v1beta1

type AccessboundarypolicyAccessBoundaryRule struct {
	/* The availability condition further constrains the access allowed by the access boundary rule. */
	// +optional
	AvailabilityCondition *AccessboundarypolicyAvailabilityCondition `json:"availabilityCondition,omitempty"`

	/* A list of permissions that may be allowed for use on the specified resource. */
	// +optional
	AvailablePermissions []string `json:"availablePermissions,omitempty"`

	/* The full resource name of a Google Cloud resource entity. */
	// +optional
	AvailableResource *string `json:"availableResource,omitempty"`
}

type AccessboundarypolicyAvailabilityCondition struct {
	/* Description of the expression. This is a longer text which describes the expression,
	e.g. when hovered over it in a UI. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Textual representation of an expression in Common Expression Language syntax. */
	Expression string `json:"expression"`

	/* String indicating the location of the expression for error reporting,
	e.g. a file name and a position in the file. */
	// +optional
	Location *string `json:"location,omitempty"`

	/* Title for the expression, i.e. a short string describing its purpose.
	This can be used e.g. in UIs which allow to enter the expression. */
	// +optional
	Title *string `json:"title,omitempty"`
}

type AccessboundarypolicyRules struct {
	/* An access boundary rule in an IAM policy. */
	// +optional
	AccessBoundaryRule *AccessboundarypolicyAccessBoundaryRule `json:"accessBoundaryRule,omitempty"`

	/* The description of the rule. */
	// +optional
	Description *string `json:"description,omitempty"`
}

type AuditconfigAuditLogConfigs struct {
	/* Identities that do not cause logging for this type of permission. The format is the same as that for 'members' in IAMPolicy/IAMPolicyMember. */
	// +optional
	ExemptedMembers []string `json:"exemptedMembers,omitempty"`

	/* Permission type for which logging is to be configured. Must be one of 'DATA_READ', 'DATA_WRITE', or 'ADMIN_READ'. */
	LogType string `json:"logType"`
}

type IAMAccessBoundaryPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMAccessBoundaryPolicySpec   `json:"spec,omitempty"`
	Status IAMAccessBoundaryPolicyStatus `json:"status,omitempty"`
}

type IAMAccessBoundaryPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMAccessBoundaryPolicy `json:"items"`
}

type IAMAccessBoundaryPolicySpec struct {
	/* The display name of the rule. */
	// +optional
	DisplayName *string `json:"displayName,omitempty"`

	ProjectRef v1alpha1.ResourceRef `json:"projectRef"`

	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`

	/* Rules to be applied. */
	Rules []AccessboundarypolicyRules `json:"rules"`
}

type IAMAccessBoundaryPolicyStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMAccessBoundaryPolicy's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* The hash of the resource. Used internally during updates. */
	// +optional
	Etag *string `json:"etag,omitempty"`

	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`
}

type IAMAuditConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMAuditConfigSpec   `json:"spec,omitempty"`
	Status IAMAuditConfigStatus `json:"status,omitempty"`
}

type IAMAuditConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMAuditConfig `json:"items"`
}

type IAMAuditConfigSpec struct {
	/* Required. The configuration for logging of each type of permission. */
	AuditLogConfigs []AuditconfigAuditLogConfigs `json:"auditLogConfigs"`

	/* Immutable. Required. The GCP resource to set the IAMAuditConfig on (e.g. project). */
	ResourceRef v1alpha1.IAMResourceRef `json:"resourceRef"`

	/* Immutable. Required. The service for which to enable Data Access audit logs. The special value 'allServices' covers all services. Note that if there are audit configs covering both 'allServices' and a specific service, then the union of the two audit configs is used for that service: the 'logTypes' specified in each 'auditLogConfig' are enabled, and the 'exemptedMembers' in each 'auditLogConfg' are exempted. */
	Service string `json:"service"`
}

type IAMAuditConfigStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMAuditConfig's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`
}

type IAMCustomRole struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMCustomRoleSpec   `json:"spec,omitempty"`
	Status IAMCustomRoleStatus `json:"status,omitempty"`
}

type IAMCustomRoleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMCustomRole `json:"items"`
}

type IAMCustomRoleSpec struct {
	/* A human-readable description for the role. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified. */
	Permissions []string `json:"permissions"`

	/* Immutable. Optional. The roleId of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`

	/* The current launch stage of the role. Defaults to GA. */
	// +optional
	Stage *string `json:"stage,omitempty"`

	/* A human-readable title for the role. */
	Title string `json:"title"`
}

type IAMCustomRoleStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMCustomRole's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* The current deleted state of the role. */
	// +optional
	Deleted *bool `json:"deleted,omitempty"`

	/* The full name of the role. */
	// +optional
	Name *string `json:"name,omitempty"`

	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`
}

type IAMPartialPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMPartialPolicySpec   `json:"spec,omitempty"`
	Status IAMPartialPolicyStatus `json:"status,omitempty"`
}

type IAMPartialPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMPartialPolicy `json:"items"`
}

type IAMPartialPolicySpec struct {
	/* Optional. The list of IAM bindings managed by Config Connector. */
	// +optional
	Bindings []PartialpolicyBindings `json:"bindings,omitempty"`

	/* Immutable. Required. The GCP resource to set the IAM policy on. */
	ResourceRef v1alpha1.IAMResourceRef `json:"resourceRef"`
}

type IAMPartialPolicyStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMPartialPolicy's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* AllBindings surfaces all IAM bindings for the referenced resource. */
	// +optional
	AllBindings []PartialpolicyAllBindingsStatus `json:"allBindings,omitempty"`

	/* LastAppliedBindings is the list of IAM bindings that were most recently applied by Config Connector. */
	// +optional
	LastAppliedBindings []PartialpolicyLastAppliedBindingsStatus `json:"lastAppliedBindings,omitempty"`

	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`
}

type IAMPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMPolicySpec   `json:"spec,omitempty"`
	Status IAMPolicyStatus `json:"status,omitempty"`
}

type IAMPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMPolicy `json:"items"`
}

type IAMPolicyMember struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMPolicyMemberSpec   `json:"spec,omitempty"`
	Status IAMPolicyMemberStatus `json:"status,omitempty"`
}

type IAMPolicyMemberList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMPolicyMember `json:"items"`
}

type IAMPolicyMemberSpec struct {
	/* Immutable. Optional. The condition under which the binding applies. */
	// +optional
	Condition *PolicymemberCondition `json:"condition,omitempty"`

	/* Immutable. The IAM identity to be bound to the role. Exactly one of 'member' or 'memberFrom' must be used. */
	// +optional
	Member *string `json:"member,omitempty"`

	/* Immutable. The IAM identity to be bound to the role. Exactly one of 'member' or 'memberFrom' must be used, and only one subfield within 'memberFrom' can be used. */
	// +optional
	MemberFrom *PolicymemberMemberFrom `json:"memberFrom,omitempty"`

	/* Immutable. Required. The GCP resource to set the IAM policy on. */
	ResourceRef v1alpha1.IAMResourceRef `json:"resourceRef"`

	/* Immutable. Required. The role for which the Member will be bound. */
	Role string `json:"role"`
}

type IAMPolicyMemberStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMPolicyMember's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`
}

type IAMPolicySpec struct {
	/* Optional. The list of IAM audit configs. */
	// +optional
	AuditConfigs []PolicyAuditConfigs `json:"auditConfigs,omitempty"`

	/* Optional. The list of IAM bindings. */
	// +optional
	Bindings []PolicyBindings `json:"bindings,omitempty"`

	/* Immutable. Required. The GCP resource to set the IAM policy on. */
	ResourceRef v1alpha1.IAMResourceRef `json:"resourceRef"`
}

type IAMPolicyStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMPolicy's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`
}

type IAMServiceAccount struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMServiceAccountSpec   `json:"spec,omitempty"`
	Status IAMServiceAccountStatus `json:"status,omitempty"`
}

type IAMServiceAccountKey struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMServiceAccountKeySpec   `json:"spec,omitempty"`
	Status IAMServiceAccountKeyStatus `json:"status,omitempty"`
}

type IAMServiceAccountKeyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMServiceAccountKey `json:"items"`
}

type IAMServiceAccountKeySpec struct {
	/* Immutable. The algorithm used to generate the key, used only on create. KEY_ALG_RSA_2048 is the default algorithm. Valid values are: "KEY_ALG_RSA_1024", "KEY_ALG_RSA_2048". */
	// +optional
	KeyAlgorithm *string `json:"keyAlgorithm,omitempty"`

	/* Immutable. */
	// +optional
	PrivateKeyType *string `json:"privateKeyType,omitempty"`

	/* Immutable. A field that allows clients to upload their own public key. If set, use this public key data to create a service account key for given service account. Please note, the expected format for this field is a base64 encoded X509_PEM. */
	// +optional
	PublicKeyData *string `json:"publicKeyData,omitempty"`

	/* Immutable. */
	// +optional
	PublicKeyType *string `json:"publicKeyType,omitempty"`

	ServiceAccountRef v1alpha1.ResourceRef `json:"serviceAccountRef"`
}

type IAMServiceAccountKeyStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMServiceAccountKey's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* Immutable. The name used for this key pair. */
	// +optional
	Name *string `json:"name,omitempty"`

	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	/* The private key in JSON format, base64 encoded. This is what you normally get as a file when creating service account keys through the CLI or web console. This is only populated when creating a new key. */
	// +optional
	PrivateKey *string `json:"privateKey,omitempty"`

	/* Immutable. The public key, base64 encoded. */
	// +optional
	PublicKey *string `json:"publicKey,omitempty"`

	/* The key can be used after this timestamp. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". */
	// +optional
	ValidAfter *string `json:"validAfter,omitempty"`

	/* The key can be used before this timestamp. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z". */
	// +optional
	ValidBefore *string `json:"validBefore,omitempty"`
}

type IAMServiceAccountList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMServiceAccount `json:"items"`
}

type IAMServiceAccountSpec struct {
	/* A text description of the service account. Must be less than or equal to 256 UTF-8 bytes. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Whether the service account is disabled. Defaults to false. */
	// +optional
	Disabled *bool `json:"disabled,omitempty"`

	/* The display name for the service account. Can be updated without creating a new resource. */
	// +optional
	DisplayName *string `json:"displayName,omitempty"`

	/* Immutable. Optional. The accountId of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`
}

type IAMServiceAccountStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMServiceAccount's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* The e-mail address of the service account. This value should be referenced from any google_iam_policy data sources that would grant the service account privileges. */
	// +optional
	Email *string `json:"email,omitempty"`

	/* The Identity of the service account in the form 'serviceAccount:{email}'. This value is often used to refer to the service account in order to grant IAM permissions. */
	// +optional
	Member *string `json:"member,omitempty"`

	/* The fully-qualified name of the service account. */
	// +optional
	Name *string `json:"name,omitempty"`

	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	/* The unique id of the service account. */
	// +optional
	UniqueId *string `json:"uniqueId,omitempty"`
}

type IAMWorkforcePool struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMWorkforcePoolSpec   `json:"spec,omitempty"`
	Status IAMWorkforcePoolStatus `json:"status,omitempty"`
}

type IAMWorkforcePoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMWorkforcePool `json:"items"`
}

type IAMWorkforcePoolProvider struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMWorkforcePoolProviderSpec   `json:"spec,omitempty"`
	Status IAMWorkforcePoolProviderStatus `json:"status,omitempty"`
}

type IAMWorkforcePoolProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMWorkforcePoolProvider `json:"items"`
}

type IAMWorkforcePoolProviderSpec struct {
	/* A [Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the assertion in the `attribute_mappings`. `google.profile_photo` and `google.display_name` are not supported. * `attribute`: The custom attributes mapped from the assertion in the `attribute_mappings`. The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credentials will be accepted. The following example shows how to only allow credentials with a mapped `google.groups` value of `admins`: “` "'admins' in google.groups" “` */
	// +optional
	AttributeCondition *string `json:"attributeCondition,omitempty"`

	/* Required. Maps attributes from the authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. This is a required field and the mapped subject cannot exceed 127 bytes. * `google.groups`: Groups the authenticating user belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. * `google.display_name`: The name of the authenticated user. This is an optional field and the mapped display name cannot exceed 100 bytes. If not set, `google.subject` will be displayed instead. This attribute cannot be referenced in IAM bindings. * `google.profile_photo`: The URL that specifies the authenticated user's thumbnail photo. This is an optional field. When set, the image will be visible as the user's profile picture. If not set, a generic user icon will be displayed instead. This attribute cannot be referenced in IAM bindings. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where {custom_attribute} is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workforce pool to Google Cloud resources. For example: */
	AttributeMapping map[string]string `json:"attributeMapping"`

	/* A user-specified description of the provider. Cannot exceed 256 characters. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access. */
	// +optional
	Disabled *bool `json:"disabled,omitempty"`

	/* A user-specified display name for the provider. Cannot exceed 32 characters. */
	// +optional
	DisplayName *string `json:"displayName,omitempty"`

	/* Immutable. The location for the resource */
	Location string `json:"location"`

	/* An OpenId Connect 1.0 identity provider configuration. */
	// +optional
	Oidc *WorkforcepoolproviderOidc `json:"oidc,omitempty"`

	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`

	/* A SAML identity provider configuration. */
	// +optional
	Saml *WorkforcepoolproviderSaml `json:"saml,omitempty"`

	/* Immutable. */
	WorkforcePoolRef v1alpha1.ResourceRef `json:"workforcePoolRef"`
}

type IAMWorkforcePoolProviderStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMWorkforcePoolProvider's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	// +optional
	Oidc *WorkforcepoolproviderOidcStatus `json:"oidc,omitempty"`

	/* Output only. The state of the provider. Possible values: STATE_UNSPECIFIED, ACTIVE, DELETED */
	// +optional
	State *string `json:"state,omitempty"`
}

type IAMWorkforcePoolSpec struct {
	/* A user-specified description of the pool. Cannot exceed 256 characters. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. */
	// +optional
	Disabled *bool `json:"disabled,omitempty"`

	/* A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters. */
	// +optional
	DisplayName *string `json:"displayName,omitempty"`

	/* Immutable. The location for the resource */
	Location string `json:"location"`

	/* Immutable. The Organization that this resource belongs to. Only one of [organizationRef] may be specified. */
	OrganizationRef v1alpha1.ResourceRef `json:"organizationRef"`

	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`

	/* How long the Google Cloud access tokens, console sign-in sessions, and gcloud sign-in sessions from this pool are valid. Must be greater than 15 minutes (900s) and less than 12 hours (43200s). If `session_duration` is not configured, minted credentials will have a default duration of one hour (3600s). */
	// +optional
	SessionDuration *string `json:"sessionDuration,omitempty"`
}

type IAMWorkforcePoolStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMWorkforcePool's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	/* Output only. The resource name of the pool. Format: `locations/{location}/workforcePools/{workforce_pool_id}` */
	// +optional
	SelfLink *string `json:"selfLink,omitempty"`

	/* Output only. The state of the pool. Possible values: STATE_UNSPECIFIED, ACTIVE, DELETED */
	// +optional
	State *string `json:"state,omitempty"`
}

type IAMWorkloadIdentityPool struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMWorkloadIdentityPoolSpec   `json:"spec,omitempty"`
	Status IAMWorkloadIdentityPoolStatus `json:"status,omitempty"`
}

type IAMWorkloadIdentityPoolList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMWorkloadIdentityPool `json:"items"`
}

type IAMWorkloadIdentityPoolProvider struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IAMWorkloadIdentityPoolProviderSpec   `json:"spec,omitempty"`
	Status IAMWorkloadIdentityPoolProviderStatus `json:"status,omitempty"`
}

type IAMWorkloadIdentityPoolProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IAMWorkloadIdentityPoolProvider `json:"items"`
}

type IAMWorkloadIdentityPoolProviderSpec struct {
	/* [A Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the assertion in the `attribute_mappings`. * `attribute`: The custom attributes mapped from the assertion in the `attribute_mappings`. The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credential are accepted. The following example shows how to only allow credentials with a mapped `google.groups` value of `admins`: “` "'admins' in google.groups" “` */
	// +optional
	AttributeCondition *string `json:"attributeCondition,omitempty"`

	/* Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. Cannot exceed 127 characters. * `google.groups`: Groups the external identity belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where `{custom_attribute}` is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workload to Google Cloud resources. For example: * `google.subject`: `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}` * `google.groups`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}` * `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language] (https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 8KB. For AWS providers, if no attribute mapping is defined, the following default mapping applies: “` { "google.subject":"assertion.arn", "attribute.aws_role": "assertion.arn.contains('assumed-role')" " ? assertion.arn.extract('{account_arn}assumed-role/')" " + 'assumed-role/'" " + assertion.arn.extract('assumed-role/{role_name}/')" " : assertion.arn", } “` If any custom attribute mappings are defined, they must include a mapping to the `google.subject` attribute. For OIDC providers, you must supply a custom mapping, which must include the `google.subject` attribute. For example, the following maps the `sub` claim of the incoming credential to the `subject` attribute on a Google token: “` {"google.subject": "assertion.sub"} “` */
	// +optional
	AttributeMapping map[string]string `json:"attributeMapping,omitempty"`

	/* An Amazon Web Services identity provider. */
	// +optional
	Aws *WorkloadidentitypoolproviderAws `json:"aws,omitempty"`

	/* A description for the provider. Cannot exceed 256 characters. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access. */
	// +optional
	Disabled *bool `json:"disabled,omitempty"`

	/* A display name for the provider. Cannot exceed 32 characters. */
	// +optional
	DisplayName *string `json:"displayName,omitempty"`

	/* Immutable. The location for the resource */
	Location string `json:"location"`

	/* An OpenId Connect 1.0 identity provider. */
	// +optional
	Oidc *WorkloadidentitypoolproviderOidc `json:"oidc,omitempty"`

	/* Immutable. The Project that this resource belongs to. */
	ProjectRef v1alpha1.ResourceRef `json:"projectRef"`

	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`

	/* Immutable. */
	WorkloadIdentityPoolRef v1alpha1.ResourceRef `json:"workloadIdentityPoolRef"`
}

type IAMWorkloadIdentityPoolProviderStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMWorkloadIdentityPoolProvider's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	/* Output only. The state of the provider. Possible values: STATE_UNSPECIFIED, ACTIVE, DELETED */
	// +optional
	State *string `json:"state,omitempty"`
}

type IAMWorkloadIdentityPoolSpec struct {
	/* A description of the pool. Cannot exceed 256 characters. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again. */
	// +optional
	Disabled *bool `json:"disabled,omitempty"`

	/* A display name for the pool. Cannot exceed 32 characters. */
	// +optional
	DisplayName *string `json:"displayName,omitempty"`

	/* Immutable. The location for the resource */
	Location string `json:"location"`

	/* Immutable. The Project that this resource belongs to. */
	ProjectRef v1alpha1.ResourceRef `json:"projectRef"`

	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`
}

type IAMWorkloadIdentityPoolStatus struct {
	/* Conditions represent the latest available observations of the
	   IAMWorkloadIdentityPool's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	/* Output only. The state of the pool. Possible values: STATE_UNSPECIFIED, ACTIVE, DELETED */
	// +optional
	State *string `json:"state,omitempty"`
}

type PartialpolicyAllBindingsStatus struct {
	/* Optional. The condition under which the binding applies. */
	// +optional
	Condition *PartialpolicyConditionStatus `json:"condition,omitempty"`

	/* Optional. The list of IAM users to be bound to the role. */
	// +optional
	Members []string `json:"members,omitempty"`

	/* Required. The role to bind the users to. */
	Role string `json:"role"`
}

type PartialpolicyBindings struct {
	/* Optional. The condition under which the binding applies. */
	// +optional
	Condition *PartialpolicyCondition `json:"condition,omitempty"`

	/* Optional. The list of IAM users to be bound to the role. */
	// +optional
	Members []PartialpolicyMembers `json:"members,omitempty"`

	/* Required. The role to bind the users to. */
	Role string `json:"role"`
}

type PartialpolicyCondition struct {
	// +optional
	Description *string `json:"description,omitempty"`

	Expression string `json:"expression"`

	Title string `json:"title"`
}

type PartialpolicyConditionStatus struct {
	// +optional
	Description *string `json:"description,omitempty"`

	Expression string `json:"expression"`

	Title string `json:"title"`
}

type PartialpolicyLastAppliedBindingsStatus struct {
	/* Optional. The condition under which the binding applies. */
	// +optional
	Condition *PartialpolicyConditionStatus `json:"condition,omitempty"`

	/* Optional. The list of IAM users to be bound to the role. */
	// +optional
	Members []string `json:"members,omitempty"`

	/* Required. The role to bind the users to. */
	Role string `json:"role"`
}

type PartialpolicyMemberFrom struct {
	/* The LoggingLogSink whose writer identity (i.e. its 'status.writerIdentity') is to be bound to the role. */
	// +optional
	LogSinkRef *v1alpha1.IAMResourceRef `json:"logSinkRef,omitempty"`

	/* The IAMServiceAccount to be bound to the role. */
	// +optional
	ServiceAccountRef *v1alpha1.IAMResourceRef `json:"serviceAccountRef,omitempty"`

	/* The ServiceIdentity whose service account (i.e., its 'status.email') is to be bound to the role. */
	// +optional
	ServiceIdentityRef *v1alpha1.IAMResourceRef `json:"serviceIdentityRef,omitempty"`

	/* The SQLInstance whose service account (i.e. its 'status.serviceAccountEmailAddress') is to be bound to the role. */
	// +optional
	SqlInstanceRef *v1alpha1.IAMResourceRef `json:"sqlInstanceRef,omitempty"`
}

type PartialpolicyMembers struct {
	/* The IAM identity to be bound to the role. Exactly one of 'member' or 'memberFrom' must be used. */
	// +optional
	Member *string `json:"member,omitempty"`

	/* The IAM identity to be bound to the role. Exactly one of 'member' or 'memberFrom' must be used, and only one subfield within 'memberFrom' can be used. */
	// +optional
	MemberFrom *PartialpolicyMemberFrom `json:"memberFrom,omitempty"`
}

type PolicyAuditConfigs struct {
	/* Required. The configuration for logging of each type of permission. */
	AuditLogConfigs []PolicyAuditLogConfigs `json:"auditLogConfigs"`

	/* Required. The service for which to enable Data Access audit logs. The special value 'allServices' covers all services. Note that if there are audit configs covering both 'allServices' and a specific service, then the union of the two audit configs is used for that service: the 'logTypes' specified in each 'auditLogConfig' are enabled, and the 'exemptedMembers' in each 'auditLogConfg' are exempted. */
	Service string `json:"service"`
}

type PolicyAuditLogConfigs struct {
	/* Identities that do not cause logging for this type of permission. The format is the same as that for 'members' in IAMPolicy/IAMPolicyMember. */
	// +optional
	ExemptedMembers []string `json:"exemptedMembers,omitempty"`

	/* Permission type for which logging is to be configured. Must be one of 'DATA_READ', 'DATA_WRITE', or 'ADMIN_READ'. */
	LogType string `json:"logType"`
}

type PolicyBindings struct {
	/* Optional. The condition under which the binding applies. */
	// +optional
	Condition *PolicyCondition `json:"condition,omitempty"`

	/* Optional. The list of IAM users to be bound to the role. */
	// +optional
	Members []string `json:"members,omitempty"`

	/* Required. The role to bind the users to. */
	Role string `json:"role"`
}

type PolicyCondition struct {
	// +optional
	Description *string `json:"description,omitempty"`

	Expression string `json:"expression"`

	Title string `json:"title"`
}

type PolicymemberCondition struct {
	// +optional
	Description *string `json:"description,omitempty"`

	Expression string `json:"expression"`

	Title string `json:"title"`
}

type PolicymemberMemberFrom struct {
	/* The LoggingLogSink whose writer identity (i.e. its 'status.writerIdentity') is to be bound to the role. */
	// +optional
	LogSinkRef *v1alpha1.IAMResourceRef `json:"logSinkRef,omitempty"`

	/* The IAMServiceAccount to be bound to the role. */
	// +optional
	ServiceAccountRef *v1alpha1.IAMResourceRef `json:"serviceAccountRef,omitempty"`

	/* The ServiceIdentity whose service account (i.e., its 'status.email') is to be bound to the role. */
	// +optional
	ServiceIdentityRef *v1alpha1.IAMResourceRef `json:"serviceIdentityRef,omitempty"`

	/* The SQLInstance whose service account (i.e. its 'status.serviceAccountEmailAddress') is to be bound to the role. */
	// +optional
	SqlInstanceRef *v1alpha1.IAMResourceRef `json:"sqlInstanceRef,omitempty"`
}

type WorkforcepoolproviderClientSecret struct {
	/* The value of the client secret. */
	// +optional
	Value *WorkforcepoolproviderValue `json:"value,omitempty"`
}

type WorkforcepoolproviderClientSecretStatus struct {
	// +optional
	Value *WorkforcepoolproviderValueStatus `json:"value,omitempty"`
}

type WorkforcepoolproviderOidc struct {
	/* Required. The client ID. Must match the audience claim of the JWT issued by the identity provider. */
	ClientId string `json:"clientId"`

	/* The optional client secret. Required to enable Authorization Code flow for web sign-in. */
	// +optional
	ClientSecret *WorkforcepoolproviderClientSecret `json:"clientSecret,omitempty"`

	/* Required. The OIDC issuer URI. Must be a valid URI using the 'https' scheme. */
	IssuerUri string `json:"issuerUri"`

	/* OIDC JWKs in JSON String format. For details on definition of a JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we use the `jwks_uri` from the discovery document fetched from the .well-known path for the `issuer_uri`. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: “`{"keys": [{"kty": "RSA/EC", "alg": "<algorithm>", "use": "sig", "kid": "<key-id>", "n": "", "e": "", "x": "", "y": "", "crv": ""}]}“` */
	// +optional
	JwksJson *string `json:"jwksJson,omitempty"`

	/* Required. Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser. */
	WebSsoConfig WorkforcepoolproviderWebSsoConfig `json:"webSsoConfig"`
}

type WorkforcepoolproviderOidcStatus struct {
	// +optional
	ClientSecret *WorkforcepoolproviderClientSecretStatus `json:"clientSecret,omitempty"`
}

type WorkforcepoolproviderPlainText struct {
	/* Value of the field. Cannot be used if 'valueFrom' is specified. */
	// +optional
	Value *string `json:"value,omitempty"`

	/* Source for the field's value. Cannot be used if 'value' is specified. */
	// +optional
	ValueFrom *WorkforcepoolproviderValueFrom `json:"valueFrom,omitempty"`
}

type WorkforcepoolproviderSaml struct {
	/* Required. SAML Identity provider configuration metadata xml doc. The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf). The max size of the acceptable xml document will be bounded to 128k characters. The metadata xml document should satisfy the following constraints: 1) Must contain an Identity Provider Entity ID. 2) Must contain at least one non-expired signing key certificate. 3) For each signing key: a) Valid from should be no more than 7 days from now. b) Valid to should be no more than 10 years in the future. 4) Up to 3 IdP signing keys are allowed in the metadata xml. When updating the provider's metadata xml, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata. */
	IdpMetadataXml string `json:"idpMetadataXml"`
}

type WorkforcepoolproviderValue struct {
	/* Input only. The plain text of the client secret value. */
	// +optional
	PlainText *WorkforcepoolproviderPlainText `json:"plainText,omitempty"`
}

type WorkforcepoolproviderValueFrom struct {
	/* Reference to a value with the given key in the given Secret in the resource's namespace. */
	// +optional
	SecretKeyRef *v1alpha1.SecretKeyRef `json:"secretKeyRef,omitempty"`
}

type WorkforcepoolproviderValueStatus struct {
	/* Output only. A thumbprint to represent the current client secret value. */
	// +optional
	Thumbprint *string `json:"thumbprint,omitempty"`
}

type WorkforcepoolproviderWebSsoConfig struct {
	/* Additional scopes to request for in the OIDC authentication request on top of scopes requested by default. By default, the `openid`, `profile` and `email` scopes that are supported by the identity provider are requested. Each additional scope may be at most 256 characters. A maximum of 10 additional scopes may be configured. */
	// +optional
	AdditionalScopes []string `json:"additionalScopes,omitempty"`

	/* Required. The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition. Possible values: ASSERTION_CLAIMS_BEHAVIOR_UNSPECIFIED, MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS, ONLY_ID_TOKEN_CLAIMS */
	AssertionClaimsBehavior string `json:"assertionClaimsBehavior"`

	/* Required. The Response Type to request for in the OIDC Authorization Request for web sign-in. The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons. Possible values: RESPONSE_TYPE_UNSPECIFIED, CODE, ID_TOKEN */
	ResponseType string `json:"responseType"`
}

type WorkloadidentitypoolproviderAws struct {
	/* Required. The AWS account ID. */
	AccountId string `json:"accountId"`

	/* A list of AWS STS URIs that can be used when exchanging credentials. If not provided, any valid AWS STS URI is allowed. URIs must use the form `https://sts.amazonaws.com` or `https://sts.{region}.amazonaws.com`, where {region} is a valid AWS region. You can specify a maximum of 25 URIs. */
	// +optional
	StsUri []string `json:"stsUri,omitempty"`
}

type WorkloadidentitypoolproviderOidc struct {
	/* Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: “` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ “` */
	// +optional
	AllowedAudiences []string `json:"allowedAudiences,omitempty"`

	/* Required. The OIDC issuer URL. Must be an HTTPS endpoint. */
	IssuerUri string `json:"issuerUri"`
}