v1alpha1

type APIServerProxyMode string

type AppConnector struct {
	// Routes are optional preconfigured routes for the domains routed via the app connector.
	// If not set, routes for the domains will be discovered dynamically.
	// If set, the app connector will immediately be able to route traffic using the preconfigured routes, but may
	// also dynamically discover other routes.
	// https://tailscale.com/kb/1332/apps-best-practices#preconfiguration
	// +optional
	Routes Routes `json:"routes"`
}

type ConditionType string

type Connector struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// ConnectorSpec describes the desired Tailscale component.
	// More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	Spec ConnectorSpec `json:"spec"`

	// ConnectorStatus describes the status of the Connector. This is set
	// and managed by the Tailscale operator.
	// +optional
	Status ConnectorStatus `json:"status"`
}

type ConnectorList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []Connector `json:"items"`
}

type ConnectorSpec struct {
	// Tags that the Tailscale node will be tagged with.
	// Defaults to [tag:k8s].
	// To autoapprove the subnet routes or exit node defined by a Connector,
	// you can configure Tailscale ACLs to give these tags the necessary
	// permissions.
	// See https://tailscale.com/kb/1337/acl-syntax#autoapprovers.
	// If you specify custom tags here, you must also make the operator an owner of these tags.
	// See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
	// Tags cannot be changed once a Connector node has been created.
	// Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
	// +optional
	Tags Tags `json:"tags,omitempty"`
	// Hostname is the tailnet hostname that should be assigned to the
	// Connector node. If unset, hostname defaults to <connector
	// name>-connector. Hostname can contain lower case letters, numbers and
	// dashes, it must not start or end with a dash and must be between 2
	// and 63 characters long.
	// +optional
	Hostname Hostname `json:"hostname,omitempty"`
	// ProxyClass is the name of the ProxyClass custom resource that
	// contains configuration options that should be applied to the
	// resources created for this Connector. If unset, the operator will
	// create resources with the default configuration.
	// +optional
	ProxyClass string `json:"proxyClass,omitempty"`
	// SubnetRouter defines subnet routes that the Connector device should
	// expose to tailnet as a Tailscale subnet router.
	// https://tailscale.com/kb/1019/subnets/
	// If this field is unset, the device does not get configured as a Tailscale subnet router.
	// This field is mutually exclusive with the appConnector field.
	// +optional
	SubnetRouter *SubnetRouter `json:"subnetRouter,omitempty"`
	// AppConnector defines whether the Connector device should act as a Tailscale app connector. A Connector that is
	// configured as an app connector cannot be a subnet router or an exit node. If this field is unset, the
	// Connector does not act as an app connector.
	// Note that you will need to manually configure the permissions and the domains for the app connector via the
	// Admin panel.
	// Note also that the main tested and supported use case of this config option is to deploy an app connector on
	// Kubernetes to access SaaS applications available on the public internet. Using the app connector to expose
	// cluster workloads or other internal workloads to tailnet might work, but this is not a use case that we have
	// tested or optimised for.
	// If you are using the app connector to access SaaS applications because you need a predictable egress IP that
	// can be whitelisted, it is also your responsibility to ensure that cluster traffic from the connector flows
	// via that predictable IP, for example by enforcing that cluster egress traffic is routed via an egress NAT
	// device with a static IP address.
	// https://tailscale.com/kb/1281/app-connectors
	// +optional
	AppConnector *AppConnector `json:"appConnector,omitempty"`
	// ExitNode defines whether the Connector device should act as a Tailscale exit node. Defaults to false.
	// This field is mutually exclusive with the appConnector field.
	// https://tailscale.com/kb/1103/exit-nodes
	// +optional
	ExitNode bool `json:"exitNode"`
}

type ConnectorStatus struct {
	// List of status conditions to indicate the status of the Connector.
	// Known condition types are `ConnectorReady`.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions"`
	// SubnetRoutes are the routes currently exposed to tailnet via this
	// Connector instance.
	// +optional
	SubnetRoutes string `json:"subnetRoutes"`
	// IsExitNode is set to true if the Connector acts as an exit node.
	// +optional
	IsExitNode bool `json:"isExitNode"`
	// IsAppConnector is set to true if the Connector acts as an app connector.
	// +optional
	IsAppConnector bool `json:"isAppConnector"`
	// TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
	// assigned to the Connector node.
	// +optional
	TailnetIPs []string `json:"tailnetIPs,omitempty"`
	// Hostname is the fully qualified domain name of the Connector node.
	// If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
	// node.
	// +optional
	Hostname string `json:"hostname,omitempty"`
}

type Container struct {
	// List of environment variables to set in the container.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables
	// Note that environment variables provided here will take precedence
	// over Tailscale-specific environment variables set by the operator,
	// however running proxies with custom values for Tailscale environment
	// variables (i.e TS_USERSPACE) is not recommended and might break in
	// the future.
	// +optional
	Env []Env `json:"env,omitempty"`
	// Container image name. By default images are pulled from docker.io/tailscale,
	// but the official images are also available at ghcr.io/tailscale.
	//
	// For all uses except on ProxyGroups of type "kube-apiserver", this image must
	// be either tailscale/tailscale, or an equivalent mirror of that image.
	// To apply to ProxyGroups of type "kube-apiserver", this image must be
	// tailscale/k8s-proxy or a mirror of that image.
	//
	// For "tailscale/tailscale"-based proxies, specifying image name here will
	// override any proxy image values specified via the Kubernetes operator's
	// Helm chart values or PROXY_IMAGE env var in the operator Deployment.
	// For "tailscale/k8s-proxy"-based proxies, there is currently no way to
	// configure your own default, and this field is the only way to use a
	// custom image.
	//
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
	// +optional
	Image string `json:"image,omitempty"`
	// Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
	// +kubebuilder:validation:Enum=Always;Never;IfNotPresent
	// +optional
	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
	// Container resource requirements.
	// By default Tailscale Kubernetes operator does not apply any resource
	// requirements. The amount of resources required wil depend on the
	// amount of resources the operator needs to parse, usage patterns and
	// cluster size.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`
	// Container security context.
	// Security context specified here will override the security context set by the operator.
	// By default the operator sets the Tailscale container and the Tailscale init container to privileged
	// for proxies created for Tailscale ingress and egress Service, Connector and ProxyGroup.
	// You can reduce the permissions of the Tailscale container to cap NET_ADMIN by
	// installing device plugin in your cluster and configuring the proxies tun device to be created
	// by the device plugin, see  https://github.com/tailscale/tailscale/issues/10814#issuecomment-2479977752
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
	// +optional
	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`
	// Configuration for enabling extra debug information in the container.
	// Not recommended for production use.
	// +optional
	Debug *Debug `json:"debug,omitempty"`
}

type DNSConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec describes the desired DNS configuration.
	// More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	Spec DNSConfigSpec `json:"spec"`

	// Status describes the status of the DNSConfig. This is set
	// and managed by the Tailscale operator.
	// +optional
	Status DNSConfigStatus `json:"status"`
}

type DNSConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []DNSConfig `json:"items"`
}

type DNSConfigSpec struct {
	// Configuration for a nameserver that can resolve ts.net DNS names
	// associated with in-cluster proxies for Tailscale egress Services and
	// Tailscale Ingresses. The operator will always deploy this nameserver
	// when a DNSConfig is applied.
	Nameserver *Nameserver `json:"nameserver"`
}

type DNSConfigStatus struct {
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions"`
	// Nameserver describes the status of nameserver cluster resources.
	// +optional
	Nameserver *NameserverStatus `json:"nameserver"`
}

type Debug struct {
	// Enable tailscaled's HTTP pprof endpoints at <pod-ip>:9001/debug/pprof/
	// and internal debug metrics endpoint at <pod-ip>:9001/debug/metrics, where
	// 9001 is a container port named "debug". The endpoints and their responses
	// may change in backwards incompatible ways in the future, and should not
	// be considered stable.
	//
	// In 1.78.x and 1.80.x, this setting will default to the value of
	// .spec.metrics.enable, and requests to the "metrics" port matching the
	// mux pattern /debug/ will be forwarded to the "debug" port. In 1.82.x,
	// this setting will default to false, and no requests will be proxied.
	//
	// +optional
	Enable bool `json:"enable"`
}

type Env struct {
	// Name of the environment variable. Must be a C_IDENTIFIER.
	Name Name `json:"name"`
	// Variable references $(VAR_NAME) are expanded using the previously defined
	//  environment variables in the container and any service environment
	// variables. If a variable cannot be resolved, the reference in the input
	// string will be unchanged. Double $$ are reduced to a single $, which
	// allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
	// produce the string literal "$(VAR_NAME)". Escaped references will never
	// be expanded, regardless of whether the variable exists or not. Defaults
	// to "".
	// +optional
	Value string `json:"value,omitempty"`
}

type Hostname string

type HostnamePrefix string

type KubeAPIServerConfig struct {
	// Mode to run the API server proxy in. Supported modes are auth and noauth.
	// In auth mode, requests from the tailnet proxied over to the Kubernetes
	// API server are additionally impersonated using the sender's tailnet identity.
	// If not specified, defaults to auth mode.
	// +optional
	Mode *APIServerProxyMode `json:"mode,omitempty"`

	// Hostname is the hostname with which to expose the Kubernetes API server
	// proxies. Must be a valid DNS label no longer than 63 characters. If not
	// specified, the name of the ProxyGroup is used as the hostname. Must be
	// unique across the whole tailnet.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$`
	// +optional
	Hostname string `json:"hostname,omitempty"`
}

type LabelValue string

type Labels map[string]LabelValue

type Metrics struct {
	// Setting enable to true will make the proxy serve Tailscale metrics
	// at <pod-ip>:9002/metrics.
	// A metrics Service named <proxy-statefulset>-metrics will also be created in the operator's namespace and will
	// serve the metrics at <service-ip>:9002/metrics.
	//
	// In 1.78.x and 1.80.x, this field also serves as the default value for
	// .spec.statefulSet.pod.tailscaleContainer.debug.enable. From 1.82.0, both
	// fields will independently default to false.
	//
	// Defaults to false.
	Enable bool `json:"enable"`
	// Enable to create a Prometheus ServiceMonitor for scraping the proxy's Tailscale metrics.
	// The ServiceMonitor will select the metrics Service that gets created when metrics are enabled.
	// The ingested metrics for each Service monitor will have labels to identify the proxy:
	// ts_proxy_type: ingress_service|ingress_resource|connector|proxygroup
	// ts_proxy_parent_name: name of the parent resource (i.e name of the Connector, Tailscale Ingress, Tailscale Service or ProxyGroup)
	// ts_proxy_parent_namespace: namespace of the parent resource (if the parent resource is not cluster scoped)
	// job: ts_<proxy type>_[<parent namespace>]_<parent_name>
	// +optional
	ServiceMonitor *ServiceMonitor `json:"serviceMonitor"`
}

type Name string

type Nameserver struct {
	// Nameserver image. Defaults to tailscale/k8s-nameserver:unstable.
	// +optional
	Image *NameserverImage `json:"image,omitempty"`
	// Service configuration.
	// +optional
	Service *NameserverService `json:"service,omitempty"`
}

type NameserverImage struct {
	// Repo defaults to tailscale/k8s-nameserver.
	// +optional
	Repo string `json:"repo,omitempty"`
	// Tag defaults to unstable.
	// +optional
	Tag string `json:"tag,omitempty"`
}

type NameserverService struct {
	// ClusterIP sets the static IP of the service used by the nameserver.
	// +optional
	ClusterIP string `json:"clusterIP,omitempty"`
}

type NameserverStatus struct {
	// IP is the ClusterIP of the Service fronting the deployed ts.net nameserver.
	// Currently, you must manually update your cluster DNS config to add
	// this address as a stub nameserver for ts.net for cluster workloads to be
	// able to resolve MagicDNS names associated with egress or Ingress
	// proxies.
	// The IP address will change if you delete and recreate the DNSConfig.
	// +optional
	IP string `json:"ip"`
}

type NodePortConfig struct {
	// The port ranges from which the operator will select NodePorts for the Services.
	// You must ensure that firewall rules allow UDP ingress traffic for these ports
	// to the node's external IPs.
	// The ports must be in the range of service node ports for the cluster (default `30000-32767`).
	// See https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport.
	// +kubebuilder:validation:MinItems=1
	Ports []PortRange `json:"ports"`
	// A selector which will be used to select the node's that will have their `ExternalIP`'s advertised
	// by the ProxyGroup as Static Endpoints.
	Selector map[string]string `json:"selector,omitempty"`
}

type Pod struct {
	// Labels that will be added to the proxy Pod.
	// Any labels specified here will be merged with the default labels
	// applied to the Pod by the Tailscale Kubernetes operator.
	// Label keys and values must be valid Kubernetes label keys and values.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
	// +optional
	Labels Labels `json:"labels,omitempty"`
	// Annotations that will be added to the proxy Pod.
	// Any annotations specified here will be merged with the default
	// annotations applied to the Pod by the Tailscale Kubernetes operator.
	// Annotations must be valid Kubernetes annotations.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
	// Proxy Pod's affinity rules.
	// By default, the Tailscale Kubernetes operator does not apply any affinity rules.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#affinity
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`
	// Configuration for the proxy container running tailscale.
	// +optional
	TailscaleContainer *Container `json:"tailscaleContainer,omitempty"`
	// Configuration for the proxy init container that enables forwarding.
	// Not valid to apply to ProxyGroups of type "kube-apiserver".
	// +optional
	TailscaleInitContainer *Container `json:"tailscaleInitContainer,omitempty"`
	// Proxy Pod's security context.
	// By default Tailscale Kubernetes operator does not apply any Pod
	// security context.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-2
	// +optional
	SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
	// Proxy Pod's image pull Secrets.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec
	// +optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
	// Proxy Pod's node name.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
	// +optional
	NodeName string `json:"nodeName,omitempty"`
	// Proxy Pod's node selector.
	// By default Tailscale Kubernetes operator does not apply any node
	// selector.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
	// Proxy Pod's tolerations.
	// By default Tailscale Kubernetes operator does not apply any
	// tolerations.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
	// Proxy Pod's topology spread constraints.
	// By default Tailscale Kubernetes operator does not apply any topology spread constraints.
	// https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
	// +optional
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
}

type PortRange struct {
	// port represents a port selected to be used. This is a required field.
	Port uint16 `json:"port"`

	// endPort indicates that the range of ports from port to endPort if set, inclusive,
	// should be used. This field cannot be defined if the port field is not defined.
	// The endPort must be either unset, or equal or greater than port.
	// +optional
	EndPort uint16 `json:"endPort,omitempty"`
}

type PortRanges []PortRange

type ProxyClass struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Specification of the desired state of the ProxyClass resource.
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	Spec ProxyClassSpec `json:"spec"`

	// +optional
	// Status of the ProxyClass. This is set and managed automatically.
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	Status ProxyClassStatus `json:"status"`
}

type ProxyClassList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []ProxyClass `json:"items"`
}

type ProxyClassSpec struct {
	// Configuration parameters for the proxy's StatefulSet. Tailscale
	// Kubernetes operator deploys a StatefulSet for each of the user
	// configured proxies (Tailscale Ingress, Tailscale Service, Connector).
	// +optional
	StatefulSet *StatefulSet `json:"statefulSet"`
	// Configuration for proxy metrics. Metrics are currently not supported
	// for egress proxies and for Ingress proxies that have been configured
	// with tailscale.com/experimental-forward-cluster-traffic-via-ingress
	// annotation. Note that the metrics are currently considered unstable
	// and will likely change in breaking ways in the future - we only
	// recommend that you use those for debugging purposes.
	// +optional
	Metrics *Metrics `json:"metrics,omitempty"`
	// TailscaleConfig contains options to configure the tailscale-specific
	// parameters of proxies.
	// +optional
	TailscaleConfig *TailscaleConfig `json:"tailscale,omitempty"`
	// Set UseLetsEncryptStagingEnvironment to true to issue TLS
	// certificates for any HTTPS endpoints exposed to the tailnet from
	// LetsEncrypt's staging environment.
	// https://letsencrypt.org/docs/staging-environment/
	// This setting only affects Tailscale Ingress resources.
	// By default Ingress TLS certificates are issued from LetsEncrypt's
	// production environment.
	// Changing this setting true -> false, will result in any
	// existing certs being re-issued from the production environment.
	// Changing this setting false (default) -> true, when certs have already
	// been provisioned from production environment will NOT result in certs
	// being re-issued from the staging environment before they need to be
	// renewed.
	// +optional
	UseLetsEncryptStagingEnvironment bool `json:"useLetsEncryptStagingEnvironment,omitempty"`
	// Configuration for 'static endpoints' on proxies in order to facilitate
	// direct connections from other devices on the tailnet.
	// See https://tailscale.com/kb/1445/kubernetes-operator-customization#static-endpoints.
	// +optional
	StaticEndpoints *StaticEndpointsConfig `json:"staticEndpoints,omitempty"`
}

type ProxyClassStatus struct {
	// List of status conditions to indicate the status of the ProxyClass.
	// Known condition types are `ProxyClassReady`.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type ProxyGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec describes the desired ProxyGroup instances.
	Spec ProxyGroupSpec `json:"spec"`

	// ProxyGroupStatus describes the status of the ProxyGroup resources. This is
	// set and managed by the Tailscale operator.
	// +optional
	Status ProxyGroupStatus `json:"status"`
}

type ProxyGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []ProxyGroup `json:"items"`
}

type ProxyGroupSpec struct {
	// Type of the ProxyGroup proxies. Supported types are egress, ingress, and kube-apiserver.
	// Type is immutable once a ProxyGroup is created.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ProxyGroup type is immutable"
	Type ProxyGroupType `json:"type"`

	// Tags that the Tailscale devices will be tagged with. Defaults to [tag:k8s].
	// If you specify custom tags here, make sure you also make the operator
	// an owner of these tags.
	// See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
	// Tags cannot be changed once a ProxyGroup device has been created.
	// Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
	// +optional
	Tags Tags `json:"tags,omitempty"`

	// Replicas specifies how many replicas to create the StatefulSet with.
	// Defaults to 2.
	// +optional
	// +kubebuilder:validation:Minimum=0
	Replicas *int32 `json:"replicas,omitempty"`

	// HostnamePrefix is the hostname prefix to use for tailnet devices created
	// by the ProxyGroup. Each device will have the integer number from its
	// StatefulSet pod appended to this prefix to form the full hostname.
	// HostnamePrefix can contain lower case letters, numbers and dashes, it
	// must not start with a dash and must be between 1 and 62 characters long.
	// +optional
	HostnamePrefix HostnamePrefix `json:"hostnamePrefix,omitempty"`

	// ProxyClass is the name of the ProxyClass custom resource that contains
	// configuration options that should be applied to the resources created
	// for this ProxyGroup. If unset, and there is no default ProxyClass
	// configured, the operator will create resources with the default
	// configuration.
	// +optional
	ProxyClass string `json:"proxyClass,omitempty"`

	// KubeAPIServer contains configuration specific to the kube-apiserver
	// ProxyGroup type. This field is only used when Type is set to "kube-apiserver".
	// +optional
	KubeAPIServer *KubeAPIServerConfig `json:"kubeAPIServer,omitempty"`
}

type ProxyGroupStatus struct {
	// List of status conditions to indicate the status of the ProxyGroup
	// resources. Known condition types include `ProxyGroupReady` and
	// `ProxyGroupAvailable`.
	//
	// * `ProxyGroupReady` indicates all ProxyGroup resources are reconciled and
	//   all expected conditions are true.
	// * `ProxyGroupAvailable` indicates that at least one proxy is ready to
	//   serve traffic.
	//
	// For ProxyGroups of type kube-apiserver, there are two additional conditions:
	//
	// * `KubeAPIServerProxyConfigured` indicates that at least one API server
	//   proxy is configured and ready to serve traffic.
	// * `KubeAPIServerProxyValid` indicates that spec.kubeAPIServer config is
	//   valid.
	//
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// List of tailnet devices associated with the ProxyGroup StatefulSet.
	// +listType=map
	// +listMapKey=hostname
	// +optional
	Devices []TailnetDevice `json:"devices,omitempty"`

	// URL of the kube-apiserver proxy advertised by the ProxyGroup devices, if
	// any. Only applies to ProxyGroups of type kube-apiserver.
	// +optional
	URL string `json:"url,omitempty"`
}

type ProxyGroupType string

type Recorder struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec describes the desired recorder instance.
	Spec RecorderSpec `json:"spec"`

	// RecorderStatus describes the status of the recorder. This is set
	// and managed by the Tailscale operator.
	// +optional
	Status RecorderStatus `json:"status"`
}

type RecorderContainer struct {
	// List of environment variables to set in the container.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables
	// Note that environment variables provided here will take precedence
	// over Tailscale-specific environment variables set by the operator,
	// however running proxies with custom values for Tailscale environment
	// variables (i.e TS_USERSPACE) is not recommended and might break in
	// the future.
	// +optional
	Env []Env `json:"env,omitempty"`

	// Container image name including tag. Defaults to docker.io/tailscale/tsrecorder
	// with the same tag as the operator, but the official images are also
	// available at ghcr.io/tailscale/tsrecorder.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
	// +optional
	Image string `json:"image,omitempty"`

	// Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
	// +kubebuilder:validation:Enum=Always;Never;IfNotPresent
	// +optional
	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`

	// Container resource requirements.
	// By default, the operator does not apply any resource requirements. The
	// amount of resources required wil depend on the volume of recordings sent.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// Container security context. By default, the operator does not apply any
	// container security context.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
	// +optional
	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`
}

type RecorderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []Recorder `json:"items"`
}

type RecorderPod struct {
	// Labels that will be added to Recorder Pods. Any labels specified here
	// will be merged with the default labels applied to the Pod by the operator.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
	// +optional
	Labels map[string]string `json:"labels,omitempty"`

	// Annotations that will be added to Recorder Pods. Any annotations
	// specified here will be merged with the default annotations applied to
	// the Pod by the operator.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`

	// Affinity rules for Recorder Pods. By default, the operator does not
	// apply any affinity rules.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#affinity
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`

	// Configuration for the Recorder container running tailscale.
	// +optional
	Container RecorderContainer `json:"container,omitempty"`

	// Security context for Recorder Pods. By default, the operator does not
	// apply any Pod security context.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-2
	// +optional
	SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`

	// Image pull Secrets for Recorder Pods.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec
	// +optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`

	// Node selector rules for Recorder Pods. By default, the operator does
	// not apply any node selector rules.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Tolerations for Recorder Pods. By default, the operator does not apply
	// any tolerations.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// Config for the ServiceAccount to create for the Recorder's StatefulSet.
	// By default, the operator will create a ServiceAccount with the same
	// name as the Recorder resource.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#service-account
	// +optional
	ServiceAccount RecorderServiceAccount `json:"serviceAccount,omitempty"`
}

type RecorderServiceAccount struct {
	// Name of the ServiceAccount to create. Defaults to the name of the
	// Recorder resource.
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#service-account
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([a-z0-9-.]{0,61}[a-z0-9])?$`
	// +kubebuilder:validation:MaxLength=253
	// +optional
	Name string `json:"name,omitempty"`

	// Annotations to add to the ServiceAccount.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
	//
	// You can use this to add IAM roles to the ServiceAccount (IRSA) instead of
	// providing static S3 credentials in a Secret.
	// https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
	//
	// For example:
	// eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<role-name>
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
}

type RecorderSpec struct {
	// Configuration parameters for the Recorder's StatefulSet. The operator
	// deploys a StatefulSet for each Recorder resource.
	// +optional
	StatefulSet RecorderStatefulSet `json:"statefulSet"`

	// Tags that the Tailscale device will be tagged with. Defaults to [tag:k8s].
	// If you specify custom tags here, make sure you also make the operator
	// an owner of these tags.
	// See  https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
	// Tags cannot be changed once a Recorder node has been created.
	// Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
	// +optional
	Tags Tags `json:"tags,omitempty"`

	// Set to true to enable the Recorder UI. The UI lists and plays recorded sessions.
	// The UI will be served at <MagicDNS name of the recorder>:443. Defaults to false.
	// Corresponds to --ui tsrecorder flag https://tailscale.com/kb/1246/tailscale-ssh-session-recording#deploy-a-recorder-node.
	// Required if S3 storage is not set up, to ensure that recordings are accessible.
	// +optional
	EnableUI bool `json:"enableUI,omitempty"`

	// Configure where to store session recordings. By default, recordings will
	// be stored in a local ephemeral volume, and will not be persisted past the
	// lifetime of a specific pod.
	// +optional
	Storage Storage `json:"storage,omitempty"`
}

type RecorderStatefulSet struct {
	// Labels that will be added to the StatefulSet created for the Recorder.
	// Any labels specified here will be merged with the default labels applied
	// to the StatefulSet by the operator.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
	// +optional
	Labels map[string]string `json:"labels,omitempty"`

	// Annotations that will be added to the StatefulSet created for the Recorder.
	// Any Annotations specified here will be merged with the default annotations
	// applied to the StatefulSet by the operator.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`

	// Configuration for pods created by the Recorder's StatefulSet.
	// +optional
	Pod RecorderPod `json:"pod,omitempty"`
}

type RecorderStatus struct {
	// List of status conditions to indicate the status of the Recorder.
	// Known condition types are `RecorderReady`.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// List of tailnet devices associated with the Recorder StatefulSet.
	// +listType=map
	// +listMapKey=hostname
	// +optional
	Devices []RecorderTailnetDevice `json:"devices,omitempty"`
}

type RecorderTailnetDevice struct {
	// Hostname is the fully qualified domain name of the device.
	// If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
	// node.
	Hostname string `json:"hostname"`

	// TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
	// assigned to the device.
	// +optional
	TailnetIPs []string `json:"tailnetIPs,omitempty"`

	// URL where the UI is available if enabled for replaying recordings. This
	// will be an HTTPS MagicDNS URL. You must be connected to the same tailnet
	// as the recorder to access it.
	// +optional
	URL string `json:"url,omitempty"`
}

type Route string

type Routes []Route

type S3 struct {
	// S3-compatible endpoint, e.g. s3.us-east-1.amazonaws.com.
	Endpoint string `json:"endpoint,omitempty"`

	// Bucket name to write to. The bucket is expected to be used solely for
	// recordings, as there is no stable prefix for written object names.
	Bucket string `json:"bucket,omitempty"`

	// Configure environment variable credentials for managing objects in the
	// configured bucket. If not set, tsrecorder will try to acquire credentials
	// first from the file system and then the STS API.
	// +optional
	Credentials S3Credentials `json:"credentials,omitempty"`
}

type S3Credentials struct {
	// Use a Kubernetes Secret from the operator's namespace as the source of
	// credentials.
	// +optional
	Secret S3Secret `json:"secret,omitempty"`
}

type S3Secret struct {
	// The name of a Kubernetes Secret in the operator's namespace that contains
	// credentials for writing to the configured bucket. Each key-value pair
	// from the secret's data will be mounted as an environment variable. It
	// should include keys for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY if
	// using a static access key.
	//+optional
	Name string `json:"name,omitempty"`
}

type ServiceMonitor struct {
	// If Enable is set to true, a Prometheus ServiceMonitor will be created. Enable can only be set to true if metrics are enabled.
	Enable bool `json:"enable"`
	// Labels to add to the ServiceMonitor.
	// Labels must be valid Kubernetes labels.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
	// +optional
	Labels Labels `json:"labels"`
}

type StatefulSet struct {
	// Labels that will be added to the StatefulSet created for the proxy.
	// Any labels specified here will be merged with the default labels
	// applied to the StatefulSet by the Tailscale Kubernetes operator as
	// well as any other labels that might have been applied by other
	// actors.
	// Label keys and values must be valid Kubernetes label keys and values.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
	// +optional
	Labels Labels `json:"labels,omitempty"`
	// Annotations that will be added to the StatefulSet created for the proxy.
	// Any Annotations specified here will be merged with the default annotations
	// applied to the StatefulSet by the Tailscale Kubernetes operator as
	// well as any other annotations that might have been applied by other
	// actors.
	// Annotations must be valid Kubernetes annotations.
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
	// Configuration for the proxy Pod.
	// +optional
	Pod *Pod `json:"pod,omitempty"`
}

type StaticEndpointsConfig struct {
	// The configuration for static endpoints using NodePort Services.
	NodePort *NodePortConfig `json:"nodePort"`
}

type Storage struct {
	// Configure an S3-compatible API for storage. Required if the UI is not
	// enabled, to ensure that recordings are accessible.
	// +optional
	S3 *S3 `json:"s3,omitempty"`
}

type SubnetRouter struct {
	// AdvertiseRoutes refer to CIDRs that the subnet router should make
	// available. Route values must be strings that represent a valid IPv4
	// or IPv6 CIDR range. Values can be Tailscale 4via6 subnet routes.
	// https://tailscale.com/kb/1201/4via6-subnets/
	AdvertiseRoutes Routes `json:"advertiseRoutes"`
}

type Tag string

type Tags []Tag

type TailnetDevice struct {
	// Hostname is the fully qualified domain name of the device.
	// If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
	// node.
	Hostname string `json:"hostname"`

	// TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
	// assigned to the device.
	// +optional
	TailnetIPs []string `json:"tailnetIPs,omitempty"`

	// StaticEndpoints are user configured, 'static' endpoints by which tailnet peers can reach this device.
	// +optional
	StaticEndpoints []string `json:"staticEndpoints,omitempty"`
}

type TailscaleConfig struct {
	// AcceptRoutes can be set to true to make the proxy instance accept
	// routes advertized by other nodes on the tailnet, such as subnet
	// routes.
	// This is equivalent of passing --accept-routes flag to a tailscale Linux client.
	// https://tailscale.com/kb/1019/subnets#use-your-subnet-routes-from-other-devices
	// Defaults to false.
	AcceptRoutes bool `json:"acceptRoutes,omitempty"`
}