v1alpha1

type AddOnConfig struct {
	// group and resource of add-on configuration.
	ConfigGroupResource `json:",inline"`

	// name and namespace of add-on configuration.
	ConfigReferent `json:",inline"`
}

type AddOnDeploymentConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec represents a desired configuration for an add-on.
	// +required
	Spec AddOnDeploymentConfigSpec `json:"spec"`
}

type AddOnDeploymentConfigList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// Items is a list of add-on deployment config.
	Items []AddOnDeploymentConfig `json:"items"`
}

type AddOnDeploymentConfigSpec struct {
	// CustomizedVariables is a list of name-value variables for the current add-on deployment.
	// The add-on implementation can use these variables to render its add-on deployment.
	// The default is an empty list.
	// +optional
	// +listType=map
	// +listMapKey=name
	CustomizedVariables []CustomizedVariable `json:"customizedVariables,omitempty"`

	// NodePlacement enables explicit control over the scheduling of the add-on agents on the
	// managed cluster.
	// All add-on agent pods are expected to comply with this node placement.
	// If the placement is nil, the placement is not specified, it will be omitted.
	// If the placement is an empty object, the placement will match all nodes and tolerate nothing.
	// +optional
	NodePlacement *NodePlacement `json:"nodePlacement,omitempty"`

	// Registries describes how to override images used by the addon agent on the managed cluster.
	// the following example will override image "quay.io/open-cluster-management/addon-agent" to
	// "quay.io/ocm/addon-agent" when deploying the addon agent
	//
	// registries:
	//   - source: quay.io/open-cluster-management/addon-agent
	//     mirror: quay.io/ocm/addon-agent
	//
	// +optional
	Registries []ImageMirror `json:"registries,omitempty"`

	// ProxyConfig holds proxy settings for add-on agent on the managed cluster.
	// Empty means no proxy settings is available.
	// +optional
	ProxyConfig ProxyConfig `json:"proxyConfig,omitempty"`

	// AgentInstallNamespace is the namespace where the add-on agent should be installed on the managed cluster.
	// +optional
	// +kubebuilder:default=open-cluster-management-agent-addon
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	AgentInstallNamespace string `json:"agentInstallNamespace,omitempty"`
}

type AddOnMeta struct {
	// displayName represents the name of add-on that will be displayed.
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// description represents the detailed description of the add-on.
	// +optional
	Description string `json:"description,omitempty"`
}

type AddOnTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata"`

	// spec holds the registration configuration for the addon and the
	// addon agent resources yaml description.
	// +kubebuilder:validation:Required
	// +required
	Spec AddOnTemplateSpec `json:"spec"`
}

type AddOnTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// Items is a list of addon templates.
	Items []AddOnTemplate `json:"items"`
}

type AddOnTemplateSpec struct {
	// AddonName represents the name of the addon which the template belongs to
	// +kubebuilder:validation:Required
	// +required
	AddonName string `json:"addonName"`

	// AgentSpec describes what/how the kubernetes resources of the addon agent to be deployed on a managed cluster.
	// +kubebuilder:validation:Required
	// +required
	AgentSpec work.ManifestWorkSpec `json:"agentSpec"`

	// Registration holds the registration configuration for the addon
	// +optional
	Registration []RegistrationSpec `json:"registration"`
}

type ClusterManagementAddOn struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec represents a desired configuration for the agent on the cluster management add-on.
	// +required
	Spec ClusterManagementAddOnSpec `json:"spec"`

	// status represents the current status of cluster management add-on.
	// +optional
	Status ClusterManagementAddOnStatus `json:"status,omitempty"`
}

type ClusterManagementAddOnList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard list metadata.
	// More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// Items is a list of cluster management add-ons.
	Items []ClusterManagementAddOn `json:"items"`
}

type ClusterManagementAddOnSpec struct {
	// addOnMeta is a reference to the metadata information for the add-on.
	// +optional
	AddOnMeta AddOnMeta `json:"addOnMeta,omitempty"`

	// Deprecated: Use supportedConfigs filed instead
	// addOnConfiguration is a reference to configuration information for the add-on.
	// In scenario where a multiple add-ons share the same add-on CRD, multiple ClusterManagementAddOn
	// resources need to be created and reference the same AddOnConfiguration.
	// +optional
	AddOnConfiguration ConfigCoordinates `json:"addOnConfiguration,omitempty"`

	// supportedConfigs is a list of configuration types supported by add-on.
	// An empty list means the add-on does not require configurations.
	// The default is an empty list
	// +optional
	// +listType=map
	// +listMapKey=group
	// +listMapKey=resource
	SupportedConfigs []ConfigMeta `json:"supportedConfigs,omitempty"`

	// InstallStrategy represents that related ManagedClusterAddOns should be installed
	// on certain clusters.
	// +optional
	// +kubebuilder:default={type: Manual}
	InstallStrategy InstallStrategy `json:"installStrategy,omitempty"`
}

type ClusterManagementAddOnStatus struct {
	// defaultconfigReferences is a list of current add-on default configuration references.
	// +optional
	DefaultConfigReferences []DefaultConfigReference `json:"defaultconfigReferences,omitempty"`
	// installProgression is a list of current add-on configuration references per placement.
	// +optional
	InstallProgressions []InstallProgression `json:"installProgressions,omitempty"`
}

type ConfigCoordinates struct {
	// crdName is the name of the CRD used to configure instances of the managed add-on.
	// This field should be configured if the add-on have a CRD that controls the configuration of the add-on.
	// +optional
	CRDName string `json:"crdName,omitempty"`

	// crName is the name of the CR used to configure instances of the managed add-on.
	// This field should be configured if add-on CR have a consistent name across the all of the ManagedCluster instaces.
	// +optional
	CRName string `json:"crName,omitempty"`

	// lastObservedGeneration is the observed generation of the custom resource for the configuration of the addon.
	// +optional
	LastObservedGeneration int64 `json:"lastObservedGeneration,omitempty"`
}

type ConfigGroupResource struct {
	// group of the add-on configuration.
	// +optional
	// +kubebuilder:default=""
	Group string `json:"group"`

	// resource of the add-on configuration.
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength:=1
	Resource string `json:"resource"`
}

type ConfigMeta struct {
	// group and resouce of the add-on configuration.
	ConfigGroupResource `json:",inline"`

	// defaultConfig represents the namespace and name of the default add-on configuration.
	// In scenario where all add-ons have a same configuration.
	// +optional
	DefaultConfig *ConfigReferent `json:"defaultConfig,omitempty"`
}

type ConfigReference struct {
	// This field is synced from ClusterManagementAddOn configGroupResource field.
	ConfigGroupResource `json:",inline"`

	// Deprecated: Use DesiredConfig instead
	// This field is synced from ClusterManagementAddOn defaultConfig and ManagedClusterAddOn config fields.
	// If both of them are defined, the ManagedClusterAddOn configs will overwrite the ClusterManagementAddOn
	// defaultConfigs.
	ConfigReferent `json:",inline"`

	// Deprecated: Use LastAppliedConfig instead
	// lastObservedGeneration is the observed generation of the add-on configuration.
	LastObservedGeneration int64 `json:"lastObservedGeneration"`

	// desiredConfig record the desired config spec hash.
	// +optional
	DesiredConfig *ConfigSpecHash `json:"desiredConfig"`

	// lastAppliedConfig record the config spec hash when the corresponding ManifestWork is applied successfully.
	// +optional
	LastAppliedConfig *ConfigSpecHash `json:"lastAppliedConfig"`
}

type ConfigReferent struct {
	// namespace of the add-on configuration.
	// If this field is not set, the configuration is in the cluster scope.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// name of the add-on configuration.
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength:=1
	Name string `json:"name"`
}

type ConfigSpecHash struct {
	// namespace and name for an add-on configuration.
	ConfigReferent `json:",inline"`

	// spec hash for an add-on configuration.
	SpecHash string `json:"specHash"`
}

type CurrentClusterBindingConfig struct {
	// ClusterRoleName is the name of the clusterrole the addon agent is bound. A rolebinding
	// will be created referring to this cluster role in each cluster namespace.
	// The user must make sure the clusterrole exists on the hub cluster.
	// +kubebuilder:validation:Required
	ClusterRoleName string `json:"clusterRoleName"`
}

type CustomSignerRegistrationConfig struct {
	// signerName is the name of signer that addon agent will use to create csr.
	// +required
	// +kubebuilder:validation:MaxLength=571
	// +kubebuilder:validation:MinLength=5
	SignerName string `json:"signerName"`

	// Subject is the user subject of the addon agent to be registered to the hub.
	// If it is not set, the addon agent will have the default subject
	// "subject": {
	//   "user": "system:open-cluster-management:cluster:{clusterName}:addon:{addonName}:agent:{agentName}",
	//   "groups: ["system:open-cluster-management:cluster:{clusterName}:addon:{addonName}",
	//             "system:open-cluster-management:addon:{addonName}", "system:authenticated"]
	// }
	Subject *Subject `json:"subject,omitempty"`

	// SigningCA represents the reference of the secret on the hub cluster to sign the CSR
	// the secret must be in the namespace where the addon-manager is located, and the secret
	// type must be "kubernetes.io/tls"
	// Note: The addon manager will not have permission to access the secret by default, so
	// the user must grant the permission to the addon manager(by creating rolebinding for
	// the addon-manager serviceaccount "addon-manager-controller-sa").
	// +kubebuilder:validation:Required
	SigningCA SigningCARef `json:"signingCA"`
}

type CustomizedVariable struct {
	// Name of this variable.
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=255
	// +kubebuilder:validation:Pattern=^[a-zA-Z_][_a-zA-Z0-9]*$
	Name string `json:"name"`

	// Value of this variable.
	// +kubebuilder:validation:MaxLength=1024
	Value string `json:"value"`
}

type DefaultConfigReference struct {
	// This field is synced from ClusterManagementAddOn Configurations.
	ConfigGroupResource `json:",inline"`

	// desiredConfig record the desired config spec hash.
	DesiredConfig *ConfigSpecHash `json:"desiredConfig"`
}

type HealthCheck struct {
	// mode indicates which mode will be used to check the healthiness status of the addon.
	// +optional
	// +kubebuilder:default=Lease
	Mode HealthCheckMode `json:"mode,omitempty"`
}

type HealthCheckMode string

type HubPermissionConfig struct {
	// Type of the permissions setting. It defines how to bind the roleRef on the hub cluster. It can be:
	// - CurrentCluster: Bind the roleRef to the namespace with the same name as the managedCluster.
	// - SingleNamespace: Bind the roleRef to the namespace specified by SingleNamespaceBindingConfig.
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum:=CurrentCluster;SingleNamespace
	Type HubPermissionsBindingType `json:"type"`

	// CurrentCluster contains the configuration of CurrentCluster type binding.
	// It is required when the type is CurrentCluster.
	CurrentCluster *CurrentClusterBindingConfig `json:"currentCluster,omitempty"`

	// SingleNamespace contains the configuration of SingleNamespace type binding.
	// It is required when the type is SingleNamespace
	SingleNamespace *SingleNamespaceBindingConfig `json:"singleNamespace,omitempty"`
}

type HubPermissionsBindingType string

type ImageMirror struct {
	// Mirror is the mirrored registry of the Source. Will be ignored if Mirror is empty.
	// +kubebuilder:validation:Required
	// +required
	Mirror string `json:"mirror"`

	// Source is the source registry. All image registries will be replaced by Mirror if Source is empty.
	// +optional
	Source string `json:"source"`
}

type InstallConfigReference struct {
	// This field is synced from ClusterManagementAddOn Configurations.
	ConfigGroupResource `json:",inline"`

	// desiredConfig record the desired config name and spec hash.
	DesiredConfig *ConfigSpecHash `json:"desiredConfig"`

	// lastKnownGoodConfig records the last known good config spec hash.
	// For fresh install or rollout with type UpdateAll or RollingUpdate, the
	// lastKnownGoodConfig is the same as lastAppliedConfig.
	// For rollout with type RollingUpdateWithCanary, the lastKnownGoodConfig
	// is the last successfully applied config spec hash of the canary placement.
	LastKnownGoodConfig *ConfigSpecHash `json:"lastKnownGoodConfig"`

	// lastAppliedConfig records the config spec hash when the all the corresponding
	// ManagedClusterAddOn are applied successfully.
	LastAppliedConfig *ConfigSpecHash `json:"lastAppliedConfig"`
}

type InstallProgression struct {
	PlacementRef `json:",inline"`

	// configReferences is a list of current add-on configuration references.
	// +optional
	ConfigReferences []InstallConfigReference `json:"configReferences,omitempty"`

	// conditions describe the state of the managed and monitored components for the operator.
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"  patchStrategy:"merge" patchMergeKey:"type"`
}

type InstallStrategy struct {
	// Type is the type of the install strategy, it can be:
	// - Manual: no automatic install
	// - Placements: install to clusters selected by placements.
	// +kubebuilder:validation:Enum=Manual;Placements
	// +kubebuilder:default:=Manual
	// +optional
	Type string `json:"type"`
	// Placements is a list of placement references honored when install strategy type is
	// Placements. All clusters selected by these placements will install the addon
	// If one cluster belongs to multiple placements, it will only apply the strategy defined
	// later in the order. That is to say, The latter strategy overrides the previous one.
	// +optional
	// +listType=map
	// +listMapKey=namespace
	// +listMapKey=name
	Placements []PlacementStrategy `json:"placements,omitempty"`
}

type KubeClientRegistrationConfig struct {
	// HubPermissions represent the permission configurations of the addon agent to access the hub cluster
	// +optional
	HubPermissions []HubPermissionConfig `json:"hubPermissions,omitempty"`
}

type ManagedClusterAddOn struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata"`

	// spec holds configuration that could apply to any operator.
	// +kubebuilder:validation:Required
	// +required
	Spec ManagedClusterAddOnSpec `json:"spec"`

	// status holds the information about the state of an operator.  It is consistent with status information across
	// the Kubernetes ecosystem.
	// +optional
	Status ManagedClusterAddOnStatus `json:"status"`
}

type ManagedClusterAddOnList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []ManagedClusterAddOn `json:"items"`
}

type ManagedClusterAddOnSpec struct {
	// installNamespace is the namespace on the managed cluster to install the addon agent.
	// If it is not set, open-cluster-management-agent-addon namespace is used to install the addon agent.
	// +optional
	// +kubebuilder:default=open-cluster-management-agent-addon
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	InstallNamespace string `json:"installNamespace,omitempty"`

	// configs is a list of add-on configurations.
	// In scenario where the current add-on has its own configurations.
	// An empty list means there are no default configurations for add-on.
	// The default is an empty list
	// +optional
	Configs []AddOnConfig `json:"configs,omitempty"`
}

type ManagedClusterAddOnStatus struct {
	// conditions describe the state of the managed and monitored components for the operator.
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"  patchStrategy:"merge" patchMergeKey:"type"`

	// relatedObjects is a list of objects that are "interesting" or related to this operator. Common uses are:
	// 1. the detailed resource driving the operator
	// 2. operator namespaces
	// 3. operand namespaces
	// 4. related ClusterManagementAddon resource
	// +optional
	RelatedObjects []ObjectReference `json:"relatedObjects,omitempty"`

	// addOnMeta is a reference to the metadata information for the add-on.
	// This should be same as the addOnMeta for the corresponding ClusterManagementAddOn resource.
	// +optional
	AddOnMeta AddOnMeta `json:"addOnMeta,omitempty"`

	// Deprecated: Use configReferences instead.
	// addOnConfiguration is a reference to configuration information for the add-on.
	// This resource is used to locate the configuration resource for the add-on.
	// +optional
	AddOnConfiguration ConfigCoordinates `json:"addOnConfiguration,omitempty"`

	// SupportedConfigs is a list of configuration types that are allowed to override the add-on configurations defined
	// in ClusterManagementAddOn spec.
	// The default is an empty list, which means the add-on configurations can not be overridden.
	// +optional
	// +listType=map
	// +listMapKey=group
	// +listMapKey=resource
	SupportedConfigs []ConfigGroupResource `json:"supportedConfigs,omitempty"`

	// configReferences is a list of current add-on configuration references.
	// This will be overridden by the clustermanagementaddon configuration references.
	// +optional
	ConfigReferences []ConfigReference `json:"configReferences,omitempty"`

	// namespace is the namespace on the managedcluster to put registration secret or lease for the addon. It is
	// required when registration is set or healthcheck mode is Lease.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// registrations is the configurations for the addon agent to register to hub. It should be set by each addon controller
	// on hub to define how the addon agent on managedcluster is registered. With the registration defined,
	// The addon agent can access to kube apiserver with kube style API or other endpoints on hub cluster with client
	// certificate authentication. A csr will be created per registration configuration. If more than one
	// registrationConfig is defined, a csr will be created for each registration configuration. It is not allowed that
	// multiple registrationConfigs have the same signer name. After the csr is approved on the hub cluster, the klusterlet
	// agent will create a secret in the installNamespace for the registrationConfig. If the signerName is
	// "kubernetes.io/kube-apiserver-client", the secret name will be "{addon name}-hub-kubeconfig" whose contents includes
	// key/cert and kubeconfig. Otherwise, the secret name will be "{addon name}-{signer name}-client-cert" whose contents includes key/cert.
	// +optional
	Registrations []RegistrationConfig `json:"registrations,omitempty"`

	// healthCheck indicates how to check the healthiness status of the current addon. It should be
	// set by each addon implementation, by default, the lease mode will be used.
	// +optional
	HealthCheck HealthCheck `json:"healthCheck,omitempty"`
}

type NodePlacement struct {
	// NodeSelector defines which Nodes the Pods are scheduled on.
	// If the selector is an empty list, it will match all nodes.
	// The default is an empty list.
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Tolerations is attached by pods to tolerate any taint that matches
	// the triple <key,value,effect> using the matching operator <operator>.
	// If the tolerations is an empty list, it will tolerate nothing.
	// The default is an empty list.
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
}

type ObjectReference struct {
	// group of the referent.
	// +kubebuilder:validation:Required
	// +required
	Group string `json:"group"`
	// resource of the referent.
	// +kubebuilder:validation:Required
	// +required
	Resource string `json:"resource"`
	// namespace of the referent.
	// +optional
	Namespace string `json:"namespace,omitempty"`
	// name of the referent.
	// +kubebuilder:validation:Required
	// +required
	Name string `json:"name"`
}

type PlacementRef struct {
	// Namespace is the namespace of the placement
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength:=1
	Namespace string `json:"namespace"`
	// Name is the name of the placement
	// +required
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength:=1
	Name string `json:"name"`
}

type PlacementStrategy struct {
	PlacementRef `json:",inline"`
	// Configs is the configuration of managedClusterAddon during installation.
	// User can override the configuration by updating the managedClusterAddon directly.
	// +optional
	Configs []AddOnConfig `json:"configs,omitempty"`
	// The rollout strategy to apply addon configurations change.
	// The rollout strategy only watches the addon configurations defined in ClusterManagementAddOn.
	// +kubebuilder:default={type: All}
	// +optional
	RolloutStrategy clusterv1alpha1.RolloutStrategy `json:"rolloutStrategy,omitempty"`
}

type ProxyConfig struct {
	// HTTPProxy is the URL of the proxy for HTTP requests
	// +optional
	HTTPProxy string `json:"httpProxy,omitempty"`

	// HTTPSProxy is the URL of the proxy for HTTPS requests
	// +optional
	HTTPSProxy string `json:"httpsProxy,omitempty"`

	// CABundle is a CA certificate bundle to verify the proxy server.
	// And it's only useful when HTTPSProxy is set and a HTTPS proxy server is specified.
	// +optional
	CABundle []byte `json:"caBundle,omitempty"`

	// NoProxy is a comma-separated list of hostnames and/or CIDRs and/or IPs for which the proxy
	// should not be used.
	// +optional
	NoProxy string `json:"noProxy,omitempty"`
}

type RegistrationConfig struct {
	// signerName is the name of signer that addon agent will use to create csr.
	// +required
	// +kubebuilder:validation:MaxLength=571
	// +kubebuilder:validation:MinLength=5
	SignerName string `json:"signerName"`

	// subject is the user subject of the addon agent to be registered to the hub.
	// If it is not set, the addon agent will have the default subject
	// "subject": {
	//   "user": "system:open-cluster-management:cluster:{clusterName}:addon:{addonName}:agent:{agentName}",
	//   "groups: ["system:open-cluster-management:cluster:{clusterName}:addon:{addonName}",
	//             "system:open-cluster-management:addon:{addonName}", "system:authenticated"]
	// }
	//
	// +optional
	Subject Subject `json:"subject,omitempty"`
}

type RegistrationSpec struct {
	// Type of the registration configuration, it supports:
	// - KubeClient: the addon agent can access the hub kube apiserver with kube style API.
	//   the signer name should be "kubernetes.io/kube-apiserver-client". When this type is
	//   used, the KubeClientRegistrationConfig can be used to define the permission of the
	//   addon agent to access the hub cluster
	// - CustomSigner: the addon agent can access the hub cluster through user-defined endpoints.
	//   When this type is used, the CustomSignerRegistrationConfig can be used to define how
	//   to issue the client certificate for the addon agent.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum:=KubeClient;CustomSigner
	Type RegistrationType `json:"type"`

	// KubeClient holds the configuration of the KubeClient type registration
	// +optional
	KubeClient *KubeClientRegistrationConfig `json:"kubeClient,omitempty"`

	// CustomSigner holds the configuration of the CustomSigner type registration
	// required when the Type is CustomSigner
	CustomSigner *CustomSignerRegistrationConfig `json:"customSigner,omitempty"`
}

type RegistrationType string

type SigningCARef struct {
	// Name of the signing CA secret
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type SingleNamespaceBindingConfig struct {
	// Namespace is the namespace the addon agent has permissions to bind to. A rolebinding
	// will be created in this namespace referring to the RoleRef.
	// +kubebuilder:validation:Required
	Namespace string `json:"namespace"`

	// RoleRef is an reference to the permission resource. it could be a role or a cluster role,
	// the user must make sure it exist on the hub cluster.
	// +kubebuilder:validation:Required
	RoleRef rbacv1.RoleRef `json:"roleRef"`
}

type Subject struct {
	// user is the user name of the addon agent.
	User string `json:"user"`

	// groups is the user group of the addon agent.
	// +optional
	Groups []string `json:"groups,omitempty"`

	// organizationUnit is the ou of the addon agent
	// +optional
	OrganizationUnits []string `json:"organizationUnit,omitempty"`
}