types

type AuthConfig struct {
	APIKeys          string `yaml:"api_keys,omitempty"`
	Provider         string `yaml:"provider,omitempty"`
	Token            string `yaml:"token,omitempty"`
	AllowRemoteAdmin bool   `yaml:"allow_remote_admin,omitempty"`
}

type CORSPolicy struct {
	// Allowed origins (e.g., "https://example.com")
	AllowOrigins []string `json:"allowOrigins" yaml:"allowOrigins"`

	// Allowed methods (e.g., "GET", "POST")
	AllowMethods []string `json:"allowMethods,omitempty" yaml:"allowMethods,omitempty"`

	// Allowed headers
	AllowHeaders []string `json:"allowHeaders,omitempty" yaml:"allowHeaders,omitempty"`

	// Exposed headers
	ExposeHeaders []string `json:"exposeHeaders,omitempty" yaml:"exposeHeaders,omitempty"`

	// Max age for CORS preflight requests in seconds
	MaxAge int `json:"maxAge,omitempty" yaml:"maxAge,omitempty"`

	// Allow credentials
	AllowCredentials bool `json:"allowCredentials,omitempty" yaml:"allowCredentials,omitempty"`
}

type CPUConfig struct {
	DefaultRequest string `yaml:"default_request,omitempty"`
	DefaultLimit   string `yaml:"default_limit,omitempty"`
}

type CastFile struct {
	Specs      []Spec          `yaml:"specs,omitempty"`
	Services   []ServiceSpec   `yaml:"services,omitempty"`
	Secrets    []SecretSpec    `yaml:"secrets,omitempty"`
	Configmaps []ConfigmapSpec `yaml:"configmaps,omitempty"`
	// contains filtered or unexported fields
}

type ClientConfig struct {
	Timeout time.Duration `yaml:"timeout,omitempty"`
	Retries int           `yaml:"retries,omitempty"`
}

type Cluster struct {
	// Unique identifier for the cluster
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the cluster
	Name string `json:"name" yaml:"name"`

	// Version of the cluster schema
	Version string `json:"version" yaml:"version"`

	// Nodes that are part of this cluster
	Nodes []Node `json:"nodes,omitempty" yaml:"nodes,omitempty"`

	// Services deployed in this cluster
	Services []Service `json:"services,omitempty" yaml:"services,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type ClusterNetwork struct {
	// CIDR is the service VIP range, e.g. "10.96.0.0/16". Set once at
	// bootstrap; changing it requires a cluster reset.
	CIDR string `json:"cidr"`

	// AllocatedVIPs maps serviceID → IP (string form, e.g. "10.96.0.7").
	// Stored as strings to keep JSON / proto round-trips stable.
	AllocatedVIPs map[string]string `json:"allocatedVIPs,omitempty"`

	// FreeList is the queue of IPs available for the next allocation.
	// IPs returned by Release reach FreeList only after the cooldown
	// period elapses. Stored as strings for the same reason as above.
	FreeList []string `json:"freeList,omitempty"`
}

type Configmap struct {
	// Unique identifier for the config
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the config (DNS-1123 unique name within a namespace)
	Name string `json:"name" yaml:"name"`

	// Namespace the config belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Configuration data (not encrypted)
	Data map[string]string `json:"data" yaml:"data"`

	// Current version number
	Version int `json:"version" yaml:"version"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type ConfigmapMount struct {
	// Name of the mount (for identification)
	Name string `json:"name" yaml:"name"`

	// Path where the config should be mounted
	MountPath string `json:"mountPath" yaml:"mountPath"`

	// Name of the config to mount
	ConfigmapName string `json:"configmapName" yaml:"configmapName"`

	// Optional: specific keys to project from the config
	Items []KeyToPath `json:"items,omitempty" yaml:"items,omitempty"`
}

type ConfigmapSpec struct {
	// Human-readable name for the config (required)
	Name string `json:"name" yaml:"name"`

	// Namespace the config belongs to (optional, defaults to "default")
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

	// Config data
	Data map[string]string `json:"data" yaml:"data"`

	// Skip indicates this spec should be ignored by castfile parsing
	Skip bool `json:"skip,omitempty" yaml:"skip,omitempty"`
	// contains filtered or unexported fields
}

type DeletionOperation struct {
	// Unique identifier for the operation
	ID string `json:"id"`

	// Namespace the service belongs to
	Namespace string `json:"namespace"`

	// Name of the service being deleted
	ServiceName string `json:"service_name"`

	// Total number of instances to delete
	TotalInstances int `json:"total_instances"`

	// Number of instances deleted so far
	DeletedInstances int `json:"deleted_instances"`

	// Number of failed instance deletions
	FailedInstances int `json:"failed_instances"`

	// Time the operation started
	StartTime time.Time `json:"start_time"`

	// Time the operation ended (if completed/failed/cancelled)
	EndTime *time.Time `json:"end_time,omitempty"`

	// Current status of the operation (combines previous status and phase)
	Status DeletionOperationStatus `json:"status"`

	// Whether this is a dry run operation
	DryRun bool `json:"dry_run"`

	// Reason for failure/cancellation if applicable
	FailureReason string `json:"failure_reason,omitempty"`

	// List of pending cleanup operations
	PendingOperations []string `json:"pending_operations,omitempty"`

	// Estimated completion time
	EstimatedCompletion *time.Time `json:"estimated_completion,omitempty"`

	// Finalizers that need to complete before deletion (ordered by execution)
	Finalizers []Finalizer `json:"finalizers,omitempty"`
}

type DeletionOperationStatus string

type DeletionRequest struct {
	// Namespace of the service
	Namespace string `json:"namespace"`

	// Name of the service
	Name string `json:"name"`

	// Force deletion without confirmation
	Force bool `json:"force"`

	// Timeout for graceful shutdown
	TimeoutSeconds int32 `json:"timeout_seconds"`

	// Detach and return immediately
	Detach bool `json:"detach"`

	// Dry run mode
	DryRun bool `json:"dry_run"`

	// Grace period for graceful shutdown
	GracePeriod int32 `json:"grace_period"`

	// Immediate deletion without graceful shutdown
	Now bool `json:"now"`

	// Don't error if service doesn't exist
	IgnoreNotFound bool `json:"ignore_not_found"`

	// Optional finalizers to run
	Finalizers []string `json:"finalizers,omitempty"`
}

type DeletionResponse struct {
	// ID of the deletion operation
	DeletionID string `json:"deletion_id"`

	// Status of the deletion
	Status string `json:"status"`

	// Warning messages
	Warnings []string `json:"warnings,omitempty"`

	// Error messages
	Errors []string `json:"errors,omitempty"`

	// Whether cleanup was partial
	PartialCleanup bool `json:"partial_cleanup"`

	// Finalizers that will be executed
	Finalizers []Finalizer `json:"finalizers,omitempty"`
}

type DeletionTask struct {
	*worker.BaseTask

	// Service to delete
	Service *Service `json:"service"`

	// Deletion request parameters
	Request *DeletionRequest `json:"request"`

	// Finalizers to execute
	FinalizerTypes []FinalizerType `json:"finalizer_types"`

	// Timeout configuration
	TimeoutConfig FinalizerTimeoutConfig `json:"timeout_config"`
}

type DependencyRef struct {
	Service   string `json:"service,omitempty" yaml:"service,omitempty"`
	Secret    string `json:"secret,omitempty" yaml:"secret,omitempty"`
	Configmap string `json:"configmap,omitempty" yaml:"configmap,omitempty"`
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
}

type DockerConfig struct {
	APIVersion                string `yaml:"api_version,omitempty"`
	FallbackAPIVersion        string `yaml:"fallback_api_version,omitempty"`
	NegotiationTimeoutSeconds int    `yaml:"negotiation_timeout_seconds,omitempty"`
}

type EgressRule struct {
	To    []NetworkPolicyPeer `json:"to" yaml:"to"`
	Ports []string            `json:"ports,omitempty" yaml:"ports,omitempty"`
}

type EncryptionConfig struct {
	Enabled bool       `yaml:"enabled"`
	KEK     *KEKConfig `yaml:"kek,omitempty"`
}

type Endpoint struct {
	// Instance ID this endpoint belongs to
	InstanceID string `json:"instanceId" yaml:"instanceId"`

	// IP address for this endpoint
	IP string `json:"ip" yaml:"ip"`

	// Port for this endpoint
	Port int `json:"port" yaml:"port"`

	// Protocol for this endpoint
	Protocol string `json:"protocol,omitempty" yaml:"protocol,omitempty"`

	// Endpoint-specific metadata
	Metadata map[string]string `json:"metadata,omitempty" yaml:"metadata,omitempty"`

	// Health status for this endpoint
	Healthy bool `json:"healthy" yaml:"healthy"`

	// Last health check timestamp
	LastCheck time.Time `json:"lastCheck,omitempty" yaml:"lastCheck,omitempty"`
}

type EnvFromList []EnvFromSourceSpec

type EnvFromSource struct {
	// Exactly one of these will be set
	SecretName    string `json:"secretName,omitempty" yaml:"secretName,omitempty"`
	ConfigmapName string `json:"configmapName,omitempty" yaml:"configmapName,omitempty"`

	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
	Prefix    string `json:"prefix,omitempty" yaml:"prefix,omitempty"`
}

type EnvFromSourceSpec struct {
	// One of these must be set
	Secret    string `json:"secret,omitempty" yaml:"secret,omitempty"`
	Configmap string `json:"configmap,omitempty" yaml:"configmap,omitempty"`

	// Optional namespace; defaults to the service namespace
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

	// Optional prefix to apply to each imported key
	Prefix string `json:"prefix,omitempty" yaml:"prefix,omitempty"`

	// Raw holds the original scalar form (possibly a template placeholder) used during restoration
	Raw string `json:"-" yaml:"-"`
}

type Exec struct {
	// Command to execute
	Command []string `json:"command" yaml:"command"`

	// Environment variables
	Env map[string]string `json:"env,omitempty" yaml:"env,omitempty"`
}

type ExecOptions struct {
	// Command is the command to execute
	Command []string

	// Env is a map of environment variables to set for the command
	Env map[string]string

	// WorkingDir is the working directory for the command
	WorkingDir string

	// TTY indicates whether to allocate a pseudo-TTY
	TTY bool

	// TerminalWidth is the initial width of the terminal
	TerminalWidth uint32

	// TerminalHeight is the initial height of the terminal
	TerminalHeight uint32
}

type ExecStream interface {
	// Write writes data to the standard input of the process
	Write(p []byte) (n int, err error)

	// Read reads data from the standard output of the process
	Read(p []byte) (n int, err error)

	// Stderr provides access to the standard error stream of the process
	Stderr() io.Reader

	// ResizeTerminal resizes the terminal (if TTY was enabled)
	ResizeTerminal(width, height uint32) error

	// Signal sends a signal to the process
	Signal(sigName string) error

	// ExitCode returns the exit code after the process has completed
	ExitCode() (int, error)

	// Close terminates the exec session and releases resources
	Close() error
}

type ExposeServiceTLS struct {
	// Secret name containing TLS certificate and key
	SecretName string `json:"secretName,omitempty" yaml:"secretName,omitempty"`

	// Whether to automatically generate a TLS certificate
	Auto bool `json:"auto,omitempty" yaml:"auto,omitempty"`

	// Mode selects the certificate provisioning strategy.
	// Empty / "manual": operator supplies SecretName.
	// "acme": ingress controller obtains a cert from Let's Encrypt
	// (HTTP-01) for Expose.Host. Auto implies Mode=acme.
	// See RUNE-066.
	Mode string `json:"mode,omitempty" yaml:"mode,omitempty"`
}

type Finalizer struct {
	// Unique identifier for the finalizer
	ID string `json:"id"`

	// Type of finalizer
	Type FinalizerType `json:"type"`

	// Status of the finalizer
	Status FinalizerStatus `json:"status"`

	// Error message if finalizer failed
	Error string `json:"error,omitempty"`

	// Dependencies this finalizer has on other finalizers
	Dependencies []FinalizerDependency `json:"dependencies,omitempty"`

	// Timestamps
	CreatedAt   time.Time  `json:"created_at"`
	UpdatedAt   time.Time  `json:"updated_at"`
	CompletedAt *time.Time `json:"completed_at,omitempty"`
}

type FinalizerDependency struct {
	// The type of finalizer that must complete before this one
	DependsOn FinalizerType `json:"depends_on"`

	// Whether the dependency is required (true) or optional (false)
	Required bool `json:"required"`
}

type FinalizerInterface interface {
	GetID() string
	GetType() FinalizerType
	Execute(ctx context.Context, service *Service) error
	GetDependencies() []FinalizerDependency
	Validate(service *Service) error
}

type FinalizerStatus string

type FinalizerTimeoutConfig struct {
	// Default timeout for all finalizers
	DefaultTimeout time.Duration `json:"default_timeout"`

	// Timeout for specific finalizer types
	TypeTimeouts map[FinalizerType]time.Duration `json:"type_timeouts,omitempty"`

	// Whether to fail the entire operation if a finalizer times out
	FailOnTimeout bool `json:"fail_on_timeout"`
}

type FinalizerType string

type Function struct {
	// Unique identifier for the function
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the function
	Name string `json:"name" yaml:"name"`

	// Namespace the function belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Specification of the function
	Spec FunctionSpec `json:"spec" yaml:"spec"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type FunctionCode struct {
	// Inline source code
	Inline string `json:"inline,omitempty" yaml:"inline,omitempty"`
}

type FunctionDefinition struct {
	// Function metadata and spec
	Function struct {
		// Human-readable name for the function (required)
		Name string `json:"name" yaml:"name"`

		// Namespace the function belongs to (optional, defaults to "default")
		Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

		// Function specification
		Spec FunctionSpec `json:"spec" yaml:"spec"`
	} `json:"function" yaml:"function"`
}

type FunctionInvocationRequest struct {
	// Payload for the function (JSON-serializable object)
	Payload map[string]interface{} `json:"payload" yaml:"payload"`

	// Timeout override (optional)
	Timeout string `json:"timeout,omitempty" yaml:"timeout,omitempty"`

	// Asynchronous execution flag
	Async bool `json:"async,omitempty" yaml:"async,omitempty"`
}

type FunctionNetworkPolicy struct {
	// Allowed outbound connections
	Allow []FunctionNetworkRule `json:"allow" yaml:"allow"`
}

type FunctionNetworkRule struct {
	// Target host or IP
	Host string `json:"host" yaml:"host"`

	// Allowed ports and protocols (e.g., ["80/tcp", "443/tcp"])
	Ports []string `json:"ports" yaml:"ports"`
}

type FunctionRun struct {
	// Unique identifier for the function run
	ID string `json:"id" yaml:"id"`

	// ID of the function that was executed
	FunctionID string `json:"functionId" yaml:"functionId"`

	// Namespace the function belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Input payload (JSON-serialized)
	Input string `json:"input,omitempty" yaml:"input,omitempty"`

	// Output result (JSON-serialized)
	Output string `json:"output,omitempty" yaml:"output,omitempty"`

	// Execution logs (stdout/stderr)
	Logs string `json:"logs,omitempty" yaml:"logs,omitempty"`

	// Execution status
	Status FunctionRunStatus `json:"status" yaml:"status"`

	// Error message (if status is Failed or TimedOut)
	Error string `json:"error,omitempty" yaml:"error,omitempty"`

	// Start time
	StartTime *time.Time `json:"startTime,omitempty" yaml:"startTime,omitempty"`

	// End time
	EndTime *time.Time `json:"endTime,omitempty" yaml:"endTime,omitempty"`

	// Duration in milliseconds
	DurationMs int64 `json:"durationMs,omitempty" yaml:"durationMs,omitempty"`

	// Invoker information (component/user that triggered the execution)
	InvokedBy string `json:"invokedBy,omitempty" yaml:"invokedBy,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`
}

type FunctionRunStatus string

type FunctionSpec struct {
	// Runtime environment (e.g., python3.9, nodejs16, go1.18)
	Runtime string `json:"runtime" yaml:"runtime"`

	// Entrypoint handler (format depends on runtime, e.g., "main.handler")
	Handler string `json:"handler" yaml:"handler"`

	// Maximum execution time (e.g., "30s", "2m")
	Timeout string `json:"timeout" yaml:"timeout"`

	// Memory limit (e.g., "128Mi", "1Gi")
	MemoryLimit string `json:"memoryLimit" yaml:"memoryLimit"`

	// CPU limit (e.g., "100m", "0.5")
	CPULimit string `json:"cpuLimit,omitempty" yaml:"cpuLimit,omitempty"`

	// Function code
	Code FunctionCode `json:"code" yaml:"code"`

	// Static environment variables
	Env map[string]string `json:"env,omitempty" yaml:"env,omitempty"`

	// Network policy for the function
	NetworkPolicy *FunctionNetworkPolicy `json:"networkPolicy,omitempty" yaml:"networkPolicy,omitempty"`
}

type Gateway struct {
	// Unique identifier for the gateway
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the gateway
	Name string `json:"name" yaml:"name"`

	// Namespace the gateway belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Hostname for the gateway (for virtual hosting)
	Hostname string `json:"hostname,omitempty" yaml:"hostname,omitempty"`

	// Whether this is an internal gateway (not exposed outside the mesh)
	Internal bool `json:"internal" yaml:"internal"`

	// Port configurations for the gateway
	Ports []GatewayPort `json:"ports" yaml:"ports"`

	// TLS configuration options
	TLS *GatewayTLS `json:"tls,omitempty" yaml:"tls,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type GatewayPort struct {
	// Port number
	Port int `json:"port" yaml:"port"`

	// Protocol for this port (HTTP, HTTPS, TCP, etc.)
	Protocol string `json:"protocol" yaml:"protocol"`

	// Name for this port (optional)
	Name string `json:"name,omitempty" yaml:"name,omitempty"`
}

type GatewaySpec struct {
	// Gateway metadata and configuration
	Gateway struct {
		// Human-readable name for the gateway (required)
		Name string `json:"name" yaml:"name"`

		// Namespace the gateway belongs to (optional, defaults to "default")
		Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

		// Hostname for the gateway (for virtual hosting)
		Hostname string `json:"hostname,omitempty" yaml:"hostname,omitempty"`

		// Whether this is an internal gateway (not exposed outside the mesh)
		Internal bool `json:"internal" yaml:"internal"`

		// Port configurations for the gateway
		Ports []GatewayPort `json:"ports" yaml:"ports"`

		// TLS configuration options
		TLS *GatewayTLS `json:"tls,omitempty" yaml:"tls,omitempty"`
	} `json:"gateway" yaml:"gateway"`
}

type GatewayTLS struct {
	// Mode of TLS operation (PASSTHROUGH, SIMPLE, MUTUAL)
	Mode string `json:"mode" yaml:"mode"`

	// Secret name containing TLS credentials
	SecretName string `json:"secretName,omitempty" yaml:"secretName,omitempty"`

	// Minimum TLS version
	MinVersion string `json:"minVersion,omitempty" yaml:"minVersion,omitempty"`

	// Maximum TLS version
	MaxVersion string `json:"maxVersion,omitempty" yaml:"maxVersion,omitempty"`

	// Allow client certificate validation
	ClientCertificate bool `json:"clientCertificate,omitempty" yaml:"clientCertificate,omitempty"`
}

type HTTPRetryPolicy struct {
	// Number of retry attempts
	Attempts int `json:"attempts" yaml:"attempts"`

	// Timeout per retry attempt in milliseconds
	PerTryTimeout int `json:"perTryTimeout,omitempty" yaml:"perTryTimeout,omitempty"`

	// HTTP status codes that trigger a retry
	RetryOn []int `json:"retryOn,omitempty" yaml:"retryOn,omitempty"`
}

type HTTPRewrite struct {
	// URI to replace the matched path with
	URI string `json:"uri,omitempty" yaml:"uri,omitempty"`

	// Host to replace the request host with
	Host string `json:"host,omitempty" yaml:"host,omitempty"`
}

type HTTPRoute struct {
	// Path match for this route (e.g., "/api/v1")
	Path string `json:"path,omitempty" yaml:"path,omitempty"`

	// Path prefix match (e.g., "/api")
	PathPrefix string `json:"pathPrefix,omitempty" yaml:"pathPrefix,omitempty"`

	// HTTP methods this route applies to (GET, POST, etc.)
	Methods []string `json:"methods,omitempty" yaml:"methods,omitempty"`

	// Header matches required
	Headers map[string]string `json:"headers,omitempty" yaml:"headers,omitempty"`

	// Query parameter matches required
	QueryParams map[string]string `json:"queryParams,omitempty" yaml:"queryParams,omitempty"`

	// Destination service and options
	Destination RouteDestination `json:"destination" yaml:"destination"`

	// Rewrite options
	Rewrite *HTTPRewrite `json:"rewrite,omitempty" yaml:"rewrite,omitempty"`

	// Response headers to be added
	AddResponseHeaders map[string]string `json:"addResponseHeaders,omitempty" yaml:"addResponseHeaders,omitempty"`

	// Request headers to be added
	AddRequestHeaders map[string]string `json:"addRequestHeaders,omitempty" yaml:"addRequestHeaders,omitempty"`

	// Timeout for this route in milliseconds
	Timeout int `json:"timeout,omitempty" yaml:"timeout,omitempty"`

	// Retry policy
	Retries *HTTPRetryPolicy `json:"retries,omitempty" yaml:"retries,omitempty"`

	// CORS policy
	CORS *CORSPolicy `json:"cors,omitempty" yaml:"cors,omitempty"`
}

type HealthCheck struct {
	// Liveness probe checks if the instance is running
	Liveness *Probe `json:"liveness,omitempty" yaml:"liveness,omitempty"`

	// Readiness probe checks if the instance is ready to receive traffic
	Readiness *Probe `json:"readiness,omitempty" yaml:"readiness,omitempty"`
}

type HealthCheckResult struct {
	Success    bool
	Message    string
	Duration   time.Duration
	CheckTime  time.Time
	InstanceID string
	CheckType  string
}

type HealthFinalizerInterface interface {
	RemoveInstance(instanceID string) error
}

type IngressCertState string

type IngressCertStatus struct {
	// Host is the hostname the cert is issued for, e.g. api.example.com.
	Host string `json:"host" yaml:"host"`

	// State is one of Pending, Issued, Failed.
	State IngressCertState `json:"state" yaml:"state"`

	// IssuedAt is set when State transitions to Issued.
	IssuedAt *time.Time `json:"issuedAt,omitempty" yaml:"issuedAt,omitempty"`

	// ExpiresAt is the certificate NotAfter from the issued cert.
	ExpiresAt *time.Time `json:"expiresAt,omitempty" yaml:"expiresAt,omitempty"`

	// LastError is populated when State == Failed.
	LastError string `json:"lastError,omitempty" yaml:"lastError,omitempty"`

	// NextRetry is set when State == Failed; the orchestrator
	// schedules the next attempt at this time.
	NextRetry *time.Time `json:"nextRetry,omitempty" yaml:"nextRetry,omitempty"`
}

type IngressRule struct {
	From  []NetworkPolicyPeer `json:"from" yaml:"from"`
	Ports []string            `json:"ports,omitempty" yaml:"ports,omitempty"`
}

type Instance struct {
	NamespacedResource `json:"-" yaml:"-"`

	// Runner type for the instance
	Runner RunnerType `json:"runner" yaml:"runner"`

	// Unique identifier for the instance
	ID string `json:"id" yaml:"id"`

	// Namespace of the instance
	Namespace string `json:"namespace" yaml:"namespace"`

	// Human-readable name for the instance
	Name string `json:"name" yaml:"name"`

	// ID of the service this instance belongs to
	ServiceID string `json:"serviceId" yaml:"serviceId"`

	// Name of the service this instance belongs to
	ServiceName string `json:"serviceName" yaml:"serviceName"`

	// ID of the node running this instance
	NodeID string `json:"nodeId" yaml:"nodeId"`

	// IP address assigned to this instance
	IP string `json:"ip" yaml:"ip"`

	// Status of the instance
	Status InstanceStatus `json:"status" yaml:"status"`

	// Detailed status information
	StatusMessage string `json:"statusMessage,omitempty" yaml:"statusMessage,omitempty"`

	// Container ID or process ID
	ContainerID string `json:"containerId,omitempty" yaml:"containerId,omitempty"`

	// Process ID for process runner
	PID int `json:"pid,omitempty" yaml:"pid,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`

	// Process-specific configuration for process runner
	Process *ProcessSpec `json:"process,omitempty" yaml:"process,omitempty"`

	// Execution configuration for commands and environment
	Exec *Exec `json:"exec,omitempty" yaml:"exec,omitempty"`

	// Resources requirements for the instance
	Resources *Resources `json:"resources,omitempty" yaml:"resources,omitempty"`

	// Environment variables for the instance
	Environment map[string]string `json:"environment,omitempty" yaml:"environment,omitempty"`

	// Metadata contains additional information about the instance
	// Use for storing system properties that aren't part of the core spec
	Metadata *InstanceMetadata `json:"metadata,omitempty" yaml:"metadata,omitempty"`
}

type InstanceAction struct {
	Type       InstanceActionType
	Service    string
	Namespace  string
	InstanceID string
	Timestamp  time.Time
}

type InstanceActionType string

type InstanceFinalizerInterface interface {
	StopInstance(ctx context.Context, instance *Instance) error
	DeleteInstance(ctx context.Context, instance *Instance) error
}

type InstanceHealthStatus struct {
	InstanceID  string
	Liveness    bool
	Readiness   bool
	LastChecked time.Time
}

type InstanceIdentity struct {
	// InstanceID is the orchestrator-assigned instance ID. Useful
	// for log correlation; not used for matching.
	InstanceID string `json:"instanceId" yaml:"instanceId"`

	// Service is the service name (no namespace).
	Service string `json:"service" yaml:"service"`

	// Namespace the service belongs to.
	Namespace string `json:"namespace" yaml:"namespace"`
}

type InstanceMetadata struct {
	// Image is the image that the instance is running
	Image string `json:"image,omitempty" yaml:"image,omitempty"`

	// ImagePullPolicy controls when the runner pulls the container image
	// ("Always", "IfNotPresent", "Never"). Propagated from the parent
	// Service spec; empty defaults to "Always".
	ImagePullPolicy string `json:"imagePullPolicy,omitempty" yaml:"imagePullPolicy,omitempty"`

	// ServiceGeneration is the generation of the service that the instance belongs to
	ServiceGeneration int64 `json:"serviceGeneration,omitempty" yaml:"serviceGeneration,omitempty"`

	// DeletionTimestamp is the timestamp when the instance was marked for deletion
	DeletionTimestamp *time.Time `json:"deletionTimestamp,omitempty" yaml:"deletionTimestamp,omitempty"`

	// RestartCount is the number of times this instance has been restarted
	RestartCount int `json:"restartCount,omitempty" yaml:"restartCount,omitempty"`

	// SecretMounts contains the resolved secret mount information for this instance
	SecretMounts []ResolvedSecretMount `json:"secretMounts,omitempty" yaml:"secretMounts,omitempty"`

	// ConfigmapMounts contains the resolved config mount information for this instance
	ConfigmapMounts []ResolvedConfigmapMount `json:"configMounts,omitempty" yaml:"configMounts,omitempty"`

	// Ports declared by the service (propagated for runner use)
	Ports []ServicePort `json:"ports,omitempty" yaml:"ports,omitempty"`

	// Expose specification from the service (propagated for runner use)
	Expose *ServiceExpose `json:"expose,omitempty" yaml:"expose,omitempty"`

	// Resolved exposed endpoint on host (best-effort)
	ExposedHost     string `json:"exposedHost,omitempty" yaml:"exposedHost,omitempty"`
	ExposedHostPort int    `json:"exposedHostPort,omitempty" yaml:"exposedHostPort,omitempty"`

	// ContainerIP is the IP assigned to the container on its primary
	// Docker network. Recorded by the runner on Start; consumed by the
	// agent to map source IPs to service identity for policy
	// enforcement.
	ContainerIP string `json:"containerIp,omitempty" yaml:"containerIp,omitempty"`
}

type InstanceStatus string

type InstanceStatusInfo struct {
	Status        InstanceStatus
	StatusMessage string
	InstanceID    string
	NodeID        string
	CreatedAt     time.Time
	UpdatedAt     time.Time
}

type Job struct {
	// Unique identifier for the job
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the job
	Name string `json:"name" yaml:"name"`

	// Namespace the job belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Schedule in cron format (if this is a scheduled job)
	Schedule string `json:"schedule,omitempty" yaml:"schedule,omitempty"`

	// Template defining the job execution environment
	Template JobTemplate `json:"template" yaml:"template"`

	// Optional array job configuration
	Array *JobArray `json:"array,omitempty" yaml:"array,omitempty"`

	// Retry policy for failed job runs
	RetryPolicy *RetryPolicy `json:"retryPolicy,omitempty" yaml:"retryPolicy,omitempty"`

	// How to handle concurrent runs (for scheduled jobs)
	ConcurrencyPolicy string `json:"concurrencyPolicy,omitempty" yaml:"concurrencyPolicy,omitempty"`

	// Number of successful run records to keep
	SuccessfulRunsHistoryLimit int `json:"successfulRunsHistoryLimit,omitempty" yaml:"successfulRunsHistoryLimit,omitempty"`

	// Number of failed run records to keep
	FailedRunsHistoryLimit int `json:"failedRunsHistoryLimit,omitempty" yaml:"failedRunsHistoryLimit,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type JobArray struct {
	// Number of runs to create in the array
	Count int `json:"count" yaml:"count"`

	// Optional parallelism limit (max concurrent runs)
	Parallelism int `json:"parallelism,omitempty" yaml:"parallelism,omitempty"`
}

type JobFile struct {
	// Job definition
	Job *JobSpec `json:"job,omitempty" yaml:"job,omitempty"`

	// Multiple job definitions
	Jobs []JobSpec `json:"jobs,omitempty" yaml:"jobs,omitempty"`
}

type JobRun struct {
	// Unique identifier for the job run
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the job run
	Name string `json:"name" yaml:"name"`

	// ID of the job this run belongs to
	JobID string `json:"jobId" yaml:"jobId"`

	// Namespace the job run belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Node this job run is/was scheduled on
	NodeID string `json:"nodeId,omitempty" yaml:"nodeId,omitempty"`

	// For array jobs, the index of this run in the array
	ArrayIndex int `json:"arrayIndex,omitempty" yaml:"arrayIndex,omitempty"`

	// Status of the job run
	Status JobRunStatus `json:"status" yaml:"status"`

	// Detailed status message
	StatusMessage string `json:"statusMessage,omitempty" yaml:"statusMessage,omitempty"`

	// Exit code if the job has completed
	ExitCode int `json:"exitCode,omitempty" yaml:"exitCode,omitempty"`

	// Number of restart attempts so far
	RestartCount int `json:"restartCount,omitempty" yaml:"restartCount,omitempty"`

	// Start time
	StartTime *time.Time `json:"startTime,omitempty" yaml:"startTime,omitempty"`

	// Completion time
	CompletionTime *time.Time `json:"completionTime,omitempty" yaml:"completionTime,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type JobRunStatus string

type JobSpec struct {
	// Human-readable name for the job (required)
	Name string `json:"name" yaml:"name"`

	// Namespace the job belongs to (optional, defaults to "default")
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

	// Schedule in cron format (if this is a scheduled job)
	Schedule string `json:"schedule,omitempty" yaml:"schedule,omitempty"`

	// Template defining the job execution environment
	Template JobTemplate `json:"template" yaml:"template"`

	// Optional array job configuration
	Array *JobArray `json:"array,omitempty" yaml:"array,omitempty"`

	// Retry policy for failed job runs
	RetryPolicy *RetryPolicy `json:"retryPolicy,omitempty" yaml:"retryPolicy,omitempty"`

	// How to handle concurrent runs (for scheduled jobs)
	ConcurrencyPolicy string `json:"concurrencyPolicy,omitempty" yaml:"concurrencyPolicy,omitempty"`

	// Number of successful run records to keep
	SuccessfulRunsHistoryLimit int `json:"successfulRunsHistoryLimit,omitempty" yaml:"successfulRunsHistoryLimit,omitempty"`

	// Number of failed run records to keep
	FailedRunsHistoryLimit int `json:"failedRunsHistoryLimit,omitempty" yaml:"failedRunsHistoryLimit,omitempty"`
}

type JobTemplate struct {
	// Container image for the job
	Image string `json:"image" yaml:"image"`

	// Command to run in the container (overrides image CMD)
	Command string `json:"command,omitempty" yaml:"command,omitempty"`

	// Arguments to the command
	Args []string `json:"args,omitempty" yaml:"args,omitempty"`

	// Environment variables for the job
	Env map[string]string `json:"env,omitempty" yaml:"env,omitempty"`

	// Resource requirements for the job
	Resources Resources `json:"resources,omitempty" yaml:"resources,omitempty"`

	// Volumes to mount in the job container
	Volumes []VolumeMount `json:"volumes,omitempty" yaml:"volumes,omitempty"`

	// Secret mounts
	SecretMounts []SecretMount `json:"secretMounts,omitempty" yaml:"secretMounts,omitempty"`

	// Config mounts
	ConfigmapMounts []ConfigmapMount `json:"configmapMounts,omitempty" yaml:"configmapMounts,omitempty"`
}

type KEKConfig struct {
	Source     string            `yaml:"source,omitempty"`
	File       string            `yaml:"file,omitempty"`
	Passphrase *PassphraseConfig `yaml:"passphrase,omitempty"`
}

type KeyToPath struct {
	// Key in the Secret or Config
	Key string `json:"key" yaml:"key"`

	// Path where the key should be mounted (relative to mount point)
	Path string `json:"path" yaml:"path"`
}

type LocalInstances struct {
	// NodeID is the identity of the node these instances live on.
	NodeID string `json:"nodeId" yaml:"nodeId"`

	// Instances maps a container IP (e.g. "172.17.0.5") to the
	// service identity that owns it.
	Instances map[string]InstanceIdentity `json:"instances" yaml:"instances"`
}

type LogConfig struct {
	Level  string `yaml:"level,omitempty"`
	Format string `yaml:"format,omitempty"`
}

type LogOptions struct {
	Follow     bool
	Since      time.Time
	Until      time.Time
	Tail       int
	Timestamps bool
	ShowLogs   bool   // Show container/process logs
	ShowEvents bool   // Show lifecycle events
	ShowStatus bool   // Show status changes
	Pattern    string // Filter logs by pattern
}

type MemoryConfig struct {
	DefaultRequest string `yaml:"default_request,omitempty"`
	DefaultLimit   string `yaml:"default_limit,omitempty"`
}

type Namespace struct {
	// Unique identifier for the namespace
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the namespace
	Name string `json:"name" yaml:"name"`

	// Optional description for the namespace
	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	// Optional resource quotas for this namespace
	Quota *NamespaceQuota `json:"quota,omitempty" yaml:"quota,omitempty"`

	// Labels attached to the namespace for organization
	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type NamespaceQuota struct {
	// Maximum CPU allocation for all resources in the namespace (millicores)
	CPU int64 `json:"cpu,omitempty" yaml:"cpu,omitempty"`

	// Maximum memory allocation for all resources in the namespace (bytes)
	Memory int64 `json:"memory,omitempty" yaml:"memory,omitempty"`

	// Maximum storage allocation for all resources in the namespace (bytes)
	Storage int64 `json:"storage,omitempty" yaml:"storage,omitempty"`

	// Maximum number of services allowed in the namespace
	Services int `json:"services,omitempty" yaml:"services,omitempty"`

	// Maximum number of jobs allowed in the namespace
	Jobs int `json:"jobs,omitempty" yaml:"jobs,omitempty"`

	// Maximum number of instances (all services combined) allowed in the namespace
	Instances int `json:"instances,omitempty" yaml:"instances,omitempty"`
}

type NamespaceSpec struct {
	// Human-readable name for the namespace (required)
	Name string `json:"name" yaml:"name"`

	// Optional description for the namespace
	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	// Optional resource quotas for this namespace
	Quota *NamespaceQuota `json:"quota,omitempty" yaml:"quota,omitempty"`

	// Labels attached to the namespace for organization
	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
}

type NamespacedName struct {
	Namespace string `json:"namespace" yaml:"namespace"`
	Name      string `json:"name" yaml:"name"`
}

type NamespacedResource interface {
	NamespacedName() NamespacedName
	GetID() string // For resources that also have an ID
	GetResourceType() ResourceType
}

type NetworkPolicyPeer struct {
	Service         string            `json:"service,omitempty" yaml:"service,omitempty"`
	Namespace       string            `json:"namespace,omitempty" yaml:"namespace,omitempty"`
	ServiceSelector map[string]string `json:"serviceSelector,omitempty" yaml:"serviceSelector,omitempty"`
	CIDR            string            `json:"cidr,omitempty" yaml:"cidr,omitempty"`
}

type Node struct {
	// Unique identifier for the node
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the node
	Name string `json:"name" yaml:"name"`

	// IP address or hostname of the node
	Address string `json:"address" yaml:"address"`

	// Labels attached to the node for scheduling decisions
	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`

	// Available resources on this node
	Resources NodeResources `json:"resources" yaml:"resources"`

	// Status of the node
	Status NodeStatus `json:"status" yaml:"status"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last heartbeat timestamp
	LastHeartbeat time.Time `json:"lastHeartbeat" yaml:"lastHeartbeat"`
}

type NodeResources struct {
	// Available CPU in millicores (1000m = 1 CPU)
	CPU int64 `json:"cpu" yaml:"cpu"`

	// Available memory in bytes
	Memory int64 `json:"memory" yaml:"memory"`
}

type NodeStatus string

type PassphraseConfig struct {
	Enabled bool   `yaml:"enabled"`
	Env     string `yaml:"env,omitempty"`
}

type PluginConfig struct {
	Dir     string   `yaml:"dir,omitempty"`
	Enabled []string `yaml:"enabled,omitempty"`
}

type Policy struct {
	ID          string       `json:"id" yaml:"id"`
	Name        string       `json:"name" yaml:"name"` // DNS-1123 unique name within a namespace
	Description string       `json:"description,omitempty" yaml:"description,omitempty"`
	Rules       []PolicyRule `json:"rules" yaml:"rules"`
	Builtin     bool         `json:"builtin" yaml:"builtin"`
}

type PolicyRule struct {
	Resource  string   `json:"resource" yaml:"resource"`
	Verbs     []string `json:"verbs" yaml:"verbs"`
	Namespace string   `json:"namespace,omitempty" yaml:"namespace,omitempty"`
}

type Probe struct {
	// Type of probe (http, tcp, exec)
	Type string `json:"type" yaml:"type"`

	// HTTP path for http probe
	Path string `json:"path,omitempty" yaml:"path,omitempty"`

	// Port to connect to
	Port int `json:"port" yaml:"port"`

	// Command to execute for exec probe
	Command []string `json:"command,omitempty" yaml:"command,omitempty"`

	// Initial delay seconds before starting checks
	InitialDelaySeconds int `json:"initialDelaySeconds,omitempty" yaml:"initialDelaySeconds,omitempty"`

	// Interval between checks in seconds
	IntervalSeconds int `json:"intervalSeconds,omitempty" yaml:"intervalSeconds,omitempty"`

	// Timeout for the probe in seconds
	TimeoutSeconds int `json:"timeoutSeconds,omitempty" yaml:"timeoutSeconds,omitempty"`

	// Failure threshold for the probe
	FailureThreshold int `json:"failureThreshold,omitempty" yaml:"failureThreshold,omitempty"`

	// Success threshold for the probe
	SuccessThreshold int `json:"successThreshold,omitempty" yaml:"successThreshold,omitempty"`
}

type ProcessSecurityContext struct {
	// User to run as
	User string `json:"user,omitempty" yaml:"user,omitempty"`

	// Group to run as
	Group string `json:"group,omitempty" yaml:"group,omitempty"`

	// Run with read-only filesystem
	ReadOnlyFS bool `json:"readOnlyFS,omitempty" yaml:"readOnlyFS,omitempty"`

	// Linux capabilities to add
	Capabilities []string `json:"capabilities,omitempty" yaml:"capabilities,omitempty"`

	// Allowed syscalls (seccomp)
	AllowedSyscalls []string `json:"allowedSyscalls,omitempty" yaml:"allowedSyscalls,omitempty"`

	// Denied syscalls (seccomp)
	DeniedSyscalls []string `json:"deniedSyscalls,omitempty" yaml:"deniedSyscalls,omitempty"`
}

type ProcessSpec struct {
	// Command to run
	Command string `json:"command" yaml:"command"`

	// Command arguments
	Args []string `json:"args,omitempty" yaml:"args,omitempty"`

	// Working directory for the process
	WorkingDir string `json:"workingDir,omitempty" yaml:"workingDir,omitempty"`

	// Security settings
	SecurityContext *ProcessSecurityContext `json:"securityContext,omitempty" yaml:"securityContext,omitempty"`
}

type RegistryAuth struct {
	Type     string `json:"type,omitempty" yaml:"type,omitempty"` // basic | token | ecr
	Username string `json:"username,omitempty" yaml:"username,omitempty"`
	Password string `json:"password,omitempty" yaml:"password,omitempty"`
	Token    string `json:"token,omitempty" yaml:"token,omitempty"`
	Region   string `json:"region,omitempty" yaml:"region,omitempty"`
}

type ResolvedConfigmapMount struct {
	// Name of the mount (for identification)
	Name string `json:"name" yaml:"name"`

	// Path where the config should be mounted
	MountPath string `json:"mountPath" yaml:"mountPath"`

	// Resolved config data (key -> value)
	Data map[string]string `json:"data" yaml:"data"`

	// Optional: specific keys to project from the config
	Items []KeyToPath `json:"items,omitempty" yaml:"items,omitempty"`
}

type ResolvedSecretMount struct {
	// Name of the mount (for identification)
	Name string `json:"name" yaml:"name"`

	// Path where the secret should be mounted
	MountPath string `json:"mountPath" yaml:"mountPath"`

	// Resolved secret data (key -> value)
	Data map[string]string `json:"data" yaml:"data"`

	// Optional: specific keys to project from the secret
	Items []KeyToPath `json:"items,omitempty" yaml:"items,omitempty"`
}

type Resource interface {
	// String returns a unique identifier for the resource
	String() string

	// Equals checks if two resources are functionally equivalent
	Equals(other Resource) bool
}

type ResourceConfig struct {
	CPU    *CPUConfig    `yaml:"cpu,omitempty"`
	Memory *MemoryConfig `yaml:"memory,omitempty"`
}

type ResourceLimit struct {
	// Requested resources (guaranteed)
	Request string `json:"request,omitempty" yaml:"request,omitempty"`

	// Maximum resources (limit)
	Limit string `json:"limit,omitempty" yaml:"limit,omitempty"`
}

type ResourceRef struct {
	Type      ResourceType
	Namespace string
	Name      string
	ID        string
	Key       string
}

type ResourceType string

type Resources struct {
	// CPU request in millicores (1000m = 1 CPU)
	CPU ResourceLimit `json:"cpu,omitempty" yaml:"cpu,omitempty"`

	// Memory request in bytes
	Memory ResourceLimit `json:"memory,omitempty" yaml:"memory,omitempty"`
}

type RestartPolicy string

type RetryPolicy struct {
	// Number of retry attempts
	Count int `json:"count" yaml:"count"`

	// Backoff type (fixed or exponential)
	Backoff string `json:"backoff" yaml:"backoff"`

	// Initial backoff duration in seconds (for fixed or exponential)
	BackoffSeconds int `json:"backoffSeconds,omitempty" yaml:"backoffSeconds,omitempty"`
}

type RotationAction struct {
	// Services to reload (send SIGHUP)
	ReloadServices []string `json:"reloadServices,omitempty" yaml:"reloadServices,omitempty"`

	// Services to restart (rolling restart)
	RestartServices []string `json:"restartServices,omitempty" yaml:"restartServices,omitempty"`

	// Job to run
	RunJob string `json:"runJob,omitempty" yaml:"runJob,omitempty"`
}

type RotationPolicy struct {
	// Interval between rotations (e.g., "30d", "90d")
	Interval string `json:"interval" yaml:"interval"`

	// Actions to take after rotation
	OnRotate []RotationAction `json:"onRotate,omitempty" yaml:"onRotate,omitempty"`
}

type Route struct {
	// Unique identifier for the route
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the route
	Name string `json:"name" yaml:"name"`

	// Namespace the route belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Gateway this route is attached to
	Gateway string `json:"gateway" yaml:"gateway"`

	// Host or hosts this route matches (e.g., "api.example.com")
	Hosts []string `json:"hosts,omitempty" yaml:"hosts,omitempty"`

	// HTTP path-based routing rules
	HTTP []HTTPRoute `json:"http,omitempty" yaml:"http,omitempty"`

	// TCP routing rules (port-based)
	TCP []TCPRoute `json:"tcp,omitempty" yaml:"tcp,omitempty"`

	// Priority of this route (higher numbers take precedence)
	Priority int `json:"priority,omitempty" yaml:"priority,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type RouteDestination struct {
	// Service name to route to
	Service string `json:"service" yaml:"service"`

	// Namespace of the service (optional, defaults to route's namespace)
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

	// Port on the service to route to
	Port int `json:"port" yaml:"port"`

	// Weight for traffic splitting (0-100)
	Weight int `json:"weight,omitempty" yaml:"weight,omitempty"`

	// Subset of the service to route to (requires service to have defined subsets)
	Subset string `json:"subset,omitempty" yaml:"subset,omitempty"`
}

type RouteSpec struct {
	// Route metadata and rules
	Route struct {
		// Human-readable name for the route (required)
		Name string `json:"name" yaml:"name"`

		// Namespace the route belongs to (optional, defaults to "default")
		Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

		// Gateway this route is attached to
		Gateway string `json:"gateway" yaml:"gateway"`

		// Host or hosts this route matches
		Hosts []string `json:"hosts,omitempty" yaml:"hosts,omitempty"`

		// HTTP path-based routing rules
		HTTP []HTTPRoute `json:"http,omitempty" yaml:"http,omitempty"`

		// TCP routing rules (port-based)
		TCP []TCPRoute `json:"tcp,omitempty" yaml:"tcp,omitempty"`

		// Priority of this route (higher numbers take precedence)
		Priority int `json:"priority,omitempty" yaml:"priority,omitempty"`
	} `json:"route" yaml:"route"`
}

type RuneFile struct {
	// Server configuration
	Server *ServerConfig `yaml:"server,omitempty"`

	// Data directory for persistent storage
	DataDir string `yaml:"data_dir,omitempty"`

	// Client configuration
	Client *ClientConfig `yaml:"client,omitempty"`

	// Docker runner configuration
	Docker *DockerConfig `yaml:"docker,omitempty"`

	// Default namespace
	Namespace string `yaml:"namespace,omitempty"`

	// Authentication configuration
	Auth *AuthConfig `yaml:"auth,omitempty"`

	// Resource limits and requests
	Resources *ResourceConfig `yaml:"resources,omitempty"`

	// Logging configuration
	Log *LogConfig `yaml:"log,omitempty"`

	// Secret encryption configuration
	Secret *SecretConfig `yaml:"secret,omitempty"`

	// Plugin configuration
	Plugins *PluginConfig `yaml:"plugins,omitempty"`
	// contains filtered or unexported fields
}

type RunesetContext struct {
	Namespace   string
	Mode        string
	ReleaseName string
	Runeset     RunesetManifest
}

type RunesetManifest struct {
	Name        string                 `yaml:"name"`
	Version     string                 `yaml:"version"`
	Description string                 `yaml:"description"`
	Namespace   string                 `yaml:"namespace"`
	Defaults    map[string]interface{} `yaml:"defaults"`
}

type RunesetSourceType string

type RunnerType string

type RuntimeType string

type ScalingMode string

type ScalingOperation struct {
	// Unique identifier for the operation
	ID string `json:"id"`

	// Namespace the service belongs to
	Namespace string `json:"namespace"`

	// Name of the service being scaled
	ServiceName string `json:"service_name"`

	// Current scale when operation started
	CurrentScale int `json:"current_scale"`

	// Target scale to reach
	TargetScale int `json:"target_scale"`

	// Step size for gradual scaling
	StepSize int `json:"step_size"`

	// Interval between steps in seconds
	Interval int `json:"interval"`

	// Time the operation started
	StartTime time.Time `json:"start_time"`

	// Time the operation ended (if completed/failed/cancelled)
	EndTime time.Time `json:"end_time,omitempty"`

	// Current status of the operation
	Status ScalingOperationStatus `json:"status"`

	// Mode of scaling (immediate or gradual)
	Mode ScalingMode `json:"mode"`

	// Reason for failure/cancellation if applicable
	FailureReason string `json:"failure_reason,omitempty"`
}

type ScalingOperationMetadata struct {
	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type ScalingOperationParams struct {
	// Current scale of the service
	CurrentScale int

	// Target scale to reach
	TargetScale int

	// Step size for gradual scaling
	StepSize int

	// Interval between steps in seconds
	IntervalSeconds int

	// Whether to use gradual scaling
	IsGradual bool
}

type ScalingOperationStatus string

type Secret struct {
	// Unique identifier for the secret
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the secret (DNS-1123 unique name within a namespace)
	Name string `json:"name" yaml:"name"`

	// Namespace the secret belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Type of secret (static or dynamic)
	Type string `json:"type" yaml:"type"`

	// Static data (encrypted at rest, only for static secrets)
	Data map[string]string `json:"-" yaml:"-"` // Not serialized, stored encrypted separately

	// Engine configuration for dynamic secrets
	Engine *SecretEngine `json:"engine,omitempty" yaml:"engine,omitempty"`

	// Rotation configuration
	Rotation *RotationPolicy `json:"rotation,omitempty" yaml:"rotation,omitempty"`

	// Current version number
	Version int `json:"version" yaml:"version"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`

	// Last rotation timestamp
	LastRotated *time.Time `json:"lastRotated,omitempty" yaml:"lastRotated,omitempty"`
}

type SecretConfig struct {
	Encryption *EncryptionConfig `yaml:"encryption,omitempty"`
}

type SecretEngine struct {
	// Name of the engine to use (references a SecretsEngine resource)
	Name string `json:"name" yaml:"name"`

	// Role or profile to use with the engine (engine-specific)
	Role string `json:"role,omitempty" yaml:"role,omitempty"`

	// Engine-specific configuration for this secret
	Config map[string]interface{} `json:"config,omitempty" yaml:"config,omitempty"`
}

type SecretMount struct {
	// Name of the mount (for identification)
	Name string `json:"name" yaml:"name"`

	// Path where the secret should be mounted
	MountPath string `json:"mountPath" yaml:"mountPath"`

	// Name of the secret to mount
	SecretName string `json:"secretName" yaml:"secretName"`

	// Optional: specific keys to project from the secret
	Items []KeyToPath `json:"items,omitempty" yaml:"items,omitempty"`
}

type SecretSpec struct {
	// Human-readable name for the secret (required)
	Name string `json:"name" yaml:"name"`

	// Namespace the secret belongs to (optional, defaults to "default")
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

	// Type of secret (static or dynamic)
	Type string `json:"type" yaml:"type"`

	// Secret data for static secrets (only for creation, not returned in GET)
	Data map[string]string `json:"data,omitempty" yaml:"data,omitempty"`

	// Single value convenience field (alternative to data.value for simple secrets)
	Value string `json:"value,omitempty" yaml:"value,omitempty"`

	// Base64-encoded value (for binary data)
	ValueBase64 string `json:"valueBase64,omitempty" yaml:"valueBase64,omitempty"`

	// Engine configuration for dynamic secrets
	Engine *SecretEngine `json:"engine,omitempty" yaml:"engine,omitempty"`

	// Rotation configuration
	Rotation *RotationPolicy `json:"rotation,omitempty" yaml:"rotation,omitempty"`

	// Skip indicates this spec should be ignored by castfile parsing
	Skip bool `json:"skip,omitempty" yaml:"skip,omitempty"`
	// contains filtered or unexported fields
}

type SecretsEngine struct {
	// Unique identifier for the engine
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the engine
	Name string `json:"name" yaml:"name"`

	// Namespace the engine belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Type of engine (builtin, function, plugin)
	Type string `json:"type" yaml:"type"`

	// For function-based engines, the reference to the function
	Function string `json:"function,omitempty" yaml:"function,omitempty"`

	// For plugin-based engines, the path to the plugin executable
	Path string `json:"path,omitempty" yaml:"path,omitempty"`

	// Engine-wide configuration
	Config map[string]interface{} `json:"config,omitempty" yaml:"config,omitempty"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`
}

type SecretsEngineSpec struct {
	// Engine metadata and configuration
	SecretsEngine struct {
		// Human-readable name for the engine (required)
		Name string `json:"name" yaml:"name"`

		// Namespace the engine belongs to (optional, defaults to "default")
		Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

		// Type of engine (required: builtin, function, plugin)
		Type string `json:"type" yaml:"type"`

		// For function-based engines, the reference to the function
		Function string `json:"function,omitempty" yaml:"function,omitempty"`

		// For plugin-based engines, the path to the plugin executable
		Path string `json:"path,omitempty" yaml:"path,omitempty"`

		// Engine-wide configuration
		Config map[string]interface{} `json:"config,omitempty" yaml:"config,omitempty"`
	} `json:"secretsEngine" yaml:"secretsEngine"`
}

type ServerConfig struct {
	GRPCAddress string     `yaml:"grpc_address,omitempty"`
	HTTPAddress string     `yaml:"http_address,omitempty"`
	TLS         *TLSConfig `yaml:"tls,omitempty"`
}

type Service struct {
	NamespacedResource `json:"-" yaml:"-"`

	// Unique identifier for the service
	ID string `json:"id" yaml:"id"`

	// Human-readable name for the service // DNS-1123 unique name within a namespace
	Name string `json:"name" yaml:"name"`

	// Namespace the service belongs to
	Namespace string `json:"namespace" yaml:"namespace"`

	// Labels are key/value pairs that can be used to organize and categorize services
	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`

	// Container image for the service
	Image string `json:"image,omitempty" yaml:"image,omitempty"`

	// Named registry selector for pulling the image (optional)
	ImageRegistry string `json:"imageRegistry,omitempty" yaml:"imageRegistry,omitempty"`

	// Registry override allowing inline auth or named selection (optional)
	Registry *ServiceRegistryOverride `json:"registry,omitempty" yaml:"registry,omitempty"`

	// ImagePullPolicy controls when the runner pulls the container image.
	// Allowed values: "Always", "IfNotPresent", "Never". Empty defaults to
	// "Always" (re-pull on every deploy/restart).
	ImagePullPolicy string `json:"imagePullPolicy,omitempty" yaml:"imagePullPolicy,omitempty"`

	// Command to run in the container (overrides image CMD)
	Command string `json:"command,omitempty" yaml:"command,omitempty"`

	// Arguments to the command
	Args []string `json:"args,omitempty" yaml:"args,omitempty"`

	// Environment variables for the service
	Env map[string]string `json:"env,omitempty" yaml:"env,omitempty"`

	// Imported environment variables sources (normalized from spec)
	EnvFrom []EnvFromSource `json:"envFrom,omitempty" yaml:"envFrom,omitempty"`

	// Number of instances to run
	Scale int `json:"scale" yaml:"scale"`

	// Ports exposed by the service
	Ports []ServicePort `json:"ports,omitempty" yaml:"ports,omitempty"`

	// Resource requirements for each instance
	Resources Resources `json:"resources,omitempty" yaml:"resources,omitempty"`

	// Health checks for the service
	Health *HealthCheck `json:"health,omitempty" yaml:"health,omitempty"`

	// Network policy for controlling traffic
	NetworkPolicy *ServiceNetworkPolicy `json:"networkPolicy,omitempty" yaml:"networkPolicy,omitempty"`

	// External exposure configuration
	Expose *ServiceExpose `json:"expose,omitempty" yaml:"expose,omitempty"`

	// Placement preferences and requirements
	Affinity *ServiceAffinity `json:"affinity,omitempty" yaml:"affinity,omitempty"`

	// Autoscaling configuration
	Autoscale *ServiceAutoscale `json:"autoscale,omitempty" yaml:"autoscale,omitempty"`

	// Secret mounts
	SecretMounts []SecretMount `json:"secretMounts,omitempty" yaml:"secretMounts,omitempty"`

	// Config mounts
	ConfigmapMounts []ConfigmapMount `json:"configmapMounts,omitempty" yaml:"configmapMounts,omitempty"`

	// Service discovery configuration
	Discovery *ServiceDiscovery `json:"discovery,omitempty" yaml:"discovery,omitempty"`

	// Dependencies this service declares (normalized internal form)
	Dependencies []DependencyRef `json:"dependencies,omitempty" yaml:"dependencies,omitempty"`

	// Status of the service
	Status ServiceStatus `json:"status" yaml:"status"`

	// IngressCert tracks asynchronous TLS certificate state for the
	// ingress controller (RUNE-066). Populated only when Expose is
	// configured for ACME-managed TLS. The orchestrator updates this
	// field independently of cast; cast does not block on issuance.
	IngressCert *IngressCertStatus `json:"ingressCert,omitempty" yaml:"ingressCert,omitempty"`

	// Instances of this service currently running
	Instances []Instance `json:"instances,omitempty" yaml:"instances,omitempty"`

	// Runtime for the service ("container" or "process")
	Runtime RuntimeType `json:"runtime,omitempty" yaml:"runtime,omitempty"`

	// Process-specific configuration (when Runtime="process")
	Process *ProcessSpec `json:"process,omitempty" yaml:"process,omitempty"`

	// Restart policy for the service
	RestartPolicy RestartPolicy `json:"restart_policy,omitempty" yaml:"restart_policy,omitempty"`

	// Metadata for the service
	Metadata *ServiceMetadata `json:"metadata,omitempty" yaml:"metadata,omitempty"`
}

type ServiceAffinity struct {
	// Hard constraints (service can only run on nodes matching these)
	Required []string `json:"required,omitempty" yaml:"required,omitempty"`

	// Soft preferences (scheduler will try to place on nodes matching these)
	Preferred []string `json:"preferred,omitempty" yaml:"preferred,omitempty"`

	// Run instances near services matching these labels
	With []string `json:"with,omitempty" yaml:"with,omitempty"`

	// Avoid running instances on nodes with services matching these labels
	Avoid []string `json:"avoid,omitempty" yaml:"avoid,omitempty"`

	// Try to distribute instances across this topology key (e.g., "zone")
	Spread string `json:"spread,omitempty" yaml:"spread,omitempty"`
}

type ServiceAutoscale struct {
	// Whether autoscaling is enabled
	Enabled bool `json:"enabled" yaml:"enabled"`

	// Minimum number of instances
	Min int `json:"min" yaml:"min"`

	// Maximum number of instances
	Max int `json:"max" yaml:"max"`

	// Metric to scale on (e.g., cpu, memory)
	Metric string `json:"metric" yaml:"metric"`

	// Target value for the metric (e.g., 70%)
	Target string `json:"target" yaml:"target"`

	// Cooldown period between scaling events
	Cooldown string `json:"cooldown,omitempty" yaml:"cooldown,omitempty"`

	// Maximum number of instances to add/remove in a single scaling event
	Step int `json:"step,omitempty" yaml:"step,omitempty"`
}

type ServiceDependency struct {
	// Optional raw FQDN captured by YAML parsing helpers
	FQDN string `json:"-" yaml:"-"`

	Service   string `json:"service,omitempty" yaml:"service,omitempty"`
	Secret    string `json:"secret,omitempty" yaml:"secret,omitempty"`
	Configmap string `json:"configmap,omitempty" yaml:"configmap,omitempty"`
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
}

type ServiceDiscovery struct {
	// Discovery mode (load-balanced or headless)
	Mode string `json:"mode,omitempty" yaml:"mode,omitempty"`

	// VIP is the cluster virtual IP allocated for this service. Set by
	// the control plane on Create via the cluster VIP allocator
	// (RUNE-040). Stable for the lifetime of the service ID.
	VIP string `json:"vip,omitempty" yaml:"vip,omitempty"`

	// LocalityPreference controls how the userspace proxy picks
	// endpoints (RUNE-041). One of "" (no preference), "prefer-local"
	// (same-node first, fall back to remote), or "local-only" (fail
	// closed if no local endpoint).
	LocalityPreference string `json:"localityPreference,omitempty" yaml:"localityPreference,omitempty"`
}

type ServiceEndpoints struct {
	// Service full name (namespace.name)
	ServiceID string `json:"serviceId" yaml:"serviceId"`

	// Individual endpoints (instances) for this service
	Endpoints []Endpoint `json:"endpoints" yaml:"endpoints"`

	// Service-level metadata
	Metadata map[string]string `json:"metadata,omitempty" yaml:"metadata,omitempty"`
}

type ServiceExpose struct {
	// Port or port name to expose
	Port string `json:"port" yaml:"port"`

	// Host for the exposed service
	Host string `json:"host,omitempty" yaml:"host,omitempty"`

	// Path prefix for the exposed service
	Path string `json:"path,omitempty" yaml:"path,omitempty"`

	// TLS configuration for the exposed service
	TLS *ExposeServiceTLS `json:"tls,omitempty" yaml:"tls,omitempty"`
}

type ServiceFinalizerInterface interface {
	DeleteService(ctx context.Context, service *Service) error
}

type ServiceMetadata struct {
	// Creation timestamp
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt" yaml:"updatedAt"`

	// Generation of the service
	Generation int64 `json:"generation,omitempty" yaml:"generation,omitempty"`

	// LastNonZeroScale tracks the most recent non-zero scale to support restart semantics
	LastNonZeroScale int `json:"lastNonZeroScale,omitempty" yaml:"lastNonZeroScale,omitempty"`
}

type ServiceNetworkPolicy struct {
	// Ingress rules (traffic coming into the service)
	Ingress []IngressRule `json:"ingress,omitempty" yaml:"ingress,omitempty"`

	// Egress rules (traffic going out from the service)
	Egress []EgressRule `json:"egress,omitempty" yaml:"egress,omitempty"`
}

type ServicePort struct {
	// Name for this port (used in references)
	Name string `json:"name" yaml:"name"`

	// Port number
	Port int `json:"port" yaml:"port"`

	// Target port (if different from port)
	TargetPort int `json:"targetPort,omitempty" yaml:"targetPort,omitempty"`

	// Protocol (default: TCP)
	Protocol string `json:"protocol,omitempty" yaml:"protocol,omitempty"`
}

type ServiceRegistry struct {
	// Map of service namespaced names to endpoint information
	Services map[string]*ServiceEndpoints `json:"services" yaml:"services"`

	// Last update timestamp
	LastUpdated time.Time `json:"lastUpdated" yaml:"lastUpdated"`
}

type ServiceRegistryOverride struct {
	Name string        `json:"name,omitempty" yaml:"name,omitempty"`
	Auth *RegistryAuth `json:"auth,omitempty" yaml:"auth,omitempty"`
}

type ServiceSpec struct {
	// Human-readable name for the service (required)
	Name string `json:"name" yaml:"name"`

	// Namespace the service belongs to (optional, defaults to "default")
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`

	// Labels for the service
	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`

	// Container image for the service (required)
	Image string `json:"image" yaml:"image"`

	// Command to run in the container (overrides image CMD)
	Command string `json:"command,omitempty" yaml:"command,omitempty"`

	// Arguments to the command
	Args []string `json:"args,omitempty" yaml:"args,omitempty"`

	// Environment variables for the service
	Env map[string]string `json:"env,omitempty" yaml:"env,omitempty"`

	// Import environment variables from secrets/configmaps with optional prefix
	EnvFrom EnvFromList `json:"envFrom,omitempty" yaml:"envFrom,omitempty"`

	// Number of instances to run (default: 1)
	Scale int `json:"scale" yaml:"scale"`

	// Ports exposed by the service
	Ports []ServicePort `json:"ports,omitempty" yaml:"ports,omitempty"`

	// Resource requirements for each instance
	Resources *Resources `json:"resources,omitempty" yaml:"resources,omitempty"`

	// Health checks for the service
	Health *HealthCheck `json:"health,omitempty" yaml:"health,omitempty"`

	// Network policy for controlling traffic
	NetworkPolicy *ServiceNetworkPolicy `json:"networkPolicy,omitempty" yaml:"networkPolicy,omitempty"`

	// External exposure configuration
	Expose *ServiceExpose `json:"expose,omitempty" yaml:"expose,omitempty"`

	// Placement preferences and requirements
	Affinity *ServiceAffinity `json:"affinity,omitempty" yaml:"affinity,omitempty"`

	// Autoscaling configuration
	Autoscale *ServiceAutoscale `json:"autoscale,omitempty" yaml:"autoscale,omitempty"`

	// Secret mounts
	SecretMounts []SecretMount `json:"secretMounts,omitempty" yaml:"secretMounts,omitempty"`

	// Configmap mounts
	ConfigmapMounts []ConfigmapMount `json:"configmapMounts,omitempty" yaml:"configmapMounts,omitempty"`

	// Service discovery configuration
	Discovery *ServiceDiscovery `json:"discovery,omitempty" yaml:"discovery,omitempty"`

	// Named registry selector for pulling the image (optional)
	ImageRegistry string `json:"imageRegistry,omitempty" yaml:"imageRegistry,omitempty"`

	// Registry override allowing inline auth or named selection (optional)
	Registry *ServiceRegistryOverride `json:"registry,omitempty" yaml:"registry,omitempty"`

	// ImagePullPolicy controls when the runner pulls the container image.
	// Allowed values: "Always" (default), "IfNotPresent", "Never".
	ImagePullPolicy string `json:"imagePullPolicy,omitempty" yaml:"imagePullPolicy,omitempty"`

	// Skip indicates this spec should be ignored by castfile parsing
	Skip bool `json:"skip,omitempty" yaml:"skip,omitempty"`

	// Dependencies in user-facing form. Accepts either:
	// - FQDN strings (e.g., "db.prod.rune") as YAML sequence entries
	// - ResourceRef strings (e.g., "secret:db-creds" or "configmap:app-settings")
	// - Structured objects (service/secret/configmap with optional namespace)
	// These will be normalized to []DependencyRef in internal Service
	Dependencies []ServiceDependency `json:"dependencies,omitempty" yaml:"dependencies,omitempty"`
	// contains filtered or unexported fields
}

type ServiceStatus string

type ServiceStatusInfo struct {
	Status ServiceStatus

	// ObservedGeneration tracks which generation was last processed by the controller
	ObservedGeneration int64 `json:"observedGeneration,omitempty" yaml:"observedGeneration,omitempty"`

	// DesiredInstances is the number of instances that should be running
	DesiredInstances int

	// RunningInstances is the number of instances that are currently running
	RunningInstances int
}

type Spec interface {
	// Validate ensures the spec is structurally and semantically valid.
	Validate() error
	// GetName returns the resource name declared in the spec.
	GetName() string
	// GetNamespace returns the resource namespace declared in the spec
	// (defaulting behavior may be applied by callers as needed).
	GetNamespace() string
	// Kind returns the logical resource kind (e.g., "Service", "Secret", "Config").
	Kind() string
}

type StoredSecret struct {
	// Name of the secret
	Name string `json:"name"`

	// Namespace of the secret
	Namespace string `json:"namespace"`

	// Version of the secret
	Version int `json:"version"`

	// Creation timestamp
	CreatedAt time.Time `json:"createdAt"`

	// Last update timestamp
	UpdatedAt time.Time `json:"updatedAt"`

	// Ciphertext of the secret
	Ciphertext []byte `json:"ciphertext"`

	// Wrapped DEK of the secret
	WrappedDEK []byte `json:"wrappedDEK"`
}

type TCPRoute struct {
	// Port number for this TCP route
	Port int `json:"port" yaml:"port"`

	// Destination service and options
	Destination RouteDestination `json:"destination" yaml:"destination"`
}

type TLSConfig struct {
	Enabled  bool   `yaml:"enabled"`
	CertFile string `yaml:"cert_file,omitempty"`
	KeyFile  string `yaml:"key_file,omitempty"`
}

type Token struct {
	ID          string     `json:"id" yaml:"id"`
	Name        string     `json:"name" yaml:"name"`
	SubjectID   string     `json:"subjectId" yaml:"subjectId"`
	SubjectType string     `json:"subjectType" yaml:"subjectType"` // "user" | "service"
	Description string     `json:"description,omitempty" yaml:"description,omitempty"`
	IssuedAt    time.Time  `json:"issuedAt" yaml:"issuedAt"`
	ExpiresAt   *time.Time `json:"expiresAt,omitempty" yaml:"expiresAt,omitempty"`
	Revoked     bool       `json:"revoked" yaml:"revoked"`
	SecretHash  string     `json:"secretHash" yaml:"secretHash"`
}

type User struct {
	ID        string    `json:"id" yaml:"id"`
	Name      string    `json:"name" yaml:"name"`
	Email     string    `json:"email,omitempty" yaml:"email,omitempty"`
	Policies  []string  `json:"policies,omitempty" yaml:"policies,omitempty"`
	CreatedAt time.Time `json:"createdAt" yaml:"createdAt"`
}

type ValidationError struct {
	Message string
}

type Volume struct {
	// Name of the persistent volume
	Name string `json:"name,omitempty" yaml:"name,omitempty"`

	// Storage details
	Storage VolumeStorage `json:"storage,omitempty" yaml:"storage,omitempty"`
}

type VolumeMount struct {
	// Name of the volume mount (for identification)
	Name string `json:"name" yaml:"name"`

	// Path where the volume should be mounted
	MountPath string `json:"mountPath" yaml:"mountPath"`

	// Volume details
	Volume Volume `json:"volume,omitempty" yaml:"volume,omitempty"`
}

type VolumeStorage struct {
	// Size of the volume (e.g., "10Gi")
	Size string `json:"size" yaml:"size"`

	// Storage class to use for provisioning
	StorageClassName string `json:"storageClassName" yaml:"storageClassName"`

	// Access mode (ReadWriteOnce, ReadOnlyMany, ReadWriteMany)
	AccessMode string `json:"accessMode" yaml:"accessMode"`
}