v1alpha1

type BundleEndpointProfile struct {
	// Type is the type of the bundle endpoint profile.
	Type BundleEndpointProfileType `json:"type"`

	// EndpointSPIFFEID is the SPIFFE ID of the bundle endpoint. It is
	// required for the "https_spiffe" profile.
	// +kubebuilder:validation:Optional
	EndpointSPIFFEID string `json:"endpointSPIFFEID,omitempty"`
}

type BundleEndpointProfileType string

type ClusterFederatedTrustDomain struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterFederatedTrustDomainSpec   `json:"spec,omitempty"`
	Status ClusterFederatedTrustDomainStatus `json:"status,omitempty"`
}

type ClusterFederatedTrustDomainList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterFederatedTrustDomain `json:"items"`
}

type ClusterFederatedTrustDomainSpec struct {
	// TrustDomain is the name of the trust domain to federate with (e.g. example.org)
	// +kubebuilder:validation:Pattern="[a-z0-9._-]{1,255}"
	TrustDomain string `json:"trustDomain"`

	// BundleEndpointURL is the URL of the bundle endpoint. It must be an
	// HTTPS URL and cannot contain userinfo (i.e. username/password).
	BundleEndpointURL string `json:"bundleEndpointURL"`

	// BundleEndpointProfile is the profile for the bundle endpoint.
	BundleEndpointProfile BundleEndpointProfile `json:"bundleEndpointProfile"`

	// TrustDomainBundle is the contents of the bundle for the referenced trust
	// domain. This field is optional when the resource is created.
	// +kubebuilder:validation:Optional
	TrustDomainBundle string `json:"trustDomainBundle,omitempty"`
}

type ClusterFederatedTrustDomainStatus struct {
}

type ClusterSPIFFEID struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterSPIFFEIDSpec   `json:"spec,omitempty"`
	Status ClusterSPIFFEIDStatus `json:"status,omitempty"`
}

type ClusterSPIFFEIDList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterSPIFFEID `json:"items"`
}

type ClusterSPIFFEIDSpec struct {

	// SPIFFEID is the SPIFFE ID template. The node and pod spec are made
	// available to the template under .NodeSpec, .PodSpec respectively.
	SPIFFEIDTemplate string `json:"spiffeIDTemplate"`

	// TTL indicates an upper-bound time-to-live for SVIDs minted for this
	// ClusterSPIFFEID. If unset, a default will be chosen.
	TTL metav1.Duration `json:"ttl,omitempty"`

	// DNSNameTemplate represents templates for extra DNS names that are
	// applicable to SVIDs minted for this ClusterSPIFFEID.
	// The node and pod spec are made available to the template under
	// .NodeSpec, .PodSpec respectively.
	DNSNameTemplates []string `json:"dnsNameTemplates,omitempty"`

	// WorkloadSelectorTemplates are templates to produce arbitrary workload
	// selectors that apply to a given workload before it will receive this
	// SPIFFE ID. The rendered value is interpreted by SPIRE and are of the
	// form type:value, where the value may, and often does, contain
	// semicolons, .e.g., k8s:container-image:docker/hello-world
	// The node and pod spec are made available to the template under
	// .NodeSpec, .PodSpec respectively.
	WorkloadSelectorTemplates []string `json:"workloadSelectorTemplates,omitempty"`

	// FederatesWith is a list of trust domain names that workloads that
	// obtain this SPIFFE ID will federate with.
	FederatesWith []string `json:"federatesWith,omitempty"`

	// NamespaceSelector selects the namespaces that are targeted by this
	// CRD.
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

	// PodSelector selects the pods that are targeted by this
	// CRD.
	PodSelector *metav1.LabelSelector `json:"podSelector,omitempty"`

	// Admin indicates whether or not the SVID can be used to access the SPIRE
	// administrative APIs. Extra care should be taken to only apply this
	// SPIFFE ID to admin workloads.
	Admin bool `json:"admin,omitempty"`

	// Downstream indicates that the entry describes a downstream SPIRE server.
	Downstream bool `json:"downstream,omitempty"`
}

type ClusterSPIFFEIDStats struct {
	// How many namespaces were selected.
	// +kubebuilder:validation:Optional
	NamespacesSelected int `json:"namespacesSelected"`

	// How many (selected) namespaces were ignored (based on configuration).
	// +kubebuilder:validation:Optional
	NamespacesIgnored int `json:"namespacesIgnored"`

	// How many pods were selected out of the namespaces.
	// +kubebuilder:validation:Optional
	PodsSelected int `json:"podsSelected"`

	// How many failures were encountered rendering an entry selected pods.
	// This could be due to either a bad template in the ClusterSPIFFEID or
	// Pod metadata that when applied to the template did not produce valid
	// entry values.
	// +kubebuilder:validation:Optional
	PodEntryRenderFailures int `json:"podEntryRenderFailures"`

	// How many entries were masked by entries for other ClusterSPIFFEIDs.
	// This happens when one or more ClusterSPIFFEIDs produce an entry for
	// the same pod with the same set of workload selectors.
	// +kubebuilder:validation:Optional
	EntriesMasked int `json:"entriesMasked"`

	// How many entries are to be set for this ClusterSPIFFEID. In nominal
	// conditions, this should reflect the number of pods selected, but not
	// always if there were problems encountered rendering an entry for the pod
	// (RenderFailures) or entries are masked (EntriesMasked).
	// +kubebuilder:validation:Optional
	EntriesToSet int `json:"entriesToSet"`

	// How many entries were unable to be set due to failures to create or
	// update the entries via the SPIRE Server API.
	// +kubebuilder:validation:Optional
	EntryFailures int `json:"entryFailures"`
}

type ClusterSPIFFEIDStatus struct {

	// Stats produced by the last entry reconciliation run
	// +kubebuilder:validation:Optional
	Stats ClusterSPIFFEIDStats `json:"stats"`
}

type ControllerManagerConfig struct {
	metav1.TypeMeta `json:",inline"`

	// ControllerManagerConfigurationSpec returns the contfigurations for controllers
	cfgv1alpha1.ControllerManagerConfigurationSpec `json:",inline"`

	// ClusterName is the cluster name
	ClusterName string `json:"clusterName"`

	// TrustDomain is the name of the SPIFFE trust domain
	TrustDomain string `json:"trustDomain"`

	// IgnoreNamespaces are the namespaces to ignore
	IgnoreNamespaces []string `json:"ignoreNamespaces"`

	// ValidatingWebhookConfigurationName selects the webhook configuration to manage.
	// Defaults to spire-controller-manager-webhook.
	ValidatingWebhookConfigurationName string `json:"validatingWebhookConfigurationName"`

	// GCInterval is how often SPIRE state is reconciled when the controller
	// is otherwise idle. This impacts how quickly SPIRE state will converge
	// after CRDs are removed or SPIRE state is mutated out from underneath
	// the controller.
	GCInterval time.Duration `json:"gcInterval"`

	// SPIREServerSocketPath is the path to the SPIRE Server API socket
	SPIREServerSocketPath string `json:"spireServerSocketPath"`
}

type ParsedClusterSPIFFEIDSpec struct {
	SPIFFEIDTemplate          *template.Template
	NamespaceSelector         labels.Selector
	PodSelector               labels.Selector
	TTL                       time.Duration
	FederatesWith             []spiffeid.TrustDomain
	DNSNameTemplates          []*template.Template
	WorkloadSelectorTemplates []*template.Template
	Admin                     bool
	Downstream                bool
}