v1

type DomainEgressPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DomainEgressPolicySpec   `json:"spec,omitempty"`
	Status DomainEgressPolicyStatus `json:"status,omitempty"`
}

type DomainEgressPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DomainEgressPolicy `json:"items"`
}

type DomainEgressPolicySpec struct {
	// podSelector selects the pods to which this DomainEgressPolicy object applies.
	// The array of ingress rules is applied to any pods selected by this field.
	// Multiple network policies can select the same set of pods. In this case,
	// the ingress rules for each are combined additively.
	// This field is NOT optional and follows standard label selector semantics.
	// An empty podSelector matches all pods in this namespace.
	PodSelector metav1.LabelSelector `json:"podSelector" protobuf:"bytes,1,opt,name=podSelector"`

	// domainEgress is a list of egress rules to be applied to the selected pods. Outgoing traffic
	// is allowed if there are no DomainEgressPolicies selecting the pod (and cluster policy
	// otherwise allows the traffic), OR if the traffic matches at least one egress rule
	// across all of the DomainEgressPolicy objects whose podSelector matches the pod. If
	// this field is empty then this DomainEgressPolicy limits all outgoing traffic (and serves
	// solely to ensure that the pods it selects are isolated by default).
	DomainEgress []DomainEgressRule `json:"domainEgress,omitempty" protobuf:"bytes,3,rep,name=domainEgress"`
}

type DomainEgressPolicyStatus struct {
	// ResolvedDomains is a list of resolved domains
	ResolvedDomains []ResolvedDomain `json:"resolvedDomains,omitempty" protobuf:"bytes,1,rep,name=resolvedDomains"`
}

type DomainEgressRule struct {
	// ports is a list of destination ports for outgoing traffic.
	// Each item in this list is combined using a logical OR. If this field is
	// empty or missing, this rule matches all ports (traffic not restricted by port).
	// If this field is present and contains at least one item, then this rule allows
	// traffic only if the traffic matches at least one port in the list.
	// +optional
	Ports []networkingv1.NetworkPolicyPort `json:"ports,omitempty" protobuf:"bytes,1,rep,name=ports"`

	// domains is a list of destinations for outgoing traffic of pods selected for this rule.
	// Items in this list are combined using a logical OR operation. If this field is
	// empty or missing, this rule matches all destinations (traffic not restricted by
	// destination). If this field is present and contains at least one item, this rule
	// allows traffic only if the traffic matches at least one item in the to list.
	// domain names may be fully qualified or match wildcards.
	Domains []string `json:"domains,omitempty" protobuf:"bytes,2,rep,name=domains"`
}

type ResolvedDomain struct {
	Domain string   `json:"domain" protobuf:"bytes,1,opt,name=domain"`
	IPs    []string `json:"ips" protobuf:"bytes,2,rep,name=ips"`

	// UpdateTimestamp is a timestamp of when the domain was resolved
	UpdateTimestamp metav1.Time `json:"updateTimestamp,omitempty" protobuf:"bytes,8,opt,name=updateTimestamp"`
}