v1beta1

type ActuationMode string

type ConfigConnector struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ConfigConnectorSpec   `json:"spec,omitempty"`
	Status ConfigConnectorStatus `json:"status,omitempty"`
}

type ConfigConnectorContext struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ConfigConnectorContextSpec   `json:"spec"`
	Status ConfigConnectorContextStatus `json:"status,omitempty"`
}

type ConfigConnectorContextList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ConfigConnectorContext `json:"items"`
}

type ConfigConnectorContextSpec struct {
	// The Google Service Account to be used by Config Connector to
	// authenticate with Google Cloud APIs in the associated namespace.
	GoogleServiceAccount string `json:"googleServiceAccount"`

	// Specifies which project to use for preconditions, quota, and billing for
	// requests made to Google Cloud APIs for resources in the associated
	// namespace. Must be one of 'SERVICE_ACCOUNT_PROJECT',
	// 'RESOURCE_PROJECT', or 'BILLING_PROJECT. Defaults to 'SERVICE_ACCOUNT_PROJECT'. If set to
	// 'SERVICE_ACCOUNT_PROJECT', uses the project that the Google Service
	// Account belongs to. If set to 'RESOURCE_PROJECT', uses the project that
	// the resource belongs to. If set to 'BILLING_PROJECT', uses the project specified by spec.billingProject.
	// +kubebuilder:validation:Enum=SERVICE_ACCOUNT_PROJECT;RESOURCE_PROJECT;BILLING_PROJECT
	RequestProjectPolicy string `json:"requestProjectPolicy,omitempty"`

	// Specifies the project to use for preconditions, quota and billing.
	// Should only be used when requestProjectPolicy is set to BILLING_PROJECT.
	BillingProject string `json:"billingProject,omitempty"`

	// StateIntoSpec is the user override of the default value for the
	// 'cnrm.cloud.google.com/state-into-spec' annotation if the annotation is
	// unset for a resource.
	// 'absent' means that unspecified fields in the resource spec stay
	// unspecified after successful reconciliation.
	// 'merge' means that unspecified fields in the resource spec are populated
	// after a successful reconciliation if those unspecified fields are
	// computed/defaulted by the API.
	//+kubebuilder:validation:Enum=Absent;Merge
	//+kubebuilder:validation:Optional
	StateIntoSpec *StateIntoSpecValue `json:"stateIntoSpec,omitempty"`
	// The actuation mode of Config Connector controls how resources are actuated onto the cloud provider.
	// This can be either 'Reconciling' or 'Paused'. The default is 'Reconciling' where resources get actuated.
	// In 'Paused', k8s resources are still reconciled with the api server but not actuated onto the cloud provider.
	//+kubebuilder:validation:Enum=Reconciling;Paused
	//+kubebuilder:validation:Optional
	Actuation ActuationMode `json:"actuationMode,omitempty"`
}

type ConfigConnectorContextStatus struct {
	addonv1alpha1.CommonStatus `json:",inline"`
}

type ConfigConnectorList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ConfigConnector `json:"items"`
}

type ConfigConnectorSpec struct {
	addonv1alpha1.CommonSpec `json:"-"`
	// The Google Service Account to be used by Config Connector to authenticate with Google Cloud APIs. This field is used only when running in cluster mode with Workload Identity enabled.
	// See Google Kubernetes Engine (GKE) workload-identity (https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) for details. This field cannot be specified together with `credentialSecretName`.
	// For namespaced mode, use `googleServiceAccount` in ConfigConnectorContext CRD to specify the Google Service Account to be used to authenticate with Google Cloud APIs per namespace.
	GoogleServiceAccount string `json:"googleServiceAccount,omitempty"`

	// The Kubernetes secret that contains the Google Service Account Key's credentials to be used by ConfigConnector to authenticate with Google Cloud APIs. This field is used only when in cluster mode.
	// It's recommended to use `googleServiceAccount` when running ConfigConnector in Google Kubernetes Engine (GKE) clusters with Workload Identity enabled.
	// This field cannot be specified together with `googleServiceAccount`.
	CredentialSecretName string `json:"credentialSecretName,omitempty"`

	// The mode that Config Connector will run in. This can be either 'cluster' or 'namespaced'. The default is 'namespaced'.
	// Cluster mode uses a single Google Service Account to create and manage resources, even if you are using Config Connector to manage multiple Projects.
	// You must specify either `credentialSecretName` or `googleServiceAccount` when in cluster mode, but not both.
	// Namespaced mode allows you to use different Google service accounts for different Projects.
	// When in namespaced mode, you must create a ConfigConnectorContext object per namespace that you want to enable Config Connector in, and each must set `googleServiceAccount` to specify the Google Service Account to be used to authenticate with Google Cloud APIs for the namespace.
	//+kubebuilder:validation:Enum=cluster;namespaced
	Mode string `json:"mode,omitempty"`

	// The actuation mode of Config Connector controls how resources are actuated onto the cloud provider.
	// This can be either 'Reconciling' or 'Paused'.
	// In 'Paused', k8s resources are still reconciled with the api server but not actuated onto the cloud provider.
	// If Config Connector is running in 'namespaced' mode, then the value in ConfigConnectorContext (CCC) takes precedence.
	// If CCC doesn't define a value but ConfigConnecor (CC) does, we defer to that value. Otherwise,
	// the default is 'Reconciling' where resources get actuated.
	//+kubebuilder:validation:Enum=Reconciling;Paused
	//+kubebuilder:validation:Optional
	Actuation ActuationMode `json:"actuationMode,omitempty"`
}

type ConfigConnectorStatus struct {
	addonv1alpha1.CommonStatus `json:",inline"`
}

type StateIntoSpecValue string