common

type DefaultNetworkPolicyOptions networkingv1.NetworkPolicySpec

type DefaultServiceAccountOptions struct {
	Secrets                      []corev1.ObjectReference      `yaml:"secrets,omitempty"`
	ImagePullSecrets             []corev1.LocalObjectReference `yaml:"imagePullSecrets,omitempty"`
	AutomountServiceAccountToken *bool                         `yaml:"automountServiceAccountToken,omitEmpty"`
}

type HardeningOptions struct {
	// ServiceAccount represents the overrides to be supplied to the default service account patched by the hardening controller
	ServiceAccount *DefaultServiceAccountOptions `yaml:"serviceAccountSpec"`
	// NetworkPolicy represents the overrides to be supplied to the generated NetworkPolicy created by the hardening controller
	NetworkPolicy *DefaultNetworkPolicyOptions `yaml:"networkPolicySpec"`
}

type OperatorOptions struct {
	// HelmAPIVersion is the unique API version marking ProjectHelmCharts that this Helm Project Operator should watch for
	HelmAPIVersion string

	// ReleaseName is a name that identifies releases created for this operator
	ReleaseName string

	// SystemNamespaces are additional operator namespaces to treat as if they are system namespaces whether or not
	// they are marked via some sort of annotation
	SystemNamespaces []string

	// ChartContent is the base64 tgz contents of the folder containing the Helm chart that needs to be deployed
	ChartContent string

	// Singleton marks whether only a single ProjectHelmChart can exist per registration namespace
	// If enabled, it will ensure that releases are named based on the registration namespace rather than
	// the name provided on the ProjectHelmChart, which is what triggers an UnableToCreateHelmRelease status
	// on the ProjectHelmChart created after this one
	Singleton bool
}

type Options struct {
	RuntimeOptions
	OperatorOptions
}

type RuntimeOptions struct {
	// Namespace is the systemNamespace to create HelmCharts and HelmReleases in
	// It's generally expected that this namespace is not widely accessible by all users in your cluster; it's recommended that it is placed
	// in something akin to a System Project that is locked down in terms of permissions since resources like HelmCharts and HelmReleases are deployed there
	Namespace string `` /* 193-byte string literal not displayed */

	// NodeName is the name of the node running the operator; it adds additional information to events about where they were generated from
	NodeName string `usage:"Name of the node this controller is running on" env:"NODE_NAME"`

	// ControllerName is the name of the controller that identifies this operator; this ensures that all HelmCharts and HelmReleases have the correct managed-by annotation
	// so that multiple iterations of this operator in the same namespace do not try to manage the same HelmChart and HelmRelease objects
	ControllerName string `` /* 160-byte string literal not displayed */

	// HelmJobImage is the job image to use to run the HelmChart job (default rancher/klipper-helm:v0.7.0-build20220315)
	// Generally, this HelmJobImage can be left undefined, but may be necessary to be set if you are running with a non-default image
	HelmJobImage string `usage:"Job image to use to perform helm operations on HelmChart creation" env:"HELM_JOB_IMAGE"`

	// ClusterID identifies the cluster that the operator is being operated frmo within; it adds an additional annotation to project registration
	// namespaces that indicates the projectID with the cluster label.
	//
	// Note: primarily used for integration with Rancher Projects
	ClusterID string `usage:"Identifies the cluster this controller is running on. Ignored if --project-label is not provided." env:"CLUSTER_ID"`

	// SystemDefaultRegistry is the prefix to be added to all images deployed by the HelmChart embedded into the Project Operator
	// to point at the right set of images that need to be deployed. This is usually provided in Rancher as global.cattle.systemDefaultRegistry
	SystemDefaultRegistry string `` /* 187-byte string literal not displayed */

	// CattleURL is the Rancher URL that this chart has been deployed onto. This is usually provided in Rancher Helm charts as global.cattle.url
	CattleURL string `usage:"Default Rancher URL to provide to the Helm chart under global.cattle.url" env:"CATTLE_URL"`

	// ProjectLabel is the label that identifies projects
	// Note: this field is optional and ensures that ProjectHelmCharts auto-infer their spec.projectNamespaceSelector
	// If provided, any spec.projectNamespaceSelector provided will be ignored
	// example: field.cattle.io/projectId
	ProjectLabel string `usage:"Label on namespaces to create Project Registration Namespaces and watch for ProjectHelmCharts" env:"PROJECT_LABEL"`

	// SystemProjectLabelValues are values of ProjectLabel that identify system namespaces. Does nothing if ProjectLabel is not provided
	// example: p-ranch
	// If both this and the ProjectLabel example are provided, any namespaces with label 'field.cattle.io/projectId: <system-project-label-value>'
	// will be treated as a systemNamespace, which means that no ProjectHelmChart will be allowed to select it
	SystemProjectLabelValues []string `usage:"Values on project label on namespaces that marks it as a system namespace" env:"SYSTEM_PROJECT_LABEL_VALUE"`

	// ProjectReleaseLabelValue is the value of the ProjectLabel that should be added to Project Release Namespaces. Does nothing if ProjectLabel is not provided
	// example: p-ranch
	// If provided, dedicated Project Release namespaces will be created in the cluster for each ProjectHelmChart that needs a Helm Release
	// The created Project Release namespaces will also automatically be identified as a System Project Namespaces based on this label, so other
	// namespaces with this label value will be treated as a system namespace as well
	ProjectReleaseLabelValue string `usage:"Value on project label on namespaces that marks it as a system namespace" env:"SYSTEM_PROJECT_LABEL_VALUE"`

	// AdminClusterRole configures the operator to automaticaly create RoleBindings on Roles in the Project Release Namespace marked with
	// 'helm.cattle.io/project-helm-chart-role': '<helm-release>' and 'helm.cattle.io/project-helm-chart-role-aggregate-from': 'admin'
	// based on ClusterRoleBindings or RoleBindings in the Project Registration namespace tied to the provided ClusterRole, if it exists
	AdminClusterRole string `usage:"ClusterRole tied to admin users who should have permissions in the Project Release Namespace" env:"ADMIN_CLUSTER_ROLE"`

	// EditClusterRole configures the operator to automaticaly create RoleBindings on Roles in the Project Release Namespace marked with
	// 'helm.cattle.io/project-helm-chart-role': '<helm-release>' and 'helm.cattle.io/project-helm-chart-role-aggregate-from': 'edit'
	// based on ClusterRoleBindings or RoleBindings in the Project Registration namespace tied to the provided ClusterRole, if it exists
	EditClusterRole string `usage:"ClusterRole tied to edit users who should have permissions in the Project Release Namespace" env:"EDIT_CLUSTER_ROLE"`

	// ViewClusterRole configures the operator to automaticaly create RoleBindings on Roles in the Project Release Namespace marked with
	// 'helm.cattle.io/project-helm-chart-role': '<helm-release>' and 'helm.cattle.io/project-helm-chart-role-aggregate-from': 'view'
	// based on ClusterRoleBindings or RoleBindings in the Project Registration namespace tied to the provided ClusterRole, if it exists
	ViewClusterRole string `usage:"ClusterRole tied to view users who should have permissions in the Project Release Namespace" env:"VIEW_CLUSTER_ROLE"`

	// DisableHardening turns off the controller that manages the default service account and a default NetworkPolicy deployed on all
	// namespaces marked with the Helm Project Operated Label to prevent generated namespaces from breaking a CIS 1.16 Hardened Scan by patching
	// the default ServiceAccount and creating a default secure NetworkPolicy.
	//
	// ref: https://docs.rke2.io/security/cis_self_assessment16/#515
	// ref: https://docs.rke2.io/security/cis_self_assessment16/#532
	//
	// To configure the default ServiceAccount and NetworkPolicy across all generated namespaces, you can provide overrides in the HardeningOptionsFile
	// If you need to configure the default ServiceAccount and NetworkPolicy on a per-namespace basis, it is recommended that you disable this
	DisableHardening bool `` /* 162-byte string literal not displayed */

	// HardeningOptionsFile is the path to the file that contains the configuration for the default ServiceAccount and NetworkPolicy deployed on operated namespaces
	// By default, the default service account of the namespace is patched to disable automountServiceAccountToken
	// By default, a default NetworkPolicy is deployed in the namespace that selects all pods in the namespace and limits all ingress and egress
	HardeningOptionsFile string `` /* 187-byte string literal not displayed */

	// ValuesOverrideFile is the path to the file that contains operated-provided overrides on the values.yaml that should be applied for each ProjectHelmChart
	ValuesOverrideFile string `` /* 130-byte string literal not displayed */

	// DisableEmbeddedHelmLocker determines whether to disable embedded Helm Locker controller in favor of external Helm Locker
	DisableEmbeddedHelmLocker bool `` /* 126-byte string literal not displayed */

	// DisableEmbeddedHelmController determines whether to disable embedded Helm Controller controller in favor of external Helm Controller
	// This should be the default in most RKE2 clusters since the RKE2 server binary already embeds a Helm Controller instance that manages HelmCharts
	DisableEmbeddedHelmController bool `` /* 170-byte string literal not displayed */
}