package v1beta1

import "cue.dev/x/k8s.io/apimachinery/pkg/apis/meta/v1"

// ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).
//
// ClusterTrustBundle objects are considered to be readable by any authenticated
// user in the cluster, because they can be mounted by pods using the
// `clusterTrustBundle` projection. All service accounts have read access to
// ClusterTrustBundles by default. Users who only have namespace-level access
// to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
// that they have access to.
//
// It can be optionally associated with a particular assigner, in which case it
// contains one valid set of trust anchors for that signer. Signers may have
// multiple associated ClusterTrustBundles; each is an independent set of trust
// anchors for that signer. Admission control is used to enforce that only
// users with permissions on the signer can create or modify the corresponding
// bundle.
#ClusterTrustBundle: {
	// APIVersion defines the versioned schema of this representation of an object.
	// Servers should convert recognized schemas to the latest internal value, and
	// may reject unrecognized values. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
	"apiVersion": "certificates.k8s.io/v1beta1"

	// Kind is a string value representing the REST resource this object represents.
	// Servers may infer this from the endpoint the client submits requests to.
	// Cannot be updated. In CamelCase. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	"kind": "ClusterTrustBundle"

	// metadata contains the object metadata.
	"metadata"?: v1.#ObjectMeta

	// spec contains the signer (if any) and trust anchors.
	"spec"!: #ClusterTrustBundleSpec
}

// ClusterTrustBundleList is a collection of ClusterTrustBundle objects
#ClusterTrustBundleList: {
	// APIVersion defines the versioned schema of this representation of an object.
	// Servers should convert recognized schemas to the latest internal value, and
	// may reject unrecognized values. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
	"apiVersion": "certificates.k8s.io/v1beta1"

	// items is a collection of ClusterTrustBundle objects
	"items"!: [...#ClusterTrustBundle]

	// Kind is a string value representing the REST resource this object represents.
	// Servers may infer this from the endpoint the client submits requests to.
	// Cannot be updated. In CamelCase. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	"kind": "ClusterTrustBundleList"

	// metadata contains the list metadata.
	"metadata"?: v1.#ListMeta
}

// ClusterTrustBundleSpec contains the signer and trust anchors.
#ClusterTrustBundleSpec: {
	// signerName indicates the associated signer, if any.
	//
	// In order to create or update a ClusterTrustBundle that sets signerName, you
	// must have the following cluster-scoped permission: group=certificates.k8s.io
	// resource=signers resourceName=<the signer name> verb=attest.
	//
	// If signerName is not empty, then the ClusterTrustBundle object must be named
	// with the signer name as a prefix (translating slashes to colons). For
	// example, for the signer name `example.com/foo`, valid ClusterTrustBundle
	// object names include `example.com:foo:abc` and `example.com:foo:v1`.
	//
	// If signerName is empty, then the ClusterTrustBundle object's name must not have such a prefix.
	//
	// List/watch requests for ClusterTrustBundles can filter on this field using a
	// `spec.signerName=NAME` field selector.
	"signerName"?: string

	// trustBundle contains the individual X.509 trust anchors for this bundle, as
	// PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.
	//
	// The data must consist only of PEM certificate blocks that parse as valid
	// X.509 certificates. Each certificate must include a basic constraints
	// extension with the CA bit set. The API server will reject objects that
	// contain duplicate certificates, or that use PEM block headers.
	//
	// Users of ClusterTrustBundles, including Kubelet, are free to reorder and
	// deduplicate certificate blocks in this file according to their own logic, as
	// well as to drop PEM block headers and inter-block data.
	"trustBundle"!: string
}

// PodCertificateRequest encodes a pod requesting a certificate from a given signer.
//
// Kubelets use this API to implement podCertificate projected volumes
#PodCertificateRequest: {
	// APIVersion defines the versioned schema of this representation of an object.
	// Servers should convert recognized schemas to the latest internal value, and
	// may reject unrecognized values. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
	"apiVersion": "certificates.k8s.io/v1beta1"

	// Kind is a string value representing the REST resource this object represents.
	// Servers may infer this from the endpoint the client submits requests to.
	// Cannot be updated. In CamelCase. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	"kind": "PodCertificateRequest"

	// metadata contains the object metadata.
	"metadata"?: v1.#ObjectMeta

	// spec contains the details about the certificate being requested.
	"spec"!: #PodCertificateRequestSpec

	// status contains the issued certificate, and a standard set of conditions.
	"status"?: #PodCertificateRequestStatus
}

// PodCertificateRequestList is a collection of PodCertificateRequest objects
#PodCertificateRequestList: {
	// APIVersion defines the versioned schema of this representation of an object.
	// Servers should convert recognized schemas to the latest internal value, and
	// may reject unrecognized values. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
	"apiVersion": "certificates.k8s.io/v1beta1"

	// items is a collection of PodCertificateRequest objects
	"items"!: [...#PodCertificateRequest]

	// Kind is a string value representing the REST resource this object represents.
	// Servers may infer this from the endpoint the client submits requests to.
	// Cannot be updated. In CamelCase. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	"kind": "PodCertificateRequestList"

	// metadata contains the list metadata.
	"metadata"?: v1.#ListMeta
}

// PodCertificateRequestSpec describes the certificate request. All fields are
// immutable after creation.
#PodCertificateRequestSpec: {
	// maxExpirationSeconds is the maximum lifetime permitted for the certificate.
	//
	// If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
	// will reject values shorter than 3600 (1 hour). The maximum allowable value
	// is 7862400 (91 days).
	//
	// The signer implementation is then free to issue a certificate with any
	// lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
	// seconds (1 hour). This constraint is enforced by kube-apiserver.
	// `kubernetes.io` signers will never issue certificates with a lifetime longer
	// than 24 hours.
	"maxExpirationSeconds"?: int32 & int

	// nodeName is the name of the node the pod is assigned to.
	"nodeName"!: string

	// nodeUID is the UID of the node the pod is assigned to.
	"nodeUID"!: string

	// The PKIX-serialized public key the signer will issue the certificate to.
	//
	// The key must be one of RSA3072, RSA4096, ECDSAP256, ECDSAP384, ECDSAP521, or
	// ED25519. Note that this list may be expanded in the future.
	//
	// Signer implementations do not need to support all key types supported by
	// kube-apiserver and kubelet. If a signer does not support the key type used
	// for a given PodCertificateRequest, it must deny the request by setting a
	// status.conditions entry with a type of "Denied" and a reason of
	// "UnsupportedKeyType". It may also suggest a key type that it does support in
	// the message field.
	//
	// Deprecated: This field is replaced by StubPKCS10Request. If StubPKCS10Request
	// is set, this field must be empty. Signer implementations should extract the
	// public key from the StubPKCS10Request field.
	"pkixPublicKey"?: string

	// podName is the name of the pod into which the certificate will be mounted.
	"podName"!: string

	// podUID is the UID of the pod into which the certificate will be mounted.
	"podUID"!: string

	// A proof that the requesting kubelet holds the private key corresponding to pkixPublicKey.
	//
	// It is contructed by signing the ASCII bytes of the pod's UID using `pkixPublicKey`.
	//
	// kube-apiserver validates the proof of possession during creation of the PodCertificateRequest.
	//
	// If the key is an RSA key, then the signature is over the ASCII bytes of the
	// pod UID, using RSASSA-PSS from RFC 8017 (as implemented by the golang
	// function crypto/rsa.SignPSS with nil options).
	//
	// If the key is an ECDSA key, then the signature is as described by [SEC 1,
	// Version 2.0](https://www.secg.org/sec1-v2.pdf) (as implemented by the golang
	// library function crypto/ecdsa.SignASN1)
	//
	// If the key is an ED25519 key, the the signature is as described by the
	// [ED25519 Specification](https://ed25519.cr.yp.to/) (as implemented by the
	// golang library crypto/ed25519.Sign).
	//
	// Deprecated: This field is replaced by StubPKCS10Request. If StubPKCS10Request
	// is set, this field must be empty.
	"proofOfPossession"?: string

	// serviceAccountName is the name of the service account the pod is running as.
	"serviceAccountName"!: string

	// serviceAccountUID is the UID of the service account the pod is running as.
	"serviceAccountUID"!: string

	// signerName indicates the requested signer.
	//
	// All signer names beginning with `kubernetes.io` are reserved for use by the
	// Kubernetes project. There is currently one well-known signer documented by
	// the Kubernetes project, `kubernetes.io/kube-apiserver-client-pod`, which
	// will issue client certificates understood by kube-apiserver. It is currently
	// unimplemented.
	"signerName"!: string

	// A PKCS#10 certificate signing request (DER-serialized) generated by Kubelet
	// using the subject private key.
	//
	// Most signer implementations will ignore the contents of the CSR except to
	// extract the subject public key. The API server automatically verifies the
	// CSR signature during admission, so the signer does not need to repeat the
	// verification. CSRs generated by kubelet are completely empty.
	//
	// The subject public key must be one of RSA3072, RSA4096, ECDSAP256, ECDSAP384,
	// ECDSAP521, or ED25519. Note that this list may be expanded in the future.
	//
	// Signer implementations do not need to support all key types supported by
	// kube-apiserver and kubelet. If a signer does not support the key type used
	// for a given PodCertificateRequest, it must deny the request by setting a
	// status.conditions entry with a type of "Denied" and a reason of
	// "UnsupportedKeyType". It may also suggest a key type that it does support in
	// the message field.
	"stubPKCS10Request"!: string

	// unverifiedUserAnnotations allow pod authors to pass additional information to
	// the signer implementation. Kubernetes does not restrict or validate this
	// metadata in any way.
	//
	// Entries are subject to the same validation as object metadata annotations,
	// with the addition that all keys must be domain-prefixed. No restrictions are
	// placed on values, except an overall size limitation on the entire field.
	//
	// Signers should document the keys and values they support. Signers should deny
	// requests that contain keys they do not recognize.
	"unverifiedUserAnnotations"?: [string]: string
}

// PodCertificateRequestStatus describes the status of the request, and holds
// the certificate data if the request is issued.
#PodCertificateRequestStatus: {
	// beginRefreshAt is the time at which the kubelet should begin trying to
	// refresh the certificate. This field is set via the /status subresource, and
	// must be set at the same time as certificateChain. Once populated, this field
	// is immutable.
	//
	// This field is only a hint. Kubelet may start refreshing before or after this time if necessary.
	"beginRefreshAt"?: v1.#Time

	// certificateChain is populated with an issued certificate by the signer. This
	// field is set via the /status subresource. Once populated, this field is
	// immutable.
	//
	// If the certificate signing request is denied, a condition of type "Denied" is
	// added and this field remains empty. If the signer cannot issue the
	// certificate, a condition of type "Failed" is added and this field remains
	// empty.
	//
	// Validation requirements:
	// 1. certificateChain must consist of one or more PEM-formatted certificates.
	// 2. Each entry must be a valid PEM-wrapped, DER-encoded ASN.1 Certificate as
	// described in section 4 of RFC5280.
	//
	// If more than one block is present, and the definition of the requested
	// spec.signerName does not indicate otherwise, the first block is the issued
	// certificate, and subsequent blocks should be treated as intermediate
	// certificates and presented in TLS handshakes. When projecting the chain into
	// a pod volume, kubelet will drop any data in-between the PEM blocks, as well
	// as any PEM block headers.
	"certificateChain"?: string

	// conditions applied to the request.
	//
	// The types "Issued", "Denied", and "Failed" have special handling. At most one
	// of these conditions may be present, and they must have status "True".
	//
	// If the request is denied with `Reason=UnsupportedKeyType`, the signer may
	// suggest a key type that will work in the message field.
	"conditions"?: [...v1.#Condition]

	// notAfter is the time at which the certificate expires. The value must be the
	// same as the notAfter value in the leaf certificate in certificateChain. This
	// field is set via the /status subresource. Once populated, it is immutable.
	// The signer must set this field at the same time it sets certificateChain.
	"notAfter"?: v1.#Time

	// notBefore is the time at which the certificate becomes valid. The value must
	// be the same as the notBefore value in the leaf certificate in
	// certificateChain. This field is set via the /status subresource. Once
	// populated, it is immutable. The signer must set this field at the same time
	// it sets certificateChain.
	"notBefore"?: v1.#Time
}