v1alpha1

type ConfigSyncError struct {
	// code is the error code of this particular error.  Error codes are numeric strings,
	// like "1012".
	Code string `json:"code"`

	// errorMessage describes the error that occurred.
	ErrorMessage string `json:"errorMessage"`

	// errorResources describes the resources associated with this error, if any.
	// +optional
	Resources []ResourceRef `json:"errorResources,omitempty"`
}

type ContainerLogLevelOverride struct {
	// containerName specifies the name of the reconciler deployment container for which log level will be overridden.
	// Must be one of the following: "reconciler", "git-sync", "hydration-controller", "oci-sync", or "helm-sync".
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=^(reconciler|git-sync|hydration-controller|oci-sync|helm-sync|gcenode-askpass-sidecar|otel-agent)$
	ContainerName string `json:"containerName"`

	// logLevel specifies the verbosity level of the logging for a specific container.
	// The "git-sync" and "otel-agent" containers default to 5, while all other containers default to 0.
	// Increasing the value of logLevel increases the verbosity of the logs.
	// Lower severity messages are logged at higher verbosity.
	// Allowed values are from 0 to 10.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=10
	// +kubebuilder:validation:Required
	LogLevel int `json:"logLevel"`
}

type ContainerResourcesSpec struct {
	// containerName specifies the name of a container whose resource requirements will be overridden.
	// Must be "reconciler", "git-sync", "hydration-controller", "oci-sync", or "helm-sync".
	//
	// +kubebuilder:validation:Pattern=^(reconciler|git-sync|hydration-controller|oci-sync|helm-sync|gcenode-askpass-sidecar|otel-agent)$
	// +optional
	ContainerName string `json:"containerName,omitempty"`
	// cpuRequest allows one to override the CPU request of a container
	// +optional
	CPURequest resource.Quantity `json:"cpuRequest,omitempty"`
	// memoryRequest allows one to override the memory request of a container
	// +optional
	MemoryRequest resource.Quantity `json:"memoryRequest,omitempty"`
	// cpuLimit allows one to override the CPU limit of a container
	// +optional
	CPULimit resource.Quantity `json:"cpuLimit,omitempty"`
	// memoryLimit allows one to override the memory limit of a container
	// +optional
	MemoryLimit resource.Quantity `json:"memoryLimit,omitempty"`
}

type ErrorSource string

type ErrorSummary struct {
	// totalCount tracks the total number of errors.
	TotalCount int `json:"totalCount,omitempty"`
	// truncated indicates whether the `Errors` field includes all the errors.
	// If `true`, the `Errors` field does not includes all the errors.
	// If `false`, the `Errors` field includes all the errors.
	// The size limit of a RootSync/RepoSync object is 2MiB. The status update would
	// fail with the `ResourceExhausted` rpc error if there are too many errors.
	Truncated bool `json:"truncated,omitempty"`
	// errorCountAfterTruncation tracks the number of errors in the `Errors` field.
	ErrorCountAfterTruncation int `json:"errorCountAfterTruncation,omitempty"`
}

type Git struct {
	// repo is the git repository URL to sync from. Required.
	Repo string `json:"repo"`

	// branch is the git branch to sync from.
	// Branch defaults to 'master', but if 'revision' is set and is not 'HEAD',
	// 'revision' takes precedence over 'branch'.
	// +optional
	Branch string `json:"branch,omitempty"`

	// revision is the git revision (branch, tag, ref or commit) to fetch.
	// If 'revision' is not specified, it defaults to the HEAD of the branch that
	// is specified in the 'branch' field.
	// If neither 'revision' nor 'branch' is specified, it defaults to the HEAD of
	// the 'master' branch.
	// +optional
	Revision string `json:"revision,omitempty"`

	// dir is the absolute path of the directory that contains
	// the local resources.  Default: the root directory of the repo.
	// +optional
	Dir string `json:"dir,omitempty"`

	// period is the time duration between consecutive syncs. Default: 15s.
	// Note to developers that customers specify this value using
	// string (https://golang.org/pkg/time/#Duration.String) like "3s"
	// in their Custom Resource YAML. However, time.Duration is at a nanosecond
	// granularity, and it is easy to introduce a bug where it looks like the
	// code is dealing with seconds but its actually nanoseconds (or vice versa).
	// +optional
	Period metav1.Duration `json:"period,omitempty"`

	// auth is the type of secret configured for access to the Git repo.
	// Must be one of ssh, cookiefile, gcenode, token, or none.
	// The validation of this is case-sensitive. Required.
	//
	// +kubebuilder:validation:Enum=ssh;cookiefile;gcenode;gcpserviceaccount;token;none
	Auth configsync.AuthType `json:"auth"`

	// gcpServiceAccountEmail specifies the GCP service account used to annotate
	// the RootSync/RepoSync controller Kubernetes Service Account.
	// Note: The field is used when spec.git.auth: gcpserviceaccount.
	GCPServiceAccountEmail string `json:"gcpServiceAccountEmail,omitempty"`

	// proxy specifies an HTTPS proxy for accessing the Git repo.
	// Only has an effect when secretType is one of ("cookiefile", "none", "token").
	// When secretType is "cookiefile" or "token", if your HTTPS proxy URL contains sensitive information
	// such as a username or password and you need to hide the sensitive information,
	// you can leave this field empty and add the URL for the HTTPS proxy into the same Secret
	// used for the Git credential via `kubectl create secret ... --from-literal=https_proxy=HTTPS_PROXY_URL`. Optional.
	// +optional
	Proxy string `json:"proxy,omitempty"`

	// secretRef is the secret used to connect to the Git source of truth.
	// +nullable
	// +optional
	SecretRef *SecretReference `json:"secretRef,omitempty"`

	// noSSLVerify specifies whether to enable or disable the SSL certificate verification. Default: false.
	// If noSSLVerify is set to true, it tells Git to skip the SSL certificate verification.
	// This should either be false or unset when caCertSecretRef is provided.
	// +optional
	NoSSLVerify bool `json:"noSSLVerify,omitempty"`

	// caCertSecretRef specifies the name of the secret where the CA certificate is stored.
	// The creation of the secret should be done out of band by the user and should store the
	// certificate in a key named "cert". For RepoSync resources, the secret must be
	// created in the same namespace as the RepoSync. For RootSync resource, the secret
	// must be created in the config-management-system namespace.
	// +nullable
	// +optional
	CACertSecretRef *SecretReference `json:"caCertSecretRef,omitempty"`
}

type GitStatus struct {
	// repo is the git repository URL being synced from.
	Repo string `json:"repo"`

	// revision is the git revision (tag, ref, or commit) being fetched.
	Revision string `json:"revision"`

	// branch is the git branch being fetched
	Branch string `json:"branch"`

	// dir is the path within the Git repository that represents the top level of the repo to sync.
	// Default: the root directory of the repository
	Dir string `json:"dir"`
}

type HelmBase struct {
	// repo is the helm repository URL to sync from. Required.
	Repo string `json:"repo"`

	// chart is a Helm chart name. Required.
	Chart string `json:"chart"`

	// version is the chart version.
	// This can be specified as a static version, or as a range of values from which Config Sync
	// will fetch the latest. If left empty, Config Sync will fetch the latest version according to semver.
	// The supported version range syntax is identical to the version range syntax
	// supported by helm CLI, and is documented here: https://github.com/Masterminds/semver#hyphen-range-comparisons.
	// Versions specified as a range, the literal tag "latest", or left empty to indicate that Config Sync should
	// fetch the latest version, will be fetched every sync according to spec.helm.period.
	// +optional
	Version string `json:"version,omitempty"`

	// releaseName is the name of the Helm release.
	// +optional
	ReleaseName string `json:"releaseName,omitempty"`

	// values to use instead of default values that accompany the chart. Format
	// values the same as default values.yaml. If `valuesFileRefs` is also specified,
	// fields from `values` will override fields from `valuesFileRefs`.
	// +optional
	Values *apiextensionsv1.JSON `json:"values,omitempty"`

	// valuesFileRefs holds references to objects in the cluster that represent
	// values to use instead of default values that accompany the chart. Currently,
	// only ConfigMaps are supported. The ConfigMaps must be immutable and in the same
	// namespace as the RootSync/RepoSync. When multiple values files are specified, duplicated
	// keys in later files will override the value from earlier files. This is equivalent
	// to passing in multiple values files to Helm CLI. If `values` is also specified,
	// fields from `values` will override fields from `valuesFileRefs`.
	// +optional
	ValuesFileRefs []ValuesFileRef `json:"valuesFileRefs,omitempty"`

	// includeCRDs specifies if Helm template should also generate CustomResourceDefinitions.
	// If IncludeCRDs is set to false, no CustomeResourceDefinition will be generated.
	// Default: false.
	// +optional
	IncludeCRDs bool `json:"includeCRDs,omitempty"`

	// period is the time duration that Config Sync waits before refetching the chart.
	// Default: 1 hour.
	// Use string to specify this field value, like "30s", "5m".
	// More details about valid inputs: https://pkg.go.dev/time#ParseDuration.
	// If the chart version is a range, the literal tag "latest", or left empty to indicate that Config Sync
	// should fetch the latest version, the chart will be re-fetched according to spec.helm.period.
	// If the chart version is specified as a single static version, the chart will not be re-fetched.
	// +optional
	Period metav1.Duration `json:"period,omitempty"`

	// auth specifies the type to authenticate to the Helm repository.
	// Must be one of token, gcpserviceaccount, k8sserviceaccount, gcenode or none.
	// The validation of this is case-sensitive. Required.
	// +kubebuilder:validation:Enum=none;gcpserviceaccount;k8sserviceaccount;token;gcenode
	Auth configsync.AuthType `json:"auth"`

	// gcpServiceAccountEmail specifies the GCP service account used to annotate
	// the RootSync/RepoSync controller Kubernetes Service Account.
	// Note: The field is used when spec.helm.auth: gcpserviceaccount.
	// +optional
	GCPServiceAccountEmail string `json:"gcpServiceAccountEmail,omitempty"`

	// secretRef holds the authentication secret for accessing
	// the Helm repository.
	// +nullable
	// +optional
	SecretRef *SecretReference `json:"secretRef,omitempty"`
}

type HelmRepoSync struct {
	HelmBase `json:",inline"`
}

type HelmRootSync struct {
	HelmBase `json:",inline"`
	// namespace sets the target namespace for a release.
	// Default: "default".
	// +optional
	Namespace string `json:"namespace,omitempty"`
	// deployNamespace specifies the namespace in which to deploy the chart.
	// This is a mutually exclusive setting with "namespace".
	// If neither namespace nor deployNamespace are set, the chart will be
	// deployed into the default namespace.
	// +optional
	DeployNamespace string `json:"deployNamespace,omitempty"`
}

type HelmStatus struct {
	// repo is the helm repository URL being synced from.
	Repo string `json:"repo"`

	// version is the helm chart version being fetched.
	Version string `json:"version"`

	// chart is the name of helm chart being fetched
	Chart string `json:"chart"`
}

type Oci struct {
	// image is the OCI image repository URL for the package to sync from.
	// e.g. `LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME`.
	// The image can be pulled by TAG or by DIGEST if it is specified in PACKAGE_NAME.
	// - Pull by tag: `LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME:TAG`.
	// - Pull by digest: `LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME@sha256:DIGEST`.
	// If neither TAG nor DIGEST is specified, it pulls with the `latest` tag by default.
	// Required
	Image string `json:"image"`

	// dir is the absolute path of the directory that contains
	// the local resources.  Default: the root directory of the image.
	// +optional
	Dir string `json:"dir,omitempty"`

	// period is the time duration between consecutive syncs. Default: 15s.
	// Note to developers that customers specify this value using
	// string (https://golang.org/pkg/time/#Duration.String) like "3s"
	// in their Custom Resource YAML. However, time.Duration is at a nanosecond
	// granularity, and it is easy to introduce a bug where it looks like the
	// code is dealing with seconds but its actually nanoseconds (or vice versa).
	// +optional
	Period metav1.Duration `json:"period,omitempty"`

	// auth is the type of secret configured for access to the OCI package.
	// Must be one of gcenode, gcpserviceaccount, k8sserviceaccount, or none.
	// The validation of this is case-sensitive. Required.
	//
	// +kubebuilder:validation:Enum=gcenode;gcpserviceaccount;k8sserviceaccount;none
	Auth configsync.AuthType `json:"auth"`

	// gcpServiceAccountEmail specifies the GCP service account used to annotate
	// the RootSync/RepoSync controller Kubernetes Service Account.
	// Note: The field is used when secretType: gcpServiceAccount.
	GCPServiceAccountEmail string `json:"gcpServiceAccountEmail,omitempty"`
}

type OciStatus struct {
	// image is the OCI image repository URL for the package to sync from.
	Image string `json:"image"`

	// dir is the absolute path of the directory that contains the local resources.
	// Default: the root directory of the repository
	Dir string `json:"dir"`
}

type OverrideSpec struct {
	// resources allow one to override the resource requirements for the containers in a reconciler pod.
	// +optional
	Resources []ContainerResourcesSpec `json:"resources,omitempty"`

	// gitSyncDepth allows one to override the number of git commits to fetch.
	// Must be no less than 0.
	// Config Sync would do a full clone if this field is 0, and a shallow
	// clone if this field is greater than 0.
	// If this field is not provided, Config Sync would configure it automatically.
	//
	// +kubebuilder:validation:Minimum=0
	// +optional
	GitSyncDepth *int64 `json:"gitSyncDepth,omitempty"`

	// statusMode controls whether the actuation status
	// such as apply failed or not should be embedded into the ResourceGroup object.
	// Must be "enabled" or "disabled".
	// If set to "enabled", it increases the size of the ResourceGroup object.
	//
	// +kubebuilder:validation:Pattern=^(enabled|disabled|)$
	// +optional
	StatusMode string `json:"statusMode,omitempty"`

	// reconcileTimeout allows one to override the threshold for how long to wait for
	// all resources to reconcile before giving up.
	// Default: 5m.
	// Use string to specify this field value, like "30s", "5m".
	// More details about valid inputs: https://pkg.go.dev/time#ParseDuration.
	// Recommended reconcileTimeout range is from "10s" to "1h".
	// +optional
	ReconcileTimeout *metav1.Duration `json:"reconcileTimeout,omitempty"`

	// apiServerTimeout allows one to override the client-side timeout for requests to the API server.
	// Default: 15s.
	// Use string to specify this field value, like "30s", "1m".
	// More details about valid inputs: https://pkg.go.dev/time#ParseDuration.
	// Recommended apiServerTimeout range is from "3s" to "1m".
	// +optional
	APIServerTimeout *metav1.Duration `json:"apiServerTimeout,omitempty"`

	// enableShellInRendering specifies whether to enable or disable the shell access in rendering process. Default: false.
	// Kustomize remote bases requires shell access. Setting this field to true will enable shell in the rendering process and
	// support pulling remote bases from public repositories.
	// +optional
	EnableShellInRendering *bool `json:"enableShellInRendering,omitempty"`

	// logLevels specify the container name and log level override value for the reconciler deployment container.
	// Each entry must contain the name of the reconciler deployment container and the desired log level.
	// +listType=map
	// +listMapKey=containerName
	// +optional
	LogLevels []ContainerLogLevelOverride `json:"logLevels,omitempty"`
}

type RenderingStatus struct {
	// gitStatus contains fields describing the status of a Git source of truth.
	// +optional
	Git *GitStatus `json:"gitStatus,omitempty"`

	// ociStatus contains fields describing the status of an OCI source of truth.
	// +optional
	Oci *OciStatus `json:"ociStatus,omitempty"`

	// helmStatus contains fields describing the status of a Helm source of truth.
	// +optional
	Helm *HelmStatus `json:"helmStatus,omitempty"`

	// hash of the source of truth that is rendered.
	// It can be a git commit hash, or an OCI image digest.
	// +optional
	Commit string `json:"commit,omitempty"`

	// Human-readable message describes details about the rendering status.
	Message string `json:"message,omitempty"`

	// lastUpdate is the timestamp of when this status was last updated by a
	// reconciler.
	// +nullable
	// +optional
	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`

	// errors is a list of any errors that occurred while rendering the source of truth.
	// +optional
	Errors []ConfigSyncError `json:"errors,omitempty"`

	// errorSummary summarizes the errors encountered during the process of rendering the source of truth.
	// +optional
	ErrorSummary *ErrorSummary `json:"errorSummary,omitempty"`
}

type RepoSync struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +optional
	Spec RepoSyncSpec `json:"spec,omitempty"`
	// +optional
	Status RepoSyncStatus `json:"status,omitempty"`
}

type RepoSyncCondition struct {
	// type of RepoSync condition.
	Type RepoSyncConditionType `json:"type"`
	// status of the condition, one of True, False, Unknown.
	Status metav1.ConditionStatus `json:"status"`
	// The last time this condition was updated.
	// +nullable
	// +optional
	LastUpdateTime metav1.Time `json:"lastUpdateTime,omitempty"`
	// Last time the condition transitioned from one status to another.
	// +nullable
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
	// The reason for the condition's last transition.
	// +optional
	Reason string `json:"reason,omitempty"`
	// A human readable message indicating details about the transition.
	// +optional
	Message string `json:"message,omitempty"`
	// hash of the source of truth. It can be a git commit hash, or an OCI image digest.
	// +optional
	Commit string `json:"commit,omitempty"`
	// errors is a list of errors that occurred in the process.
	// This field is used to track errors when the condition type is Reconciling or Stalled.
	// When the condition type is Syncing, the `errorSourceRefs` field is used instead to
	// avoid duplicating errors between `status.conditions` and `status.rendering|source|sync`.
	// +optional
	Errors []ConfigSyncError `json:"errors,omitempty"`
	// errorSourceRefs track the origination(s) of errors when the condition type is Syncing.
	// +optional
	ErrorSourceRefs []ErrorSource `json:"errorSourceRefs,omitempty"`
	// errorSummary summarizes the errors in the `errors` field when the condition type is Reconciling or Stalled,
	// and summarizes the errors referred in the `errorsSourceRefs` field when the condition type is Syncing.
	// +optional
	ErrorSummary *ErrorSummary `json:"errorSummary,omitempty"`
}

type RepoSyncConditionType string

type RepoSyncList struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []RepoSync `json:"items"`
}

type RepoSyncOverrideSpec struct {
	OverrideSpec `json:",inline"`
}

type RepoSyncSpec struct {
	// sourceFormat specifies how the repository is formatted.
	// See documentation for specifics of what these options do.
	//
	// Must be one of hierarchy, unstructured. Optional. Set to
	// hierarchy if not specified.
	//
	// The validation of this is case-sensitive.
	// +kubebuilder:validation:Pattern=^(unstructured|)$
	// +optional
	SourceFormat string `json:"sourceFormat,omitempty"`

	// sourceType specifies the type of the source of truth.
	//
	// Must be one of git, oci, helm. Optional. Set to git if not specified.
	// +kubebuilder:validation:Pattern=^(git|oci|helm)$
	// +kubebuilder:default:=git
	// +optional
	SourceType string `json:"sourceType,omitempty"`

	// git contains configuration specific to importing resources from a Git repo.
	// +optional
	*Git `json:"git,omitempty"`

	// oci contains configuration specific to importing resources from an OCI package.
	// +optional
	Oci *Oci `json:"oci,omitempty"`

	// helm contains configuration specific to importing resources from a Helm repo.
	// +optional
	Helm *HelmRepoSync `json:"helm,omitempty"`

	// override allows to override the settings for a reconciler.
	// +nullable
	// +optional
	Override *RepoSyncOverrideSpec `json:"override,omitempty"`
}

type RepoSyncStatus struct {
	Status `json:",inline"`

	// conditions represents the latest available observations of the RepoSync's
	// current state.
	// +optional
	Conditions []RepoSyncCondition `json:"conditions,omitempty"`
}

type ResourceRef struct {
	// sourcePath is the repo-relative slash path to where the config is defined.
	// This field may be empty for errors that are not associated with a specific
	// config file.
	// +optional
	SourcePath string `json:"sourcePath,omitempty"`

	// name is the name of the affected K8S resource. This field may be empty for
	// errors that are not associated with a specific resource.
	// +optional
	Name string `json:"name,omitempty"`

	// namespace is the namespace of the affected K8S resource. This field may be
	// empty for errors that are associated with a cluster-scoped resource or not
	// associated with a specific resource.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// gvk is the GroupVersionKind of the affected K8S resource. This field may be
	// empty for errors that are not associated with a specific resource.
	// +optional
	GVK metav1.GroupVersionKind `json:"gvk,omitempty"`
}

type RootSync struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// +optional
	Spec RootSyncSpec `json:"spec,omitempty"`
	// +optional
	Status RootSyncStatus `json:"status,omitempty"`
}

type RootSyncCondition struct {
	// type of RootSync condition.
	Type RootSyncConditionType `json:"type"`
	// status of the condition, one of True, False, Unknown.
	Status metav1.ConditionStatus `json:"status"`
	// The last time this condition was updated.
	// +nullable
	// +optional
	LastUpdateTime metav1.Time `json:"lastUpdateTime,omitempty"`
	// Last time the condition transitioned from one status to another.
	// +nullable
	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
	// The reason for the condition's last transition.
	// +optional
	Reason string `json:"reason,omitempty"`
	// A human readable message indicating details about the transition.
	// +optional
	Message string `json:"message,omitempty"`
	// hash of the source of truth. It can be a git commit hash, or an OCI image digest.
	// +optional
	Commit string `json:"commit,omitempty"`
	// errors is a list of errors that occurred in the process.
	// This field is used to track errors when the condition type is Reconciling or Stalled.
	// When the condition type is Syncing, the `errorSourceRefs` field is used instead to
	// avoid duplicating errors between `status.conditions` and `status.rendering|source|sync`.
	// +optional
	Errors []ConfigSyncError `json:"errors,omitempty"`
	// errorSourceRefs track the origination(s) of errors when the condition type is Syncing.
	// +optional
	ErrorSourceRefs []ErrorSource `json:"errorSourceRefs,omitempty"`
	// errorSummary summarizes the errors in the `errors` field when the condition type is Reconciling or Stalled,
	// and summarizes the errors referred in the `errorsSourceRefs` field when the condition type is Syncing.
	// +optional
	ErrorSummary *ErrorSummary `json:"errorSummary,omitempty"`
}

type RootSyncConditionType string

type RootSyncList struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []RootSync `json:"items"`
}

type RootSyncOverrideSpec struct {
	OverrideSpec `json:",inline"`

	// namespaceStrategy controls how the reconciler handles Namespaces
	// which are used by resources in the source but not declared. Only applies
	// when using the unstructured sourceFormat.
	// Must be "implicit" or "explicit". Default: "implicit".
	// "implicit" means that the reconciler will implicitly create Namespaces
	// if they do not exist, even if they are not declared in the source.
	// "explicit" means that the reconciler will not create Namespaces which
	// are not declared in the source.
	//
	// +kubebuilder:validation:Enum=implicit;explicit
	// +optional
	NamespaceStrategy configsync.NamespaceStrategy `json:"namespaceStrategy,omitempty"`

	// roleRefs is a list of Roles or ClusterRoles to create bindings.
	// If unset, a binding to cluster-admin will be created.
	//
	// +optional
	RoleRefs []RootSyncRoleRef `json:"roleRefs,omitempty"`
}

type RootSyncRoleRef struct {
	// kind refers to the Kind of the RBAC resource.
	// Accepted values are Role and ClusterRole. Required.
	//
	// +kubebuilder:validation:Enum=Role;ClusterRole
	Kind string `json:"kind"`

	// name is the name of the Role or ClusterRole resource. Required.
	Name string `json:"name"`

	// namespace indicates the Namespace in which a RoleBinding should be created.
	// For ClusterRole objects, will determine whether a RoleBinding or ClusterRoleBinding
	// is created.
	// For Role objects, must be set to the same namespace as the Role.
	//
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type RootSyncSpec struct {
	// sourceFormat specifies how the repository is formatted.
	// See documentation for specifics of what these options do.
	//
	// Must be one of hierarchy, unstructured. Optional. Set to
	// hierarchy if not specified.
	//
	// The validation of this is case-sensitive.
	// +kubebuilder:validation:Pattern=^(hierarchy|unstructured|)$
	// +optional
	SourceFormat string `json:"sourceFormat,omitempty"`

	// sourceType specifies the type of the source of truth.
	//
	// Must be one of git, oci, helm. Optional. Set to git if not specified.
	// +kubebuilder:validation:Pattern=^(git|oci|helm)$
	// +kubebuilder:default:=git
	// +optional
	SourceType string `json:"sourceType,omitempty"`

	// git contains configuration specific to importing resources from a Git repo.
	// +optional
	*Git `json:"git,omitempty"`

	// oci contains configuration specific to importing resources from an OCI package.
	// +optional
	Oci *Oci `json:"oci,omitempty"`

	// helm contains configuration specific to importing resources from a Helm repo.
	// +optional
	Helm *HelmRootSync `json:"helm,omitempty"`

	// override allows to override the settings for a reconciler.
	// +nullable
	// +optional
	Override *RootSyncOverrideSpec `json:"override,omitempty"`
}

type RootSyncStatus struct {
	Status `json:",inline"`

	// conditions represents the latest available observations of the RootSync's
	// current state.
	// +optional
	Conditions []RootSyncCondition `json:"conditions,omitempty"`
}

type SecretReference struct {
	// name represents the secret name.
	// +optional
	Name string `json:"name,omitempty"`
}

type SourceStatus struct {
	// gitStatus contains fields describing the status of a Git source of truth.
	// +optional
	Git *GitStatus `json:"gitStatus,omitempty"`

	// ociStatus contains fields describing the status of an OCI source of truth.
	// +optional
	Oci *OciStatus `json:"ociStatus,omitempty"`

	// helmStatus contains fields describing the status of a Helm source of truth.
	// +optional
	Helm *HelmStatus `json:"helmStatus,omitempty"`

	// hash of the source of truth that is rendered.
	// It can be a git commit hash, or an OCI image digest.
	// +optional
	Commit string `json:"commit,omitempty"`

	// lastUpdate is the timestamp of when this status was last updated by a
	// reconciler.
	// +nullable
	// +optional
	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`

	// errors is a list of any errors that occurred while reading from the source of truth.
	// +optional
	Errors []ConfigSyncError `json:"errors,omitempty"`

	// errorSummary summarizes the errors encountered during the process of reading from the source of truth.
	// +optional
	ErrorSummary *ErrorSummary `json:"errorSummary,omitempty"`
}

type SourceType string

type Status struct {
	// observedGeneration is the most recent generation observed for the sync resource.
	// It corresponds to the it's generation, which is updated on mutation by the API Server.
	// +optional
	// +kubebuilder:default:=0
	ObservedGeneration int64 `json:"observedGeneration"`

	// reconciler is the name of the reconciler process which corresponds to the
	// sync resource.
	// +optional
	Reconciler string `json:"reconciler,omitempty"`

	// lastSyncedCommit describes the most recent hash that is successfully synced.
	// It can be a git commit hash, or an OCI image digest.
	// +optional
	LastSyncedCommit string `json:"lastSyncedCommit,omitempty"`

	// source contains fields describing the status of a *Sync's source of
	// truth.
	// +optional
	Source SourceStatus `json:"source,omitempty"`

	// rendering contains fields describing the status of rendering resources from
	// the source of truth.
	// +optional
	Rendering RenderingStatus `json:"rendering,omitempty"`

	// sync contains fields describing the status of syncing resources from the
	// source of truth to the cluster.
	// +optional
	Sync SyncStatus `json:"sync,omitempty"`
}

type SyncStatus struct {
	// gitStatus contains fields describing the status of a Git source of truth.
	// +optional
	Git *GitStatus `json:"gitStatus,omitempty"`

	// ociStatus contains fields describing the status of an OCI source of truth.
	// +optional
	Oci *OciStatus `json:"ociStatus,omitempty"`

	// helmStatus contains fields describing the status of a Helm source of truth.
	// +optional
	Helm *HelmStatus `json:"helmStatus,omitempty"`

	// hash of the source of truth that is rendered.
	// It can be a git commit hash, or an OCI image digest.
	// +optional
	Commit string `json:"commit,omitempty"`

	// lastUpdate is the timestamp of when this status was last updated by a
	// reconciler.
	// +nullable
	// +optional
	LastUpdate metav1.Time `json:"lastUpdate,omitempty"`

	// errors is a list of any errors that occurred while applying the resources
	// from the change indicated by Commit.
	// +optional
	Errors []ConfigSyncError `json:"errors,omitempty"`

	// errorSummary summarizes the errors encountered during the process of syncing the resources.
	// +optional
	ErrorSummary *ErrorSummary `json:"errorSummary,omitempty"`
}

type ValuesFileRef struct {
	// name represents the Object name. Required.
	Name string `json:"name,omitempty"`

	// dataKey represents the object data key to read the values from. Default: `values.yaml`
	// +optional
	DataKey string `json:"dataKey,omitempty"`
}