v1alpha1

type VaultCertificate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   VaultCertificateSpec   `json:"spec,omitempty"`
	Status VaultCertificateStatus `json:"status,omitempty"`
}

type VaultCertificateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []VaultCertificate `json:"items"`
}

type VaultCertificateSpec struct {

	// +kubebuilder:validation:MinLength=3
	// +kubebuilder:validation:MaxLength=255
	// +kubebuilder:validation:Pattern=`^[^-_+A-Z][^A-Z\\\/\*\?"\<\> ,|#]{1,254}$`
	// +kubebuilder:validation:Required
	Name string `json:"name"`
	// Path PKI in Vault.
	// +kubebuilder:validation:MaxLength=255
	// +kubebuilder:validation:Required
	VaultPKIPath string `json:"vault_pki_path"`
	// For future use of ec and ecdsa
	// +kubebuilder:default=rsa
	// +kubebuilder:validation:Pattern=`^(rsa|ec|ecdsa)$`
	KeyType string `json:"key_type,omitempty"`
	// Key length
	// +kubebuilder:default=4096
	KeyLength uint `json:"key_length,omitempty"`
	// Key ECDSA curve
	// +kubebuilder:validation:Pattern=`^(p224|p256|p384|p521)$`
	ECDSACurve string `json:"ecdsa_curve,omitempty"`
	// +kubebuilder:validation:Required
	CommonName string `json:"cn"`
	// Alternative names if you need more than one
	// CommonName will be added automatically
	AltNames []string `json:"alt_names,omitempty"`
	// What is TTL for certificate (in seconds).
	// Min 5 minutes, Max 1 year (in seconds). Default 24 hours
	//+kubebuilder:validation:Minimum=300
	//+kubebuilder:validation:Maximum=31536000
	//+kubebuilder:default=86400
	CertTTL int `json:"cert_ttl,omitempty"`
	// Type is the type of the Kubernetes secret, which will be created by the
	// Type of secret. Default kubernetes.io/tls
	//+kubebuilder:default=kubernetes.io/tls
	Type corev1.SecretType `json:"type,omitempty"`
	// ManualCreateSecret if true, then secret will not be created automatically
	// +kubebuilder:default=true
	// +kubebuilder:validation:Format=`^(true|false)$`
	ManualCreateSecret bool `json:"manual_create_secret,omitempty"`
}

type VaultCertificateStatus struct {

	// Condition store the status condition of the VaultCertificate instances
	// +operator-sdk:csv:customresourcedefinitions:type=status
	Condition metav1.Condition `json:"condition,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
	// Cert expire date
	CertValidUntil metav1.Time `json:"cert_valid_until,omitempty"`
}

type VaultSecret struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   VaultSecretSpec   `json:"spec,omitempty"`
	Status VaultSecretStatus `json:"status,omitempty"`
}

type VaultSecretList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []VaultSecret `json:"items"`
}

type VaultSecretSpec struct {

	//+kubebuilder:validation:MinLength=3
	//+kubebuilder:validation:MaxLength=255
	//+kubebuilder:validation:Pattern=`^[^-_+A-Z][^A-Z\\\/\*\?"\<\> ,|#]{1,254}$`
	Name string `json:"name"`
	// Path is map of secrets and their path in Vault. Keys would be ported to
	// secrets and values would be taken from Vault secrets values.
	// NOTE: 'value' keys in Vault would be base64 encoded for K8S secrets and
	//       'base64_values' keys in Vault would not be encoded for K8S secrets
	SecretsPaths map[string]string `json:"secrets_paths"`
	// ProvidedSecrets are secrets, which we don't need to look for in Vault,
	//  but take from this structure and push to final secret verbatim.
	//  Required for mixed secrets, where part is from Vault, part is provided in CRD.
	ProvidedSecrets map[string]string `json:"provided_secrets,omitempty"`
	// How offten to re-read secrets from Vault (in seconds).
	// Min 5 minutes, Max 1 year (in seconds). Default 24 hours
	//+kubebuilder:validation:Minimum=300
	//+kubebuilder:validation:Maximum=31536000
	//+kubebuilder:default=86400
	ReReadIntervals int64 `json:"reread_intervals,omitempty"`
	// Type is the type of the Kubernetes secret, which will be created by the
	// VaultSecrets Operator. Default Opaque
	//+kubebuilder:default=Opaque
	Type corev1.SecretType `json:"type,omitempty"`
}

type VaultSecretStatus struct {
	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
	// Important: Run "operator-sdk generate k8s" to regenerate code after modifying this file
	// Add custom validation using kubebuilder tags: https://book-v1.book.kubebuilder.io/beyond_basics/generating_crd.html
	// Unix timestamp when secret was read last time, required for re-reading schedule.
	//  If LastReadTime < now().Seconds() - ReReadIntervals, then operator would re-read values from Vault
	LastReadTime int64 `json:"last_read_time"`
	// LatestError would hold error, if last operation was un-successful, or it would be empty otherways
	// +optional
	LatestError string `json:"latest_error,omitempty"`
}