v1beta1

type AddressGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.capacity) || (has(self.initProvider) && has(self.initProvider.capacity))",message="spec.forProvider.capacity is a required parameter"
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.type) || (has(self.initProvider) && has(self.initProvider.type))",message="spec.forProvider.type is a required parameter"
	Spec   AddressGroupSpec   `json:"spec"`
	Status AddressGroupStatus `json:"status,omitempty"`
}

type AddressGroupInitParameters struct {

	// Capacity of the Address Group.
	Capacity *float64 `json:"capacity,omitempty" tf:"capacity,omitempty"`

	// Free-text description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// List of items.
	Items []*string `json:"items,omitempty" tf:"items,omitempty"`

	// Set of label tags associated with the AddressGroup resource.
	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The type of the Address Group. Possible values are "IPV4" or "IPV6".
	// Possible values are: IPV4, IPV6.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type AddressGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AddressGroup `json:"items"`
}

type AddressGroupObservation struct {

	// Capacity of the Address Group.
	Capacity *float64 `json:"capacity,omitempty" tf:"capacity,omitempty"`

	// The timestamp when the resource was created.
	// A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z"
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// Free-text description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// for all of the labels present on the resource.
	// +mapType=granular
	EffectiveLabels map[string]*string `json:"effectiveLabels,omitempty" tf:"effective_labels,omitempty"`

	// an identifier for the resource with format {{parent}}/locations/{{location}}/addressGroups/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// List of items.
	Items []*string `json:"items,omitempty" tf:"items,omitempty"`

	// Set of label tags associated with the AddressGroup resource.
	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The location of the gateway security policy.
	// The default value is global.
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}.
	Parent *string `json:"parent,omitempty" tf:"parent,omitempty"`

	// The combination of labels configured directly on the resource
	// and default labels configured on the provider.
	// +mapType=granular
	TerraformLabels map[string]*string `json:"terraformLabels,omitempty" tf:"terraform_labels,omitempty"`

	// The type of the Address Group. Possible values are "IPV4" or "IPV6".
	// Possible values are: IPV4, IPV6.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`

	// The timestamp when the resource was updated.
	// A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`
}

type AddressGroupParameters struct {

	// Capacity of the Address Group.
	// +kubebuilder:validation:Optional
	Capacity *float64 `json:"capacity,omitempty" tf:"capacity,omitempty"`

	// Free-text description of the resource.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// List of items.
	// +kubebuilder:validation:Optional
	Items []*string `json:"items,omitempty" tf:"items,omitempty"`

	// Set of label tags associated with the AddressGroup resource.
	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
	// +kubebuilder:validation:Optional
	// +mapType=granular
	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`

	// The location of the gateway security policy.
	// The default value is global.
	// +kubebuilder:validation:Required
	Location *string `json:"location" tf:"location,omitempty"`

	// The name of the parent this address group belongs to. Format: organizations/{organization_id} or projects/{project_id}.
	// +kubebuilder:validation:Required
	Parent *string `json:"parent" tf:"parent,omitempty"`

	// The type of the Address Group. Possible values are "IPV4" or "IPV6".
	// Possible values are: IPV4, IPV6.
	// +kubebuilder:validation:Optional
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type AddressGroupSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     AddressGroupParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider AddressGroupInitParameters `json:"initProvider,omitempty"`
}

type AddressGroupStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        AddressGroupObservation `json:"atProvider,omitempty"`
}

type GatewaySecurityPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              GatewaySecurityPolicySpec   `json:"spec"`
	Status            GatewaySecurityPolicyStatus `json:"status,omitempty"`
}

type GatewaySecurityPolicyInitParameters struct {

	// A free-text description of the resource. Max length 1024 characters.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`
}

type GatewaySecurityPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GatewaySecurityPolicy `json:"items"`
}

type GatewaySecurityPolicyObservation struct {

	// The timestamp when the resource was created.
	// A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z"
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// A free-text description of the resource. Max length 1024 characters.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/{{location}}/gatewaySecurityPolicies/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// The location of the gateway security policy.
	// The default value is global.
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// Server-defined URL of this resource.
	SelfLink *string `json:"selfLink,omitempty" tf:"self_link,omitempty"`

	// The timestamp when the resource was updated.
	// A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`
}

type GatewaySecurityPolicyParameters struct {

	// A free-text description of the resource. Max length 1024 characters.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// The location of the gateway security policy.
	// The default value is global.
	// +kubebuilder:validation:Optional
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`
}

type GatewaySecurityPolicyRule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.basicProfile) || (has(self.initProvider) && has(self.initProvider.basicProfile))",message="spec.forProvider.basicProfile is a required parameter"
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.enabled) || (has(self.initProvider) && has(self.initProvider.enabled))",message="spec.forProvider.enabled is a required parameter"
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.priority) || (has(self.initProvider) && has(self.initProvider.priority))",message="spec.forProvider.priority is a required parameter"
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.sessionMatcher) || (has(self.initProvider) && has(self.initProvider.sessionMatcher))",message="spec.forProvider.sessionMatcher is a required parameter"
	Spec   GatewaySecurityPolicyRuleSpec   `json:"spec"`
	Status GatewaySecurityPolicyRuleStatus `json:"status,omitempty"`
}

type GatewaySecurityPolicyRuleInitParameters struct {

	// CEL expression for matching on L7/application level criteria.
	ApplicationMatcher *string `json:"applicationMatcher,omitempty" tf:"application_matcher,omitempty"`

	// Profile which tells what the primitive action should be. Possible values are: * ALLOW * DENY.
	// Possible values are: BASIC_PROFILE_UNSPECIFIED, ALLOW, DENY.
	BasicProfile *string `json:"basicProfile,omitempty" tf:"basic_profile,omitempty"`

	// Free-text description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Whether the rule is enforced.
	Enabled *bool `json:"enabled,omitempty" tf:"enabled,omitempty"`

	// Priority of the rule. Lower number corresponds to higher precedence.
	Priority *float64 `json:"priority,omitempty" tf:"priority,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// CEL expression for matching on session criteria.
	SessionMatcher *string `json:"sessionMatcher,omitempty" tf:"session_matcher,omitempty"`

	// Flag to enable TLS inspection of traffic matching on. Can only be true if the
	// parent GatewaySecurityPolicy references a TLSInspectionConfig.
	TLSInspectionEnabled *bool `json:"tlsInspectionEnabled,omitempty" tf:"tls_inspection_enabled,omitempty"`
}

type GatewaySecurityPolicyRuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GatewaySecurityPolicyRule `json:"items"`
}

type GatewaySecurityPolicyRuleObservation struct {

	// CEL expression for matching on L7/application level criteria.
	ApplicationMatcher *string `json:"applicationMatcher,omitempty" tf:"application_matcher,omitempty"`

	// Profile which tells what the primitive action should be. Possible values are: * ALLOW * DENY.
	// Possible values are: BASIC_PROFILE_UNSPECIFIED, ALLOW, DENY.
	BasicProfile *string `json:"basicProfile,omitempty" tf:"basic_profile,omitempty"`

	// The timestamp when the resource was created.
	// A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z"
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// Free-text description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Whether the rule is enforced.
	Enabled *bool `json:"enabled,omitempty" tf:"enabled,omitempty"`

	// The name of the gatewat security policy this rule belongs to.
	GatewaySecurityPolicy *string `json:"gatewaySecurityPolicy,omitempty" tf:"gateway_security_policy,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/{{location}}/gatewaySecurityPolicies/{{gateway_security_policy}}/rules/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// The location of the gateway security policy.
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// Priority of the rule. Lower number corresponds to higher precedence.
	Priority *float64 `json:"priority,omitempty" tf:"priority,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// Server-defined URL of this resource.
	SelfLink *string `json:"selfLink,omitempty" tf:"self_link,omitempty"`

	// CEL expression for matching on session criteria.
	SessionMatcher *string `json:"sessionMatcher,omitempty" tf:"session_matcher,omitempty"`

	// Flag to enable TLS inspection of traffic matching on. Can only be true if the
	// parent GatewaySecurityPolicy references a TLSInspectionConfig.
	TLSInspectionEnabled *bool `json:"tlsInspectionEnabled,omitempty" tf:"tls_inspection_enabled,omitempty"`

	// The timestamp when the resource was updated.
	// A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
	// Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`
}

type GatewaySecurityPolicyRuleParameters struct {

	// CEL expression for matching on L7/application level criteria.
	// +kubebuilder:validation:Optional
	ApplicationMatcher *string `json:"applicationMatcher,omitempty" tf:"application_matcher,omitempty"`

	// Profile which tells what the primitive action should be. Possible values are: * ALLOW * DENY.
	// Possible values are: BASIC_PROFILE_UNSPECIFIED, ALLOW, DENY.
	// +kubebuilder:validation:Optional
	BasicProfile *string `json:"basicProfile,omitempty" tf:"basic_profile,omitempty"`

	// Free-text description of the resource.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Whether the rule is enforced.
	// +kubebuilder:validation:Optional
	Enabled *bool `json:"enabled,omitempty" tf:"enabled,omitempty"`

	// The name of the gatewat security policy this rule belongs to.
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/networksecurity/v1beta1.GatewaySecurityPolicy
	// +kubebuilder:validation:Optional
	GatewaySecurityPolicy *string `json:"gatewaySecurityPolicy,omitempty" tf:"gateway_security_policy,omitempty"`

	// Reference to a GatewaySecurityPolicy in networksecurity to populate gatewaySecurityPolicy.
	// +kubebuilder:validation:Optional
	GatewaySecurityPolicyRef *v1.Reference `json:"gatewaySecurityPolicyRef,omitempty" tf:"-"`

	// Selector for a GatewaySecurityPolicy in networksecurity to populate gatewaySecurityPolicy.
	// +kubebuilder:validation:Optional
	GatewaySecurityPolicySelector *v1.Selector `json:"gatewaySecurityPolicySelector,omitempty" tf:"-"`

	// The location of the gateway security policy.
	// +kubebuilder:validation:Required
	Location *string `json:"location" tf:"location,omitempty"`

	// Priority of the rule. Lower number corresponds to higher precedence.
	// +kubebuilder:validation:Optional
	Priority *float64 `json:"priority,omitempty" tf:"priority,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// CEL expression for matching on session criteria.
	// +kubebuilder:validation:Optional
	SessionMatcher *string `json:"sessionMatcher,omitempty" tf:"session_matcher,omitempty"`

	// Flag to enable TLS inspection of traffic matching on. Can only be true if the
	// parent GatewaySecurityPolicy references a TLSInspectionConfig.
	// +kubebuilder:validation:Optional
	TLSInspectionEnabled *bool `json:"tlsInspectionEnabled,omitempty" tf:"tls_inspection_enabled,omitempty"`
}

type GatewaySecurityPolicyRuleSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     GatewaySecurityPolicyRuleParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider GatewaySecurityPolicyRuleInitParameters `json:"initProvider,omitempty"`
}

type GatewaySecurityPolicyRuleStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        GatewaySecurityPolicyRuleObservation `json:"atProvider,omitempty"`
}

type GatewaySecurityPolicySpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     GatewaySecurityPolicyParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider GatewaySecurityPolicyInitParameters `json:"initProvider,omitempty"`
}

type GatewaySecurityPolicyStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        GatewaySecurityPolicyObservation `json:"atProvider,omitempty"`
}

type TLSInspectionPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              TLSInspectionPolicySpec   `json:"spec"`
	Status            TLSInspectionPolicyStatus `json:"status,omitempty"`
}

type TLSInspectionPolicyInitParameters struct {

	// A CA pool resource used to issue interception certificates.
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/privateca/v1beta2.CAPool
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractResourceID()
	CAPool *string `json:"caPool,omitempty" tf:"ca_pool,omitempty"`

	// Reference to a CAPool in privateca to populate caPool.
	// +kubebuilder:validation:Optional
	CAPoolRef *v1.Reference `json:"caPoolRef,omitempty" tf:"-"`

	// Selector for a CAPool in privateca to populate caPool.
	// +kubebuilder:validation:Optional
	CAPoolSelector *v1.Selector `json:"caPoolSelector,omitempty" tf:"-"`

	// List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
	CustomTLSFeatures []*string `json:"customTlsFeatures,omitempty" tf:"custom_tls_features,omitempty"`

	// Free-text description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
	ExcludePublicCASet *bool `json:"excludePublicCaSet,omitempty" tf:"exclude_public_ca_set,omitempty"`

	// Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
	// Possible values are: TLS_VERSION_UNSPECIFIED, TLS_1_0, TLS_1_1, TLS_1_2, TLS_1_3.
	MinTLSVersion *string `json:"minTlsVersion,omitempty" tf:"min_tls_version,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
	// Possible values are: PROFILE_UNSPECIFIED, PROFILE_COMPATIBLE, PROFILE_MODERN, PROFILE_RESTRICTED, PROFILE_CUSTOM.
	TLSFeatureProfile *string `json:"tlsFeatureProfile,omitempty" tf:"tls_feature_profile,omitempty"`

	// A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/certificatemanager/v1beta1.TrustConfig
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractResourceID()
	TrustConfig *string `json:"trustConfig,omitempty" tf:"trust_config,omitempty"`

	// Reference to a TrustConfig in certificatemanager to populate trustConfig.
	// +kubebuilder:validation:Optional
	TrustConfigRef *v1.Reference `json:"trustConfigRef,omitempty" tf:"-"`

	// Selector for a TrustConfig in certificatemanager to populate trustConfig.
	// +kubebuilder:validation:Optional
	TrustConfigSelector *v1.Selector `json:"trustConfigSelector,omitempty" tf:"-"`
}

type TLSInspectionPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []TLSInspectionPolicy `json:"items"`
}

type TLSInspectionPolicyObservation struct {

	// A CA pool resource used to issue interception certificates.
	CAPool *string `json:"caPool,omitempty" tf:"ca_pool,omitempty"`

	// The timestamp when the resource was created.
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
	CustomTLSFeatures []*string `json:"customTlsFeatures,omitempty" tf:"custom_tls_features,omitempty"`

	// Free-text description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
	ExcludePublicCASet *bool `json:"excludePublicCaSet,omitempty" tf:"exclude_public_ca_set,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/{{location}}/tlsInspectionPolicies/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// The location of the tls inspection policy.
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
	// Possible values are: TLS_VERSION_UNSPECIFIED, TLS_1_0, TLS_1_1, TLS_1_2, TLS_1_3.
	MinTLSVersion *string `json:"minTlsVersion,omitempty" tf:"min_tls_version,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
	// Possible values are: PROFILE_UNSPECIFIED, PROFILE_COMPATIBLE, PROFILE_MODERN, PROFILE_RESTRICTED, PROFILE_CUSTOM.
	TLSFeatureProfile *string `json:"tlsFeatureProfile,omitempty" tf:"tls_feature_profile,omitempty"`

	// A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
	TrustConfig *string `json:"trustConfig,omitempty" tf:"trust_config,omitempty"`

	// The timestamp when the resource was updated.
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`
}

type TLSInspectionPolicyParameters struct {

	// A CA pool resource used to issue interception certificates.
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/privateca/v1beta2.CAPool
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractResourceID()
	// +kubebuilder:validation:Optional
	CAPool *string `json:"caPool,omitempty" tf:"ca_pool,omitempty"`

	// Reference to a CAPool in privateca to populate caPool.
	// +kubebuilder:validation:Optional
	CAPoolRef *v1.Reference `json:"caPoolRef,omitempty" tf:"-"`

	// Selector for a CAPool in privateca to populate caPool.
	// +kubebuilder:validation:Optional
	CAPoolSelector *v1.Selector `json:"caPoolSelector,omitempty" tf:"-"`

	// List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
	// +kubebuilder:validation:Optional
	CustomTLSFeatures []*string `json:"customTlsFeatures,omitempty" tf:"custom_tls_features,omitempty"`

	// Free-text description of the resource.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
	// +kubebuilder:validation:Optional
	ExcludePublicCASet *bool `json:"excludePublicCaSet,omitempty" tf:"exclude_public_ca_set,omitempty"`

	// The location of the tls inspection policy.
	// +kubebuilder:validation:Optional
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
	// Possible values are: TLS_VERSION_UNSPECIFIED, TLS_1_0, TLS_1_1, TLS_1_2, TLS_1_3.
	// +kubebuilder:validation:Optional
	MinTLSVersion *string `json:"minTlsVersion,omitempty" tf:"min_tls_version,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
	// Possible values are: PROFILE_UNSPECIFIED, PROFILE_COMPATIBLE, PROFILE_MODERN, PROFILE_RESTRICTED, PROFILE_CUSTOM.
	// +kubebuilder:validation:Optional
	TLSFeatureProfile *string `json:"tlsFeatureProfile,omitempty" tf:"tls_feature_profile,omitempty"`

	// A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/certificatemanager/v1beta1.TrustConfig
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractResourceID()
	// +kubebuilder:validation:Optional
	TrustConfig *string `json:"trustConfig,omitempty" tf:"trust_config,omitempty"`

	// Reference to a TrustConfig in certificatemanager to populate trustConfig.
	// +kubebuilder:validation:Optional
	TrustConfigRef *v1.Reference `json:"trustConfigRef,omitempty" tf:"-"`

	// Selector for a TrustConfig in certificatemanager to populate trustConfig.
	// +kubebuilder:validation:Optional
	TrustConfigSelector *v1.Selector `json:"trustConfigSelector,omitempty" tf:"-"`
}

type TLSInspectionPolicySpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     TLSInspectionPolicyParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider TLSInspectionPolicyInitParameters `json:"initProvider,omitempty"`
}

type TLSInspectionPolicyStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        TLSInspectionPolicyObservation `json:"atProvider,omitempty"`
}

type URLLists struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.values) || (has(self.initProvider) && has(self.initProvider.values))",message="spec.forProvider.values is a required parameter"
	Spec   URLListsSpec   `json:"spec"`
	Status URLListsStatus `json:"status,omitempty"`
}

type URLListsInitParameters struct {

	// Free-text description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// FQDNs and URLs.
	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
}

type URLListsList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []URLLists `json:"items"`
}

type URLListsObservation struct {

	// Output only. Time when the security policy was created.
	// A timestamp in RFC3339 UTC 'Zulu' format, with nanosecond resolution and up to nine fractional digits.
	// Examples: '2014-10-02T15:01:23Z' and '2014-10-02T15:01:23.045123456Z'
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// Free-text description of the resource.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// an identifier for the resource with format projects/{{project}}/locations/{{location}}/urlLists/{{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// The location of the url lists.
	Location *string `json:"location,omitempty" tf:"location,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// Output only. Time when the security policy was updated.
	// A timestamp in RFC3339 UTC 'Zulu' format, with nanosecond resolution and up to nine fractional digits.
	// Examples: '2014-10-02T15:01:23Z' and '2014-10-02T15:01:23.045123456Z'.
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`

	// FQDNs and URLs.
	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
}

type URLListsParameters struct {

	// Free-text description of the resource.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// The location of the url lists.
	// +kubebuilder:validation:Required
	Location *string `json:"location" tf:"location,omitempty"`

	// The ID of the project in which the resource belongs.
	// If it is not provided, the provider project is used.
	// +kubebuilder:validation:Optional
	Project *string `json:"project,omitempty" tf:"project,omitempty"`

	// FQDNs and URLs.
	// +kubebuilder:validation:Optional
	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
}

type URLListsSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     URLListsParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider URLListsInitParameters `json:"initProvider,omitempty"`
}

type URLListsStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        URLListsObservation `json:"atProvider,omitempty"`
}