v1beta1

type AllowlistedCertificatesInitParameters struct {

	// PEM certificate that is allowlisted. The certificate can be up to 5k bytes, and must be a parseable X.509 certificate.
	PemCertificate *string `json:"pemCertificate,omitempty" tf:"pem_certificate,omitempty"`
}

type AllowlistedCertificatesObservation struct {

	// PEM certificate that is allowlisted. The certificate can be up to 5k bytes, and must be a parseable X.509 certificate.
	PemCertificate *string `json:"pemCertificate,omitempty" tf:"pem_certificate,omitempty"`
}

type AllowlistedCertificatesParameters struct {

	// PEM certificate that is allowlisted. The certificate can be up to 5k bytes, and must be a parseable X.509 certificate.
	// +kubebuilder:validation:Optional
	PemCertificate *string `json:"pemCertificate" tf:"pem_certificate,omitempty"`
}

type AuthorizationAttemptInfoInitParameters struct {
}

type AuthorizationAttemptInfoObservation struct {

	// (Output)
	// Human readable explanation about the issue. Provided to help address
	// the configuration issues.
	// Not guaranteed to be stable. For programmatic access use reason field.
	Details *string `json:"details,omitempty" tf:"details,omitempty"`

	// (Output)
	// Domain name of the authorization attempt.
	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`

	// (Output)
	// Reason for failure of the authorization attempt for the domain.
	FailureReason *string `json:"failureReason,omitempty" tf:"failure_reason,omitempty"`

	// (Output)
	// A state of this Managed Certificate.
	State *string `json:"state,omitempty" tf:"state,omitempty"`
}

type AuthorizationAttemptInfoParameters struct {
}

type Certificate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              CertificateSpec   `json:"spec"`
	Status            CertificateStatus `json:"status,omitempty"`
}

type CertificateInitParameters struct {

	// A human-readable description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Set of label tags associated with the Certificate resource.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// Configuration and state of a Managed Certificate.
	// Certificate Manager provisions and renews Managed Certificates
	// automatically, for as long as it's authorized to do so.
	// Structure is documented below.
	Managed []ManagedInitParameters `json:"managed,omitempty" tf:"managed,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The scope of the certificate.
	// DEFAULT: Certificates with default scope are served from core Google data centers.
	// If unsure, choose this option.
	// EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.
	// See https://cloud.google.com/vpc/docs/edge-locations.
	// ALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).
	// See https://cloud.google.com/compute/docs/regions-zones
	Scope *string `json:"scope,omitempty" tf:"scope,omitempty"`

	// Certificate data for a SelfManaged Certificate.
	// SelfManaged Certificates are uploaded by the user. Updating such
	// certificates before they expire remains the user's responsibility.
	// Structure is documented below.
	SelfManaged []SelfManagedInitParameters `json:"selfManaged,omitempty" tf:"self_managed,omitempty"`
}

type CertificateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Certificate `json:"items"`
}

type CertificateMap struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              CertificateMapSpec   `json:"spec"`
	Status            CertificateMapStatus `json:"status,omitempty"`
}

type CertificateMapEntry struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              CertificateMapEntrySpec   `json:"spec"`
	Status            CertificateMapEntryStatus `json:"status,omitempty"`
}

type CertificateMapEntryInitParameters struct {

	// A set of Certificates defines for the given hostname.
	// There can be defined up to fifteen certificates in each Certificate Map Entry.
	// Each certificate must match pattern projects//locations//certificates/*.
	// +crossplane:generate:reference:type=github.com/johngray-glitch/provider-upjet-gcp/v2/apis/cluster/certificatemanager/v1beta2.Certificate
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/v2/pkg/resource.ExtractResourceID()
	Certificates []*string `json:"certificates,omitempty" tf:"certificates,omitempty"`

	// References to Certificate in certificatemanager to populate certificates.
	// +kubebuilder:validation:Optional
	CertificatesRefs []v1.Reference `json:"certificatesRefs,omitempty" tf:"-"`

	// Selector for a list of Certificate in certificatemanager to populate certificates.
	// +kubebuilder:validation:Optional
	CertificatesSelector *v1.Selector `json:"certificatesSelector,omitempty" tf:"-"`

	// A human-readable description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)
	// for a set of hostnames with common suffix. Used as Server Name Indication (SNI) for
	// selecting a proper certificate.
	Hostname *string `json:"hostname,omitempty" tf:"hostname,omitempty"`

	// Set of labels associated with a Certificate Map Entry.
	// An object containing a list of "key": value pairs.
	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// A predefined matcher for particular cases, other than SNI selection
	Matcher *string `json:"matcher,omitempty" tf:"matcher,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`
}

type CertificateMapEntryList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CertificateMapEntry `json:"items"`
}

type CertificateMapEntryObservation struct {

	// A set of Certificates defines for the given hostname.
	// There can be defined up to fifteen certificates in each Certificate Map Entry.
	// Each certificate must match pattern projects//locations//certificates/*.
	Certificates []*string `json:"certificates,omitempty" tf:"certificates,omitempty"`

	// Creation timestamp of a Certificate Map Entry. Timestamp in RFC3339 UTC "Zulu" format,
	// with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// A human-readable description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// for all of the labels present on the resource.
	// +mapType=granular
	EffectiveLabels map[string]*string `json:"effectiveLabels,omitempty" tf:"effective_labels,omitempty"`

	// A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)
	// for a set of hostnames with common suffix. Used as Server Name Indication (SNI) for
	// selecting a proper certificate.
	Hostname *string `json:"hostname,omitempty" tf:"hostname,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/global/certificateMaps/{{map}}/certificateMapEntries/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Set of labels associated with a Certificate Map Entry.
	// An object containing a list of "key": value pairs.
	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// A map entry that is inputted into the cetrificate map
	Map *string `json:"map,omitempty" tf:"map,omitempty"`

	// A predefined matcher for particular cases, other than SNI selection
	Matcher *string `json:"matcher,omitempty" tf:"matcher,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// A serving state of this Certificate Map Entry.
	State *string `json:"state,omitempty" tf:"state,omitempty"`

	// The combination of labels configured directly on the resource
	// and default labels configured on the provider.
	// +mapType=granular
	TerraformLabels map[string]*string `json:"terraformLabels,omitempty" tf:"terraform_labels,omitempty"`

	// Update timestamp of a Certificate Map Entry. Timestamp in RFC3339 UTC "Zulu" format,
	// with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`
}

type CertificateMapEntryParameters struct {

	// A set of Certificates defines for the given hostname.
	// There can be defined up to fifteen certificates in each Certificate Map Entry.
	// Each certificate must match pattern projects//locations//certificates/*.
	// +crossplane:generate:reference:type=github.com/johngray-glitch/provider-upjet-gcp/v2/apis/cluster/certificatemanager/v1beta2.Certificate
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/v2/pkg/resource.ExtractResourceID()
	// +kubebuilder:validation:Optional
	Certificates []*string `json:"certificates,omitempty" tf:"certificates,omitempty"`

	// References to Certificate in certificatemanager to populate certificates.
	// +kubebuilder:validation:Optional
	CertificatesRefs []v1.Reference `json:"certificatesRefs,omitempty" tf:"-"`

	// Selector for a list of Certificate in certificatemanager to populate certificates.
	// +kubebuilder:validation:Optional
	CertificatesSelector *v1.Selector `json:"certificatesSelector,omitempty" tf:"-"`

	// A human-readable description of the resource.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// A Hostname (FQDN, e.g. example.com) or a wildcard hostname expression (*.example.com)
	// for a set of hostnames with common suffix. Used as Server Name Indication (SNI) for
	// selecting a proper certificate.
	// +kubebuilder:validation:Optional
	Hostname *string `json:"hostname,omitempty" tf:"hostname,omitempty"`

	// Set of labels associated with a Certificate Map Entry.
	// An object containing a list of "key": value pairs.
	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
	// +kubebuilder:validation:Optional
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// A map entry that is inputted into the cetrificate map
	// +crossplane:generate:reference:type=github.com/johngray-glitch/provider-upjet-gcp/v2/apis/cluster/certificatemanager/v1beta1.CertificateMap
	// +kubebuilder:validation:Optional
	Map *string `json:"map,omitempty" tf:"map,omitempty"`

	// Reference to a CertificateMap in certificatemanager to populate map.
	// +kubebuilder:validation:Optional
	MapRef *v1.Reference `json:"mapRef,omitempty" tf:"-"`

	// Selector for a CertificateMap in certificatemanager to populate map.
	// +kubebuilder:validation:Optional
	MapSelector *v1.Selector `json:"mapSelector,omitempty" tf:"-"`

	// A predefined matcher for particular cases, other than SNI selection
	// +kubebuilder:validation:Optional
	Matcher *string `json:"matcher,omitempty" tf:"matcher,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`
}

type CertificateMapEntrySpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     CertificateMapEntryParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider CertificateMapEntryInitParameters `json:"initProvider,omitempty"`
}

type CertificateMapEntryStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        CertificateMapEntryObservation `json:"atProvider,omitempty"`
}

type CertificateMapInitParameters struct {

	// A human-readable description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Set of labels associated with a Certificate Map resource.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`
}

type CertificateMapList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CertificateMap `json:"items"`
}

type CertificateMapObservation struct {

	// Creation timestamp of a Certificate Map. Timestamp is in RFC3339 UTC "Zulu" format,
	// accurate to nanoseconds with up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// A human-readable description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// for all of the labels present on the resource.
	// +mapType=granular
	EffectiveLabels map[string]*string `json:"effectiveLabels,omitempty" tf:"effective_labels,omitempty"`

	// A list of target proxies that use this Certificate Map
	// Structure is documented below.
	GclbTargets []GclbTargetsObservation `json:"gclbTargets,omitempty" tf:"gclb_targets,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/global/certificateMaps/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Set of labels associated with a Certificate Map resource.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The combination of labels configured directly on the resource
	// and default labels configured on the provider.
	// +mapType=granular
	TerraformLabels map[string]*string `json:"terraformLabels,omitempty" tf:"terraform_labels,omitempty"`

	// Update timestamp of a Certificate Map. Timestamp is in RFC3339 UTC "Zulu" format,
	// accurate to nanoseconds with up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`
}

type CertificateMapParameters struct {

	// A human-readable description of the resource.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Set of labels associated with a Certificate Map resource.
	// +kubebuilder:validation:Optional
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`
}

type CertificateMapSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     CertificateMapParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider CertificateMapInitParameters `json:"initProvider,omitempty"`
}

type CertificateMapStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        CertificateMapObservation `json:"atProvider,omitempty"`
}

type CertificateObservation struct {

	// A human-readable description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// +mapType=granular
	EffectiveLabels map[string]*string `json:"effectiveLabels,omitempty" tf:"effective_labels,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/{{location}}/certificates/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Set of label tags associated with the Certificate resource.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The Certificate Manager location. If not specified, "global" is used.
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// Configuration and state of a Managed Certificate.
	// Certificate Manager provisions and renews Managed Certificates
	// automatically, for as long as it's authorized to do so.
	// Structure is documented below.
	Managed []ManagedObservation `json:"managed,omitempty" tf:"managed,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The list of Subject Alternative Names of dnsName type defined in the certificate (see RFC 5280 4.2.1.6)
	SanDnsnames []*string `json:"sanDnsnames,omitempty" tf:"san_dnsnames,omitempty"`

	// The scope of the certificate.
	// DEFAULT: Certificates with default scope are served from core Google data centers.
	// If unsure, choose this option.
	// EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.
	// See https://cloud.google.com/vpc/docs/edge-locations.
	// ALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).
	// See https://cloud.google.com/compute/docs/regions-zones
	Scope *string `json:"scope,omitempty" tf:"scope,omitempty"`

	// Certificate data for a SelfManaged Certificate.
	// SelfManaged Certificates are uploaded by the user. Updating such
	// certificates before they expire remains the user's responsibility.
	// Structure is documented below.
	SelfManaged []SelfManagedObservation `json:"selfManaged,omitempty" tf:"self_managed,omitempty"`

	// The combination of labels configured directly on the resource
	// and default labels configured on the provider.
	// +mapType=granular
	TerraformLabels map[string]*string `json:"terraformLabels,omitempty" tf:"terraform_labels,omitempty"`
}

type CertificateParameters struct {

	// A human-readable description of the resource.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Set of label tags associated with the Certificate resource.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +kubebuilder:validation:Optional
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The Certificate Manager location. If not specified, "global" is used.
	// +kubebuilder:validation:Optional
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// Configuration and state of a Managed Certificate.
	// Certificate Manager provisions and renews Managed Certificates
	// automatically, for as long as it's authorized to do so.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Managed []ManagedParameters `json:"managed,omitempty" tf:"managed,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The scope of the certificate.
	// DEFAULT: Certificates with default scope are served from core Google data centers.
	// If unsure, choose this option.
	// EDGE_CACHE: Certificates with scope EDGE_CACHE are special-purposed certificates, served from Edge Points of Presence.
	// See https://cloud.google.com/vpc/docs/edge-locations.
	// ALL_REGIONS: Certificates with ALL_REGIONS scope are served from all GCP regions (You can only use ALL_REGIONS with global certs).
	// See https://cloud.google.com/compute/docs/regions-zones
	// +kubebuilder:validation:Optional
	Scope *string `json:"scope,omitempty" tf:"scope,omitempty"`

	// Certificate data for a SelfManaged Certificate.
	// SelfManaged Certificates are uploaded by the user. Updating such
	// certificates before they expire remains the user's responsibility.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	SelfManaged []SelfManagedParameters `json:"selfManaged,omitempty" tf:"self_managed,omitempty"`
}

type CertificateSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     CertificateParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider CertificateInitParameters `json:"initProvider,omitempty"`
}

type CertificateStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        CertificateObservation `json:"atProvider,omitempty"`
}

type DNSAuthorization struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.domain) || (has(self.initProvider) && has(self.initProvider.domain))",message="spec.forProvider.domain is a required parameter"
	Spec   DNSAuthorizationSpec   `json:"spec"`
	Status DNSAuthorizationStatus `json:"status,omitempty"`
}

type DNSAuthorizationInitParameters struct {

	// A human-readable description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// A domain which is being authorized. A DnsAuthorization resource covers a
	// single domain and its wildcard, e.g. authorization for "example.com" can
	// be used to issue certificates for "example.com" and "*.example.com".
	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`

	// Set of label tags associated with the DNS Authorization resource.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// type of DNS authorization. If unset during the resource creation, FIXED_RECORD will
	// be used for global resources, and PER_PROJECT_RECORD will be used for other locations.
	// FIXED_RECORD DNS authorization uses DNS-01 validation method
	// PER_PROJECT_RECORD DNS authorization allows for independent management
	// of Google-managed certificates with DNS authorization across multiple
	// projects.
	// Possible values are: FIXED_RECORD, PER_PROJECT_RECORD.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type DNSAuthorizationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DNSAuthorization `json:"items"`
}

type DNSAuthorizationObservation struct {

	// The structure describing the DNS Resource Record that needs to be added
	// to DNS configuration for the authorization to be usable by
	// certificate.
	// Structure is documented below.
	DNSResourceRecord []DNSResourceRecordObservation `json:"dnsResourceRecord,omitempty" tf:"dns_resource_record,omitempty"`

	// A human-readable description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// A domain which is being authorized. A DnsAuthorization resource covers a
	// single domain and its wildcard, e.g. authorization for "example.com" can
	// be used to issue certificates for "example.com" and "*.example.com".
	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`

	// +mapType=granular
	EffectiveLabels map[string]*string `json:"effectiveLabels,omitempty" tf:"effective_labels,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/{{location}}/dnsAuthorizations/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Set of label tags associated with the DNS Authorization resource.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The Certificate Manager location. If not specified, "global" is used.
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The combination of labels configured directly on the resource
	// and default labels configured on the provider.
	// +mapType=granular
	TerraformLabels map[string]*string `json:"terraformLabels,omitempty" tf:"terraform_labels,omitempty"`

	// type of DNS authorization. If unset during the resource creation, FIXED_RECORD will
	// be used for global resources, and PER_PROJECT_RECORD will be used for other locations.
	// FIXED_RECORD DNS authorization uses DNS-01 validation method
	// PER_PROJECT_RECORD DNS authorization allows for independent management
	// of Google-managed certificates with DNS authorization across multiple
	// projects.
	// Possible values are: FIXED_RECORD, PER_PROJECT_RECORD.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type DNSAuthorizationParameters struct {

	// A human-readable description of the resource.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// A domain which is being authorized. A DnsAuthorization resource covers a
	// single domain and its wildcard, e.g. authorization for "example.com" can
	// be used to issue certificates for "example.com" and "*.example.com".
	// +kubebuilder:validation:Optional
	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`

	// Set of label tags associated with the DNS Authorization resource.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +kubebuilder:validation:Optional
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The Certificate Manager location. If not specified, "global" is used.
	// +kubebuilder:validation:Optional
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// type of DNS authorization. If unset during the resource creation, FIXED_RECORD will
	// be used for global resources, and PER_PROJECT_RECORD will be used for other locations.
	// FIXED_RECORD DNS authorization uses DNS-01 validation method
	// PER_PROJECT_RECORD DNS authorization allows for independent management
	// of Google-managed certificates with DNS authorization across multiple
	// projects.
	// Possible values are: FIXED_RECORD, PER_PROJECT_RECORD.
	// +kubebuilder:validation:Optional
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type DNSAuthorizationSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     DNSAuthorizationParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider DNSAuthorizationInitParameters `json:"initProvider,omitempty"`
}

type DNSAuthorizationStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        DNSAuthorizationObservation `json:"atProvider,omitempty"`
}

type DNSResourceRecordInitParameters struct {
}

type DNSResourceRecordObservation struct {

	// (Output)
	// Data of the DNS Resource Record.
	Data *string `json:"data,omitempty" tf:"data,omitempty"`

	// (Output)
	// Fully qualified name of the DNS Resource Record.
	// E.g. _acme-challenge.example.com.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (Output)
	// Type of the DNS Resource Record.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type DNSResourceRecordParameters struct {
}

type GclbTargetsInitParameters struct {
}

type GclbTargetsObservation struct {

	// An IP configuration where this Certificate Map is serving
	// Structure is documented below.
	IPConfigs []IPConfigsObservation `json:"ipConfigs,omitempty" tf:"ip_configs,omitempty"`

	// Proxy name must be in the format projects//locations//targetHttpsProxies/*.
	// This field is part of a union field target_proxy: Only one of targetHttpsProxy or
	// targetSslProxy may be set.
	TargetHTTPSProxy *string `json:"targetHttpsProxy,omitempty" tf:"target_https_proxy,omitempty"`

	// Proxy name must be in the format projects//locations//targetSslProxies/*.
	// This field is part of a union field target_proxy: Only one of targetHttpsProxy or
	// targetSslProxy may be set.
	TargetSSLProxy *string `json:"targetSslProxy,omitempty" tf:"target_ssl_proxy,omitempty"`
}

type GclbTargetsParameters struct {
}

type IPConfigsInitParameters struct {
}

type IPConfigsObservation struct {

	// An external IP address
	IPAddress *string `json:"ipAddress,omitempty" tf:"ip_address,omitempty"`

	// A list of ports
	Ports []*float64 `json:"ports,omitempty" tf:"ports,omitempty"`
}

type IPConfigsParameters struct {
}

type IntermediateCasInitParameters struct {

	// PEM root certificate of the PKI used for validation.
	// Each certificate provided in PEM format may occupy up to 5kB.
	// Note: This property is sensitive and will not be displayed in the plan.
	PemCertificateSecretRef *v1.SecretKeySelector `json:"pemCertificateSecretRef,omitempty" tf:"-"`
}

type IntermediateCasObservation struct {
}

type IntermediateCasParameters struct {

	// PEM root certificate of the PKI used for validation.
	// Each certificate provided in PEM format may occupy up to 5kB.
	// Note: This property is sensitive and will not be displayed in the plan.
	// +kubebuilder:validation:Optional
	PemCertificateSecretRef *v1.SecretKeySelector `json:"pemCertificateSecretRef,omitempty" tf:"-"`
}

type ManagedInitParameters struct {

	// Authorizations that will be used for performing domain authorization. Either issuanceConfig or dnsAuthorizations should be specificed, but not both.
	// +crossplane:generate:reference:type=github.com/johngray-glitch/provider-upjet-gcp/v2/apis/cluster/certificatemanager/v1beta1.DNSAuthorization
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/v2/pkg/resource.ExtractResourceID()
	DNSAuthorizations []*string `json:"dnsAuthorizations,omitempty" tf:"dns_authorizations,omitempty"`

	// References to DNSAuthorization in certificatemanager to populate dnsAuthorizations.
	// +kubebuilder:validation:Optional
	DNSAuthorizationsRefs []v1.Reference `json:"dnsAuthorizationsRefs,omitempty" tf:"-"`

	// Selector for a list of DNSAuthorization in certificatemanager to populate dnsAuthorizations.
	// +kubebuilder:validation:Optional
	DNSAuthorizationsSelector *v1.Selector `json:"dnsAuthorizationsSelector,omitempty" tf:"-"`

	// The domains for which a managed SSL certificate will be generated.
	// Wildcard domains are only supported with DNS challenge resolution
	// +crossplane:generate:reference:type=github.com/johngray-glitch/provider-upjet-gcp/v2/apis/cluster/certificatemanager/v1beta1.DNSAuthorization
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/v2/pkg/resource.ExtractParamPath("domain",false)
	Domains []*string `json:"domains,omitempty" tf:"domains,omitempty"`

	// References to DNSAuthorization in certificatemanager to populate domains.
	// +kubebuilder:validation:Optional
	DomainsRefs []v1.Reference `json:"domainsRefs,omitempty" tf:"-"`

	// Selector for a list of DNSAuthorization in certificatemanager to populate domains.
	// +kubebuilder:validation:Optional
	DomainsSelector *v1.Selector `json:"domainsSelector,omitempty" tf:"-"`

	// The resource name for a CertificateIssuanceConfig used to configure private PKI certificates in the format projects//locations//certificateIssuanceConfigs/*.
	// If this field is not set, the certificates will instead be publicly signed as documented at https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs#caa.
	// Either issuanceConfig or dnsAuthorizations should be specificed, but not both.
	IssuanceConfig *string `json:"issuanceConfig,omitempty" tf:"issuance_config,omitempty"`
}

type ManagedObservation struct {

	// (Output)
	// Detailed state of the latest authorization attempt for each domain
	// specified for this Managed Certificate.
	// Structure is documented below.
	AuthorizationAttemptInfo []AuthorizationAttemptInfoObservation `json:"authorizationAttemptInfo,omitempty" tf:"authorization_attempt_info,omitempty"`

	// Authorizations that will be used for performing domain authorization. Either issuanceConfig or dnsAuthorizations should be specificed, but not both.
	DNSAuthorizations []*string `json:"dnsAuthorizations,omitempty" tf:"dns_authorizations,omitempty"`

	// The domains for which a managed SSL certificate will be generated.
	// Wildcard domains are only supported with DNS challenge resolution
	Domains []*string `json:"domains,omitempty" tf:"domains,omitempty"`

	// The resource name for a CertificateIssuanceConfig used to configure private PKI certificates in the format projects//locations//certificateIssuanceConfigs/*.
	// If this field is not set, the certificates will instead be publicly signed as documented at https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs#caa.
	// Either issuanceConfig or dnsAuthorizations should be specificed, but not both.
	IssuanceConfig *string `json:"issuanceConfig,omitempty" tf:"issuance_config,omitempty"`

	// (Output)
	// Information about issues with provisioning this Managed Certificate.
	// Structure is documented below.
	ProvisioningIssue []ProvisioningIssueObservation `json:"provisioningIssue,omitempty" tf:"provisioning_issue,omitempty"`

	// (Output)
	// A state of this Managed Certificate.
	State *string `json:"state,omitempty" tf:"state,omitempty"`
}

type ManagedParameters struct {

	// Authorizations that will be used for performing domain authorization. Either issuanceConfig or dnsAuthorizations should be specificed, but not both.
	// +crossplane:generate:reference:type=github.com/johngray-glitch/provider-upjet-gcp/v2/apis/cluster/certificatemanager/v1beta1.DNSAuthorization
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/v2/pkg/resource.ExtractResourceID()
	// +kubebuilder:validation:Optional
	DNSAuthorizations []*string `json:"dnsAuthorizations,omitempty" tf:"dns_authorizations,omitempty"`

	// References to DNSAuthorization in certificatemanager to populate dnsAuthorizations.
	// +kubebuilder:validation:Optional
	DNSAuthorizationsRefs []v1.Reference `json:"dnsAuthorizationsRefs,omitempty" tf:"-"`

	// Selector for a list of DNSAuthorization in certificatemanager to populate dnsAuthorizations.
	// +kubebuilder:validation:Optional
	DNSAuthorizationsSelector *v1.Selector `json:"dnsAuthorizationsSelector,omitempty" tf:"-"`

	// The domains for which a managed SSL certificate will be generated.
	// Wildcard domains are only supported with DNS challenge resolution
	// +crossplane:generate:reference:type=github.com/johngray-glitch/provider-upjet-gcp/v2/apis/cluster/certificatemanager/v1beta1.DNSAuthorization
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/v2/pkg/resource.ExtractParamPath("domain",false)
	// +kubebuilder:validation:Optional
	Domains []*string `json:"domains,omitempty" tf:"domains,omitempty"`

	// References to DNSAuthorization in certificatemanager to populate domains.
	// +kubebuilder:validation:Optional
	DomainsRefs []v1.Reference `json:"domainsRefs,omitempty" tf:"-"`

	// Selector for a list of DNSAuthorization in certificatemanager to populate domains.
	// +kubebuilder:validation:Optional
	DomainsSelector *v1.Selector `json:"domainsSelector,omitempty" tf:"-"`

	// The resource name for a CertificateIssuanceConfig used to configure private PKI certificates in the format projects//locations//certificateIssuanceConfigs/*.
	// If this field is not set, the certificates will instead be publicly signed as documented at https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs#caa.
	// Either issuanceConfig or dnsAuthorizations should be specificed, but not both.
	// +kubebuilder:validation:Optional
	IssuanceConfig *string `json:"issuanceConfig,omitempty" tf:"issuance_config,omitempty"`
}

type ProvisioningIssueInitParameters struct {
}

type ProvisioningIssueObservation struct {

	// (Output)
	// Human readable explanation about the issue. Provided to help address
	// the configuration issues.
	// Not guaranteed to be stable. For programmatic access use reason field.
	Details *string `json:"details,omitempty" tf:"details,omitempty"`

	// (Output)
	// Reason for provisioning failures.
	Reason *string `json:"reason,omitempty" tf:"reason,omitempty"`
}

type ProvisioningIssueParameters struct {
}

type SelfManagedInitParameters struct {

	// The certificate chain in PEM-encoded form.
	// Leaf certificate comes first, followed by intermediate ones if any.
	// Note: This property is sensitive and will not be displayed in the plan.
	CertificatePemSecretRef *v1.SecretKeySelector `json:"certificatePemSecretRef,omitempty" tf:"-"`

	// The certificate chain in PEM-encoded form.
	// Leaf certificate comes first, followed by intermediate ones if any.
	PemCertificate *string `json:"pemCertificate,omitempty" tf:"pem_certificate,omitempty"`

	// The private key of the leaf certificate in PEM-encoded form.
	// Note: This property is sensitive and will not be displayed in the plan.
	PemPrivateKeySecretRef *v1.SecretKeySelector `json:"pemPrivateKeySecretRef,omitempty" tf:"-"`

	// The private key of the leaf certificate in PEM-encoded form.
	// Note: This property is sensitive and will not be displayed in the plan.
	PrivateKeyPemSecretRef *v1.SecretKeySelector `json:"privateKeyPemSecretRef,omitempty" tf:"-"`
}

type SelfManagedObservation struct {

	// The certificate chain in PEM-encoded form.
	// Leaf certificate comes first, followed by intermediate ones if any.
	PemCertificate *string `json:"pemCertificate,omitempty" tf:"pem_certificate,omitempty"`
}

type SelfManagedParameters struct {

	// The certificate chain in PEM-encoded form.
	// Leaf certificate comes first, followed by intermediate ones if any.
	// Note: This property is sensitive and will not be displayed in the plan.
	// +kubebuilder:validation:Optional
	CertificatePemSecretRef *v1.SecretKeySelector `json:"certificatePemSecretRef,omitempty" tf:"-"`

	// The certificate chain in PEM-encoded form.
	// Leaf certificate comes first, followed by intermediate ones if any.
	// +kubebuilder:validation:Optional
	PemCertificate *string `json:"pemCertificate,omitempty" tf:"pem_certificate,omitempty"`

	// The private key of the leaf certificate in PEM-encoded form.
	// Note: This property is sensitive and will not be displayed in the plan.
	// +kubebuilder:validation:Optional
	PemPrivateKeySecretRef *v1.SecretKeySelector `json:"pemPrivateKeySecretRef,omitempty" tf:"-"`

	// The private key of the leaf certificate in PEM-encoded form.
	// Note: This property is sensitive and will not be displayed in the plan.
	// +kubebuilder:validation:Optional
	PrivateKeyPemSecretRef *v1.SecretKeySelector `json:"privateKeyPemSecretRef,omitempty" tf:"-"`
}

type TrustAnchorsInitParameters struct {

	// PEM root certificate of the PKI used for validation.
	// Each certificate provided in PEM format may occupy up to 5kB.
	// Note: This property is sensitive and will not be displayed in the plan.
	PemCertificateSecretRef *v1.SecretKeySelector `json:"pemCertificateSecretRef,omitempty" tf:"-"`
}

type TrustAnchorsObservation struct {
}

type TrustAnchorsParameters struct {

	// PEM root certificate of the PKI used for validation.
	// Each certificate provided in PEM format may occupy up to 5kB.
	// Note: This property is sensitive and will not be displayed in the plan.
	// +kubebuilder:validation:Optional
	PemCertificateSecretRef *v1.SecretKeySelector `json:"pemCertificateSecretRef,omitempty" tf:"-"`
}

type TrustConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              TrustConfigSpec   `json:"spec"`
	Status            TrustConfigStatus `json:"status,omitempty"`
}

type TrustConfigInitParameters struct {

	// Allowlisted PEM-encoded certificates. A certificate matching an allowlisted certificate is always considered valid as long as
	// the certificate is parseable, proof of private key possession is established, and constraints on the certificate's SAN field are met.
	// Structure is documented below.
	AllowlistedCertificates []AllowlistedCertificatesInitParameters `json:"allowlistedCertificates,omitempty" tf:"allowlisted_certificates,omitempty"`

	// One or more paragraphs of text description of a trust config.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Set of label tags associated with the trust config.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// Set of trust stores to perform validation against.
	// This field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation.
	// Structure is documented below.
	TrustStores []TrustStoresInitParameters `json:"trustStores,omitempty" tf:"trust_stores,omitempty"`
}

type TrustConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []TrustConfig `json:"items"`
}

type TrustConfigObservation struct {

	// Allowlisted PEM-encoded certificates. A certificate matching an allowlisted certificate is always considered valid as long as
	// the certificate is parseable, proof of private key possession is established, and constraints on the certificate's SAN field are met.
	// Structure is documented below.
	AllowlistedCertificates []AllowlistedCertificatesObservation `json:"allowlistedCertificates,omitempty" tf:"allowlisted_certificates,omitempty"`

	// The creation timestamp of a TrustConfig.
	// A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// One or more paragraphs of text description of a trust config.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// +mapType=granular
	EffectiveLabels map[string]*string `json:"effectiveLabels,omitempty" tf:"effective_labels,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/{{location}}/trustConfigs/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Set of label tags associated with the trust config.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The trust config location.
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The combination of labels configured directly on the resource
	// and default labels configured on the provider.
	// +mapType=granular
	TerraformLabels map[string]*string `json:"terraformLabels,omitempty" tf:"terraform_labels,omitempty"`

	// Set of trust stores to perform validation against.
	// This field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation.
	// Structure is documented below.
	TrustStores []TrustStoresObservation `json:"trustStores,omitempty" tf:"trust_stores,omitempty"`

	// The last update timestamp of a TrustConfig.
	// A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`
}

type TrustConfigParameters struct {

	// Allowlisted PEM-encoded certificates. A certificate matching an allowlisted certificate is always considered valid as long as
	// the certificate is parseable, proof of private key possession is established, and constraints on the certificate's SAN field are met.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	AllowlistedCertificates []AllowlistedCertificatesParameters `json:"allowlistedCertificates,omitempty" tf:"allowlisted_certificates,omitempty"`

	// One or more paragraphs of text description of a trust config.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Set of label tags associated with the trust config.
	// Note: This field is non-authoritative, and will only manage the labels present in your configuration.
	// Please refer to the field effective_labels for all of the labels present on the resource.
	// +kubebuilder:validation:Optional
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The trust config location.
	// +kubebuilder:validation:Required
	Location *string `json:"location" tf:"location,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// Set of trust stores to perform validation against.
	// This field is supported when TrustConfig is configured with Load Balancers, currently not supported for SPIFFE certificate validation.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	TrustStores []TrustStoresParameters `json:"trustStores,omitempty" tf:"trust_stores,omitempty"`
}

type TrustConfigSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     TrustConfigParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider TrustConfigInitParameters `json:"initProvider,omitempty"`
}

type TrustConfigStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        TrustConfigObservation `json:"atProvider,omitempty"`
}

type TrustStoresInitParameters struct {

	// Set of intermediate CA certificates used for the path building phase of chain validation.
	// The field is currently not supported if trust config is used for the workload certificate feature.
	// Structure is documented below.
	IntermediateCas []IntermediateCasInitParameters `json:"intermediateCas,omitempty" tf:"intermediate_cas,omitempty"`

	// List of Trust Anchors to be used while performing validation against a given TrustStore.
	// Structure is documented below.
	TrustAnchors []TrustAnchorsInitParameters `json:"trustAnchors,omitempty" tf:"trust_anchors,omitempty"`
}

type TrustStoresObservation struct {

	// Set of intermediate CA certificates used for the path building phase of chain validation.
	// The field is currently not supported if trust config is used for the workload certificate feature.
	// Structure is documented below.
	IntermediateCas []IntermediateCasParameters `json:"intermediateCas,omitempty" tf:"intermediate_cas,omitempty"`

	// List of Trust Anchors to be used while performing validation against a given TrustStore.
	// Structure is documented below.
	TrustAnchors []TrustAnchorsParameters `json:"trustAnchors,omitempty" tf:"trust_anchors,omitempty"`
}

type TrustStoresParameters struct {

	// Set of intermediate CA certificates used for the path building phase of chain validation.
	// The field is currently not supported if trust config is used for the workload certificate feature.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	IntermediateCas []IntermediateCasParameters `json:"intermediateCas,omitempty" tf:"intermediate_cas,omitempty"`

	// List of Trust Anchors to be used while performing validation against a given TrustStore.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	TrustAnchors []TrustAnchorsParameters `json:"trustAnchors,omitempty" tf:"trust_anchors,omitempty"`
}