v3

type AWSSrcDstCheckOption string

type Action string

type AlertException struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AlertExceptionSpec   `json:"spec,omitempty"`
	Status AlertExceptionStatus `json:"status,omitempty"`
}

type AlertExceptionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []AlertException `json:"items"`
}

type AlertExceptionSpec struct {
	// The description is displayed by the UI.
	Description string `json:"description" validate:"required"`

	// Selector defines a query string for alert events to be excluded from UI search results.
	Selector string `json:"selector" validate:"required"`

	// Period controls how long an alert exception will be active. It is optional and
	// omitting Peroid will make the alert exception active forever.
	Period *metav1.Duration `json:"period,omitempty" validate:"omitempty"`
}

type AlertExceptionStatus struct {
	LastExecuted *metav1.Time `json:"lastExecuted,omitempty"`
}

type AuditEventsSelection struct {
	// Resources lists the resources that will be included in the audit logs in the ReportData.  Blank fields in the
	// listed ResourceID structs are treated as wildcards.
	Resources []AuditResource `json:"resources,omitempty" validate:"omitempty"`
}

type AuditResource struct {
	// The resource type. The format is the lowercase plural as used in audit event selection and RBAC configuration.
	Resource string `json:"resource,omitempty" validate:"omitempty"`

	// APIGroup is the name of the API group that contains the referred object (e.g. projectcalico.org).
	APIGroup string `json:"apiGroup,omitempty" validate:"omitempty"`

	// APIVersion is the version of the API group that contains the referred object (e.g. v3).
	APIVersion string `json:"apiVersion,omitempty" validate:"omitempty"`

	// The resource name.
	Name string `json:"name,omitempty" validate:"omitempty"`

	// The resource namespace.
	Namespace string `json:"namespace,omitempty" validate:"omitempty"`
}

type AuditSummary struct {
	// The total number of in-scope audit logs.
	NumTotal int `json:"numTotal,omitempty"`

	// The number of in-scope audit log create events.
	NumCreate int `json:"numCreate,omitempty"`

	// The number of in-scope audit log patch or replace events.
	NumModify int `json:"numModify,omitempty"`

	// The number of in-scope audit log delete events.
	NumDelete int `json:"numDelete,omitempty"`
}

type AuthenticationReview struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Status AuthenticationReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
}

type AuthenticationReviewList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Items []AuthenticationReview `json:"items" protobuf:"bytes,2,rep,name=items"`
}

type AuthenticationReviewStatus struct {
	Name   string              `json:"name,omitempty" validate:"omitempty"`
	UID    string              `json:"uid,omitempty" validate:"omitempty"`
	Groups []string            `json:"groups,omitempty" validate:"omitempty"`
	Extra  map[string][]string `json:"extra,omitempty" validate:"omitempty"`
}

type AuthorizationReview struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AuthorizationReviewSpec   `json:"spec,omitempty"`
	Status AuthorizationReviewStatus `json:"status,omitempty"`
}

type AuthorizationReviewList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []AuthorizationReview `json:"items"`
}

type AuthorizationReviewResourceAttributes struct {
	// The API Group to check.
	APIGroup string `json:"apiGroup,omitempty" validate:"omitempty"`
	// The set of resources to check within the same API Group.
	Resources []string `json:"resources,omitempty" validate:"omitempty"`
	// The set of verbs to check. This is expanded for each resource and within the same API Group.
	Verbs []string `json:"verbs,omitempty" validate:"omitempty"`
}

type AuthorizationReviewSpec struct {
	// The set of resource attributes that are being checked. Each resource attribute is expanded into individual
	// kind/resource and verbs.
	ResourceAttributes []AuthorizationReviewResourceAttributes `json:"resourceAttributes,omitempty" validate:"omitempty"`
}

type AuthorizationReviewStatus struct {
	// The set of authorized resource actions. A given API Group and resource combination will appear at most once in
	// this slice.
	AuthorizedResourceVerbs []AuthorizedResourceVerbs `json:"authorizedResourceVerbs,omitempty" validate:"omitempty"`
}

type AuthorizedResourceGroup struct {
	// The tier.  This is only valid for tiered policies, and tiers.
	Tier string `json:"tier,omitempty" validate:"omitempty"`

	// The namespace. If this is empty then the user is authorized cluster-wide (i.e. across all namespaces). This will
	// always be empty for cluster-scoped resources when the user is authorized.
	Namespace string `json:"namespace" validate:"omitempty"`

	// The UISettingsGroup name. This is only valid for uisettingsgroup/data sub resources.
	UISettingsGroup string `json:"uiSettingsGroup" validate:"omitempty"`
}

type AuthorizedResourceVerb struct {
	// The verb.
	Verb string `json:"verb"`
	// The group of resource instances that are authorized for this verb.
	ResourceGroups []AuthorizedResourceGroup `json:"resourceGroups"`
}

type AuthorizedResourceVerbs struct {
	// The API group.
	APIGroup string `json:"apiGroup,omitempty" validate:"omitempty"`
	// The resource.
	Resource string `json:"resource,omitempty" validate:"omitempty"`
	// The set of authorized actions for this resource. For a specific verb, this contains the set of resources for
	// which the user is authorized to perform that action. This is calculated to avoid duplication such that a single
	// resource instance can only be associated with a single entry in this slice. This allows a consumer of this API
	// to issue a minimal set of queries (e.g. watches) that cover, uniquely, the authorized set of resources.
	Verbs []AuthorizedResourceVerb `json:"verbs,omitempty" validate:"omitempty,dive"`
}

type AutoHostEndpointConfig struct {
	// AutoCreate enables automatic creation of host endpoints for every node. [Default: Disabled]
	AutoCreate string `json:"autoCreate,omitempty" validate:"omitempty,oneof=Enabled Disabled"`
}

type BGPConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Spec BGPConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

type BGPConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Items []BGPConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"`
}

type BGPConfigurationSpec struct {
	// LogSeverityScreen is the log severity above which logs are sent to the stdout. [Default: INFO]
	LogSeverityScreen string `json:"logSeverityScreen,omitempty" validate:"omitempty,logLevel" confignamev1:"loglevel"`

	// NodeToNodeMeshEnabled sets whether full node to node BGP mesh is enabled. [Default: true]
	NodeToNodeMeshEnabled *bool `json:"nodeToNodeMeshEnabled,omitempty" validate:"omitempty" confignamev1:"node_mesh"`

	// ASNumber is the default AS number used by a node. [Default: 64512]
	ASNumber *numorstring.ASNumber `json:"asNumber,omitempty" validate:"omitempty" confignamev1:"as_num"`

	// Extensions is a mapping of keys to values that can be used in custom BGP templates
	Extensions map[string]string `json:"extensions,omitempty" validate:"omitempty" confignamev1:"extensions"`

	// ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes Service LoadBalancer IPs.
	// Kubernetes Service status.LoadBalancer.Ingress IPs will only be advertised if they are within one of these blocks.
	ServiceLoadBalancerIPs []ServiceLoadBalancerIPBlock `json:"serviceLoadBalancerIPs,omitempty" validate:"omitempty,dive" confignamev1:"svc_loadbalancer_ips"`

	// ServiceExternalIPs are the CIDR blocks for Kubernetes Service External IPs.
	// Kubernetes Service ExternalIPs will only be advertised if they are within one of these blocks.
	ServiceExternalIPs []ServiceExternalIPBlock `json:"serviceExternalIPs,omitempty" validate:"omitempty,dive" confignamev1:"svc_external_ips"`

	// ServiceClusterIPs are the CIDR blocks from which service cluster IPs are allocated.
	// If specified, Calico will advertise these blocks, as well as any cluster IPs within them.
	ServiceClusterIPs []ServiceClusterIPBlock `json:"serviceClusterIPs,omitempty" validate:"omitempty,dive" confignamev1:"svc_cluster_ips"`

	// Communities is a list of BGP community values and their arbitrary names for tagging routes.
	Communities []Community `json:"communities,omitempty" validate:"omitempty,dive" confignamev1:"communities"`

	// PrefixAdvertisements contains per-prefix advertisement configuration.
	PrefixAdvertisements []PrefixAdvertisement `json:"prefixAdvertisements,omitempty" validate:"omitempty,dive" confignamev1:"prefix_advertisements"`

	// ListenPort is the port where BGP protocol should listen. Defaults to 179
	// +kubebuilder:validation:Minimum:=1
	// +kubebuilder:validation:Maximum:=65535
	ListenPort uint16 `json:"listenPort,omitempty" validate:"omitempty,gt=0" confignamev1:"listen_port"`

	// Optional BGP password for full node-to-mesh peerings.
	// This field can only be set on the default BGPConfiguration instance and requires that NodeMesh is enabled
	// +optional
	NodeMeshPassword *BGPPassword `json:"nodeMeshPassword,omitempty" validate:"omitempty" confignamev1:"node_mesh_password"`

	// Time to allow for software restart for node-to-mesh peerings.  When specified, this is configured
	// as the graceful restart timeout.  When not specified, the BIRD default of 120s is used.
	// This field can only be set on the default BGPConfiguration instance and requires that NodeMesh is enabled
	// +optional
	NodeMeshMaxRestartTime *metav1.Duration `json:"nodeMeshMaxRestartTime,omitempty" confignamev1:"node_mesh_restart_time"`
}

type BGPDaemonState string

type BGPDaemonStatus struct {
	// The state of the BGP Daemon.
	State BGPDaemonState `json:"state,omitempty"`

	// Version of the BGP daemon
	Version string `json:"version,omitempty"`

	// Router ID used by bird.
	RouterID string `json:"routerID,omitempty"`

	// LastBootTime holds the value of lastBootTime from bird.ctl output.
	LastBootTime string `json:"lastBootTime,omitempty"`

	// LastReconfigurationTime holds the value of lastReconfigTime from bird.ctl output.
	LastReconfigurationTime string `json:"lastReconfigurationTime,omitempty"`
}

type BGPPassword struct {
	// Selects a key of a secret in the node pod's namespace.
	SecretKeyRef *k8sv1.SecretKeySelector `json:"secretKeyRef,omitempty"`
}

type BGPPeer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Spec BGPPeerSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

type BGPPeerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Items []BGPPeer `json:"items" protobuf:"bytes,2,rep,name=items"`
}

type BGPPeerSpec struct {
	// The node name identifying the Calico node instance that is targeted by this peer.
	// If this is not set, and no nodeSelector is specified, then this BGP peer selects all
	// nodes in the cluster.
	// +optional
	Node string `json:"node,omitempty" validate:"omitempty,name"`

	// Selector for the nodes that should have this peering.  When this is set, the Node
	// field must be empty.
	// +optional
	NodeSelector string `json:"nodeSelector,omitempty" validate:"omitempty,selector"`

	// The IP address of the peer followed by an optional port number to peer with.
	// If port number is given, format should be `[<IPv6>]:port` or `<IPv4>:<port>` for IPv4.
	// If optional port number is not set, and this peer IP and ASNumber belongs to a calico/node
	// with ListenPort set in BGPConfiguration, then we use that port to peer.
	// +optional
	PeerIP string `json:"peerIP,omitempty" validate:"omitempty,IP:port"`

	// The AS Number of the peer.
	// +optional
	ASNumber numorstring.ASNumber `json:"asNumber,omitempty"`

	// Extensions is a mapping of keys to values that can be used in custom BGP templates
	// +optional
	Extensions map[string]string `json:"extensions,omitempty" validate:"omitempty"`

	// Selector for the remote nodes to peer with.  When this is set, the PeerIP and
	// ASNumber fields must be empty.  For each peering between the local node and
	// selected remote nodes, we configure an IPv4 peering if both ends have
	// NodeBGPSpec.IPv4Address specified, and an IPv6 peering if both ends have
	// NodeBGPSpec.IPv6Address specified.  The remote AS number comes from the remote
	// node's NodeBGPSpec.ASNumber, or the global default if that is not set.
	// +optional
	PeerSelector string `json:"peerSelector,omitempty" validate:"omitempty,selector"`

	// Option to keep the original nexthop field when routes are sent to a BGP Peer.
	// Setting "true" configures the selected BGP Peers node to use the "next hop keep;"
	// instead of "next hop self;"(default) in the specific branch of the Node on "bird.cfg".
	KeepOriginalNextHop bool `json:"keepOriginalNextHop,omitempty"`

	// Optional BGP password for the peerings generated by this BGPPeer resource.
	Password *BGPPassword `json:"password,omitempty" validate:"omitempty"`

	// Specifies whether and how to configure a source address for the peerings generated by
	// this BGPPeer resource.  Default value "UseNodeIP" means to configure the node IP as the
	// source address.  "None" means not to configure a source address.
	SourceAddress SourceAddress `json:"sourceAddress,omitempty" validate:"omitempty,sourceAddress"`

	// Specifies whether and how to detect loss of connectivity on the peerings generated by
	// this BGPPeer resource.  Default value "None" means nothing beyond BGP's own (slow) hold
	// timer.  "BFDIfDirectlyConnected" means to use BFD when the peer is directly connected.
	FailureDetectionMode FailureDetectionMode `json:"failureDetectionMode,omitempty" validate:"omitempty,failureDetectionMode"`

	// Specifies restart behaviour to configure on the peerings generated by this BGPPeer
	// resource.  Default value "GracefulRestart" means traditional graceful restart.
	// "LongLivedGracefulRestart" means LLGR according to draft-uttaro-idr-bgp-persistence-05.
	RestartMode RestartMode `json:"restartMode,omitempty" validate:"omitempty,restartMode"`

	// Time to allow for software restart.  When specified, this is configured as the graceful
	// restart timeout when RestartMode is "GracefulRestart", and as the LLGR stale time when
	// RestartMode is "LongLivedGracefulRestart".  When not specified, the BIRD defaults are
	// used, which are 120s for "GracefulRestart" and 3600s for "LongLivedGracefulRestart".
	MaxRestartTime *metav1.Duration `json:"maxRestartTime,omitempty"`

	// Specifies the BIRD "gateway" mode, i.e. method for computing the immediate next hop for
	// each received route, for peerings generated by this BGPPeer resource.  Default value
	// "Recursive" means "gateway recursive".  "DirectIfDirectlyConnected" means to configure
	// "gateway direct" when the peer is directly connected.
	BIRDGatewayMode BIRDGatewayMode `json:"birdGatewayMode,omitempty" validate:"omitempty,birdGatewayMode"`
}

type BGPPeerType string

type BGPSessionState string

type BIRDGatewayMode string

type CISBenchmarkFilter struct {
	// BenchmarkSelection specifies which benchmarks this filter applies to. If not specified, applies to all.
	BenchmarkSelection *CISBenchmarkSelection `json:"benchmarkSelection,omitempty" validate:"omitempty"`

	// Exclude is an array of test indices to exclude from the report.
	Exclude []string `json:"exclude,omitempty"`

	// Include is an array of test indices to show in the report.
	// Is additive if IncludeUnscoredTests is true.
	// Takes precedence over Exclude.
	Include []string `json:"include,omitempty"`
}

type CISBenchmarkNode struct {
	// NodeName is the name of the node the this set of benchmark results is from.
	NodeName string `json:"nodeName"`

	// KubernetesVersion is the version of the kubelet running on this node.
	KubernetesVersion string `json:"kubernetesVersion"`

	// BenchmarksVersion is the version of the benchmarks that ran on this node.
	BenchmarksVersion string `json:"benchmarksVersion"`

	// Summary is a set of summary stats for this set of node-specific benchmarks.
	Summary CISBenchmarkNodeSummary `json:"summary"`

	// Results is the detailed set of results for this set of node-specific benchmarks.
	Results []CISBenchmarkSectionResult `json:"results"`
}

type CISBenchmarkNodeSummary struct {
	Status    string `json:"status"`
	TotalPass int    `json:"totalPass"`
	TotalFail int    `json:"totalFail"`
	TotalInfo int    `json:"totalInfo"`
	Total     int    `json:"total"`
}

type CISBenchmarkParams struct {
	// Specifies if the report should also show results for scored/not-scored tests.
	IncludeUnscoredTests bool `json:"includeUnscoredTests,omitempty"`

	// Configure the number of top failed tests to show up on the report.
	NumFailedTests *int `json:"numFailedTests,omitempty" validate:"gt=0"`

	// Benchmark results filters. The first matching set of filters is applied to each set of benchmark results.
	// If there are no matching filters, the full set of benchmark results will be included in the report.
	ResultsFilters []CISBenchmarkFilter `json:"resultsFilters,omitempty"`

	// Interpretted as a percentage to indicate at what levels of passing tests a node should be considered
	// HIGH, MED, and LOW.
	// - If >= HighThreshold flag as high
	// - Otherwise, if > MedThreshold flag as med
	// - Otherwise flag as low.
	HighThreshold *int `json:"highThreshold,omitempty" validate:"gte=0,lte=100,gtfield=MedThreshold"`
	MedThreshold  *int `json:"medThreshold,omitempty" validate:"gte=0,lte=100"`
}

type CISBenchmarkResult struct {
	TestNumber string `json:"testNumber"`
	TestDesc   string `json:"testDesc"`
	TestInfo   string `json:"testInfo"`
	Status     string `json:"status"`
	Scored     bool   `json:"scored"`
}

type CISBenchmarkResultCount struct {
	CISBenchmarkResult
	Count int `json:"count"`
}

type CISBenchmarkSectionResult struct {
	Status  string               `json:"status"`
	Section string               `json:"section"`
	Desc    string               `json:"desc"`
	Pass    int                  `json:"pass"`
	Fail    int                  `json:"fail"`
	Info    int                  `json:"info"`
	Results []CISBenchmarkResult `json:"results"`
}

type CISBenchmarkSelection struct {
	// KubernetesVersion is used select nodes that are running a specific version of kubelet. The full version need not
	// be fully specified down to the patch level, in which case the significant parts of the version are matched.
	// e.g. "1.0" will match versions "1.0.1" and "1.0.2"
	// If not specified, matches all versions.
	KubernetesVersion string `json:"kubernetesVersion,omitempty"`
}

type CISBenchmarkSummary struct {
	Type      string `json:"type"`
	HighCount int    `json:"highCount"`
	MedCount  int    `json:"medCount"`
	LowCount  int    `json:"lowCount"`
}

type CalicoNodeAgentStatus struct {
	// BIRDV4 represents the latest observed status of bird4.
	BIRDV4 BGPDaemonStatus `json:"birdV4,omitempty"`

	// BIRDV6 represents the latest observed status of bird6.
	BIRDV6 BGPDaemonStatus `json:"birdV6,omitempty"`
}

type CalicoNodeBGPRouteStatus struct {
	// RoutesV4 represents IPv4 routes on the node.
	RoutesV4 []CalicoNodeRoute `json:"routesV4,omitempty"`

	// RoutesV6 represents IPv6 routes on the node.
	RoutesV6 []CalicoNodeRoute `json:"routesV6,omitempty"`
}

type CalicoNodeBGPStatus struct {
	// The total number of IPv4 established bgp sessions.
	NumberEstablishedV4 int `json:"numberEstablishedV4"`

	// The total number of IPv4 non-established bgp sessions.
	NumberNotEstablishedV4 int `json:"numberNotEstablishedV4"`

	// The total number of IPv6 established bgp sessions.
	NumberEstablishedV6 int `json:"numberEstablishedV6"`

	// The total number of IPv6 non-established bgp sessions.
	NumberNotEstablishedV6 int `json:"numberNotEstablishedV6"`

	// PeersV4 represents IPv4 BGP peers status on the node.
	PeersV4 []CalicoNodePeer `json:"peersV4,omitempty"`

	// PeersV6 represents IPv6 BGP peers status on the node.
	PeersV6 []CalicoNodePeer `json:"peersV6,omitempty"`
}

type CalicoNodePeer struct {
	// IP address of the peer whose condition we are reporting.
	PeerIP string `json:"peerIP,omitempty" validate:"omitempty,ip"`

	// Type indicates whether this peer is configured via the node-to-node mesh,
	// or via en explicit global or per-node BGPPeer object.
	Type BGPPeerType `json:"type,omitempty"`

	// State is the BGP session state.
	State BGPSessionState `json:"state,omitempty"`

	// Since the state or reason last changed.
	Since string `json:"since,omitempty"`
}

type CalicoNodeRoute struct {
	// Type indicates if the route is being used for forwarding or not.
	Type CalicoNodeRouteType `json:"type,omitempty"`

	// Destination of the route.
	Destination string `json:"destination,omitempty"`

	// Gateway for the destination.
	Gateway string `json:"gateway,omitempty"`

	// Interface for the destination
	Interface string `json:"interface,omitempty"`

	// LearnedFrom contains information regarding where this route originated.
	LearnedFrom CalicoNodeRouteLearnedFrom `json:"learnedFrom,omitempty"`
}

type CalicoNodeRouteLearnedFrom struct {
	// Type of the source where a route is learned from.
	SourceType CalicoNodeRouteSourceType `json:"sourceType,omitempty"`

	// If sourceType is NodeMesh or BGPPeer, IP address of the router that sent us this route.
	PeerIP string `json:"peerIP,omitempty, validate:"omitempty,ip"`
}

type CalicoNodeRouteSourceType string

type CalicoNodeRouteType string

type CalicoNodeStatus struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Spec   CalicoNodeStatusSpec   `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
	Status CalicoNodeStatusStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
}

type CalicoNodeStatusList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Items []CalicoNodeStatus `json:"items" protobuf:"bytes,2,rep,name=items"`
}

type CalicoNodeStatusSpec struct {
	// The node name identifies the Calico node instance for node status.
	Node string `json:"node,omitempty" validate:"required,name"`

	// Classes declares the types of information to monitor for this calico/node,
	// and allows for selective status reporting about certain subsets of information.
	Classes []NodeStatusClassType `json:"classes,omitempty" validate:"required,unique"`

	// UpdatePeriodSeconds is the period at which CalicoNodeStatus should be updated.
	// Set to 0 to disable CalicoNodeStatus refresh. Maximum update period is one day.
	UpdatePeriodSeconds *uint32 `json:"updatePeriodSeconds,omitempty" validate:"required,gte=0,lte=86400"`
}

type CalicoNodeStatusStatus struct {
	// LastUpdated is a timestamp representing the server time when CalicoNodeStatus object
	// last updated. It is represented in RFC3339 form and is in UTC.
	// +nullable
	LastUpdated metav1.Time `json:"lastUpdated,omitempty"`

	// Agent holds agent status on the node.
	Agent CalicoNodeAgentStatus `json:"agent,omitempty"`

	// BGP holds node BGP status.
	BGP CalicoNodeBGPStatus `json:"bgp,omitempty"`

	// Routes reports routes known to the Calico BGP daemon on the node.
	Routes CalicoNodeBGPRouteStatus `json:"routes,omitempty"`
}

type ClusterInformation struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Spec ClusterInformationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

type ClusterInformationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Items []ClusterInformation `json:"items" protobuf:"bytes,2,rep,name=items"`
}

type ClusterInformationSpec struct {
	// ClusterGUID is the GUID of the cluster
	ClusterGUID string `json:"clusterGUID,omitempty" validate:"omitempty"`
	// ClusterType describes the type of the cluster
	ClusterType string `json:"clusterType,omitempty" validate:"omitempty"`
	// CalicoVersion is the version of Calico that the cluster is running
	CalicoVersion string `json:"calicoVersion,omitempty" validate:"omitempty"`
	// CNXVersion is the version of CNX that the cluster is running
	CNXVersion string `json:"cnxVersion,omitempty" validate:"omitempty"`
	// DatastoreReady is used during significant datastore migrations to signal to components
	// such as Felix that it should wait before accessing the datastore.
	DatastoreReady *bool `json:"datastoreReady,omitempty"`
	// Variant declares which variant of Calico should be active.
	Variant string `json:"variant,omitempty"`
}

type Community struct {
	// Name given to community value.
	Name string `json:"name,omitempty" validate:"required,name"`
	// Value must be of format `aa:nn` or `aa:nn:mm`.
	// For standard community use `aa:nn` format, where `aa` and `nn` are 16 bit number.
	// For large community use `aa:nn:mm` format, where `aa`, `nn` and `mm` are 32 bit number.
	// Where, `aa` is an AS Number, `nn` and `mm` are per-AS identifier.
	// +kubebuilder:validation:Pattern=`^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$`
	Value string `json:"value,omitempty" validate:"required"`
}

type CompletedReportJob struct {
	ReportJob `json:",inline"`

	// The time the report job completed.
	JobCompletionTime *metav1.Time `json:"jobCompletionTime,omitempty"`
}

type ControllersConfig struct {
	// Node enables and configures the node controller. Enabled by default, set to nil to disable.
	Node *NodeControllerConfig `json:"node,omitempty"`

	// Policy enables and configures the policy controller. Enabled by default, set to nil to disable.
	Policy *PolicyControllerConfig `json:"policy,omitempty"`

	// WorkloadEndpoint enables and configures the workload endpoint controller. Enabled by default, set to nil to disable.
	WorkloadEndpoint *WorkloadEndpointControllerConfig `json:"workloadEndpoint,omitempty"`

	// ServiceAccount enables and configures the service account controller. Enabled by default, set to nil to disable.
	ServiceAccount *ServiceAccountControllerConfig `json:"serviceAccount,omitempty"`

	// Namespace enables and configures the namespace controller. Enabled by default, set to nil to disable.
	Namespace *NamespaceControllerConfig `json:"namespace,omitempty"`

	// FederatedServices enables and configures the federatedservices controller. Disabled by default.
	FederatedServices *FederatedServicesControllerConfig `json:"federatedServices,omitempty"`
}

type DPIActive struct {
	// Success indicates if deep packet inspection is running on all workloads matching the selector.
	Success bool `json:"success,omitempty"`
	// Timestamp of when the active status was last updated.
	LastUpdated *metav1.Time `json:"lastUpdated,omitempty"`
}

type DPIErrorCondition struct {
	// Message from deep packet inspection error.
	Message string `json:"message,omitempty"`
	// Timestamp of when this error message was added.
	LastUpdated *metav1.Time `json:"lastUpdated,omitempty"`
}

type DPINode struct {
	// Node identifies with a physical node from the cluster via its hostname.
	Node   string    `json:"node,omitempty"`
	Active DPIActive `json:"active,omitempty"`
	// +kubebuilder:validation:MaxItems:=10
	ErrorConditions []DPIErrorCondition `json:"errorConditions,omitempty"`
}

type DeepPacketInspection struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object's metadata.
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// Specification of the DeepPacketInspection.
	Spec DeepPacketInspectionSpec `json:"spec,omitempty"`
	// Status of the DeepPacketInspection.
	Status DeepPacketInspectionStatus `json:"status,omitempty"`
}

type DeepPacketInspectionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []DeepPacketInspection `json:"items"`
}

type DeepPacketInspectionSpec struct {
	// The selector is an expression used to pick out the endpoints for which deep packet inspection should
	// be performed on. The selector will only match endpoints in the same namespace as the
	// DeepPacketInspection resource.
	//
	// Selector expressions follow this syntax:
	//
	// 	label == "string_literal"  ->  comparison, e.g. my_label == "foo bar"
	// 	label != "string_literal"   ->  not equal; also matches if label is not present
	// 	label in { "a", "b", "c", ... }  ->  true if the value of label X is one of "a", "b", "c"
	// 	label not in { "a", "b", "c", ... }  ->  true if the value of label X is not one of "a", "b", "c"
	// 	has(label_name)  -> True if that label is present
	// 	! expr -> negation of expr
	// 	expr && expr  -> Short-circuit and
	// 	expr || expr  -> Short-circuit or
	// 	( expr ) -> parens for grouping
	// 	all() or the empty selector -> matches all endpoints.
	//
	// Label names are allowed to contain alphanumerics, -, _ and /. String literals are more permissive
	// but they do not support escape characters.
	//
	// Examples (with made-up labels):
	//
	// 	type == "webserver" && deployment == "prod"
	// 	type in {"frontend", "backend"}
	// 	deployment != "dev"
	// 	! has(label_name)
	Selector string `json:"selector,omitempty" validate:"selector"`
}

type DeepPacketInspectionStatus struct {
	Nodes []DPINode `json:"nodes,omitempty"`
}

type EgressSpec struct {
	// NamespaceSelector
	NamespaceSelector string `json:"namespaceSelector,omitempty" validate:"omitempty,selector"`
	// Selector
	Selector string `json:"selector,omitempty" validate:"omitempty,selector"`
}

type EncapMode string

type EndpointPort struct {
	Name     string               `json:"name" validate:"portName"`
	Protocol numorstring.Protocol `json:"protocol"`
	Port     uint16               `json:"port" validate:"gt=0"`
}

type EndpointsReportEndpoint struct {
	Endpoint ResourceID `json:"endpoint,omitempty"`

	// Whether ingress traffic to this endpoint was always protected during the reporting interval.
	//
	// Ingress protection is defined as denying ingress traffic unless explicitly whitelisted. This is translated as
	// the endpoint having some explicit ingress policy applied to it.
	//
	// Source: Calculated from the set of ingress policies that apply to each endpoint.
	//
	// Set to:
	// - false if there are no ingress policies applied to the endpoint at any point during the reporting interval.
	// - true otherwise.
	//
	// Note: Policy is not inspected for protection bypass: for example match-all-and-allow rules which would effectively
	//       short-circuit the default tier-drop behavior, in this case the match-all-and-allow would be considered to be
	//       an explicit whitelist of all traffic. We could include simplistic all-match rules and check that they
	//       don't result in an allow. To check for more circuitous match-all allows is much trickier (e.g. you have one
	//       rule that allows for src!=1.2.3.0/24 and another rule that allows for src==1.2.3.0/24, which combined
	//       is essentially an allow-all).
	IngressProtected bool `json:"ingressProtected,omitempty"`

	// Whether egress traffic to this endpoint was always protected during the reporting interval.
	//
	// Egress protection is defined as denying egress traffic unless explicitly whitelisted. This is translated as
	// the endpoint having some explicit egress policy applied to it.
	//
	// Source: Calculated from the set of egress policies that apply to each endpoint.
	//
	// Set to:
	// - false if there are no egress policies applied to the endpoint at any point during the reporting interval.
	// - true otherwise.
	//
	// Note: Policy is not inspected for protection bypass: for example match-all-and-allow rules which would effectively
	//       short-circuit the default tier-drop behavior, in this case the match-all-and-allow would be considered to be
	//       an explicit whitelist of all traffic. We could include simplistic all-match rules and check that they
	//       don't result in an allow. To check for more circuitous match-all allows is much trickier (e.g. you have one
	//       rule that allows for src!=1.2.3.0/24 and another rule that allows for src==1.2.3.0/24, which combined
	//       is essentially an allow-all). Similarly, policy that only contains pass rules would still count as being
	//       protected.
	EgressProtected bool `json:"egressProtected,omitempty"`

	// Whether the matching policy has any ingress allow rules from a public IP address (as defined by the complement of
	// the private addresses; private addresses default to those defined in RFC 1918, but may also be configured separately).
	//
	// Source: Calculated from the policies applied to the endpoint. The ingress allow rules in each policy are checked
	//         to determine if any CIDR specified in the rule, either directly or through a matching network set, is an
	//         internet address. Endpoint addresses are not included - therefore ingress from a pod that has a public
	//         IP address will not be considered as “from internet”.
	//
	// Note: This is a simplification since it does not examine the policies to determine if it's actually possible to
	//       hit one of these allow rules (e.g. a previous rule may be a match-all-deny).
	IngressFromInternet bool `json:"ingressFromInternet,omitempty"`

	// Whether the matching policy has any egress allow rules to a public IP address (as defined by the complement of
	// the private addresses; private addresses default to those defined in RFC 1918, but may also be configured separately).
	//
	// Source: Calculated from the policies applied to the endpoint. The egress allow rules in each policy are checked
	//         to determine if any CIDR specified in the rule, either directly or through a matching network set, is an
	//         internet address. Endpoint addresses are not included - therefore egress to a pod that has a public
	//         IP address will not be considered as “to internet”.
	//
	// Note 1: This is a simplification since it does not examine the policies to determine if it's actually possible to
	//         hit one of these allow rules (e.g. a previous rule may be a match-all-deny).
	EgressToInternet bool `json:"egressToInternet,omitempty"`

	// Whether the matching policy has any ingress allow rules from another namespace.
	//
	// Source: Calculated from the policies applied to the endpoint.
	//
	// Set to true if:
	// - this is a pod (i.e. namespaced) with an applied GlobalNetworkPolicy with an ingress allow rule with no CIDR match.
	// - this is a pod with an applied NetworkPolicy with an ingress allow rule with a non-empty NamespaceSelector.
	//
	// Note: This is a simplification since it does not examine the policies to determine if it's actually possible to
	//       hit one of these allow rules (e.g. a previous rule may be a match-all-deny, or endpoint selector may not
	//       match any endpoints within the namespace).
	IngressFromOtherNamespace bool `json:"ingressFromOtherNamespace,omitempty"`

	// Whether the matching policy has any egress allow rules to another namespace.
	//
	// Source: Calculated from the policies applied to the endpoint.
	//
	// Set to true if:
	// - this is a pod endpoint (i.e. namespaced) matches a GlobalNetworkPolicy with an egress allow rule with no CIDR match.
	// - this is a pod endpoint which matches a NetworkPolicy with an egress allow rule with a non-empty NamespaceSelector.
	//
	// Note: This is a simplification since it does not examine the policies to determine if it's actually possible to
	//       hit one of these allow rules (e.g. a previous rule may be a match-all-deny, or endpoint selector may not
	//       match any endpoints within the namespace).
	EgressToOtherNamespace bool `json:"egressToOtherNamespace,omitempty"`

	// Whether this pod is envoy-enabled. This is simply an indicator of whether an Envoy container is running within the pod.
	// Provided Istio is configured appropriately, this can provide a simplistic determination of whether the pod is mTLS
	// enabled.
	//
	// Source: Pod spec.
	//
	// Set to:
	// - true if envoy is running within the pod
	// - false if envoy is not running within the pod
	EnvoyEnabled bool `json:"envoyEnabled,omitempty"`

	// The set of policies that apply to an endpoint may change within the reporting interval, this is the superset of all
	// policies that applied to the endpoint during that interval.
	AppliedPolicies []ResourceID `json:"appliedPolicies,omitempty"`

	// The list of services that exposed this endpoint at any moment during the reporting interval.
	//
	// Source: Determined from the Kubernetes endpoints resource associated with the service.
	Services []ResourceID `json:"services,omitempty"`

	// The ServiceAccount configured on this endpoint.
	ServiceAccount string `json:"serviceAccount,omitempty"`

	// The flow log aggregation name. This is used to locate flow logs associated with this endpoint when flow log
	// aggregation is turned on.
	FlowLogAggregationName string `json:"flowLogAggregationName,omitempty"`
}

type EndpointsReportFlow struct {
	// The source of the flow log.
	Source FlowEndpoint `json:"source"`

	// The destination of the flow log.
	Destination FlowEndpoint `json:"destination"`
}

type EndpointsReportNamespace struct {
	Namespace ResourceID `json:"namespace,omitempty"`

	// Whether ingress traffic was protected for all endpoints within this namespace within the reporting interval.
	// This is a summary of information contained in the endpoints data.
	IngressProtected bool `json:"ingressProtected,omitempty"`

	// Whether egress traffic was protected for all endpoints within this namespace within the reporting interval.
	// This is a summary of information contained in the endpoints data.
	EgressProtected bool `json:"egressProtected,omitempty"`

	// Whether ingress traffic was allowed from the internet for any endpoint within this namespace within the reporting
	// interval.
	IngressFromInternet bool `json:"ingressFromInternet,omitempty"`

	// Whether ingress traffic was allowed from the internet for any endpoint within this namespace within the reporting
	// interval.
	EgressToInternet bool `json:"egressToInternet,omitempty"`

	// Whether ingress traffic was allowed from another namespace for any endpoint within this namespace within the
	// reporting interval.
	IngressFromOtherNamespace bool `json:"ingressFromOtherNamespace,omitempty"`

	// Whether ingress traffic was allowed from another namespace for any endpoint within this namespace within the
	// reporting interval.
	EgressToOtherNamespace bool `json:"egressToOtherNamespace,omitempty"`

	// Whether envoy was enabled for all endpoints within this namespace within the reporting interval.
	// This is a summary of information contained in the endpoints data.
	EnvoyEnabled bool `json:"envoyEnabled,omitempty"`
}

type EndpointsReportService struct {
	Service ResourceID `json:"service,omitempty"`

	// Whether ingress traffic was protected for all endpoints within this namespace within the reporting interval.
	// This is a summary of information contained in the endpoints data.
	IngressProtected bool `json:"ingressProtected,omitempty"`

	// Whether ingress traffic was allowed from the internet for any endpoint exposed by this service within the reporting
	// interval.
	IngressFromInternet bool `json:"ingressFromInternet,omitempty"`

	// Whether ingress traffic was allowed from another namespace for any endpoint exposed by this service within the
	// reporting interval.
	IngressFromOtherNamespace bool `json:"ingressFromOtherNamespace,omitempty"`

	// Whether envoy was enabled for all endpoints that were exposed by this service within the reporting interval.
	// This is a summary of information contained in the endpoints data.
	EnvoyEnabled bool `json:"envoyEnabled,omitempty"`
}

type EndpointsSelection struct {
	// Selector, selects endpoints by endpoint labels. If omitted, all endpoints are included in the report
	// data.
	Selector string `json:"selector,omitempty" validate:"omitempty,selector"`

	// Namespace match restricts endpoint selection to those in the selected namespaces.
	Namespaces *NamesAndLabelsMatch `json:"namespaces,omitempty" validate:"omitempty"`

	// ServiceAccount match restricts endpoint selection to those in the selected service accounts.
	ServiceAccounts *NamesAndLabelsMatch `json:"serviceAccounts,omitempty" validate:"omitempty"`
}

type EndpointsSummary struct {
	// For endpoints: the total number of in-scope endpoints.
	//    Namespaces: the total number of namespaces containing in-scope endpoints.
	//      Services: the total number of services containing in-scope endpoints.
	//
	// Source: Calculated from pod/wep, hep, namespace and service account labels.
	NumTotal int `json:"numTotal,omitempty"`

	// For endpoints: the total number of service accounts for in-scope endpoints.
	//    Namespaces: n/a.
	//      Services: n/a.
	NumServiceAccounts int `json:"numServiceAccounts,omitempty"`

	// For endpoints: the number of in-scope endpoints that were ingress protected during the reporting interval.
	//    Namespaces: the number of namespaces whose in-scope endpoints were ingress protected during
	//                the reporting interval.
	//      Services: the number of services whose in-scope endpoints were ingress protected during the reporting
	//                interval.
	//
	// See below for defn of ingress-protected.
	NumIngressProtected int `json:"numIngressProtected,omitempty"`

	// For endpoints: the number of in-scope endpoints that were egress protected during the reporting interval.
	//    Namespaces: the number of namespaces whose in-scope endpoints were egress protected during the reporting
	//                interval.
	//
	// See below for defn of egress-protected.
	NumEgressProtected int `json:"numEgressProtected,omitempty"`

	// For endpoints: the number of in-scope endpoints whose policy would allow ingress traffic from the Internet
	//                for *any* period within the reporting interval.
	//                (See below for how this is calculated for an endpoint.)
	//    Namespaces: the number of namespaces that contained in-scope endpoints that would allow ingress traffic
	//                from the Internet for *any* period within the reporting interval.
	//      Services: the number of services that contained in-scope endpoints that would allow ingress traffic
	//                from the Internet for *any* period within the reporting interval.
	NumIngressFromInternet int `json:"numIngressFromInternet,omitempty"`

	// For endpoints: the number of in-scope endpoints whose policy would allow egress traffic to the Internet
	//                for *any* period within the reporting interval.
	//                (See below for how this is calculated for an endpoint.)
	//    Namespaces: the number of namespaces that contained in-scope endpoints that would allow egress traffic
	//                to the Internet for *any* period within the reporting interval.
	NumEgressToInternet int `json:"numEgressToInternet,omitempty"`

	// For endpoints: the number of in-scope endpoints whose policy would allow ingress traffic from a
	//                different namespace for *any* period within the reporting interval.
	//                (See below for how this is calculated for an endpoint.)
	//    Namespaces: the number of namespaces that contained in-scope endpoints that would allow ingress
	//                traffic from another namespace for *any* period within the reporting interval.
	//      Services: the number of services that contained in-scope endpoints that would allow ingress
	//                traffic from another namespace for *any* period within the reporting interval.
	NumIngressFromOtherNamespace int `json:"numIngressFromOtherNamespace,omitempty"`

	// For endpoints: the number of in-scope endpoints whose policy would allow ingress traffic from
	//                a different namespace for *any* period within the reporting interval.
	//                (See below for how this is calculated for an endpoint.)
	//    Namespaces: the number of namespaces that contained in-scope endpoints that would allow egress
	//                traffic to another namespace for *any* period within the reporting interval.
	NumEgressToOtherNamespace int `json:"numEgressToOtherNamespace,omitempty"`

	// For endpoints: the number of in-scope endpoints that were envoy-enabled within the reporting interval.
	//    Namespaces: the number of namespaces whose in-scope endpoints were always Envoy-enabled
	//      Services: the number of services whose in-scope endpoints were always Envoy-enabled
	//
	// See below for defn of envoy-enabled
	NumEnvoyEnabled int `json:"numEnvoyEnabled,omitempty"`
}

type EntityRule struct {
	// Nets is an optional field that restricts the rule to only apply to traffic that
	// originates from (or terminates at) IP addresses in any of the given subnets.
	Nets []string `json:"nets,omitempty" validate:"omitempty,dive,net"`

	// Selector is an optional field that contains a selector expression (see Policy for
	// sample syntax).  Only traffic that originates from (terminates at) endpoints matching
	// the selector will be matched.
	//
	// Note that: in addition to the negated version of the Selector (see NotSelector below), the
	// selector expression syntax itself supports negation.  The two types of negation are subtly
	// different. One negates the set of matched endpoints, the other negates the whole match:
	//
	//	Selector = "!has(my_label)" matches packets that are from other Calico-controlled
	// 	endpoints that do not have the label "my_label".
	//
	// 	NotSelector = "has(my_label)" matches packets that are not from Calico-controlled
	// 	endpoints that do have the label "my_label".
	//
	// The effect is that the latter will accept packets from non-Calico sources whereas the
	// former is limited to packets from Calico-controlled endpoints.
	Selector string `json:"selector,omitempty" validate:"omitempty,selector"`

	// NamespaceSelector is an optional field that contains a selector expression. Only traffic
	// that originates from (or terminates at) endpoints within the selected namespaces will be
	// matched. When both NamespaceSelector and another selector are defined on the same rule, then only
	// workload endpoints that are matched by both selectors will be selected by the rule.
	//
	// For NetworkPolicy, an empty NamespaceSelector implies that the Selector is limited to selecting
	// only workload endpoints in the same namespace as the NetworkPolicy.
	//
	// For NetworkPolicy, `global()` NamespaceSelector implies that the Selector is limited to selecting
	// only GlobalNetworkSet or HostEndpoint.
	//
	// For GlobalNetworkPolicy, an empty NamespaceSelector implies the Selector applies to workload
	// endpoints across all namespaces.
	NamespaceSelector string `json:"namespaceSelector,omitempty" validate:"omitempty,selector"`

	// Services is an optional field that contains options for matching Kubernetes Services.
	// If specified, only traffic that originates from or terminates at endpoints within the selected
	// service(s) will be matched, and only to/from each endpoint's port.
	//
	// Services cannot be specified on the same rule as Selector, NotSelector, NamespaceSelector, Nets,
	// NotNets or ServiceAccounts.
	//
	// Ports and NotPorts can only be specified with Services on ingress rules.
	Services *ServiceMatch `json:"services,omitempty" validate:"omitempty"`

	// Ports is an optional field that restricts the rule to only apply to traffic that has a
	// source (destination) port that matches one of these ranges/values. This value is a
	// list of integers or strings that represent ranges of ports.
	//
	// Since only some protocols have ports, if any ports are specified it requires the
	// Protocol match in the Rule to be set to "TCP" or "UDP".
	Ports []numorstring.Port `json:"ports,omitempty" validate:"omitempty,dive"`

	// Domains is an optional field, valid for egress Allow rules only, that restricts the rule
	// to apply only to traffic to one of the specified domains.  If this field is specified,
	// Action must be Allow, and Nets and Selector must both be left empty.
	Domains []string `json:"domains,omitempty" validate:"omitempty,dive,wildname"`

	// NotNets is the negated version of the Nets field.
	NotNets []string `json:"notNets,omitempty" validate:"omitempty,dive,net"`

	// NotSelector is the negated version of the Selector field.  See Selector field for
	// subtleties with negated selectors.
	NotSelector string `json:"notSelector,omitempty" validate:"omitempty,selector"`

	// NotPorts is the negated version of the Ports field.
	// Since only some protocols have ports, if any ports are specified it requires the
	// Protocol match in the Rule to be set to "TCP" or "UDP".
	NotPorts []numorstring.Port `json:"notPorts,omitempty" validate:"omitempty,dive"`

	// ServiceAccounts is an optional field that restricts the rule to only apply to traffic that originates from (or
	// terminates at) a pod running as a matching service account.
	ServiceAccounts *ServiceAccountMatch `json:"serviceAccounts,omitempty" validate:"omitempty"`
}

type ErrorCondition struct {
	Type    string `json:"type" validate:"required"`
	Message string `json:"message" validate:"required"`
}

type EtcdConfig struct {
	// A comma separated list of etcd endpoints. Valid if DatastoreType is etcdv3.  [Default: ]
	EtcdEndpoints string `json:"etcdEndpoints,omitempty" validate:"omitempty,etcdEndpoints"`
	// User name for RBAC. Valid if DatastoreType is etcdv3.
	EtcdUsername string `json:"etcdUsername,omitempty" validate:"omitempty"`
	// Password for the given user name. Valid if DatastoreType is etcdv3.
	EtcdPassword string `json:"etcdPassword,omitempty" validate:"omitempty"`
	// Path to the etcd key file. Valid if DatastoreType is etcdv3.
	EtcdKeyFile string `json:"etcdKeyFile,omitempty" validate:"omitempty,file"`
	// Path to the etcd client certificate. Valid if DatastoreType is etcdv3.
	EtcdCertFile string `json:"etcdCertFile,omitempty" validate:"omitempty,file"`
	// Path to the etcd Certificate Authority file. Valid if DatastoreType is etcdv3.
	EtcdCACertFile string `json:"etcdCACertFile,omitempty" validate:"omitempty,file"`
	// These config file parameters are to support inline certificates, keys and CA / Trusted certificate.
	EtcdKey    string `json:"etcdKey,omitempty" ignored:"true"`
	EtcdCert   string `json:"etcdCert,omitempty" ignored:"true"`
	EtcdCACert string `json:"etcdCACert,omitempty" ignored:"true"`
}

type FailureDetectionMode string

type FederatedServicesControllerConfig struct {
	// ReconcilerPeriod is the period to perform reconciliation. [Default: 5m]
	ReconcilerPeriod *metav1.Duration `json:"reconcilerPeriod,omitempty" validate:"omitempty"`
}

type FelixConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Spec FelixConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

type FelixConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Items []FelixConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"`
}

type FelixConfigurationSpec struct {
	UseInternalDataplaneDriver *bool  `json:"useInternalDataplaneDriver,omitempty"`
	DataplaneDriver            string `json:"dataplaneDriver,omitempty"`

	IPv6Support *bool `json:"ipv6Support,omitempty" confignamev1:"Ipv6Support"`

	// RouteRefreshInterval is the period at which Felix re-checks the routes
	// in the dataplane to ensure that no other process has accidentally broken Calico's rules.
	// Set to 0 to disable route refresh. [Default: 90s]
	RouteRefreshInterval *metav1.Duration `json:"routeRefreshInterval,omitempty" configv1timescale:"seconds"`
	// InterfaceRefreshInterval is the period at which Felix rescans local interfaces to verify their state.
	// The rescan can be disabled by setting the interval to 0.
	InterfaceRefreshInterval *metav1.Duration `json:"interfaceRefreshInterval,omitempty" configv1timescale:"seconds"`
	// IptablesRefreshInterval is the period at which Felix re-checks the IP sets
	// in the dataplane to ensure that no other process has accidentally broken Calico's rules.
	// Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the
	// other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel
	// version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value
	// to reduce Felix CPU usage. [Default: 10s]
	IptablesRefreshInterval *metav1.Duration `json:"iptablesRefreshInterval,omitempty" configv1timescale:"seconds"`
	// IptablesPostWriteCheckInterval is the period after Felix has done a write
	// to the dataplane that it schedules an extra read back in order to check the write was not
	// clobbered by another process. This should only occur if another application on the system
	// doesn't respect the iptables lock. [Default: 1s]
	IptablesPostWriteCheckInterval *metav1.Duration `json:"iptablesPostWriteCheckInterval,omitempty" configv1timescale:"seconds" confignamev1:"IptablesPostWriteCheckIntervalSecs"`
	// IptablesLockFilePath is the location of the iptables lock file. You may need to change this
	// if the lock file is not in its standard location (for example if you have mapped it into Felix's
	// container at a different path). [Default: /run/xtables.lock]
	IptablesLockFilePath string `json:"iptablesLockFilePath,omitempty"`
	// IptablesLockTimeout is the time that Felix will wait for the iptables lock,
	// or 0, to disable. To use this feature, Felix must share the iptables lock file with all other
	// processes that also take the lock. When running Felix inside a container, this requires the
	// /run directory of the host to be mounted into the calico/node or calico/felix container.
	// [Default: 0s disabled]
	IptablesLockTimeout *metav1.Duration `json:"iptablesLockTimeout,omitempty" configv1timescale:"seconds" confignamev1:"IptablesLockTimeoutSecs"`
	// IptablesLockProbeInterval is the time that Felix will wait between
	// attempts to acquire the iptables lock if it is not available. Lower values make Felix more
	// responsive when the lock is contended, but use more CPU. [Default: 50ms]
	IptablesLockProbeInterval *metav1.Duration `json:"iptablesLockProbeInterval,omitempty" configv1timescale:"milliseconds" confignamev1:"IptablesLockProbeIntervalMillis"`
	// FeatureDetectOverride is used to override the feature detection.
	// Values are specified in a comma separated list with no spaces, example;
	// "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=".
	// "true" or "false" will force the feature, empty or omitted values are
	// auto-detected.
	FeatureDetectOverride string `json:"featureDetectOverride,omitempty" validate:"omitempty,keyValueList"`
	// IpsetsRefreshInterval is the period at which Felix re-checks all iptables
	// state to ensure that no other process has accidentally broken Calico's rules. Set to 0 to
	// disable iptables refresh. [Default: 90s]
	IpsetsRefreshInterval *metav1.Duration `json:"ipsetsRefreshInterval,omitempty" configv1timescale:"seconds"`
	MaxIpsetSize          *int             `json:"maxIpsetSize,omitempty"`
	// IptablesBackend specifies which backend of iptables will be used. The default is legacy.
	IptablesBackend *IptablesBackend `json:"iptablesBackend,omitempty" validate:"omitempty,iptablesBackend"`

	// XDPRefreshInterval is the period at which Felix re-checks all XDP state to ensure that no
	// other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to
	// disable XDP refresh. [Default: 90s]
	XDPRefreshInterval *metav1.Duration `json:"xdpRefreshInterval,omitempty" configv1timescale:"seconds"`

	NetlinkTimeout *metav1.Duration `json:"netlinkTimeout,omitempty" configv1timescale:"seconds" confignamev1:"NetlinkTimeoutSecs"`

	// MetadataAddr is the IP address or domain name of the server that can answer VM queries for
	// cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in
	// Ubuntu, nova-api-metadata). A value of none (case insensitive) means that Felix should not
	// set up any NAT rule for the metadata path. [Default: 127.0.0.1]
	MetadataAddr string `json:"metadataAddr,omitempty"`
	// MetadataPort is the port of the metadata server. This, combined with global.MetadataAddr (if
	// not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort.
	// In most cases this should not need to be changed [Default: 8775].
	MetadataPort *int `json:"metadataPort,omitempty"`

	// OpenstackRegion is the name of the region that a particular Felix belongs to. In a multi-region
	// Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel,
	// or in felix.cfg or the environment on each compute node), and must match the [calico]
	// openstack_region value configured in neutron.conf on each node. [Default: Empty]
	OpenstackRegion string `json:"openstackRegion,omitempty"`

	// InterfacePrefix is the interface name prefix that identifies workload endpoints and so distinguishes
	// them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators
	// configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value,
	// and our OpenStack integration sets the 'tap' value. [Default: cali]
	InterfacePrefix string `json:"interfacePrefix,omitempty"`
	// InterfaceExclude is a comma-separated list of interfaces that Felix should exclude when monitoring for host
	// endpoints. The default value ensures that Felix ignores Kubernetes' IPVS dummy interface, which is used
	// internally by kube-proxy. If you want to exclude multiple interface names using a single value, the list
	// supports regular expressions. For regular expressions you must wrap the value with '/'. For example
	// having values '/^kube/,veth1' will exclude all interfaces that begin with 'kube' and also the interface
	// 'veth1'. [Default: kube-ipvs0]
	InterfaceExclude string `json:"interfaceExclude,omitempty"`

	// ChainInsertMode controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule
	// at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents
	// Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains
	// signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed.
	// [Default: insert]
	ChainInsertMode string `json:"chainInsertMode,omitempty"`
	// DefaultEndpointToHostAction controls what happens to traffic that goes from a workload endpoint to the host
	// itself (after the traffic hits the endpoint egress policy). By default Calico blocks traffic from workload
	// endpoints to the host itself with an iptables "DROP" action. If you want to allow some or all traffic from
	// endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables
	// "INPUT" chain; Calico will insert its rules at the top of that chain, then "RETURN" packets to the "INPUT" chain
	// once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets
	// from workloads after processing workload endpoint egress policy. [Default: Drop]
	DefaultEndpointToHostAction string `json:"defaultEndpointToHostAction,omitempty" validate:"omitempty,dropAcceptReturn"`
	IptablesFilterAllowAction   string `json:"iptablesFilterAllowAction,omitempty" validate:"omitempty,acceptReturn"`
	IptablesMangleAllowAction   string `json:"iptablesMangleAllowAction,omitempty" validate:"omitempty,acceptReturn"`
	// LogPrefix is the log prefix that Felix uses when rendering LOG rules. [Default: calico-packet]
	LogPrefix string `json:"logPrefix,omitempty"`

	// LogDropActionOverride specifies whether or not to include the DropActionOverride in the logs when it is triggered.
	LogDropActionOverride *bool `json:"logDropActionOverride,omitempty"`

	// LogFilePath is the full path to the Felix log. Set to none to disable file logging. [Default: /var/log/calico/felix.log]
	LogFilePath string `json:"logFilePath,omitempty"`

	// LogSeverityFile is the log severity above which logs are sent to the log file. [Default: Info]
	LogSeverityFile string `json:"logSeverityFile,omitempty" validate:"omitempty,logLevel"`
	// LogSeverityScreen is the log severity above which logs are sent to the stdout. [Default: Info]
	LogSeverityScreen string `json:"logSeverityScreen,omitempty" validate:"omitempty,logLevel"`
	// LogSeveritySys is the log severity above which logs are sent to the syslog. Set to None for no logging to syslog.
	// [Default: Info]
	LogSeveritySys string `json:"logSeveritySys,omitempty" validate:"omitempty,logLevel"`
	// LogDebugFilenameRegex controls which source code files have their Debug log output included in the logs.
	// Only logs from files with names that match the given regular expression are included.  The filter only applies
	// to Debug level logs.
	LogDebugFilenameRegex string `json:"logDebugFilenameRegex,omitempty" validate:"omitempty,regexp"`

	IPIPEnabled *bool `json:"ipipEnabled,omitempty" confignamev1:"IpInIpEnabled"`
	// IPIPMTU is the MTU to set on the tunnel device. See Configuring MTU [Default: 1440]
	IPIPMTU *int `json:"ipipMTU,omitempty" confignamev1:"IpInIpMtu"`

	VXLANEnabled *bool `json:"vxlanEnabled,omitempty"`
	// VXLANMTU is the MTU to set on the tunnel device. See Configuring MTU [Default: 1440]
	VXLANMTU  *int `json:"vxlanMTU,omitempty"`
	VXLANPort *int `json:"vxlanPort,omitempty"`
	VXLANVNI  *int `json:"vxlanVNI,omitempty"`

	// AllowVXLANPacketsFromWorkloads controls whether Felix will add a rule to drop VXLAN encapsulated traffic
	// from workloads [Default: false]
	// +optional
	AllowVXLANPacketsFromWorkloads *bool `json:"allowVXLANPacketsFromWorkloads,omitempty"`
	// AllowIPIPPacketsFromWorkloads controls whether Felix will add a rule to drop IPIP encapsulated traffic
	// from workloads [Default: false]
	// +optional
	AllowIPIPPacketsFromWorkloads *bool `json:"allowIPIPPacketsFromWorkloads,omitempty"`

	// ReportingInterval is the interval at which Felix reports its status into the datastore or 0 to disable.
	// Must be non-zero in OpenStack deployments. [Default: 30s]
	ReportingInterval *metav1.Duration `json:"reportingInterval,omitempty" configv1timescale:"seconds" confignamev1:"ReportingIntervalSecs"`
	// ReportingTTL is the time-to-live setting for process-wide status reports. [Default: 90s]
	ReportingTTL *metav1.Duration `json:"reportingTTL,omitempty" configv1timescale:"seconds" confignamev1:"ReportingTTLSecs"`

	EndpointReportingEnabled *bool            `json:"endpointReportingEnabled,omitempty"`
	EndpointReportingDelay   *metav1.Duration `json:"endpointReportingDelay,omitempty" configv1timescale:"seconds" confignamev1:"EndpointReportingDelaySecs"`

	// IptablesMarkMask is the mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal
	// number with at least 8 bits set, none of which clash with any other mark bits in use on the system.
	// [Default: 0xff000000]
	IptablesMarkMask *uint32 `json:"iptablesMarkMask,omitempty"`

	DisableConntrackInvalidCheck *bool `json:"disableConntrackInvalidCheck,omitempty"`

	HealthEnabled *bool   `json:"healthEnabled,omitempty"`
	HealthHost    *string `json:"healthHost,omitempty"`
	HealthPort    *int    `json:"healthPort,omitempty"`

	// PrometheusMetricsEnabled enables the Prometheus metrics server in Felix if set to true. [Default: false]
	PrometheusMetricsEnabled *bool `json:"prometheusMetricsEnabled,omitempty"`
	// PrometheusMetricsHost is the host that the Prometheus metrics server should bind to. [Default: empty]
	PrometheusMetricsHost string `json:"prometheusMetricsHost,omitempty" validate:"omitempty,prometheusHost"`
	// PrometheusMetricsPort is the TCP port that the Prometheus metrics server should bind to. [Default: 9091]
	PrometheusMetricsPort *int `json:"prometheusMetricsPort,omitempty"`
	// PrometheusGoMetricsEnabled disables Go runtime metrics collection, which the Prometheus client does by default, when
	// set to false. This reduces the number of metrics reported, reducing Prometheus load. [Default: true]
	PrometheusGoMetricsEnabled *bool `json:"prometheusGoMetricsEnabled,omitempty"`
	// PrometheusProcessMetricsEnabled disables process metrics collection, which the Prometheus client does by default, when
	// set to false. This reduces the number of metrics reported, reducing Prometheus load. [Default: true]
	PrometheusProcessMetricsEnabled *bool `json:"prometheusProcessMetricsEnabled,omitempty"`
	// PrometheusWireGuardMetricsEnabled disables wireguard metrics collection, which the Prometheus client does by default, when
	// set to false. This reduces the number of metrics reported, reducing Prometheus load. [Default: true]
	PrometheusWireGuardMetricsEnabled *bool `json:"prometheusWireGuardMetricsEnabled,omitempty"`
	// TLS credentials for this port.
	PrometheusMetricsCertFile string `json:"prometheusMetricsCertFile,omitempty"`
	PrometheusMetricsKeyFile  string `json:"prometheusMetricsKeyFile,omitempty"`
	PrometheusMetricsCAFile   string `json:"prometheusMetricsCAFile,omitempty"`

	// FailsafeInboundHostPorts is a list of UDP/TCP ports and CIDRs that Felix will allow incoming traffic to host endpoints
	// on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration.
	// For back-compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow
	// traffic from all addresses. To disable all inbound host ports, use the value none. The default value allows ssh access
	// and DHCP.
	// [Default: tcp:22, udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]
	FailsafeInboundHostPorts *[]ProtoPort `json:"failsafeInboundHostPorts,omitempty"`
	// FailsafeOutboundHostPorts is a list of UDP/TCP ports and CIDRs that Felix will allow outgoing traffic from host endpoints
	// to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration.
	// For back-compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow
	// traffic from all addresses. To disable all outbound host ports, use the value none. The default value opens etcd's standard
	// ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP and DNS.
	// [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667, udp:53, udp:67]
	FailsafeOutboundHostPorts *[]ProtoPort `json:"failsafeOutboundHostPorts,omitempty"`

	// KubeMasqueradeBit should be set to the same value as --iptables-masquerade-bit of kube-proxy
	// when TPROXY is used. The default is the same as kube-proxy default thus only needs a change
	// if kube-proxy is using a non-standard setting. Must be within the range of 0-31.  [Default: 14]
	KubeMasqueradeBit *int `json:"kubeMasqueradeBit,omitempty" validate:"omitempty,gte=0,lte=31"`

	// KubeNodePortRanges holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode.
	// Felix uses these ranges to separate host and workload traffic. [Default: 30000:32767].
	KubeNodePortRanges *[]numorstring.Port `json:"kubeNodePortRanges,omitempty" validate:"omitempty,dive"`

	// PolicySyncPathPrefix is used to by Felix to communicate policy changes to external services,
	// like Application layer policy. [Default: Empty]
	PolicySyncPathPrefix string `json:"policySyncPathPrefix,omitempty"`

	// UsageReportingEnabled reports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage
	// server. For example, if a significant security vulnerability has been discovered in the version of Calico being used. [Default: true]
	UsageReportingEnabled *bool `json:"usageReportingEnabled,omitempty"`
	// UsageReportingInitialDelay controls the minimum delay before Felix makes a report. [Default: 300s]
	UsageReportingInitialDelay *metav1.Duration `json:"usageReportingInitialDelay,omitempty" configv1timescale:"seconds" confignamev1:"UsageReportingInitialDelaySecs"`
	// UsageReportingInterval controls the interval at which Felix makes reports. [Default: 86400s]
	UsageReportingInterval *metav1.Duration `json:"usageReportingInterval,omitempty" configv1timescale:"seconds" confignamev1:"UsageReportingIntervalSecs"`

	// NATPortRange specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the
	// network stack is used.
	NATPortRange *numorstring.Port `json:"natPortRange,omitempty"`

	// NATOutgoingAddress specifies an address to use when performing source NAT for traffic in a natOutgoing pool that
	// is leaving the network. By default the address used is an address on the interface the traffic is leaving on
	// (ie it uses the iptables MASQUERADE target)
	NATOutgoingAddress string `json:"natOutgoingAddress,omitempty"`

	// This is the source address to use on programmed device routes. By default the source address is left blank,
	// leaving the kernel to choose the source address used.
	DeviceRouteSourceAddress string `json:"deviceRouteSourceAddress,omitempty"`

	// This defines the route protocol added to programmed device routes, by default this will be RTPROT_BOOT
	// when left blank.
	DeviceRouteProtocol *int `json:"deviceRouteProtocol,omitempty"`
	// Whether or not to remove device routes that have not been programmed by Felix. Disabling this will allow external
	// applications to also add device routes. This is enabled by default which means we will remove externally added routes.
	RemoveExternalRoutes *bool `json:"removeExternalRoutes,omitempty"`

	// ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes which may source tunnel traffic and have
	// the tunneled traffic be accepted at calico nodes.
	ExternalNodesCIDRList *[]string `json:"externalNodesList,omitempty"`

	NfNetlinkBufSize  string `json:"nfNetlinkBufSize,omitempty"`
	StatsDumpFilePath string `json:"statsDumpFilePath,omitempty"`

	// Felix Denied Packet Metrics configuration parameters.
	PrometheusReporterEnabled   *bool  `json:"prometheusReporterEnabled,omitempty"`
	PrometheusReporterPort      *int   `json:"prometheusReporterPort,omitempty"`
	PrometheusReporterCertFile  string `json:"prometheusReporterCertFile,omitempty"`
	PrometheusReporterKeyFile   string `json:"prometheusReporterKeyFile,omitempty"`
	PrometheusReporterCAFile    string `json:"prometheusReporterCAFile,omitempty"`
	DeletedMetricsRetentionSecs *int   `json:"deletedMetricsRetentionSecs,omitempty"`

	// DropActionOverride overrides the Drop action in Felix, optionally changing the behavior to Accept, and optionally adding Log.
	// Possible values are Drop, LogAndDrop, Accept, LogAndAccept. [Default: Drop]
	DropActionOverride string `json:"dropActionOverride,omitempty" validate:"omitempty,dropActionOverride"`

	DebugMemoryProfilePath          string           `json:"debugMemoryProfilePath,omitempty"`
	DebugDisableLogDropping         *bool            `json:"debugDisableLogDropping,omitempty"`
	DebugSimulateCalcGraphHangAfter *metav1.Duration `json:"debugSimulateCalcGraphHangAfter,omitempty" configv1timescale:"seconds"`
	DebugSimulateDataplaneHangAfter *metav1.Duration `json:"debugSimulateDataplaneHangAfter,omitempty" configv1timescale:"seconds"`

	// DNSPolicyNfqueueID is the NFQUEUE ID to use for DNS Policy re-evaluation when the domains IP hasn't been programmed
	// to ipsets yet. [Default: 100]
	DNSPolicyNfqueueID *int `json:"dnsPolicyNfqueueID,omitempty" validate:"omitempty,gte=0,lte=65535"`

	IptablesNATOutgoingInterfaceFilter string `json:"iptablesNATOutgoingInterfaceFilter,omitempty" validate:"omitempty,ifaceFilter"`

	// SidecarAccelerationEnabled enables experimental sidecar acceleration [Default: false]
	SidecarAccelerationEnabled *bool `json:"sidecarAccelerationEnabled,omitempty"`

	// XDPEnabled enables XDP acceleration for suitable untracked incoming deny rules. [Default: true]
	XDPEnabled *bool `json:"xdpEnabled,omitempty" confignamev1:"XDPEnabled"`

	// GenericXDPEnabled enables Generic XDP so network cards that don't support XDP offload or driver
	// modes can use XDP. This is not recommended since it doesn't provide better performance than
	// iptables. [Default: false]
	GenericXDPEnabled *bool `json:"genericXDPEnabled,omitempty" confignamev1:"GenericXDPEnabled"`

	// BPFEnabled, if enabled Felix will use the BPF dataplane. [Default: false]
	BPFEnabled *bool `json:"bpfEnabled,omitempty" validate:"omitempty"`
	// BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable
	// unprivileged use of BPF.  This ensures that unprivileged users cannot access Calico's BPF maps and
	// cannot insert their own BPF programs to interfere with Calico's. [Default: true]
	BPFDisableUnprivileged *bool `json:"bpfDisableUnprivileged,omitempty" validate:"omitempty"`
	// BPFLogLevel controls the log level of the BPF programs when in BPF dataplane mode.  One of "Off", "Info", or
	// "Debug".  The logs are emitted to the BPF trace pipe, accessible with the command `tc exec bpf debug`.
	// [Default: Off].
	// +optional
	BPFLogLevel string `json:"bpfLogLevel,omitempty" validate:"omitempty,bpfLogLevel"`
	// BPFDataIfacePattern is a regular expression that controls which interfaces Felix should attach BPF programs to
	// in order to catch traffic to/from the network.  This needs to match the interfaces that Calico workload traffic
	// flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the
	// cluster.  It should not match the workload interfaces (usually named cali...).
	BPFDataIfacePattern string `json:"bpfDataIfacePattern,omitempty" validate:"omitempty,regexp"`
	// BPFConnectTimeLoadBalancingEnabled when in BPF mode, controls whether Felix installs the connection-time load
	// balancer.  The connect-time load balancer is required for the host to be able to reach Kubernetes services
	// and it improves the performance of pod-to-service connections.  The only reason to disable it is for debugging
	// purposes.  [Default: true]
	BPFConnectTimeLoadBalancingEnabled *bool `json:"bpfConnectTimeLoadBalancingEnabled,omitempty" validate:"omitempty"`
	// BPFExternalServiceMode in BPF mode, controls how connections from outside the cluster to services (node ports
	// and cluster IPs) are forwarded to remote workloads.  If set to "Tunnel" then both request and response traffic
	// is tunneled to the remote node.  If set to "DSR", the request traffic is tunneled but the response traffic
	// is sent directly from the remote node.  In "DSR" mode, the remote node appears to use the IP of the ingress
	// node; this requires a permissive L2 network.  [Default: Tunnel]
	BPFExternalServiceMode string `json:"bpfExternalServiceMode,omitempty" validate:"omitempty,bpfServiceMode"`
	// BPFExtToServiceConnmark in BPF mode, control a 32bit mark that is set on connections from an
	// external client to a local service. This mark allows us to control how packets of that
	// connection are routed within the host and how is routing intepreted by RPF check. [Default: 0]
	BPFExtToServiceConnmark *int `json:"bpfExtToServiceConnmark,omitempty" validate:"omitempty,gte=0,lte=4294967295"`
	// BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF mode, Felix will proactively clean up the upstream
	// Kubernetes kube-proxy's iptables chains.  Should only be enabled if kube-proxy is not running.  [Default: true]
	BPFKubeProxyIptablesCleanupEnabled *bool `json:"bpfKubeProxyIptablesCleanupEnabled,omitempty" validate:"omitempty"`
	// BPFKubeProxyMinSyncPeriod, in BPF mode, controls the minimum time between updates to the dataplane for Felix's
	// embedded kube-proxy.  Lower values give reduced set-up latency.  Higher values reduce Felix CPU usage by
	// batching up more work.  [Default: 1s]
	BPFKubeProxyMinSyncPeriod *metav1.Duration `json:"bpfKubeProxyMinSyncPeriod,omitempty" validate:"omitempty" configv1timescale:"seconds"`
	// BPFKubeProxyEndpointSlicesEnabled in BPF mode, controls whether Felix's
	// embedded kube-proxy accepts EndpointSlices or not.
	BPFKubeProxyEndpointSlicesEnabled *bool `json:"bpfKubeProxyEndpointSlicesEnabled,omitempty" validate:"omitempty"`
	// BPFPSNATPorts sets the range from which we randomly pick a port if there is a source port
	// collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and
	// preferably outside the  ephemeral ranges used by common operating systems. Linux uses
	// 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily
	// a problem if this range overlaps with the operating systems. Both ends of the range are
	// inclusive. [Default: 20000:29999]
	BPFPSNATPorts *numorstring.Port `json:"bpfPSNATPorts,omitempty"`
	// BPFMapSizeNATFrontend sets the size for nat front end map.
	// FrontendMap should be large enough to hold an entry for each nodeport,
	// external IP and each port in each service.
	BPFMapSizeNATFrontend *int `json:"bpfMapSizeNATFrontend,omitempty"`
	// BPFMapSizeNATBackend sets the size for nat back end map.
	// This is the total number of endpoints. This is mostly
	// more than the size of the number of services.
	BPFMapSizeNATBackend  *int `json:"bpfMapSizeNATBackend,omitempty"`
	BPFMapSizeNATAffinity *int `json:"bpfMapSizeNATAffinity,omitempty"`
	// BPFMapSizeRoute sets the size for the routes map.  The routes map should be large enough
	// to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and
	// tunnel IPs).
	BPFMapSizeRoute *int `json:"bpfMapSizeRoute,omitempty"`
	// BPFMapSizeConntrack sets the size for the conntrack map.  This map must be large enough to hold
	// an entry for each active connection.  Warning: changing the size of the conntrack map can cause disruption.
	BPFMapSizeConntrack *int `json:"bpfMapSizeConntrack,omitempty"`
	// BPFMapSizeIPSets sets the size for ipsets map.  The IP sets map must be large enough to hold an entry
	// for each endpoint matched by every selector in the source/destination matches in network policy.  Selectors
	// such as "all()" can result in large numbers of entries (one entry per endpoint in that case).
	BPFMapSizeIPSets *int `json:"bpfMapSizeIPSets,omitempty"`

	SyslogReporterNetwork string `json:"syslogReporterNetwork,omitempty"`
	SyslogReporterAddress string `json:"syslogReporterAddress,omitempty"`

	// IPSecMode controls which mode IPSec is operating on.
	// Default value means IPSec is not enabled. [Default: ""]
	IPSecMode string `json:"ipsecMode,omitempty" validate:"omitempty,ipsecMode"`
	// IPSecAllowUnsecuredTraffic controls whether non-IPsec traffic is allowed in addition to IPsec traffic. Enabling this
	// negates the anti-spoofing protections of IPsec but it is useful when migrating to/from IPsec. [Default: false]
	IPSecAllowUnsecuredTraffic *bool `json:"ipsecAllowUnsecuredTraffic,omitempty"`
	// IPSecIKEAlgorithm sets IPSec IKE algorithm. Default is NIST suite B recommendation. [Default: aes128gcm16-prfsha256-ecp256]
	IPSecIKEAlgorithm string `json:"ipsecIKEAlgorithm,omitempty"`
	// IPSecESAlgorithm sets IPSec ESP algorithm. Default is NIST suite B recommendation. [Default: aes128gcm16-ecp256]
	IPSecESPAlgorithm string `json:"ipsecESPAlgorithm,omitempty"`
	// IPSecLogLevel controls log level for IPSec components. Set to None for no logging.
	// A generic log level terminology is used [None, Notice, Info, Debug, Verbose].
	// [Default: Info]
	IPSecLogLevel string `json:"ipsecLogLevel,omitempty" validate:"omitempty,ipsecLogLevel"`
	// IPSecPolicyRefreshInterval is the interval at which Felix will check the kernel's IPsec policy tables and
	// repair any inconsistencies. [Default: 600s]
	IPSecPolicyRefreshInterval *metav1.Duration `json:"ipsecPolicyRefreshInterval,omitempty" configv1timescale:"seconds"`

	// FlowLogsFlushInterval configures the interval at which Felix exports flow logs.
	FlowLogsFlushInterval *metav1.Duration `json:"flowLogsFlushInterval,omitempty" configv1timescale:"seconds"`
	// FlowLogsEnableHostEndpoint enables Flow logs reporting for HostEndpoints.
	FlowLogsEnableHostEndpoint *bool `json:"flowLogsEnableHostEndpoint,omitempty"`
	// FlowLogsEnableNetworkSets enables Flow logs reporting for GlobalNetworkSets.
	FlowLogsEnableNetworkSets *bool `json:"flowLogsEnableNetworkSets,omitempty"`
	// FlowLogsMaxOriginalIPsIncluded specifies the number of unique IP addresses (if relevant) that should be included in Flow logs.
	FlowLogsMaxOriginalIPsIncluded *int `json:"flowLogsMaxOriginalIPsIncluded,omitempty"`
	// FlowLogsCollectProcessInfo, if enabled Felix will load the kprobe BPF programs to collect process info. [Default: false]
	FlowLogsCollectProcessInfo *bool `json:"flowLogsCollectProcessInfo,omitempty" validate:"omitempty"`
	// FlowLogsCollectTcpStats enables flow logs reporting TCP socket stats
	FlowLogsCollectTcpStats *bool `json:"flowLogsCollectTcpStats,omitempty" validate:"omitempty"`
	// When FlowLogsCollectProcessPath and FlowLogsCollectProcessInfo are
	// both enabled, each flow log will include information about the process
	// that is sending or receiving the packets in that flow: the
	// `process_name` field will contain the full path of the process
	// executable, and the `process_args` field will have the arguments with
	// which the executable was invoked.  Process information will not be
	// reported for connections which use raw sockets.
	FlowLogsCollectProcessPath *bool `json:"flowLogsCollectProcessPath,omitempty" validate:"omitempty"`
	// When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be
	// printed in their entirety.
	FlowLogsCollectorDebugTrace *bool `json:"flowLogsCollectorDebugTrace,omitempty"`
	// FlowLogsFileEnabled when set to true, enables logging flow logs to a file. If false no flow logging to file will occur.
	FlowLogsFileEnabled *bool `json:"flowLogsFileEnabled,omitempty"`
	// FlowLogsFileMaxFiles sets the number of log files to keep.
	FlowLogsFileMaxFiles *int `json:"flowLogsFileMaxFiles,omitempty"`
	// FlowLogsFileMaxFileSizeMB sets the max size in MB of flow logs files before rotation.
	FlowLogsFileMaxFileSizeMB *int `json:"flowLogsFileMaxFileSizeMB,omitempty"`
	// FlowLogsFileDirectory sets the directory where flow logs files are stored.
	FlowLogsFileDirectory *string `json:"flowLogsFileDirectory,omitempty"`
	// FlowLogsFileIncludeLabels is used to configure if endpoint labels are included in a Flow log entry written to file.
	FlowLogsFileIncludeLabels *bool `json:"flowLogsFileIncludeLabels,omitempty"`
	// FlowLogsFileIncludePolicies is used to configure if policy information are included in a Flow log entry written to file.
	FlowLogsFileIncludePolicies *bool `json:"flowLogsFileIncludePolicies,omitempty"`
	// FlowLogsFileIncludeService is used to configure if the destination service is included in a Flow log entry written to file.
	// The service information can only be included if the flow was explicitly determined to be directed at the service (e.g.
	// when the pre-DNAT destination corresponds to the service ClusterIP and port).
	FlowLogsFileIncludeService *bool `json:"flowLogsFileIncludeService,omitempty"`
	// FlowLogsFileAggregationKindForAllowed is used to choose the type of aggregation for flow log entries created for
	// allowed connections. [Default: 2 - pod prefix name based aggregation].
	// Accepted values are 0, 1 and 2.
	// 0 - No aggregation
	// 1 - Source port based aggregation
	// 2 - Pod prefix name based aggreagation.
	FlowLogsFileAggregationKindForAllowed *int `json:"flowLogsFileAggregationKindForAllowed,omitempty" validate:"omitempty,flowLogAggregationKind"`
	// FlowLogsFileAggregationKindForDenied is used to choose the type of aggregation for flow log entries created for
	// denied connections. [Default: 1 - source port based aggregation].
	// Accepted values are 0, 1 and 2.
	// 0 - No aggregation
	// 1 - Source port based aggregation
	// 2 - Pod prefix name based aggregation.
	// 3 - No destination ports based aggregation
	FlowLogsFileAggregationKindForDenied *int `json:"flowLogsFileAggregationKindForDenied,omitempty" validate:"omitempty,flowLogAggregationKind"`
	// FlowLogsFileEnabledForAllowed is used to enable/disable flow logs entries created for allowed connections. Default is true.
	// This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.
	FlowLogsFileEnabledForAllowed *bool `json:"flowLogsFileEnabledForAllowed,omitempty"`
	// FlowLogsFileEnabledForDenied is used to enable/disable flow logs entries created for denied flows. Default is true.
	// This parameter only takes effect when FlowLogsFileReporterEnabled is set to true.
	FlowLogsFileEnabledForDenied *bool `json:"flowLogsFileEnabledForDenied,omitempty"`
	// FlowLogsDynamicAggregationEnabled is used to enable/disable dynamically changing aggregation levels. Default is true.
	FlowLogsDynamicAggregationEnabled *bool `json:"flowLogsDynamicAggregationEnabled,omitempty"`
	// FlowLogsPositionFilePath is used specify the position of the external pipeline that reads flow logs. Default is /var/log/calico/flows.log.pos.
	// This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
	FlowLogsPositionFilePath *string `json:"flowLogsPositionFilePath,omitempty"`
	// FlowLogsAggregationThresholdBytes is used specify how far behind the external pipeline that reads flow logs can be. Default is 8192 bytes.
	// This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
	FlowLogsAggregationThresholdBytes *int `json:"flowLogsAggregationThresholdBytes,omitempty"`
	// FlowLogsFilePerFlowProcessLimit, is used to specify the maximum number of flow log entries with distinct process information
	// beyond which process information will be aggregated. [Default: 2]
	FlowLogsFilePerFlowProcessLimit *int `json:"flowLogsFilePerFlowProcessLimit,omitempty" validate:"omitempty"`
	// FlowLogsFilePerFlowProcessArgsLimit is used to specify the maximum number of distinct process args that will appear in the flowLogs.
	// Default value is 5
	FlowLogsFilePerFlowProcessArgsLimit *int `json:"flowLogsFilePerFlowProcessArgsLimit,omitempty" validate:"omitempty"`
	// FlowLogsFileNatOutgoingPortLimit is used to specify the maximum number of distinct post SNAT ports that will appear
	// in the flowLogs. Default value is 3
	FlowLogsFileNatOutgoingPortLimit *int `json:"flowLogsFileNatOutgoingPortLimit,omitempty" validate:"omitempty"`

	// WindowsFlowLogsFileDirectory sets the directory where flow logs files are stored on Windows nodes. [Default: "c:\\TigeraCalico\\flowlogs"].
	WindowsFlowLogsFileDirectory string `json:"windowsFlowLogsFileDirectory,omitempty"`
	// WindowsFlowLogsPositionFilePath is used to specify the position of the external pipeline that reads flow logs on Windows nodes.
	// [Default: "c:\\TigeraCalico\\flowlogs\\flows.log.pos"].
	// This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true.
	WindowsFlowLogsPositionFilePath string `json:"windowsFlowLogsPositionFilePath,omitempty"`
	// WindowsStatsDumpFilePath is used to specify the path of the stats dump file on Windows nodes. [Default: "c:\\TigeraCalico\\stats\\dump"]
	WindowsStatsDumpFilePath string `json:"windowsStatsDumpFilePath,omitempty"`
	// The name of the file that Felix uses to preserve learnt DNS information when restarting. [Default:
	// "c:\\TigeraCalico\\felix-dns-cache.txt"].
	WindowsDNSCacheFile string `json:"windowsDnsCacheFile,omitempty"`
	// Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name
	// or IP's advertised TTL. The default value is 120s which is same as the default value of
	// ServicePointManager.DnsRefreshTimeout on .net framework. [Default: 120s].
	WindowsDNSExtraTTL *metav1.Duration `json:"windowsDnsExtraTTL,omitempty" configv1timescale:"seconds"`

	// The DNS servers that Felix should trust. Each entry here must be `<ip>[:<port>]` - indicating an
	// explicit DNS server IP - or `k8s-service:[<namespace>/]<name>[:port]` - indicating a Kubernetes DNS
	// service. `<port>` defaults to the first service port, or 53 for an IP, and `<namespace>` to
	// `kube-system`. An IPv6 address with a port must use the square brackets convention, for example
	// `[fd00:83a6::12]:5353`.Note that Felix (calico-node) will need RBAC permission to read the details of
	// each service specified by a `k8s-service:...` form. [Default: "k8s-service:kube-dns"].
	DNSTrustedServers *[]string `json:"dnsTrustedServers,omitempty" validate:"omitempty,dive,ipOrK8sService"`
	// The name of the file that Felix uses to preserve learnt DNS information when restarting. [Default:
	// "/var/run/calico/felix-dns-cache.txt"].
	DNSCacheFile string `json:"dnsCacheFile,omitempty"`
	// The periodic interval at which Felix saves learnt DNS information to the cache file. [Default:
	// 60s].
	DNSCacheSaveInterval *metav1.Duration `json:"dnsCacheSaveInterval,omitempty" configv1timescale:"seconds"`
	// An arbitrary number that can be changed, at runtime, to tell Felix to discard all its
	// learnt DNS information. [Default: 0].
	DNSCacheEpoch *int `json:"dnsCacheEpoch,omitempty"`
	// Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name
	// or IP's advertised TTL. [Default: 0s].
	DNSExtraTTL *metav1.Duration `json:"dnsExtraTTL,omitempty" configv1timescale:"seconds"`

	// DNSLogsFlushInterval configures the interval at which Felix exports DNS logs.
	// [Default: 300s]
	DNSLogsFlushInterval *metav1.Duration `json:"dnsLogsFlushInterval,omitempty" configv1timescale:"seconds"`
	// DNSLogsFileEnabled controls logging DNS logs to a file. If false no DNS logging to file will occur.
	// [Default: false]
	DNSLogsFileEnabled *bool `json:"dnsLogsFileEnabled,omitempty"`
	// DNSLogsFileMaxFiles sets the number of DNS log files to keep.
	// [Default: 5]
	DNSLogsFileMaxFiles *int `json:"dnsLogsFileMaxFiles,omitempty"`
	// DNSLogsFileMaxFileSizeMB sets the max size in MB of DNS log files before rotation.
	// [Default: 100]
	DNSLogsFileMaxFileSizeMB *int `json:"dnsLogsFileMaxFileSizeMB,omitempty"`
	// DNSLogsFileDirectory sets the directory where DNS log files are stored.
	// [Default: /var/log/calico/dnslogs]
	DNSLogsFileDirectory *string `json:"dnsLogsFileDirectory,omitempty"`
	// DNSLogsFileIncludeLabels is used to configure if endpoint labels are included in a DNS log entry written to file.
	// [Default: true]
	DNSLogsFileIncludeLabels *bool `json:"dnsLogsFileIncludeLabels,omitempty"`
	// DNSLogsFileAggregationKind is used to choose the type of aggregation for DNS log entries.
	// [Default: 1 - client name prefix aggregation].
	// Accepted values are 0 and 1.
	// 0 - No aggregation
	// 1 - Aggregate over clients with the same name prefix
	DNSLogsFileAggregationKind *int `json:"dnsLogsFileAggregationKind,omitempty" validate:"omitempty,dnsAggregationKind"`
	// Limit on the number of DNS logs that can be emitted within each flush interval.  When
	// this limit has been reached, Felix counts the number of unloggable DNS responses within
	// the flush interval, and emits a WARNING log with that count at the same time as it
	// flushes the buffered DNS logs.  [Default: 0, meaning no limit]
	DNSLogsFilePerNodeLimit *int `json:"dnsLogsFilePerNodeLimit,omitempty"`
	// DNSLogsLatency indicates to include measurements of DNS request/response latency in each DNS log.
	// [Default: true]
	DNSLogsLatency *bool `json:"dnsLogsLatency,omitempty"`

	// L7LogsFlushInterval configures the interval at which Felix exports L7 logs.
	// [Default: 300s]
	L7LogsFlushInterval *metav1.Duration `json:"l7LogsFlushInterval,omitempty" configv1timescale:"seconds"`
	// L7LogsFileEnabled controls logging L7 logs to a file. If false no L7 logging to file will occur.
	// [Default: true]
	L7LogsFileEnabled *bool `json:"l7LogsFileEnabled,omitempty"`
	// L7LogsFileMaxFiles sets the number of L7 log files to keep.
	// [Default: 5]
	L7LogsFileMaxFiles *int `json:"l7LogsFileMaxFiles,omitempty"`
	// L7LogsFileMaxFileSizeMB sets the max size in MB of L7 log files before rotation.
	// [Default: 100]
	L7LogsFileMaxFileSizeMB *int `json:"l7LogsFileMaxFileSizeMB,omitempty"`
	// L7LogsFileDirectory sets the directory where L7 log files are stored.
	// [Default: /var/log/calico/l7logs]
	L7LogsFileDirectory *string `json:"l7LogsFileDirectory,omitempty"`
	// L7LogsFileAggregationHTTPHeaderInfo is used to choose the type of aggregation for HTTP header data on L7 log entries.
	// [Default: ExcludeL7HTTPHeaderInfo - http header info removal].
	// Accepted values are IncludeL7HTTPHeaderInfo and ExcludeL7HTTPHeaderInfo.
	// IncludeL7HTTPHeaderInfo - Include HTTP header data in the logs.
	// ExcludeL7HTTPHeaderInfo - Aggregate over all other fields ignoring the user agent and log type.
	L7LogsFileAggregationHTTPHeaderInfo *string `json:"l7LogsFileAggregationHTTPHeaderInfo,omitempty" validate:"omitempty,l7HTTPHeaderAggregation"`
	// L7LogsFileAggregationHTTPMethod is used to choose the type of aggregation for the HTTP request method on L7 log entries.
	// [Default: IncludeL7HTTPMethod - include the HTTP method].
	// Accepted values are IncludeL7HTTPMethod and ExcludeL7HTTPMethod.
	// IncludeL7HTTPMethod - Include HTTP method in the logs.
	// ExcludeL7HTTPMethod - Aggregate over all other fields ignoring the HTTP method.
	L7LogsFileAggregationHTTPMethod *string `json:"l7LogsFileAggregationHTTPMethod,omitempty" validate:"omitempty,l7HTTPMethodAggregation"`
	// L7LogsFileAggregationServiceInfo is used to choose the type of aggregation for the service data on L7 log entries.
	// [Default: IncludeL7ServiceInfo - include service data].
	// Accepted values are IncludeL7ServiceInfo and ExcludeL7ServiceInfo.
	// IncludeL7ServiceInfo - Include service data in the logs.
	// ExcludeL7ServiceInfo - Aggregate over all other fields ignoring the service name, namespace, and port.
	L7LogsFileAggregationServiceInfo *string `json:"l7LogsFileAggregationServiceInfo,omitempty" validate:"omitempty,l7ServiceAggregation"`
	// L7LogsFileAggregationDestinationInfo is used to choose the type of aggregation for the destination metadata on L7 log entries.
	// [Default: IncludeL7DestinationInfo - include destination metadata].
	// Accepted values are IncludeL7DestinationInfo and ExcludeL7DestinationInfo.
	// IncludeL7DestinationInfo - Include destination metadata in the logs.
	// ExcludeL7DestinationInfo - Aggregate over all other fields ignoring the destination aggregated name, namespace, and type.
	L7LogsFileAggregationDestinationInfo *string `json:"l7LogsFileAggregationDestinationInfo,omitempty" validate:"omitempty,l7DestinationAggregation"`
	// L7LogsFileAggregationExcludeSourceInfo is used to choose the type of aggregation for the source metadata on L7 log entries.
	// [Default: IncludeL7SourceInfoNoPort - include all source metadata except for the source port].
	// Accepted values are IncludeL7SourceInfo, IncludeL7SourceInfoNoPort, and ExcludeL7SourceInfo.
	// IncludeL7SourceInfo - Include source metadata in the logs.
	// IncludeL7SourceInfoNoPort - Include source metadata in the logs excluding the source port.
	// ExcludeL7SourceInfo - Aggregate over all other fields ignoring the source aggregated name, namespace, and type.
	L7LogsFileAggregationSourceInfo *string `json:"l7LogsFileAggregationSourceInfo,omitempty" validate:"omitempty,l7SourceAggregation"`
	// L7LogsFileAggregationResponseCode is used to choose the type of aggregation for the response code on L7 log entries.
	// [Default: IncludeL7ResponseCode - include the response code].
	// Accepted values are IncludeL7ResponseCode and ExcludeL7ResponseCode.
	// IncludeL7ResponseCode - Include the response code in the logs.
	// ExcludeL7ResponseCode - Aggregate over all other fields ignoring the response code.
	L7LogsFileAggregationResponseCode *string `json:"l7LogsFileAggregationResponseCode,omitempty" validate:"omitempty,l7ResponseCodeAggregation"`
	// L7LogsFileAggregationTrimURL is used to choose the type of aggregation for the url on L7 log entries.
	// [Default: IncludeL7FullURL - include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath].
	// Accepted values are 0 and 1.
	// IncludeL7FullURL - Include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath.
	// TrimURLQuery - Aggregate over all other fields ignoring the query parameters on the URL.
	// TrimURLQueryAndPath - Aggregate over all other fields and the base URL only.
	// ExcludeL7URL - Aggregate over all other fields ignoring the URL entirely.
	L7LogsFileAggregationTrimURL *string `json:"l7LogsFileAggregationTrimURL,omitempty" validate:"omitempty,l7URLAggregation"`
	// L7LogsFileAggregationNumURLPath is used to choose the number of components in the url path to display.
	// This allows for the url to be truncated in case parts of the path provide no value. Setting this value
	// to negative will allow all parts of the path to be displayed.
	// [Default: 5].
	L7LogsFileAggregationNumURLPath *int `json:"l7LogsFileAggregationNumURLPath,omitempty"`
	// Limit on the length of the URL collected in L7 logs. When a URL length reaches this limit
	// it is sliced off, and the sliced URL is sent to log storage. [Default: 250]
	L7LogsFileAggregationURLCharLimit *int `json:"l7LogsFileAggregationURLCharLimit,omitempty"`
	// Limit on the number of L7 logs that can be emitted within each flush interval.  When
	// this limit has been reached, Felix counts the number of unloggable L7 responses within
	// the flush interval, and emits a WARNING log with that count at the same time as it
	// flushes the buffered L7 logs. A value of 0 means no limit. [Default: 1500]
	L7LogsFilePerNodeLimit *int `json:"l7LogsFilePerNodeLimit,omitempty"`

	// WindowsNetworkName specifies which Windows HNS networks Felix should operate on.  The default is to match
	// networks that start with "calico".  Supports regular expression syntax.
	WindowsNetworkName *string `json:"windowsNetworkName,omitempty"`

	// RouteSource configures where Felix gets its routing information.
	// - WorkloadIPs: use workload endpoints to construct routes.
	// - CalicoIPAM: the default - use IPAM data to construct routes.
	RouteSource string `json:"routeSource,omitempty" validate:"omitempty,routeSource"`

	// Calico programs additional Linux route tables for various purposes.
	// RouteTableRanges specifies a set of table index ranges that Calico should use.
	// Deprecates`RouteTableRange`, overrides `RouteTableRange`.
	RouteTableRanges *RouteTableRanges `json:"routeTableRanges,omitempty" validate:"omitempty,dive"`

	// Deprecated in favor of RouteTableRanges.
	// Calico programs additional Linux route tables for various purposes.
	// RouteTableRange specifies the indices of the route tables that Calico should use.
	RouteTableRange *RouteTableRange `json:"routeTableRange,omitempty" validate:"omitempty"`

	// EgressIPSupport defines three different support modes for egress IP function. [Default: Disabled]
	// - Disabled:                    Egress IP function is disabled.
	// - EnabledPerNamespace:         Egress IP function is enabled and can be configured on a per-namespace basis;
	//                                per-pod egress annotations are ignored.
	// - EnabledPerNamespaceOrPerPod: Egress IP function is enabled and can be configured per-namespace or per-pod,
	//                                with per-pod egress annotations overriding namespace annotations.
	EgressIPSupport string `json:"egressIPSupport,omitempty" validate:"omitempty,oneof=Disabled EnabledPerNamespace EnabledPerNamespaceOrPerPod"`
	// EgressIPVXLANPort is the port number of vxlan tunnel device for egress traffic. [Default: 4790]
	EgressIPVXLANPort *int `json:"egressIPVXLANPort,omitempty"`
	// EgressIPVXLANVNI is the VNI ID of vxlan tunnel device for egress traffic. [Default: 4097]
	EgressIPVXLANVNI *int `json:"egressIPVXLANVNI,omitempty"`
	// EgressIPRoutingRulePriority controls the priority value to use for the egress IP routing rule. [Default: 100]
	EgressIPRoutingRulePriority *int `json:"egressIPRoutingRulePriority,omitempty" validate:"omitempty,gt=0,lt=32766"`

	// WireguardEnabled controls whether Wireguard is enabled. [Default: false]
	WireguardEnabled *bool `json:"wireguardEnabled,omitempty"`
	// WireguardListeningPort controls the listening port used by Wireguard. [Default: 51820]
	WireguardListeningPort *int `json:"wireguardListeningPort,omitempty" validate:"omitempty,gt=0,lte=65535"`
	// WireguardRoutingRulePriority controls the priority value to use for the Wireguard routing rule. [Default: 99]
	WireguardRoutingRulePriority *int `json:"wireguardRoutingRulePriority,omitempty" validate:"omitempty,gt=0,lt=32766"`
	// WireguardInterfaceName specifies the name to use for the Wireguard interface. [Default: wg.calico]
	WireguardInterfaceName string `json:"wireguardInterfaceName,omitempty" validate:"omitempty,interface"`
	// WireguardMTU controls the MTU on the Wireguard interface. See Configuring MTU [Default: 1420]
	WireguardMTU *int `json:"wireguardMTU,omitempty"`
	// WireguardHostEncryptionEnabled controls whether Wireguard host-to-host encryption is enabled. [Default: false]
	WireguardHostEncryptionEnabled *bool `json:"wireguardHostEncryptionEnabled,omitempty"`
	// WireguardKeepAlive controls Wireguard PersistentKeepalive option. Set 0 to disable. [Default: 0]
	WireguardPersistentKeepAlive *metav1.Duration `json:"wireguardKeepAlive,omitempty"`

	// +kubebuilder:validation:MinLength=1
	// CaptureDir controls directory to store file capture. [Default: /var/log/calico/pcap]
	CaptureDir *string `json:"captureDir,omitempty" validate:"omitempty,gt=0"`

	// +kubebuilder:validation:Minimum=1
	// CaptureMaxSizeBytes controls the max size of a file capture. [Default: 10000000]
	CaptureMaxSizeBytes *int `json:"captureMaxSizeBytes,omitempty" validate:"omitempty,gt=0"`

	// +kubebuilder:validation:Minimum=1
	// CaptureRotationSeconds controls the time rotation of a packet capture. [Default: 3600]
	CaptureRotationSeconds *int `json:"captureRotationSeconds,omitempty" validate:"omitempty,gt=0"`

	// +kubebuilder:validation:Minimum=1
	// CaptureMaxFiles controls number of rotated capture file to keep. [Default: 2]
	CaptureMaxFiles *int `json:"captureMaxFiles,omitempty" validate:"omitempty,gt=0"`

	// Set source-destination-check on AWS EC2 instances. Accepted value must be one of "DoNothing", "Enable" or "Disable".
	// [Default: DoNothing]
	AWSSrcDstCheck *AWSSrcDstCheckOption `json:"awsSrcDstCheck,omitempty" validate:"omitempty,oneof=DoNothing Enable Disable"`
	// AWSSecondaryIPSupport controls whether Felix will try to provision AWS secondary ENIs and secondary IPs for
	// workloads that have IPs from IP pools that are configured with an AWS subnet ID. [Default: Disabled]
	AWSSecondaryIPSupport string `json:"awsSecondaryIPSupport,omitempty" validate:"omitempty,oneof=Enabled Disabled"`
	// AWSSecondaryIPRoutingRulePriority controls the priority that Felix will use for routing rules when programming
	// them for AWS Secondary IP support. [Default: 101]
	AWSSecondaryIPRoutingRulePriority *int `json:"awsSecondaryIPRoutingRulePriority,omitempty" validate:"omitempty,gte=0,lte=4294967295"`
	// AWSRequestTimeout is the timeout on AWS API requests. [Default: 30s]
	AWSRequestTimeout *metav1.Duration `json:"awsRequestTimeout,omitempty" configv1timescale:"seconds"`

	// When service IP advertisement is enabled, prevent routing loops to service IPs that are
	// not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy.
	// Unless set to "Disabled", in which case such routing loops continue to be allowed.
	// [Default: Drop]
	ServiceLoopPrevention string `json:"serviceLoopPrevention,omitempty" validate:"omitempty,oneof=Drop Reject Disabled"`

	// MTUIfacePattern is a regular expression that controls which interfaces Felix should scan in order
	// to calculate the host's MTU.
	// This should not match workload interfaces (usually named cali...).
	// +optional
	MTUIfacePattern string `json:"mtuIfacePattern,omitempty" validate:"omitempty,regexp"`

	// TPROXYMode sets whether traffic is directed through a transparent proxy
	// for further processing or not and how is the proxying done.
	// [Default: Disabled]
	TPROXYMode string `json:"tproxyMode,omitempty" validate:"omitempty,oneof=Disabled Enabled EnabledAllServices"`
	// TPROXYPort sets to which port proxied traffic should be redirected.
	// [Default: 16001]
	TPROXYPort *int `json:"tproxyPort,omitempty" validate:"omitempty,gt=0,lte=65535"`
	// TPROXYUpstreamConnMark tells Felix which mark is used by the proxy for its upstream
	// connections so that Felix can program the dataplane correctly.  [Default: 0x17]
	TPROXYUpstreamConnMark *uint32 `json:"tproxyUpstreamConnMark,omitempty" validate:"omitempty,gt=0`
}

type FlowEndpoint struct {
	// The endpoint type, indicating whether this is a Pod, HostEndpoint, NetworkSet, or internet.
	Kind string `json:"kind"`

	// The name of the endpoint. Note that this name may actually be a name prefix if flow logs have
	// been aggregated.
	Name string `json:"name"`

	// Whether the name is an aggregation prefix rather than the actual name.
	NameIsAggregationPrefix bool `json:"nameIsAggregationPrefix,omitempty"`

	// The namespace of the endpoint.
	Namespace string `json:"namespace,omitempty"`
}

type GlobalAlert struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object's metadata.
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// Specification of the GlobalAlert.
	Spec   GlobalAlertSpec   `json:"spec,omitempty"`
	Status GlobalAlertStatus `json:"status,omitempty"`
}

type GlobalAlertList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []GlobalAlert `json:"items"`
}

type GlobalAlertSpec struct {
	// Type will dictate how the fields of the GlobalAlert will be utilized.
	// Each Type will have different usages and defaults for the fields. [Default: UserDefined]
	Type GlobalAlertType `json:"type,omitempty" validate:"omitempty,globalAlertType"`
	// Template for the description field in generated events, description is used if this is omitted.
	Summary string `json:"summary,omitempty" validate:"omitempty"`
	// Human-readable description of the template.
	Description string `json:"description" validate:"required"`
	// Detector specifies the AnomalyDetection Detector to run.
	// Required and used only if Type is AnomalyDetection.
	Detector string `json:"detector,omitempty" validate:"omitempty"`
	// Severity of the alert for display in Manager.
	Severity int `json:"severity" validate:"required,min=1,max=100"`
	// If Type is UserDefined, it is how often the query defined will run.
	// If Type is AnomalyDetection it is how often the detector will be run.
	Period *metav1.Duration `json:"period,omitempty" validate:"omitempty"`
	// How much data to gather at once.
	// If Type is UserDefined, it must exceed audit log flush interval, dnsLogsFlushInterval, or flowLogsFlushInterval as appropriate.
	Lookback *metav1.Duration `json:"lookback,omitempty" validate:"omitempty"`
	// DataSet determines which dataset type the Query will use.
	// Required and used only if Type is UserDefined.
	DataSet string `json:"dataSet" validate:"omitempty,oneof=flows dns audit l7 waf vulnerability"`
	// Which data to include from the source data set. Written in a domain-specific query language. Only used if Type is UserDefined.
	Query string `json:"query,omitempty" validate:"omitempty"`
	// An optional list of fields to aggregate results.
	// Only used if Type is UserDefined.
	AggregateBy []string `json:"aggregateBy,omitempty" validate:"omitempty"`
	// Which field to aggregate results by if using a metric other than count.
	// Only used if Type is UserDefined.
	Field string `json:"field,omitempty" validate:"omitempty"`
	// A metric to apply to aggregated results. count is the number of log entries matching the aggregation pattern.
	// Others are applied only to numeric fields in the logs.
	// Only used if Type is UserDefined.
	Metric string `json:"metric,omitempty" validate:"omitempty,oneof=avg max min sum count"`
	// Compare the value of the metric to the threshold using this condition.
	// Only used if Type is UserDefined.
	Condition string `json:"condition,omitempty" validate:"omitempty,oneof=eq not_eq gt gte lt lte"`
	// A numeric value to compare the value of the metric against.
	// Only used if Type is UserDefined.
	Threshold float64 `json:"threshold,omitempty" validate:"omitempty"`
	// An optional list of values to replace variable names in query.
	// Only used if Type is UserDefined.
	Substitutions []GlobalAlertSubstitution `json:"substitutions,omitempty" validate:"omitempty"`
}

type GlobalAlertStatus struct {
	LastUpdate      *metav1.Time     `json:"lastUpdate,omitempty"`
	Active          bool             `json:"active"`
	Healthy         bool             `json:"healthy"`
	LastExecuted    *metav1.Time     `json:"lastExecuted,omitempty"`
	LastEvent       *metav1.Time     `json:"lastEvent,omitempty"`
	ErrorConditions []ErrorCondition `json:"errorConditions,omitempty"`
}

type GlobalAlertSubstitution struct {
	Name   string   `json:"name" validate:"required"`
	Values []string `json:"values,omitempty"`
}

type GlobalAlertTemplate struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object's metadata.
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// Specification of the GlobalAlert.
	Spec GlobalAlertSpec `json:"spec,omitempty"`
}

type GlobalAlertTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []GlobalAlertTemplate `json:"items"`
}

type GlobalAlertType string

type GlobalNetworkPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Spec GlobalNetworkPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

type GlobalNetworkPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	Items []GlobalNetworkPolicy `json:"items" protobuf:"bytes,2,rep,name=items"`
}

type GlobalNetworkPolicySpec struct {
	// The name of the tier that this policy belongs to.  If this is omitted, the default
	// tier (name is "default") is assumed.  The specified tier must exist in order to create
	// security policies within the tier, the "default" tier is created automatically if it
	// does not exist, this means for deployments requiring only a single Tier, the tier name
	// may be omitted on all policy management requests.
	Tier string `json:"tier,omitempty" validate:"omitempty,name"`
	// Order is an optional field that specifies the order in which the policy is applied.
	// Policies with higher "order" are applied after those with lower
	// order within the same tier.  If the order is omitted, it may be considered to be "infinite" - i.e. the
	// policy will be applied last.  Policies with identical order will be applied in
	// alphanumerical order based on the Policy "Name" within the tier.
	Order *float64 `json:"order,omitempty"`
	// The ordered set of ingress rules.  Each rule contains a set of packet match criteria and
	// a corresponding action to apply.
	Ingress []Rule `json:"ingress,omitempty" validate:"omitempty,dive"`
	// The ordered set of egress rules.  Each rule contains a set of packet match criteria and
	// a corresponding action to apply.
	Egress []Rule `json:"egress,omitempty" validate:"omitempty,dive"`
	// The selector is an expression used to pick pick out the endpoints that the policy should
	// be applied to.
	//
	// Selector expressions follow this syntax:
	//
	// 	label == "string_literal"  ->  comparison, e.g. my_label == "foo bar"
	// 	label != "string_literal"   ->  not equal; also matches if label is not present
	// 	label in { "a", "b", "c", ... }  ->  true if the value of label X is one of "a", "b", "c"
	// 	label not in { "a", "b", "c", ... }  ->  true if the value of label X is not one of "a", "b", "c"
	// 	has(label_name)  -> True if that label is present
	// 	! expr -> negation of expr
	// 	expr && expr  -> Short-circuit and
	// 	expr || expr  -> Short-circuit or
	// 	( expr ) -> parens for grouping
	// 	all() or the empty selector -> matches all endpoints.
	//
	// Label names are allowed to contain alphanumerics, -, _ and /. String literals are more permissive
	// but they do not support escape characters.
	//
	// Examples (with made-up labels):
	//
	// 	type == "webserver" && deployment == "prod"
	// 	type in {"frontend", "backend"}
	// 	deployment != "dev"
	// 	! has(label_name)
	Selector string `json:"selector,omitempty" validate:"selector"`
	// Types indicates whether this policy applies to ingress, or to egress, or to both.  When
	// not explicitly specified (and so the value on creation is empty or nil), Calico defaults
	// Types according to what Ingress and Egress rules are present in the policy.  The
	// default is:
	//
	// - [ PolicyTypeIngress ], if there are no Egress rules (including the case where there are
	//   also no Ingress rules)
	//
	// - [ PolicyTypeEgress ], if there are Egress rules but no Ingress rules
	//
	// - [ PolicyTypeIngress, PolicyTypeEgress ], if there are both Ingress and Egress rules.
	//
	// When the policy is read back again, Types will always be one of these values, never empty
	// or nil.
	Types []PolicyType `json:"types,omitempty" validate:"omitempty,dive,policyType"`

	// DoNotTrack indicates whether packets matched by the rules in this policy should go through
	// the data plane's connection tracking, such as Linux conntrack.  If True, the rules in
	// this policy are applied before any data plane connection tracking, and packets allowed by
	// this policy are marked as not to be tracked.
	DoNotTrack bool `json:"doNotTrack,omitempty"`
	// PreDNAT indicates to apply the rules in this policy before any DNAT.
	PreDNAT bool `json:"preDNAT,omitempty"`
	// ApplyOnForward indicates to apply the rules in this policy on forward traffic.
	ApplyOnForward bool `json:"applyOnForward,omitempty"`

	// ServiceAccountSelector is an optional field for an expression used to select a pod based on service accounts.
	ServiceAccountSelector string `json:"serviceAccountSelector,omitempty" validate:"selector"`

	// NamespaceSelector is an optional field for an expression used to select a pod based on namespaces.
	NamespaceSelector string `json:"namespaceSelector,omitempty" validate:"selector"`
}