v1beta1

type APIServerLoadBalancer struct {
	// Enabled defines whether a load balancer should be created. This value
	// defaults to true if an APIServerLoadBalancer is given.
	//
	// There is no reason to set this to false. To disable creation of the
	// API server loadbalancer, omit the APIServerLoadBalancer field in the
	// cluster spec instead.
	//
	// +kubebuilder:validation:Required
	// +kubebuilder:default:=true
	Enabled *bool `json:"enabled"`

	// AdditionalPorts adds additional tcp ports to the load balancer.
	// +optional
	// +listType=set
	AdditionalPorts []int `json:"additionalPorts,omitempty"`

	// AllowedCIDRs restrict access to all API-Server listeners to the given address CIDRs.
	// +optional
	// +listType=set
	AllowedCIDRs []string `json:"allowedCIDRs,omitempty"`

	// Provider specifies name of a specific Octavia provider to use for the
	// API load balancer. The Octavia default will be used if it is not
	// specified.
	// +optional
	Provider optional.String `json:"provider,omitempty"`

	// Network defines which network should the load balancer be allocated on.
	//+optional
	Network *NetworkParam `json:"network,omitempty"`

	// Subnets define which subnets should the load balancer be allocated on.
	// It is expected that subnets are located on the network specified in this resource.
	// Only the first element is taken into account.
	// +optional
	// +listType=atomic
	// kubebuilder:validation:MaxLength:=2
	Subnets []SubnetParam `json:"subnets,omitempty"`

	// AvailabilityZone is the failure domain that will be used to create the APIServerLoadBalancer Spec.
	//+optional
	AvailabilityZone optional.String `json:"availabilityZone,omitempty"`
}

type AdditionalBlockDevice struct {
	// Name of the block device in the context of a machine.
	// If the block device is a volume, the Cinder volume will be named
	// as a combination of the machine name and this name.
	// Also, this name will be used for tagging the block device.
	// Information about the block device tag can be obtained from the OpenStack
	// metadata API or the config drive.
	// Name cannot be 'root', which is reserved for the root volume.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// SizeGiB is the size of the block device in gibibytes (GiB).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum:=1
	SizeGiB int `json:"sizeGiB"`

	// Storage specifies the storage type of the block device and
	// additional storage options.
	Storage BlockDeviceStorage `json:"storage"`
}

type AddressPair struct {
	// IPAddress is the IP address of the allowed address pair. Depending on
	// the configuration of Neutron, it may be supported to specify a CIDR
	// instead of a specific IP address.
	// +kubebuilder:validation:Required
	IPAddress string `json:"ipAddress"`

	// MACAddress is the MAC address of the allowed address pair. If not
	// specified, the MAC address will be the MAC address of the port.
	// +optional
	MACAddress optional.String `json:"macAddress,omitempty"`
}

type AllocationPool struct {
	// Start represents the start of the AllocationPool, that is the lowest IP of the pool.
	// +required
	Start string `json:"start"`

	// End represents the end of the AlloctionPool, that is the highest IP of the pool.
	// +required
	End string `json:"end"`
}

type Bastion struct {
	// Enabled means that bastion is enabled. The bastion is enabled by
	// default if this field is not specified. Set this field to false to disable the
	// bastion.
	//
	// It is not currently possible to remove the bastion from the cluster
	// spec without first disabling it by setting this field to false and
	// waiting until the bastion has been deleted.
	// +kubebuilder:default:=true
	// +optional
	Enabled optional.Bool `json:"enabled,omitempty"`

	// Spec for the bastion itself
	Spec *OpenStackMachineSpec `json:"spec,omitempty"`

	// AvailabilityZone is the failure domain that will be used to create the Bastion Spec.
	//+optional
	AvailabilityZone optional.String `json:"availabilityZone,omitempty"`

	// FloatingIP which will be associated to the bastion machine. It's the IP address, not UUID.
	// The floating IP should already exist and should not be associated with a port. If FIP of this address does not
	// exist, CAPO will try to create it, but by default only OpenStack administrators have privileges to do so.
	//+optional
	//+kubebuilder:validation:Format:=ipv4
	FloatingIP optional.String `json:"floatingIP,omitempty"`
}

type BastionStatus struct {
	ID         string        `json:"id,omitempty"`
	Name       string        `json:"name,omitempty"`
	SSHKeyName string        `json:"sshKeyName,omitempty"`
	State      InstanceState `json:"state,omitempty"`
	IP         string        `json:"ip,omitempty"`
	FloatingIP string        `json:"floatingIP,omitempty"`

	// Resolved contains parts of the bastion's machine spec with all
	// external references fully resolved.
	// +optional
	Resolved *ResolvedMachineSpec `json:"resolved,omitempty"`

	// Resources contains references to OpenStack resources created for the bastion.
	// +optional
	Resources *MachineResources `json:"resources,omitempty"`
}

type BindingProfile struct {
	// OVSHWOffload enables or disables the OVS hardware offload feature.
	// +optional
	OVSHWOffload *bool `json:"ovsHWOffload,omitempty"`

	// TrustedVF enables or disables the “trusted mode” for the VF.
	// +optional
	TrustedVF *bool `json:"trustedVF,omitempty"`
}

type BlockDeviceStorage struct {
	// Type is the type of block device to create.
	// This can be either "Volume" or "Local".
	// +unionDiscriminator
	Type BlockDeviceType `json:"type"`

	// Volume contains additional storage options for a volume block device.
	// +optional
	// +unionMember,optional
	Volume *BlockDeviceVolume `json:"volume,omitempty"`
}

type BlockDeviceType string

type BlockDeviceVolume struct {
	// Type is the Cinder volume type of the volume.
	// If omitted, the default Cinder volume type that is configured in the OpenStack cloud
	// will be used.
	// +optional
	Type string `json:"type,omitempty"`

	// AvailabilityZone is the volume availability zone to create the volume
	// in. If not specified, the volume will be created without an explicit
	// availability zone.
	// +optional
	AvailabilityZone *VolumeAvailabilityZone `json:"availabilityZone,omitempty"`
}

type ExternalRouterIPParam struct {
	// The FixedIP in the corresponding subnet
	FixedIP string `json:"fixedIP,omitempty"`
	// The subnet in which the FixedIP is used for the Gateway of this router
	Subnet SubnetParam `json:"subnet"`
}

type FilterByNeutronTags struct {
	// Tags is a list of tags to filter by. If specified, the resource must
	// have all of the tags specified to be included in the result.
	// +listType=set
	// +optional
	Tags []NeutronTag `json:"tags,omitempty"`

	// TagsAny is a list of tags to filter by. If specified, the resource
	// must have at least one of the tags specified to be included in the
	// result.
	// +listType=set
	// +optional
	TagsAny []NeutronTag `json:"tagsAny,omitempty"`

	// NotTags is a list of tags to filter by. If specified, resources which
	// contain all of the given tags will be excluded from the result.
	// +listType=set
	// +optional
	NotTags []NeutronTag `json:"notTags,omitempty"`

	// NotTagsAny is a list of tags to filter by. If specified, resources
	// which contain any of the given tags will be excluded from the result.
	// +listType=set
	// +optional
	NotTagsAny []NeutronTag `json:"notTagsAny,omitempty"`
}

type FixedIP struct {
	// Subnet is an openstack subnet query that will return the id of a subnet to create
	// the fixed IP of a port in. This query must not return more than one subnet.
	// +optional
	Subnet *SubnetParam `json:"subnet,omitempty"`

	// IPAddress is a specific IP address to assign to the port. If Subnet
	// is also specified, IPAddress must be a valid IP address in the
	// subnet. If Subnet is not specified, IPAddress must be a valid IP
	// address in any subnet of the port's network.
	// +optional
	IPAddress optional.String `json:"ipAddress,omitempty"`
}

type ImageFilter struct {
	// The name of the desired image. If specified, the combination of name and tags must return a single matching image or an error will be raised.
	// +optional
	Name optional.String `json:"name,omitempty"`

	// The tags associated with the desired image. If specified, the combination of name and tags must return a single matching image or an error will be raised.
	// +listType=set
	// +optional
	Tags []string `json:"tags,omitempty"`
}

type ImageParam struct {
	// ID is the uuid of the image. ID will not be validated before use.
	// +kubebuilder:validation:Format:=uuid
	// +optional
	ID optional.String `json:"id,omitempty"`

	// Filter describes a query for an image. If specified, the combination
	// of name and tags must return a single matching image or an error will
	// be raised.
	// +optional
	Filter *ImageFilter `json:"filter,omitempty"`
}

type InstanceState string

type LoadBalancer struct {
	Name       string `json:"name"`
	ID         string `json:"id"`
	IP         string `json:"ip"`
	InternalIP string `json:"internalIP"`
	//+optional
	AllowedCIDRs []string `json:"allowedCIDRs,omitempty"`
	//+optional
	Tags []string `json:"tags,omitempty"`
	// LoadBalancerNetwork contains information about network and/or subnets which the
	// loadbalancer is allocated on.
	// If subnets are specified within the LoadBalancerNetwork currently only the first
	// subnet in the list is taken into account.
	// +optional
	LoadBalancerNetwork *NetworkStatusWithSubnets `json:"loadBalancerNetwork,omitempty"`
}

type MachineResources struct {
	// Ports is the status of the ports created for the machine.
	// +optional
	Ports []PortStatus `json:"ports,omitempty"`
}

type ManagedSecurityGroupName string

type ManagedSecurityGroups struct {
	// allNodesSecurityGroupRules defines the rules that should be applied to all nodes.
	// +patchMergeKey=name
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=name
	// +optional
	AllNodesSecurityGroupRules []SecurityGroupRuleSpec `json:"allNodesSecurityGroupRules,omitempty" patchStrategy:"merge" patchMergeKey:"name"`

	// AllowAllInClusterTraffic allows all ingress and egress traffic between cluster nodes when set to true.
	// +kubebuilder:default=false
	// +kubebuilder:validation:Required
	AllowAllInClusterTraffic bool `json:"allowAllInClusterTraffic"`
}

type NetworkFilter struct {
	Name        string `json:"name,omitempty"`
	Description string `json:"description,omitempty"`
	ProjectID   string `json:"projectID,omitempty"`

	FilterByNeutronTags `json:",inline"`
}

type NetworkParam struct {
	// ID is the ID of the network to use. If ID is provided, the other filters cannot be provided. Must be in UUID format.
	// +kubebuilder:validation:Format:=uuid
	// +optional
	ID optional.String `json:"id,omitempty"`

	// Filter specifies a filter to select an OpenStack network. If provided, cannot be empty.
	// +optional
	Filter *NetworkFilter `json:"filter,omitempty"`
}

type NetworkStatus struct {
	Name string `json:"name"`
	ID   string `json:"id"`

	//+optional
	Tags []string `json:"tags,omitempty"`
}

type NetworkStatusWithSubnets struct {
	NetworkStatus `json:",inline"`

	// Subnets is a list of subnets associated with the default cluster network. Machines which use the default cluster network will get an address from all of these subnets.
	Subnets []Subnet `json:"subnets,omitempty"`
}

type NeutronTag string

type OpenStackCluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   OpenStackClusterSpec   `json:"spec,omitempty"`
	Status OpenStackClusterStatus `json:"status,omitempty"`
}

type OpenStackClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OpenStackCluster `json:"items"`
}

type OpenStackClusterSpec struct {
	// ManagedSubnets describe OpenStack Subnets to be created. Cluster actuator will create a network,
	// subnets with the defined CIDR, and a router connected to these subnets. Currently only one IPv4
	// subnet is supported. If you leave this empty, no network will be created.
	// +kubebuilder:validation:MaxItems=1
	// +listType=atomic
	// +optional
	ManagedSubnets []SubnetSpec `json:"managedSubnets,omitempty"`

	// Router specifies an existing router to be used if ManagedSubnets are
	// specified. If specified, no new router will be created.
	// +optional
	Router *RouterParam `json:"router,omitempty"`

	// Network specifies an existing network to use if no ManagedSubnets
	// are specified.
	// +optional
	Network *NetworkParam `json:"network,omitempty"`

	// Subnets specifies existing subnets to use if not ManagedSubnets are
	// specified. All subnets must be in the network specified by Network.
	// There can be zero, one, or two subnets. If no subnets are specified,
	// all subnets in Network will be used. If 2 subnets are specified, one
	// must be IPv4 and the other IPv6.
	// +kubebuilder:validation:MaxItems=2
	// +listType=atomic
	// +optional
	Subnets []SubnetParam `json:"subnets,omitempty"`

	// NetworkMTU sets the maximum transmission unit (MTU) value to address fragmentation for the private network ID.
	// This value will be used only if the Cluster actuator creates the network.
	// If left empty, the network will have the default MTU defined in Openstack network service.
	// To use this field, the Openstack installation requires the net-mtu neutron API extension.
	// +optional
	NetworkMTU optional.Int `json:"networkMTU,omitempty"`

	// ExternalRouterIPs is an array of externalIPs on the respective subnets.
	// This is necessary if the router needs a fixed ip in a specific subnet.
	// +listType=atomic
	// +optional
	ExternalRouterIPs []ExternalRouterIPParam `json:"externalRouterIPs,omitempty"`

	// ExternalNetwork is the OpenStack Network to be used to get public internet to the VMs.
	// This option is ignored if DisableExternalNetwork is set to true.
	//
	// If ExternalNetwork is defined it must refer to exactly one external network.
	//
	// If ExternalNetwork is not defined or is empty the controller will use any
	// existing external network as long as there is only one. It is an
	// error if ExternalNetwork is not defined and there are multiple
	// external networks unless DisableExternalNetwork is also set.
	//
	// If ExternalNetwork is not defined and there are no external networks
	// the controller will proceed as though DisableExternalNetwork was set.
	// +optional
	ExternalNetwork *NetworkParam `json:"externalNetwork,omitempty"`

	// DisableExternalNetwork specifies whether or not to attempt to connect the cluster
	// to an external network. This allows for the creation of clusters when connecting
	// to an external network is not possible or desirable, e.g. if using a provider network.
	// +optional
	DisableExternalNetwork optional.Bool `json:"disableExternalNetwork,omitempty"`

	// APIServerLoadBalancer configures the optional LoadBalancer for the APIServer.
	// If not specified, no load balancer will be created for the API server.
	// +optional
	APIServerLoadBalancer *APIServerLoadBalancer `json:"apiServerLoadBalancer,omitempty"`

	// DisableAPIServerFloatingIP determines whether or not to attempt to attach a floating
	// IP to the API server. This allows for the creation of clusters when attaching a floating
	// IP to the API server (and hence, in many cases, exposing the API server to the internet)
	// is not possible or desirable, e.g. if using a shared VLAN for communication between
	// management and workload clusters or when the management cluster is inside the
	// project network.
	// This option requires that the API server use a VIP on the cluster network so that the
	// underlying machines can change without changing ControlPlaneEndpoint.Host.
	// When using a managed load balancer, this VIP will be managed automatically.
	// If not using a managed load balancer, cluster configuration will fail without additional
	// configuration to manage the VIP on the control plane machines, which falls outside of
	// the scope of this controller.
	// +optional
	DisableAPIServerFloatingIP optional.Bool `json:"disableAPIServerFloatingIP,omitempty"`

	// APIServerFloatingIP is the floatingIP which will be associated with the API server.
	// The floatingIP will be created if it does not already exist.
	// If not specified, a new floatingIP is allocated.
	// This field is not used if DisableAPIServerFloatingIP is set to true.
	// +optional
	APIServerFloatingIP optional.String `json:"apiServerFloatingIP,omitempty"`

	// APIServerFixedIP is the fixed IP which will be associated with the API server.
	// In the case where the API server has a floating IP but not a managed load balancer,
	// this field is not used.
	// If a managed load balancer is used and this field is not specified, a fixed IP will
	// be dynamically allocated for the load balancer.
	// If a managed load balancer is not used AND the API server floating IP is disabled,
	// this field MUST be specified and should correspond to a pre-allocated port that
	// holds the fixed IP to be used as a VIP.
	// +optional
	APIServerFixedIP optional.String `json:"apiServerFixedIP,omitempty"`

	// APIServerPort is the port on which the listener on the APIServer
	// will be created
	// +optional
	APIServerPort optional.Int `json:"apiServerPort,omitempty"`

	// ManagedSecurityGroups determines whether OpenStack security groups for the cluster
	// will be managed by the OpenStack provider or whether pre-existing security groups will
	// be specified as part of the configuration.
	// By default, the managed security groups have rules that allow the Kubelet, etcd, and the
	// Kubernetes API server to function correctly.
	// It's possible to add additional rules to the managed security groups.
	// When defined to an empty struct, the managed security groups will be created with the default rules.
	// +optional
	ManagedSecurityGroups *ManagedSecurityGroups `json:"managedSecurityGroups,omitempty"`

	// DisablePortSecurity disables the port security of the network created for the
	// Kubernetes cluster, which also disables SecurityGroups
	// +optional
	DisablePortSecurity optional.Bool `json:"disablePortSecurity,omitempty"`

	// Tags to set on all resources in cluster which support tags
	// +listType=set
	// +optional
	Tags []string `json:"tags,omitempty"`

	// ControlPlaneEndpoint represents the endpoint used to communicate with the control plane.
	// It is normally populated automatically by the OpenStackCluster
	// controller during cluster provisioning. If it is set on creation the
	// control plane endpoint will use the values set here in preference to
	// values set elsewhere.
	// ControlPlaneEndpoint cannot be modified after ControlPlaneEndpoint.Host has been set.
	// +optional
	ControlPlaneEndpoint *clusterv1.APIEndpoint `json:"controlPlaneEndpoint,omitempty"`

	// ControlPlaneAvailabilityZones is the set of availability zones which
	// control plane machines may be deployed to.
	// +listType=set
	// +optional
	ControlPlaneAvailabilityZones []string `json:"controlPlaneAvailabilityZones,omitempty"`

	// ControlPlaneOmitAvailabilityZone causes availability zone to be
	// omitted when creating control plane nodes, allowing the Nova
	// scheduler to make a decision on which availability zone to use based
	// on other scheduling constraints
	// +optional
	ControlPlaneOmitAvailabilityZone optional.Bool `json:"controlPlaneOmitAvailabilityZone,omitempty"`

	// Bastion is the OpenStack instance to login the nodes
	//
	// As a rolling update is not ideal during a bastion host session, we
	// prevent changes to a running bastion configuration. To make changes, it's required
	// to first set `enabled: false` which will remove the bastion and then changes can be made.
	//+optional
	Bastion *Bastion `json:"bastion,omitempty"`

	// IdentityRef is a reference to a secret holding OpenStack credentials
	// to be used when reconciling this cluster. It is also to reconcile
	// machines unless overridden in the machine spec.
	// +kubebuilder:validation:Required
	IdentityRef OpenStackIdentityReference `json:"identityRef"`
}

type OpenStackClusterStatus struct {
	// Ready is true when the cluster infrastructure is ready.
	// +kubebuilder:default=false
	Ready bool `json:"ready"`

	// Network contains information about the created OpenStack Network.
	// +optional
	Network *NetworkStatusWithSubnets `json:"network,omitempty"`

	// ExternalNetwork contains information about the external network used for default ingress and egress traffic.
	// +optional
	ExternalNetwork *NetworkStatus `json:"externalNetwork,omitempty"`

	// Router describes the default cluster router
	// +optional
	Router *Router `json:"router,omitempty"`

	// APIServerLoadBalancer describes the api server load balancer if one exists
	// +optional
	APIServerLoadBalancer *LoadBalancer `json:"apiServerLoadBalancer,omitempty"`

	// FailureDomains represent OpenStack availability zones
	FailureDomains clusterv1.FailureDomains `json:"failureDomains,omitempty"`

	// ControlPlaneSecurityGroup contains the information about the
	// OpenStack Security Group that needs to be applied to control plane
	// nodes.
	// +optional
	ControlPlaneSecurityGroup *SecurityGroupStatus `json:"controlPlaneSecurityGroup,omitempty"`

	// WorkerSecurityGroup contains the information about the OpenStack
	// Security Group that needs to be applied to worker nodes.
	// +optional
	WorkerSecurityGroup *SecurityGroupStatus `json:"workerSecurityGroup,omitempty"`

	// BastionSecurityGroup contains the information about the OpenStack
	// Security Group that needs to be applied to worker nodes.
	// +optional
	BastionSecurityGroup *SecurityGroupStatus `json:"bastionSecurityGroup,omitempty"`

	// Bastion contains the information about the deployed bastion host
	// +optional
	Bastion *BastionStatus `json:"bastion,omitempty"`

	// FailureReason will be set in the event that there is a terminal problem
	// reconciling the OpenStackCluster and will contain a succinct value suitable
	// for machine interpretation.
	//
	// This field should not be set for transitive errors that a controller
	// faces that are expected to be fixed automatically over
	// time (like service outages), but instead indicate that something is
	// fundamentally wrong with the OpenStackCluster's spec or the configuration of
	// the controller, and that manual intervention is required. Examples
	// of terminal errors would be invalid combinations of settings in the
	// spec, values that are unsupported by the controller, or the
	// responsible controller itself being critically misconfigured.
	//
	// Any transient errors that occur during the reconciliation of
	// OpenStackClusters can be added as events to the OpenStackCluster object
	// and/or logged in the controller's output.
	// +optional
	FailureReason *capierrors.ClusterStatusError `json:"failureReason,omitempty"`

	// FailureMessage will be set in the event that there is a terminal problem
	// reconciling the OpenStackCluster and will contain a more verbose string suitable
	// for logging and human consumption.
	//
	// This field should not be set for transitive errors that a controller
	// faces that are expected to be fixed automatically over
	// time (like service outages), but instead indicate that something is
	// fundamentally wrong with the OpenStackCluster's spec or the configuration of
	// the controller, and that manual intervention is required. Examples
	// of terminal errors would be invalid combinations of settings in the
	// spec, values that are unsupported by the controller, or the
	// responsible controller itself being critically misconfigured.
	//
	// Any transient errors that occur during the reconciliation of
	// OpenStackClusters can be added as events to the OpenStackCluster object
	// and/or logged in the controller's output.
	// +optional
	FailureMessage *string `json:"failureMessage,omitempty"`
}

type OpenStackClusterTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec OpenStackClusterTemplateSpec `json:"spec,omitempty"`
}

type OpenStackClusterTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OpenStackClusterTemplate `json:"items"`
}

type OpenStackClusterTemplateResource struct {
	Spec OpenStackClusterSpec `json:"spec"`
}

type OpenStackClusterTemplateSpec struct {
	Template OpenStackClusterTemplateResource `json:"template"`
}

type OpenStackIdentityReference struct {
	// Name is the name of a secret in the same namespace as the resource being provisioned.
	// The secret must contain a key named `clouds.yaml` which contains an OpenStack clouds.yaml file.
	// The secret may optionally contain a key named `cacert` containing a PEM-encoded CA certificate.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// CloudName specifies the name of the entry in the clouds.yaml file to use.
	// +kubebuilder:validation:Required
	CloudName string `json:"cloudName"`
}

type OpenStackMachine struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   OpenStackMachineSpec   `json:"spec,omitempty"`
	Status OpenStackMachineStatus `json:"status,omitempty"`
}

type OpenStackMachineList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OpenStackMachine `json:"items"`
}

type OpenStackMachineSpec struct {
	// ProviderID is the unique identifier as specified by the cloud provider.
	ProviderID *string `json:"providerID,omitempty"`

	// The flavor reference for the flavor for your server instance.
	Flavor string `json:"flavor"`

	// The image to use for your server instance.
	// If the rootVolume is specified, this will be used when creating the root volume.
	// +required
	Image ImageParam `json:"image"`

	// The ssh key to inject in the instance
	SSHKeyName string `json:"sshKeyName,omitempty"`

	// Ports to be attached to the server instance. They are created if a port with the given name does not already exist.
	// If not specified a default port will be added for the default cluster network.
	Ports []PortOpts `json:"ports,omitempty"`

	// The names of the security groups to assign to the instance
	SecurityGroups []SecurityGroupParam `json:"securityGroups,omitempty"`

	// Whether the server instance is created on a trunk port or not.
	Trunk bool `json:"trunk,omitempty"`

	// Tags which will be added to the machine and all dependent resources
	// which support them. These are in addition to Tags defined on the
	// cluster.
	// Requires Nova api 2.52 minimum!
	// +listType=set
	Tags []string `json:"tags,omitempty"`

	// Metadata mapping. Allows you to create a map of key value pairs to add to the server instance.
	// +listType=map
	// +listMapKey=key
	ServerMetadata []ServerMetadata `json:"serverMetadata,omitempty"`

	// Config Drive support
	ConfigDrive *bool `json:"configDrive,omitempty"`

	// The volume metadata to boot from
	RootVolume *RootVolume `json:"rootVolume,omitempty"`

	// AdditionalBlockDevices is a list of specifications for additional block devices to attach to the server instance
	// +listType=map
	// +listMapKey=name
	// +optional
	AdditionalBlockDevices []AdditionalBlockDevice `json:"additionalBlockDevices,omitempty"`

	// The server group to assign the machine to.
	// +optional
	ServerGroup *ServerGroupParam `json:"serverGroup,omitempty"`

	// IdentityRef is a reference to a secret holding OpenStack credentials
	// to be used when reconciling this machine. If not specified, the
	// credentials specified in the cluster will be used.
	// +optional
	IdentityRef *OpenStackIdentityReference `json:"identityRef,omitempty"`

	// floatingIPPoolRef is a reference to a IPPool that will be assigned
	// to an IPAddressClaim. Once the IPAddressClaim is fulfilled, the FloatingIP
	// will be assigned to the OpenStackMachine.
	// +optional
	FloatingIPPoolRef *corev1.TypedLocalObjectReference `json:"floatingIPPoolRef,omitempty"`
}

type OpenStackMachineStatus struct {
	// Ready is true when the provider resource is ready.
	// +optional
	Ready bool `json:"ready"`

	// InstanceID is the OpenStack instance ID for this machine.
	// +optional
	InstanceID optional.String `json:"instanceID,omitempty"`

	// Addresses contains the OpenStack instance associated addresses.
	Addresses []corev1.NodeAddress `json:"addresses,omitempty"`

	// InstanceState is the state of the OpenStack instance for this machine.
	// +optional
	InstanceState *InstanceState `json:"instanceState,omitempty"`

	// Resolved contains parts of the machine spec with all external
	// references fully resolved.
	// +optional
	Resolved *ResolvedMachineSpec `json:"resolved,omitempty"`

	// Resources contains references to OpenStack resources created for the machine.
	// +optional
	Resources *MachineResources `json:"resources,omitempty"`

	FailureReason *errors.MachineStatusError `json:"failureReason,omitempty"`

	// FailureMessage will be set in the event that there is a terminal problem
	// reconciling the Machine and will contain a more verbose string suitable
	// for logging and human consumption.
	//
	// This field should not be set for transitive errors that a controller
	// faces that are expected to be fixed automatically over
	// time (like service outages), but instead indicate that something is
	// fundamentally wrong with the Machine's spec or the configuration of
	// the controller, and that manual intervention is required. Examples
	// of terminal errors would be invalid combinations of settings in the
	// spec, values that are unsupported by the controller, or the
	// responsible controller itself being critically misconfigured.
	//
	// Any transient errors that occur during the reconciliation of Machines
	// can be added as events to the Machine object and/or logged in the
	// controller's output.
	// +optional
	FailureMessage *string `json:"failureMessage,omitempty"`

	Conditions clusterv1.Conditions `json:"conditions,omitempty"`
}

type OpenStackMachineTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec OpenStackMachineTemplateSpec `json:"spec,omitempty"`
}

type OpenStackMachineTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OpenStackMachineTemplate `json:"items"`
}

type OpenStackMachineTemplateResource struct {
	// Spec is the specification of the desired behavior of the machine.
	Spec OpenStackMachineSpec `json:"spec"`
}

type OpenStackMachineTemplateSpec struct {
	Template OpenStackMachineTemplateResource `json:"template"`
}

type PortOpts struct {
	// Network is a query for an openstack network that the port will be created or discovered on.
	// This will fail if the query returns more than one network.
	// +optional
	Network *NetworkParam `json:"network,omitempty"`

	// Description is a human-readable description for the port.
	// +optional
	Description optional.String `json:"description,omitempty"`

	// NameSuffix will be appended to the name of the port if specified. If unspecified, instead the 0-based index of the port in the list is used.
	// +optional
	NameSuffix optional.String `json:"nameSuffix,omitempty"`

	// FixedIPs is a list of pairs of subnet and/or IP address to assign to the port. If specified, these must be subnets of the port's network.
	// +optional
	// +listType=atomic
	FixedIPs []FixedIP `json:"fixedIPs,omitempty"`

	// SecurityGroups is a list of the names, uuids, filters or any combination these of the security groups to assign to the instance.
	// +optional
	// +listType=atomic
	SecurityGroups []SecurityGroupParam `json:"securityGroups,omitempty"`

	// Tags applied to the port (and corresponding trunk, if a trunk is configured.)
	// These tags are applied in addition to the instance's tags, which will also be applied to the port.
	// +listType=set
	// +optional
	Tags []string `json:"tags,omitempty"`

	// Trunk specifies whether trunking is enabled at the port level. If not
	// provided the value is inherited from the machine, or false for a
	// bastion host.
	// +optional
	Trunk *bool `json:"trunk,omitempty"`

	ResolvedPortSpecFields `json:",inline"`
}

type PortStatus struct {
	// ID is the unique identifier of the port.
	// +required
	ID string `json:"id"`
}

type ResolvedFixedIP struct {
	// SubnetID is the id of a subnet to create the fixed IP of a port in.
	// +optional
	SubnetID optional.String `json:"subnet,omitempty"`

	// IPAddress is a specific IP address to assign to the port. If SubnetID
	// is also specified, IPAddress must be a valid IP address in the
	// subnet. If Subnet is not specified, IPAddress must be a valid IP
	// address in any subnet of the port's network.
	// +optional
	IPAddress optional.String `json:"ipAddress,omitempty"`
}

type ResolvedMachineSpec struct {
	// ServerGroupID is the ID of the server group the machine should be added to and is calculated based on ServerGroupFilter.
	// +optional
	ServerGroupID string `json:"serverGroupID,omitempty"`

	// ImageID is the ID of the image to use for the machine and is calculated based on ImageFilter.
	// +optional
	ImageID string `json:"imageID,omitempty"`

	// Ports is the fully resolved list of ports to create for the machine.
	// +optional
	Ports []ResolvedPortSpec `json:"ports,omitempty"`
}

type ResolvedPortSpec struct {
	// Name is the name of the port.
	Name string `json:"name"`

	// Description is a human-readable description for the port.
	Description string `json:"description"`

	// NetworkID is the ID of the network the port will be created in.
	NetworkID string `json:"networkID"`

	// Tags applied to the port (and corresponding trunk, if a trunk is configured.)
	// +listType=set
	// +optional
	Tags []string `json:"tags,omitempty"`

	// Trunk specifies whether trunking is enabled at the port level.
	// +optional
	Trunk optional.Bool `json:"trunk,omitempty"`

	// FixedIPs is a list of pairs of subnet and/or IP address to assign to the port. If specified, these must be subnets of the port's network.
	// +optional
	// +listType=atomic
	FixedIPs []ResolvedFixedIP `json:"fixedIPs,omitempty"`

	// SecurityGroups is a list of security group IDs to assign to the port.
	// +optional
	// +listType=atomic
	SecurityGroups []string `json:"securityGroups,omitempty"`

	ResolvedPortSpecFields `json:",inline"`
}

type ResolvedPortSpecFields struct {
	// AdminStateUp specifies whether the port should be created in the up (true) or down (false) state. The default is up.
	// +optional
	AdminStateUp *bool `json:"adminStateUp,omitempty"`

	// MACAddress specifies the MAC address of the port. If not specified, the MAC address will be generated.
	// +optional
	MACAddress optional.String `json:"macAddress,omitempty"`

	// AllowedAddressPairs is a list of address pairs which Neutron will
	// allow the port to send traffic from in addition to the port's
	// addresses. If not specified, the MAC Address will be the MAC Address
	// of the port. Depending on the configuration of Neutron, it may be
	// supported to specify a CIDR instead of a specific IP address.
	// +optional
	AllowedAddressPairs []AddressPair `json:"allowedAddressPairs,omitempty"`

	// HostID specifies the ID of the host where the port resides.
	// +optional
	HostID optional.String `json:"hostID,omitempty"`

	// VNICType specifies the type of vNIC which this port should be
	// attached to. This is used to determine which mechanism driver(s) to
	// be used to bind the port. The valid values are normal, macvtap,
	// direct, baremetal, direct-physical, virtio-forwarder, smart-nic and
	// remote-managed, although these values will not be validated in this
	// API to ensure compatibility with future neutron changes or custom
	// implementations. What type of vNIC is actually available depends on
	// deployments. If not specified, the Neutron default value is used.
	// +optional
	VNICType optional.String `json:"vnicType,omitempty"`

	// Profile is a set of key-value pairs that are used for binding
	// details. We intentionally don't expose this as a map[string]string
	// because we only want to enable the users to set the values of the
	// keys that are known to work in OpenStack Networking API.  See
	// https://docs.openstack.org/api-ref/network/v2/index.html?expanded=create-port-detail#create-port
	// To set profiles, your tenant needs permissions rule:create_port, and
	// rule:create_port:binding:profile
	// +optional
	Profile *BindingProfile `json:"profile,omitempty"`

	// DisablePortSecurity enables or disables the port security when set.
	// When not set, it takes the value of the corresponding field at the network level.
	// +optional
	DisablePortSecurity *bool `json:"disablePortSecurity,omitempty"`

	// PropageteUplinkStatus enables or disables the propagate uplink status on the port.
	// +optional
	PropagateUplinkStatus *bool `json:"propagateUplinkStatus,omitempty"`

	// Value specs are extra parameters to include in the API request with OpenStack.
	// This is an extension point for the API, so what they do and if they are supported,
	// depends on the specific OpenStack implementation.
	// +optional
	// +listType=map
	// +listMapKey=name
	ValueSpecs []ValueSpec `json:"valueSpecs,omitempty"`
}

type RootVolume struct {
	// SizeGiB is the size of the block device in gibibytes (GiB).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum:=1
	SizeGiB int `json:"sizeGiB"`

	BlockDeviceVolume `json:",inline"`
}

type Router struct {
	Name string `json:"name"`
	ID   string `json:"id"`
	//+optional
	Tags []string `json:"tags,omitempty"`
	//+optional
	IPs []string `json:"ips,omitempty"`
}

type RouterFilter struct {
	Name        string `json:"name,omitempty"`
	Description string `json:"description,omitempty"`
	ProjectID   string `json:"projectID,omitempty"`

	FilterByNeutronTags `json:",inline"`
}

type RouterParam struct {
	// ID is the ID of the router to use. If ID is provided, the other filters cannot be provided. Must be in UUID format.
	// +kubebuilder:validation:Format:=uuid
	// +optional
	ID optional.String `json:"id,omitempty"`

	// Filter specifies a filter to select an OpenStack router. If provided, cannot be empty.
	Filter *RouterFilter `json:"filter,omitempty"`
}

type SecurityGroupFilter struct {
	Name        string `json:"name,omitempty"`
	Description string `json:"description,omitempty"`
	ProjectID   string `json:"projectID,omitempty"`

	FilterByNeutronTags `json:",inline"`
}

type SecurityGroupParam struct {
	// ID is the ID of the security group to use. If ID is provided, the other filters cannot be provided. Must be in UUID format.
	// +kubebuilder:validation:Format:=uuid
	// +optional
	ID optional.String `json:"id,omitempty"`

	// Filter specifies a query to select an OpenStack security group. If provided, cannot be empty.
	// +optional
	Filter *SecurityGroupFilter `json:"filter,omitempty"`
}

type SecurityGroupRuleSpec struct {
	// name of the security group rule.
	// It's used to identify the rule so it can be patched and will not be sent to the OpenStack API.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// description of the security group rule.
	// +optional
	Description *string `json:"description,omitempty"`

	// direction in which the security group rule is applied. The only values
	// allowed are "ingress" or "egress". For a compute instance, an ingress
	// security group rule is applied to incoming (ingress) traffic for that
	// instance. An egress rule is applied to traffic leaving the instance.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:enum=ingress;egress
	Direction string `json:"direction"`

	// etherType must be IPv4 or IPv6, and addresses represented in CIDR must match the
	// ingress or egress rules.
	// +kubebuilder:validation:enum=IPv4;IPv6
	// +optional
	EtherType *string `json:"etherType,omitempty"`

	// portRangeMin is a number in the range that is matched by the security group
	// rule. If the protocol is TCP or UDP, this value must be less than or equal
	// to the value of the portRangeMax attribute.
	// +optional
	PortRangeMin *int `json:"portRangeMin,omitempty"`

	// portRangeMax is a number in the range that is matched by the security group
	// rule. The portRangeMin attribute constrains the portRangeMax attribute.
	// +optional
	PortRangeMax *int `json:"portRangeMax,omitempty"`

	// protocol is the protocol that is matched by the security group rule.
	// +optional
	Protocol *string `json:"protocol,omitempty"`

	// remoteGroupID is the remote group ID to be associated with this security group rule.
	// You can specify either remoteGroupID or remoteIPPrefix or remoteManagedGroups.
	// +optional
	RemoteGroupID *string `json:"remoteGroupID,omitempty"`

	// remoteIPPrefix is the remote IP prefix to be associated with this security group rule.
	// You can specify either remoteGroupID or remoteIPPrefix or remoteManagedGroups.
	// +optional
	RemoteIPPrefix *string `json:"remoteIPPrefix,omitempty"`

	// remoteManagedGroups is the remote managed groups to be associated with this security group rule.
	// You can specify either remoteGroupID or remoteIPPrefix or remoteManagedGroups.
	// +optional
	RemoteManagedGroups []ManagedSecurityGroupName `json:"remoteManagedGroups,omitempty"`
}

type SecurityGroupStatus struct {
	// name of the security group
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// id of the security group
	// +kubebuilder:validation:Required
	ID string `json:"id"`
}

type ServerGroupFilter struct {
	// Name is the name of a server group to look for.
	Name optional.String `json:"name,omitempty"`
}

type ServerGroupParam struct {
	// ID is the ID of the server group to use.
	// +kubebuilder:validation:Format:=uuid
	ID optional.String `json:"id,omitempty"`

	// Filter specifies a query to select an OpenStack server group. If provided, it cannot be empty.
	Filter *ServerGroupFilter `json:"filter,omitempty"`
}

type ServerMetadata struct {
	// Key is the server metadata key
	// +kubebuilder:validation:MaxLength:=255
	// +kubebuilder:validation:Required
	Key string `json:"key"`

	// Value is the server metadata value
	// +kubebuilder:validation:MaxLength:=255
	// +kubebuilder:validation:Required
	Value string `json:"value"`
}

type Subnet struct {
	Name string `json:"name"`
	ID   string `json:"id"`

	CIDR string `json:"cidr"`

	//+optional
	Tags []string `json:"tags,omitempty"`
}

type SubnetFilter struct {
	Name            string `json:"name,omitempty"`
	Description     string `json:"description,omitempty"`
	ProjectID       string `json:"projectID,omitempty"`
	IPVersion       int    `json:"ipVersion,omitempty"`
	GatewayIP       string `json:"gatewayIP,omitempty"`
	CIDR            string `json:"cidr,omitempty"`
	IPv6AddressMode string `json:"ipv6AddressMode,omitempty"`
	IPv6RAMode      string `json:"ipv6RAMode,omitempty"`

	FilterByNeutronTags `json:",inline"`
}

type SubnetParam struct {
	// ID is the uuid of the subnet. It will not be validated.
	// +kubebuilder:validation:Format:=uuid
	// +optional
	ID optional.String `json:"id,omitempty"`

	// Filter specifies a filter to select the subnet. It must match exactly one subnet.
	// +optional
	Filter *SubnetFilter `json:"filter,omitempty"`
}

type SubnetSpec struct {
	// CIDR is representing the IP address range used to create the subnet, e.g. 10.0.0.0/24.
	// This field is required when defining a subnet.
	// +required
	CIDR string `json:"cidr"`

	// DNSNameservers holds a list of DNS server addresses that will be provided when creating
	// the subnet. These addresses need to have the same IP version as CIDR.
	DNSNameservers []string `json:"dnsNameservers,omitempty"`

	// AllocationPools is an array of AllocationPool objects that will be applied to OpenStack Subnet being created.
	// If set, OpenStack will only allocate these IPs for Machines. It will still be possible to create ports from
	// outside of these ranges manually.
	AllocationPools []AllocationPool `json:"allocationPools,omitempty"`
}

type ValueSpec struct {
	// Name is the name of the key-value pair.
	// This is just for identifying the pair and will not be sent to the OpenStack API.
	// +kubebuilder:validation:Required
	Name string `json:"name"`
	// Key is the key in the key-value pair.
	// +kubebuilder:validation:Required
	Key string `json:"key"`
	// Value is the value in the key-value pair.
	// +kubebuilder:validation:Required
	Value string `json:"value"`
}

type VolumeAZName string

type VolumeAZSource string

type VolumeAvailabilityZone struct {
	// From specifies where we will obtain the availability zone for the
	// volume. The options are "Name" and "Machine". If "Name" is specified
	// then the Name field must also be specified. If "Machine" is specified
	// the volume will use the value of FailureDomain, if any, from the
	// associated Machine.
	// +kubebuilder:default:=Name
	// +optional
	From VolumeAZSource `json:"from,omitempty"`

	// Name is the name of a volume availability zone to use. It is required
	// if From is "Name". The volume availability zone name may not contain
	// spaces.
	// +optional
	Name *VolumeAZName `json:"name,omitempty"`
}