//! Auto-generated models for source-controller
//! Generated from: source-controller.crds.yaml
//! DO NOT EDIT - This file is auto-generated by kopium
#![allow(clippy::all)]

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --filename /tmp/tmp.ArNBx7apbm/doc1.yaml --derive Default --derive PartialEq --docs --smart-derive-elision
// kopium version: 0.23.0

#[allow(unused_imports)]
mod prelude {
    pub use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
    pub use kube::CustomResource;
    pub use serde::{Deserialize, Serialize};
    pub use std::collections::BTreeMap;
}

use self::prelude::*;

/// BucketSpec specifies the required configuration to produce an Artifact for
/// an object storage bucket.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[kube(
    group = "source.toolkit.fluxcd.io",
    version = "v1",
    kind = "Bucket",
    plural = "buckets"
)]
#[kube(namespaced)]
#[kube(status = "BucketStatus")]
#[kube(schema = "disabled")]
#[kube(derive = "Default")]
#[kube(derive = "PartialEq")]
pub struct BucketSpec {
    /// BucketName is the name of the object storage bucket.
    #[serde(rename = "bucketName")]
    pub bucket_name: String,
    /// CertSecretRef can be given the name of a Secret containing
    /// either or both of
    ///
    /// - a PEM-encoded client certificate (`tls.crt`) and private
    /// key (`tls.key`);
    /// - a PEM-encoded CA certificate (`ca.crt`)
    ///
    /// and whichever are supplied, will be used for connecting to the
    /// bucket. The client cert and key are useful if you are
    /// authenticating with a certificate; the CA cert is useful if
    /// you are using a self-signed server certificate. The Secret must
    /// be of type `Opaque` or `kubernetes.io/tls`.
    ///
    /// This field is only supported for the `generic` provider.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "certSecretRef"
    )]
    pub cert_secret_ref: Option<BucketCertSecretRef>,
    /// Endpoint is the object storage address the BucketName is located at.
    pub endpoint: String,
    /// Ignore overrides the set of excluded patterns in the .sourceignore format
    /// (which is the same as .gitignore). If not provided, a default will be used,
    /// consult the documentation for your version to find out what those are.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ignore: Option<String>,
    /// Insecure allows connecting to a non-TLS HTTP Endpoint.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub insecure: Option<bool>,
    /// Interval at which the Bucket Endpoint is checked for updates.
    /// This interval is approximate and may be subject to jitter to ensure
    /// efficient use of resources.
    pub interval: String,
    /// Prefix to use for server-side filtering of files in the Bucket.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub prefix: Option<String>,
    /// Provider of the object storage bucket.
    /// Defaults to 'generic', which expects an S3 (API) compatible object
    /// storage.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub provider: Option<BucketProvider>,
    /// ProxySecretRef specifies the Secret containing the proxy configuration
    /// to use while communicating with the Bucket server.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "proxySecretRef"
    )]
    pub proxy_secret_ref: Option<BucketProxySecretRef>,
    /// Region of the Endpoint where the BucketName is located in.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    /// SecretRef specifies the Secret containing authentication credentials
    /// for the Bucket.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<BucketSecretRef>,
    /// ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
    /// the bucket. This field is only supported for the 'gcp' and 'aws' providers.
    /// For more information about workload identity:
    /// <https://fluxcd.io/flux/components/source/buckets/#workload-identity>
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serviceAccountName"
    )]
    pub service_account_name: Option<String>,
    /// STS specifies the required configuration to use a Security Token
    /// Service for fetching temporary credentials to authenticate in a
    /// Bucket provider.
    ///
    /// This field is only supported for the `aws` and `generic` providers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub sts: Option<BucketSts>,
    /// Suspend tells the controller to suspend the reconciliation of this
    /// Bucket.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub suspend: Option<bool>,
    /// Timeout for fetch operations, defaults to 60s.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub timeout: Option<String>,
}

/// CertSecretRef can be given the name of a Secret containing
/// either or both of
///
/// - a PEM-encoded client certificate (`tls.crt`) and private
/// key (`tls.key`);
/// - a PEM-encoded CA certificate (`ca.crt`)
///
/// and whichever are supplied, will be used for connecting to the
/// bucket. The client cert and key are useful if you are
/// authenticating with a certificate; the CA cert is useful if
/// you are using a self-signed server certificate. The Secret must
/// be of type `Opaque` or `kubernetes.io/tls`.
///
/// This field is only supported for the `generic` provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct BucketCertSecretRef {
    /// Name of the referent.
    pub name: String,
}

/// BucketSpec specifies the required configuration to produce an Artifact for
/// an object storage bucket.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum BucketProvider {
    #[serde(rename = "generic")]
    Generic,
    #[serde(rename = "aws")]
    Aws,
    #[serde(rename = "gcp")]
    Gcp,
    #[serde(rename = "azure")]
    Azure,
}

/// ProxySecretRef specifies the Secret containing the proxy configuration
/// to use while communicating with the Bucket server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct BucketProxySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// SecretRef specifies the Secret containing authentication credentials
/// for the Bucket.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct BucketSecretRef {
    /// Name of the referent.
    pub name: String,
}

/// STS specifies the required configuration to use a Security Token
/// Service for fetching temporary credentials to authenticate in a
/// Bucket provider.
///
/// This field is only supported for the `aws` and `generic` providers.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct BucketSts {
    /// CertSecretRef can be given the name of a Secret containing
    /// either or both of
    ///
    /// - a PEM-encoded client certificate (`tls.crt`) and private
    /// key (`tls.key`);
    /// - a PEM-encoded CA certificate (`ca.crt`)
    ///
    /// and whichever are supplied, will be used for connecting to the
    /// STS endpoint. The client cert and key are useful if you are
    /// authenticating with a certificate; the CA cert is useful if
    /// you are using a self-signed server certificate. The Secret must
    /// be of type `Opaque` or `kubernetes.io/tls`.
    ///
    /// This field is only supported for the `ldap` provider.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "certSecretRef"
    )]
    pub cert_secret_ref: Option<BucketStsCertSecretRef>,
    /// Endpoint is the HTTP/S endpoint of the Security Token Service from
    /// where temporary credentials will be fetched.
    pub endpoint: String,
    /// Provider of the Security Token Service.
    pub provider: BucketStsProvider,
    /// SecretRef specifies the Secret containing authentication credentials
    /// for the STS endpoint. This Secret must contain the fields `username`
    /// and `password` and is supported only for the `ldap` provider.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<BucketStsSecretRef>,
}

/// CertSecretRef can be given the name of a Secret containing
/// either or both of
///
/// - a PEM-encoded client certificate (`tls.crt`) and private
/// key (`tls.key`);
/// - a PEM-encoded CA certificate (`ca.crt`)
///
/// and whichever are supplied, will be used for connecting to the
/// STS endpoint. The client cert and key are useful if you are
/// authenticating with a certificate; the CA cert is useful if
/// you are using a self-signed server certificate. The Secret must
/// be of type `Opaque` or `kubernetes.io/tls`.
///
/// This field is only supported for the `ldap` provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct BucketStsCertSecretRef {
    /// Name of the referent.
    pub name: String,
}

/// STS specifies the required configuration to use a Security Token
/// Service for fetching temporary credentials to authenticate in a
/// Bucket provider.
///
/// This field is only supported for the `aws` and `generic` providers.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum BucketStsProvider {
    #[serde(rename = "aws")]
    Aws,
    #[serde(rename = "ldap")]
    Ldap,
}

/// SecretRef specifies the Secret containing authentication credentials
/// for the STS endpoint. This Secret must contain the fields `username`
/// and `password` and is supported only for the `ldap` provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct BucketStsSecretRef {
    /// Name of the referent.
    pub name: String,
}

/// BucketStatus records the observed state of a Bucket.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct BucketStatus {
    /// Artifact represents the last successful Bucket reconciliation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub artifact: Option<BucketStatusArtifact>,
    /// Conditions holds the conditions for the Bucket.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
    /// LastHandledReconcileAt holds the value of the most recent
    /// reconcile request value, so a change of the annotation value
    /// can be detected.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "lastHandledReconcileAt"
    )]
    pub last_handled_reconcile_at: Option<String>,
    /// ObservedGeneration is the last observed generation of the Bucket object.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedGeneration"
    )]
    pub observed_generation: Option<i64>,
    /// ObservedIgnore is the observed exclusion patterns used for constructing
    /// the source artifact.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedIgnore"
    )]
    pub observed_ignore: Option<String>,
    /// URL is the dynamic fetch link for the latest Artifact.
    /// It is provided on a "best effort" basis, and using the precise
    /// BucketStatus.Artifact data is recommended.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// Artifact represents the last successful Bucket reconciliation.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct BucketStatusArtifact {
    /// Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
    pub digest: String,
    /// LastUpdateTime is the timestamp corresponding to the last update of the
    /// Artifact.
    #[serde(rename = "lastUpdateTime")]
    pub last_update_time: String,
    /// Metadata holds upstream information such as OCI annotations.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metadata: Option<BTreeMap<String, String>>,
    /// Path is the relative file path of the Artifact. It can be used to locate
    /// the file in the root of the Artifact storage on the local file system of
    /// the controller managing the Source.
    pub path: String,
    /// Revision is a human-readable identifier traceable in the origin source
    /// system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
    pub revision: String,
    /// Size is the number of bytes in the file.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub size: Option<i64>,
    /// URL is the HTTP address of the Artifact as exposed by the controller
    /// managing the Source. It can be used to retrieve the Artifact for
    /// consumption, e.g. by another controller applying the Artifact contents.
    pub url: String,
}

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --filename /tmp/tmp.ArNBx7apbm/doc2.yaml --derive Default --derive PartialEq --docs --smart-derive-elision
// kopium version: 0.23.0

#[allow(unused_imports)]
use self::prelude::*;

/// ExternalArtifactSpec defines the desired state of ExternalArtifact
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[kube(
    group = "source.toolkit.fluxcd.io",
    version = "v1",
    kind = "ExternalArtifact",
    plural = "externalartifacts"
)]
#[kube(namespaced)]
#[kube(status = "ExternalArtifactStatus")]
#[kube(schema = "disabled")]
#[kube(derive = "Default")]
#[kube(derive = "PartialEq")]
pub struct ExternalArtifactSpec {
    /// SourceRef points to the Kubernetes custom resource for
    /// which the artifact is generated.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "sourceRef")]
    pub source_ref: Option<ExternalArtifactSourceRef>,
}

/// SourceRef points to the Kubernetes custom resource for
/// which the artifact is generated.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ExternalArtifactSourceRef {
    /// API version of the referent, if not specified the Kubernetes preferred version will be used.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "apiVersion"
    )]
    pub api_version: Option<String>,
    /// Kind of the referent.
    pub kind: String,
    /// Name of the referent.
    pub name: String,
    /// Namespace of the referent, when not specified it acts as LocalObjectReference.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// ExternalArtifactStatus defines the observed state of ExternalArtifact
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ExternalArtifactStatus {
    /// Artifact represents the output of an ExternalArtifact reconciliation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub artifact: Option<ExternalArtifactStatusArtifact>,
    /// Conditions holds the conditions for the ExternalArtifact.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
}

/// Artifact represents the output of an ExternalArtifact reconciliation.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ExternalArtifactStatusArtifact {
    /// Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
    pub digest: String,
    /// LastUpdateTime is the timestamp corresponding to the last update of the
    /// Artifact.
    #[serde(rename = "lastUpdateTime")]
    pub last_update_time: String,
    /// Metadata holds upstream information such as OCI annotations.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metadata: Option<BTreeMap<String, String>>,
    /// Path is the relative file path of the Artifact. It can be used to locate
    /// the file in the root of the Artifact storage on the local file system of
    /// the controller managing the Source.
    pub path: String,
    /// Revision is a human-readable identifier traceable in the origin source
    /// system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
    pub revision: String,
    /// Size is the number of bytes in the file.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub size: Option<i64>,
    /// URL is the HTTP address of the Artifact as exposed by the controller
    /// managing the Source. It can be used to retrieve the Artifact for
    /// consumption, e.g. by another controller applying the Artifact contents.
    pub url: String,
}

// ---

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --filename /tmp/tmp.ArNBx7apbm/doc3.yaml --derive Default --derive PartialEq --docs --smart-derive-elision
// kopium version: 0.23.0

#[allow(unused_imports)]
use self::prelude::*;

/// GitRepositorySpec specifies the required configuration to produce an
/// Artifact for a Git repository.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[kube(
    group = "source.toolkit.fluxcd.io",
    version = "v1",
    kind = "GitRepository",
    plural = "gitrepositories"
)]
#[kube(namespaced)]
#[kube(status = "GitRepositoryStatus")]
#[kube(schema = "disabled")]
#[kube(derive = "Default")]
#[kube(derive = "PartialEq")]
pub struct GitRepositorySpec {
    /// Ignore overrides the set of excluded patterns in the .sourceignore format
    /// (which is the same as .gitignore). If not provided, a default will be used,
    /// consult the documentation for your version to find out what those are.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ignore: Option<String>,
    /// Include specifies a list of GitRepository resources which Artifacts
    /// should be included in the Artifact produced for this GitRepository.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub include: Option<Vec<GitRepositoryInclude>>,
    /// Interval at which the GitRepository URL is checked for updates.
    /// This interval is approximate and may be subject to jitter to ensure
    /// efficient use of resources.
    pub interval: String,
    /// Provider used for authentication, can be 'azure', 'github', 'generic'.
    /// When not specified, defaults to 'generic'.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub provider: Option<GitRepositoryProvider>,
    /// ProxySecretRef specifies the Secret containing the proxy configuration
    /// to use while communicating with the Git server.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "proxySecretRef"
    )]
    pub proxy_secret_ref: Option<GitRepositoryProxySecretRef>,
    /// RecurseSubmodules enables the initialization of all submodules within
    /// the GitRepository as cloned from the URL, using their default settings.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "recurseSubmodules"
    )]
    pub recurse_submodules: Option<bool>,
    /// Reference specifies the Git reference to resolve and monitor for
    /// changes, defaults to the 'master' branch.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ref")]
    pub r#ref: Option<GitRepositoryRef>,
    /// SecretRef specifies the Secret containing authentication credentials for
    /// the GitRepository.
    /// For HTTPS repositories the Secret must contain 'username' and 'password'
    /// fields for basic auth or 'bearerToken' field for token auth.
    /// For SSH repositories the Secret must contain 'identity'
    /// and 'known_hosts' fields.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<GitRepositorySecretRef>,
    /// ServiceAccountName is the name of the Kubernetes ServiceAccount used to
    /// authenticate to the GitRepository. This field is only supported for 'azure' provider.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serviceAccountName"
    )]
    pub service_account_name: Option<String>,
    /// SparseCheckout specifies a list of directories to checkout when cloning
    /// the repository. If specified, only these directories are included in the
    /// Artifact produced for this GitRepository.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "sparseCheckout"
    )]
    pub sparse_checkout: Option<Vec<String>>,
    /// Suspend tells the controller to suspend the reconciliation of this
    /// GitRepository.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub suspend: Option<bool>,
    /// Timeout for Git operations like cloning, defaults to 60s.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub timeout: Option<String>,
    /// URL specifies the Git repository URL, it can be an HTTP/S or SSH address.
    pub url: String,
    /// Verification specifies the configuration to verify the Git commit
    /// signature(s).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub verify: Option<GitRepositoryVerify>,
}

/// GitRepositoryInclude specifies a local reference to a GitRepository which
/// Artifact (sub-)contents must be included, and where they should be placed.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryInclude {
    /// FromPath specifies the path to copy contents from, defaults to the root
    /// of the Artifact.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromPath")]
    pub from_path: Option<String>,
    /// GitRepositoryRef specifies the GitRepository which Artifact contents
    /// must be included.
    pub repository: GitRepositoryIncludeRepository,
    /// ToPath specifies the path to copy contents to, defaults to the name of
    /// the GitRepositoryRef.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPath")]
    pub to_path: Option<String>,
}

/// GitRepositoryRef specifies the GitRepository which Artifact contents
/// must be included.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryIncludeRepository {
    /// Name of the referent.
    pub name: String,
}

/// GitRepositorySpec specifies the required configuration to produce an
/// Artifact for a Git repository.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum GitRepositoryProvider {
    #[serde(rename = "generic")]
    Generic,
    #[serde(rename = "azure")]
    Azure,
    #[serde(rename = "github")]
    Github,
}

/// ProxySecretRef specifies the Secret containing the proxy configuration
/// to use while communicating with the Git server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryProxySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// Reference specifies the Git reference to resolve and monitor for
/// changes, defaults to the 'master' branch.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryRef {
    /// Branch to check out, defaults to 'master' if no other field is defined.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub branch: Option<String>,
    /// Commit SHA to check out, takes precedence over all reference fields.
    ///
    /// This can be combined with Branch to shallow clone the branch, in which
    /// the commit is expected to exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub commit: Option<String>,
    /// Name of the reference to check out; takes precedence over Branch, Tag and SemVer.
    ///
    /// It must be a valid Git reference: <https://git-scm.com/docs/git-check-ref-format#_description>
    /// Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head"
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// SemVer tag expression to check out, takes precedence over Tag.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub semver: Option<String>,
    /// Tag to check out, takes precedence over Branch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tag: Option<String>,
}

/// SecretRef specifies the Secret containing authentication credentials for
/// the GitRepository.
/// For HTTPS repositories the Secret must contain 'username' and 'password'
/// fields for basic auth or 'bearerToken' field for token auth.
/// For SSH repositories the Secret must contain 'identity'
/// and 'known_hosts' fields.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositorySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// Verification specifies the configuration to verify the Git commit
/// signature(s).
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryVerify {
    /// Mode specifies which Git object(s) should be verified.
    ///
    /// The variants "head" and "HEAD" both imply the same thing, i.e. verify
    /// the commit that the HEAD of the Git repository points to. The variant
    /// "head" solely exists to ensure backwards compatibility.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub mode: Option<GitRepositoryVerifyMode>,
    /// SecretRef specifies the Secret containing the public keys of trusted Git
    /// authors.
    #[serde(rename = "secretRef")]
    pub secret_ref: GitRepositoryVerifySecretRef,
}

/// Verification specifies the configuration to verify the Git commit
/// signature(s).
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum GitRepositoryVerifyMode {
    #[serde(rename = "head")]
    Head,
    #[serde(rename = "HEAD")]
    HeadX,
    Tag,
    #[serde(rename = "TagAndHEAD")]
    TagAndHead,
}

/// SecretRef specifies the Secret containing the public keys of trusted Git
/// authors.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryVerifySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// GitRepositoryStatus records the observed state of a Git repository.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryStatus {
    /// Artifact represents the last successful GitRepository reconciliation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub artifact: Option<GitRepositoryStatusArtifact>,
    /// Conditions holds the conditions for the GitRepository.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
    /// IncludedArtifacts contains a list of the last successfully included
    /// Artifacts as instructed by GitRepositorySpec.Include.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "includedArtifacts"
    )]
    pub included_artifacts: Option<Vec<GitRepositoryStatusIncludedArtifacts>>,
    /// LastHandledReconcileAt holds the value of the most recent
    /// reconcile request value, so a change of the annotation value
    /// can be detected.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "lastHandledReconcileAt"
    )]
    pub last_handled_reconcile_at: Option<String>,
    /// ObservedGeneration is the last observed generation of the GitRepository
    /// object.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedGeneration"
    )]
    pub observed_generation: Option<i64>,
    /// ObservedIgnore is the observed exclusion patterns used for constructing
    /// the source artifact.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedIgnore"
    )]
    pub observed_ignore: Option<String>,
    /// ObservedInclude is the observed list of GitRepository resources used to
    /// produce the current Artifact.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedInclude"
    )]
    pub observed_include: Option<Vec<GitRepositoryStatusObservedInclude>>,
    /// ObservedRecurseSubmodules is the observed resource submodules
    /// configuration used to produce the current Artifact.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedRecurseSubmodules"
    )]
    pub observed_recurse_submodules: Option<bool>,
    /// ObservedSparseCheckout is the observed list of directories used to
    /// produce the current Artifact.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedSparseCheckout"
    )]
    pub observed_sparse_checkout: Option<Vec<String>>,
    /// SourceVerificationMode is the last used verification mode indicating
    /// which Git object(s) have been verified.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "sourceVerificationMode"
    )]
    pub source_verification_mode: Option<String>,
}

/// Artifact represents the last successful GitRepository reconciliation.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryStatusArtifact {
    /// Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
    pub digest: String,
    /// LastUpdateTime is the timestamp corresponding to the last update of the
    /// Artifact.
    #[serde(rename = "lastUpdateTime")]
    pub last_update_time: String,
    /// Metadata holds upstream information such as OCI annotations.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metadata: Option<BTreeMap<String, String>>,
    /// Path is the relative file path of the Artifact. It can be used to locate
    /// the file in the root of the Artifact storage on the local file system of
    /// the controller managing the Source.
    pub path: String,
    /// Revision is a human-readable identifier traceable in the origin source
    /// system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
    pub revision: String,
    /// Size is the number of bytes in the file.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub size: Option<i64>,
    /// URL is the HTTP address of the Artifact as exposed by the controller
    /// managing the Source. It can be used to retrieve the Artifact for
    /// consumption, e.g. by another controller applying the Artifact contents.
    pub url: String,
}

/// Artifact represents the output of a Source reconciliation.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryStatusIncludedArtifacts {
    /// Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
    pub digest: String,
    /// LastUpdateTime is the timestamp corresponding to the last update of the
    /// Artifact.
    #[serde(rename = "lastUpdateTime")]
    pub last_update_time: String,
    /// Metadata holds upstream information such as OCI annotations.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metadata: Option<BTreeMap<String, String>>,
    /// Path is the relative file path of the Artifact. It can be used to locate
    /// the file in the root of the Artifact storage on the local file system of
    /// the controller managing the Source.
    pub path: String,
    /// Revision is a human-readable identifier traceable in the origin source
    /// system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
    pub revision: String,
    /// Size is the number of bytes in the file.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub size: Option<i64>,
    /// URL is the HTTP address of the Artifact as exposed by the controller
    /// managing the Source. It can be used to retrieve the Artifact for
    /// consumption, e.g. by another controller applying the Artifact contents.
    pub url: String,
}

/// GitRepositoryInclude specifies a local reference to a GitRepository which
/// Artifact (sub-)contents must be included, and where they should be placed.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryStatusObservedInclude {
    /// FromPath specifies the path to copy contents from, defaults to the root
    /// of the Artifact.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromPath")]
    pub from_path: Option<String>,
    /// GitRepositoryRef specifies the GitRepository which Artifact contents
    /// must be included.
    pub repository: GitRepositoryStatusObservedIncludeRepository,
    /// ToPath specifies the path to copy contents to, defaults to the name of
    /// the GitRepositoryRef.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPath")]
    pub to_path: Option<String>,
}

/// GitRepositoryRef specifies the GitRepository which Artifact contents
/// must be included.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct GitRepositoryStatusObservedIncludeRepository {
    /// Name of the referent.
    pub name: String,
}

// ---

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --filename /tmp/tmp.ArNBx7apbm/doc4.yaml --derive Default --derive PartialEq --docs --smart-derive-elision
// kopium version: 0.23.0

#[allow(unused_imports)]
use self::prelude::*;

/// HelmChartSpec specifies the desired state of a Helm chart.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, PartialEq)]
#[kube(
    group = "source.toolkit.fluxcd.io",
    version = "v1",
    kind = "HelmChart",
    plural = "helmcharts"
)]
#[kube(namespaced)]
#[kube(status = "HelmChartStatus")]
#[kube(schema = "disabled")]
#[kube(derive = "PartialEq")]
pub struct HelmChartSpec {
    /// Chart is the name or path the Helm chart is available at in the
    /// SourceRef.
    pub chart: String,
    /// IgnoreMissingValuesFiles controls whether to silently ignore missing values
    /// files rather than failing.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "ignoreMissingValuesFiles"
    )]
    pub ignore_missing_values_files: Option<bool>,
    /// Interval at which the HelmChart SourceRef is checked for updates.
    /// This interval is approximate and may be subject to jitter to ensure
    /// efficient use of resources.
    pub interval: String,
    /// ReconcileStrategy determines what enables the creation of a new artifact.
    /// Valid values are ('ChartVersion', 'Revision').
    /// See the documentation of the values for an explanation on their behavior.
    /// Defaults to ChartVersion when omitted.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "reconcileStrategy"
    )]
    pub reconcile_strategy: Option<HelmChartReconcileStrategy>,
    /// SourceRef is the reference to the Source the chart is available at.
    #[serde(rename = "sourceRef")]
    pub source_ref: HelmChartSourceRef,
    /// Suspend tells the controller to suspend the reconciliation of this
    /// source.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub suspend: Option<bool>,
    /// ValuesFiles is an alternative list of values files to use as the chart
    /// values (values.yaml is not included by default), expected to be a
    /// relative path in the SourceRef.
    /// Values files are merged in the order of this list with the last file
    /// overriding the first. Ignored when omitted.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "valuesFiles"
    )]
    pub values_files: Option<Vec<String>>,
    /// Verify contains the secret name containing the trusted public keys
    /// used to verify the signature and specifies which provider to use to check
    /// whether OCI image is authentic.
    /// This field is only supported when using HelmRepository source with spec.type 'oci'.
    /// Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub verify: Option<HelmChartVerify>,
    /// Version is the chart version semver expression, ignored for charts from
    /// GitRepository and Bucket sources. Defaults to latest when omitted.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
}

/// HelmChartSpec specifies the desired state of a Helm chart.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum HelmChartReconcileStrategy {
    ChartVersion,
    Revision,
}

/// SourceRef is the reference to the Source the chart is available at.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct HelmChartSourceRef {
    /// APIVersion of the referent.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "apiVersion"
    )]
    pub api_version: Option<String>,
    /// Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
    /// 'Bucket').
    pub kind: HelmChartSourceRefKind,
    /// Name of the referent.
    pub name: String,
}

/// SourceRef is the reference to the Source the chart is available at.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum HelmChartSourceRefKind {
    HelmRepository,
    GitRepository,
    Bucket,
}

/// Verify contains the secret name containing the trusted public keys
/// used to verify the signature and specifies which provider to use to check
/// whether OCI image is authentic.
/// This field is only supported when using HelmRepository source with spec.type 'oci'.
/// Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct HelmChartVerify {
    /// MatchOIDCIdentity specifies the identity matching criteria to use
    /// while verifying an OCI artifact which was signed using Cosign keyless
    /// signing. The artifact's identity is deemed to be verified if any of the
    /// specified matchers match against the identity.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchOIDCIdentity"
    )]
    pub match_oidc_identity: Option<Vec<HelmChartVerifyMatchOidcIdentity>>,
    /// Provider specifies the technology used to sign the OCI Artifact.
    pub provider: HelmChartVerifyProvider,
    /// SecretRef specifies the Kubernetes Secret containing the
    /// trusted public keys.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<HelmChartVerifySecretRef>,
}

/// OIDCIdentityMatch specifies options for verifying the certificate identity,
/// i.e. the issuer and the subject of the certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmChartVerifyMatchOidcIdentity {
    /// Issuer specifies the regex pattern to match against to verify
    /// the OIDC issuer in the Fulcio certificate. The pattern must be a
    /// valid Go regular expression.
    pub issuer: String,
    /// Subject specifies the regex pattern to match against to verify
    /// the identity subject in the Fulcio certificate. The pattern must
    /// be a valid Go regular expression.
    pub subject: String,
}

/// Verify contains the secret name containing the trusted public keys
/// used to verify the signature and specifies which provider to use to check
/// whether OCI image is authentic.
/// This field is only supported when using HelmRepository source with spec.type 'oci'.
/// Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum HelmChartVerifyProvider {
    #[serde(rename = "cosign")]
    Cosign,
    #[serde(rename = "notation")]
    Notation,
}

/// SecretRef specifies the Kubernetes Secret containing the
/// trusted public keys.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmChartVerifySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// HelmChartStatus records the observed state of the HelmChart.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmChartStatus {
    /// Artifact represents the output of the last successful reconciliation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub artifact: Option<HelmChartStatusArtifact>,
    /// Conditions holds the conditions for the HelmChart.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
    /// LastHandledReconcileAt holds the value of the most recent
    /// reconcile request value, so a change of the annotation value
    /// can be detected.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "lastHandledReconcileAt"
    )]
    pub last_handled_reconcile_at: Option<String>,
    /// ObservedChartName is the last observed chart name as specified by the
    /// resolved chart reference.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedChartName"
    )]
    pub observed_chart_name: Option<String>,
    /// ObservedGeneration is the last observed generation of the HelmChart
    /// object.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedGeneration"
    )]
    pub observed_generation: Option<i64>,
    /// ObservedSourceArtifactRevision is the last observed Artifact.Revision
    /// of the HelmChartSpec.SourceRef.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedSourceArtifactRevision"
    )]
    pub observed_source_artifact_revision: Option<String>,
    /// ObservedValuesFiles are the observed value files of the last successful
    /// reconciliation.
    /// It matches the chart in the last successfully reconciled artifact.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedValuesFiles"
    )]
    pub observed_values_files: Option<Vec<String>>,
    /// URL is the dynamic fetch link for the latest Artifact.
    /// It is provided on a "best effort" basis, and using the precise
    /// BucketStatus.Artifact data is recommended.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// Artifact represents the output of the last successful reconciliation.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmChartStatusArtifact {
    /// Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
    pub digest: String,
    /// LastUpdateTime is the timestamp corresponding to the last update of the
    /// Artifact.
    #[serde(rename = "lastUpdateTime")]
    pub last_update_time: String,
    /// Metadata holds upstream information such as OCI annotations.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metadata: Option<BTreeMap<String, String>>,
    /// Path is the relative file path of the Artifact. It can be used to locate
    /// the file in the root of the Artifact storage on the local file system of
    /// the controller managing the Source.
    pub path: String,
    /// Revision is a human-readable identifier traceable in the origin source
    /// system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
    pub revision: String,
    /// Size is the number of bytes in the file.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub size: Option<i64>,
    /// URL is the HTTP address of the Artifact as exposed by the controller
    /// managing the Source. It can be used to retrieve the Artifact for
    /// consumption, e.g. by another controller applying the Artifact contents.
    pub url: String,
}

// ---

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --filename /tmp/tmp.ArNBx7apbm/doc5.yaml --derive Default --derive PartialEq --docs --smart-derive-elision
// kopium version: 0.23.0

#[allow(unused_imports)]
use self::prelude::*;

/// HelmRepositorySpec specifies the required configuration to produce an
/// Artifact for a Helm repository index YAML.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[kube(
    group = "source.toolkit.fluxcd.io",
    version = "v1",
    kind = "HelmRepository",
    plural = "helmrepositories"
)]
#[kube(namespaced)]
#[kube(status = "HelmRepositoryStatus")]
#[kube(schema = "disabled")]
#[kube(derive = "Default")]
#[kube(derive = "PartialEq")]
pub struct HelmRepositorySpec {
    /// AccessFrom specifies an Access Control List for allowing cross-namespace
    /// references to this object.
    /// NOTE: Not implemented, provisional as of <https://github.com/fluxcd/flux2/pull/2092>
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "accessFrom"
    )]
    pub access_from: Option<HelmRepositoryAccessFrom>,
    /// CertSecretRef can be given the name of a Secret containing
    /// either or both of
    ///
    /// - a PEM-encoded client certificate (`tls.crt`) and private
    /// key (`tls.key`);
    /// - a PEM-encoded CA certificate (`ca.crt`)
    ///
    /// and whichever are supplied, will be used for connecting to the
    /// registry. The client cert and key are useful if you are
    /// authenticating with a certificate; the CA cert is useful if
    /// you are using a self-signed server certificate. The Secret must
    /// be of type `Opaque` or `kubernetes.io/tls`.
    ///
    /// It takes precedence over the values specified in the Secret referred
    /// to by `.spec.secretRef`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "certSecretRef"
    )]
    pub cert_secret_ref: Option<HelmRepositoryCertSecretRef>,
    /// Insecure allows connecting to a non-TLS HTTP container registry.
    /// This field is only taken into account if the .spec.type field is set to 'oci'.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub insecure: Option<bool>,
    /// Interval at which the HelmRepository URL is checked for updates.
    /// This interval is approximate and may be subject to jitter to ensure
    /// efficient use of resources.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub interval: Option<String>,
    /// PassCredentials allows the credentials from the SecretRef to be passed
    /// on to a host that does not match the host as defined in URL.
    /// This may be required if the host of the advertised chart URLs in the
    /// index differ from the defined URL.
    /// Enabling this should be done with caution, as it can potentially result
    /// in credentials getting stolen in a MITM-attack.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "passCredentials"
    )]
    pub pass_credentials: Option<bool>,
    /// Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
    /// This field is optional, and only taken into account if the .spec.type field is set to 'oci'.
    /// When not specified, defaults to 'generic'.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub provider: Option<HelmRepositoryProvider>,
    /// SecretRef specifies the Secret containing authentication credentials
    /// for the HelmRepository.
    /// For HTTP/S basic auth the secret must contain 'username' and 'password'
    /// fields.
    /// Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
    /// keys is deprecated. Please use `.spec.certSecretRef` instead.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<HelmRepositorySecretRef>,
    /// Suspend tells the controller to suspend the reconciliation of this
    /// HelmRepository.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub suspend: Option<bool>,
    /// Timeout is used for the index fetch operation for an HTTPS helm repository,
    /// and for remote OCI Repository operations like pulling for an OCI helm
    /// chart by the associated HelmChart.
    /// Its default value is 60s.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub timeout: Option<String>,
    /// Type of the HelmRepository.
    /// When this field is set to  "oci", the URL field value must be prefixed with "oci://".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<HelmRepositoryType>,
    /// URL of the Helm repository, a valid URL contains at least a protocol and
    /// host.
    pub url: String,
}

/// AccessFrom specifies an Access Control List for allowing cross-namespace
/// references to this object.
/// NOTE: Not implemented, provisional as of <https://github.com/fluxcd/flux2/pull/2092>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmRepositoryAccessFrom {
    /// NamespaceSelectors is the list of namespace selectors to which this ACL applies.
    /// Items in this list are evaluated using a logical OR operation.
    #[serde(rename = "namespaceSelectors")]
    pub namespace_selectors: Vec<HelmRepositoryAccessFromNamespaceSelectors>,
}

/// NamespaceSelector selects the namespaces to which this ACL applies.
/// An empty map of MatchLabels matches all namespaces in a cluster.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmRepositoryAccessFromNamespaceSelectors {
    /// MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// CertSecretRef can be given the name of a Secret containing
/// either or both of
///
/// - a PEM-encoded client certificate (`tls.crt`) and private
/// key (`tls.key`);
/// - a PEM-encoded CA certificate (`ca.crt`)
///
/// and whichever are supplied, will be used for connecting to the
/// registry. The client cert and key are useful if you are
/// authenticating with a certificate; the CA cert is useful if
/// you are using a self-signed server certificate. The Secret must
/// be of type `Opaque` or `kubernetes.io/tls`.
///
/// It takes precedence over the values specified in the Secret referred
/// to by `.spec.secretRef`.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmRepositoryCertSecretRef {
    /// Name of the referent.
    pub name: String,
}

/// HelmRepositorySpec specifies the required configuration to produce an
/// Artifact for a Helm repository index YAML.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum HelmRepositoryProvider {
    #[serde(rename = "generic")]
    Generic,
    #[serde(rename = "aws")]
    Aws,
    #[serde(rename = "azure")]
    Azure,
    #[serde(rename = "gcp")]
    Gcp,
}

/// SecretRef specifies the Secret containing authentication credentials
/// for the HelmRepository.
/// For HTTP/S basic auth the secret must contain 'username' and 'password'
/// fields.
/// Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
/// keys is deprecated. Please use `.spec.certSecretRef` instead.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmRepositorySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// HelmRepositorySpec specifies the required configuration to produce an
/// Artifact for a Helm repository index YAML.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum HelmRepositoryType {
    #[serde(rename = "default")]
    Default,
    #[serde(rename = "oci")]
    Oci,
}

/// HelmRepositoryStatus records the observed state of the HelmRepository.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmRepositoryStatus {
    /// Artifact represents the last successful HelmRepository reconciliation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub artifact: Option<HelmRepositoryStatusArtifact>,
    /// Conditions holds the conditions for the HelmRepository.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
    /// LastHandledReconcileAt holds the value of the most recent
    /// reconcile request value, so a change of the annotation value
    /// can be detected.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "lastHandledReconcileAt"
    )]
    pub last_handled_reconcile_at: Option<String>,
    /// ObservedGeneration is the last observed generation of the HelmRepository
    /// object.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedGeneration"
    )]
    pub observed_generation: Option<i64>,
    /// URL is the dynamic fetch link for the latest Artifact.
    /// It is provided on a "best effort" basis, and using the precise
    /// HelmRepositoryStatus.Artifact data is recommended.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// Artifact represents the last successful HelmRepository reconciliation.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct HelmRepositoryStatusArtifact {
    /// Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
    pub digest: String,
    /// LastUpdateTime is the timestamp corresponding to the last update of the
    /// Artifact.
    #[serde(rename = "lastUpdateTime")]
    pub last_update_time: String,
    /// Metadata holds upstream information such as OCI annotations.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metadata: Option<BTreeMap<String, String>>,
    /// Path is the relative file path of the Artifact. It can be used to locate
    /// the file in the root of the Artifact storage on the local file system of
    /// the controller managing the Source.
    pub path: String,
    /// Revision is a human-readable identifier traceable in the origin source
    /// system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
    pub revision: String,
    /// Size is the number of bytes in the file.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub size: Option<i64>,
    /// URL is the HTTP address of the Artifact as exposed by the controller
    /// managing the Source. It can be used to retrieve the Artifact for
    /// consumption, e.g. by another controller applying the Artifact contents.
    pub url: String,
}

// ---

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --filename /tmp/tmp.ArNBx7apbm/doc6.yaml --derive Default --derive PartialEq --docs --smart-derive-elision
// kopium version: 0.23.0

#[allow(unused_imports)]
use self::prelude::*;

/// OCIRepositorySpec defines the desired state of OCIRepository
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[kube(
    group = "source.toolkit.fluxcd.io",
    version = "v1",
    kind = "OCIRepository",
    root = "OciRepository",
    plural = "ocirepositories"
)]
#[kube(namespaced)]
#[kube(status = "OciRepositoryStatus")]
#[kube(schema = "disabled")]
#[kube(derive = "Default")]
#[kube(derive = "PartialEq")]
pub struct OciRepositorySpec {
    /// CertSecretRef can be given the name of a Secret containing
    /// either or both of
    ///
    /// - a PEM-encoded client certificate (`tls.crt`) and private
    /// key (`tls.key`);
    /// - a PEM-encoded CA certificate (`ca.crt`)
    ///
    /// and whichever are supplied, will be used for connecting to the
    /// registry. The client cert and key are useful if you are
    /// authenticating with a certificate; the CA cert is useful if
    /// you are using a self-signed server certificate. The Secret must
    /// be of type `Opaque` or `kubernetes.io/tls`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "certSecretRef"
    )]
    pub cert_secret_ref: Option<OciRepositoryCertSecretRef>,
    /// Ignore overrides the set of excluded patterns in the .sourceignore format
    /// (which is the same as .gitignore). If not provided, a default will be used,
    /// consult the documentation for your version to find out what those are.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ignore: Option<String>,
    /// Insecure allows connecting to a non-TLS HTTP container registry.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub insecure: Option<bool>,
    /// Interval at which the OCIRepository URL is checked for updates.
    /// This interval is approximate and may be subject to jitter to ensure
    /// efficient use of resources.
    pub interval: String,
    /// LayerSelector specifies which layer should be extracted from the OCI artifact.
    /// When not specified, the first layer found in the artifact is selected.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "layerSelector"
    )]
    pub layer_selector: Option<OciRepositoryLayerSelector>,
    /// The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
    /// When not specified, defaults to 'generic'.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub provider: Option<OciRepositoryProvider>,
    /// ProxySecretRef specifies the Secret containing the proxy configuration
    /// to use while communicating with the container registry.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "proxySecretRef"
    )]
    pub proxy_secret_ref: Option<OciRepositoryProxySecretRef>,
    /// The OCI reference to pull and monitor for changes,
    /// defaults to the latest tag.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ref")]
    pub r#ref: Option<OciRepositoryRef>,
    /// SecretRef contains the secret name containing the registry login
    /// credentials to resolve image metadata.
    /// The secret must be of type kubernetes.io/dockerconfigjson.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<OciRepositorySecretRef>,
    /// ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
    /// the image pull if the service account has attached pull secrets. For more information:
    /// <https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account>
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serviceAccountName"
    )]
    pub service_account_name: Option<String>,
    /// This flag tells the controller to suspend the reconciliation of this source.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub suspend: Option<bool>,
    /// The timeout for remote OCI Repository operations like pulling, defaults to 60s.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub timeout: Option<String>,
    /// URL is a reference to an OCI artifact repository hosted
    /// on a remote container registry.
    pub url: String,
    /// Verify contains the secret name containing the trusted public keys
    /// used to verify the signature and specifies which provider to use to check
    /// whether OCI image is authentic.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub verify: Option<OciRepositoryVerify>,
}

/// CertSecretRef can be given the name of a Secret containing
/// either or both of
///
/// - a PEM-encoded client certificate (`tls.crt`) and private
/// key (`tls.key`);
/// - a PEM-encoded CA certificate (`ca.crt`)
///
/// and whichever are supplied, will be used for connecting to the
/// registry. The client cert and key are useful if you are
/// authenticating with a certificate; the CA cert is useful if
/// you are using a self-signed server certificate. The Secret must
/// be of type `Opaque` or `kubernetes.io/tls`.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryCertSecretRef {
    /// Name of the referent.
    pub name: String,
}

/// LayerSelector specifies which layer should be extracted from the OCI artifact.
/// When not specified, the first layer found in the artifact is selected.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryLayerSelector {
    /// MediaType specifies the OCI media type of the layer
    /// which should be extracted from the OCI Artifact. The
    /// first layer matching this type is selected.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mediaType")]
    pub media_type: Option<String>,
    /// Operation specifies how the selected layer should be processed.
    /// By default, the layer compressed content is extracted to storage.
    /// When the operation is set to 'copy', the layer compressed content
    /// is persisted to storage as it is.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub operation: Option<OciRepositoryLayerSelectorOperation>,
}

/// LayerSelector specifies which layer should be extracted from the OCI artifact.
/// When not specified, the first layer found in the artifact is selected.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum OciRepositoryLayerSelectorOperation {
    #[serde(rename = "extract")]
    Extract,
    #[serde(rename = "copy")]
    Copy,
}

/// OCIRepositorySpec defines the desired state of OCIRepository
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum OciRepositoryProvider {
    #[serde(rename = "generic")]
    Generic,
    #[serde(rename = "aws")]
    Aws,
    #[serde(rename = "azure")]
    Azure,
    #[serde(rename = "gcp")]
    Gcp,
}

/// ProxySecretRef specifies the Secret containing the proxy configuration
/// to use while communicating with the container registry.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryProxySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// The OCI reference to pull and monitor for changes,
/// defaults to the latest tag.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryRef {
    /// Digest is the image digest to pull, takes precedence over SemVer.
    /// The value should be in the format 'sha256:<HASH>'.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub digest: Option<String>,
    /// SemVer is the range of tags to pull selecting the latest within
    /// the range, takes precedence over Tag.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub semver: Option<String>,
    /// SemverFilter is a regex pattern to filter the tags within the SemVer range.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "semverFilter"
    )]
    pub semver_filter: Option<String>,
    /// Tag is the image tag to pull, defaults to latest.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tag: Option<String>,
}

/// SecretRef contains the secret name containing the registry login
/// credentials to resolve image metadata.
/// The secret must be of type kubernetes.io/dockerconfigjson.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositorySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// Verify contains the secret name containing the trusted public keys
/// used to verify the signature and specifies which provider to use to check
/// whether OCI image is authentic.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct OciRepositoryVerify {
    /// MatchOIDCIdentity specifies the identity matching criteria to use
    /// while verifying an OCI artifact which was signed using Cosign keyless
    /// signing. The artifact's identity is deemed to be verified if any of the
    /// specified matchers match against the identity.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchOIDCIdentity"
    )]
    pub match_oidc_identity: Option<Vec<OciRepositoryVerifyMatchOidcIdentity>>,
    /// Provider specifies the technology used to sign the OCI Artifact.
    pub provider: OciRepositoryVerifyProvider,
    /// SecretRef specifies the Kubernetes Secret containing the
    /// trusted public keys.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<OciRepositoryVerifySecretRef>,
}

/// OIDCIdentityMatch specifies options for verifying the certificate identity,
/// i.e. the issuer and the subject of the certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryVerifyMatchOidcIdentity {
    /// Issuer specifies the regex pattern to match against to verify
    /// the OIDC issuer in the Fulcio certificate. The pattern must be a
    /// valid Go regular expression.
    pub issuer: String,
    /// Subject specifies the regex pattern to match against to verify
    /// the identity subject in the Fulcio certificate. The pattern must
    /// be a valid Go regular expression.
    pub subject: String,
}

/// Verify contains the secret name containing the trusted public keys
/// used to verify the signature and specifies which provider to use to check
/// whether OCI image is authentic.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum OciRepositoryVerifyProvider {
    #[serde(rename = "cosign")]
    Cosign,
    #[serde(rename = "notation")]
    Notation,
}

/// SecretRef specifies the Kubernetes Secret containing the
/// trusted public keys.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryVerifySecretRef {
    /// Name of the referent.
    pub name: String,
}

/// OCIRepositoryStatus defines the observed state of OCIRepository
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryStatus {
    /// Artifact represents the output of the last successful OCI Repository sync.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub artifact: Option<OciRepositoryStatusArtifact>,
    /// Conditions holds the conditions for the OCIRepository.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
    /// LastHandledReconcileAt holds the value of the most recent
    /// reconcile request value, so a change of the annotation value
    /// can be detected.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "lastHandledReconcileAt"
    )]
    pub last_handled_reconcile_at: Option<String>,
    /// ObservedGeneration is the last observed generation.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedGeneration"
    )]
    pub observed_generation: Option<i64>,
    /// ObservedIgnore is the observed exclusion patterns used for constructing
    /// the source artifact.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedIgnore"
    )]
    pub observed_ignore: Option<String>,
    /// ObservedLayerSelector is the observed layer selector used for constructing
    /// the source artifact.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedLayerSelector"
    )]
    pub observed_layer_selector: Option<OciRepositoryStatusObservedLayerSelector>,
    /// URL is the download link for the artifact output of the last OCI Repository sync.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// Artifact represents the output of the last successful OCI Repository sync.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryStatusArtifact {
    /// Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
    pub digest: String,
    /// LastUpdateTime is the timestamp corresponding to the last update of the
    /// Artifact.
    #[serde(rename = "lastUpdateTime")]
    pub last_update_time: String,
    /// Metadata holds upstream information such as OCI annotations.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metadata: Option<BTreeMap<String, String>>,
    /// Path is the relative file path of the Artifact. It can be used to locate
    /// the file in the root of the Artifact storage on the local file system of
    /// the controller managing the Source.
    pub path: String,
    /// Revision is a human-readable identifier traceable in the origin source
    /// system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
    pub revision: String,
    /// Size is the number of bytes in the file.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub size: Option<i64>,
    /// URL is the HTTP address of the Artifact as exposed by the controller
    /// managing the Source. It can be used to retrieve the Artifact for
    /// consumption, e.g. by another controller applying the Artifact contents.
    pub url: String,
}

/// ObservedLayerSelector is the observed layer selector used for constructing
/// the source artifact.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct OciRepositoryStatusObservedLayerSelector {
    /// MediaType specifies the OCI media type of the layer
    /// which should be extracted from the OCI Artifact. The
    /// first layer matching this type is selected.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mediaType")]
    pub media_type: Option<String>,
    /// Operation specifies how the selected layer should be processed.
    /// By default, the layer compressed content is extracted to storage.
    /// When the operation is set to 'copy', the layer compressed content
    /// is persisted to storage as it is.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub operation: Option<OciRepositoryStatusObservedLayerSelectorOperation>,
}

/// ObservedLayerSelector is the observed layer selector used for constructing
/// the source artifact.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum OciRepositoryStatusObservedLayerSelectorOperation {
    #[serde(rename = "extract")]
    Extract,
    #[serde(rename = "copy")]
    Copy,
}

// ---
