v1alpha2

type AssociatedVpc struct {
	// CredentialsSecretRef references a Kubernetes secret with the keys: "aws_access_key_id" and
	// "aws_secret_access_key" which has the permissions to perform route53:AssociateVpcWithHostedZone and
	// ec2:DescribeVpcs
	CredentialsSecretRef *corev1.SecretReference `json:"credentialsSecretRef"`
	// VpcId is the ID of the VPC to associate to the Route 53 Private Hosted Zone
	VpcId string `json:"vpcId"`
	// Region is the AWS Region the VPC exists in
	Region string `json:"region"`
}

type AwsEndpointSelector struct {
	Name string `json:"name"`
}

type CustomDns struct {
	// Route53PrivateHostedZone configures an AWS Route 53 Private Hosted Zone with a route to the created VPCE.
	Route53PrivateHostedZone Route53PrivateHostedZone `json:"route53PrivateHostedZone,omitempty"`
}

type DnsSelector struct {
	// Name of the config.openshift.io/v1 DNS custom resource to select
	Name string `json:"name"`
}

type DomainName struct {
	// Name specifies the base domain name directly
	Name string `json:"name,omitempty"`

	// ValueFrom allows the base domain name to be read from a source
	ValueFrom *DomainNameSource `json:"valueFrom,omitempty"`
}

type DomainNameSource struct {
	// A reference to a config.openshift.io/v1 DNS custom resource
	DnsRef *DnsSelector `json:"dnsRef,omitempty"`

	// A reference to a hypershift.openshift.io/v1beta1 HostedControlPlane custom resource
	HostedControlPlaneRef *HostedControlPlaneSelector `json:"hostedControlPlaneRef,omitempty"`
}

type ExternalNameService struct {
	// Name of the ExternalName service to create in the same namespace as the VPCE Custom Resource
	Name string `json:"name"`
}

type HostedControlPlaneSelector struct {
	// Path of the field containing the namespace of the hostedcontrolplane, typically ".metadata.namespace" to select
	// the same namespace as the VpcEndpoint itself
	NamespaceFieldRef *ObjectFieldSelector `json:"namespaceFieldRef,omitempty"`
}

type ObjectFieldSelector struct {

	// Path of the field to select
	FieldPath string `json:"fieldPath"`
}

type Route53HostedZoneRecord struct {
	// Hostname is the hostname of the record.
	Hostname string `json:"hostname"`

	ExternalNameService ExternalNameService `json:"externalNameService,omitempty"`
}

type Route53PrivateHostedZone struct {

	// AutoDiscover will use the existing ROSA cluster's Route 53 Private Hosted Zone
	AutoDiscover bool `json:"autoDiscoverPrivateHostedZone,omitempty"`

	// AssociatedVpc represents configuration for associating the created Route53 Private Hosted Zone to additional VPCs
	// Ref: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-associate-vpcs-different-accounts.html
	AssociatedVpcs []AssociatedVpc `json:"associatedVpcs,omitempty"`

	// DomainName specifies the domain name of a Route 53 Private Hosted Zone to create
	DomainName string `json:"domainName,omitempty"`

	// DomainNameRef is an alternative to DomainName when the domain name of a Route 53 Private Hosted Zone is read from
	// another source
	DomainNameRef *DomainName `json:"domainNameRef,omitempty"`

	// Id specifies the AWS ID of an existing Route 53 Private Hosted Zone to use
	Id string `json:"id,omitempty"`

	// Record is the configuration of a record within the selected Route 53 Private Hosted Zone
	Record Route53HostedZoneRecord `json:"record,omitempty"`
}

type SecurityGroup struct {
	// IngressRules is a list of security group ingress rules.
	// They will be allowed for the master and worker security groups.
	// +optional
	IngressRules []SecurityGroupRule `json:"ingressRules,omitempty"`

	// EgressRules is a list of security group egress rules
	// They will be allowed for the master and worker security groups.
	// +optional
	EgressRules []SecurityGroupRule `json:"egressRules,omitempty"`
}

type SecurityGroupRule struct {

	// CidrIp is the IPv4 address range, in CIDR format, to allow.
	// If not specified, the cluster's master and worker security group are allowed instead.
	CidrIp string `json:"cidrIp,omitempty"`

	// FromPort and ToPort are the start and end of the port range to allow.
	// In the case of a single port, set both to the same value.
	FromPort int32 `json:"fromPort,omitempty"`

	// FromPort and ToPort are the start and end of the port range to allow.
	// In the case of a single port, set both to the same value.
	ToPort int32 `json:"toPort,omitempty"`

	// Protocol is the IP protocol, tcp | udp | icmp | all
	Protocol string `json:"protocol,omitempty"`
}

type ServiceName struct {
	Name      string             `json:"name,omitempty"`
	ValueFrom *ServiceNameSource `json:"valueFrom,omitempty"`
}

type ServiceNameSource struct {
	AwsEndpointServiceRef *AwsEndpointSelector `json:"awsEndpointServiceRef,omitempty"`
}

type Tag struct {
	// Key of an AWS tag
	Key string `json:"key"`

	// Value of an AWS tag
	Value string `json:"value"`
}

type Vpc struct {

	// AutoDiscoverSubnets will instruct the controller to use the subnets associated with this ROSA cluster if true
	// using the tag-key: "kubernetes.io/cluster/${infraName}". If .spec.vpc.ids or spec.vpc.tags is specified, the
	// tag-key "kubernetes.io/role/internal-elb" will be used instead.
	AutoDiscoverSubnets bool `json:"autoDiscoverSubnets,omitempty"`

	// SubnetIds is a list of subnet ids to associate with the VPC Endpoint, which must all be in the same VPC.
	// If more than one is specified, each subnet must be in a different Availability Zone.
	// Ref: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html
	SubnetIds []string `json:"subnetIds,omitempty"`

	// Ids is a list of VPC ids that aws-vpce-operator can choose from to load balance in a "least used"
	// fashion to evenly spread quota usage across provided VPCs. All provided VPCs must be in the
	// same region as the specified VPC Endpoint Service (.spec.serviceName) and must use subnet auto-discovery
	// (.spec.vpc.autoDiscoverSubnets true) based on the "kubernetes.io/role/internal-elb" tag key
	Ids []string `json:"ids,omitempty"`

	// Tags is a list of AWS tag key-value pairs to find VPCs with. This is mutually exclusive with
	// .spec.vpc.ids and can only be specified with .spec.vpc.autoDiscoverSubnets = true.
	Tags []Tag `json:"tags,omitempty"`

	// SubnetTags is a list of AWS tag key-value pairs to additionally filter private-subnets with. The main tags used
	// when filtering subnets is controlled by .spec.vpc.autoDiscoverSubnets
	SubnetTags []Tag `json:"subnetTags,omitempty"`
}

type VpcEndpoint struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   VpcEndpointSpec   `json:"spec,omitempty"`
	Status VpcEndpointStatus `json:"status,omitempty"`
}

type VpcEndpointList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []VpcEndpoint `json:"items"`
}

type VpcEndpointSpec struct {
	// ServiceName is the name of the VPC Endpoint Service to connect to
	ServiceName string `json:"serviceName,omitempty"`

	// ServiceNameRef refers to a group and resource that contains the name of the VPC Endpoint Service
	ServiceNameRef *ServiceName `json:"serviceNameRef,omitempty"`

	// SecurityGroup contains the configuration of the security group attached to the VPC Endpoint
	SecurityGroup SecurityGroup `json:"securityGroup"`

	// AssumeRoleArn will allow AVO to use sts:AssumeRole to create VPC Endpoints in separate AWS Accounts
	// TODO: Implement
	AssumeRoleArn string `json:"assumeRoleArn,omitempty"`

	// AWSCredentialOverride is a Kubernetes secret containing AWS credentials for the operator to use for reconciling
	// this specific vpcendpoint Custom Resource.
	// The secret should have data keys for either:
	// * role_arn: The operator will attempt to assume this role
	// * aws_access_key_id and aws_secret_access_key: The operator will simply use these IAM User credentials
	AWSCredentialOverrideRef *corev1.SecretReference `json:"awsCredentialOverrideRef,omitempty"`

	// Region will allow AVO to create VPC Endpoints and other AWS infrastructure in a specific region
	// Defaults to the same region as the cluster AVO is running on
	Region string `json:"region,omitempty"`

	// EnablePrivateDns will allow AVO to create VPC Endpoints with private DNS names specified by a VPC Endpoint Service
	// https://docs.aws.amazon.com/vpc/latest/privatelink/manage-dns-names.html (defaults to false)
	// TODO: Implement
	EnablePrivateDns bool `json:"enablePrivateDns,omitempty"`

	// Vpc will allow AVO to use a specific VPC or use the same VPC as the ROSA cluster it's running on
	Vpc Vpc `json:"vpc,omitempty"`

	// CustomDns will define configurations for all other custom DNS setups, such as a separate Route 53 Private Hosted
	// Zone or an `ExternalName` Kubernetes service.
	CustomDns CustomDns `json:"customDns,omitempty"`
}

type VpcEndpointStatus struct {
	// Status of the VPC Endpoint
	Status string `json:"status,omitempty"`

	// The AWS ID of the managed security group
	// +kubebuilder:validation:Optional
	SecurityGroupId string `json:"securityGroupId,omitempty"`

	// The AWS ID of the VPC to create resources in
	// +kubebuilder:validation:Optional
	VPCId string `json:"vpcId,omitempty"`

	// The AWS ID of the managed VPC Endpoint
	// +kubebuilder:validation:Optional
	VPCEndpointId string `json:"vpcEndpointId,omitempty"`

	// The name of the VPC Endpoint Service the VPC Endpoint connects to
	// +kubebuilder:validation:Optional
	VPCEndpointServiceName string `json:"vpcEndpointServiceName,omitempty"`

	// The AWS ID of the Route 53 Private Hosted Zone being used
	// +kubebuilder:validation:Optional
	HostedZoneId string `json:"hostedZoneId,omitempty"`

	// The FQDN of a Route 53 Hosted Zone record that has been created
	// +kubebuilder:validation:Optional
	ResourceRecordSet string `json:"resourceRecordSet,omitempty"`

	// The Infra Id of the cluster, used for naming and tagging purposes
	// +kubebuilder:validation:Optional
	InfraId string `json:"infraId,omitempty"`

	// The status conditions of the AWS and K8s resources managed by this controller
	// +kubebuilder:validation:Optional
	Conditions []metav1.Condition `json:"conditions"`
}

type VpcEndpointTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   VpcEndpointTemplateSpec   `json:"spec,omitempty"`
	Status VpcEndpointTemplateStatus `json:"status,omitempty"`
}

type VpcEndpointTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []VpcEndpointTemplate `json:"items"`
}

type VpcEndpointTemplateSpec struct {
	// Type allows us to make different VpcEndpointTemplates that watch various kinds
	Type VpcEndpointTemplateType `json:"type"`

	// A label selector is a label query over a set of resources. The result of
	// matchLabels and matchExpressions are ANDed. An empty label selector matches
	// all objects. A null label selector matches no objects.
	Selector metav1.LabelSelector `json:"selector"`

	// Template describes the VpcEndpoints that will be created.
	Template VpceTemplateSpec `json:"template"`
}

type VpcEndpointTemplateStatus struct {
}

type VpcEndpointTemplateType string

type VpceTemplateSpec struct {
	// Standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Specification of the desired behavior of the VpcEndpoint.
	Spec VpcEndpointSpec `json:"spec"`
}