openbao

type Access struct {
	Org            string          `json:"org"`
	Env            string          `json:"env"`
	Root           string          `json:"root,omitempty"`
	ServiceAccount string          `json:"serviceAccount,omitempty"`
	SelfCluster    string          `json:"selfCluster"`
	Clusters       []AccessCluster `json:"clusters"`
	Bindings       []Binding       `json:"bindings,omitempty"`
}

type AccessCluster struct {
	ID       string `json:"id"`
	Audience string `json:"audience"`
	// Exactly one of OIDCDiscoveryURL / PublicKeys, or neither for the self
	// cluster, whose keys the converge Job reads from its own API server.
	OIDCDiscoveryURL string   `json:"oidcDiscoveryURL,omitempty"`
	BoundIssuer      string   `json:"boundIssuer,omitempty"`
	PublicKeys       []string `json:"publicKeys,omitempty"`
}

type AccessDoc struct {
	// Self is the id of the cluster OpenBao runs on; its mount (jwt-<Self>)
	// holds the converge, consumer and writer roles and is never removed.
	Self string `json:"self"`
	KV   KV     `json:"kv"`
	// Transit are the transit mounts to enable; never disabled.
	Transit  []TransitMount `json:"transit,omitempty"`
	Mounts   []Mount        `json:"mounts"`
	Policies []Policy       `json:"policies"`
	Roles    []Role         `json:"roles"`
	// Retired are auth mounts the store must not carry; converge disables
	// each that is present (retired.go). Widen never applies them.
	Retired []RetiredAuthMount `json:"retired,omitempty"`
}

type Audit struct {
	Stdout   bool   `json:"stdout"`
	File     bool   `json:"file"`
	FilePath string `json:"filePath"`
}

type Binding struct {
	Cluster   string     `json:"cluster"`
	Namespace string     `json:"namespace"`
	Names     []string   `json:"names"`
	Wildcards []Wildcard `json:"wildcards,omitempty"`
}

type Bootstrap struct {
	// Project is the Google project holding the secrets.
	Project string `json:"project"`
	// ReaderServiceAccount is the Kubernetes service account, in the store's
	// namespace, that the ESO `gcpsm` SecretStore logs in as; ReaderGSA is the
	// Google service account it is federated to (secretAccessor on the seal
	// key and the Postgres password only).
	ReaderServiceAccount string `json:"readerServiceAccount"`
	ReaderGSA            string `json:"readerGSA"`
	// EscrowGSA is the Google service account the converge Job's service
	// account is federated to: versions.add on the recovery escrow only.
	EscrowGSA string `json:"escrowGSA"`
	// ClusterProject, ClusterLocation and ClusterName say which GKE cluster the
	// store runs on, for Workload Identity. All empty = ESO asks the GKE
	// metadata server, which a NetworkPolicy may block; the project can differ
	// from Project, where the secrets are.
	ClusterProject  string `json:"clusterProject,omitempty"`
	ClusterLocation string `json:"clusterLocation,omitempty"`
	ClusterName     string `json:"clusterName,omitempty"`
	// ESONamespace is where the External Secrets Operator runs; it is granted
	// a token for ReaderServiceAccount and nothing else.
	ESONamespace string `json:"esoNamespace"`
	// SealSecretID, PasswordSecretID and EscrowSecretID are the secret ids of
	// the seal key, the Postgres password (Postgres storage only) and the
	// recovery escrow.
	SealSecretID     string `json:"sealSecretID"`
	PasswordSecretID string `json:"passwordSecretID,omitempty"`
	EscrowSecretID   string `json:"escrowSecretID"`
}

type Consumer struct {
	Name      string  `json:"name"`
	Workload  string  `json:"workload"`
	Namespace string  `json:"namespace"`
	Grants    []Grant `json:"grants,omitempty"`
	Delegated bool    `json:"delegated,omitempty"`
}

type Grant struct {
	Path               string   `json:"path"`
	Capabilities       []string `json:"capabilities"`
	WildcardReadReason string   `json:"wildcardReadReason,omitempty"`
}

type HA struct {
	PDB        bool `json:"pdb"`
	ZoneSpread bool `json:"zoneSpread"`
	// NodeSpread is "required" (the default; empty means required) or
	// "preferred". Required refuses to co-locate two replicas of an HA store
	// on one node (a node loss would take quorum or every standby with it);
	// preferred is the scheduler's best effort and states NodeSpreadReason.
	NodeSpread       string `json:"nodeSpread,omitempty"`
	NodeSpreadReason string `json:"nodeSpreadReason,omitempty"`
	PriorityClass    string `json:"priorityClass,omitempty"`
}

type Hooks struct {
	Escrow   string `json:"escrow,omitempty"`
	Generate string `json:"generate,omitempty"`
}

type KV struct {
	Mount       string `json:"mount"`
	MaxVersions int    `json:"maxVersions"`
}

type Listener struct {
	Port               int    `json:"port"`
	TLS                bool   `json:"tls"`
	TransitionalReason string `json:"transitionalReason,omitempty"`
}

type Mount struct {
	Name    string `json:"name"`
	Cluster string `json:"cluster"`
	// Trust says how OpenBao verifies the cluster's tokens: "self" (the Job
	// reads the cluster's own JWKS), or "config" (Config is written as is).
	Trust  string         `json:"trust"`
	Config map[string]any `json:"config,omitempty"`
}

type Peer struct {
	NamespaceLabels map[string]string `json:"namespaceLabels,omitempty"`
	PodLabels       map[string]string `json:"podLabels,omitempty"`
}

type Policy struct {
	Name  string `json:"name"`
	Rules []Rule `json:"rules"`
}

type Postgres struct {
	CloudSQLInstance  string `json:"cloudSQLInstance,omitempty"`
	Host              string `json:"host,omitempty"`
	Port              int    `json:"port"`
	Database          string `json:"database"`
	Role              string `json:"role"`
	GCPServiceAccount string `json:"gcpServiceAccount,omitempty"`
	// PrivateIP makes the proxy dial the instance's private address (an
	// instance with no public IP).
	PrivateIP   bool `json:"privateIP,omitempty"`
	MaxParallel int  `json:"maxParallel"`
}

type Public struct {
	// Host is the DNS name clients dial.
	Host string `json:"host"`
	// Gateway, Listener and GatewayNamespace say where the route attaches. The
	// listener is the HTTPS one forge adds to the Gateway for Host.
	Gateway          string `json:"gateway"`
	GatewayNamespace string `json:"gatewayNamespace"`
	Listener         string `json:"listener"`

	// RequestsPerSecond is the ceiling on all sources together,
	// PerSourceRequestsPerSecond on one source address, MaxConnections on the
	// listener. All are per Envoy replica.
	RequestsPerSecond          int `json:"requestsPerSecond"`
	PerSourceRequestsPerSecond int `json:"perSourceRequestsPerSecond"`
	MaxConnections             int `json:"maxConnections"`
	// RequestTimeout is a Gateway API duration (30s, 1m30s).
	RequestTimeout string `json:"requestTimeout"`

	// Port is the TLS port OpenBao opens for the Gateway, beside its
	// Listeners. Only the Gateway's proxy pods can reach it.
	Port int `json:"port"`
	// ProxyNamespace is where Envoy Gateway runs the proxy pods; the
	// NetworkPolicy admits the pods of Gateway there and nothing else.
	ProxyNamespace string `json:"proxyNamespace"`
	// TrustedProxyCIDRs are the peer ranges OpenBao trusts to set
	// X-Forwarded-For on Port. A peer outside them is refused (HTTP 400), as is
	// a request with no header: nothing but Envoy should be talking to Port.
	TrustedProxyCIDRs []string `json:"trustedProxyCIDRs"`
}

type PublicMatch struct {
	Method string
	// Type is a Gateway API path match type: Exact or RegularExpression. The
	// allowlist never uses PathPrefix.
	Type  string
	Value string
}

type Raft struct {
	SizeGiB      int       `json:"sizeGiB"`
	StorageClass string    `json:"storageClass,omitempty"`
	Snapshot     *Snapshot `json:"snapshot,omitempty"`
}

type RetiredAuthMount struct {
	Name   string `json:"name"`
	Reason string `json:"reason"`
	Force  bool   `json:"force,omitempty"`
}

type Role struct {
	Mount   string         `json:"mount"`
	Name    string         `json:"name"`
	Payload map[string]any `json:"payload"`
}

type Rule struct {
	Path         string   `json:"path"`
	Capabilities []string `json:"capabilities"`
	Reason       string   `json:"reason,omitempty"`
}

type Seal struct {
	KeyID string `json:"keyID"`
}

type Snapshot struct {
	Bucket   string `json:"bucket"`
	Schedule string `json:"schedule"`
	Keep     int    `json:"keep"`
}

type Spec struct {
	Name      string `json:"name"`
	Namespace string `json:"namespace"`
	Image     string `json:"image"`
	// ReleaseOwner is the native provider's explicit compiled snapshot consumer.
	ReleaseOwner string `json:"releaseOwner,omitempty"`
	// KubectlImage runs the converge Jobs: kubectl, curl and jq. Empty =
	// [DefaultKubectlImage].
	KubectlImage string `json:"kubectlImage,omitempty"`
	// CloudSQLProxyImage is the sidecar for Postgres storage on Cloud SQL.
	// Empty = [DefaultCloudSQLProxyImage].
	CloudSQLProxyImage string `json:"cloudSQLProxyImage,omitempty"`
	Replicas           int    `json:"replicas"`
	// Owner is "<project>.<env>", stamped as [LabelOwner].
	Owner string `json:"owner"`

	Storage   Storage    `json:"storage"`
	Listeners []Listener `json:"listeners"`
	TLS       TLS        `json:"tls"`
	Seal      Seal       `json:"seal"`
	// RecoverySecret is the in-cluster Secret the converge Job writes the
	// `operator init` output to, before it converges anything.
	RecoverySecret string `json:"recoverySecret"`
	KV             KV     `json:"kv"`
	// Transit are the transit secret-engine mounts the converge Job enables
	// (keys are created by the consumers whose grants allow it). Empty = none.
	Transit []TransitMount `json:"transit,omitempty"`
	HA      HA             `json:"ha"`
	Audit   Audit          `json:"audit"`

	Consumers []Consumer `json:"consumers,omitempty"`
	Writer    Writer     `json:"writer"`
	Access    Access     `json:"access"`
	// RetiredAuthMounts are auth mounts a previous install left behind and the
	// converge Job disables (retired.go). Empty = none.
	RetiredAuthMounts []RetiredAuthMount `json:"retiredAuthMounts,omitempty"`

	// Hooks are ConfigMaps of scripts the converge Job runs at two points:
	// the escrow hook right after init, the generate hook after the document
	// is applied. Empty = none. The names should be content-addressed so a
	// changed hook changes the Job.
	Hooks Hooks `json:"hooks,omitempty"`
	// Bootstrap delivers the values the store needs before it can serve a read
	// (the seal key, the Postgres password) from Google Secret Manager through
	// ESO, and escrows the `operator init` output back to it. Nil = the Secrets
	// are provided by something else (a prerequisite, or the env's file store).
	Bootstrap *Bootstrap `json:"bootstrap,omitempty"`
	// IngressNamespaces are namespaces whose pods may reach the API port:
	// ESO's, and every namespace that holds a SecretStore for this store.
	IngressNamespaces []string `json:"ingressNamespaces,omitempty"`
	// CANamespaces are the namespaces (beside OpenBao's own) that get the CA
	// published as a ConfigMap, so a SecretStore there can name it. They must
	// exist when the converge Job runs.
	CANamespaces []string `json:"caNamespaces,omitempty"`
	// IngressFrom are extra NetworkPolicy peers (the Gateway, for `public`).
	IngressFrom []Peer `json:"ingressFrom,omitempty"`
	// ExtraDNSNames are added to the server certificate (the public host).
	ExtraDNSNames []string `json:"extraDNSNames,omitempty"`
	// Public publishes the store on a Gateway (public.go). Nil = not published.
	Public *Public `json:"public,omitempty"`
}

type Storage struct {
	Type     string    `json:"type"`
	Raft     *Raft     `json:"raft,omitempty"`
	Postgres *Postgres `json:"postgres,omitempty"`
}

type TLS struct {
	// Secret is a BYO kubernetes.io/tls Secret. Empty = cert-manager issues
	// one from a namespaced self-signed CA.
	Secret string `json:"secret,omitempty"`
	// CAConfigMap names the ConfigMap holding the CA that signed the
	// certificate. For the self-signed default the converge Job publishes it.
	CAConfigMap string `json:"caConfigMap"`
	Duration    string `json:"duration"`
}

type TransitMount struct {
	Mount string `json:"mount"`
}

type Wildcard struct {
	Pattern string `json:"pattern"`
	Reason  string `json:"reason"`
}

type Writer struct {
	Type string `json:"type"`
	// ServiceAccount is the SA forge renders for Type "service_account".
	ServiceAccount string `json:"serviceAccount,omitempty"`
	// Role is the ManagedIdentity role for Type "oidc" (recorded; the OIDC
	// wiring is not rendered here).
	Role string `json:"role,omitempty"`
}