v1alpha1

type AppEnvConfigTemplateAllowedEgress struct {
	// Type of egress traffic (i.e. "http").
	Type string `json:"type,omitempty"`
	// Hosts to allow egress to (i.e. "www.google.com").
	Hosts []string `json:"hosts,omitempty"`
}

type AppEnvConfigTemplateAuth struct {
	// Configuration for validating JWTs.
	JWT       *AppEnvConfigTemplateJWT       `json:"jwt,omitempty"`
	GCPAccess *AppEnvConfigTemplateGCPAccess `json:"gcpAccess,omitempty"`
}

type AppEnvConfigTemplateGCPAccess struct {
	// Defines the type of GCP access auth granted to the application (must be "secret" or "vault").
	AccessType string `json:"accessType,omitempty"`
	// Used with accessType="secret". Declares the properties of the secret resource.
	SecretInfo *AppEnvConfigTemplateGCPAccessSecretInfo `json:"secretInfo,omitempty"`
	// Used with accessType="vault". Declares the configured Google Cloud roleSet name
	// to be enabled via the given Kubernetes service accounts for use by the application.
	// See https://www.vaultproject.io/docs/secrets/gcp/index.html for details on creating roleSets.
	VaultInfo *AppEnvConfigTemplateGCPAccessVaultInfo `json:"vaultInfo,omitempty"`
}

type AppEnvConfigTemplateGCPAccessSecretInfo struct {
	// The name of the Secret.
	Name string `json:"name,omitempty"`
	// The namespace of the Secret.
	Namespace string `json:"namespace,omitempty"`
}

type AppEnvConfigTemplateGCPAccessVaultInfo struct {
	// Kubernetes service account name used in Vault authentication.
	ServiceAccount string `json:"serviceAccount,omitempty"`
	// Vault Google Cloud Secrets Engine mounted path.
	Path string `json:"path,omitempty"`
	// Vault Google Cloud Secrets Engine roleset name to retrieve credentials from.
	Roleset string `json:"roleset,omitempty"`
}

type AppEnvConfigTemplateIngress struct {
	TLS AppEnvConfigTemplateIngressTLS `json:"tls,omitempty"`
}

type AppEnvConfigTemplateIngressTLS struct {
	CertSecrets []string `json:"certSecrets,omitempty"`
}

type AppEnvConfigTemplateJWT struct {
	// Type of system to accept JWTs from (i.e. "firebase").
	Type string `json:"type,omitempty"`
	// Parameters used to identify project/etc. for a given type of system.
	Params map[string]string `json:"params,omitempty"`
}

type AppEnvConfigTemplateRelatedClientInfo struct {
	// Name of the allowed client (corresponds to the "app" label on client Pod). It can be namespaced (i.e. "namespace/app") or it will default to the same namespace as the app config.
	Name string `json:"name,omitempty"`
}

type AppEnvConfigTemplateServiceInfo struct {
	// Name of the service.
	Name string `json:"name,omitempty"`
	// Must match the "app" label on the corresponding deployed Pods.
	DeploymentApp string `json:"deploymentApp,omitempty"`
	// Must match the "version" label on the corresponding deployed Pods.
	DeploymentVersion string `json:"deploymentVersion,omitempty"`
	// Must match the port exposed on the corresponding deployed Pods.
	DeploymentPort int32 `json:"deploymentPort,omitempty"`
	// The port for the Kubernetes Service that will be created.
	ServicePort int32 `json:"servicePort,omitempty"`
	// Protocol to use for the service (i.e. "TCP").
	DeploymentPortProtocol corev1.Protocol `json:"deploymentPortProtocol,omitempty"`
	// The set of clients that are allowed to call the service.
	AllowedClients []AppEnvConfigTemplateRelatedClientInfo `json:"allowedClients,omitempty"`
	// Disables the application-wide auth policy (i.e. JWT) for this service.
	DisableAuth bool `json:"disableAuth,omitempty"`
	// Attaches a kubernetes service account to created pods.
	ServiceAccount string `json:"serviceAccount,omitempty"`
	// Specifies the ingress policy for this service (external access).
	Ingress *ServiceIngress `json:"ingress,omitempty"`
}

type AppEnvConfigTemplateStatusConditionType string

type AppEnvConfigTemplateV2 struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AppEnvConfigTemplateV2Spec   `json:"spec,omitempty"`
	Status AppEnvConfigTemplateV2Status `json:"status,omitempty"`
}

type AppEnvConfigTemplateV2List struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AppEnvConfigTemplateV2 `json:"items"`
}

type AppEnvConfigTemplateV2Spec struct {
	// Services that make up this application (set of services).
	Services []AppEnvConfigTemplateServiceInfo `json:"services,omitempty"`
	// Whitelisted destinations that services may initiate outgoing connections with.
	AllowedEgress []AppEnvConfigTemplateAllowedEgress `json:"allowedEgress,omitempty"`
	// Application-wide authentication configuration.
	Auth *AppEnvConfigTemplateAuth `json:"auth,omitempty"`
	// Ingress configuration.
	Ingress AppEnvConfigTemplateIngress `json:"ingress,omitempty"`
}

type AppEnvConfigTemplateV2Status struct{}

type ServiceIngress struct {
	Host string `json:"host,omitempty"`
	Path string `json:"path,omitempty"`
}