v1alpha1

type CRLExposeSpec struct {
	// Enabled indicates whether the CRL should be exposed.
	Enabled bool `json:"enabled"`

	// Image specifies the container image to use for exposing the CRL.
	// +optional
	Image ImageSpec `json:"image,omitempty"`
	// Node Selector to deploy the CRL server
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
	// Tolerations to deploy the CRL server
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// Internal indicates whether the issuer should be configured to reach the
	// CRL internally within the cluster.
	// (default: true)
	// +optional
	Internal *bool `json:"internal"`

	// Ingress indicates whether the CRL should be exposed externally outside the cluster
	// using an Ingress resource.
	// (default: Disabled)
	// +optional
	Ingress *IngressSpec `json:"ingress"`
}

type IPAddress string

type ImageSpec struct {
	// Repository is the container image repository.
	// +kubebuilder:validation:MinLength=1
	// +optional
	Repository *string `json:"repository"`

	// Name is the container image name.
	// (default: "nginx")
	// +kubebuilder:validation:MinLength=1
	// +optional
	Name *string `json:"name"`

	// Tag is the container image tag.
	// (default: "1.29.3-alpine3.22")
	// +kubebuilder:validation:MinLength=1
	// +optional
	Tag *string `json:"tag"`

	// PullSecretRef is a reference to a Secret containing the image pull
	// credentials.
	// +optional
	PullSecrets []corev1.LocalObjectReference `json:"pullSecrets,omitempty"`
}

type IngressSpec struct {
	// Enabled indicates whether to create an Ingress resource to expose the CRL.
	// (default: true)
	// +optional
	Enabled *bool `json:"enabled"`

	// Managed indicates whether the operator should manage the Ingress resource.
	// If false, the Ingress resource will not be created or updated by the operator.
	// (default: true)
	// +optional
	Managed *bool `json:"managed"`

	// Hostname is the hostname to use for the ingress.
	// (One of Hostname or IPAddresses must be specified)
	// +kubebuilder:validation:MinLength=1
	// +optional
	Hostname *string `json:"hostname,omitempty"`

	// ClassName is the ingress class name to use for the ingress.
	// +optional
	ClassName *string `json:"className,omitempty"`

	// IPAddresses is a list of IP addresses to use for the ingress.
	// (One of Hostname or IPAddresses must be specified)
	// +optional
	IPAddresses []IPAddress `json:"ipAddresses,omitempty"`
}

type ManagedCRL struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ManagedCRLSpec   `json:"spec,omitempty"`
	Status ManagedCRLStatus `json:"status,omitempty"`
}

type ManagedCRLList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ManagedCRL `json:"items"`
}

type ManagedCRLSpec struct {
	// IssuerRef is a reference to the cert-manager Issuer or ClusterIssuer
	// that will sign the CRL.
	IssuerRef cmmetav1.ObjectReference `json:"issuerRef"`

	// Duration is the duration for which the CRL is valid.
	// (default: 168h = 7 days)
	// +optional
	Duration *metav1.Duration `json:"duration,omitempty"`

	// Revocations is a list of certificates to be revoked.
	// +optional
	Revocations []RevocationSpec `json:"revocations,omitempty"`

	// Expose specifies how the CRL should be exposed.
	// +optional
	Expose *CRLExposeSpec `json:"expose,omitempty"`
}

type ManagedCRLStatus struct {
	// SecretReady indicates whether the CRL is built and available in the Secret.
	SecretReady *bool `json:"secretReady,omitempty"`
	// PodExposed indicates whether the CRL expose Pod is running.
	PodExposed *bool `json:"podExposed,omitempty"`
	// IngressExposed indicates whether the CRL Ingress is available.
	IngressExposed *bool `json:"ingressExposed,omitempty"`
	// IssuerConfigured indicates whether the Issuer is properly configured.
	IssuerConfigured *bool              `json:"issuerConfigured,omitempty"`
	Conditions       []metav1.Condition `json:"conditions,omitempty"`

	// CRLValidUntil is the time until which the CRL is valid.
	CRLValidUntil metav1.Time `json:"crlValidUntil,omitempty"`

	// CRLNumber is the number of the CRL.
	CRLNumber int64 `json:"crlNumber,omitempty"`

	// ObservedCASecretRef is a reference to the Secret containing the last
	// CA certificate and private key used to sign the CRL.
	ObservedCASecretRef *corev1.SecretReference `json:"observedCASecretRef,omitempty"`
	// ObservedCASecretVersion is the resource version of the Secret
	// containing the last CA certificate and private key used to sign the CRL.
	ObservedCASecretVersion string `json:"observedCASecretVersion,omitempty"`
}

type RevocationSpec struct {
	// SerialNumber is the serial number of the certificate to be revoked.
	// +kubebuilder:validation:MinLength=1
	SerialNumber string `json:"serialNumber"`

	// RevocationTime is the time at which the certificate was revoked.
	// If not specified, the current time will be used.
	// +optional
	RevocationTime *metav1.Time `json:"revocationTime,omitempty"`

	// Reason is the reason for revocation (refer to RFC 5280 Section 5.3.1.).
	ReasonCode int `json:"reasonCode,omitempty"`
}