v1

type AKSPreset struct {
	ProviderPreset `json:",inline"`

	TenantID       string `json:"tenantID"`
	SubscriptionID string `json:"subscriptionID"`
	ClientID       string `json:"clientID"`
	ClientSecret   string `json:"clientSecret"`
}

type APIServerSettings struct {
	DeploymentSettings `json:",inline"`

	EndpointReconcilingDisabled *bool  `json:"endpointReconcilingDisabled,omitempty"`
	NodePortRange               string `json:"nodePortRange,omitempty"`
}

type AWSCloudSpec struct {
	CredentialsReference *GlobalSecretKeySelector `json:"credentialsReference,omitempty"`

	AccessKeyID          string `json:"accessKeyID,omitempty"`
	SecretAccessKey      string `json:"secretAccessKey,omitempty"`
	AssumeRoleARN        string `json:"assumeRoleARN,omitempty"` //nolint:tagliatelle
	AssumeRoleExternalID string `json:"assumeRoleExternalID,omitempty"`
	VPCID                string `json:"vpcID"`
	// The IAM role, the control plane will use. The control plane will perform an assume-role
	ControlPlaneRoleARN string `json:"roleARN"` //nolint:tagliatelle
	RouteTableID        string `json:"routeTableID"`
	InstanceProfileName string `json:"instanceProfileName"`
	SecurityGroupID     string `json:"securityGroupID"`
	// A CIDR range that will be used to allow access to the node port range in the security group to. Only applies if
	// the security group is generated by KKP and not preexisting.
	// If NodePortsAllowedIPRange nor NodePortsAllowedIPRanges is set, the node port range can be accessed from anywhere.
	NodePortsAllowedIPRange string `json:"nodePortsAllowedIPRange,omitempty"`
	// Optional: CIDR ranges that will be used to allow access to the node port range in the security group to. Only applies if
	// the security group is generated by KKP and not preexisting.
	// If NodePortsAllowedIPRange nor NodePortsAllowedIPRanges is set,  the node port range can be accessed from anywhere.
	NodePortsAllowedIPRanges *NetworkRanges `json:"nodePortsAllowedIPRanges,omitempty"`
	// DisableIAMReconciling is used to disable reconciliation for IAM related configuration. This is useful in air-gapped
	// setups where access to IAM service is not possible.
	DisableIAMReconciling bool `json:"disableIAMReconciling,omitempty"` //nolint:tagliatelle
}

type AWSPreset struct {
	ProviderPreset `json:",inline"`

	// Access Key ID to authenticate against AWS.
	AccessKeyID string `json:"accessKeyID"`
	// Secret Access Key to authenticate against AWS.
	SecretAccessKey string `json:"secretAccessKey"`

	AssumeRoleARN        string `json:"assumeRoleARN,omitempty"` //nolint:tagliatelle
	AssumeRoleExternalID string `json:"assumeRoleExternalID,omitempty"`

	// AWS VPC to use. Must be configured.
	VPCID string `json:"vpcID,omitempty"`
	// Route table to use. This can be configured, but if left empty will be
	// automatically filled in during reconciliation.
	RouteTableID string `json:"routeTableID,omitempty"`
	// Instance profile to use. This can be configured, but if left empty will be
	// automatically filled in during reconciliation.
	InstanceProfileName string `json:"instanceProfileName,omitempty"`
	// Security group to use. This can be configured, but if left empty will be
	// automatically filled in during reconciliation.
	SecurityGroupID string `json:"securityGroupID,omitempty"`
	// ARN to use. This can be configured, but if left empty will be
	// automatically filled in during reconciliation.
	ControlPlaneRoleARN string `json:"roleARN,omitempty"` //nolint:tagliatelle
}

type Addon struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec describes the desired addon state.
	Spec AddonSpec `json:"spec,omitempty"`

	// Status contains information about the reconciliation status.
	Status AddonStatus `json:"status,omitempty"`
}

type AddonCondition struct {
	// Status of the condition, one of True, False, Unknown.
	Status corev1.ConditionStatus `json:"status"`
	// Last time we got an update on a given condition.
	LastHeartbeatTime metav1.Time `json:"lastHeartbeatTime"`
	// Last time the condition transitioned from one status to another.
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
}

type AddonConditionType string

type AddonConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec AddonConfigSpec `json:"spec,omitempty"`
}

type AddonConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []AddonConfig `json:"items"`
}

type AddonConfigSpec struct {
	// ShortDescription of the configured addon that contains more detailed information about the addon,
	// it will be displayed in the addon details view in the UI
	ShortDescription string `json:"shortDescription,omitempty"`
	// Description of the configured addon, it will be displayed in the addon overview in the UI
	Description string `json:"description,omitempty"`
	// Logo of the configured addon, encoded in base64
	Logo string `json:"logo,omitempty"`
	// LogoFormat contains logo format of the configured addon, i.e. svg+xml
	LogoFormat string `json:"logoFormat,omitempty"`
	// Controls that can be set for configured addon
	Controls []AddonFormControl `json:"formSpec,omitempty"`
}

type AddonFormControl struct {
	// DisplayName is visible in the UI
	DisplayName string `json:"displayName,omitempty"`
	// InternalName is used internally to save in the addon object
	InternalName string `json:"internalName,omitempty"`
	// HelpText is visible in the UI next to the control
	HelpText string `json:"helpText,omitempty"`
	// Required indicates if the control has to be set
	Required bool `json:"required,omitempty"`
	// Type of displayed control
	Type string `json:"type,omitempty"`
}

type AddonList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []Addon `json:"items"`
}

type AddonSpec struct {
	// Name defines the name of the addon to install
	Name string `json:"name"`
	// Cluster is the reference to the cluster the addon should be installed in
	Cluster corev1.ObjectReference `json:"cluster"`
	// Variables is free form data to use for parsing the manifest templates
	// +kubebuilder:pruning:PreserveUnknownFields
	Variables *runtime.RawExtension `json:"variables,omitempty"`
	// RequiredResourceTypes allows to indicate that this addon needs some resource type before it
	// can be installed. This can be used to indicate that a specific CRD and/or extension
	// apiserver must be installed before this addon can be installed. The addon will not
	// be installed until that resource is served.
	RequiredResourceTypes []GroupVersionKind `json:"requiredResourceTypes,omitempty"`
	// IsDefault indicates whether the addon is installed because it was configured in
	// the default addon section in the KubermaticConfiguration. User-installed addons
	// must not set this field to true, as extra default Addon objects (that are not in
	// the KubermaticConfiguration) will be garbage-collected.
	IsDefault bool `json:"isDefault,omitempty"`
}

type AddonStatus struct {
	Conditions map[AddonConditionType]AddonCondition `json:"conditions,omitempty"`
}

type AdmissionPlugin struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec AdmissionPluginSpec `json:"spec,omitempty"`
}

type AdmissionPluginList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	// List of Admission Plugins
	Items []AdmissionPlugin `json:"items"`
}

type AdmissionPluginSpec struct {
	PluginName string `json:"pluginName"`

	// FromVersion flag can be empty. It means the plugin fit to all k8s versions
	FromVersion *semver.Semver `json:"fromVersion,omitempty"`
}

type Alertmanager struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AlertmanagerSpec   `json:"spec,omitempty"`
	Status AlertmanagerStatus `json:"status,omitempty"`
}

type AlertmanagerConfigurationStatus struct {
	// LastUpdated stores the last successful time when the configuration was successfully applied
	LastUpdated metav1.Time `json:"lastUpdated,omitempty"`
	// Status of whether the configuration was applied, one of True, False
	Status corev1.ConditionStatus `json:"status"`
	// ErrorMessage contains a default error message in case the configuration could not be applied.
	// Will be reset if the error was resolved and condition becomes True
	ErrorMessage string `json:"errorMessage,omitempty"`
}

type AlertmanagerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []Alertmanager `json:"items"`
}

type AlertmanagerSpec struct {
	// ConfigSecret refers to the Secret in the same namespace as the Alertmanager object,
	// which contains configuration for this Alertmanager.
	ConfigSecret corev1.LocalObjectReference `json:"configSecret"`
}

type AlertmanagerStatus struct {
	ConfigStatus AlertmanagerConfigurationStatus `json:"configStatus,omitempty"`
}

type AlibabaCloudSpec struct {
	CredentialsReference *GlobalSecretKeySelector `json:"credentialsReference,omitempty"`

	AccessKeyID     string `json:"accessKeyID,omitempty"`
	AccessKeySecret string `json:"accessKeySecret,omitempty"`
}

type AlibabaPreset struct {
	ProviderPreset `json:",inline"`

	// Access Key ID to authenticate against Alibaba.
	AccessKeyID string `json:"accessKeyID"`
	// Access Key Secret to authenticate against Alibaba.
	AccessKeySecret string `json:"accessKeySecret"`
}

type AllowedRegistry struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec AllowedRegistrySpec `json:"spec,omitempty"`
}

type AllowedRegistryList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []AllowedRegistry `json:"items"`
}

type AllowedRegistrySpec struct {
	// RegistryPrefix contains the prefix of the registry which will be allowed. User clusters will be able to deploy
	// only images which are prefixed with one of the allowed image registry prefixes.
	RegistryPrefix string `json:"registryPrefix"`
}

type AnexiaCloudSpec struct {
	CredentialsReference *GlobalSecretKeySelector `json:"credentialsReference,omitempty"`

	Token string `json:"token,omitempty"`
}

type AnexiaPreset struct {
	ProviderPreset `json:",inline"`

	// Token is used to authenticate with the Anexia API.
	Token string `json:"token"`
}

type ApplicationSettings struct {
	// CacheSize is the size of the cache used to download application's sources.
	CacheSize *resource.Quantity `json:"cacheSize,omitempty"`
}

type AuditLoggingSettings struct {
	// Enabled will enable or disable audit logging.
	Enabled bool `json:"enabled,omitempty"`
	// Optional: PolicyPreset can be set to utilize a pre-defined set of audit policy rules.
	PolicyPreset AuditPolicyPreset `json:"policyPreset,omitempty"`
	// Optional: Configures the fluent-bit sidecar deployed alongside kube-apiserver.
	SidecarSettings *AuditSidecarSettings `json:"sidecar,omitempty"`
}

type AuditPolicyPreset string

type AuditSidecarConfiguration struct {
	Service map[string]string   `json:"service,omitempty"`
	Filters []map[string]string `json:"filters,omitempty"`
	Outputs []map[string]string `json:"outputs,omitempty"`
}

type AuditSidecarSettings struct {
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
	Config    *AuditSidecarConfiguration   `json:"config,omitempty"`
}

type AzureCloudSpec struct {
	// CredentialsReference allows referencing a `Secret` resource instead of passing secret data in this spec.
	CredentialsReference *GlobalSecretKeySelector `json:"credentialsReference,omitempty"`

	// TenantID is the Azure Active Directory Tenant used for this cluster.
	// Can be read from `credentialsReference` instead.
	TenantID string `json:"tenantID,omitempty"`
	// SubscriptionID is the Azure Subscription used for this cluster.
	// Can be read from `credentialsReference` instead.
	SubscriptionID string `json:"subscriptionID,omitempty"`
	// ClientID is the service principal used to access Azure.
	// Can be read from `credentialsReference` instead.
	ClientID string `json:"clientID,omitempty"`
	// ClientSecret is the client secret corresponding to the given service principal.
	// Can be read from `credentialsReference` instead.
	ClientSecret string `json:"clientSecret,omitempty"`

	// The resource group that will be used to look up and create resources for the cluster in.
	// If set to empty string at cluster creation, a new resource group will be created and this field will be updated to
	// the generated resource group's name.
	ResourceGroup string `json:"resourceGroup"`
	// Optional: VNetResourceGroup optionally defines a second resource group that will be used for VNet related resources instead.
	// If left empty, NO additional resource group will be created and all VNet related resources use the resource group defined by `resourceGroup`.
	VNetResourceGroup string `json:"vnetResourceGroup"`
	// The name of the VNet resource used for setting up networking in.
	// If set to empty string at cluster creation, a new VNet will be created and this field will be updated to
	// the generated VNet's name.
	VNetName string `json:"vnet"`
	// The name of a subnet in the VNet referenced by `vnet`.
	// If set to empty string at cluster creation, a new subnet will be created and this field will be updated to
	// the generated subnet's name. If no VNet is defined at cluster creation, this field should be empty as well.
	SubnetName string `json:"subnet"`
	// The name of a route table associated with the subnet referenced by `subnet`.
	// If set to empty string at cluster creation, a new route table will be created and this field will be updated to
	// the generated route table's name. If no subnet is defined at cluster creation, this field should be empty as well.
	RouteTableName string `json:"routeTable"`
	// The name of a security group associated with the subnet referenced by `subnet`.
	// If set to empty string at cluster creation, a new security group will be created and this field will be updated to
	// the generated security group's name. If no subnet is defined at cluster creation, this field should be empty as well.
	SecurityGroup string `json:"securityGroup"`
	// A CIDR range that will be used to allow access to the node port range in the security group to. Only applies if
	// the security group is generated by KKP and not preexisting.
	// If NodePortsAllowedIPRange nor NodePortsAllowedIPRanges is set, the node port range can be accessed from anywhere.
	NodePortsAllowedIPRange string `json:"nodePortsAllowedIPRange,omitempty"`
	// Optional: CIDR ranges that will be used to allow access to the node port range in the security group to. Only applies if
	// the security group is generated by KKP and not preexisting.
	// If NodePortsAllowedIPRange nor NodePortsAllowedIPRanges is set,  the node port range can be accessed from anywhere.
	NodePortsAllowedIPRanges *NetworkRanges `json:"nodePortsAllowedIPRanges,omitempty"`
	// Optional: AssignAvailabilitySet determines whether KKP creates and assigns an AvailabilitySet to machines.
	// Defaults to `true` internally if not set.
	AssignAvailabilitySet *bool `json:"assignAvailabilitySet,omitempty"`
	// An availability set that will be associated with nodes created for this cluster. If this field is set to empty string
	// at cluster creation and `AssignAvailabilitySet` is set to `true`, a new availability set will be created and this field
	// will be updated to the generated availability set's name.
	AvailabilitySet string `json:"availabilitySet"`

	LoadBalancerSKU AzureLBSKU `json:"loadBalancerSKU"` //nolint:tagliatelle
}

type AzureLBSKU string

type AzurePreset struct {
	ProviderPreset `json:",inline"`

	TenantID       string `json:"tenantID"`
	SubscriptionID string `json:"subscriptionID"`
	ClientID       string `json:"clientID"`
	ClientSecret   string `json:"clientSecret"`

	ResourceGroup     string `json:"resourceGroup,omitempty"`
	VNetResourceGroup string `json:"vnetResourceGroup,omitempty"`
	VNetName          string `json:"vnet,omitempty"`
	SubnetName        string `json:"subnet,omitempty"`
	RouteTableName    string `json:"routeTable,omitempty"`
	SecurityGroup     string `json:"securityGroup,omitempty"`
	// LoadBalancerSKU sets the LB type that will be used for the Azure cluster;
	// if empty, "basic" will be used.
	LoadBalancerSKU AzureLBSKU `json:"loadBalancerSKU"` //nolint:tagliatelle
}

type BackupDestination struct {
	// Endpoint is the API endpoint to use for backup and restore.
	Endpoint string `json:"endpoint"`
	// BucketName is the bucket name to use for backup and restore.
	BucketName string `json:"bucketName"`
	// Credentials hold the ref to the secret with backup credentials
	Credentials *corev1.SecretReference `json:"credentials,omitempty"`
}

type BackupStatus struct {
	// ScheduledTime will always be set when the BackupStatus is created, so it'll never be nil
	// +optional
	ScheduledTime metav1.Time `json:"scheduledTime,omitempty"`
	BackupName    string      `json:"backupName,omitempty"`
	JobName       string      `json:"jobName,omitempty"`
	// +optional
	BackupStartTime metav1.Time `json:"backupStartTime,omitempty"`
	// +optional
	BackupFinishedTime metav1.Time     `json:"backupFinishedTime,omitempty"`
	BackupPhase        EtcdBackupPhase `json:"backupPhase,omitempty"`
	BackupMessage      string          `json:"backupMessage,omitempty"`
	DeleteJobName      string          `json:"deleteJobName,omitempty"`
	// +optional
	DeleteStartTime metav1.Time `json:"deleteStartTime,omitempty"`
	// +optional
	DeleteFinishedTime metav1.Time     `json:"deleteFinishedTime,omitempty"`
	DeletePhase        EtcdBackupPhase `json:"deletePhase,omitempty"`
	DeleteMessage      string          `json:"deleteMessage,omitempty"`
}

type BringYourOwnCloudSpec struct{}

type Bytes []byte

type CIDR string

type CNIPluginSettings struct {
	// Type is the CNI plugin type to be used.
	Type CNIPluginType `json:"type"`
	// Version defines the CNI plugin version to be used. This varies by chosen CNI plugin type.
	Version string `json:"version"`
}

type CNIPluginType string

type CleanupOptions struct {
	// Enable checkboxes that allow the user to ask for LoadBalancers and PVCs
	// to be deleted in order to not leave potentially expensive resources behind.
	Enabled bool `json:"enabled,omitempty"`
	// If enforced is set to true, the cleanup of LoadBalancers and PVCs is
	// enforced.
	Enforced bool `json:"enforced,omitempty"`
}

type CloudProvider string

type CloudSpec struct {
	// DatacenterName states the name of a cloud provider "datacenter" (defined in `Seed` resources)
	// this cluster should be deployed into.
	DatacenterName string `json:"dc"`

	// ProviderName is the name of the cloud provider used for this cluster.
	// This must match the given provider spec (e.g. if the providerName is
	// "aws", then the `aws` field must be set).
	ProviderName CloudProvider `json:"providerName"`

	Fake                *FakeCloudSpec                `json:"fake,omitempty"`
	Digitalocean        *DigitaloceanCloudSpec        `json:"digitalocean,omitempty"`
	BringYourOwn        *BringYourOwnCloudSpec        `json:"bringyourown,omitempty"`
	AWS                 *AWSCloudSpec                 `json:"aws,omitempty"`
	Azure               *AzureCloudSpec               `json:"azure,omitempty"`
	OpenStack           *OpenStackCloudSpec           `json:"openstack,omitempty"`
	Packet              *PacketCloudSpec              `json:"packet,omitempty"`
	Hetzner             *HetznerCloudSpec             `json:"hetzner,omitempty"`
	VSphere             *VSphereCloudSpec             `json:"vsphere,omitempty"`
	GCP                 *GCPCloudSpec                 `json:"gcp,omitempty"`
	KubeVirt            *KubeVirtCloudSpec            `json:"kubevirt,omitempty"`
	Alibaba             *AlibabaCloudSpec             `json:"alibaba,omitempty"`
	Anexia              *AnexiaCloudSpec              `json:"anexia,omitempty"`
	Nutanix             *NutanixCloudSpec             `json:"nutanix,omitempty"`
	VMwareCloudDirector *VMwareCloudDirectorCloudSpec `json:"vmwareclouddirector,omitempty"`
}

type Cluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec describes the desired cluster state.
	Spec ClusterSpec `json:"spec,omitempty"`

	// Status contains reconciliation information for the cluster.
	Status ClusterStatus `json:"status,omitempty"`
}

type ClusterAddress struct {
	// URL under which the Apiserver is available
	// +optional
	URL string `json:"url"`
	// Port is the port the API server listens on
	// +optional
	Port int32 `json:"port"`
	// ExternalName is the DNS name for this cluster
	// +optional
	ExternalName string `json:"externalName"`
	// InternalName is the seed cluster internal absolute DNS name to the API server
	// +optional
	InternalName string `json:"internalURL"`
	// AdminToken is the token for the kubeconfig, the user can download
	// +optional
	AdminToken string `json:"adminToken"`
	// IP is the external IP under which the apiserver is available
	// +optional
	IP string `json:"ip"`
}

type ClusterCondition struct {
	// Status of the condition, one of True, False, Unknown.
	Status corev1.ConditionStatus `json:"status"`
	// KubermaticVersion current kubermatic version.
	KubermaticVersion string `json:"kubermaticVersion"`
	// Last time we got an update on a given condition.
	LastHeartbeatTime metav1.Time `json:"lastHeartbeatTime"`
	// Last time the condition transit from one status to another.
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
	// (brief) reason for the condition's last transition.
	// +optional
	Reason string `json:"reason,omitempty"`
	// Human readable message indicating details about last transition.
	// +optional
	Message string `json:"message,omitempty"`
}

type ClusterConditionType string

type ClusterEncryptionPhase string

type ClusterEncryptionStatus struct {
	// The current "primary" key used to encrypt data written to etcd. Secondary keys that can be used for decryption
	// (but not encryption) might be configured in the ClusterSpec.
	ActiveKey string `json:"activeKey"`

	// List of resources currently encrypted.
	EncryptedResources []string `json:"encryptedResources"`

	// The current phase of the encryption process. Can be one of `Pending`, `Failed`, `Active` or `EncryptionNeeded`.
	// The `encryption_controller` logic will process the cluster based on the current phase and issue necessary changes
	// to make sure encryption on the cluster is active and updated with what the ClusterSpec defines.
	Phase ClusterEncryptionPhase `json:"phase,omitempty"`
}

type ClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []Cluster `json:"items"`
}

type ClusterNetworkingConfig struct {
	// Optional: IP family used for cluster networking. Supported values are "", "IPv4" or "IPv4+IPv6".
	// Can be omitted / empty if pods and services network ranges are specified.
	// In that case it defaults according to the IP families of the provided network ranges.
	// If neither ipFamily nor pods & services network ranges are specified, defaults to "IPv4".
	// +optional
	IPFamily IPFamily `json:"ipFamily,omitempty"`

	// The network ranges from which service VIPs are allocated.
	// It can contain one IPv4 and/or one IPv6 CIDR.
	// If both address families are specified, the first one defines the primary address family.
	Services NetworkRanges `json:"services"`

	// The network ranges from which POD networks are allocated.
	// It can contain one IPv4 and/or one IPv6 CIDR.
	// If both address families are specified, the first one defines the primary address family.
	Pods NetworkRanges `json:"pods"`

	// NodeCIDRMaskSizeIPv4 is the mask size used to address the nodes within provided IPv4 Pods CIDR.
	// It has to be larger than the provided IPv4 Pods CIDR. Defaults to 24.
	// +optional
	NodeCIDRMaskSizeIPv4 *int32 `json:"nodeCidrMaskSizeIPv4,omitempty"`

	// NodeCIDRMaskSizeIPv6 is the mask size used to address the nodes within provided IPv6 Pods CIDR.
	// It has to be larger than the provided IPv6 Pods CIDR. Defaults to 64.
	// +optional
	NodeCIDRMaskSizeIPv6 *int32 `json:"nodeCidrMaskSizeIPv6,omitempty"`

	// Domain name for services.
	DNSDomain string `json:"dnsDomain"`

	// ProxyMode defines the kube-proxy mode ("ipvs" / "iptables" / "ebpf").
	// Defaults to "ipvs". "ebpf" disables kube-proxy and requires CNI support.
	ProxyMode string `json:"proxyMode"`

	// IPVS defines kube-proxy ipvs configuration options
	IPVS *IPVSConfiguration `json:"ipvs,omitempty"`

	// NodeLocalDNSCacheEnabled controls whether the NodeLocal DNS Cache feature is enabled.
	// Defaults to true.
	NodeLocalDNSCacheEnabled *bool `json:"nodeLocalDNSCacheEnabled,omitempty"`

	// CoreDNSReplicas is the number of desired pods of user cluster coredns deployment.
	CoreDNSReplicas *int32 `json:"coreDNSReplicas,omitempty"`

	// KonnectivityEnabled enables konnectivity for controlplane to node network communication.
	KonnectivityEnabled *bool `json:"konnectivityEnabled,omitempty"`

	// TunnelingAgentIP is the address used by the tunneling agents
	TunnelingAgentIP string `json:"tunnelingAgentIP,omitempty"`
}

type ClusterPhase string

type ClusterSpec struct {
	// HumanReadableName is the cluster name provided by the user.
	HumanReadableName string `json:"humanReadableName"`

	// Version defines the wanted version of the control plane.
	Version semver.Semver `json:"version"`

	// Cloud contains information regarding the cloud provider that
	// is responsible for hosting the cluster's workload.
	Cloud CloudSpec `json:"cloud"`

	// ContainerRuntime to use, i.e. `docker` or `containerd`. By default `containerd` will be used.
	ContainerRuntime string `json:"containerRuntime,omitempty"`

	// Optional: ImagePullSecret references a secret with container registry credentials. This is
	// passed to the machine-controller which sets the registry credentials on node level.
	ImagePullSecret *corev1.SecretReference `json:"imagePullSecret,omitempty"`

	CNIPlugin *CNIPluginSettings `json:"cniPlugin,omitempty"`

	ClusterNetwork  ClusterNetworkingConfig   `json:"clusterNetwork"`
	MachineNetworks []MachineNetworkingConfig `json:"machineNetworks,omitempty"`

	// ExposeStrategy is the strategy used to expose a cluster control plane.
	ExposeStrategy ExposeStrategy `json:"exposeStrategy"`

	// Optional: APIServerAllowedIPRanges is a list of IP ranges allowed to access the API server.
	// Applicable only if the expose strategy of the cluster is LoadBalancer.
	// If not configured, access to the API server is unrestricted.
	APIServerAllowedIPRanges *NetworkRanges `json:"apiServerAllowedIPRanges,omitempty"`

	// Component specific overrides that allow customization of control plane components.
	ComponentsOverride ComponentSettings `json:"componentsOverride,omitempty"`

	OIDC *OIDCSettings `json:"oidc,omitempty"`

	// A map of optional or early-stage features that can be enabled for the user cluster.
	// Some feature gates cannot be disabled after being enabled.
	// The available feature gates vary based on KKP version, Kubernetes version and Seed configuration.
	// Please consult the KKP documentation for specific feature gates.
	Features map[string]bool `json:"features,omitempty"`

	// Optional: UpdateWindow configures automatic update systems to respect a maintenance window for
	// applying OS updates to nodes. This is only respected on Flatcar nodes currently.
	UpdateWindow *UpdateWindow `json:"updateWindow,omitempty"`

	// Enables the admission plugin `PodSecurityPolicy`. This plugin is deprecated by Kubernetes.
	UsePodSecurityPolicyAdmissionPlugin bool `json:"usePodSecurityPolicyAdmissionPlugin,omitempty"`
	// Enables the admission plugin `PodNodeSelector`. Needs additional configuration via the `podNodeSelectorAdmissionPluginConfig` field.
	UsePodNodeSelectorAdmissionPlugin bool `json:"usePodNodeSelectorAdmissionPlugin,omitempty"`
	// Enables the admission plugin `EventRateLimit`. Needs additional configuration via the `eventRateLimitConfig` field.
	// This plugin is considered "alpha" by Kubernetes.
	UseEventRateLimitAdmissionPlugin bool `json:"useEventRateLimitAdmissionPlugin,omitempty"`

	// A list of arbitrary admission plugin names that are passed to kube-apiserver. Must not include admission plugins
	// that can be enabled via a separate setting.
	AdmissionPlugins []string `json:"admissionPlugins,omitempty"`

	// Optional: Provides configuration for the PodNodeSelector admission plugin (needs plugin enabled
	// via `usePodNodeSelectorAdmissionPlugin`). It's used by the backend to create a configuration file for this plugin.
	// The key:value from this map is converted to <namespace>:<node-selectors-labels> in the file. Use `clusterDefaultNodeSelector`
	// as key to configure a default node selector.
	PodNodeSelectorAdmissionPluginConfig map[string]string `json:"podNodeSelectorAdmissionPluginConfig,omitempty"`

	// Optional: Configures the EventRateLimit admission plugin (if enabled via `useEventRateLimitAdmissionPlugin`)
	// to create limits on Kubernetes event generation. The EventRateLimit plugin is capable of comparing and rate limiting incoming
	// `Events` based on several configured buckets.
	EventRateLimitConfig *EventRateLimitConfig `json:"eventRateLimitConfig,omitempty"`

	// Optional: Deploys the UserSSHKeyAgent to the user cluster. This field is immutable.
	// If enabled, the agent will be deployed and used to sync user ssh keys attached by users to the cluster.
	// No SSH keys will be synced after node creation if this is disabled.
	EnableUserSSHKeyAgent *bool `json:"enableUserSSHKeyAgent,omitempty"`

	// Optional: Enables operating-system-manager (OSM), which is responsible for creating and managing worker node configuration.
	// This field is enabled(true) by default.
	EnableOperatingSystemManager *bool `json:"enableOperatingSystemManager,omitempty"`

	// KubernetesDashboard holds the configuration for the kubernetes-dashboard component.
	KubernetesDashboard *KubernetesDashboard `json:"kubernetesDashboard,omitempty"`

	// Optional: AuditLogging configures Kubernetes API audit logging (https://kubernetes.io/docs/tasks/debug-application-cluster/audit/)
	// for the user cluster.
	AuditLogging *AuditLoggingSettings `json:"auditLogging,omitempty"`

	// Optional: OPAIntegration is a preview feature that enables OPA integration for the cluster.
	// Enabling it causes OPA Gatekeeper and its resources to be deployed on the user cluster.
	// By default it is disabled.
	OPAIntegration *OPAIntegrationSettings `json:"opaIntegration,omitempty"`

	// Optional: ServiceAccount contains service account related settings for the user cluster's kube-apiserver.
	ServiceAccount *ServiceAccountSettings `json:"serviceAccount,omitempty"`

	// Optional: MLA contains monitoring, logging and alerting related settings for the user cluster.
	MLA *MLASettings `json:"mla,omitempty"`

	// Optional: ApplicationSettings contains the settings relative to the application feature.
	ApplicationSettings *ApplicationSettings `json:"applicationSettings,omitempty"`

	// Optional: Configures encryption-at-rest for Kubernetes API data. This needs the `encryptionAtRest` feature gate.
	EncryptionConfiguration *EncryptionConfiguration `json:"encryptionConfiguration,omitempty"`

	// If this is set to true, the cluster will not be reconciled by KKP.
	// This indicates that the user needs to do some action to resolve the pause.
	// +kubebuilder:default=false
	Pause bool `json:"pause,omitempty"`
	// PauseReason is the reason why the cluster is not being managed. This field is for informational
	// purpose only and can be set by a user or a controller to communicate the reason for pausing the cluster.
	PauseReason string `json:"pauseReason,omitempty"`

	// Enables more verbose logging in KKP's user-cluster-controller-manager.
	DebugLog bool `json:"debugLog,omitempty"`
}

type ClusterStatus struct {
	// Address contains the IPs/URLs to access the cluster control plane.
	// +optional
	Address ClusterAddress `json:"address,omitempty"`

	// +optional
	LastUpdated metav1.Time `json:"lastUpdated,omitempty"`
	// ExtendedHealth exposes information about the current health state.
	// Extends standard health status for new states.
	// +optional
	ExtendedHealth ExtendedClusterHealth `json:"extendedHealth,omitempty"`
	// LastProviderReconciliation is the time when the cloud provider resources
	// were last fully reconciled (during normal cluster reconciliation, KKP does
	// not re-check things like security groups, networks etc.).
	// +optional
	LastProviderReconciliation metav1.Time `json:"lastProviderReconciliation,omitempty"`
	// NamespaceName defines the namespace the control plane of this cluster is deployed in.
	// +optional
	NamespaceName string `json:"namespaceName"`

	// Versions contains information regarding the current and desired versions
	// of the cluster control plane and worker nodes.
	// +optional
	Versions ClusterVersionsStatus `json:"versions,omitempty"`

	// Deprecated: UserName contains the name of the owner of this cluster.
	// This field is not actively used and will be removed in the future.
	// +optional
	UserName string `json:"userName,omitempty"`
	// UserEmail contains the email of the owner of this cluster.
	// During cluster creation only, this field will be used to bind the `cluster-admin` `ClusterRole` to a cluster owner.
	// +optional
	UserEmail string `json:"userEmail"`

	// ErrorReason contains a error reason in case the controller encountered an error. Will be reset if the error was resolved.
	// +optional
	ErrorReason *ClusterStatusError `json:"errorReason,omitempty"`
	// ErrorMessage contains a default error message in case the controller encountered an error. Will be reset if the error was resolved.
	// +optional
	ErrorMessage *string `json:"errorMessage,omitempty"`

	// Conditions contains conditions the cluster is in, its primary use case is status signaling between controllers or between
	// controllers and the API.
	// +optional
	Conditions map[ClusterConditionType]ClusterCondition `json:"conditions,omitempty"`

	// Phase is a description of the current cluster status, summarizing the various conditions,
	// possible active updates etc. This field is for informational purpose only and no logic
	// should be tied to the phase.
	Phase ClusterPhase `json:"phase,omitempty"`

	// InheritedLabels are labels the cluster inherited from the project. They are read-only for users.
	// +optional
	InheritedLabels map[string]string `json:"inheritedLabels,omitempty"`

	// Encryption describes the status of the encryption-at-rest feature for encrypted data in etcd.
	// +optional
	Encryption *ClusterEncryptionStatus `json:"encryption,omitempty"`

	// ResourceUsage shows the current usage of resources for the cluster.
	ResourceUsage *ResourceDetails `json:"resourceUsage,omitempty"`
}

type ClusterStatusError string

type ClusterTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	ClusterLabels          map[string]string       `json:"clusterLabels,omitempty"`
	InheritedClusterLabels map[string]string       `json:"inheritedClusterLabels,omitempty"`
	Credential             string                  `json:"credential"`
	UserSSHKeys            []ClusterTemplateSSHKey `json:"userSSHKeys,omitempty"`
	Spec                   ClusterSpec             `json:"spec,omitempty"`
}

type ClusterTemplateInstance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec ClusterTemplateInstanceSpec `json:"spec,omitempty"`
}

type ClusterTemplateInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ClusterTemplateInstance `json:"items"`
}

type ClusterTemplateInstanceSpec struct {
	ProjectID           string `json:"projectID"`
	ClusterTemplateID   string `json:"clusterTemplateID"`
	ClusterTemplateName string `json:"clusterTemplateName"`
	Replicas            int64  `json:"replicas"`
}

type ClusterTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ClusterTemplate `json:"items"`
}

type ClusterTemplateSSHKey struct {
	// ID is the name of the UserSSHKey object that is supposed to be assigned
	// to any ClusterTemplateInstance created based on this template.
	ID string `json:"id"`
	// Name is the human readable SSH key name.
	Name string `json:"name"`
}

type ClusterVersionsStatus struct {
	// ControlPlane is the currently active cluster version. This can lag behind the apiserver
	// version if an update is currently rolling out.
	ControlPlane semver.Semver `json:"controlPlane"`
	// Apiserver is the currently desired version of the kube-apiserver. During
	// upgrades across multiple minor versions (e.g. from 1.20 to 1.23), this will gradually
	// be increased by the update-controller until the desired cluster version (spec.version)
	// is reached.
	Apiserver semver.Semver `json:"apiserver"`
	// ControllerManager is the currently desired version of the kube-controller-manager. This
	// field behaves the same as the apiserver field.
	ControllerManager semver.Semver `json:"controllerManager"`
	// Scheduler is the currently desired version of the kube-scheduler. This field behaves the
	// same as the apiserver field.
	Scheduler semver.Semver `json:"scheduler"`
	// OldestNodeVersion is the oldest node version currently in use inside the cluster. This can be
	// nil if there are no nodes. This field is primarily for speeding up reconciling, so that
	// the controller doesn't have to re-fetch to the usercluster and query its node on every
	// reconciliation.
	OldestNodeVersion *semver.Semver `json:"oldestNodeVersion,omitempty"`
}

type ComponentSettings struct {
	// Apiserver configures kube-apiserver settings.
	Apiserver APIServerSettings `json:"apiserver"`
	// ControllerManager configures kube-controller-manager settings.
	ControllerManager ControllerSettings `json:"controllerManager"`
	// Scheduler configures kube-scheduler settings.
	Scheduler ControllerSettings `json:"scheduler"`
	// Etcd configures the etcd ring used to store Kubernetes data.
	Etcd EtcdStatefulSetSettings `json:"etcd"`
	// Prometheus configures the Prometheus instance deployed into the cluster control plane.
	Prometheus *StatefulSetSettings `json:"prometheus,omitempty"`
	// NodePortProxyEnvoy configures the per-cluster nodeport-proxy-envoy that is deployed if
	// the `LoadBalancer` expose strategy is used. This is not effective if a different expose
	// strategy is configured.
	NodePortProxyEnvoy *NodeportProxyComponent `json:"nodePortProxyEnvoy,omitempty"`
	// KonnectivityProxy configures konnectivity-server and konnectivity-agent components.
	KonnectivityProxy *KonnectivityProxySettings `json:"konnectivityProxy,omitempty"`
}

type ConditionType string

type Constraint struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec ConstraintSpec `json:"spec,omitempty"`
}

type ConstraintList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []Constraint `json:"items"`
}

type ConstraintMatch struct {
	// Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which
	// the constraint will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope
	Kinds []ConstraintMatchKind `json:"kinds,omitempty"`
	// Scope accepts *, Cluster, or Namespaced which determines if cluster-scoped and/or namesapced-scoped resources are selected. (defaults to *)
	Scope string `json:"scope,omitempty"`
	// Namespaces is a list of namespace names. If defined, a constraint will only apply to resources in a listed namespace.
	Namespaces []string `json:"namespaces,omitempty"`
	// ExcludedNamespaces is a list of namespace names. If defined, a constraint will only apply to resources not in a listed namespace.
	ExcludedNamespaces []string `json:"excludedNamespaces,omitempty"`
	// LabelSelector is a standard Kubernetes label selector.
	LabelSelector metav1.LabelSelector `json:"labelSelector,omitempty"`
	// NamespaceSelector  is a standard Kubernetes namespace selector. If defined, make sure to add Namespaces to your
	// configs.config.gatekeeper.sh object to ensure namespaces are synced into OPA
	NamespaceSelector metav1.LabelSelector `json:"namespaceSelector,omitempty"`
}

type ConstraintMatchKind struct {
	// Kinds specifies the kinds of the resources
	Kinds []string `json:"kinds,omitempty"`
	// APIGroups specifies the APIGroups of the resources
	APIGroups []string `json:"apiGroups,omitempty"`
}

type ConstraintParameters map[string]json.RawMessage

type ConstraintSelector struct {
	// Providers is a list of cloud providers to which the Constraint applies to. Empty means all providers are selected.
	Providers []CloudProvider `json:"providers,omitempty"`
	// LabelSelector selects the Clusters to which the Constraint applies based on their labels
	LabelSelector metav1.LabelSelector `json:"labelSelector,omitempty"`
}

type ConstraintSpec struct {
	// ConstraintType specifies the type of gatekeeper constraint that the constraint applies to
	ConstraintType string `json:"constraintType"`
	// Disabled  is the flag for disabling OPA constraints
	Disabled bool `json:"disabled,omitempty"`
	// Match contains the constraint to resource matching data
	Match ConstraintMatch `json:"match,omitempty"`
	// Parameters specifies the parameters used by the constraint template REGO.
	// It supports both the legacy rawJSON parameters, in which all the parameters are set in a JSON string, and regular
	// parameters like in Gatekeeper Constraints.
	// If rawJSON is set, during constraint syncing to the user cluster, the other parameters are ignored
	// Example with rawJSON parameters:
	//
	// parameters:
	//   rawJSON: '{"labels":["gatekeeper"]}'
	//
	// And with regular parameters:
	//
	// parameters:
	//   labels: ["gatekeeper"]
	//
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:pruning:PreserveUnknownFields
	Parameters ConstraintParameters `json:"parameters,omitempty"`
	// Selector specifies the cluster selection filters
	Selector *ConstraintSelector `json:"selector,omitempty"`

	// EnforcementAction defines the action to take in response to a constraint being violated.
	// By default, EnforcementAction is set to deny as the default behavior is to deny admission requests with any violation.
	EnforcementAction string `json:"enforcementAction,omitempty"`
}

type ConstraintTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec ConstraintTemplateSpec `json:"spec,omitempty"`
}

type ConstraintTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ConstraintTemplate `json:"items"`
}

type ConstraintTemplateSelector struct {
	// Providers is a list of cloud providers to which the Constraint Template applies to. Empty means all providers are selected.
	Providers []CloudProvider `json:"providers,omitempty"`
	// LabelSelector selects the Clusters to which the Constraint Template applies based on their labels
	LabelSelector metav1.LabelSelector `json:"labelSelector,omitempty"`
}

type ConstraintTemplateSpec struct {
	CRD      openpolicyagent.CRD        `json:"crd,omitempty"`
	Targets  []openpolicyagent.Target   `json:"targets,omitempty"`
	Selector ConstraintTemplateSelector `json:"selector,omitempty"`
}

type ContainerRuntimeContainerd struct {
	// A map of registries to use to render configs and mirrors for containerd registries
	Registries map[string]ContainerdRegistry `json:"registries,omitempty"`
}

type ContainerdRegistry struct {
	// List of registry mirrors to use
	Mirrors []string `json:"mirrors,omitempty"`
}

type ControllerSettings struct {
	DeploymentSettings     `json:",inline"`
	LeaderElectionSettings `json:"leaderElection,omitempty"`
}

type CustomLink struct {
	Label    string `json:"label"`
	URL      string `json:"url"`
	Icon     string `json:"icon"`
	Location string `json:"location"`
}

type CustomLinks []CustomLink

type CustomNetworkPolicy struct {
	// Name is the name of the Custom Network Policy.
	Name string `json:"name"`
	// Spec is the Spec of the NetworkPolicy, using the standard type.
	Spec networkingv1.NetworkPolicySpec `json:"spec"`
}

type Datacenter struct {
	// Optional: Country of the seed as ISO-3166 two-letter code, e.g. DE or UK.
	// For informational purposes in the Kubermatic dashboard only.
	Country string `json:"country,omitempty"`
	// Optional: Detailed location of the cluster, like "Hamburg" or "Datacenter 7".
	// For informational purposes in the Kubermatic dashboard only.
	Location string `json:"location,omitempty"`
	// Node holds node-specific settings, like e.g. HTTP proxy, Docker
	// registries and the like. Proxy settings are inherited from the seed if
	// not specified here.
	Node *NodeSettings `json:"node,omitempty"`
	// Spec describes the cloud provider settings used to manage resources
	// in this datacenter. Exactly one cloud provider must be defined.
	Spec DatacenterSpec `json:"spec"`
}

type DatacenterSpec struct {
	Digitalocean *DatacenterSpecDigitalocean `json:"digitalocean,omitempty"`
	// BringYourOwn contains settings for clusters using manually created
	// nodes via kubeadm.
	BringYourOwn *DatacenterSpecBringYourOwn `json:"bringyourown,omitempty"`
	// AWS configures an Amazon Web Services (AWS) datacenter.
	AWS *DatacenterSpecAWS `json:"aws,omitempty"`
	// Azure configures an Azure datacenter.
	Azure *DatacenterSpecAzure `json:"azure,omitempty"`
	// OpenStack configures an OpenStack datacenter.
	OpenStack *DatacenterSpecOpenStack `json:"openstack,omitempty"`
	// Packet configures an Equinix Metal datacenter.
	Packet *DatacenterSpecPacket `json:"packet,omitempty"`
	// Hetzner configures a Hetzner datacenter.
	Hetzner *DatacenterSpecHetzner `json:"hetzner,omitempty"`
	// VSphere configures a VMware vSphere datacenter.
	VSphere *DatacenterSpecVSphere `json:"vsphere,omitempty"`
	// VMwareCloudDirector configures a VMware Cloud Director datacenter.
	VMwareCloudDirector *DatacenterSpecVMwareCloudDirector `json:"vmwareclouddirector,omitempty"`
	// GCP configures a Google Cloud Platform (GCP) datacenter.
	GCP *DatacenterSpecGCP `json:"gcp,omitempty"`
	// KubeVirt configures a KubeVirt datacenter.
	KubeVirt *DatacenterSpecKubeVirt `json:"kubevirt,omitempty"`
	// Alibaba configures an Alibaba Cloud datacenter.
	Alibaba *DatacenterSpecAlibaba `json:"alibaba,omitempty"`
	// Anexia configures an Anexia datacenter.
	Anexia *DatacenterSpecAnexia `json:"anexia,omitempty"`
	// Nutanix configures a Nutanix HCI datacenter.
	Nutanix *DatacenterSpecNutanix `json:"nutanix,omitempty"`

	//nolint:staticcheck
	//lint:ignore SA5008 omitgenyaml is used by the example-yaml-generator
	Fake *DatacenterSpecFake `json:"fake,omitempty,omitgenyaml"`

	// Optional: When defined, only users with an e-mail address on the
	// given domains can make use of this datacenter. You can define multiple
	// domains, e.g. "example.com", one of which must match the email domain
	// exactly (i.e. "example.com" will not match "user@test.example.com").
	RequiredEmails []string `json:"requiredEmails,omitempty"`

	// Optional: EnforceAuditLogging enforces audit logging on every cluster within the DC,
	// ignoring cluster-specific settings.
	EnforceAuditLogging bool `json:"enforceAuditLogging,omitempty"`

	// Optional: EnforcePodSecurityPolicy enforces pod security policy plugin on every clusters within the DC,
	// ignoring cluster-specific settings.
	EnforcePodSecurityPolicy bool `json:"enforcePodSecurityPolicy,omitempty"`

	// Optional: ProviderReconciliationInterval is the time that must have passed since a
	// Cluster's status.lastProviderReconciliation to make the cliuster controller
	// perform an in-depth provider reconciliation, where for example missing security
	// groups will be reconciled.
	// Setting this too low can cause rate limits by the cloud provider, setting this
	// too high means that *if* a resource at a cloud provider is removed/changed outside
	// of KKP, it will take this long to fix it.
	ProviderReconciliationInterval *metav1.Duration `json:"providerReconciliationInterval,omitempty"`

	// Optional: DefaultOperatingSystemProfiles specifies the OperatingSystemProfiles to use for each supported operating system.
	DefaultOperatingSystemProfiles OperatingSystemProfileList `json:"operatingSystemProfiles,omitempty"`

	// Optional: MachineFlavorFilter is used to filter out allowed machine flavors based on the specified resource limits like CPU, Memory, and GPU etc.
	MachineFlavorFilter *MachineFlavorFilter `json:"machineFlavorFilter,omitempty"`
}

type DatacenterSpecAWS struct {
	// The AWS region to use, e.g. "us-east-1". For a list of available regions, see
	// https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html
	Region string `json:"region"`

	// List of AMIs to use for a given operating system.
	// This gets defaulted by querying for the latest AMI for the given distribution
	// when machines are created, so under normal circumstances it is not necessary
	// to define the AMIs statically.
	Images ImageList `json:"images,omitempty"`
}

type DatacenterSpecAlibaba struct {
	// Region to use, for a full list of regions see
	// https://www.alibabacloud.com/help/doc-detail/40654.htm
	Region string `json:"region"`
}

type DatacenterSpecAnexia struct {
	// LocationID the location of the region
	LocationID string `json:"locationID"`
}

type DatacenterSpecAzure struct {
	// Region to use, for example "westeurope". A list of available regions can be
	// found at https://azure.microsoft.com/en-us/global-infrastructure/locations/
	Location string `json:"location"`
}

type DatacenterSpecBringYourOwn struct {
}

type DatacenterSpecDigitalocean struct {
	// Datacenter location, e.g. "ams3". A list of existing datacenters can be found
	// at https://www.digitalocean.com/docs/platform/availability-matrix/
	Region string `json:"region"`
}

type DatacenterSpecFake struct {
	FakeProperty string `json:"fakeProperty,omitempty"`
}

type DatacenterSpecGCP struct {
	// Region to use, for example "europe-west3", for a full list of regions see
	// https://cloud.google.com/compute/docs/regions-zones/
	Region string `json:"region"`
	// List of enabled zones, for example [a, c]. See the link above for the available
	// zones in your chosen region.
	ZoneSuffixes []string `json:"zoneSuffixes"`

	// Optional: Regional clusters spread their resources across multiple availability zones.
	// Refer to the official documentation for more details on this:
	// https://cloud.google.com/kubernetes-engine/docs/concepts/regional-clusters
	Regional bool `json:"regional,omitempty"`
}

type DatacenterSpecHetzner struct {
	// Datacenter location, e.g. "nbg1-dc3". A list of existing datacenters can be found
	// at https://docs.hetzner.com/general/others/data-centers-and-connection/
	Datacenter string `json:"datacenter"`
	// Network is the pre-existing Hetzner network in which the machines are running.
	// While machines can be in multiple networks, a single one must be chosen for the
	// HCloud CCM to work.
	Network string `json:"network"`
	// Optional: Detailed location of the datacenter, like "Hamburg" or "Datacenter 7".
	// For informational purposes only.
	Location string `json:"location,omitempty"`
}

type DatacenterSpecKubeVirt struct {

	// DNSPolicy represents the dns policy for the pod. Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst',
	// 'Default' or 'None'. Defaults to "ClusterFirst". DNS parameters given in DNSConfig will be merged with the
	// policy selected with DNSPolicy.
	DNSPolicy string `json:"dnsPolicy,omitempty"`

	// DNSConfig represents the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS
	// configuration based on DNSPolicy.
	DNSConfig *corev1.PodDNSConfig `json:"dnsConfig,omitempty"`

	// CustomNetworkPolicies (optional) allows to add some extra custom NetworkPolicies, that are deployed
	// in the dedicated infra KubeVirt cluster. They are added to the defaults.
	CustomNetworkPolicies []*CustomNetworkPolicy `json:"customNetworkPolicies,omitempty"`

	// Images represents standard VM Image sources.
	Images *KubeVirtImageSources `json:"images,omitempty"`

	// InfraStorageClasses contains a list of KubeVirt infra cluster StorageClasses names
	// that will be used to initialise StorageClasses in the tenant cluster.
	// In the tenant cluster, the created StorageClass name will have as name:
	// kubevirt-<infra-storageClass-name>
	InfraStorageClasses []KubeVirtInfraStorageClass `json:"infraStorageClasses,omitempty"`
}

type DatacenterSpecNutanix struct {
	// Endpoint to use for accessing Nutanix Prism Central. No protocol or port should be passed,
	// for example "nutanix.example.com" or "10.0.0.1"
	Endpoint string `json:"endpoint"`
	// Optional: Port to use when connecting to the Nutanix Prism Central endpoint (defaults to 9440)
	Port *int32 `json:"port,omitempty"`

	// Optional: AllowInsecure allows to disable the TLS certificate check against the endpoint (defaults to false)
	AllowInsecure bool `json:"allowInsecure,omitempty"`
	// Images to use for each supported operating system
	Images ImageList `json:"images"`
}

type DatacenterSpecOpenStack struct {
	AuthURL          string `json:"authURL"`
	AvailabilityZone string `json:"availabilityZone,omitempty"`
	Region           string `json:"region"`
	// Optional
	IgnoreVolumeAZ bool `json:"ignoreVolumeAZ,omitempty"` //nolint:tagliatelle
	// Optional
	EnforceFloatingIP bool `json:"enforceFloatingIP,omitempty"`
	// Used for automatic network creation
	DNSServers []string `json:"dnsServers,omitempty"`
	// Images to use for each supported operating system.
	Images ImageList `json:"images"`
	// Optional: Gets mapped to the "manage-security-groups" setting in the cloud config.
	// This setting defaults to true.
	ManageSecurityGroups *bool `json:"manageSecurityGroups,omitempty"`
	// Optional: Gets mapped to the "use-octavia" setting in the cloud config.
	// use-octavia is enabled by default in CCM since v1.17.0, and disabled by
	// default with the in-tree cloud provider.
	UseOctavia *bool `json:"useOctavia,omitempty"`
	// Optional: Gets mapped to the "trust-device-path" setting in the cloud config.
	// This setting defaults to false.
	TrustDevicePath *bool `json:"trustDevicePath,omitempty"`
	// Optional: Restrict the allowed VM configurations that can be chosen in
	// the KKP dashboard. This setting does not affect the validation webhook for
	// MachineDeployments.
	NodeSizeRequirements *OpenStackNodeSizeRequirements `json:"nodeSizeRequirements,omitempty"`
	// Optional: List of enabled flavors for the given datacenter
	EnabledFlavors []string `json:"enabledFlavors,omitempty"`
	// Optional: defines if the IPv6 is enabled for the datacenter
	IPv6Enabled *bool `json:"ipv6Enabled,omitempty"`
}

type DatacenterSpecPacket struct {
	// The list of enabled facilities, for example "ams1", for a full list of available
	// facilities see https://metal.equinix.com/developers/docs/locations/facilities/
	Facilities []string `json:"facilities,omitempty"`
	// Metros are facilities that are grouped together geographically and share capacity
	// and networking features, see https://metal.equinix.com/developers/docs/locations/metros/
	Metro string `json:"metro,omitempty"`
}

type DatacenterSpecVMwareCloudDirector struct {
	// Endpoint URL to use, including protocol, for example "https://vclouddirector.example.com".
	URL string `json:"url"`
	// If set to true, disables the TLS certificate check against the endpoint.
	AllowInsecure bool `json:"allowInsecure,omitempty"`
	// The default catalog which contains the VM templates.
	DefaultCatalog string `json:"catalog,omitempty"`
	// The name of the storage profile to use for disks attached to the VMs.
	DefaultStorageProfile string `json:"storageProfile,omitempty"`
	// A list of VM templates to use for a given operating system. You must
	// define at least one template.
	Templates ImageList `json:"templates"`
}

type DatacenterSpecVSphere struct {
	// Endpoint URL to use, including protocol, for example "https://vcenter.example.com".
	Endpoint string `json:"endpoint"`
	// If set to true, disables the TLS certificate check against the endpoint.
	AllowInsecure bool `json:"allowInsecure,omitempty"`
	// The default Datastore to be used for provisioning volumes using storage
	// classes/dynamic provisioning and for storing virtual machine files in
	// case no `Datastore` or `DatastoreCluster` is provided at Cluster level.
	DefaultDatastore string `json:"datastore"`
	// The name of the datacenter to use.
	Datacenter string `json:"datacenter"`
	// The name of the vSphere cluster to use. Used for out-of-tree CSI Driver.
	Cluster string `json:"cluster"`
	// The name of the storage policy to use for the storage class created in the user cluster.
	DefaultStoragePolicy string `json:"storagePolicy,omitempty"`
	// Optional: The root path for cluster specific VM folders. Each cluster gets its own
	// folder below the root folder. Must be the FQDN (for example
	// "/datacenter-1/vm/all-kubermatic-vms-in-here") and defaults to the root VM
	// folder: "/datacenter-1/vm"
	RootPath string `json:"rootPath,omitempty"`
	// A list of VM templates to use for a given operating system. You must
	// define at least one template.
	// See: https://github.com/kubermatic/machine-controller/blob/master/docs/vsphere.md#template-vms-preparation
	Templates ImageList `json:"templates"`
	// Optional: Infra management user is the user that will be used for everything
	// except the cloud provider functionality, which will still use the credentials
	// passed in via the Kubermatic dashboard/API.
	InfraManagementUser *VSphereCredentials `json:"infraManagementUser,omitempty"`
	// Optional: defines if the IPv6 is enabled for the datacenter
	IPv6Enabled *bool `json:"ipv6Enabled,omitempty"`
	// DefaultTagCategoryID is the tag category id that will be used as default, if users don't specify it on a cluster level,
	// and they don't wish KKP to create default generated tag category, upon cluster creation.
	DefaultTagCategoryID string `json:"defaultTagCategoryID,omitempty"`
}

type DefaultProjectResourceQuota struct {
	Quota *ResourceDetails `json:"quota,omitempty"`
}

type DeploymentSettings struct {
	Replicas    *int32                       `json:"replicas,omitempty"`
	Resources   *corev1.ResourceRequirements `json:"resources,omitempty"`
	Tolerations []corev1.Toleration          `json:"tolerations,omitempty"`
}

type DigitaloceanCloudSpec struct {
	CredentialsReference *GlobalSecretKeySelector `json:"credentialsReference,omitempty"`

	Token string `json:"token,omitempty"` // Token is used to authenticate with the DigitalOcean API.
}

type DigitaloceanPreset struct {
	ProviderPreset `json:",inline"`

	// Token is used to authenticate with the DigitalOcean API.
	Token string `json:"token"`
}

type EKSPreset struct {
	ProviderPreset `json:",inline"`

	AccessKeyID          string `json:"accessKeyID"`
	SecretAccessKey      string `json:"secretAccessKey"`
	AssumeRoleARN        string `json:"assumeRoleARN,omitempty"` //nolint:tagliatelle
	AssumeRoleExternalID string `json:"assumeRoleExternalID,omitempty"`
}

type EncryptionConfiguration struct {
	// Enables encryption-at-rest on this cluster.
	Enabled bool `json:"enabled"`

	// List of resources that will be stored encrypted in etcd.
	Resources []string `json:"resources"`
	// Configuration for the `secretbox` static key encryption scheme as supported by Kubernetes.
	// More info: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers
	Secretbox *SecretboxEncryptionConfiguration `json:"secretbox,omitempty"`
}

type EnvoyLoadBalancerService struct {
	// Annotations are used to further tweak the LoadBalancer integration with the
	// cloud provider.
	Annotations map[string]string `json:"annotations,omitempty"`
	// SourceRanges will restrict loadbalancer service to IP ranges specified using CIDR notation like 172.25.0.0/16.
	// This field will be ignored if the cloud-provider does not support the feature.
	// More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/
	SourceRanges []CIDR `json:"sourceRanges,omitempty"`
}