []QuantityLedgerReservation `json:"reservations,omitempty"`

	// Pending delete hints carried over from admission delete handling.
	// +optional
	PendingDeletes []QuantityLedgerPendingDelete `json:"pendingDeletes,omitempty"`

	// Conditions for the resource claim
	// +optional
	Conditions meta.ConditionList `json:"conditions,omitzero"`

	// Allocated is the admission-owned total that has been accepted by the webhook.
	// It must be updated only through optimistic concurrency on QuantityLedger.
	Allocated resource.Quantity `json:"allocated,omitempty"`
}

type QuantityLedgerTargetRef struct {
	// APIGroup of the target quota resource, for example "capsule.clastix.io".
	// +optional
	APIGroup string `json:"apiGroup,omitempty"`

	// Kind of the target quota resource, for example "CustomQuota" or "GlobalCustomQuota".
	// +kubebuilder:validation:MinLength=1
	Kind string `json:"kind"`

	// Namespace of the target quota resource.
	// Must be empty for cluster-scoped targets.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Name of the target quota resource.
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// UID of the target quota resource.
	// Optional, but useful for stale reference detection.
	// +optional
	UID types.UID `json:"uid,omitempty"`
}

type RBACConfiguration struct {
	// The ClusterRoles applied for Administrators
	// +kubebuilder:default={capsule-namespace-deleter}
	AdministrationClusterRoles []string `json:"administrationClusterRoles,omitempty"`
	// The ClusterRoles applied for ServiceAccounts which had owner Promotion
	// +kubebuilder:default={capsule-namespace-provisioner,capsule-namespace-deleter}
	PromotionClusterRoles []string `json:"promotionClusterRoles,omitempty"`
	// Name for the ClusterRole required to grant Namespace Deletion permissions.
	// +kubebuilder:default=capsule-namespace-deleter
	DeleterClusterRole string `json:"deleter,omitempty"`
	// Name for the ClusterRole required to grant Namespace Provision permissions.
	// +kubebuilder:default=capsule-namespace-provisioner
	ProvisionerClusterRole string `json:"provisioner,omitempty"`
}

type RawExtension struct {
	runtime.RawExtension `json:",inline"`
}

type RequiredMetadata struct {
	// Labels that must be defined for each namespace
	// +optional
	Labels map[string]string `json:"labels,omitzero"`

	// Annotations that must be defined for each namespace
	// +optional
	Annotations map[string]string `json:"annotations,omitzero"`
}

type ResourcePool struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	Spec ResourcePoolSpec `json:"spec"`

	// +optional
	Status ResourcePoolStatus `json:"status,omitzero"`
}

type ResourcePoolClaim struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	Spec ResourcePoolClaimSpec `json:"spec"`

	// +optional
	Status ResourcePoolClaimStatus `json:"status,omitzero"`
}

type ResourcePoolClaimList struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []ResourcePoolClaim `json:"items"`
}

type ResourcePoolClaimSpec struct {
	// If there's the possability to claim from multiple global Quotas
	// You must be specific about which one you want to claim resources from
	// Once bound to a ResourcePool, this field is immutable
	Pool string `json:"pool"`
	// Amount which should be claimed for the resourcequota
	ResourceClaims corev1.ResourceList `json:"claim"`
}

type ResourcePoolClaimStatus struct {
	// ObservedGeneration is the most recent generation the controller has observed.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Reference to the GlobalQuota being claimed from
	// +optional
	Pool meta.LocalRFC1123ObjectReferenceWithUID `json:"pool,omitzero"`
	// Deprecated: Use Conditions
	//
	// +optional
	Condition metav1.Condition `json:"condition,omitzero"`
	// Conditions for the resource claim
	Conditions meta.ConditionList `json:"conditions,omitzero"`
	// Tracks the Usage from Claimed from this claim and available resources
	// +optional
	Allocation ResourcePoolQuotaStatus `json:"allocation,omitzero"`
}

type ResourcePoolClaimsItem struct {
	// Reference to the GlobalQuota being claimed from
	meta.NamespacedRFC1123ObjectReferenceWithNamespaceWithUID `json:",inline"`

	// Claimed resources
	Claims corev1.ResourceList `json:"claims,omitempty"`
}

type ResourcePoolClaimsList []*ResourcePoolClaimsItem

type ResourcePoolList struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []ResourcePool `json:"items"`
}

type ResourcePoolNamespaceClaimsStatus map[string]ResourcePoolClaimsList

type ResourcePoolQuotaStatus struct {
	// Hard is the set of enforced hard limits for each named resource.
	// More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
	// +optional
	Hard corev1.ResourceList `json:"hard,omitempty" protobuf:"bytes,1,rep,name=hard,casttype=ResourceList,castkey=ResourceName"`
	// Used is the current observed total usage of the resource in the namespace.
	// +optional
	Claimed corev1.ResourceList `json:"used,omitempty" protobuf:"bytes,2,rep,name=used,casttype=ResourceList,castkey=ResourceName"`
	// Used to track the usage of the resource in the pool (diff hard - claimed). May be used for further automation
	// +optional
	Available corev1.ResourceList `json:"available,omitempty" protobuf:"bytes,2,rep,name=available,casttype=ResourceList,castkey=ResourceName"`
}

type ResourcePoolSpec struct {
	// Selector to match the namespaces that should be managed by the GlobalResourceQuota
	Selectors []selectors.NamespaceSelector `json:"selectors,omitempty"`
	// Define the resourcequota served by this resourcepool.
	Quota corev1.ResourceQuotaSpec `json:"quota"`
	// The Defaults given for each namespace, the default is not counted towards the total allocation
	// When you use claims it's recommended to provision Defaults as the prevent the scheduling of any resources
	// +optional
	Defaults corev1.ResourceList `json:"defaults,omitzero"`
	// Additional Configuration
	//+kubebuilder:default:={}
	// +optional
	Config ResourcePoolSpecConfiguration `json:"config,omitzero"`
}

type ResourcePoolSpecConfiguration struct {
	// With this option all resources which can be allocated are set to 0 for the resourcequota defaults. (Default false)
	// +kubebuilder:default=false
	DefaultsAssignZero *bool `json:"defaultsZero,omitempty"`
	// Claims are queued whenever they are allocated to a pool. A pool tries to allocate claims in order based on their
	// creation date. But no matter their creation time, if a claim is requesting too much resources it's put into the queue
	// but if a lower priority claim still has enough space in the available resources, it will be able to claim them. Eventough
	// it's priority was lower
	// Enabling this option respects to Order. Meaning the Creationtimestamp matters and if a resource is put into the queue, no
	// other claim can claim the same resources with lower priority. (Default false)
	// +kubebuilder:default=false
	OrderedQueue *bool `json:"orderedQueue,omitempty"`
	// When a resourcepool is deleted, the resourceclaims bound to it are disassociated from the resourcepool but not deleted.
	// By Enabling this option, the resourceclaims will be deleted when the resourcepool is deleted, if they are in bound state. (Default false)
	// +kubebuilder:default=false
	DeleteBoundResources *bool `json:"deleteBoundResources,omitempty"`
}

type ResourcePoolStatus struct {
	// ObservedGeneration is the most recent generation the controller has observed.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// How many namespaces are considered
	// +kubebuilder:default=0
	NamespaceSize uint `json:"namespaceCount,omitempty"`
	// Amount of claims
	// +kubebuilder:default=0
	ClaimSize uint `json:"claimCount,omitempty"`
	// Namespaces which are considered for claims
	Namespaces []string `json:"namespaces,omitempty"`
	// Tracks the quotas for the Resource.
	// +optional
	Claims ResourcePoolNamespaceClaimsStatus `json:"claims,omitzero"`
	// Tracks the Usage from Claimed against what has been granted from the pool
	// +optional
	Allocation ResourcePoolQuotaStatus `json:"allocation,omitzero"`
	// Exhaustions from claims associated with the pool
	Exhaustions map[string]api.PoolExhaustionResource `json:"exhaustions,omitempty"`
	// Conditions for the resource claim
	Conditions meta.ConditionList `json:"conditions,omitzero"`
}

type ResourceSpec struct {
	// Defines the Namespace selector to select the Tenant Namespaces on which the resources must be propagated.
	// In case of nil value, all the Tenant Namespaces are targeted.
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
	// List of the resources already existing in other Namespaces that must be replicated.
	NamespacedItems []tpl.ResourceReference `json:"namespacedItems,omitempty"`
	// List of raw resources that must be replicated.
	RawItems []RawExtension `json:"rawItems,omitempty"`
	// Besides the Capsule metadata required by TenantResource controller, defines additional metadata that must be
	// added to the replicated resources.
	AdditionalMetadata *api.AdditionalMetadataSpec `json:"additionalMetadata,omitempty"`
	// Templates for advanced use cases
	Generators []TemplateItemSpec `json:"generators,omitempty"`
	// Provide additional template context, which can be used throughout all
	// the declared items for the replication
	// +optional
	Context *tpl.TemplateContext `json:"context,omitempty"`
}

type RuleStatus struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// +optional
	Spec []*api.NamespaceRuleBodyNamespace `json:"spec,omitzero"`

	// +optional
	Status RuleStatusStatus `json:"status,omitzero"`
}

type RuleStatusList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []RuleStatus `json:"items"`
}

type RuleStatusStatus struct {
	// ObservedGeneration is the most recent generation the controller has observed.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Managed Enforcement properties per Namespace (aggregated from rules)
	//+optional
	Rule api.NamespaceRuleBodyNamespace `json:"rule,omitzero"`
	// Conditions
	Conditions meta.ConditionList `json:"conditions"`
}

type ServiceAccountClient struct {
	// Kubernetes API Endpoint to use for impersonation
	Endpoint string `json:"endpoint,omitempty"`
	// Namespace where the CA certificate secret is located
	CASecretNamespace meta.RFC1123SubdomainName `json:"caSecretNamespace,omitempty"`
	// Name of the secret containing the CA certificate
	CASecretName meta.RFC1123Name `json:"caSecretName,omitempty"`
	// Key in the secret that holds the CA certificate (e.g., "ca.crt")
	// +kubebuilder:default=ca.crt
	CASecretKey string `json:"caSecretKey,omitempty"`
	// If true, TLS certificate verification is skipped (not recommended for production)
	// +kubebuilder:default=false
	SkipTLSVerify bool `json:"skipTlsVerify,omitempty"`
	// Default ServiceAccount for global resources (GlobalTenantResource)
	// When defined, users are required to use this ServiceAccount anywhere in the cluster
	// unless they explicitly provide their own.
	GlobalDefaultServiceAccount meta.RFC1123Name `json:"globalDefaultServiceAccount,omitempty"`
	// Default ServiceAccount for global resources (GlobalTenantResource)
	// When defined, users are required to use this ServiceAccount anywhere in the cluster
	// unless they explicitly provide their own.
	// +optional
	GlobalDefaultServiceAccountNamespace meta.RFC1123SubdomainName `json:"globalDefaultServiceAccountNamespace,omitempty"`
	// Default ServiceAccount for namespaced resources (TenantResource)
	// When defined, users are required to use this ServiceAccount within the namespace
	// where they deploy the resource, unless they explicitly provide their own.
	TenantDefaultServiceAccount meta.RFC1123Name `json:"tenantDefaultServiceAccount,omitempty"`
}

type TemplateItemSpec struct {
	// Template contains any amount of yaml which is applied to Kubernetes.
	// This can be a single resource or multiple resources
	Template string `json:"template,omitempty"`
	// Missing Key Option for templating
	// +kubebuilder:default=zero
	MissingKey tpl.MissingKeyOption `json:"missingKey,omitempty"`
}

type Tenant struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// +optional
	Spec TenantSpec `json:"spec,omitzero"`

	// +optional
	Status TenantStatus `json:"status,omitzero"`
}

type TenantAvailableClassesStatus struct {
	// Available Storageclasses (Only collected if any matching condition is specified)
	StorageClasses []string `json:"storage,omitempty"`
	// Available PriorityClasses
	PriorityClasses []string `json:"priority,omitempty"`
	// Available StorageClasses
	RuntimeClasses []string `json:"runtime,omitempty"`
	// Available GatewayClasses
	GatewayClasses []string `json:"gateway,omitempty"`
	// Available DeviceClasses
	DeviceClasses []string `json:"device,omitempty"`
}

type TenantAvailableStatus struct {
	// Available Class Types within Tenant
	// +optional
	Classes TenantAvailableClassesStatus `json:"classes,omitzero"`
}

type TenantList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []Tenant `json:"items"`
}

type TenantOwner struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of TenantOwner.
	// +required
	Spec TenantOwnerSpec `json:"spec"`

	// status defines the observed state of TenantOwner.
	// +optional
	Status TenantOwnerStatus `json:"status,omitzero"`
}

type TenantOwnerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []TenantOwner `json:"items"`
}

type TenantOwnerSpec struct {
	// Subject
	rbac.CoreOwnerSpec `json:",inline"`

	// Adds the given subject as capsule user. When enabled this subject does not have to be
	// mentioned in the CapsuleConfiguration as Capsule User. In almost all scenarios Tenant Owners
	// must be Capsule Users.
	//+kubebuilder:default:=true
	Aggregate bool `json:"aggregate"`
}

type TenantOwnerStatus struct {
	// ObservedGeneration is the most recent generation the controller has observed.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Tenants lists the names of all Tenants that this TenantOwner is currently matched to
	// via the Tenant's spec.permissions.matchOwners selectors.
	// +optional
	// +listType=atomic
	Tenants []string `json:"tenants,omitempty"`

	// Conditions contains the reconciliation conditions for this TenantOwner.
	// +optional
	Conditions meta.ConditionList `json:"conditions,omitempty"`
}

type TenantResource struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	Spec TenantResourceSpec `json:"spec"`

	// +optional
	Status TenantResourceStatus `json:"status,omitzero"`
}

type TenantResourceCommonSpec struct {
	// Provide additional settings
	// +kubebuilder:default={}
	Settings TenantResourceCommonSpecSettings `json:"settings,omitzero"`
	// DependsOn may contain a meta.NamespacedObjectReference slice
	// with references to TenantResource resources that must be ready before this
	// TenantResource can be reconciled.
	// +optional
	DependsOn []meta.LocalRFC1123ObjectReference `json:"dependsOn,omitempty"`
	// Define the period of time upon a second reconciliation must be invoked.
	// Keep in mind that any change to the manifests will trigger a new reconciliation.
	// +kubebuilder:default="60s"
	ResyncPeriod metav1.Duration `json:"resyncPeriod"`
	// When the replicated resource manifest is deleted, all the objects replicated so far will be automatically deleted.
	// Disable this to keep replicated resources although the deletion of the replication manifest.
	// +kubebuilder:default=true
	PruningOnDelete *bool `json:"pruningOnDelete,omitempty"`
	// When cordoning a replication it will no longer execute any applies or deletions (paused).
	// This is useful for maintenances
	// +kubebuilder:default=false
	Cordoned *bool `json:"cordoned,omitempty"`
	// Defines the rules to select targeting Namespace, along with the objects that must be replicated.
	Resources []ResourceSpec `json:"resources"`
}

type TenantResourceCommonSpecSettings struct {
	// Enabling this allows TenanResources to interact with objects which were not created by a TenantResource. In this case on prune no deletion of the entire object is made.
	// +kubebuilder:default=false
	Adopt *bool `json:"adopt,omitempty"`
	// Force indicates that in case of conflicts with server-side apply, the client should acquire ownership of the conflicting field.
	// You may create collisions with this.
	// +kubebuilder:default=false
	Force *bool `json:"force,omitempty"`
}

type TenantResourceCommonStatus struct {
	// ObservedGeneration is the most recent generation the controller has observed.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Condition of the GlobalTenantResource.
	Conditions meta.ConditionList `json:"conditions,omitempty"`

	// List of the replicated resources for the given TenantResource.
	//+optional
	ProcessedItems meta.ProcessedItems `json:"processedItems,omitzero"`

	// How many items are being replicated by the TenantResource.
	Size uint `json:"size"`

	// Serviceaccount used for impersonation
	//+optional
	ServiceAccount *meta.NamespacedRFC1123ObjectReferenceWithNamespace `json:"serviceAccount,omitzero"`
}

type TenantResourceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`

	Items []TenantResource `json:"items"`
}

type TenantResourceSpec struct {
	TenantResourceCommonSpec `json:",inline"`

	// Local ServiceAccount which will perform all the actions defined in the TenantResource
	// You must provide permissions accordingly to that ServiceAccount
	//+optional
	ServiceAccount *meta.LocalRFC1123ObjectReference `json:"serviceAccount,omitzero"`
}

type TenantResourceStatus struct {
	TenantResourceCommonStatus `json:",inline"`
}

type TenantSpec struct {
	// Specify additional data relating to the tenant.
	// Mainly useable in templating and more accessible than labels/annotations.
	// +optional
	Data apiextensionsv1.JSON `json:"data"`

	// Specify Permissions for the Tenant.
	// +optional
	Permissions Permissions `json:"permissions,omitzero"`
	// Specify enforcement specifications for the scope of the Tenant.
	//  We are moving all configuration enforcement. per namespace into a rule construct.
	//  It's currently not final.
	//
	// Read More: https://projectcapsule.dev/docs/tenants/rules/
	//+optional
	Rules []*api.NamespaceRuleBodyTenant `json:"rules,omitzero"`

	// Specifies the owners of the Tenant.
	// Optional
	Owners rbac.OwnerListSpec `json:"owners,omitempty"`
	// Specifies options for the Namespaces, such as additional metadata or maximum number of namespaces allowed for that Tenant. Once the namespace quota assigned to the Tenant has been reached, the Tenant owner cannot create further namespaces. Optional.
	NamespaceOptions *NamespaceOptions `json:"namespaceOptions,omitempty"`
	// Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.
	ServiceOptions *api.ServiceOptions `json:"serviceOptions,omitempty"`
	// Specifies options for the Pods deployed in the Tenant namespaces, such as additional metadata.
	PodOptions *api.PodOptions `json:"podOptions,omitempty"`
	// Specifies the allowed StorageClasses assigned to the Tenant.
	// Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses.
	// A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class.
	// Optional.
	StorageClasses *api.DefaultAllowedListSpec `json:"storageClasses,omitempty"`
	// Specifies options for the Ingress resources, such as allowed hostnames and IngressClass. Optional.
	// +optional
	IngressOptions IngressOptions `json:"ingressOptions,omitzero"`
	// Specifies the label to control the placement of pods on a given pool of worker nodes. All namespaces created within the Tenant will have the node selector annotation. This annotation tells the Kubernetes scheduler to place pods on the nodes having the selector label. Optional.
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
	// Specifies a list of ResourceQuota resources assigned to the Tenant. The assigned values are inherited by any namespace created in the Tenant. The Capsule operator aggregates ResourceQuota at Tenant level, so that the hard quota is never crossed for the given Tenant. This permits the Tenant owner to consume resources in the Tenant regardless of the namespace. Optional.
	// +optional
	ResourceQuota api.ResourceQuotaSpec `json:"resourceQuotas,omitzero"`
	// Specifies additional RoleBindings assigned to the Tenant. Capsule will ensure that all namespaces in the Tenant always contain the RoleBinding for the given ClusterRole. Optional.
	AdditionalRoleBindings []rbac.AdditionalRoleBindingsSpec `json:"additionalRoleBindings,omitempty"`
	// Specifies the allowed RuntimeClasses assigned to the Tenant.
	// Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses.
	// Optional.
	RuntimeClasses *api.DefaultAllowedListSpec `json:"runtimeClasses,omitempty"`
	// Specifies the allowed priorityClasses assigned to the Tenant.
	// Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses.
	// A default value can be specified, and all the Pod resources created will inherit the declared class.
	// Optional.
	PriorityClasses *api.DefaultAllowedListSpec `json:"priorityClasses,omitempty"`
	// Specifies options for the DeviceClass resources.
	DeviceClasses *api.SelectorAllowedListSpec `json:"deviceClasses,omitempty"`
	// Specifies options for the GatewayClass resources.
	// +optional
	GatewayOptions GatewayOptions `json:"gatewayOptions,omitzero"`
	// Toggling the Tenant resources cordoning, when enable resources cannot be deleted.
	//+kubebuilder:default:=false
	Cordoned bool `json:"cordoned,omitempty"`
	// Prevent accidental deletion of the Tenant.
	// When enabled, the deletion request will be declined.
	//+kubebuilder:default:=false
	PreventDeletion bool `json:"preventDeletion,omitempty"`
	// Use this if you want to disable/enable the Tenant name prefix to specific Tenants, overriding global forceTenantPrefix in CapsuleConfiguration.
	// When set to 'true', it enforces Namespaces created for this Tenant to be named with the Tenant name prefix,
	// separated by a dash (i.e. for Tenant 'foo', namespace names must be prefixed with 'foo-'),
	// this is useful to avoid Namespace name collision.
	// When set to 'false', it allows Namespaces created for this Tenant to be named anything.
	// Overrides CapsuleConfiguration global forceTenantPrefix for the Tenant only.
	// If unset, Tenant uses CapsuleConfiguration's forceTenantPrefix
	// Optional
	ForceTenantPrefix *bool `json:"forceTenantPrefix,omitempty"`

	// Deprecated: Use Enforcement.Registries instead
	//
	// Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional.
	ContainerRegistries *api.AllowedListSpec `json:"containerRegistries,omitempty"`
	// Deprecated: Use Enforcement.Registries instead
	//
	// Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional.
	ImagePullPolicies []api.ImagePullPolicySpec `json:"imagePullPolicies,omitempty"`

	// Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/)
	//
	// Specifies the NetworkPolicies assigned to the Tenant. The assigned NetworkPolicies are inherited by any namespace created in the Tenant. Optional.
	// +optional
	NetworkPolicies api.NetworkPolicySpec `json:"networkPolicies,omitzero"`
	// Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/)
	//
	// Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional.
	// +optional
	LimitRanges api.LimitRangesSpec `json:"limitRanges,omitzero"`
}

type TenantStatus struct {
	// Allowed Cluster Objects within Tenant
	TenantAvailableStatus `json:",inline"`

	// ObservedGeneration is the most recent generation the controller has observed.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Collected owners for this tenant
	Owners rbac.OwnerStatusListSpec `json:"owners,omitempty"`
	// Promoted ServiceAccounts across the Tenant
	Promotions rbac.PromotionStatusListSpec `json:"promotions,omitempty"`
	// +kubebuilder:default=Active
	// The operational state of the Tenant. Possible values are "Active", "Cordoned" or "Terminating".
	State tenantState `json:"state"`
	// How many namespaces are assigned to the Tenant.
	Size uint `json:"size"`
	// List of namespaces assigned to the Tenant. (Deprecated)
	Namespaces []string `json:"namespaces,omitempty"`
	// Tracks state for the namespaces associated with this tenant
	Spaces []*TenantStatusNamespaceItem `json:"spaces,omitempty"`
	// Tenant Condition
	Conditions meta.ConditionList `json:"conditions"`
}

type TenantStatusNamespaceEnforcement struct {
	// Registries which are allowed within this namespace
	Registries []api.OCIRegistry `json:"registry,omitempty"`
}

type TenantStatusNamespaceItem struct {
	// Conditions
	Conditions meta.ConditionList `json:"conditions"`
	// Namespace Name
	Name string `json:"name"`
	// Namespace UID
	UID k8stypes.UID `json:"uid,omitempty"`
	// Managed Metadata
	Metadata *TenantStatusNamespaceMetadata `json:"metadata,omitempty"`
	// Managed Metadata
	//+optional
	Enforce TenantStatusNamespaceEnforcement `json:"enforce,omitzero"`
}

type TenantStatusNamespaceMetadata struct {
	// Managed Labels
	Labels map[string]string `json:"labels,omitempty"`
	// Managed Annotations
	Annotations map[string]string `json:"annotations,omitempty"`
}

type TenantStatusRuleStatusItem struct {
	// Promotions originating from this namespace
	Promotions rbac.OwnerStatusListSpec `json:"promotions,omitempty"`

	// Target Namespaces for this rule
	TargetNamespaces []meta.RFC1123SubdomainName `json:"namespaces,omitempty"`
}