v1alpha1

type BundleEndpointProfile struct {
	// Type is the type of the bundle endpoint profile.
	Type BundleEndpointProfileType `json:"type"`

	// EndpointSPIFFEID is the SPIFFE ID of the bundle endpoint. It is
	// required for the "https_spiffe" profile.
	// +kubebuilder:validation:Optional
	EndpointSPIFFEID string `json:"endpointSPIFFEID,omitempty"`
}

type BundleEndpointProfileType string

type ClusterFederatedTrustDomain struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata"`

	Spec ClusterFederatedTrustDomainSpec `json:"spec"`
	// +optional
	Status ClusterFederatedTrustDomainStatus `json:"status"`
}

type ClusterFederatedTrustDomainCustomValidator struct {
}

type ClusterFederatedTrustDomainList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []ClusterFederatedTrustDomain `json:"items"`
}

type ClusterFederatedTrustDomainSpec struct {
	// TrustDomain is the name of the trust domain to federate with (e.g. example.org)
	// +kubebuilder:validation:Pattern="[a-z0-9._-]{1,255}"
	TrustDomain string `json:"trustDomain"`

	// BundleEndpointURL is the URL of the bundle endpoint. It must be an
	// HTTPS URL and cannot contain userinfo (i.e. username/password).
	BundleEndpointURL string `json:"bundleEndpointURL"`

	// BundleEndpointProfile is the profile for the bundle endpoint.
	BundleEndpointProfile BundleEndpointProfile `json:"bundleEndpointProfile"`

	// TrustDomainBundle is the contents of the bundle for the referenced trust
	// domain. This field is optional when the resource is created.
	// +kubebuilder:validation:Optional
	TrustDomainBundle string `json:"trustDomainBundle,omitempty"`

	// Set which Controller Class will act on this object
	// +kubebuilder:validation:Optional
	ClassName string `json:"className,omitempty"`
}

type ClusterFederatedTrustDomainStatus struct {
}

type ClusterSPIFFEID struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata"`

	Spec ClusterSPIFFEIDSpec `json:"spec"`
	// +optional
	Status ClusterSPIFFEIDStatus `json:"status"`
}

type ClusterSPIFFEIDCustomValidator struct {
}

type ClusterSPIFFEIDList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []ClusterSPIFFEID `json:"items"`
}

type ClusterSPIFFEIDSpec struct {

	// SPIFFEID is the SPIFFE ID template. The node and pod spec are made
	// available to the template under .NodeSpec, .PodSpec respectively.
	SPIFFEIDTemplate string `json:"spiffeIDTemplate"`

	// TTL indicates an upper-bound time-to-live for X509 SVIDs minted for this
	// ClusterSPIFFEID. If unset, a default will be chosen.
	TTL metav1.Duration `json:"ttl,omitempty"`

	// JWTTTL indicates an upper-bound time-to-live for JWT SVIDs minted for this
	// ClusterSPIFFEID.
	JWTTTL metav1.Duration `json:"jwtTtl,omitempty"`

	// DNSNameTemplate represents templates for extra DNS names that are
	// applicable to SVIDs minted for this ClusterSPIFFEID.
	// The node and pod spec are made available to the template under
	// .NodeSpec, .PodSpec respectively.
	DNSNameTemplates []string `json:"dnsNameTemplates,omitempty"`

	// WorkloadSelectorTemplates are templates to produce arbitrary workload
	// selectors that apply to a given workload before it will receive this
	// SPIFFE ID. The rendered value is interpreted by SPIRE and are of the
	// form type:value, where the value may, and often does, contain
	// semicolons, .e.g., k8s:container-image:docker/hello-world
	// The node and pod spec are made available to the template under
	// .NodeSpec, .PodSpec respectively.
	WorkloadSelectorTemplates []string `json:"workloadSelectorTemplates,omitempty"`

	// FederatesWith is a list of trust domain names that workloads that
	// obtain this SPIFFE ID will federate with.
	FederatesWith []string `json:"federatesWith,omitempty"`

	// NamespaceSelector selects the namespaces that are targeted by this
	// CRD.
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

	// PodSelector selects the pods that are targeted by this
	// CRD.
	PodSelector *metav1.LabelSelector `json:"podSelector,omitempty"`

	// Admin indicates whether or not the SVID can be used to access the SPIRE
	// administrative APIs. Extra care should be taken to only apply this
	// SPIFFE ID to admin workloads.
	Admin bool `json:"admin,omitempty"`

	// Downstream indicates that the entry describes a downstream SPIRE server.
	Downstream bool `json:"downstream,omitempty"`

	// AutoPopulateDNSNames indicates whether or not to auto populate service DNS names.
	AutoPopulateDNSNames bool `json:"autoPopulateDNSNames,omitempty"`

	// Set which Controller Class will act on this object
	// +kubebuilder:validation:Optional
	ClassName string `json:"className,omitempty"`

	// Apply this ID only if there are no other matching non fallback ClusterSPIFFEIDs.
	// +kubebuilder:validation:Optional
	Fallback bool `json:"fallback,omitempty"`

	// Set the entry hint
	// +kubebuilder:validation:Optional
	Hint string `json:"hint,omitempty"`
}

type ClusterSPIFFEIDStats struct {
	// How many namespaces were selected.
	// +kubebuilder:validation:Optional
	NamespacesSelected int `json:"namespacesSelected"`

	// How many (selected) namespaces were ignored (based on configuration).
	// +kubebuilder:validation:Optional
	NamespacesIgnored int `json:"namespacesIgnored"`

	// How many pods were selected out of the namespaces.
	// +kubebuilder:validation:Optional
	PodsSelected int `json:"podsSelected"`

	// How many failures were encountered rendering an entry selected pods.
	// This could be due to either a bad template in the ClusterSPIFFEID or
	// Pod metadata that when applied to the template did not produce valid
	// entry values.
	// +kubebuilder:validation:Optional
	PodEntryRenderFailures int `json:"podEntryRenderFailures"`

	// How many entries were masked by entries for other ClusterSPIFFEIDs.
	// This happens when one or more ClusterSPIFFEIDs produce an entry for
	// the same pod with the same set of workload selectors.
	// +kubebuilder:validation:Optional
	EntriesMasked int `json:"entriesMasked"`

	// How many entries are to be set for this ClusterSPIFFEID. In nominal
	// conditions, this should reflect the number of pods selected, but not
	// always if there were problems encountered rendering an entry for the pod
	// (RenderFailures) or entries are masked (EntriesMasked).
	// +kubebuilder:validation:Optional
	EntriesToSet int `json:"entriesToSet"`

	// How many entries were unable to be set due to failures to create or
	// update the entries via the SPIRE Server API.
	// +kubebuilder:validation:Optional
	EntryFailures int `json:"entryFailures"`
}

type ClusterSPIFFEIDStatus struct {
	// Stats produced by the last entry reconciliation run
	// +kubebuilder:validation:Optional
	Stats ClusterSPIFFEIDStats `json:"stats"`
}

type ClusterStaticEntry struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata"`

	Spec ClusterStaticEntrySpec `json:"spec"`
	// +optional
	Status ClusterStaticEntryStatus `json:"status"`
}

type ClusterStaticEntryList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []ClusterStaticEntry `json:"items"`
}

type ClusterStaticEntrySpec struct {
	SPIFFEID      string          `json:"spiffeID"`
	ParentID      string          `json:"parentID"`
	Selectors     []string        `json:"selectors"`
	FederatesWith []string        `json:"federatesWith,omitempty"`
	X509SVIDTTL   metav1.Duration `json:"x509SVIDTTL,omitempty"`
	JWTSVIDTTL    metav1.Duration `json:"jwtSVIDTTL,omitempty"`
	DNSNames      []string        `json:"dnsNames,omitempty"`
	Hint          string          `json:"hint,omitempty"`
	Admin         bool            `json:"admin,omitempty"`
	Downstream    bool            `json:"downstream,omitempty"`
	StoreSVID     bool            `json:"storeSVID,omitempty"`
	// Set which Controller Class will act on this object
	// +kubebuilder:validation:Optional
	ClassName string `json:"className,omitempty"`
}

type ClusterStaticEntryStatus struct {
	// If the static entry rendered properly.
	Rendered bool `json:"rendered"`

	// If the static entry was masked by another entry.
	Masked bool `json:"masked"`

	// If the static entry was successfully created/updated.
	Set bool `json:"set"`
}

type ControllerConfigurationSpec struct {
	// GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation
	// allowed for that controller.
	//
	// When a controller is registered within this manager using the builder utilities,
	// users have to specify the type the controller reconciles in the For(...) call.
	// If the object's kind passed matches one of the keys in this map, the concurrency
	// for that controller is set to the number specified.
	//
	// The key is expected to be consistent in form with GroupKind.String(),
	// e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`.
	//
	// +optional
	GroupKindConcurrency map[string]int `json:"groupKindConcurrency,omitempty"`

	// CacheSyncTimeout refers to the time limit set to wait for syncing caches.
	// Defaults to 2 minutes if not set.
	// +optional
	CacheSyncTimeout *time.Duration `json:"cacheSyncTimeout,omitempty"`

	// RecoverPanic indicates if panics should be recovered.
	// +optional
	RecoverPanic *bool `json:"recoverPanic,omitempty"`
}

type ControllerHealth struct {
	// HealthProbeBindAddress is the TCP address that the controller should bind to
	// for serving health probes
	// It can be set to "0" or "" to disable serving the health probe.
	// +optional
	HealthProbeBindAddress string `json:"healthProbeBindAddress,omitempty"`

	// ReadinessEndpointName, defaults to "readyz"
	// +optional
	ReadinessEndpointName string `json:"readinessEndpointName,omitempty"`

	// LivenessEndpointName, defaults to "healthz"
	// +optional
	LivenessEndpointName string `json:"livenessEndpointName,omitempty"`
}

type ControllerManagerConfig struct {
	metav1.TypeMeta `json:",inline"`

	// ControllerManagerConfigurationSpec returns the contfigurations for controllers
	ControllerManagerConfigurationSpec `json:",inline"`

	// ClusterName is the cluster name
	ClusterName string `json:"clusterName"`

	// ClusterDomain is the cluster domain, ie cluster.local
	ClusterDomain string `json:"clusterDomain"`

	// TrustDomain is the name of the SPIFFE trust domain
	TrustDomain string `json:"trustDomain"`

	// IgnoreNamespaces are the namespaces to ignore
	IgnoreNamespaces []string `json:"ignoreNamespaces"`

	// ValidatingWebhookConfigurationName selects the webhook configuration to manage.
	// Defaults to spire-controller-manager-webhook.
	ValidatingWebhookConfigurationName string `json:"validatingWebhookConfigurationName"`

	// GCInterval is how often SPIRE state is reconciled when the controller
	// is otherwise idle. This impacts how quickly SPIRE state will converge
	// after CRDs are removed or SPIRE state is mutated out from underneath
	// the controller.
	GCInterval time.Duration `json:"gcInterval,omitempty"`

	// SPIREServerSocketPath is the path to the SPIRE Server API socket.
	// Mutually exclusive with SPIREServerAddress.
	SPIREServerSocketPath string `json:"spireServerSocketPath,omitempty"`

	// SPIREServerAddress is the host:port of the SPIRE Server API. When set,
	// the controller manager connects to the SPIRE Server over TCP using
	// SPIFFE mTLS instead of the local Unix domain socket, authenticating
	// itself with an X509-SVID obtained from the SPIFFE Workload API at
	// WorkloadAPIAddr. The caller's SPIFFE ID must be granted admin rights
	// on the SPIRE Server (e.g. via a registration entry with the admin
	// flag, or the server's admin_ids configuration).
	// Mutually exclusive with SPIREServerSocketPath.
	// +optional
	SPIREServerAddress string `json:"spireServerAddress,omitempty"`

	// WorkloadAPIAddr is the address of the SPIFFE Workload API used to
	// obtain the controller manager's own X509-SVID when SPIREServerAddress
	// is set. Defaults to the SPIFFE_ENDPOINT_SOCKET environment variable
	// (as used by the go-spiffe Workload API client) when unset.
	// +optional
	WorkloadAPIAddr string `json:"workloadAPIAddr,omitempty"`

	// LogLevel is the log level for the controller manager
	LogLevel string `json:"logLevel"`

	// LogEncoding is the log encoding for the controller manager
	LogEncoding string `json:"logEncoding"`

	// Grpc is the grpc configuration for the controller manager communication with SPIRE Server API
	Grpc *spireapi.GrpcConfig `json:"grpc,omitempty"`

	// TLSConfig configures TLS security settings for terminating endpoints such
	// as the admission webhook server.
	// +optional
	TLSConfig *TLSConfig `json:"tlsConfig,omitempty"`
}

type ControllerManagerConfigurationSpec struct {
	// SyncPeriod determines the minimum frequency at which watched resources are
	// reconciled. A lower period will correct entropy more quickly, but reduce
	// responsiveness to change if there are many watched resources. Change this
	// value only if you know what you are doing. Defaults to 10 hours if unset.
	// there will a 10 percent jitter between the SyncPeriod of all controllers
	// so that all controllers will not send list requests simultaneously.
	// +optional
	SyncPeriod *metav1.Duration `json:"syncPeriod,omitempty"`

	// LeaderElection is the LeaderElection config to be used when configuring
	// the manager.Manager leader election.
	// +optional
	LeaderElection *configv1alpha1.LeaderElectionConfiguration `json:"leaderElection,omitempty"`

	// CacheNamespace if specified restricts the manager's cache to watch objects in
	// the desired namespace. Defaults to all namespaces.
	//
	// Deprecated: use cacheNamespaces instead
	//
	// Note: If a namespace is specified, controllers can still Watch for a
	// cluster-scoped resource (e.g Node).  For namespaced resources the cache
	// will only hold objects from the desired namespace.
	// +optional
	CacheNamespace string `json:"cacheNamespace,omitempty"`

	// CacheNamespaces if specified restricts the manager's cache to watch objects in
	// the desired namespaces. Defaults to all namespaces.
	// +optional
	CacheNamespaces map[string]*NamespaceConfig `json:"cacheNamespaces,omitempty"`

	// GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop.
	// To disable graceful shutdown, set to time.Duration(0)
	// To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1)
	// The graceful shutdown is skipped for safety reasons in case the leader election lease is lost.
	GracefulShutdownTimeout *metav1.Duration `json:"gracefulShutDown,omitempty"`

	// Controller contains global configuration options for controllers
	// registered within this manager.
	// +optional
	Controller *ControllerConfigurationSpec `json:"controller,omitempty"`

	// Metrics contains the controller metrics configuration
	// +optional
	Metrics ControllerMetrics `json:"metrics"`

	// Health contains the controller health configuration
	// +optional
	Health ControllerHealth `json:"health"`

	// Webhook contains the controllers webhook configuration
	// +optional
	Webhook ControllerWebhook `json:"webhook"`

	// ClassName contains the name of a class to watch CRs for. Others will be ignored.
	// If unset all will be watched.
	// +optional
	ClassName string `json:"className,omitempty"`

	// If WatchClassless is set and ClassName is set, any CR without a ClassName
	// specified will also be handled by this controller.
	// +optional
	WatchClassless bool `json:"watchClassless,omitempty"`

	// ClusterSPIFFEIDLabelSelector if specified, restricts the ClusterSPIFFEID
	// informer cache to only objects matching the given labels. When empty, all
	// ClusterSPIFFEID objects are cached (default behavior).
	// Useful in SPIRE setups to limit the controller manager cache
	// to only the targeted ClusterSPIFFEIDs it needs to reconcile.
	// +optional
	ClusterSPIFFEIDLabelSelector map[string]string `json:"clusterSPIFFEIDLabelSelector,omitempty"`

	// FilterByClassName, if set, restricts the ClusterSPIFFEID informer cache
	// to objects labeled with this controller's ClassName, using the
	// well-known "spire.spiffe.io/class-name" label. It is shorthand for
	// adding {"spire.spiffe.io/class-name": ClassName} to
	// ClusterSPIFFEIDLabelSelector. If ClusterSPIFFEIDLabelSelector already
	// sets that label to a different value, this value takes precedence.
	// Requires ClassName to be set.
	// +optional
	FilterByClassName bool `json:"filterByClassName,omitempty"`

	// If specified, uses a different parent id template for linking pods to nodes
	// +optional
	ParentIDTemplate string `json:"parentIDTemplate,omitempty"`

	// If specified, only syncs the specified CR types. Defaults to all.
	// +optional
	Reconcile *ReconcileConfig `json:"reconcile,omitempty"`

	// If specified, prefixes each entry id with `<prefix>.`. Entries without the Prefix will be ignored (except ones marked for cleanup, see EntryIDPrefixCleanup).
	// +optiional
	EntryIDPrefix string `json:"entryIDPrefix,omitempty"`

	// If specified, entries with the specified prefix will be removed. If set to "" it will clean up all unprefixed entries.
	// It can not be set to the same value as EntryIDPrefix.
	// Generally useful when switching from nonprefixed to prefixed, or between two different prefixes.
	// +optiional
	EntryIDPrefixCleanup *string `json:"entryIDPrefixCleanup,omitempty"`

	// When configured, read yaml objects from the specified path rather then from Kubernetes.
	StaticManifestPath *string `json:"staticManifestPath,omitempty"`

	// When true, any static manifest parsed will first have environment variables expanded.
	ExpandEnvStaticManifests bool `json:"expandEnvStaticManifests"`

	// EnableEntryRenderCache enables the LRU cache for rendered pod entries.
	// Defaults to false.
	// +optional
	EnableEntryRenderCache bool `json:"enableEntryRenderCache,omitempty"`

	// EntryRenderCacheSize is the maximum number of entries in the LRU cache for
	// rendered pod entries. Only used when enableEntryRenderCache is true.
	// Defaults to 300000 if unset or zero.
	// +optional
	EntryRenderCacheSize int `json:"entryRenderCacheSize,omitempty"`
}

type ControllerMetrics struct {
	// BindAddress is the TCP address that the controller should bind to
	// for serving prometheus metrics.
	// It can be set to "0" to disable the metrics serving.
	// +optional
	BindAddress string `json:"bindAddress,omitempty"`
}

type ControllerWebhook struct {
	// Port is the port that the webhook server serves at.
	// It is used to set webhook.Server.Port.
	// +optional
	Port *int `json:"port,omitempty"`

	// Host is the hostname that the webhook server binds to.
	// It is used to set webhook.Server.Host.
	// +optional
	Host string `json:"host,omitempty"`

	// CertDir is the directory that contains the server key and certificate.
	// if not set, webhook server would look up the server key and certificate in
	// {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate
	// must be named tls.key and tls.crt, respectively.
	// +optional
	CertDir string `json:"certDir,omitempty"`
}

type NamespaceConfig struct {
	// LabelSelectors map of Labels selectors
	// +optional
	LabelSelectors map[string]string `json:"labelSelectors,omitempty"`

	// FieldSelectors map of Fields selectors
	// +optional
	FieldSelectors map[string]string `json:"fieldSelectors,omitempty"`
}

type ParsedClusterSPIFFEIDSpec struct {
	SPIFFEIDTemplate          *template.Template
	NamespaceSelector         labels.Selector
	PodSelector               labels.Selector
	TTL                       time.Duration
	JWTTTL                    time.Duration
	FederatesWith             []spiffeid.TrustDomain
	DNSNameTemplates          []*template.Template
	WorkloadSelectorTemplates []*template.Template
	Admin                     bool
	Downstream                bool
	AutoPopulateDNSNames      bool
	Hint                      string
}

type ReconcileConfig struct {
	// ClusterSpiffeIds enable syncing of clusterspiffeids
	// +optional
	ClusterSPIFFEIDs bool `json:"clusterSPIFFEIDs,omitempty"`

	// ClusterFederatedTrustDomains enable syncing of clusterfederatedtrustdomains
	// +optional
	ClusterFederatedTrustDomains bool `json:"clusterFederatedTrustDomains,omitempty"`

	// ClusterStaticEntries enable syncing of clusterstaticentries
	// +optional
	ClusterStaticEntries bool `json:"clusterStaticEntries,omitempty"`
}

type TLSConfig struct {
	// MinTLSVersion is the minimum TLS version in Kubernetes-style naming
	// (for example "VersionTLS12"). Values below VersionTLS12 are rejected.
	// +optional
	MinTLSVersion string `json:"minTLSVersion,omitempty"`

	// CipherSuites is the list of allowed cipher suites in IANA naming.
	// +optional
	CipherSuites []string `json:"cipherSuites,omitempty"`

	// CurvePreferences is the ordered list of allowed key exchange curves or groups.
	// +optional
	CurvePreferences []string `json:"curvePreferences,omitempty"`
}