v1alpha1

type AWSCredentials struct {
	// AWS Access key ID
	AccessKeyID SecretKeySelector `json:"accessKeyID"`
	// AWS Secret Access Key
	SecretAccessKey SecretKeySelector `json:"secretAccessKey"`
}

type AWSKMS struct {
	// A unique identifier for the customer master key (CMK).
	//
	// To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name,
	// or alias ARN. When using an alias name, prefix it with "alias/". To specify
	// a CMK in a different AWS account, you must use the key ARN or alias ARN.
	//
	// For example:
	//
	//    * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//    * Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
	//
	//    * Alias name: alias/ExampleAlias
	//
	//    * Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias
	//
	// To get the key ID and key ARN for a CMK, use ListKeys or DescribeKey. To
	// get the alias name and alias ARN, use ListAliases.
	//
	// KeyId is a required field
	KeyID string `json:"keyID"`
	// The region to send requests to. This parameter is required and must
	// be configured globally or on a per-client basis unless otherwise
	// noted. A full list of regions is found in the "Regions and Endpoints"
	// document.
	//
	// See http://docs.aws.amazon.com/general/latest/gr/rande.html for AWS
	// Regions and Endpoints.
	Region string `json:"region,omitempty"`
	// List of references to the AWS Access key IDs and Secret Access Keys
	Credentials []AWSCredentials `json:"credentials"`
}

type Curve25519 struct {
	// Reference to a secret containing a key store with Curve25519 key pairs
	KeyStore corev1.LocalObjectReference `json:"keyStore"`
	// Key rotation schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
	RotationSchedule string `json:"rotationSchedule,omitempty"`
}

type EncryptedSecret struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Data contains the secret data. Each key must consist of alphanumeric
	// characters, '-', '_' or '.'. The serialized form of the secret data is a
	// base64 encoded string, representing the arbitrary (possibly non-string)
	// data value here. Described in https://tools.ietf.org/html/rfc4648#section-4
	Data map[string][]byte `json:"data,omitempty"`

	// Used to facilitate programmatic handling of secret data.
	Type corev1.SecretType `json:"type,omitempty"`

	// EncryptionConfigRef holds a reference to the SecretEncryptionConfig
	EncryptionConfigRef EncryptionConfigRef `json:"encryptionConfigRef"`

	Status *EncryptedSecretStatus `json:"status,omitempty"`
}

type EncryptedSecretList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []EncryptedSecret `json:"items"`
}

type EncryptedSecretStatus struct {
	// Decrypted is set to true once the Secret is fully decrypted and created.
	Decrypted bool `json:"decrypted,omitempty"`
	// FailedToDecrypt holds the map of Secret.Data keys which could not be decrypted.
	// Since different keys can be encrypted using different providers,
	// failing to decrypt a single value should not block creating the decrypted
	// Secret resource. Thus every EncryptedSecret is decrypted and created on
	// the best effort basis.
	FailedToDecrypt map[string]string `json:"failedToDecrypt,omitempty"`
}

type EncryptionConfigRef struct {
	// Name is the name of SecretEncryptionConfig being referenced
	Name string `json:"name"`
}

type GCPKMS struct {
	// GCP project ID, see https://cloud.google.com/kms/docs/object-hierarchy#project
	// +kubebuilder:validation:Pattern=^[a-z]([a-z0-9-]+)?[a-z0-9]?$
	ProjectID string `json:"projectID"`
	// KMS location ID, see https://cloud.google.com/kms/docs/object-hierarchy#location
	// +kubebuilder:validation:Pattern=^[\w-]{1,63}$
	LocationID string `json:"locationID"`
	// Key ring resource ID, see https://cloud.google.com/kms/docs/object-hierarchy#key_ring
	// +kubebuilder:validation:Pattern=^[\w-]{1,63}$
	KeyRingID string `json:"keyRingID"`
	// Key resource ID, see https://cloud.google.com/kms/docs/object-hierarchy#key
	// +kubebuilder:validation:Pattern=^[\w-]{1,63}$
	CryptoKeyID string `json:"cryptoKeyID"`
	// Key version resource ID (needed for asymmetric decryption), see https://cloud.google.com/kms/docs/object-hierarchy#key_version
	// +kubebuilder:validation:Minimum=1
	CryptoKeyVersion int `json:"cryptoKeyVersion,omitempty"`
	// List of references to keys of Secrets containing GCP credential files, see https://cloud.google.com/iam/docs/creating-managing-service-account-keys
	Credentials []SecretKeySelector `json:"credentials"`
}

type SecretEncryptionConfig struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Providers is the list of encryption providers to be used.
	// The first one is the primary provider that will be used for encryption.
	// +kubebuilder:validation:Minimum=1
	Providers []SecretEncryptionProvider `json:"providers"`
	// Status contains the information about public keys of the primary encryption
	// provider (if applicable), observed state of the configuration, etc.
	Status SecretEncryptionStatus `json:"status,omitempty"`
}

type SecretEncryptionConfigList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []SecretEncryptionConfig `json:"items"`
}

type SecretEncryptionProvider struct {
	// Name is the name of the provider to be used.
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
	Name string `json:"name"`
	// Curve25519 defines the configuration of the local Curve25519 provider
	Curve25519 *Curve25519 `json:"curve25519,omitempty"`
	// GCPKMS defines the configuration of the GCP KMS provider
	GCPKMS *GCPKMS `json:"gcpkms,omitempty"`
	// AWSKMS defines the configuration of the AWS KMS provider
	AWSKMS *AWSKMS `json:"awskms,omitempty"`
}

type SecretEncryptionStatus struct {
	// PublicKey is the current primary PublicKey used for encryption
	PublicKey string `json:"publicKey,omitempty"`
}

type SecretKeySelector struct {
	// Selects a key of a Secret in the same namespace
	SecretKeyRef *corev1.SecretKeySelector `json:"secretKeyRef"`
}