v1beta1

type AuthorizationpolicyDestinations struct {
	/* Required. List of host names to match. Matched against HOST header in http requests. Each host can be an exact match, or a prefix match (example, “mydomain.*”) or a suffix match (example, *.myorg.com”) or a presence(any) match “*”. */
	Hosts []string `json:"hosts"`

	/* Optional. Match against key:value pair in http header. Provides a flexible match based on HTTP headers, for potentially advanced use cases. */
	// +optional
	HttpHeaderMatch *AuthorizationpolicyHttpHeaderMatch `json:"httpHeaderMatch,omitempty"`

	/* Optional. A list of HTTP methods to match. Should not be set for gRPC services. */
	// +optional
	Methods []string `json:"methods,omitempty"`

	/* Required. List of destination ports to match. */
	Ports []int `json:"ports"`
}

type AuthorizationpolicyHttpHeaderMatch struct {
	/* Required. The name of the HTTP header to match. For matching against the HTTP request's authority, use a headerMatch with the header name ":authority". For matching a request's method, use the headerName ":method". */
	HeaderName string `json:"headerName"`

	/* Required. The value of the header must match the regular expression specified in regexMatch. For regular expression grammar, please see: en.cppreference.com/w/cpp/regex/ecmascript For matching against a port specified in the HTTP request, use a headerMatch with headerName set to Host and a regular expression that satisfies the RFC2616 Host header's port specifier. */
	RegexMatch string `json:"regexMatch"`
}

type AuthorizationpolicyRules struct {
	/* Optional. List of attributes for the traffic destination. If not set, the action specified in the ‘action’ field will be applied without any rule checks for the destination. */
	// +optional
	Destinations []AuthorizationpolicyDestinations `json:"destinations,omitempty"`

	/* Optional. List of attributes for the traffic source. If not set, the action specified in the ‘action’ field will be applied without any rule checks for the source. */
	// +optional
	Sources []AuthorizationpolicySources `json:"sources,omitempty"`
}

type AuthorizationpolicySources struct {
	/* Optional. List of CIDR ranges to match based on source IP address. Single IP (e.g., "1.2.3.4") and CIDR (e.g., "1.2.3.0/24") are supported. */
	// +optional
	IpBlocks []string `json:"ipBlocks,omitempty"`

	/* Optional. List of peer identities to match for authorization. Each peer can be an exact match, or a prefix match (example, “namespace/*”) or a suffix match (example, * /service-account”) or a presence match “*”. */
	// +optional
	Principals []string `json:"principals,omitempty"`
}

type ClienttlspolicyCertificateProviderInstance struct {
	/* Required. Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance. */
	PluginInstance string `json:"pluginInstance"`
}

type ClienttlspolicyClientCertificate struct {
	/* The certificate provider instance specification that will be passed to the data plane, which will be used to load necessary credential information. */
	// +optional
	CertificateProviderInstance *ClienttlspolicyCertificateProviderInstance `json:"certificateProviderInstance,omitempty"`

	/* gRPC specific configuration to access the gRPC server to obtain the cert and private key. */
	// +optional
	GrpcEndpoint *ClienttlspolicyGrpcEndpoint `json:"grpcEndpoint,omitempty"`
}

type ClienttlspolicyGrpcEndpoint struct {
	/* Required. The target URI of the gRPC endpoint. Only UDS path is supported, and should start with “unix:”. */
	TargetUri string `json:"targetUri"`
}

type ClienttlspolicyServerValidationCa struct {
	/* The certificate provider instance specification that will be passed to the data plane, which will be used to load necessary credential information. */
	// +optional
	CertificateProviderInstance *ClienttlspolicyCertificateProviderInstance `json:"certificateProviderInstance,omitempty"`

	/* gRPC specific configuration to access the gRPC server to obtain the CA certificate. */
	// +optional
	GrpcEndpoint *ClienttlspolicyGrpcEndpoint `json:"grpcEndpoint,omitempty"`
}

type NetworkSecurityAuthorizationPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NetworkSecurityAuthorizationPolicySpec   `json:"spec,omitempty"`
	Status NetworkSecurityAuthorizationPolicyStatus `json:"status,omitempty"`
}

type NetworkSecurityAuthorizationPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NetworkSecurityAuthorizationPolicy `json:"items"`
}

type NetworkSecurityAuthorizationPolicySpec struct {
	/* Required. The action to take when a rule match is found. Possible values are "ALLOW" or "DENY". Possible values: ACTION_UNSPECIFIED, ALLOW, DENY */
	Action string `json:"action"`

	/* Optional. Free-text description of the resource. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Immutable. The location for the resource */
	Location string `json:"location"`

	/* Immutable. The Project that this resource belongs to. */
	ProjectRef v1alpha1.ResourceRef `json:"projectRef"`

	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`

	/* Optional. List of rules to match. If not set, the action specified in the ‘action’ field will be applied without any additional rule checks. */
	// +optional
	Rules []AuthorizationpolicyRules `json:"rules,omitempty"`
}

type NetworkSecurityAuthorizationPolicyStatus struct {
	/* Conditions represent the latest available observations of the
	   NetworkSecurityAuthorizationPolicy's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* Output only. The timestamp when the resource was created. */
	// +optional
	CreateTime *string `json:"createTime,omitempty"`

	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	/* Output only. The timestamp when the resource was updated. */
	// +optional
	UpdateTime *string `json:"updateTime,omitempty"`
}

type NetworkSecurityClientTLSPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NetworkSecurityClientTLSPolicySpec   `json:"spec,omitempty"`
	Status NetworkSecurityClientTLSPolicyStatus `json:"status,omitempty"`
}

type NetworkSecurityClientTLSPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NetworkSecurityClientTLSPolicy `json:"items"`
}

type NetworkSecurityClientTLSPolicySpec struct {
	/* Optional. Defines a mechanism to provision client identity (public and private keys) for peer to peer authentication. The presence of this dictates mTLS. */
	// +optional
	ClientCertificate *ClienttlspolicyClientCertificate `json:"clientCertificate,omitempty"`

	/* Optional. Free-text description of the resource. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Immutable. The location for the resource */
	Location string `json:"location"`

	/* Immutable. The Project that this resource belongs to. */
	// +optional
	ProjectRef *v1alpha1.ResourceRef `json:"projectRef,omitempty"`

	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`

	/* Required. Defines the mechanism to obtain the Certificate Authority certificate to validate the server certificate. */
	// +optional
	ServerValidationCa []ClienttlspolicyServerValidationCa `json:"serverValidationCa,omitempty"`

	/* Optional. Server Name Indication string to present to the server during TLS handshake. E.g: "secure.example.com". */
	// +optional
	Sni *string `json:"sni,omitempty"`
}

type NetworkSecurityClientTLSPolicyStatus struct {
	/* Conditions represent the latest available observations of the
	   NetworkSecurityClientTLSPolicy's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* Output only. The timestamp when the resource was created. */
	// +optional
	CreateTime *string `json:"createTime,omitempty"`

	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	/* Output only. The timestamp when the resource was updated. */
	// +optional
	UpdateTime *string `json:"updateTime,omitempty"`
}

type NetworkSecurityServerTLSPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NetworkSecurityServerTLSPolicySpec   `json:"spec,omitempty"`
	Status NetworkSecurityServerTLSPolicyStatus `json:"status,omitempty"`
}

type NetworkSecurityServerTLSPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NetworkSecurityServerTLSPolicy `json:"items"`
}

type NetworkSecurityServerTLSPolicySpec struct {
	/* Optional. Determines if server allows plaintext connections. If set to true, server allows plain text connections. By default, it is set to false. This setting is not exclusive of other encryption modes. For example, if allow_open and mtls_policy are set, server allows both plain text and mTLS connections. See documentation of other encryption modes to confirm compatibility. */
	// +optional
	AllowOpen *bool `json:"allowOpen,omitempty"`

	/* Optional. Free-text description of the resource. */
	// +optional
	Description *string `json:"description,omitempty"`

	/* Immutable. The location for the resource */
	Location string `json:"location"`

	/* Optional. Defines a mechanism to provision peer validation certificates for peer to peer authentication (Mutual TLS - mTLS). If not specified, client certificate will not be requested. The connection is treated as TLS and not mTLS. If allow_open and mtls_policy are set, server allows both plain text and mTLS connections. */
	// +optional
	MtlsPolicy *ServertlspolicyMtlsPolicy `json:"mtlsPolicy,omitempty"`

	/* Immutable. The Project that this resource belongs to. */
	// +optional
	ProjectRef *v1alpha1.ResourceRef `json:"projectRef,omitempty"`

	/* Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default. */
	// +optional
	ResourceID *string `json:"resourceID,omitempty"`

	/* Optional. Defines a mechanism to provision server identity (public and private keys). Cannot be combined with allow_open as a permissive mode that allows both plain text and TLS is not supported. */
	// +optional
	ServerCertificate *ServertlspolicyServerCertificate `json:"serverCertificate,omitempty"`
}

type NetworkSecurityServerTLSPolicyStatus struct {
	/* Conditions represent the latest available observations of the
	   NetworkSecurityServerTLSPolicy's current state. */
	Conditions []v1alpha1.Condition `json:"conditions,omitempty"`
	/* Output only. The timestamp when the resource was created. */
	// +optional
	CreateTime *string `json:"createTime,omitempty"`

	/* ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. */
	// +optional
	ObservedGeneration *int `json:"observedGeneration,omitempty"`

	/* Output only. The timestamp when the resource was updated. */
	// +optional
	UpdateTime *string `json:"updateTime,omitempty"`
}

type ServertlspolicyCertificateProviderInstance struct {
	/* Required. Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance. */
	PluginInstance string `json:"pluginInstance"`
}

type ServertlspolicyClientValidationCa struct {
	/* The certificate provider instance specification that will be passed to the data plane, which will be used to load necessary credential information. */
	// +optional
	CertificateProviderInstance *ServertlspolicyCertificateProviderInstance `json:"certificateProviderInstance,omitempty"`

	/* gRPC specific configuration to access the gRPC server to obtain the CA certificate. */
	// +optional
	GrpcEndpoint *ServertlspolicyGrpcEndpoint `json:"grpcEndpoint,omitempty"`
}

type ServertlspolicyGrpcEndpoint struct {
	/* Required. The target URI of the gRPC endpoint. Only UDS path is supported, and should start with “unix:”. */
	TargetUri string `json:"targetUri"`
}

type ServertlspolicyMtlsPolicy struct {
	/* Required. Defines the mechanism to obtain the Certificate Authority certificate to validate the client certificate. */
	ClientValidationCa []ServertlspolicyClientValidationCa `json:"clientValidationCa"`
}

type ServertlspolicyServerCertificate struct {
	/* The certificate provider instance specification that will be passed to the data plane, which will be used to load necessary credential information. */
	// +optional
	CertificateProviderInstance *ServertlspolicyCertificateProviderInstance `json:"certificateProviderInstance,omitempty"`

	/* gRPC specific configuration to access the gRPC server to obtain the cert and private key. */
	// +optional
	GrpcEndpoint *ServertlspolicyGrpcEndpoint `json:"grpcEndpoint,omitempty"`
}