package v1

import "cue.dev/x/k8s.io/apimachinery/pkg/apis/meta/v1"

// ExemptPriorityLevelConfiguration describes the configurable aspects of the
// handling of exempt requests. In the mandatory exempt configuration object
// the values in the fields here can be modified by authorized users, unlike
// the rest of the `spec`.
#ExemptPriorityLevelConfiguration: {
	// `lendablePercent` prescribes the fraction of the level's NominalCL that can
	// be borrowed by other priority levels. This value of this field must be
	// between 0 and 100, inclusive, and it defaults to 0. The number of seats that
	// other levels can borrow from this level, known as this level's
	// LendableConcurrencyLimit (LendableCL), is defined as follows.
	//
	// LendableCL(i) = round( NominalCL(i) * lendablePercent(i)/100.0 )
	"lendablePercent"?: int32 & int

	// `nominalConcurrencyShares` (NCS) contributes to the computation of the
	// NominalConcurrencyLimit (NominalCL) of this level. This is the number of
	// execution seats nominally reserved for this priority level. This DOES NOT
	// limit the dispatching from this priority level but affects the other
	// priority levels through the borrowing mechanism. The server's concurrency
	// limit (ServerCL) is divided among all the priority levels in proportion to
	// their NCS values:
	//
	// NominalCL(i) = ceil( ServerCL * NCS(i) / sum_ncs ) sum_ncs = sum[priority level k] NCS(k)
	//
	// Bigger numbers mean a larger nominal concurrency limit, at the expense of
	// every other priority level. This field has a default value of zero.
	"nominalConcurrencyShares"?: int32 & int
}

// FlowDistinguisherMethod specifies the method of a flow distinguisher.
#FlowDistinguisherMethod: {
	// `type` is the type of flow distinguisher method The supported types are
	// "ByUser" and "ByNamespace". Required.
	"type"!: string
}

// FlowSchema defines the schema of a group of flows. Note that a flow is made
// up of a set of inbound API requests with similar attributes and is
// identified by a pair of strings: the name of the FlowSchema and a "flow
// distinguisher".
#FlowSchema: {
	// APIVersion defines the versioned schema of this representation of an object.
	// Servers should convert recognized schemas to the latest internal value, and
	// may reject unrecognized values. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
	"apiVersion": "flowcontrol.apiserver.k8s.io/v1"

	// Kind is a string value representing the REST resource this object represents.
	// Servers may infer this from the endpoint the client submits requests to.
	// Cannot be updated. In CamelCase. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	"kind": "FlowSchema"

	// `metadata` is the standard object's metadata. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	"metadata"?: v1.#ObjectMeta

	// `spec` is the specification of the desired behavior of a FlowSchema. More
	// info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	"spec"?: #FlowSchemaSpec

	// `status` is the current status of a FlowSchema. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	"status"?: #FlowSchemaStatus
}

// FlowSchemaCondition describes conditions for a FlowSchema.
#FlowSchemaCondition: {
	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
	"lastTransitionTime"?: v1.#Time

	// `message` is a human-readable message indicating details about last transition.
	"message"?: string

	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
	"reason"?: string

	// `status` is the status of the condition. Can be True, False, Unknown. Required.
	"status"?: string

	// `type` is the type of the condition. Required.
	"type"?: string
}

// FlowSchemaList is a list of FlowSchema objects.
#FlowSchemaList: {
	// APIVersion defines the versioned schema of this representation of an object.
	// Servers should convert recognized schemas to the latest internal value, and
	// may reject unrecognized values. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
	"apiVersion": "flowcontrol.apiserver.k8s.io/v1"

	// `items` is a list of FlowSchemas.
	"items"!: [...#FlowSchema]

	// Kind is a string value representing the REST resource this object represents.
	// Servers may infer this from the endpoint the client submits requests to.
	// Cannot be updated. In CamelCase. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	"kind": "FlowSchemaList"

	// `metadata` is the standard list metadata. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	"metadata"?: v1.#ListMeta
}

// FlowSchemaSpec describes how the FlowSchema's specification looks like.
#FlowSchemaSpec: {
	// `distinguisherMethod` defines how to compute the flow distinguisher for
	// requests that match this schema. `nil` specifies that the distinguisher is
	// disabled and thus will always be the empty string.
	"distinguisherMethod"?: #FlowDistinguisherMethod

	// `matchingPrecedence` is used to choose among the FlowSchemas that match a
	// given request. The chosen FlowSchema is among those with the numerically
	// lowest (which we take to be logically highest) MatchingPrecedence. Each
	// MatchingPrecedence value must be ranged in [1,10000]. Note that if the
	// precedence is not specified, it will be set to 1000 as default.
	"matchingPrecedence"?: int32 & int

	// `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in
	// the cluster. If the reference cannot be resolved, the FlowSchema will be
	// ignored and marked as invalid in its status. Required.
	"priorityLevelConfiguration"!: #PriorityLevelConfigurationReference

	// `rules` describes which requests will match this flow schema. This FlowSchema
	// matches a request if and only if at least one member of rules matches the
	// request. if it is an empty slice, there will be no requests matching the
	// FlowSchema.
	"rules"?: [...#PolicyRulesWithSubjects]
}

// FlowSchemaStatus represents the current state of a FlowSchema.
#FlowSchemaStatus: {
	// `conditions` is a list of the current states of FlowSchema.
	"conditions"?: [...#FlowSchemaCondition]
}

// GroupSubject holds detailed information for group-kind subject.
#GroupSubject: {
	// name is the user group that matches, or "*" to match all user groups. See
	// https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go
	// for some well-known group names. Required.
	"name"!: string
}

// LimitResponse defines how to handle requests that can not be executed right now.
#LimitResponse: {
	// `queuing` holds the configuration parameters for queuing. This field may be
	// non-empty only if `type` is `"Queue"`.
	"queuing"?: #QueuingConfiguration

	// `type` is "Queue" or "Reject". "Queue" means that requests that can not be
	// executed upon arrival are held in a queue until they can be executed or a
	// queuing limit is reached. "Reject" means that requests that can not be
	// executed upon arrival are rejected. Required.
	"type"!: string
}

// LimitedPriorityLevelConfiguration specifies how to handle requests that are
// subject to limits. It addresses two issues:
// - How are requests for this priority level limited?
// - What should be done with requests that exceed the limit?
#LimitedPriorityLevelConfiguration: {
	// `borrowingLimitPercent`, if present, configures a limit on how many seats
	// this priority level can borrow from other priority levels. The limit is
	// known as this level's BorrowingConcurrencyLimit (BorrowingCL) and is a limit
	// on the total number of seats that this level may borrow at any one time.
	// This field holds the ratio of that limit to the level's nominal concurrency
	// limit. When this field is non-nil, it must hold a non-negative integer and
	// the limit is calculated as follows.
	//
	// BorrowingCL(i) = round( NominalCL(i) * borrowingLimitPercent(i)/100.0 )
	//
	// The value of this field can be more than 100, implying that this priority
	// level can borrow a number of seats that is greater than its own nominal
	// concurrency limit (NominalCL). When this field is left `nil`, the limit is
	// effectively infinite.
	"borrowingLimitPercent"?: int32 & int

	// `lendablePercent` prescribes the fraction of the level's NominalCL that can
	// be borrowed by other priority levels. The value of this field must be
	// between 0 and 100, inclusive, and it defaults to 0. The number of seats that
	// other levels can borrow from this level, known as this level's
	// LendableConcurrencyLimit (LendableCL), is defined as follows.
	//
	// LendableCL(i) = round( NominalCL(i) * lendablePercent(i)/100.0 )
	"lendablePercent"?: int32 & int

	// `limitResponse` indicates what to do with requests that can not be executed right now
	"limitResponse"?: #LimitResponse

	// `nominalConcurrencyShares` (NCS) contributes to the computation of the
	// NominalConcurrencyLimit (NominalCL) of this level. This is the number of
	// execution seats available at this priority level. This is used both for
	// requests dispatched from this priority level as well as requests dispatched
	// from other priority levels borrowing seats from this level. The server's
	// concurrency limit (ServerCL) is divided among the Limited priority levels in
	// proportion to their NCS values:
	//
	// NominalCL(i) = ceil( ServerCL * NCS(i) / sum_ncs ) sum_ncs = sum[priority level k] NCS(k)
	//
	// Bigger numbers mean a larger nominal concurrency limit, at the expense of
	// every other priority level.
	//
	// If not specified, this field defaults to a value of 30.
	//
	// Setting this field to zero supports the construction of a "jail" for this
	// priority level that is used to hold some request(s)
	"nominalConcurrencyShares"?: int32 & int
}

// NonResourcePolicyRule is a predicate that matches non-resource requests
// according to their verb and the target non-resource URL. A
// NonResourcePolicyRule matches a request if and only if both (a) at least one
// member of verbs matches the request and (b) at least one member of
// nonResourceURLs matches the request.
#NonResourcePolicyRule: {
	// `nonResourceURLs` is a set of url prefixes that a user should have access to
	// and may not be empty. For example:
	// - "/healthz" is legal
	// - "/hea*" is illegal
	// - "/hea" is legal but matches nothing
	// - "/hea/*" also matches nothing
	// - "/healthz/*" matches all per-component health checks.
	// "*" matches all non-resource urls. if it is present, it must be the only entry. Required.
	"nonResourceURLs"!: [...string]

	// `verbs` is a list of matching verbs and may not be empty. "*" matches all
	// verbs. If it is present, it must be the only entry. Required.
	"verbs"!: [...string]
}

// PolicyRulesWithSubjects prescribes a test that applies to a request to an
// apiserver. The test considers the subject making the request, the verb being
// requested, and the resource to be acted upon. This PolicyRulesWithSubjects
// matches a request if and only if both (a) at least one member of subjects
// matches the request and (b) at least one member of resourceRules or
// nonResourceRules matches the request.
#PolicyRulesWithSubjects: {
	// `nonResourceRules` is a list of NonResourcePolicyRules that identify matching
	// requests according to their verb and the target non-resource URL.
	"nonResourceRules"?: [...#NonResourcePolicyRule]

	// `resourceRules` is a slice of ResourcePolicyRules that identify matching
	// requests according to their verb and the target resource. At least one of
	// `resourceRules` and `nonResourceRules` has to be non-empty.
	"resourceRules"?: [...#ResourcePolicyRule]

	// subjects is the list of normal user, serviceaccount, or group that this rule
	// cares about. There must be at least one member in this slice. A slice that
	// includes both the system:authenticated and system:unauthenticated user
	// groups matches every request. Required.
	"subjects"!: [...#Subject]
}

// PriorityLevelConfiguration represents the configuration of a priority level.
#PriorityLevelConfiguration: {
	// APIVersion defines the versioned schema of this representation of an object.
	// Servers should convert recognized schemas to the latest internal value, and
	// may reject unrecognized values. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
	"apiVersion": "flowcontrol.apiserver.k8s.io/v1"

	// Kind is a string value representing the REST resource this object represents.
	// Servers may infer this from the endpoint the client submits requests to.
	// Cannot be updated. In CamelCase. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	"kind": "PriorityLevelConfiguration"

	// `metadata` is the standard object's metadata. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	"metadata"?: v1.#ObjectMeta

	// `spec` is the specification of the desired behavior of a "request-priority".
	// More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	"spec"?: #PriorityLevelConfigurationSpec

	// `status` is the current status of a "request-priority". More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
	"status"?: #PriorityLevelConfigurationStatus
}

// PriorityLevelConfigurationCondition defines the condition of priority level.
#PriorityLevelConfigurationCondition: {
	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
	"lastTransitionTime"?: v1.#Time

	// `message` is a human-readable message indicating details about last transition.
	"message"?: string

	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
	"reason"?: string

	// `status` is the status of the condition. Can be True, False, Unknown. Required.
	"status"?: string

	// `type` is the type of the condition. Required.
	"type"?: string
}

// PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects.
#PriorityLevelConfigurationList: {
	// APIVersion defines the versioned schema of this representation of an object.
	// Servers should convert recognized schemas to the latest internal value, and
	// may reject unrecognized values. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
	"apiVersion": "flowcontrol.apiserver.k8s.io/v1"

	// `items` is a list of request-priorities.
	"items"!: [...#PriorityLevelConfiguration]

	// Kind is a string value representing the REST resource this object represents.
	// Servers may infer this from the endpoint the client submits requests to.
	// Cannot be updated. In CamelCase. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
	"kind": "PriorityLevelConfigurationList"

	// `metadata` is the standard object's metadata. More info:
	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	"metadata"?: v1.#ListMeta
}

// PriorityLevelConfigurationReference contains information that points to the
// "request-priority" being used.
#PriorityLevelConfigurationReference: {
	// `name` is the name of the priority level configuration being referenced Required.
	"name"!: string
}

// PriorityLevelConfigurationSpec specifies the configuration of a priority level.
#PriorityLevelConfigurationSpec: {
	// `exempt` specifies how requests are handled for an exempt priority level.
	// This field MUST be empty if `type` is `"Limited"`. This field MAY be
	// non-empty if `type` is `"Exempt"`. If empty and `type` is `"Exempt"` then
	// the default values for `ExemptPriorityLevelConfiguration` apply.
	"exempt"?: #ExemptPriorityLevelConfiguration

	// `limited` specifies how requests are handled for a Limited priority level.
	// This field must be non-empty if and only if `type` is `"Limited"`.
	"limited"?: #LimitedPriorityLevelConfiguration

	// `type` indicates whether this priority level is subject to limitation on
	// request execution. A value of `"Exempt"` means that requests of this
	// priority level are not subject to a limit (and thus are never queued) and do
	// not detract from the capacity made available to other priority levels. A
	// value of `"Limited"` means that (a) requests of this priority level _are_
	// subject to limits and (b) some of the server's limited capacity is made
	// available exclusively to this priority level. Required.
	"type"!: string
}

// PriorityLevelConfigurationStatus represents the current state of a "request-priority".
#PriorityLevelConfigurationStatus: {
	// `conditions` is the current state of "request-priority".
	"conditions"?: [...#PriorityLevelConfigurationCondition]
}

// QueuingConfiguration holds the configuration parameters for queuing
#QueuingConfiguration: {
	// `handSize` is a small positive number that configures the shuffle sharding of
	// requests into queues. When enqueuing a request at this priority level the
	// request's flow identifier (a string pair) is hashed and the hash value is
	// used to shuffle the list of queues and deal a hand of the size specified
	// here. The request is put into one of the shortest queues in that hand.
	// `handSize` must be no larger than `queues`, and should be significantly
	// smaller (so that a few heavy flows do not saturate most of the queues). See
	// the user-facing documentation for more extensive guidance on setting this
	// field. This field has a default value of 8.
	"handSize"?: int32 & int

	// `queueLengthLimit` is the maximum number of requests allowed to be waiting in
	// a given queue of this priority level at a time; excess requests are
	// rejected. This value must be positive. If not specified, it will be
	// defaulted to 50.
	"queueLengthLimit"?: int32 & int

	// `queues` is the number of queues for this priority level. The queues exist
	// independently at each apiserver. The value must be positive. Setting it to 1
	// effectively precludes shufflesharding and thus makes the distinguisher
	// method of associated flow schemas irrelevant. This field has a default value
	// of 64.
	"queues"?: int32 & int
}

// ResourcePolicyRule is a predicate that matches some resource requests,
// testing the request's verb and the target resource. A ResourcePolicyRule
// matches a resource request if and only if: (a) at least one member of verbs
// matches the request, (b) at least one member of apiGroups matches the
// request, (c) at least one member of resources matches the request, and (d)
// either (d1) the request does not specify a namespace (i.e., `Namespace==""`)
// and clusterScope is true or (d2) the request specifies a namespace and least
// one member of namespaces matches the request's namespace.
#ResourcePolicyRule: {
	// `apiGroups` is a list of matching API groups and may not be empty. "*"
	// matches all API groups and, if present, must be the only entry. Required.
	"apiGroups"!: [...string]

	// `clusterScope` indicates whether to match requests that do not specify a
	// namespace (which happens either because the resource is not namespaced or
	// the request targets all namespaces). If this field is omitted or false then
	// the `namespaces` field must contain a non-empty list.
	"clusterScope"?: bool

	// `namespaces` is a list of target namespaces that restricts matches. A request
	// that specifies a target namespace matches only if either (a) this list
	// contains that target namespace or (b) this list contains "*". Note that "*"
	// matches any specified namespace but does not match a request that _does not
	// specify_ a namespace (see the `clusterScope` field for that). This list may
	// be empty, but only if `clusterScope` is true.
	"namespaces"?: [...string]

	// `resources` is a list of matching resources (i.e., lowercase and plural)
	// with, if desired, subresource. For example, [ "services", "nodes/status" ].
	// This list may not be empty. "*" matches all resources and, if present, must
	// be the only entry. Required.
	"resources"!: [...string]

	// `verbs` is a list of matching verbs and may not be empty. "*" matches all
	// verbs and, if present, must be the only entry. Required.
	"verbs"!: [...string]
}

// ServiceAccountSubject holds detailed information for service-account-kind subject.
#ServiceAccountSubject: {
	// `name` is the name of matching ServiceAccount objects, or "*" to match
	// regardless of name. Required.
	"name"!: string

	// `namespace` is the namespace of matching ServiceAccount objects. Required.
	"namespace"!: string
}

// Subject matches the originator of a request, as identified by the request
// authentication system. There are three ways of matching an originator; by
// user, group, or service account.
#Subject: {
	// `group` matches based on user group name.
	"group"?: #GroupSubject

	// `kind` indicates which one of the other fields is non-empty. Required
	"kind"!: string

	// `serviceAccount` matches ServiceAccounts.
	"serviceAccount"?: #ServiceAccountSubject

	// `user` matches based on username.
	"user"?: #UserSubject
}

// UserSubject holds detailed information for user-kind subject.
#UserSubject: {
	// `name` is the username that matches, or "*" to match all usernames. Required.
	"name"!: string
}