v1

type Access struct {
	// Name is an optional name that is used for this access rule
	// +optional
	Name string `json:"name,omitempty"`

	// Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. VerbAll represents all kinds.
	Verbs []string `json:"verbs"`

	// Subresources defines the sub resources that are allowed by this access rule
	// +optional
	Subresources []string `json:"subresources,omitempty"`

	// Users specifies which users should be able to access this secret with the aforementioned verbs
	// +optional
	Users []string `json:"users,omitempty"`

	// Teams specifies which teams should be able to access this secret with the aforementioned verbs
	// +optional
	Teams []string `json:"teams,omitempty"`
}

type AccessAccessor interface {
	GetAccess() []Access
	SetAccess(access []Access)

	GetOwner() *UserOrTeam
	SetOwner(userOrTeam *UserOrTeam)
}

type AccessKey struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessKeySpec   `json:"spec,omitempty"`
	Status AccessKeyStatus `json:"status,omitempty"`
}

type AccessKeyIdentity struct {
	// The subject of the user
	// +optional
	UserID string `json:"userId,omitempty"`

	// The username
	// +optional
	Username string `json:"username,omitempty"`

	// The preferred username / display name
	// +optional
	PreferredUsername string `json:"preferredUsername,omitempty"`

	// The user email
	// +optional
	Email string `json:"email,omitempty"`

	// If the user email was verified
	// +optional
	EmailVerified bool `json:"emailVerified,omitempty"`

	// The groups from the identity provider
	// +optional
	Groups []string `json:"groups,omitempty"`

	// Connector is the name of the connector this access key was created from
	// +optional
	Connector string `json:"connector,omitempty"`

	// ConnectorData holds data used by the connector for subsequent requests after initial
	// authentication, such as access tokens for upstream providers.
	//
	// This data is never shared with end users, OAuth clients, or through the API.
	// +optional
	ConnectorData []byte `json:"connectorData,omitempty"`
}

type AccessKeyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessKey `json:"items"`
}

type AccessKeyOIDC struct {
	// The current id token that was created during login
	// +optional
	IDToken []byte `json:"idToken,omitempty"`

	// The current access token that was created during login
	// +optional
	AccessToken []byte `json:"accessToken,omitempty"`

	// The current refresh token that was created during login
	// +optional
	RefreshToken []byte `json:"refreshToken,omitempty"`

	// The last time the id token was refreshed
	// +optional
	LastRefresh *metav1.Time `json:"lastRefresh,omitempty"`
}

type AccessKeyOIDCProvider struct {
	// ClientId the token was generated for
	// +optional
	ClientId string `json:"clientId,omitempty"`

	// Nonce to use
	// +optional
	Nonce string `json:"nonce,omitempty"`

	// RedirectUri to use
	// +optional
	RedirectUri string `json:"redirectUri,omitempty"`

	// Scopes to use
	// +optional
	Scopes string `json:"scopes,omitempty"`
}

type AccessKeyScope struct {
	// AllowLoftCLI allows certain read-only management requests to
	// make sure loft cli works correctly with this specific access key.
	// +optional
	AllowLoftCLI bool `json:"allowLoftCli,omitempty"`

	// Projects specifies the projects the access key should have access to.
	// +optional
	Projects []AccessKeyScopeProject `json:"projects,omitempty"`

	// Spaces specifies the spaces the access key is allowed to access.
	// +optional
	Spaces []AccessKeyScopeSpace `json:"spaces,omitempty"`

	// VirtualClusters specifies the virtual clusters the access key is allowed to access.
	// +optional
	VirtualClusters []AccessKeyScopeVirtualCluster `json:"virtualClusters,omitempty"`

	// Clusters specifies the project cluster the access key is allowed to access.
	// +optional
	Clusters []AccessKeyScopeCluster `json:"clusters,omitempty"`

	// DEPRECATED: Use Projects, Spaces and VirtualClusters instead
	// Rules specifies the rules that should apply to the access key.
	// +optional
	Rules []AccessKeyScopeRule `json:"rules,omitempty"`
}

type AccessKeyScopeCluster struct {
	// Cluster is the name of the cluster to access. You can specify * to select all clusters.
	// +optional
	Cluster string `json:"cluster,omitempty"`
}

type AccessKeyScopeProject struct {
	// Project is the name of the project. You can specify * to select all projects.
	// +optional
	Project string `json:"project,omitempty"`
}

type AccessKeyScopeRule struct {
	// The verbs that match this rule.
	// An empty list implies every verb.
	// +optional
	Verbs []string `json:"verbs,omitempty"`

	// Resources that this rule matches. An empty list implies all kinds in all API groups.
	// +optional
	Resources []GroupResources `json:"resources,omitempty"`

	// Namespaces that this rule matches.
	// The empty string "" matches non-namespaced resources.
	// An empty list implies every namespace.
	// +optional
	Namespaces []string `json:"namespaces,omitempty"`

	// NonResourceURLs is a set of URL paths that should be checked.
	// *s are allowed, but only as the full, final step in the path.
	// Examples:
	//  "/metrics" - Log requests for apiserver metrics
	//  "/healthz*" - Log all health checks
	// +optional
	NonResourceURLs []string `json:"nonResourceURLs,omitempty"`

	// RequestTargets is a list of request targets that are allowed.
	// An empty list implies every request.
	// +optional
	RequestTargets []RequestTarget `json:"requestTargets,omitempty"`

	// Cluster that this rule matches. Only applies to cluster requests.
	// If this is set, no requests for non cluster requests are allowed.
	// An empty cluster means no restrictions will apply.
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// VirtualClusters that this rule matches. Only applies to virtual cluster requests.
	// An empty list means no restrictions will apply.
	// +optional
	VirtualClusters []AccessKeyVirtualCluster `json:"virtualClusters,omitempty"`
}

type AccessKeyScopeSpace struct {
	// Project is the name of the project.
	// +optional
	Project string `json:"project,omitempty"`

	// Space is the name of the space. You can specify * to select all spaces.
	// +optional
	Space string `json:"space,omitempty"`
}

type AccessKeyScopeVirtualCluster struct {
	// Project is the name of the project.
	// +optional
	Project string `json:"project,omitempty"`

	// VirtualCluster is the name of the virtual cluster to access. You can specify * to select all virtual clusters.
	// +optional
	VirtualCluster string `json:"virtualCluster,omitempty"`
}

type AccessKeySpec struct {
	// The display name shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// The user this access key refers to
	// +optional
	User string `json:"user,omitempty"`

	// The team this access key refers to
	// +optional
	Team string `json:"team,omitempty"`

	// Subject is a generic subject that can be used
	// instead of user or team
	// +optional
	Subject string `json:"subject,omitempty"`

	// Groups specifies extra groups to apply when using
	// this access key
	// +optional
	Groups []string `json:"groups,omitempty"`

	// The actual access key that will be used as a bearer token
	// +optional
	Key string `json:"key,omitempty"`

	// If this field is true, the access key is still allowed to exist,
	// however will not work to access the api
	// +optional
	Disabled bool `json:"disabled,omitempty"`

	// The time to life for this access key
	// +optional
	TTL int64 `json:"ttl,omitempty"`

	// If this is specified, the time to life for this access key will
	// start after the lastActivity instead of creation timestamp
	// +optional
	TTLAfterLastActivity bool `json:"ttlAfterLastActivity,omitempty"`

	// Scope defines the scope of the access key.
	// +optional
	Scope *AccessKeyScope `json:"scope,omitempty"`

	// The type of an access key, which basically describes if the access
	// key is user managed or managed by loft itself.
	// +optional
	Type AccessKeyType `json:"type,omitempty"`

	// If available, contains information about the sso login data for this
	// access key
	// +optional
	Identity *AccessKeyIdentity `json:"identity,omitempty"`

	// The last time the identity was refreshed
	// +optional
	IdentityRefresh *metav1.Time `json:"identityRefresh,omitempty"`

	// If the token is a refresh token, contains information about it
	// +optional
	OIDCProvider *AccessKeyOIDCProvider `json:"oidcProvider,omitempty"`

	// DEPRECATED: do not use anymore
	// Parent is used to share OIDC and external token information
	// with multiple access keys. Since copying an OIDC refresh token
	// would result in the other access keys becoming invalid after a refresh
	// parent allows access keys to share that information.
	//
	// The use case for this is primarily user generated access keys,
	// which will have the users current access key as parent if it contains
	// an OIDC token.
	// +optional
	Parent string `json:"parent,omitempty"`

	// DEPRECATED: Use identity instead
	// If available, contains information about the oidc login data for this
	// access key
	// +optional
	OIDCLogin *AccessKeyOIDC `json:"oidcLogin,omitempty"`
}

type AccessKeyStatus struct {
	// The last time this access key was used to access the api
	// +optional
	LastActivity *metav1.Time `json:"lastActivity,omitempty"`
}

type AccessKeyType string

type AccessKeyVirtualCluster struct {
	// Name of the virtual cluster. Empty means all virtual clusters.
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace of the virtual cluster. Empty means all namespaces.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type AccountClusterStatus struct {
	// Status holds the status of the account in the target cluster
	// +optional
	Status AccountClusterStatusPhase `json:"phase,omitempty"`

	// Reason describes why loft couldn't sync the account with a machine readable identifier
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message describes why loft couldn't sync the account in human language
	// +optional
	Message string `json:"message,omitempty"`

	// Cluster is the cluster name of the user in the cluster
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// AccountsClusterTemplate status is the status of the account cluster template that was used
	// to create the cluster account
	// +optional
	AccountsClusterTemplate []AccountClusterTemplateStatus `json:"accountsClusterTemplateStatus,omitempty"`

	// Accounts is the account name of the user in the cluster
	// +optional
	Accounts []string `json:"accounts,omitempty"`
}

type AccountClusterStatusPhase string

type AccountClusterTemplateStatus struct {
	// Name is the name of the cluster account template
	// +optional
	Name string `json:"name,omitempty"`

	// Account is the name of the account in the cluster
	// +optional
	Account string `json:"account,omitempty"`

	// AccountTemplateHash is the hash of the account template that was applied
	// +optional
	AccountTemplateHash string `json:"accountTemplateHash,omitempty"`

	// OwnsHash is the hash of the owns part of the cluster account template that was
	// applied
	// +optional
	OwnsHash string `json:"ownsHash,omitempty"`

	// Last time the condition transitioned from one status to another.
	// +optional
	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`

	// Status holds the status of the account in the target cluster
	// +optional
	Status ClusterAccountTemplateStatusPhase `json:"phase,omitempty"`

	// Reason describes why loft couldn't sync the account with a machine readable identifier
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message describes why loft couldn't sync the account in human language
	// +optional
	Message string `json:"message,omitempty"`
}

type AllowedCluster struct {
	// Name is the name of the cluster that is allowed to create an environment in.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedClusterAccountTemplate struct {
	// Name is the name of a cluster account template
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedRunner struct {
	// Name is the name of the runner that is allowed to create an environment in.
	// +optional
	Name string `json:"name,omitempty"`
}

type AllowedTemplate struct {
	// Kind of the template that is allowed. Currently only supports DevPodWorkspaceTemplate, VirtualClusterTemplate & SpaceTemplate
	// +optional
	Kind string `json:"kind,omitempty"`

	// Group of the template that is allowed. Currently only supports storage.loft.sh
	// +optional
	Group string `json:"group,omitempty"`

	// Name of the template
	// +optional
	Name string `json:"name,omitempty"`

	// IsDefault specifies if the template should be used as a default
	// +optional
	IsDefault bool `json:"isDefault,omitempty"`
}

type App struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AppSpec   `json:"spec,omitempty"`
	Status AppStatus `json:"status,omitempty"`
}

type AppConfig struct {
	// DefaultNamespace is the default namespace this app should installed
	// in.
	// +optional
	DefaultNamespace string `json:"defaultNamespace,omitempty"`

	// Readme is a longer markdown string that describes the app.
	// +optional
	Readme string `json:"readme,omitempty"`

	// Icon holds an URL to the app icon
	// +optional
	Icon string `json:"icon,omitempty"`

	// Config is the helm config to use to deploy the helm release
	// +optional
	Config clusterv1.HelmReleaseConfig `json:"config,omitempty"`

	// Wait determines if Loft should wait during deploy for the app to become ready
	// +optional
	Wait bool `json:"wait,omitempty"`

	// Timeout is the time to wait for any individual Kubernetes operation (like Jobs for hooks) (default 5m0s)
	// +optional
	Timeout string `json:"timeout,omitempty"`

	// Parameters define additional app parameters that will set helm values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// DEPRECATED: Use config.bash instead
	// StreamContainer can be used to stream a containers logs instead of the helm output.
	// +optional
	// +internal
	StreamContainer *StreamContainer `json:"streamContainer,omitempty"`
}

type AppList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []App `json:"items"`
}

type AppParameter struct {
	// Variable is the path of the variable. Can be foo or foo.bar for nested objects.
	// +optional
	Variable string `json:"variable,omitempty"`

	// Label is the label to show for this parameter
	// +optional
	Label string `json:"label,omitempty"`

	// Description is the description to show for this parameter
	// +optional
	Description string `json:"description,omitempty"`

	// Type of the parameter. Can be one of:
	// string, multiline, boolean, number and password
	// +optional
	Type string `json:"type,omitempty"`

	// Options is a slice of strings, where each string represents a mutually exclusive choice.
	// +optional
	Options []string `json:"options,omitempty"`

	// Min is the minimum number if type is number
	// +optional
	Min *int `json:"min,omitempty"`

	// Max is the maximum number if type is number
	// +optional
	Max *int `json:"max,omitempty"`

	// Required specifies if this parameter is required
	// +optional
	Required bool `json:"required,omitempty"`

	// DefaultValue is the default value if none is specified
	// +optional
	DefaultValue string `json:"defaultValue,omitempty"`

	// Placeholder shown in the UI
	// +optional
	Placeholder string `json:"placeholder,omitempty"`

	// Invalidation regex that if matched will reject the input
	// +optional
	Invalidation string `json:"invalidation,omitempty"`

	// Validation regex that if matched will allow the input
	// +optional
	Validation string `json:"validation,omitempty"`

	// Section where this app should be displayed. Apps with the same section name will be grouped together
	// +optional
	Section string `json:"section,omitempty"`
}

type AppSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this app can be installed in.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// RecommendedApp specifies where this app should show up as recommended app
	// +optional
	RecommendedApp []RecommendedApp `json:"recommendedApp,omitempty"`

	// AppConfig is the app configuration
	AppConfig `json:",inline"`

	// Versions are different app versions that can be referenced
	// +optional
	Versions []AppVersion `json:"versions,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// DEPRECATED: Use config instead
	// manifest represents kubernetes resources that will be deployed into the target namespace
	// +optional
	Manifests string `json:"manifests,omitempty"`

	// DEPRECATED: Use config instead
	// helm defines the configuration for a helm deployment
	// +optional
	Helm *HelmConfiguration `json:"helm,omitempty"`
}

type AppStatus struct {
}

type AppTask struct {
	// Type is the task type. Defaults to Upgrade
	// +optional
	Type HelmTaskType `json:"type,omitempty"`

	// RollbackRevision is the revision to rollback to
	// +optional
	RollbackRevision string `json:"rollbackRevision,omitempty"`

	// AppReference is the reference to the app to deploy
	// +optional
	AppReference agentstoragev1.AppReference `json:"appReference,omitempty"`
}

type AppVersion struct {
	// AppConfig is the app configuration
	AppConfig `json:",inline"`

	// Version is the version. Needs to be in X.X.X format.
	// +optional
	Version string `json:"version,omitempty"`
}

type ArgoIntegrationSpec struct {
	// Enabled indicates if the ArgoCD Integration is enabled for the project -- this knob only
	// enables the syncing of virtualclusters, but does not enable SSO integration or project
	// creation (see subsequent spec sections!).
	// +optional
	Enabled bool `json:"enabled,omitempty"`

	// Cluster defines the name of the cluster that ArgoCD is deployed into -- if not provided this
	// will default to 'loft-cluster'.
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// VirtualClusterInstance defines the name of *virtual cluster* (instance) that ArgoCD is
	// deployed into. If provided, Cluster will be ignored and Loft will assume that ArgoCD is
	// running in the specified virtual cluster.
	// +optional
	VirtualClusterInstance string `json:"virtualClusterInstance,omitempty"`

	// Namespace defines the namespace in which ArgoCD is running in the cluster.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// SSO defines single-sign-on related values for the ArgoCD Integration. Enabling SSO will allow
	// users to authenticate to ArgoCD via Loft.
	// +optional
	SSO *ArgoSSOSpec `json:"sso,omitempty"`

	// Project defines project related values for the ArgoCD Integration. Enabling Project
	// integration will cause Loft to generate and manage an ArgoCD appProject that corresponds to
	// the Loft Project.
	// +optional
	Project *ArgoProjectSpec `json:"project,omitempty"`
}

type ArgoProjectPolicyRule struct {
	// Action is one of "*", "get", "create", "update", "delete", "sync", or "override".
	// +optional
	Action string `json:"action,omitempty"`
	// Application is the ArgoCD project/repository to apply the rule to.
	// +optional
	Application string `json:"application,omitempty"`
	// Allow applies the "allow" permission to the rule, if allow is not set, the permission will
	// always be set to "deny".
	// +optional
	Allow bool `json:"permission,omitempty"`
}

type ArgoProjectRole struct {
	// Name of the ArgoCD role to attach to the project.
	Name string `json:"name,omitempty"`
	// Description to add to the ArgoCD project.
	// +optional
	Description string `json:"description,omitempty"`
	// Rules ist a list of policy rules to attach to the role.
	Rules []ArgoProjectPolicyRule `json:"rules,omitempty"`
	// Groups is a list of OIDC group names to bind to the role.
	Groups []string `json:"groups,omitempty"`
}

type ArgoProjectSpec struct {
	// Enabled indicates if the ArgoCD Project Integration is enabled for this project. Enabling
	// this will cause Loft to create an appProject in ArgoCD that is associated with the Loft
	// Project. When Project integration is enabled Loft will override the default assigned role
	// set in the SSO integration spec.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// Metadata defines additional metadata to attach to the loft created project in ArgoCD.
	// +optional
	Metadata ArgoProjectSpecMetadata `json:"metadata,omitempty"`
	// SourceRepos is a list of source repositories to attach/allow on the project, if not specified
	// will be "*" indicating all source repositories.
	// +optional
	SourceRepos []string `json:"sourceRepos,omitempty"`
	// Roles is a list of roles that should be attached to the ArgoCD project. If roles are provided
	// no loft default roles will be set. If no roles are provided *and* SSO is enabled, loft will
	// configure sane default values.
	// +optional
	Roles []ArgoProjectRole `json:"roles,omitempty"`
}

type ArgoProjectSpecMetadata struct {
	// ExtraAnnotations are optional annotations that can be attached to the project in ArgoCD.
	// +optional
	ExtraAnnotations map[string]string `json:"extraAnnotations,omitempty"`
	// ExtraLabels are optional labels that can be attached to the project in ArgoCD.
	// +optional
	ExtraLabels map[string]string `json:"extraLabels,omitempty"`
	// Description to add to the ArgoCD project.
	// +optional
	Description string `json:"description,omitempty"`
}

type ArgoSSOSpec struct {
	// Enabled indicates if the ArgoCD SSO Integration is enabled for this project. Enabling this
	// will cause Loft to configure SSO authentication via Loft in ArgoCD. If Projects are *not*
	// enabled, all users associated with this Project will be assigned either the 'read-only'
	// (default) role, *or* the roles set under the AssignedRoles field.
	// +optional
	Enabled bool `json:"enabled,omitempty"`
	// Host defines the ArgoCD host address that will be used for OIDC authentication between loft
	// and ArgoCD. If not specified OIDC integration will be skipped, but vclusters/spaces will
	// still be synced to ArgoCD.
	// +optional
	Host string `json:"host,omitempty"`
	// AssignedRoles is a list of roles to assign for users who authenticate via Loft -- by default
	// this will be the `read-only` role. If any roles are provided this will override the default
	// setting.
	// +optional
	AssignedRoles []string `json:"assignedRoles,omitempty"`
}

type AutomaticImport struct {
	// VirtualClusters defines automatic virtual cluster import options.
	// +optional
	VirtualClusters AutomaticImportVirtualClusters `json:"virtualClusters,omitempty"`
}

type AutomaticImportVirtualClusters struct {
	// Enabled specifies if automatic virtual cluster import should be enabled for this project.
	// +optional
	Enabled bool `json:"enabled"`
}

type Chart struct {
	// Name is the chart name in the repository
	Name string `json:"name,omitempty"`

	// Version is the chart version in the repository
	// +optional
	Version string `json:"version,omitempty"`

	// RepoURL is the repo url where the chart can be found
	// +optional
	RepoURL string `json:"repoURL,omitempty"`

	// The username that is required for this repository
	// +optional
	Username string `json:"username,omitempty"`

	// The password that is required for this repository
	// +optional
	Password string `json:"password,omitempty"`
}

type Cluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterSpec   `json:"spec,omitempty"`
	Status ClusterStatus `json:"status,omitempty"`
}

type ClusterAccess struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterAccessSpec   `json:"spec,omitempty"`
	Status ClusterAccessStatus `json:"status,omitempty"`
}

type ClusterAccessList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterAccess `json:"items"`
}

type ClusterAccessSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster access object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this template should be applied on.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// LocalClusterAccessTemplate holds the cluster access template
	// +omitempty
	LocalClusterAccessTemplate LocalClusterAccessTemplate `json:"localClusterAccessTemplate,omitempty"`
}

type ClusterAccessStatus struct {
}

type ClusterAccountTemplateClusterStatus struct {
	// Name of the cluster where the cluster account template was applied
	// +optional
	Name string `json:"name,omitempty"`

	// Status holds the status of the account in the target cluster
	// +optional
	Status ClusterAccountTemplateClusterStatusPhase `json:"phase,omitempty"`

	// Reason describes why loft couldn't sync the account with a machine readable identifier
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message describes why loft couldn't sync the account in human language
	// +optional
	Message string `json:"message,omitempty"`
}

type ClusterAccountTemplateClusterStatusPhase string

type ClusterAccountTemplateStatusPhase string

type ClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Cluster `json:"items"`
}

type ClusterRef struct {
	// Cluster is the connected cluster the space will be created in
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// Namespace is the namespace inside the connected cluster holding the space
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type ClusterRoleTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterRoleTemplateSpec   `json:"spec,omitempty"`
	Status ClusterRoleTemplateStatus `json:"status,omitempty"`
}

type ClusterRoleTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterRoleTemplate `json:"items"`
}

type ClusterRoleTemplateSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster role template object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Clusters are the clusters this template should be applied on.
	// +optional
	Clusters []string `json:"clusters,omitempty"`

	// Management defines if this cluster role should be created in the management instance.
	// +optional
	Management bool `json:"management,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// ClusterRoleTemplate holds the cluster role template
	// +optional
	ClusterRoleTemplate ClusterRoleTemplateTemplate `json:"clusterRoleTemplate,omitempty"`

	// DEPRECATED: Use ClusterRoleTemplate instead
	// LocalClusterRoleTemplate holds the cluster role template
	// +omitempty
	LocalClusterRoleTemplate *LocalClusterRoleTemplate `json:"localClusterRoleTemplate,omitempty"`
}

type ClusterRoleTemplateStatus struct {
}

type ClusterRoleTemplateTemplate struct {
	// Standard object's metadata.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Rules holds all the PolicyRules for this ClusterRole
	// +optional
	Rules []rbacv1.PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`

	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
	// stomped by the controller.
	// +optional
	AggregationRule *rbacv1.AggregationRule `json:"aggregationRule,omitempty" protobuf:"bytes,3,opt,name=aggregationRule"`
}

type ClusterSpec struct {
	// If specified this name is displayed in the UI instead of the metadata name
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a cluster access object
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Holds a reference to a secret that holds the kube config to access this cluster
	// +optional
	Config SecretRef `json:"config,omitempty"`

	// Local specifies if it is the local cluster that should be connected, when this is specified, config is optional
	// +optional
	Local bool `json:"local,omitempty"`

	// NetworkPeer specifies if the cluster is connected via tailscale, when this is specified, config is optional
	// +optional
	NetworkPeer bool `json:"networkPeer,omitempty"`

	// The namespace where the cluster components will be installed in
	// +optional
	ManagementNamespace string `json:"managementNamespace,omitempty"`

	// If unusable is true, no spaces or virtual clusters can be scheduled on this cluster.
	// +optional
	Unusable bool `json:"unusable,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`
}

type ClusterStatus struct {
	// +optional
	Phase ClusterStatusPhase `json:"phase,omitempty"`

	// +optional
	Reason string `json:"reason,omitempty"`

	// +optional
	Message string `json:"message,omitempty"`
}

type ClusterStatusPhase string

type ConstraintSpaceTemplate struct {
	// The enforced metadata of the space to create. Currently, only annotations and labels are supported
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// This defines the cluster role that will be used for the rolebinding when
	// creating a new space for the selected subjects
	// +optional
	ClusterRole *string `json:"clusterRole,omitempty"`

	// Objects are Kubernetes style yamls that should get deployed into the space
	// +optional
	Objects string `json:"objects,omitempty"`
}

type DevPodCommandDeleteOptions struct {
	IgnoreNotFound bool   `json:"ignoreNotFound,omitempty"`
	Force          bool   `json:"force,omitempty"`
	GracePeriod    string `json:"gracePeriod,omitempty"`
}

type DevPodCommandStatusOptions struct {
	ContainerStatus bool `json:"containerStatus,omitempty"`
}

type DevPodCommandStopOptions struct{}

type DevPodCommandUpOptions struct {
	// up options
	ID                   string   `json:"id,omitempty"`
	Source               string   `json:"source,omitempty"`
	IDE                  string   `json:"ide,omitempty"`
	IDEOptions           []string `json:"ideOptions,omitempty"`
	PrebuildRepositories []string `json:"prebuildRepositories,omitempty"`
	DevContainerPath     string   `json:"devContainerPath,omitempty"`
	WorkspaceEnv         []string `json:"workspaceEnv,omitempty"`
	Recreate             bool     `json:"recreate,omitempty"`
	Proxy                bool     `json:"proxy,omitempty"`
	DisableDaemon        bool     `json:"disableDaemon,omitempty"`
	DaemonInterval       string   `json:"daemonInterval,omitempty"`

	// build options
	Repository string   `json:"repository,omitempty"`
	SkipPush   bool     `json:"skipPush,omitempty"`
	Platform   []string `json:"platform,omitempty"`

	// TESTING
	ForceBuild            bool `json:"forceBuild,omitempty"`
	ForceInternalBuildKit bool `json:"forceInternalBuildKit,omitempty"`
}

type DevPodProjectSpec struct {
	// +optional
	Git *GitProjectSpec `json:"git,omitempty"`
}

type DevPodProviderOption struct {
	// Value of this option.
	// +optional
	Value string `json:"value,omitempty"`

	// ValueFrom specifies a secret where this value should be taken from.
	// +optional
	ValueFrom *DevPodProviderOptionFrom `json:"valueFrom,omitempty"`
}

type DevPodProviderOptionFrom struct {
	// ProjectSecretRef is the project secret to use for this value.
	// +optional
	ProjectSecretRef *corev1.SecretKeySelector `json:"projectSecretRef,omitempty"`

	// SharedSecretRef is the shared secret to use for this value.
	// +optional
	SharedSecretRef *corev1.SecretKeySelector `json:"sharedSecretRef,omitempty"`
}

type DevPodProviderSource struct {
	// Github source for the provider
	Github string `json:"github,omitempty"`

	// File source for the provider
	File string `json:"file,omitempty"`

	// URL where the provider was downloaded from
	URL string `json:"url,omitempty"`
}

type DevPodWorkspaceInstance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DevPodWorkspaceInstanceSpec   `json:"spec,omitempty"`
	Status DevPodWorkspaceInstanceStatus `json:"status,omitempty"`
}

type DevPodWorkspaceInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DevPodWorkspaceInstance `json:"items"`
}

type DevPodWorkspaceInstanceSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes a DevPod machine instance
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// TemplateRef holds the DevPod machine template reference
	// +optional
	TemplateRef *TemplateRef `json:"templateRef,omitempty"`

	// Template is the inline template to use for DevPod machine creation. This is mutually
	// exclusive with templateRef.
	// +optional
	Template *DevPodWorkspaceTemplateDefinition `json:"template,omitempty"`

	// RunnerRef is the reference to the connected runner holding
	// this workspace
	// +optional
	RunnerRef RunnerRef `json:"runnerRef,omitempty"`

	// Parameters are values to pass to the template.
	// The values should be encoded as YAML string where each parameter is represented as a top-level field key.
	// +optional
	Parameters string `json:"parameters,omitempty"`

	// Access to the DevPod machine instance object itself
	// +optional
	Access []Access `json:"access,omitempty"`
}

type DevPodWorkspaceInstanceStatus struct {
	// LastWorkspaceStatus is the last workspace status reported by the runner.
	// +optional
	LastWorkspaceStatus WorkspaceStatus `json:"lastWorkspaceStatus,omitempty"`

	// Phase describes the current phase the DevPod machine instance is in
	// +optional
	Phase InstancePhase `json:"phase,omitempty"`

	// Reason describes the reason in machine-readable form why the cluster is in the current
	// phase
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message describes the reason in human-readable form why the DevPod machine is in the current
	// phase
	// +optional
	Message string `json:"message,omitempty"`

	// Conditions holds several conditions the DevPod machine might be in
	// +optional
	Conditions agentstoragev1.Conditions `json:"conditions,omitempty"`

	// Instance is the template rendered with all the parameters
	// +optional
	Instance *DevPodWorkspaceTemplateDefinition `json:"instance,omitempty"`

	// IgnoreReconciliation ignores reconciliation for this object
	// +optional
	IgnoreReconciliation bool `json:"ignoreReconciliation,omitempty"`
}

type DevPodWorkspaceProvider struct {
	// Name is the name of the provider. This can also be an url.
	Name string `json:"name"`

	// Options are the provider option values
	// +optional
	Options map[string]DevPodProviderOption `json:"options,omitempty"`

	// Env are environment options to set when using the provider.
	// +optional
	Env map[string]DevPodProviderOption `json:"env,omitempty"`
}

type DevPodWorkspaceTemplate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DevPodWorkspaceTemplateSpec   `json:"spec,omitempty"`
	Status DevPodWorkspaceTemplateStatus `json:"status,omitempty"`
}

type DevPodWorkspaceTemplateDefinition struct {
	// Provider holds the DevPod provider configuration
	Provider DevPodWorkspaceProvider `json:"provider"`

	// SpaceTemplate is the space that should get created for this DevPod. If this is specified, the
	// Kubernetes provider will be selected automatically.
	// +optional
	SpaceTemplate *TemplateRef `json:"spaceTemplate,omitempty"`

	// VirtualClusterTemplate is the virtual cluster that should get created for this DevPod. If this is specified, the
	// Kubernetes provider will be selected automatically.
	// +optional
	VirtualClusterTemplate *TemplateRef `json:"virtualClusterTemplate,omitempty"`

	// WorkspaceEnv are environment variables that should be available within the created workspace.
	// +optional
	WorkspaceEnv map[string]DevPodProviderOption `json:"workspaceEnv,omitempty"`

	// UseProjectGitCredentials specifies if the project git credentials should be used instead of local ones for this workspace
	// +optional
	UseProjectGitCredentials bool `json:"useProjectGitCredentials,omitempty"`
}

type DevPodWorkspaceTemplateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DevPodWorkspaceTemplate `json:"items"`
}

type DevPodWorkspaceTemplateSpec struct {
	// DisplayName is the name that is shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes the virtual cluster template
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Parameters define additional app parameters that will set provider values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// Template holds the DevPod workspace template
	Template DevPodWorkspaceTemplateDefinition `json:"template,omitempty"`

	// Versions are different versions of the template that can be referenced as well
	// +optional
	Versions []DevPodWorkspaceTemplateVersion `json:"versions,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`
}

type DevPodWorkspaceTemplateStatus struct {
}

type DevPodWorkspaceTemplateVersion struct {
	// Template holds the DevPod template
	// +optional
	Template DevPodWorkspaceTemplateDefinition `json:"template,omitempty"`

	// Parameters define additional app parameters that will set provider values
	// +optional
	Parameters []AppParameter `json:"parameters,omitempty"`

	// Version is the version. Needs to be in X.X.X format.
	// +optional
	Version string `json:"version,omitempty"`
}

type GitProjectSpec struct {
	// Token defines the token to use for authentication.
	// +optional
	Token string `json:"token,omitempty"`

	// TokenSecretRef defines the project secret to use for token authentication.
	// Will be used if `Token` is not provided.
	// +optional
	TokenProjectSecretRef *corev1.SecretKeySelector `json:"tokenSecretRef,omitempty"`
}

type GroupResources struct {
	// Group is the name of the API group that contains the resources.
	// The empty string represents the core API group.
	// +optional
	Group string `json:"group,omitempty" protobuf:"bytes,1,opt,name=group"`
	// Resources is a list of resources this rule applies to.
	//
	// For example:
	// 'pods' matches pods.
	// 'pods/log' matches the log subresource of pods.
	// '*' matches all resources and their subresources.
	// 'pods/*' matches all subresources of pods.
	// '*/scale' matches all scale subresources.
	//
	// If wildcard is present, the validation rule will ensure resources do not
	// overlap with each other.
	//
	// An empty list implies all resources and subresources in this API groups apply.
	// +optional
	Resources []string `json:"resources,omitempty" protobuf:"bytes,2,rep,name=resources"`
	// ResourceNames is a list of resource instance names that the policy matches.
	// Using this field requires Resources to be specified.
	// An empty list implies that every instance of the resource is matched.
	// +optional
	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,3,rep,name=resourceNames"`
}

type HelmChart struct {
	// Metadata provides information about a chart
	// +optional
	Metadata clusterv1.Metadata `json:"metadata,omitempty"`

	// Versions holds all chart versions
	// +optional
	Versions []string `json:"versions,omitempty"`

	// Repository is the repository name of this chart
	// +optional
	Repository HelmChartRepository `json:"repository,omitempty"`
}

type HelmChartRepository struct {
	// Name is the name of the repository
	// +optional
	Name string `json:"name,omitempty"`

	// URL is the repository url
	// +optional
	URL string `json:"url,omitempty"`

	// Username of the repository
	// +optional
	Username string `json:"username,omitempty"`

	// Password of the repository
	// +optional
	Password string `json:"password,omitempty"`

	// Insecure specifies if the chart should be retrieved without TLS
	// verification
	// +optional
	Insecure bool `json:"insecure,omitempty"`
}

type HelmConfiguration struct {
	// Name of the chart to deploy
	Name string `json:"name"`

	// The additional helm values to use. Expected block string
	// +optional
	Values string `json:"values,omitempty"`

	// Version is the version of the chart to deploy
	// +optional
	Version string `json:"version,omitempty"`

	// The repo url to use
	// +optional
	RepoURL string `json:"repoUrl,omitempty"`

	// The username to use for the selected repository
	// +optional
	Username string `json:"username,omitempty"`

	// The password to use for the selected repository
	// +optional
	Password string `json:"password,omitempty"`

	// Determines if the remote location uses an insecure
	// TLS certificate.
	// +optional
	Insecure bool `json:"insecure,omitempty"`
}

type HelmTask struct {
	// Release holds the release information
	// +optional
	Release HelmTaskRelease `json:"release,omitempty"`

	// Type is the task type. Defaults to Upgrade
	// +optional
	Type HelmTaskType `json:"type,omitempty"`

	// RollbackRevision is the revision to rollback to
	// +optional
	RollbackRevision string `json:"rollbackRevision,omitempty"`
}

type HelmTaskRelease struct {
	// Name is the name of the release
	Name string `json:"name,omitempty"`

	// Namespace of the release, if empty will use the target namespace
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Config is the helm config to use to deploy the release
	// +optional
	Config clusterv1.HelmReleaseConfig `json:"config,omitempty"`

	// Labels are additional labels for the helm release.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`
}

type HelmTaskType string

type ImportVirtualClustersSpec struct {
	// RoleMapping indicates an optional role mapping from a rancher project role to a rancher cluster role. Map to an empty role to exclude users and groups with that role from
	// being synced.
	// +optional
	RoleMapping map[string]string `json:"roleMapping,omitempty"`
}

type InstanceDeployedAppPhase string

type InstanceDeployedAppStatus struct {
	// Name of the app that should get deployed
	// +optional
	Name string `json:"name,omitempty"`

	// Namespace specifies in which target namespace the app should
	// get deployed in. Only used for virtual cluster apps.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// ReleaseName of the target app
	// +optional
	ReleaseName string `json:"releaseName,omitempty"`

	// Version of the app that should get deployed
	// +optional
	Version string `json:"version,omitempty"`

	// Phase describes the current phase the app deployment is in
	// +optional
	Phase InstanceDeployedAppPhase `json:"phase,omitempty"`

	// Reason describes the reason in machine-readable form
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message describes the reason in human-readable form
	// +optional
	Message string `json:"message,omitempty"`
}

type InstancePhase string

type KindSecretRef struct {
	// APIGroup is the api group of the secret
	APIGroup string `json:"apiGroup,omitempty"`
	// Kind is the kind of the secret
	Kind string `json:"kind,omitempty"`
	// +optional
	SecretName string `json:"secretName,omitempty"`
	// +optional
	SecretNamespace string `json:"secretNamespace,omitempty"`
	// +optional
	Key string `json:"key,omitempty"`
}

type LocalClusterAccessTemplate struct {
	// Metadata is the metadata of the cluster access object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Metadata metav1.ObjectMeta `json:"metadata,omitempty"`

	// LocalClusterAccessSpec holds the spec of the cluster access in the cluster
	// +optional
	LocalClusterAccessSpec agentstoragev1.LocalClusterAccessSpec `json:"spec,omitempty"`
}

type LocalClusterRoleTemplate struct {
	// Metadata is the metadata of the cluster role template object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Metadata metav1.ObjectMeta `json:"metadata,omitempty"`

	// LocalClusterRoleTemplateSpec holds the spec of the cluster role template in the cluster
	// +optional
	LocalClusterRoleTemplateSpec LocalClusterRoleTemplateSpec `json:"spec,omitempty"`
}

type LocalClusterRoleTemplateSpec struct {
	// DisplayName is the name that should be shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description is the description of this object in
	// human-readable text.
	// +optional
	Description string `json:"description,omitempty"`

	// ClusterRoleTemplate holds the cluster role template
	// +optional
	ClusterRoleTemplate ClusterRoleTemplateTemplate `json:"clusterRoleTemplate,omitempty"`
}

type LocalSpaceConstraintSpec struct {
	// DisplayName is the name that should be shown in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description is the description of this object in
	// human-readable text.
	// +optional
	Description string `json:"description,omitempty"`

	// SpaceTemplate holds the space configuration
	// +optional
	SpaceTemplate ConstraintSpaceTemplate `json:"spaceTemplate,omitempty"`

	// Sync specifies if spaces that were created through this space constraint
	// object should get synced with this object.
	// +optional
	Sync bool `json:"sync,omitempty"`
}

type LocalSpaceConstraintTemplate struct {
	// Metadata is the metadata of the space constraint object
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	Metadata metav1.ObjectMeta `json:"metadata,omitempty"`

	// LocalSpaceConstraintSpec holds the spec of the space constraint in the cluster
	// +optional
	LocalSpaceConstraintSpec LocalSpaceConstraintSpec `json:"spec,omitempty"`
}

type Member struct {
	// Kind is the kind of the member. Currently either User or Team
	// +optional
	Kind string `json:"kind,omitempty"`

	// Group of the member. Currently only supports storage.loft.sh
	// +optional
	Group string `json:"group,omitempty"`

	// Name of the member
	// +optional
	Name string `json:"name,omitempty"`

	// ClusterRole is the assigned role for the above member
	ClusterRole string `json:"clusterRole,omitempty"`
}

type NamespacePattern struct {
	// Space holds the namespace pattern to use for space instances
	// +optional
	Space string `json:"space,omitempty"`

	// VirtualCluster holds the namespace pattern to use for virtual cluster instances
	// +optional
	VirtualCluster string `json:"virtualCluster,omitempty"`
}

type NetworkPeer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,inline"`

	Spec   NetworkPeerSpec   `json:"spec,omitempty"`
	Status NetworkPeerStatus `json:"status,omitempty"`
}

type NetworkPeerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []NetworkPeer `json:"items"`
}

type NetworkPeerSpec struct {
	// DiscoKey is a key used for DERP discovery
	DiscoKey string `json:"discoKey,omitempty"`
	// MachineKey is used to identify a network peer
	MachineKey string `json:"machineKey,omitempty"`
	// NodeKey is used to identify a session
	NodeKey string `json:"nodeKey,omitempty"`
	// Addresses is a list of IP addresses of this Node directly.
	Addresses []string `json:"addresses,omitempty"`
	// AllowedIPs is a range of IP addresses to route to this node.
	AllowedIPs []string `json:"allowedIPs,omitempty"`
	// Endpoints is a list of IP+port (public via STUN, and local LANs) where
	// this node can be reached.
	Endpoints []string `json:"endpoints,omitempty"`
}

type NetworkPeerStatus struct {
	// LastSeen is when the network peer was last online. It is not updated when
	// Online is true.
	LastSeen string `json:"lastSeen,omitempty"`
	// HomeDerpRegion is the currently preferred DERP region by the network peer
	HomeDerpRegion int `json:"homeDerpRegion,omitempty"`
	// Online is whether the node is currently connected to the coordination
	// server.
	Online bool `json:"online,omitempty"`
}

type Project struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ProjectSpec   `json:"spec,omitempty"`
	Status ProjectStatus `json:"status,omitempty"`
}

type ProjectList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Project `json:"items"`
}

type ProjectSpec struct {
	// DisplayName is the name that should be displayed in the UI
	// +optional
	DisplayName string `json:"displayName,omitempty"`

	// Description describes an app
	// +optional
	Description string `json:"description,omitempty"`

	// Owner holds the owner of this object
	// +optional
	Owner *UserOrTeam `json:"owner,omitempty"`

	// Quotas define the quotas inside the project
	// +optional
	Quotas Quotas `json:"quotas,omitempty"`

	// AllowedClusters are target clusters that are allowed to target with
	// environments.
	// +optional
	AllowedClusters []AllowedCluster `json:"allowedClusters,omitempty"`

	// AllowedRunners are target runners that are allowed to target with
	// DevPod environments.
	// +optional
	AllowedRunners []AllowedRunner `json:"allowedRunners,omitempty"`

	// AllowedTemplates are the templates that are allowed to use in this
	// project.
	// +optional
	AllowedTemplates []AllowedTemplate `json:"allowedTemplates,omitempty"`

	// RequireTemplate configures if a template is required for instance creation.
	// +optional
	RequireTemplate RequireTemplate `json:"requireTemplate,omitempty"`

	// Members are the users and teams that are part of this project
	// +optional
	Members []Member `json:"members,omitempty"`

	// Access holds the access rights for users and teams
	// +optional
	Access []Access `json:"access,omitempty"`

	// NamespacePattern specifies template patterns to use for creating each space or virtual cluster's namespace
	// +optional
	NamespacePattern *NamespacePattern `json:"namespacePattern,omitempty"`

	// AutomaticImport imports vClusters & Namespace automatically
	// +optional
	AutomaticImport AutomaticImport `json:"automaticImport,omitempty"`

	// ArgoIntegration holds information about ArgoCD Integration
	// +optional
	ArgoIntegration *ArgoIntegrationSpec `json:"argoCD,omitempty"`

	// VaultIntegration holds information about Vault Integration
	// +optional
	VaultIntegration *VaultIntegrationSpec `json:"vault,omitempty"`

	// RancherIntegration holds information about Rancher Integration
	// +optional
	RancherIntegration *RancherIntegrationSpec `json:"rancher,omitempty"`

	// DevPod holds DevPod specific configuration for project
	// +optional
	DevPod *DevPodProjectSpec `json:"devPod,omitempty"`
}

type ProjectStatus struct {
	// Quotas holds the quota status
	// +optional
	Quotas *QuotaStatus `json:"quotas,omitempty"`

	// Conditions holds several conditions the project might be in
	// +optional
	Conditions agentstoragev1.Conditions `json:"conditions,omitempty"`
}

type QuotaStatus struct {
	// Project is the quota status for the whole project
	// +optional
	Project *QuotaStatusProject `json:"project,omitempty"`

	// User is the quota status for each user / team. An example status
	// could look like this:
	// status:
	//   quotas:
	//     user:
	//       limit:
	//         pods: "10"
	//         spaces: "5"
	//       users:
	//         admin:
	//           used:
	//             spaces: "3"  # <- calculated in our apiserver
	//             pods: "8"    # <- the sum calculated from clusters
	//       clusters:
	//         cluster-1:  # <- populated by agent from cluster-1
	//           users:
	//             admin:
	//               pods: "3"
	//         cluster-2:
	//           users:
	//             admin:
	//               pods: "5"
	// +optional
	User *QuotaStatusUser `json:"user,omitempty"`
}

type QuotaStatusProject struct {
	// Limit is the amount limited, copied from spec.quotas.project
	// +optional
	Limit map[string]string `json:"limit,omitempty"`

	// Used is the amount currently used across all clusters
	// +optional
	Used map[string]string `json:"used,omitempty"`

	// Clusters holds the used amount per cluster. Maps cluster name to used resources
	// +optional
	Clusters map[string]QuotaStatusProjectCluster `json:"clusters,omitempty"`
}

type QuotaStatusProjectCluster struct {
	// Used is the amount currently used. Maps resource name, such as pods, to their
	// used amount.
	// +optional
	Used map[string]string `json:"used,omitempty"`
}

type QuotaStatusUser struct {
	// Limit is the amount limited per user / team
	// +optional
	Limit map[string]string `json:"limit,omitempty"`

	// Used is the used amount per user / team
	// +optional
	Used QuotaStatusUserUsed `json:"used,omitempty"`

	// Clusters holds the used amount per cluster. Maps cluster name to used resources
	// +optional
	Clusters map[string]QuotaStatusUserUsed `json:"clusters,omitempty"`
}

type QuotaStatusUserUsed struct {
	// Users is a mapping of users to used resources
	// +optional
	Users map[string]map[string]string `json:"users,omitempty"`

	// Teams is a mapping of teams to used resources
	// +optional
	Teams map[string]map[string]string `json:"teams,omitempty"`
}

type Quotas struct {
	// Project holds the quotas for the whole project
	// +optional
	Project map[string]string `json:"project,omitempty"`

	// User holds the quotas per user / team
	User map[string]string `json:"user,omitempty"`
}

type RancherIntegrationSpec struct {
	// Enabled indicates if the Rancher Project Integration is enabled for this project.
	// +optional
	Enabled bool `json:"enabled,omitempty"`

	// ProjectRef defines references to rancher project, required for syncMembers and syncVirtualClusters.syncMembers
	// +optional
	ProjectRef RancherProjectRef `json:"projectRef,omitempty"`

	// ImportVirtualClusters defines settings to import virtual clusters to Rancher on creation
	// +optional
	ImportVirtualClusters ImportVirtualClustersSpec `json:"importVirtualClusters,omitempty"`

	// SyncMembers defines settings to sync Rancher project members to the loft project
	// +optional
	SyncMembers SyncMembersSpec `json:"syncMembers,omitempty"`
}

type RancherProjectRef struct {
	// Cluster defines the Rancher cluster ID
	// Needs to be the same id within Loft
	Cluster string `json:"cluster,omitempty"`

	// Project defines the Rancher project ID
	Project string `json:"project,omitempty"`
}

type RecommendedApp string

type RequestTarget string

type RequireTemplate struct {
	// If true, all users within the project will be allowed to create a new instance without a template.
	// By default, only admins are allowed to create a new instance without a template.
	// +optional
	Disabled bool `json:"disabled,omitempty"`
}

type Runner struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RunnerSpec   `json:"spec,omitempty"`
	Status RunnerStatus `json:"status,omitempty"`
}

type RunnerClusterRef struct {
	// Cluster is the connected cluster the space will be created in
	// +optional
	Cluster string `json:"cluster,omitempty"`

	// Namespace is the namespace inside the connected cluster holding the space
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// PersistentVolumeClaimTemplate holds additional options for the persistent volume claim
	// +optional
	PersistentVolumeClaimTemplate *RunnerPersistentVolumeClaimTemplate `json:"persistentVolumeClaimTemplate,omitempty"`

	// PodTemplate holds additional options for the runner pod
	// +optional
	PodTemplate *RunnerPodTemplate `json:"podTemplate,omitempty"`
}

type RunnerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Runner `json:"items"`
}

type RunnerPersistentVolumeClaimTemplate struct {
	// Metadata holds the template metadata
	// +optional
	Metadata TemplateMetadata `json:"metadata,omitempty"`

	// Spec holds the template spec
	// +optional
	Spec RunnerPersistentVolumeClaimTemplateSpec `json:"spec,omitempty"`
}