v1alpha1

type AIProviderSettings struct {
	// Model is the LLM model name to use.
	//
	// +kubebuilder:validation:Optional
	Model *string `json:"model,omitempty"`

	// ToolModel to use for tool calling, which is less frequent and often requires more advanced reasoning
	//
	// +kubebuilder:validation:Optional
	ToolModel *string `json:"toolModel,omitempty"`

	// EmbeddingModel to use for generating embeddings
	//
	// +kubebuilder:validation:Optional
	EmbeddingModel *string `json:"embeddingModel,omitempty"`

	// BaseUrl is a custom base url to use, for reimplementations
	// of the same API scheme (for instance Together.ai uses the OpenAI API spec)
	//
	// +kubebuilder:validation:Optional
	BaseUrl *string `json:"baseUrl,omitempty"`

	// TokenSecretRef is a reference to the local secret holding the token to access
	// the configured AI provider.
	//
	// +kubebuilder:validation:Required
	TokenSecretRef corev1.SecretKeySelector `json:"tokenSecretRef"`
}

type AISettings struct {
	// Enabled defines whether to enable the AI integration or not.
	//
	// +kubebuilder:default=false
	// +kubebuilder:validation:Optional
	Enabled *bool `json:"enabled,omitempty"`

	// Configure the pace at which AI insight analysis should run. Useful if you want to minimize impacts on inference costs.
	//
	// +kubebuilder:validation:Optional
	AnalysisRates *AnalysisRates `json:"analysisRates,omitempty"`

	// Tools holds the configuration for the tools that can be used with the AI integration.
	//
	// +kubebuilder:validation:Optional
	Tools *Tools `json:"tools,omitempty"`

	// Provider defines which of the supported LLM providers should be used.
	//
	// +kubebuilder:validation:Enum=OPENAI;ANTHROPIC;OLLAMA;AZURE;BEDROCK;VERTEX
	// +kubebuilder:default=OPENAI
	// +kubebuilder:validation:Optional
	Provider *console.AiProvider `json:"provider,omitempty"`

	// ToolProvider to use for tool calling, in case you want to use a different LLM more optimized to those tasks
	//
	// +kubebuilder:validation:Enum=OPENAI;ANTHROPIC;OLLAMA;AZURE;BEDROCK;VERTEX
	// +kubebuilder:validation:Optional
	ToolProvider *console.AiProvider `json:"toolProvider,omitempty"`

	// EmbeddingProvider to use for generating embeddings. Oftentimes foundational
	// model providers do not have embeddings models, and it's better to simply use OpenAI.
	//
	// +kubebuilder:validation:Enum=OPENAI;ANTHROPIC;OLLAMA;AZURE;BEDROCK;VERTEX
	// +kubebuilder:validation:Optional
	EmbeddingProvider *console.AiProvider `json:"embeddingProvider,omitempty"`

	// OpenAI holds the OpenAI provider configuration.
	//
	// +kubebuilder:validation:Optional
	OpenAI *AIProviderSettings `json:"openAI,omitempty"`

	// Anthropic holds the Anthropic provider configuration.
	//
	// +kubebuilder:validation:Optional
	Anthropic *AIProviderSettings `json:"anthropic,omitempty"`

	// Ollama holds configuration for a self-hosted Ollama deployment,
	// more details available at https://github.com/ollama/ollama
	//
	// +kubebuilder:validation:Optional
	Ollama *OllamaSettings `json:"ollama,omitempty"`

	// Azure holds configuration for using AzureOpenAI to generate LLM insights
	//
	// +kubebuilder:validation:Optional
	Azure *AzureOpenAISettings `json:"azure,omitempty"`

	// Bedrock holds configuration for using AWS Bedrock to generate LLM insights
	//
	// +kubebuilder:validation:Optional
	Bedrock *BedrockSettings `json:"bedrock,omitempty"`

	// Vertex holds configuration for using GCP VertexAI to generate LLM insights
	//
	// +kubebuilder:validation:Optional
	Vertex *VertexSettings `json:"vertex,omitempty"`

	// VectorStore holds configuration for using a vector store to store embeddings.
	//
	// +kubebuilder:validation:Optional
	VectorStore *VectorStore `json:"vectorStore,omitempty"`

	// Configuration for the cloud graph store, which uses similar datastores to the vector store.
	//
	// +kubebuilder:validation:Optional
	Graph *GraphStore `json:"graph,omitempty"`
}

type AWSCloudConnection struct {
	AccessKeyId     string             `json:"accessKeyId"`
	SecretAccessKey ObjectKeyReference `json:"secretAccessKey"`

	// The region this connection applies to
	// +kubebuilder:validation:Optional
	Region *string `json:"region"`

	// A list of regions this connection can query
	// +kubebuilder:validation:Optional
	Regions []string `json:"regions"`
}

type AiApprovalConfiguration struct {
	// Enabled indicates if AI approval is enabled for this stack.
	// +kubebuilder:validation:Required
	Enabled bool `json:"enabled,omitempty"`

	// Git references the Git repository containing the rules file.
	// +kubebuilder:validation:Required
	Git GitRef `json:"git"`

	// File is the name of the rules file within the Git repository.
	// +kubebuilder:validation:Required
	File string `json:"file"`

	// IgnoreCancel indicates if the cancellation of a stack run should be ignored by AI.
	// +kubebuilder:validation:Optional
	IgnoreCancel *bool `json:"ignoreCancel,omitempty"`
}

type AnalysisRates struct {
	// Fast is the rate in seconds for fast analysis, eg when the prompt used has seen a material change. Example 1h
	//
	// +kubebuilder:validation:Optional
	Fast *string `json:"fast,omitempty"`

	// Slow is the rate in seconds for slow analysis, eg when the prompt used has not seen a material change. Example 2h
	//
	// +kubebuilder:validation:Optional
	Slow *string `json:"slow,omitempty"`
}

type AnsibleConfiguration struct {
	// Playbook is the ansible playbook to run.
	// +kubebuilder:validation:Optional
	Playbook *string `json:"playbook,omitempty"`

	// Inventory is the ansible inventory file to use.  We recommend checking this into git alongside your playbook files, and referencing it with a relative path.
	// +kubebuilder:validation:Optional
	Inventory *string `json:"inventory,omitempty"`

	// Additional args for the ansible playbook command.
	// +kubebuilder:validation:Optional
	AdditionalArgs []*string `json:"additionalArgs,omitempty"`
}

type AuthAttributesGetter func(context.Context, HelmRepository) (*console.HelmAuthAttributes, error)

type AzureCloudConnection struct {
	SubscriptionId string             `json:"subscriptionId"`
	TenantId       string             `json:"tenantId"`
	ClientId       string             `json:"clientId"`
	ClientSecret   ObjectKeyReference `json:"clientSecret"`
}

type AzureDevopsSettings struct {
	// The username to use for azure devops, it should be associated with the PAT you are supplying as the tokenSecretRef
	Username string `json:"username"`
	// The organization to use for azure devops
	Organization string `json:"organization"`
	// The project to use for azure devops
	Project string `json:"project"`
}

type AzureOpenAISettings struct {
	// Endpoint is your Azure OpenAI endpoint,
	// should be formatted like: https://{endpoint}/openai/deployments/{deployment-id}"
	//
	// +kubebuilder:validation:Required
	Endpoint string `json:"endpoint"`

	// The azure openai Data plane - inference api version to use,
	// defaults to 2024-10-01-preview or the latest available
	//
	// +kubebuilder:validation:Optional
	ApiVersion *string `json:"apiVersion,omitempty"`

	// Model - the OpenAi model you wish to use. If not specified, Plural will provide a default.
	//
	// +kubebuilder:validation:Optional
	Model *string `json:"model,omitempty"`

	// ToolModel to use for tool calling, which is less frequent and often requires more advanced reasoning.
	//
	// +kubebuilder:validation:Optional
	ToolModel *string `json:"toolModel,omitempty"`

	// EmbeddingModel to use for generating embeddings.
	//
	// +kubebuilder:validation:Optional
	EmbeddingModel *string `json:"embeddingModel,omitempty"`

	// TokenSecretRef is a reference to the local secret holding the token to access
	// the configured AI provider.
	//
	// +kubebuilder:validation:Required
	TokenSecretRef corev1.SecretKeySelector `json:"tokenSecretRef"`
}

type BedrockSettings struct {
	// ModelID is the AWS Bedrock Model ID to use.  This will use the openai compatible endpoint, so the model id must be supported.
	//
	// +kubebuilder:validation:Required
	ModelID string `json:"modelId"`

	// ToolModelId to use for tool calling, which is less frequent and often requires more advanced reasoning
	//
	// +kubebuilder:validation:Optional
	ToolModelId *string `json:"toolModelId,omitempty"`

	// EmbeddingModel to use for generating embeddings
	//
	// +kubebuilder:validation:Optional
	EmbeddingModel *string `json:"embeddingModel,omitempty"`

	// Region is the AWS region the model is hosted in
	//
	// +kubebuilder:validation:Required
	Region string `json:"region"`

	// TokenSecretRef is a reference to the local secret holding the token to access
	// the configured AI provider.
	//
	// +kubebuilder:validation:Required
	TokenSecretRef corev1.SecretKeySelector `json:"tokenSecretRef,omitempty"`
}

type Binding struct {
	// ID of a binding.
	// Deprecated.
	// Do not use.
	// +kubebuilder:validation:Optional
	ID *string `json:"id,omitempty"`

	// +kubebuilder:validation:Optional
	UserID *string `json:"UserID,omitempty"`

	// +kubebuilder:validation:Optional
	UserEmail *string `json:"userEmail,omitempty"`

	// +kubebuilder:validation:Optional
	GroupID *string `json:"groupID,omitempty"`

	// +kubebuilder:validation:Optional
	GroupName *string `json:"groupName,omitempty"`
}

type Bindings struct {
	// Read bindings.
	// +kubebuilder:validation:Optional
	Read []Binding `json:"read,omitempty"`

	// Write bindings.
	// +kubebuilder:validation:Optional
	Write []Binding `json:"write,omitempty"`
}

type BindingsTemplate struct {
	// Read bindings.
	// +kubebuilder:validation:Optional
	Read *string `json:"read,omitempty"`

	// Write bindings.
	// +kubebuilder:validation:Optional
	Write *string `json:"write,omitempty"`
}

type BootstrapToken struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   BootstrapTokenSpec `json:"spec,omitempty"`
	Status Status             `json:"status,omitempty"`
}

type BootstrapTokenList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []BootstrapToken `json:"items"`
}

type BootstrapTokenSpec struct {
	// User is an optional email to attribute bootstrap token operations in audit logs.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="User is immutable"
	// +kubebuilder:validation:Optional
	User *string `json:"user,omitempty"`

	// ProjectRef is the project that all clusters registered with this token will belong to.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Project is immutable"
	// +kubebuilder:validation:Required
	ProjectRef v1.ObjectReference `json:"projectRef,omitempty"`

	// TokenSecretRef points to a secret where the generated bootstrap token will be stored.
	// The secret is created automatically and must not already exist when the BootstrapToken is created.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Token secret is immutable"
	// +kubebuilder:validation:Required
	TokenSecretRef v1.SecretReference `json:"tokenSecretRef,omitempty"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type Cascade struct {
	// Detach specifies whether to delete owned resources in Plural Console but leave
	// the corresponding Kubernetes objects in-place in the target clusters.
	// This allows for graceful handoff of resource management without disrupting running workloads.
	// +kubebuilder:validation:Optional
	Detach *bool `json:"detach,omitempty"`

	// Delete specifies whether to delete owned resources both in Plural Console
	// and in the targeted Kubernetes clusters. When true, this performs a complete
	// cleanup of all associated resources across the entire service deployment.
	// +kubebuilder:validation:Optional
	Delete *bool `json:"delete,omitempty"`
}

type Catalog struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CatalogSpec `json:"spec,omitempty"`
	Status Status      `json:"status,omitempty"`
}

type CatalogBindings struct {
	// Create bindings control who can generate new PR automations using this catalog.
	// Users with create permissions can trigger self-service workflows but cannot modify the catalog itself.
	// +kubebuilder:validation:Optional
	Create []Binding `json:"create,omitempty"`

	// Read bindings control who can view and browse this catalog and its PR automations.
	// Users with read permissions can see available automations but cannot execute or modify them.
	// +kubebuilder:validation:Optional
	Read []Binding `json:"read,omitempty"`

	// Write bindings control who can modify the catalog and its PR automations.
	// Users with write permissions can add, update, or remove PR automations within this catalog.
	// +kubebuilder:validation:Optional
	Write []Binding `json:"write,omitempty"`
}

type CatalogList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Catalog `json:"items"`
}

type CatalogSpec struct {
	// Name is the display name for this catalog if different from metadata.name.
	// Defaults to metadata.name if not specified.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty"`

	// Author is the name of the catalog creator used for attribution and contact purposes.
	// This field helps users identify who maintains and supports the catalog contents.
	// +kubebuilder:validation:Required
	Author string `json:"author"`

	// Icon is a URL to an icon image for visual identification in the catalog browser.
	// Should be a publicly accessible image URL that displays well at small sizes.
	// +kubebuilder:validation:Optional
	Icon *string `json:"icon,omitempty"`

	// DarkIcon is a URL to a dark mode variant of the catalog icon.
	// Used when the UI is in dark mode to ensure proper contrast and visibility.
	// +kubebuilder:validation:Optional
	DarkIcon *string `json:"darkIcon,omitempty"`

	// Description provides a detailed explanation of the catalog's purpose and contents.
	// This helps users understand what types of automations they can find within.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:example:=my catalog description
	Description *string `json:"description,omitempty"`

	// Category is a short classification label for organizing catalogs in the browser.
	// Examples include "infrastructure", "security", "monitoring", or "development".
	// +kubebuilder:validation:Optional
	Category *string `json:"category,omitempty"`

	// ProjectRef links this catalog to a specific project for permission inheritance.
	// When set, the catalog inherits the project's RBAC policies and is scoped to that project.
	// ProjectRef owning project of the catalog, permissions will propagate down
	// +kubebuilder:validation:Optional
	ProjectRef *corev1.ObjectReference `json:"projectRef,omitempty"`

	// Tags provide key-value metadata for filtering and organizing catalogs.
	// Useful for adding custom labels like environment, team, or technology stack.
	// +kubebuilder:validation:Optional
	Tags map[string]string `json:"tags,omitempty"`

	// Bindings define the read, write, and create permissions for this catalog.
	// Controls who can view, modify, and use the PR automations within this catalog.
	// Bindings contain read and write policies of this Catalog.
	// +kubebuilder:validation:Optional
	Bindings *CatalogBindings `json:"bindings,omitempty"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type CloudConnection struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CloudConnectionSpec `json:"spec,omitempty"`
	Status Status              `json:"status,omitempty"`
}

type CloudConnectionConfiguration struct {
	AWS   *AWSCloudConnection   `json:"aws,omitempty"`
	GCP   *GCPCloudConnection   `json:"gcp,omitempty"`
	Azure *AzureCloudConnection `json:"azure,omitempty"`
}

type CloudConnectionGetter func(context.Context, CloudConnection) (*console.CloudConnectionAttributes, error)

type CloudConnectionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CloudConnection `json:"items"`
}

type CloudConnectionSpec struct {
	// Name of this CloudConnection. If not provided CloudConnection's own name
	// from CloudConnection.ObjectMeta will be used.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty"`

	// Provider is the name of the cloud service for the Provider.
	// One of (CloudProvider): [gcp, aws, azure]
	// +kubebuilder:example:=aws
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:validation:Enum:=gcp;aws;azure
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Provider is immutable"
	Provider CloudProvider `json:"provider"`

	// Configuration contains the cloud connection configuration.
	// +kubebuilder:validation:Required
	Configuration CloudConnectionConfiguration `json:"configuration"`

	// ReadBindings is a list of bindings that defines
	// who can use this CloudConnection.
	// +kubebuilder:validation:Optional
	ReadBindings []Binding `json:"readBindings,omitempty"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type CloudProvider string

type Cluster struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterSpec   `json:"spec,omitempty"`
	Status ClusterStatus `json:"status,omitempty"`
}

type ClusterAWSCloudSettings struct {
	// Region in AWS to deploy this cluster to.
	// Determines data residency, latency characteristics, and available AWS services.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	Region string `json:"region"`
}

type ClusterAzureCloudSettings struct {
	// ResourceGroup specifies the Azure resource group name for organizing cluster resources.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:example:=myresourcegroup
	ResourceGroup string `json:"resourceGroup"`

	// Network specifies the Azure virtual network name for cluster networking.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:example:=mynetwork
	Network string `json:"network"`

	// SubscriptionId is the GUID of the Azure subscription that will contain this cluster.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	SubscriptionId string `json:"subscriptionId"`

	// Location specifies the Azure region where this cluster will be deployed.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:example:=eastus
	Location string `json:"location"`
}

type ClusterCloudSettings struct {
	// AWS contains Amazon Web Services specific cluster configuration.
	// +kubebuilder:validation:Optional
	AWS *ClusterAWSCloudSettings `json:"aws,omitempty"`

	// Azure contains Microsoft Azure specific cluster configuration.
	// +kubebuilder:validation:Optional
	Azure *ClusterAzureCloudSettings `json:"azure,omitempty"`

	// GCP contains Google Cloud Platform specific cluster configuration.
	// +kubebuilder:validation:Optional
	GCP *ClusterGCPCloudSettings `json:"gcp,omitempty"`
}

type ClusterGCPCloudSettings struct {
	// Project specifies the GCP project ID where this cluster will be deployed.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	Project string `json:"project"`

	// Network specifies the GCP VPC network name for cluster networking.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	Network string `json:"network"`

	// Region specifies the GCP region where this cluster will be deployed.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	Region string `json:"region"`
}

type ClusterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Cluster `json:"items"`
}

type ClusterNodePool struct {
	// Name is the unique identifier for this node pool within the cluster.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	Name string `json:"name"`

	// InstanceType specifies the cloud provider instance type for nodes in this pool.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	InstanceType string `json:"instanceType"`

	// MinSize is the minimum number of nodes that must be running in this pool.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=1
	MinSize int64 `json:"minSize"`

	// MaxSize is the maximum number of nodes that can be running in this pool.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=1
	MaxSize int64 `json:"maxSize"`

	// Labels are key-value pairs applied to nodes for workload scheduling and organization.
	// +kubebuilder:validation:Optional
	Labels map[string]string `json:"labels,omitempty"`

	// Taints are restrictions applied to nodes to control which pods can be scheduled.
	// +kubebuilder:validation:Optional
	Taints []Taint `json:"taints,omitempty"`

	// CloudSettings contains cloud provider-specific configuration for this node pool.
	// +kubebuilder:validation:Optional
	// +structType=atomic
	CloudSettings *ClusterNodePoolCloudSettings `json:"cloudSettings,omitempty"`
}

type ClusterNodePoolAWSCloudSettings struct {
	// LaunchTemplateId specifies a custom EC2 launch template ID for node provisioning.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	LaunchTemplateId *string `json:"launchTemplateId,omitempty"`
}

type ClusterNodePoolCloudSettings struct {
	// AWS contains Amazon Web Services specific node pool configuration.
	// +kubebuilder:validation:Optional
	AWS *ClusterNodePoolAWSCloudSettings `json:"aws,omitempty"`
}

type ClusterRestore struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterRestoreSpec   `json:"spec,omitempty"`
	Status ClusterRestoreStatus `json:"status,omitempty"`
}

type ClusterRestoreList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ClusterRestore `json:"items"`
}

type ClusterRestoreSpec struct {
	// BackupID is an ID of the backup to restore.
	// If BackupID is specified, then BackupName, BackupNamespace, and BackupClusterRef are not needed.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="BackupID is immutable"
	BackupID *string `json:"backupID"`

	// BackupName is a name of the backup to restore.
	// BackupNamespace and BackupClusterRef have to be specified as well with it.
	// If BackupName, BackupNamespace, and BackupCluster are specified, then BackupID is not needed.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="BackupName is immutable"
	BackupName *string `json:"backupName"`

	// BackupNamespace is a namespace of the backup to restore.
	// BackupName and BackupClusterRef have to be specified as well with it.
	// If BackupName, BackupNamespace, and BackupCluster are specified, then BackupID is not needed.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="BackupNamespace is immutable"
	BackupNamespace *string `json:"backupNamespace"`

	// BackupClusterID is an ID of a cluster where the backup to restore is located.
	// BackupName and BackupNamespace have to be specified as well with it.
	// If BackupName, BackupNamespace, and BackupClusterRef are specified, then BackupID is not needed.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="BackupClusterRef is immutable"
	BackupClusterRef *corev1.ObjectReference `json:"backupClusterRef"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type ClusterRestoreStatus struct {
	// ID of the cluster restore in the Console API.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	ID *string `json:"id,omitempty"`

	// +kubebuilder:validation:Enum=CREATED;PENDING;SUCCESSFUL;FAILED
	Status console.RestoreStatus `json:"status,omitempty"`

	// Represents the observations of ClusterRestore current state.
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type ClusterRestoreTrigger struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec defines the desired state and configuration for the cluster restore trigger.
	Spec ClusterRestoreTriggerSpec `json:"spec,omitempty"`

	// Status represents the current state of the cluster restore trigger operation.
	Status Status `json:"status,omitempty"`
}

type ClusterRestoreTriggerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ClusterRestoreTrigger `json:"items"`
}

type ClusterRestoreTriggerSpec struct {
	// ClusterRestoreRef is a reference to the ClusterRestore resource that contains
	// the backup data and configuration for the restore operation.
	//
	// This reference should point to a valid ClusterRestore resource that has been
	// successfully created and contains the backup data needed for restoration.
	//
	// +kubebuilder:validation:Optional
	ClusterRestoreRef *corev1.ObjectReference `json:"clusterRestoreRef,omitempty"`
}

type ClusterSpec struct {
	// Handle is a short, unique human-readable name used to identify this cluster.
	// Does not necessarily map to the cloud resource name.
	// This has to be specified to adopt the existing cluster.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:example:=myclusterhandle
	Handle *string `json:"handle,omitempty"`

	// Version specifies the Kubernetes version to use for this cluster.
	// Can be skipped only for BYOK (Bring Your Own Kubernetes) clusters where a version is externally managed.
	// Deprecated.
	// Do not use.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:example:="1.25.11"
	Version *string `json:"version,omitempty"`

	// ProviderRef references the cloud provider to use for this cluster.
	// Can be skipped only for BYOK clusters where infrastructure is externally provisioned.
	// Deprecated.
	// Do not use.
	// +kubebuilder:validation:Optional
	ProviderRef *corev1.ObjectReference `json:"providerRef,omitempty"`

	// ProjectRef references the project this cluster belongs to for multi-tenancy and access control.
	// If not provided, the cluster will be assigned to the default project.
	// Deprecated.
	// Do not use.
	// +kubebuilder:validation:Optional
	ProjectRef *corev1.ObjectReference `json:"projectRef,omitempty"`

	// Cloud specifies the cloud provider to use for this cluster.
	// Determines the infrastructure platform where the cluster will be provisioned and managed.
	// For BYOK clusters, this field is set to "byok" and no cloud provider is required.
	// Deprecated.
	// Do not use.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	// +kubebuilder:validation:Enum=aws;azure;gcp;byok
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Cloud is immutable"
	// +kubebuilder:example:=azure
	Cloud string `json:"cloud"`

	// Protect prevents accidental deletion of this cluster.
	// When enabled, the cluster cannot be deleted through the Console UI or API.
	// Deprecated.
	// Do not use.
	// +kubebuilder:validation:Optional
	// +kubebuilder:example:=false
	Protect *bool `json:"protect,omitempty"`

	// Tags are key-value pairs used to categorize and filter clusters in fleet management.
	// Used for organizing clusters by environment, team, or other operational criteria.
	// +kubebuilder:validation:Optional
	Tags map[string]string `json:"tags,omitempty"`

	// Metadata contains arbitrary JSON metadata for storing cluster-specific configuration.
	// Used for custom cluster properties and integration with external systems.
	// +kubebuilder:validation:Optional
	Metadata *runtime.RawExtension `json:"metadata,omitempty"`

	// Bindings contain read and write access policies for this cluster.
	// Controls which users and groups can view or manage this cluster through RBAC.
	// +kubebuilder:validation:Optional
	Bindings *Bindings `json:"bindings,omitempty"`

	// CloudSettings contains cloud provider-specific configuration for this cluster.
	// Deprecated.
	// Do not use.
	// +kubebuilder:validation:Optional
	// +structType=atomic
	CloudSettings *ClusterCloudSettings `json:"cloudSettings,omitempty"`

	// NodePools defines the worker node configurations managed by this cluster.
	// Deprecated.
	// Do not use.
	// +kubebuilder:validation:Optional
	NodePools []ClusterNodePool `json:"nodePools"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type ClusterSpecTemplate struct {
	// Metadata for the cluster.
	// +kubebuilder:validation:Required
	Metadata MetadataTemplate `json:"metadata"`

	// Spec for the cluster.
	// +kubebuilder:validation:Required
	Spec SpecTemplate `json:"spec,omitempty"`
}

type ClusterStatus struct {
	Status `json:",inline"`

	// CurrentVersion contains the actual Kubernetes version currently running on this cluster.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	CurrentVersion *string `json:"currentVersion,omitempty"`

	// KasURL contains the Kubernetes API Server URL for accessing this cluster.
	// Used by the Console and deployment operators for cluster communication.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	KasURL *string `json:"kasURL,omitempty"`

	// PingedAt contains the timestamp of the last successful cluster health check.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Type:=string
	PingedAt *string `json:"pingedAt,omitempty"`
}

type ClusterSync struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterSyncSpec `json:"spec,omitempty"`
	Status Status          `json:"status,omitempty"`
}

type ClusterSyncList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterSync `json:"items"`
}

type ClusterSyncSpec struct {
	// ProjectRef references project to sync clusters from.
	// +kubebuilder:validation:Optional
	ProjectRef *corev1.ObjectReference `json:"projectRef,omitempty"`

	// Tags used to filter clusters.
	// +kubebuilder:validation:Optional
	Tags map[string]string `json:"tags,omitempty"`

	// ClusterSpec contains specifications of the cluster.
	// +kubebuilder:validation:Required
	ClusterSpec ClusterSpecTemplate `json:"clusterSpec"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type ClusterTarget struct {
	// Tags specify a set of key-value pairs used to select target clusters.
	// Only clusters that match all specified tags will receive the managed namespace.
	// This provides a flexible mechanism for targeting specific cluster groups,
	// environments, or organizational boundaries.
	// +kubebuilder:validation:Optional
	Tags map[string]string `json:"tags,omitempty"`

	// Distro specifies the Kubernetes distribution type for target cluster selection.
	// This allows targeting namespaces to specific cluster types that may have
	// distribution-specific requirements, networking configurations, or security policies.
	// +kubebuilder:validation:Optional
	Distro *console.ClusterDistro `json:"distro,omitempty"`
}

type CommandAttributes struct {
	// Cmd is the command to execute
	// +kubebuilder:validation:Required
	Cmd string `json:"cmd"`

	// Args are the arguments to pass to the command.
	// +kubebuilder:validation:Optional
	Args []string `json:"args,omitempty"`

	// Dir is the working directory for the command.
	// +kubebuilder:validation:Optional
	Dir *string `json:"dir,omitempty"`
}

type ComplianceReportGenerator struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComplianceReportGeneratorSpec `json:"spec,omitempty"`
	Status Status                        `json:"status,omitempty"`
}

type ComplianceReportGeneratorList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComplianceReportGenerator `json:"items"`
}

type ComplianceReportGeneratorSpec struct {
	// Name, if not provided name from object meta will be used.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty"`

	// Format of the report to be generated.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=CSV;JSON
	Format console.ComplianceReportFormat `json:"format,omitempty"`

	// ReadBindings represent the download policy for this report.
	// +kubebuilder:validation:Optional
	ReadBindings []Binding `json:"readBindings,omitempty"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type ComponentState string

type Condition struct {
	// +kubebuilder:validation:Required
	Field string `json:"field"`

	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=NOT;GT;LT;EQ;GTE;LTE;PREFIX;SUFFIX
	console.Operation `json:"operation"`

	// +kubebuilder:validation:Optional
	Value *string `json:"value,omitempty"`
}

type ConditionMessage string

type ConditionReason string

type ConditionType string

type Container struct {
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	Image string `json:"image"`

	// +kubebuilder:validation:Optional
	Args []*string `json:"args,omitempty"`

	// +kubebuilder:validation:Optional
	Env []*Env `json:"env,omitempty"`

	// +kubebuilder:validation:Optional
	EnvFrom []*EnvFrom `json:"envFrom,omitempty"`

	// +kubebuilder:validation:Optional
	Resources *ContainerResources `json:"resources,omitempty"`
}

type ContainerResourceRequests struct {
	// +kubebuilder:validation:Optional
	CPU *string `json:"cpu,omitempty"`

	// +kubebuilder:validation:Optional
	Memory *string `json:"memory,omitempty"`
}

type ContainerResources struct {
	// +kubebuilder:validation:Optional
	Requests *ContainerResourceRequests `json:"requests,omitempty"`

	// +kubebuilder:validation:Optional
	Limits *ContainerResourceRequests `json:"limits,omitempty"`
}

type CostSettings struct {
	// RecommendationCushion is a percentage amount of cushion
	// to give over the average discovered utilization to generate
	// a scaling recommendation, should be between 1-99.
	//
	// +kubebuilder:validation:Optional
	RecommendationCushion *int64 `json:"recommendationCushion,omitempty"`

	// RecommendationThreshold is the minimal monthly cost for
	// a recommendation to be covered by a controller.
	//
	// +kubebuilder:validation:Optional
	RecommendationThreshold *int64 `json:"recommendationThreshold,omitempty"`
}

type CreatePr struct {
	// ScmConnectionRef the SCM connection to use for pr automations
	//
	// +kubebuilder:validation:Optional
	ScmConnectionRef *corev1.ObjectReference `json:"scmConnectionRef,omitempty"`
}

type CustomRunStep struct {
	// Args provides additional command-line arguments that should be passed
	// to the command specified in Cmd during execution.
	// +kubebuilder:validation:Required
	Args []string `json:"args,omitempty"`

	// Cmd specifies the executable command that should be run as part of this
	// custom step. This can be any command available in the execution environment.
	// +kubebuilder:validation:Required
	Cmd string `json:"cmd"`

	// RequireApproval determines whether this step requires manual approval
	// before it can proceed. When true, the stack run will pause at this step
	// until an authorized user approves its execution.
	// +kubebuilder:validation:Optional
	RequireApproval *bool `json:"requireApproval,omitempty"`

	// Stage controls at which phase of the stack lifecycle this step should be executed.
	// Valid stages include PLAN, VERIFY, APPLY, INIT, and DESTROY, allowing fine-grained
	// control over when custom logic runs in relation to the main IaC operations.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=PLAN;VERIFY;APPLY;INIT;DESTROY
	Stage console.StepStage `json:"stage"`
}

type CustomStackRun struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CustomStackRunSpec `json:"spec,omitempty"`
	Status Status             `json:"status,omitempty"`
}

type CustomStackRunList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CustomStackRun `json:"items"`
}

type CustomStackRunSpec struct {
	// Name of this CustomStackRun. If not provided CustomStackRun's own name from CustomStackRun.ObjectMeta will be used.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty"`

	// StackRef is a reference to the stack this custom run belongs to.
	// +kubebuilder:validation:Optional
	StackRef *corev1.LocalObjectReference `json:"stackRef,omitempty"`

	// Documentation to explain what this custom run does.
	// +kubebuilder:validation:Optional
	Documentation *string `json:"documentation,omitempty"`

	// Commands to execute as part of this custom run.
	// +kubebuilder:validation:Optional
	Commands []CommandAttributes `json:"commands,omitempty"`

	// Configuration self-service configuration which will be presented in UI before triggering
	// +kubebuilder:validation:Optional
	Configuration []PrAutomationConfiguration `json:"configuration,omitempty"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type DeploymentSettings struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DeploymentSettingsSpec `json:"spec,omitempty"`
	Status Status                 `json:"status,omitempty"`
}

type DeploymentSettingsBindings struct {
	// Read bindings.
	//
	// +kubebuilder:validation:Optional
	Read []Binding `json:"read,omitempty"`

	// Write bindings.
	//
	// +kubebuilder:validation:Optional
	Write []Binding `json:"write,omitempty"`

	// Create bindings.
	//
	// +kubebuilder:validation:Optional
	Create []Binding `json:"create,omitempty"`

	// Git bindings.
	//
	// +kubebuilder:validation:Optional
	Git []Binding `json:"git,omitempty"`
}

type DeploymentSettingsList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeploymentSettings `json:"items"`
}

type DeploymentSettingsSpec struct {
	// AgentHelmValues custom helm values to apply
	// to all agents (useful for things like adding
	// customary annotations/labels)
	//
	// +kubebuilder:validation:Optional
	AgentHelmValues *runtime.RawExtension `json:"agentHelmValues,omitempty"`

	// ManagementRepo is the root repo for setting up
	// your infrastructure with Plural. Usually this
	// will be your `plural up repo`
	//
	// +kubebuilder:validation:Optional
	ManagementRepo *string `json:"managementRepo,omitempty"`

	// Stacks global configuration for stack execution.
	//
	// +kubebuilder:validation:Optional
	Stacks *StackSettings `json:"stacks,omitempty"`

	// Bindings global configuration for access control.
	//
	// +kubebuilder:validation:Optional
	Bindings *DeploymentSettingsBindings `json:"bindings,omitempty"`

	// PrometheusConnection connection details for a prometheus instance to use
	//
	// +kubebuilder:validation:Optional
	PrometheusConnection *HTTPConnection `json:"prometheusConnection,omitempty"`

	// LokiConnection connection details for a loki instance to use
	//
	// +kubebuilder:validation:Optional
	LokiConnection *HTTPConnection `json:"lokiConnection,omitempty"`

	// AI settings specifies a configuration for LLM provider clients
	//
	// +kubebuilder:validation:Optional
	AI *AISettings `json:"ai,omitempty"`

	// Logging settings for connections to log aggregation datastores
	//
	// +kubebuilder:validation:Optional
	Logging *LoggingSettings `json:"logging,omitempty"`

	// Cost settings for managing Plural's cost management features
	//
	// +kubebuilder:validation:Optional
	Cost *CostSettings `json:"cost,omitempty"`

	// DeploymentRepositoryRef is a pointer to the deployment GIT repository to use
	//
	// +kubebuilder:validation:Optional
	DeploymentRepositoryRef *NamespacedName `json:"deploymentRepositoryRef,omitempty"`

	// ScaffoldsRepositoryRef is a pointer to the Scaffolds GIT repository to use
	//
	// +kubebuilder:validation:Optional
	ScaffoldsRepositoryRef *NamespacedName `json:"scaffoldsRepositoryRef,omitempty"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type DiffNormalizers struct {
	Name *string `json:"name,omitempty"`
	Kind *string `json:"kind,omitempty"`

	// +kubebuilder:validation:Optional
	Namespace *string `json:"namespace,omitempty"`

	// Backfill indicates whether to backfill the given pointers with the current live value
	// or otherwise ignore it entirely.
	// +kubebuilder:validation:Optional
	Backfill *bool `json:"backfill,omitempty"`

	// JSONPointers contains a list of JSON patches to apply to the service, which controls how drift detection works.
	JSONPointers []string `json:"jsonPointers,omitempty"`
}

type ElasticsearchConnection struct {
	// Host is the elasticsearch host to connect to.
	//
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Index to query in elasticsearch.
	//
	// +kubebuilder:validation:Optional
	Index string `json:"index"`

	// User to connect with basic auth.
	//
	// +kubebuilder:validation:Optional
	User *string `json:"user,omitempty"`

	// PasswordSecretRef is a reference to a secret containing the password to connect with basic auth.
	//
	// +kubebuilder:validation:Optional
	PasswordSecretRef *corev1.SecretKeySelector `json:"passwordSecretRef,omitempty"`
}

type ElasticsearchConnectionSettings struct {
	// Host is the host of the elasticsearch cluster.
	//
	// +kubebuilder:validation:Required
	Host string `json:"host"`

	// Index is the index of the elasticsearch cluster.
	//
	// +kubebuilder:validation:Required
	Index string `json:"index"`

	// User is the user to authenticate with.
	//
	// +kubebuilder:validation:Optional
	User *string `json:"user,omitempty"`

	// PasswordSecretRef is a reference to the local secret holding the password to authenticate with.
	//
	// +kubebuilder:validation:Optional
	PasswordSecretRef *corev1.SecretKeySelector `json:"passwordSecretRef,omitempty"`
}

type Env struct {
	// Name of the environment variable to set.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	Name string `json:"name"`

	// Value of the environment variable to set.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Type:=string
	Value string `json:"value"`
}

type EnvFrom struct {
	// Secret to source environment variables from.
	// +kubebuilder:validation:Type:=string
	Secret string `json:"secret"`

	// ConfigMap to source environment variables from.
	// +kubebuilder:validation:Type:=string
	ConfigMap string `json:"configMap"`
}

type FederatedCredential struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   FederatedCredentialSpec `json:"spec,omitempty"`
	Status Status                  `json:"status,omitempty"`
}

type FederatedCredentialList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []FederatedCredential `json:"items"`
}

type FederatedCredentialSpec struct {
	// Issuer is the URL of the identity provider that issues the tokens.
	// +kubebuilder:validation:Required
	Issuer string `json:"issuer"`

	// Scopes are the scopes that the credential will request from the identity provider.
	// +kubebuilder:validation:Optional
	Scopes []string `json:"scopes,omitempty"`

	// ClaimsLike is a JSON expression that matches the claims in the token.
	// All the value strings should be a valid regular expression.
	//
	// Example:
	// 	...
	//	claimsLike:
	//		sub: "repo:myaccount/myrepo:ref:refs/heads/.*"
	//
	// +kubebuilder:validation:Optional
	ClaimsLike *runtime.RawExtension `json:"claimsLike,omitempty"`

	// User is the user email address that will be authenticated by this credential.
	// +kubebuilder:validation:Required
	User string `json:"user"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type Flow struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   FlowSpec `json:"spec,omitempty"`
	Status Status   `json:"status,omitempty"`
}

type FlowList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Flow `json:"items"`
}

type FlowServerAssociation struct {
	// MCPServerRef is a required reference to an MCP server resource.
	// This establishes the connection between the flow and the server.
	// +kubebuilder:validation:Required
	MCPServerRef corev1.ObjectReference `json:"mcpServerRef,omitempty"`
}

type FlowSpec struct {
	// Name of this Flow. If not provided Flow's own name from Flow.ObjectMeta will be used.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty"`

	// Description provides a longform description of the service managed by this flow.
	// This field is used for documentation and UI display purposes.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty"`

	// Icon specifies an optional image icon for the flow to apply branding or improve identification.
	// +kubebuilder:validation:Optional
	Icon *string `json:"icon,omitempty"`

	// ProjectRef allows a global service to be scoped to a specific project only.
	// +kubebuilder:validation:Optional
	ProjectRef *corev1.ObjectReference `json:"projectRef,omitempty"`

	// Bindings contain read and write policies of this Flow.
	// +kubebuilder:validation:Optional
	Bindings *Bindings `json:"bindings,omitempty"`

	// Repositories contains a list of git https urls of the application code repositories used in this flow.
	// +kubebuilder:validation:Optional
	Repositories []string `json:"repositories,omitempty"`

	// ServerAssociations contains a list of MCP services you wish to associate with this flow.
	// Can also be managed within the Plural Console UI securely.
	// +kubebuilder:validation:Optional
	ServerAssociations []FlowServerAssociation `json:"serverAssociations,omitempty"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type GCPCloudConnection struct {
	ServiceAccountKey ObjectKeyReference `json:"serviceAccountKey"`
	ProjectId         string             `json:"projectId"`
}

type GateSpec struct {
	// Job configuration for JOB gate types, enabling custom validation jobs
	// such as integration tests, security scans, or other promotion checks.
	// +kubebuilder:validation:Optional
	Job *JobSpec `json:"job,omitempty"`
}

type GeneratedSecret struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GeneratedSecretSpec   `json:"spec,omitempty"`
	Status GeneratedSecretStatus `json:"status,omitempty"`
}

type GeneratedSecretDestination struct {
	// Name specifies the name of the secret to create at the destination.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Namespace specifies the namespace where the secret should be created.
	// If omitted, defaults to the same namespace as the GeneratedSecret resource.
	// +kubebuilder:validation:Optional
	Namespace string `json:"namespace,omitempty"`
}

type GeneratedSecretList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GeneratedSecret `json:"items"`
}

type GeneratedSecretSpec struct {
	// Template defines the secret data as key-value pairs in string form.
	// +kubebuilder:validation:Optional
	Template map[string]string `json:"template,omitempty"`

	// Destinations describe the target name and namespace for the generated secrets.
	// +kubebuilder:validation:Optional
	Destinations []GeneratedSecretDestination `json:"destinations,omitempty"`

	// ConfigurationRef references a Secret containing configuration data used to populate template variables.
	// +kubebuilder:validation:Optional
	ConfigurationRef *corev1.SecretReference `json:"configurationRef,omitempty"`

	// Reconciliation settings for this resource.
	// Controls drift detection and reconciliation intervals.
	// +kubebuilder:validation:Optional
	Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
}

type GeneratedSecretStatus struct {
	// Status contains the common status fields including conditions.
	Status `json:",inline"`

	// RenderedTemplateSecretRef references the secret containing the final rendered template data.
	// +kubebuilder:validation:Optional
	RenderedTemplateSecretRef *corev1.LocalObjectReference `json:"renderedTemplateSecretRef,omitempty"`
}

type GitHealth string

type GitRef struct {
	// Folder is the folder in the Git repository where the manifests are located.
	// +kubebuilder:validation:Required
	Folder string `json:"folder"`

	// Ref is the Git reference (branch, tag, or commit) to use.
	// +kubebuilder:validation:Required
	Ref string `json:"ref"`

	// Optional files to add to the manifests for this service
	// +kubebuilder:validation:Optional
	Files []string `json:"files,omitempty"`
}

type GitRepository struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GitRepositorySpec   `json:"spec,omitempty"`
	Status GitRepositoryStatus `json:"status,omitempty"`
}