v1

type AppNamespaceSpec struct {
	// Name is the namespace to deploy the Application into.
	// Should be a valid lowercase RFC1123 domain name
	// +kubebuilder:validation:Pattern:=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	// +kubebuilder:validation:MaxLength:=63
	// +kubebuilder:validation:Type=string
	Name string `json:"name"`

	// Create defines whether the namespace should be created if it does not exist. Defaults to true
	Create bool `json:"create"`

	// Labels of the namespace
	// More info: http://kubernetes.io/docs/user-guide/labels
	// +optional
	Labels map[string]string `json:"labels,omitempty"`

	// Annotations of the namespace
	// More info: http://kubernetes.io/docs/user-guide/annotations
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
}

type ApplicationDefinition struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec ApplicationDefinitionSpec `json:"spec,omitempty"`
}

type ApplicationDefinitionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ApplicationDefinition `json:"items"`
}

type ApplicationDefinitionSpec struct {
	// Description of the application. what is its purpose
	Description string `json:"description"`

	// Method used to install the application
	Method TemplateMethod `json:"method"`

	// DefaultValues describe overrides for manifest-rendering in UI when creating an application.
	// +kubebuilder:pruning:PreserveUnknownFields
	DefaultValues *runtime.RawExtension `json:"defaultValues,omitempty"`

	// DefaultDeployOptions holds the settings specific to the templating method used to deploy the application.
	// These settings can be overridden in applicationInstallation.
	DefaultDeployOptions *DeployOptions `json:"defaultDeployOptions,omitempty"`

	// Available version for this application
	Versions []ApplicationVersion `json:"versions"`
}

type ApplicationInstallation struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ApplicationInstallationSpec   `json:"spec,omitempty"`
	Status ApplicationInstallationStatus `json:"status,omitempty"`
}

type ApplicationInstallationCondition struct {
	// Status of the condition, one of True, False, Unknown.
	Status corev1.ConditionStatus `json:"status"`
	// Last time we got an update on a given condition.
	// +optional
	LastHeartbeatTime metav1.Time `json:"lastHeartbeatTime,omitempty"`
	// Last time the condition transit from one status to another.
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
	// (brief) reason for the condition's last transition.
	Reason string `json:"reason,omitempty"`
	// Human readable message indicating details about last transition.
	Message string `json:"message,omitempty"`

	// observedGeneration represents the .metadata.generation that the condition was set based upon.
	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
	// with respect to the current state of the instance.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type ApplicationInstallationConditionType string

type ApplicationInstallationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ApplicationInstallation `json:"items"`
}

type ApplicationInstallationSpec struct {
	// Namespace describe the desired state of the namespace where application will be created.
	Namespace AppNamespaceSpec `json:"namespace"`

	// ApplicationRef is a reference to identify which Application should be deployed
	ApplicationRef ApplicationRef `json:"applicationRef"`

	// Values describe overrides for manifest-rendering. It's a free yaml field.
	// +kubebuilder:pruning:PreserveUnknownFields
	Values runtime.RawExtension `json:"values,omitempty"`

	// ReconciliationInterval is the interval at which to force the reconciliation of the application. By default, Applications are only reconciled
	// on changes on spec, annotations, or the parent application definition. Meaning that if the user manually deletes the workload
	// deployed by the application, nothing will happen until the application CR change.
	//
	// Setting a value greater than zero force reconciliation even if no changes occurred on application CR.
	// Setting a value equal to 0 disables the force reconciliation of the application (default behavior).
	// Setting this too low can cause a heavy load and may disrupt your application workload depending on the template method.
	ReconciliationInterval metav1.Duration `json:"reconciliationInterval,omitempty"`

	// DeployOptions holds the settings specific to the templating method used to deploy the application.
	DeployOptions *DeployOptions `json:"deployOptions,omitempty"`
}

type ApplicationInstallationStatus struct {
	// Conditions contains conditions an installation is in, its primary use case is status signaling between controllers or between controllers and the API
	Conditions map[ApplicationInstallationConditionType]ApplicationInstallationCondition `json:"conditions,omitempty"`

	// ApplicationVersion contains information installing / removing application
	ApplicationVersion *ApplicationVersion `json:"applicationVersion,omitempty"`

	// Method used to install the application
	Method TemplateMethod `json:"method"`

	// HelmRelease holds the information about the helm release installed by this application. This field is only filled if template method is 'helm'.
	HelmRelease *HelmRelease `json:"helmRelease,omitempty"`

	// Failures counts the number of failed installation or updagrade. it is reset on successful reconciliation.
	Failures int `json:"failures,omitempty"`
}

type ApplicationRef struct {
	// Name of the Application.
	// Should be a valid lowercase RFC1123 domain name
	// +kubebuilder:validation:Pattern:=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	// +kubebuilder:validation:MaxLength:=63
	// +kubebuilder:validation:Type=string
	Name string `json:"name"`

	// Version of the Application. Must be a valid SemVer version
	Version string `json:"version"`
}

type ApplicationSource struct {
	// Install Application from a Helm repository
	Helm *HelmSource `json:"helm,omitempty"`

	// Install application from a Git repository
	Git *GitSource `json:"git,omitempty"`
}

type ApplicationTemplate struct {
	// Defined how the source of the application (e.g Helm chart) is retrieved.
	// Exactly one type of source must be defined.
	Source ApplicationSource `json:"source"`

	// DependencyCredentials holds the credentials that may be needed for templating the application.
	DependencyCredentials *DependencyCredentials `json:"templateCredentials,omitempty"`
}

type ApplicationVersion struct {

	// Version of the application (e.g. v1.2.3)
	Version string `json:"version"`

	// Template defines how application is installed (source provenance, Method...)
	Template ApplicationTemplate `json:"template"`
}

type DependencyCredentials struct {
	// HelmCredentials holds the ref to the secret with helm credentials needed to build helm dependencies.
	// It is not required when using helm as a source, as dependencies are already prepackaged in this case.
	// It's either username / password or a registryConfigFile can be defined.
	HelmCredentials *HelmCredentials `json:"helmCredentials,omitempty"`
}

type DeployOptions struct {
	Helm *HelmDeployOptions `json:"helm,omitempty"`
}

type GitAuthMethod string

type GitCredentials struct {
	// Authentication method. Either password or token or ssh-key.
	// if method is password then username and password must be defined.
	// if method is token then token must be defined.
	// if method is ssh-key then ssh-key must be defined.
	Method GitAuthMethod `json:"method"`

	// Username holds the ref and key in the secret for the username credential.
	// The Secret must exist in the namespace where KKP is installed (default is "kubermatic").
	// The Secret must be annotated with `apps.kubermatic.k8c.io/secret-type:` set to helm or git
	Username *corev1.SecretKeySelector `json:"username,omitempty"`

	// Password holds the ref and key in the secret for the Password credential.
	// The Secret must exist in the namespace where KKP is installed (default is "kubermatic").
	// The Secret must be annotated with `apps.kubermatic.k8c.io/secret-type:` set to helm or git
	Password *corev1.SecretKeySelector `json:"password,omitempty"`

	// Token holds the ref and key in the secret for the token credential.
	// The Secret must exist in the namespace where KKP is installed (default is "kubermatic").
	// The Secret must be annotated with `apps.kubermatic.k8c.io/secret-type:` set to helm or git
	Token *corev1.SecretKeySelector `json:"token,omitempty"`

	// SSHKey holds the ref and key in the secret for the SshKey credential.
	// The Secret must exist in the namespace where KKP is installed (default is "kubermatic").
	// The Secret must be annotated with `apps.kubermatic.k8c.io/secret-type:` set to helm or git
	SSHKey *corev1.SecretKeySelector `json:"sshKey,omitempty"`
}

type GitReference struct {
	// Branch to checkout. Only the last commit of the branch will be checkout in order to reduce the amount of data to download.
	// +optional
	Branch string `json:"branch,omitempty"`

	// Commit SHA in a Branch to checkout.
	//
	// It must be used in conjunction with branch field.
	// +kubebuilder:validation:Pattern:=`^[a-f0-9]{40}$`
	// +kubebuilder:validation:Type=string
	// +optional
	Commit string `json:"commit,omitempty"`

	// Tag to check out.
	// It can not be used in conjunction with commit or branch.
	// +kubebuilder:validation:Type=string
	// +optional
	Tag string `json:"tag,omitempty"`
}

type GitSource struct {
	// URL to the repository. Can be HTTP(s) (e.g. https://example.com/myrepo) or SSH (e.g. git://example.com[:port]/path/to/repo.git/)
	// +kubebuilder:validation:MinLength=1
	Remote string `json:"remote"`

	// Git reference to checkout.
	// For large repositories, we recommend to either use Tag, Branch or Branch+Commit. This allows a shallow clone, which dramatically speeds up performance
	Ref GitReference `json:"ref"`

	// Path of the "source" in the repository. default is repository root
	Path string `json:"path,omitempty"`

	// Credentials are optional and holds the git credentials
	Credentials *GitCredentials `json:"credentials,omitempty"`
}

type HelmCredentials struct {
	// Username holds the ref and key in the secret for the username credential.
	// The Secret must exist in the namespace where KKP is installed (default is "kubermatic").
	// The Secret must be annotated with `apps.kubermatic.k8c.io/secret-type:` set to helm or git
	Username *corev1.SecretKeySelector `json:"username,omitempty"`

	// Password holds the ref and key in the secret for the Password credential.
	// The Secret must exist in the namespace where KKP is installed (default is "kubermatic").
	// The Secret must be annotated with `apps.kubermatic.k8c.io/secret-type:` set to helm or git
	Password *corev1.SecretKeySelector `json:"password,omitempty"`

	// RegistryConfigFile holds the ref and key in the secret for the registry credential file. The value is dockercfg
	// file that follows the same format rules as ~/.docker/config.json
	// The The Secret must exist in the namespace where KKP is installed (default is "kubermatic").
	// The Secret must be annotated with `apps.kubermatic.k8c.io/secret-type:` set to helm or git
	RegistryConfigFile *corev1.SecretKeySelector `json:"registryConfigFile,omitempty"`
}

type HelmDeployOptions struct {
	// Wait corresponds to the --wait flag on Helm cli.
	// if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state before marking the release as successful. It will wait for as long as timeout
	Wait bool `json:"wait,omitempty"`

	// Timeout corresponds to the --timeout flag on Helm cli.
	// time to wait for any individual Kubernetes operation.
	Timeout metav1.Duration `json:"timeout,omitempty"`

	// Atomic corresponds to the --atomic flag on Helm cli.
	// if set, the installation process deletes the installation on failure; the upgrade process rolls back changes made in case of failed upgrade.
	Atomic bool `json:"atomic,omitempty"`

	// EnableDNS  corresponds to the --enable-dns flag on Helm cli.
	// enable DNS lookups when rendering templates.
	// if you enable this flag, you have to verify that helm template function 'getHostByName' is not being used in a chart to disclose any information you do not want to be passed to DNS servers.(c.f. CVE-2023-25165)
	EnableDNS bool `json:"enableDNS,omitempty"`
}

type HelmRelease struct {
	// Name is the name of the release.
	Name string `json:"name,omitempty"`

	// Version is an int which represents the revision of the release.
	Version int `json:"version,omitempty"`

	// Info provides information about a release.
	Info *HelmReleaseInfo `json:"info,omitempty"`
}

type HelmReleaseInfo struct {
	// FirstDeployed is when the release was first deployed.
	FirstDeployed metav1.Time `json:"firstDeployed,omitempty"`

	// LastDeployed is when the release was last deployed.
	LastDeployed metav1.Time `json:"lastDeployed,omitempty"`

	// Deleted tracks when this object was deleted.
	Deleted metav1.Time `json:"deleted,omitempty"`

	// Description is human-friendly "log entry" about this release.
	Description string `json:"description,omitempty"`

	// Status is the current state of the release. This field can take one of the
	// values of helm.hhs/helm/v3/pkg/releases/Status.
	Status string `json:"status,omitempty"`

	// Notes is  the rendered templates/NOTES.txt if available.
	Notes string `json:"notes,omitempty"`
}

type HelmSource struct {
	// URl of the helm repository.
	// It can be an HTTP(s) repository (e.g. https://localhost/myrepo) or on OCI repository (e.g. oci://localhost:5000/myrepo).
	// +kubebuilder:validation:Pattern="^(http|https|oci)://.+"
	URL string `json:"url"`

	// Name of the Chart.
	// +kubebuilder:validation:MinLength=1
	ChartName string `json:"chartName"`

	// Version of the Chart.
	// +kubebuilder:validation:MinLength=1
	ChartVersion string `json:"chartVersion"`

	// Credentials are optional and hold the ref to the secret with helm credentials.
	// Either username / Password or registryConfigFile can be defined.
	Credentials *HelmCredentials `json:"credentials,omitempty"`
}

type TemplateMethod string