v1alpha1

type AAOAccountAcceptanceCriteria struct {
	Namespace string `json:"namespace"`
}

type AcceptanceCriteria struct {
	// AwsAccountOperatorAccount will accept VPC Endpoint Connections that were requested from an AWS
	// account that matches AWS accounts defined in account.aws.managed.openshift.io custom resources
	AwsAccountOperatorAccount *AAOAccountAcceptanceCriteria `json:"awsAccountOperatorAccount,omitempty"`

	// AlwaysAccept will instruct the controller to accept any VPC Endpoint Connections
	AlwaysAccept bool `json:"alwaysAccept,omitempty"`
}

type AvoConfig struct {
	metav1.TypeMeta `json:",inline"`

	// ControllerManagerConfigurationSpec returns the configurations for controllers
	cfg.ControllerManagerConfigurationSpec `json:",inline"`

	// EnableVpcEndpointController is a feature flag to determine whether the VpcEndpoint controller runs.
	// Defaults to true
	EnableVpcEndpointController *bool `json:"enableVpcEndpointController,omitempty"`

	// EnableVpcEndpointAcceptanceController is a feature flag to determine whether the VpcEndpointAcceptance controller runs
	// Defaults to false
	EnableVpcEndpointAcceptanceController *bool `json:"enableVpcEndpointAcceptanceController,omitempty"`

	// EnableVpcEndpointTemplateController is a feature flag to determine whether the VpcEndpointTemplate controller runs
	// Defaults to false
	EnableVpcEndpointTemplateController *bool `json:"enableVpcEndpointTemplateController,omitempty"`
}

type AvoConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AvoConfig `json:"items"`
}

type ExternalNameServiceSpec struct {
	// Name of the ExternalName service to create in the same namespace as the VPCE CR
	Name string `json:"name"`
}

type SecurityGroup struct {
	// IngressRules is a list of security group ingress rules.
	// They will be allowed for the master and worker security groups.
	// +optional
	IngressRules []SecurityGroupRule `json:"ingressRules,omitempty"`

	// EgressRules is a list of security group egress rules
	// They will be allowed for the master and worker security groups.
	// +optional
	EgressRules []SecurityGroupRule `json:"egressRules,omitempty"`
}

type SecurityGroupRule struct {
	// FromPort and ToPort are the start and end of the port range to allow.
	// To allow a single port, set both to the same value.
	FromPort int32 `json:"fromPort,omitempty"`

	// FromPort and ToPort are the start and end of the port range to allow
	// To allow a single port, set both to the same value.
	ToPort int32 `json:"toPort,omitempty"`

	// Protocol is the IP protocol, tcp | udp | icmp | all
	Protocol string `json:"protocol,omitempty"`
}

type VpcEndpoint struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   VpcEndpointSpec   `json:"spec,omitempty"`
	Status VpcEndpointStatus `json:"status,omitempty"`
}

type VpcEndpointAcceptance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   VpcEndpointAcceptanceSpec   `json:"spec,omitempty"`
	Status VpcEndpointAcceptanceStatus `json:"status,omitempty"`
}

type VpcEndpointAcceptanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []VpcEndpointAcceptance `json:"items"`
}

type VpcEndpointAcceptanceSpec struct {
	// Id is the AWS ID of the VPC Endpoint Service for this controller to poll
	Id string `json:"id"`

	// AssumeRoleArn is the ARN of an AWS IAM role in the same account as the specified VPC Endpoint Service.
	// This is necessary if the IAM entity available to the controller is not in the same AWS account as the
	// VPC Endpoint Service.
	AssumeRoleArn string `json:"assumeRoleArn,omitempty"`

	// Region is the AWS region that contains the specified VPC Endpoint Service
	Region string `json:"region"`

	// AcceptanceCriteria
	AcceptanceCriteria AcceptanceCriteria `json:"acceptanceCriteria"`
}

type VpcEndpointAcceptanceStatus struct {
}

type VpcEndpointList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []VpcEndpoint `json:"items"`
}

type VpcEndpointSpec struct {

	// ServiceName is the name of the VPC Endpoint Service to connect to
	ServiceName string `json:"serviceName"`

	// SecurityGroup contains the configuration of the security group attached to the VPC Endpoint
	SecurityGroup SecurityGroup `json:"securityGroup"`

	// +kubebuilder:validation:Pattern=[a-z0-9]([-a-z0-9]*[a-z0-9])?
	// SubdomainName is the name of the Route53 Hosted Zone CNAME rule to create in the cluster's
	// Private Route53 Hosted Zone
	SubdomainName string `json:"subdomainName"`

	// ExternalNameService configures the name and namespace of the created Kubernetes ExternalName Service
	ExternalNameService ExternalNameServiceSpec `json:"externalNameService"`

	// AddtlHostedZoneName is an optional FQDN to support supplemental VPCE routing via Route53 Private Hosted Zone
	// +optional
	AddtlHostedZoneName string `json:"addtlHostedZoneName,omitempty"`
}

type VpcEndpointStatus struct {
	// Status of the VPC Endpoint
	Status string `json:"status,omitempty"`

	// The AWS ID of the managed security group
	// +optional
	SecurityGroupId string `json:"securityGroupId,omitempty"`

	// The AWS ID of the managed VPC Endpoint
	// +optional
	VPCEndpointId string `json:"vpcEndpointId,omitempty"`

	// The status conditions of the AWS and K8s resources managed by this controller
	// +optional
	Conditions []metav1.Condition `json:"conditions"`
}