/*
Copyright (c) 2020 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// This file was autogenerated by go-to-protobuf. Do not edit it manually!

syntax = 'proto2';

package github.com.gardener.gardener.pkg.apis.core.v1alpha1;

import "k8s.io/api/core/v1/generated.proto";
import "k8s.io/api/rbac/v1/generated.proto";
import "k8s.io/apimachinery/pkg/api/resource/generated.proto";
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
import "k8s.io/apimachinery/pkg/util/intstr/generated.proto";

// Package-wide variables from generator "generated".
option go_package = "v1alpha1";

// Addon allows enabling or disabling a specific addon and is used to derive from.
message Addon {
  // Enabled indicates whether the addon is enabled or not.
  optional bool enabled = 1;
}

// Addons is a collection of configuration for specific addons which are managed by the Gardener.
message Addons {
  // KubernetesDashboard holds configuration settings for the kubernetes dashboard addon.
  // +optional
  optional KubernetesDashboard kubernetesDashboard = 1;

  // NginxIngress holds configuration settings for the nginx-ingress addon.
  // +optional
  optional NginxIngress nginxIngress = 2;
}

// AdmissionPlugin contains information about a specific admission plugin and its corresponding configuration.
message AdmissionPlugin {
  // Name is the name of the plugin.
  optional string name = 1;

  // Config is the configuration of the plugin.
  // +optional
  optional ProviderConfig config = 2;
}

// Alerting contains information about how alerting will be done (i.e. who will receive alerts and how).
message Alerting {
  // MonitoringEmailReceivers is a list of recipients for alerts
  // +optional
  repeated string emailReceivers = 1;
}

// AuditConfig contains settings for audit of the api server
message AuditConfig {
  // AuditPolicy contains configuration settings for audit policy of the kube-apiserver.
  // +optional
  optional AuditPolicy auditPolicy = 1;
}

// AuditPolicy contains audit policy for kube-apiserver
message AuditPolicy {
  // ConfigMapRef is a reference to a ConfigMap object in the same namespace,
  // which contains the audit policy for the kube-apiserver.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference configMapRef = 1;
}

// AvailabilityZone is an availability zone.
message AvailabilityZone {
  // Name is an an availability zone name.
  optional string name = 1;

  // UnavailableMachineTypes is a list of machine type names that are not availability in this zone.
  // +optional
  repeated string unavailableMachineTypes = 2;

  // UnavailableVolumeTypes is a list of volume type names that are not availability in this zone.
  // +optional
  repeated string unavailableVolumeTypes = 3;
}

// BackupBucket holds details about backup bucket
message BackupBucket {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Specification of the Backup Bucket.
  optional BackupBucketSpec spec = 2;

  // Most recently observed status of the Backup Bucket.
  optional BackupBucketStatus status = 3;
}

// BackupBucketList is a list of BackupBucket objects.
message BackupBucketList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of BackupBucket.
  repeated BackupBucket items = 2;
}

// BackupBucketProvider holds the details of cloud provider of the object store.
message BackupBucketProvider {
  // Type is the type of provider.
  optional string type = 1;

  // Region is the region of the bucket.
  optional string region = 2;
}

// BackupBucketSpec is the specification of a Backup Bucket.
message BackupBucketSpec {
  // Provider hold the details of cloud provider of the object store.
  optional BackupBucketProvider provider = 1;

  // ProviderConfig is the configuration passed to BackupBucket resource.
  // +optional
  optional ProviderConfig providerConfig = 2;

  // SecretRef is a reference to a secret that contains the credentials to access object store.
  optional k8s.io.api.core.v1.SecretReference secretRef = 3;

  // Seed holds the name of the seed allocated to BackupBucket for running controller.
  // +optional
  optional string seed = 4;
}

// BackupBucketStatus holds the most recently observed status of the Backup Bucket.
message BackupBucketStatus {
  // ProviderStatus is the configuration passed to BackupBucket resource.
  // +optional
  optional ProviderConfig providerStatus = 1;

  // LastOperation holds information about the last operation on the BackupBucket.
  // +optional
  optional LastOperation lastOperation = 2;

  // LastError holds information about the last occurred error during an operation.
  // +optional
  optional LastError lastError = 3;

  // ObservedGeneration is the most recent generation observed for this BackupBucket. It corresponds to the
  // BackupBucket's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 4;

  // GeneratedSecretRef is reference to the secret generated by backup bucket, which
  // will have object store specific credentials.
  // +optional
  optional k8s.io.api.core.v1.SecretReference generatedSecretRef = 5;
}

// BackupEntry holds details about shoot backup.
message BackupEntry {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of the Backup Entry.
  // +optional
  optional BackupEntrySpec spec = 2;

  // Status contains the most recently observed status of the Backup Entry.
  // +optional
  optional BackupEntryStatus status = 3;
}

// BackupEntryList is a list of BackupEntry objects.
message BackupEntryList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of BackupEntry.
  repeated BackupEntry items = 2;
}

// BackupEntrySpec is the specification of a Backup Entry.
message BackupEntrySpec {
  // BucketName is the name of backup bucket for this Backup Entry.
  optional string bucketName = 1;

  // Seed holds the name of the seed allocated to BackupEntry for running controller.
  // +optional
  optional string seed = 2;
}

// BackupEntryStatus holds the most recently observed status of the Backup Entry.
message BackupEntryStatus {
  // LastOperation holds information about the last operation on the BackupEntry.
  // +optional
  optional LastOperation lastOperation = 1;

  // LastError holds information about the last occurred error during an operation.
  // +optional
  optional LastError lastError = 2;

  // ObservedGeneration is the most recent generation observed for this BackupEntry. It corresponds to the
  // BackupEntry's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 3;
}

// CRI contains information about the Container Runtimes.
message CRI {
  // The name of the CRI library
  optional string name = 1;

  // ContainerRuntimes is the list of the required container runtimes supported for a worker pool.
  // +optional
  repeated ContainerRuntime containerRuntimes = 2;
}

// CloudInfo contains information about the cloud
message CloudInfo {
  // Type is the cloud type
  optional string type = 1;

  // Region is the cloud region
  optional string region = 2;
}

// CloudProfile represents certain properties about a provider environment.
message CloudProfile {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec defines the provider environment properties.
  // +optional
  optional CloudProfileSpec spec = 2;
}

// CloudProfileList is a collection of CloudProfiles.
message CloudProfileList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of CloudProfiles.
  repeated CloudProfile items = 2;
}

// CloudProfileSpec is the specification of a CloudProfile.
// It must contain exactly one of its defined keys.
message CloudProfileSpec {
  // CABundle is a certificate bundle which will be installed onto every host machine of shoot cluster targeting this profile.
  // +optional
  optional string caBundle = 1;

  // Kubernetes contains constraints regarding allowed values of the 'kubernetes' block in the Shoot specification.
  optional KubernetesSettings kubernetes = 2;

  // MachineImages contains constraints regarding allowed values for machine images in the Shoot specification.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated MachineImage machineImages = 3;

  // MachineTypes contains constraints regarding allowed values for machine types in the 'workers' block in the Shoot specification.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated MachineType machineTypes = 4;

  // ProviderConfig contains provider-specific configuration for the profile.
  // +optional
  optional ProviderConfig providerConfig = 5;

  // Regions contains constraints regarding allowed values for regions and zones.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated Region regions = 6;

  // SeedSelector contains an optional list of labels on `Seed` resources that marks those seeds whose shoots may use this provider profile.
  // An empty list means that all seeds of the same provider type are supported.
  // This is useful for environments that are of the same type (like openstack) but may have different "instances"/landscapes.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector seedSelector = 7;

  // Type is the name of the provider.
  optional string type = 8;

  // VolumeTypes contains constraints regarding allowed values for volume types in the 'workers' block in the Shoot specification.
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated VolumeType volumeTypes = 9;
}

// ClusterAutoscaler contains the configration flags for the Kubernetes cluster autoscaler.
message ClusterAutoscaler {
  // ScaleDownDelayAfterAdd defines how long after scale up that scale down evaluation resumes (default: 1 hour).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scaleDownDelayAfterAdd = 1;

  // ScaleDownDelayAfterDelete how long after node deletion that scale down evaluation resumes, defaults to scanInterval (defaults to ScanInterval).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scaleDownDelayAfterDelete = 2;

  // ScaleDownDelayAfterFailure how long after scale down failure that scale down evaluation resumes (default: 3 mins).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scaleDownDelayAfterFailure = 3;

  // ScaleDownUnneededTime defines how long a node should be unneeded before it is eligible for scale down (default: 30 mins).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scaleDownUnneededTime = 4;

  // ScaleDownUtilizationThreshold defines the threshold in % under which a node is being removed
  // +optional
  optional double scaleDownUtilizationThreshold = 5;

  // ScanInterval how often cluster is reevaluated for scale up or down (default: 10 secs).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scanInterval = 6;
}

// ClusterInfo contains information about the Plant cluster
message ClusterInfo {
  // Cloud describes the cloud information
  optional CloudInfo cloud = 1;

  // Kubernetes describes kubernetes meta information (e.g., version)
  optional KubernetesInfo kubernetes = 2;
}

// Condition holds the information about the state of a resource.
message Condition {
  // Type of the Shoot condition.
  optional string type = 1;

  // Status of the condition, one of True, False, Unknown.
  optional string status = 2;

  // Last time the condition transitioned from one status to another.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;

  // Last time the condition was updated.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 4;

  // The reason for the condition's last transition.
  optional string reason = 5;

  // A human readable message indicating details about the transition.
  optional string message = 6;

  // Well-defined error codes in case the condition reports a problem.
  // +optional
  repeated string codes = 7;
}

// ContainerRuntime contains information about worker's available container runtime
message ContainerRuntime {
  // Type is the type of the Container Runtime.
  optional string name = 1;

  // ProviderConfig is the configuration passed to the ContainerRuntime resource.
  // +optional
  optional ProviderConfig providerConfig = 2;
}

// ControllerDeployment contains information for how this controller is deployed.
message ControllerDeployment {
  // Type is the deployment type.
  optional string type = 1;

  // ProviderConfig contains type-specific configuration.
  // +optional
  optional ProviderConfig providerConfig = 2;
}

// ControllerInstallation represents an installation request for an external controller.
message ControllerInstallation {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of this installation.
  optional ControllerInstallationSpec spec = 2;

  // Status contains the status of this installation.
  optional ControllerInstallationStatus status = 3;
}

// ControllerInstallationList is a collection of ControllerInstallations.
message ControllerInstallationList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of ControllerInstallations.
  repeated ControllerInstallation items = 2;
}

// ControllerInstallationSpec is the specification of a ControllerInstallation.
message ControllerInstallationSpec {
  // RegistrationRef is used to reference a ControllerRegistration resources.
  optional k8s.io.api.core.v1.ObjectReference registrationRef = 1;

  // SeedRef is used to reference a Seed resources.
  optional k8s.io.api.core.v1.ObjectReference seedRef = 2;
}

// ControllerInstallationStatus is the status of a ControllerInstallation.
message ControllerInstallationStatus {
  // Conditions represents the latest available observations of a ControllerInstallations's current state.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated Condition conditions = 1;

  // ProviderStatus contains type-specific status.
  // +optional
  optional ProviderConfig providerStatus = 2;
}

// ControllerRegistration represents a registration of an external controller.
message ControllerRegistration {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of this registration.
  optional ControllerRegistrationSpec spec = 2;
}

// ControllerRegistrationList is a collection of ControllerRegistrations.
message ControllerRegistrationList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of ControllerRegistrations.
  repeated ControllerRegistration items = 2;
}

// ControllerRegistrationSpec is the specification of a ControllerRegistration.
message ControllerRegistrationSpec {
  // Resources is a list of combinations of kinds (DNSProvider, Infrastructure, Generic, ...) and their actual types
  // (aws-route53, gcp, auditlog, ...).
  repeated ControllerResource resources = 1;

  // Deployment contains information for how this controller is deployed.
  // +optional
  optional ControllerDeployment deployment = 2;
}

// ControllerResource is a combination of a kind (DNSProvider, Infrastructure, Generic, ...) and the actual type for this
// kind (aws-route53, gcp, auditlog, ...).
message ControllerResource {
  // Kind is the resource kind, for example "OperatingSystemConfig".
  optional string kind = 1;

  // Type is the resource type, for example "coreos" or "ubuntu".
  optional string type = 2;

  // GloballyEnabled determines if this ControllerResource is required by all Shoot clusters.
  // +optional
  optional bool globallyEnabled = 3;

  // ReconcileTimeout defines how long Gardener should wait for the resource reconciliation.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration reconcileTimeout = 4;
}

// DNS holds information about the provider, the hosted zone id and the domain.
message DNS {
  // Domain is the external available domain of the Shoot cluster. This domain will be written into the
  // kubeconfig that is handed out to end-users.
  // +optional
  optional string domain = 1;

  // Providers is a list of DNS providers that shall be enabled for this shoot cluster. Only relevant if
  // not a default domain is used.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated DNSProvider providers = 2;
}

message DNSIncludeExclude {
  // Include is a list of resources that shall be included.
  // +optional
  repeated string include = 1;

  // Exclude is a list of resources that shall be excluded.
  // +optional
  repeated string exclude = 2;
}

// DNSProvider contains information about a DNS provider.
message DNSProvider {
  // Domains contains information about which domains shall be included/excluded for this provider.
  // +optional
  optional DNSIncludeExclude domains = 1;

  // Primary indicates that this DNSProvider is used for shoot related domains.
  // +optional
  optional bool primary = 2;

  // SecretName is a name of a secret containing credentials for the stated domain and the
  // provider. When not specified, the Gardener will use the cloud provider credentials referenced
  // by the Shoot and try to find respective credentials there (primary provider only). Specifying this field may override
  // this behavior, i.e. forcing the Gardener to only look into the given secret.
  // +optional
  optional string secretName = 3;

  // Type is the DNS provider type.
  // +optional
  optional string type = 4;

  // Zones contains information about which hosted zones shall be included/excluded for this provider.
  // +optional
  optional DNSIncludeExclude zones = 5;
}

// Endpoint is an endpoint for monitoring, logging and other services around the plant.
message Endpoint {
  // Name is the name of the endpoint
  optional string name = 1;

  // URL is the url of the endpoint
  optional string url = 2;

  // Purpose is the purpose of the endpoint
  optional string purpose = 3;
}

// ExpirableVersion contains a version and an expiration date.
message ExpirableVersion {
  // Version is the version identifier.
  optional string version = 1;

  // ExpirationDate defines the time at which this version expires.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time expirationDate = 2;

  // Classification defines the state of a version (preview, supported, deprecated)
  // +optional
  optional string classification = 3;
}

// Extension contains type and provider information for Shoot extensions.
message Extension {
  // Type is the type of the extension resource.
  optional string type = 1;

  // ProviderConfig is the configuration passed to extension resource.
  // +optional
  optional ProviderConfig providerConfig = 2;
}

// ExtensionResourceState contains the kind of the extension custom resource and its last observed state in the Shoot's
// namespace on the Seed cluster.
message ExtensionResourceState {
  // Kind (type) of the extension custom resource
  optional string kind = 1;

  // Name of the extension custom resource
  // +optional
  optional string name = 2;

  // Purpose of the extension custom resource
  // +optional
  optional string purpose = 3;

  // State of the extension resource
  optional k8s.io.apimachinery.pkg.runtime.RawExtension state = 4;
}

// Gardener holds the information about the Gardener version that operated a resource.
message Gardener {
  // ID is the Docker container id of the Gardener which last acted on a resource.
  optional string id = 1;

  // Name is the hostname (pod name) of the Gardener which last acted on a resource.
  optional string name = 2;

  // Version is the version of the Gardener which last acted on a resource.
  optional string version = 3;
}

// GardenerResourceData holds the data which is used to generate resources, deployed in the Shoot's control plane.
message GardenerResourceData {
  // Name of the object required to generate resources
  optional string name = 1;

  // Type of the object
  optional string type = 2;

  // Data contains the payload required to generate resources
  optional k8s.io.apimachinery.pkg.runtime.RawExtension data = 3;
}

// Hibernation contains information whether the Shoot is suspended or not.
message Hibernation {
  // Enabled specifies whether the Shoot needs to be hibernated or not. If it is true, the Shoot's desired state is to be hibernated.
  // If it is false or nil, the Shoot's desired state is to be awaken.
  // +optional
  optional bool enabled = 1;

  // Schedules determine the hibernation schedules.
  // +optional
  repeated HibernationSchedule schedules = 2;
}

// HibernationSchedule determines the hibernation schedule of a Shoot.
// A Shoot will be regularly hibernated at each start time and will be woken up at each end time.
// Start or End can be omitted, though at least one of each has to be specified.
message HibernationSchedule {
  // Start is a Cron spec at which time a Shoot will be hibernated.
  // +optional
  optional string start = 1;

  // End is a Cron spec at which time a Shoot will be woken up.
  // +optional
  optional string end = 2;

  // Location is the time location in which both start and and shall be evaluated.
  // +optional
  optional string location = 3;
}

// HorizontalPodAutoscalerConfig contains horizontal pod autoscaler configuration settings for the kube-controller-manager.
// Note: Descriptions were taken from the Kubernetes documentation.
message HorizontalPodAutoscalerConfig {
  // The period after which a ready pod transition is considered to be the first.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration cpuInitializationPeriod = 1;

  // The period since last downscale, before another downscale can be performed in horizontal pod autoscaler.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration downscaleDelay = 2;

  // The configurable window at which the controller will choose the highest recommendation for autoscaling.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration downscaleStabilization = 3;

  // The configurable period at which the horizontal pod autoscaler considers a Pod “not yet ready” given that it’s unready and it has  transitioned to unready during that time.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration initialReadinessDelay = 4;

  // The period for syncing the number of pods in horizontal pod autoscaler.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration syncPeriod = 5;

  // The minimum change (from 1.0) in the desired-to-actual metrics ratio for the horizontal pod autoscaler to consider scaling.
  // +optional
  optional double tolerance = 6;

  // The period since last upscale, before another upscale can be performed in horizontal pod autoscaler.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration upscaleDelay = 7;
}

// KubeAPIServerConfig contains configuration settings for the kube-apiserver.
message KubeAPIServerConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // AdmissionPlugins contains the list of user-defined admission plugins (additional to those managed by Gardener), and, if desired, the corresponding
  // configuration.
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated AdmissionPlugin admissionPlugins = 2;

  // APIAudiences are the identifiers of the API. The service account token authenticator will
  // validate that tokens used against the API are bound to at least one of these audiences.
  // Defaults to ["kubernetes"].
  // +optional
  repeated string apiAudiences = 3;

  // AuditConfig contains configuration settings for the audit of the kube-apiserver.
  // +optional
  optional AuditConfig auditConfig = 4;

  // EnableBasicAuthentication defines whether basic authentication should be enabled for this cluster or not.
  // +optional
  optional bool enableBasicAuthentication = 5;

  // OIDCConfig contains configuration settings for the OIDC provider.
  // +optional
  optional OIDCConfig oidcConfig = 6;

  // RuntimeConfig contains information about enabled or disabled APIs.
  // +optional
  map<string, bool> runtimeConfig = 7;

  // ServiceAccountConfig contains configuration settings for the service account handling
  // of the kube-apiserver.
  // +optional
  optional ServiceAccountConfig serviceAccountConfig = 8;
}

// KubeControllerManagerConfig contains configuration settings for the kube-controller-manager.
message KubeControllerManagerConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // HorizontalPodAutoscalerConfig contains horizontal pod autoscaler configuration settings for the kube-controller-manager.
  // +optional
  optional HorizontalPodAutoscalerConfig horizontalPodAutoscaler = 2;

  // NodeCIDRMaskSize defines the mask size for node cidr in cluster (default is 24)
  // +optional
  optional int32 nodeCIDRMaskSize = 3;
}

// KubeProxyConfig contains configuration settings for the kube-proxy.
message KubeProxyConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // Mode specifies which proxy mode to use.
  // defaults to IPTables.
  // +optional
  optional string mode = 2;
}

// KubeSchedulerConfig contains configuration settings for the kube-scheduler.
message KubeSchedulerConfig {
  optional KubernetesConfig kubernetesConfig = 1;
}

// KubeletConfig contains configuration settings for the kubelet.
message KubeletConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // CPUCFSQuota allows you to disable/enable CPU throttling for Pods.
  // +optional
  optional bool cpuCFSQuota = 2;

  // CPUManagerPolicy allows to set alternative CPU management policies (default: none).
  // +optional
  optional string cpuManagerPolicy = 3;

  // EvictionHard describes a set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a Pod eviction.
  // +optional
  // Default:
  //   memory.available:   "100Mi/1Gi/5%"
  //   nodefs.available:   "5%"
  //   nodefs.inodesFree:  "5%"
  //   imagefs.available:  "5%"
  //   imagefs.inodesFree: "5%"
  optional KubeletConfigEviction evictionHard = 4;

  // EvictionMaxPodGracePeriod describes the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met.
  // +optional
  // Default: 90
  optional int32 evictionMaxPodGracePeriod = 5;

  // EvictionMinimumReclaim configures the amount of resources below the configured eviction threshold that the kubelet attempts to reclaim whenever the kubelet observes resource pressure.
  // +optional
  // Default: 0 for each resource
  optional KubeletConfigEvictionMinimumReclaim evictionMinimumReclaim = 6;

  // EvictionPressureTransitionPeriod is the duration for which the kubelet has to wait before transitioning out of an eviction pressure condition.
  // +optional
  // Default: 4m0s
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration evictionPressureTransitionPeriod = 7;

  // EvictionSoft describes a set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a Pod eviction.
  // +optional
  // Default:
  //   memory.available:   "200Mi/1.5Gi/10%"
  //   nodefs.available:   "10%"
  //   nodefs.inodesFree:  "10%"
  //   imagefs.available:  "10%"
  //   imagefs.inodesFree: "10%"
  optional KubeletConfigEviction evictionSoft = 8;

  // EvictionSoftGracePeriod describes a set of eviction grace periods (e.g. memory.available=1m30s) that correspond to how long a soft eviction threshold must hold before triggering a Pod eviction.
  // +optional
  // Default:
  //   memory.available:   1m30s
  //   nodefs.available:   1m30s
  //   nodefs.inodesFree:  1m30s
  //   imagefs.available:  1m30s
  //   imagefs.inodesFree: 1m30s
  optional KubeletConfigEvictionSoftGracePeriod evictionSoftGracePeriod = 9;

  // MaxPods is the maximum number of Pods that are allowed by the Kubelet.
  // +optional
  // Default: 110
  optional int32 maxPods = 10;

  // PodPIDsLimit is the maximum number of process IDs per pod allowed by the kubelet.
  // +optional
  optional int64 podPidsLimit = 11;

  // ImagePullProgressDeadline describes the time limit under which if no pulling progress is made, the image pulling will be cancelled.
  // +optional
  // Default: 1m
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration imagePullProgressDeadline = 12;
}

// KubeletConfigEviction contains kubelet eviction thresholds supporting either a resource.Quantity or a percentage based value.
message KubeletConfigEviction {
  // MemoryAvailable is the threshold for the free memory on the host server.
  // +optional
  optional string memoryAvailable = 1;

  // ImageFSAvailable is the threshold for the free disk space in the imagefs filesystem (docker images and container writable layers).
  // +optional
  optional string imageFSAvailable = 2;

  // ImageFSInodesFree is the threshold for the available inodes in the imagefs filesystem.
  // +optional
  optional string imageFSInodesFree = 3;

  // NodeFSAvailable is the threshold for the free disk space in the nodefs filesystem (docker volumes, logs, etc).
  // +optional
  optional string nodeFSAvailable = 4;

  // NodeFSInodesFree is the threshold for the available inodes in the nodefs filesystem.
  // +optional
  optional string nodeFSInodesFree = 5;
}

// KubeletConfigEvictionMinimumReclaim contains configuration for the kubelet eviction minimum reclaim.
message KubeletConfigEvictionMinimumReclaim {
  // MemoryAvailable is the threshold for the memory reclaim on the host server.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity memoryAvailable = 1;

  // ImageFSAvailable is the threshold for the disk space reclaim in the imagefs filesystem (docker images and container writable layers).
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity imageFSAvailable = 2;

  // ImageFSInodesFree is the threshold for the inodes reclaim in the imagefs filesystem.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity imageFSInodesFree = 3;

  // NodeFSAvailable is the threshold for the disk space reclaim in the nodefs filesystem (docker volumes, logs, etc).
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity nodeFSAvailable = 4;

  // NodeFSInodesFree is the threshold for the inodes reclaim in the nodefs filesystem.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity nodeFSInodesFree = 5;
}

// KubeletConfigEvictionSoftGracePeriod contains grace periods for kubelet eviction thresholds.
message KubeletConfigEvictionSoftGracePeriod {
  // MemoryAvailable is the grace period for the MemoryAvailable eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration memoryAvailable = 1;

  // ImageFSAvailable is the grace period for the ImageFSAvailable eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration imageFSAvailable = 2;

  // ImageFSInodesFree is the grace period for the ImageFSInodesFree eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration imageFSInodesFree = 3;

  // NodeFSAvailable is the grace period for the NodeFSAvailable eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration nodeFSAvailable = 4;

  // NodeFSInodesFree is the grace period for the NodeFSInodesFree eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration nodeFSInodesFree = 5;
}

// Kubernetes contains the version and configuration variables for the Shoot control plane.
message Kubernetes {
  // AllowPrivilegedContainers indicates whether privileged containers are allowed in the Shoot (default: true).
  // +optional
  optional bool allowPrivilegedContainers = 1;

  // ClusterAutoscaler contains the configration flags for the Kubernetes cluster autoscaler.
  // +optional
  optional ClusterAutoscaler clusterAutoscaler = 2;

  // KubeAPIServer contains configuration settings for the kube-apiserver.
  // +optional
  optional KubeAPIServerConfig kubeAPIServer = 3;

  // KubeControllerManager contains configuration settings for the kube-controller-manager.
  // +optional
  optional KubeControllerManagerConfig kubeControllerManager = 4;

  // KubeScheduler contains configuration settings for the kube-scheduler.
  // +optional
  optional KubeSchedulerConfig kubeScheduler = 5;

  // KubeProxy contains configuration settings for the kube-proxy.
  // +optional
  optional KubeProxyConfig kubeProxy = 6;

  // Kubelet contains configuration settings for the kubelet.
  // +optional
  optional KubeletConfig kubelet = 7;

  // Version is the semantic Kubernetes version to use for the Shoot cluster.
  optional string version = 8;
}

// KubernetesConfig contains common configuration fields for the control plane components.
message KubernetesConfig {
  // FeatureGates contains information about enabled feature gates.
  // +optional
  map<string, bool> featureGates = 1;
}

// KubernetesDashboard describes configuration values for the kubernetes-dashboard addon.
message KubernetesDashboard {
  optional Addon addon = 2;

  // AuthenticationMode defines the authentication mode for the kubernetes-dashboard.
  // +optional
  optional string authenticationMode = 1;
}

// KubernetesInfo contains the version and configuration variables for the Plant cluster.
message KubernetesInfo {
  // Version is the semantic Kubernetes version to use for the Plant cluster.
  optional string version = 1;
}

// KubernetesSettings contains constraints regarding allowed values of the 'kubernetes' block in the Shoot specification.
message KubernetesSettings {
  // Versions is the list of allowed Kubernetes versions with optional expiration dates for Shoot clusters.
  // +patchMergeKey=version
  // +patchStrategy=merge
  // +optional
  repeated ExpirableVersion versions = 1;
}

// LastError indicates the last occurred error for an operation on a resource.
message LastError {
  // A human readable message indicating details about the last error.
  optional string description = 1;

  // ID of the task which caused this last error
  // +optional
  optional string taskID = 2;

  // Well-defined error codes of the last error(s).
  // +optional
  repeated string codes = 3;

  // Last time the error was reported
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 4;
}

// LastOperation indicates the type and the state of the last operation, along with a description
// message and a progress indicator.
message LastOperation {
  // A human readable message indicating details about the last operation.
  optional string description = 1;

  // Last time the operation state transitioned from one to another.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 2;

  // The progress in percentage (0-100) of the last operation.
  optional int32 progress = 3;

  // Status of the last operation, one of Aborted, Processing, Succeeded, Error, Failed.
  optional string state = 4;

  // Type of the last operation, one of Create, Reconcile, Delete.
  optional string type = 5;
}

// Machine contains information about the machine type and image.
message Machine {
  // Type is the machine type of the worker group.
  optional string type = 1;

  // Image holds information about the machine image to use for all nodes of this pool. It will default to the
  // latest version of the first image stated in the referenced CloudProfile if no value has been provided.
  // +optional
  optional ShootMachineImage image = 2;
}

// MachineImage defines the name and multiple versions of the machine image in any environment.
message MachineImage {
  // Name is the name of the image.
  optional string name = 1;

  // Versions contains versions and expiration dates of the machine image
  // +patchMergeKey=version
  // +patchStrategy=merge
  repeated ExpirableVersion versions = 2;
}

// MachineType contains certain properties of a machine type.
message MachineType {
  // CPU is the number of CPUs for this machine type.
  optional k8s.io.apimachinery.pkg.api.resource.Quantity cpu = 1;

  // GPU is the number of GPUs for this machine type.
  optional k8s.io.apimachinery.pkg.api.resource.Quantity gpu = 2;

  // Memory is the amount of memory for this machine type.
  optional k8s.io.apimachinery.pkg.api.resource.Quantity memory = 3;

  // Name is the name of the machine type.
  optional string name = 4;

  // Storage is the amount of storage associated with the root volume of this machine type.
  // +optional
  optional MachineTypeStorage storage = 5;

  // Usable defines if the machine type can be used for shoot clusters.
  // +optional
  optional bool usable = 6;
}

// MachineTypeStorage is the amount of storage associated with the root volume of this machine type.
message MachineTypeStorage {
  // Class is the class of the storage type.
  optional string class = 1;

  // StorageSize is the storage size.
  optional k8s.io.apimachinery.pkg.api.resource.Quantity size = 2;

  // Type is the type of the storage.
  optional string type = 3;
}

// Maintenance contains information about the time window for maintenance operations and which
// operations should be performed.
message Maintenance {
  // AutoUpdate contains information about which constraints should be automatically updated.
  // +optional
  optional MaintenanceAutoUpdate autoUpdate = 1;

  // TimeWindow contains information about the time window for maintenance operations.
  // +optional
  optional MaintenanceTimeWindow timeWindow = 2;

  // ConfineSpecUpdateRollout prevents that changes/updates to the shoot specification will be rolled out immediately.
  // Instead, they are rolled out during the shoot's maintenance time window. There is one exception that will trigger
  // an immediate roll out which is changes to the Spec.Hibernation.Enabled field.
  // +optional
  optional bool confineSpecUpdateRollout = 3;
}

// MaintenanceAutoUpdate contains information about which constraints should be automatically updated.
message MaintenanceAutoUpdate {
  // KubernetesVersion indicates whether the patch Kubernetes version may be automatically updated (default: true).
  optional bool kubernetesVersion = 1;

  // MachineImageVersion indicates whether the machine image version may be automatically updated (default: true).
  optional bool machineImageVersion = 2;
}

// MaintenanceTimeWindow contains information about the time window for maintenance operations.
message MaintenanceTimeWindow {
  // Begin is the beginning of the time window in the format HHMMSS+ZONE, e.g. "220000+0100".
  // If not present, a random value will be computed.
  optional string begin = 1;

  // End is the end of the time window in the format HHMMSS+ZONE, e.g. "220000+0100".
  // If not present, the value will be computed based on the "Begin" value.
  optional string end = 2;
}

// Monitoring contains information about the monitoring configuration for the shoot.
message Monitoring {
  // Alerting contains information about the alerting configuration for the shoot cluster.
  // +optional
  optional Alerting alerting = 1;
}

// Networking defines networking parameters for the shoot cluster.
message Networking {
  // Type identifies the type of the networking plugin.
  optional string type = 1;

  // ProviderConfig is the configuration passed to network resource.
  // +optional
  optional ProviderConfig providerConfig = 2;

  // Pods is the CIDR of the pod network.
  // +optional
  optional string pods = 3;

  // Nodes is the CIDR of the entire node network.
  // +optional
  optional string nodes = 4;

  // Services is the CIDR of the service network.
  // +optional
  optional string services = 5;
}

// NginxIngress describes configuration values for the nginx-ingress addon.
message NginxIngress {
  optional Addon addon = 4;

  // LoadBalancerSourceRanges is list of whitelist IP sources for NginxIngress
  // +optional
  repeated string loadBalancerSourceRanges = 1;

  // Config contains custom configuration for the nginx-ingress-controller configuration.
  // See https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/configmap.md#configuration-options
  // +optional
  map<string, string> config = 2;

  // ExternalTrafficPolicy controls the `.spec.externalTrafficPolicy` value of the load balancer `Service`
  // exposing the nginx-ingress. Defaults to `Cluster`.
  // +optional
  optional string externalTrafficPolicy = 3;
}

// OIDCConfig contains configuration settings for the OIDC provider.
// Note: Descriptions were taken from the Kubernetes documentation.
message OIDCConfig {
  // If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used.
  // +optional
  optional string caBundle = 1;

  // ClientAuthentication can optionally contain client configuration used for kubeconfig generation.
  // +optional
  optional OpenIDConnectClientAuthentication clientAuthentication = 2;

  // The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
  // +optional
  optional string clientID = 3;

  // If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be a string or array of strings. This flag is experimental, please see the authentication documentation for further details.
  // +optional
  optional string groupsClaim = 4;

  // If provided, all groups will be prefixed with this value to prevent conflicts with other authentication strategies.
  // +optional
  optional string groupsPrefix = 5;

  // The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT).
  // +optional
  optional string issuerURL = 6;

  // ATTENTION: Only meaningful for Kubernetes >= 1.11
  // key=value pairs that describes a required claim in the ID Token. If set, the claim is verified to be present in the ID Token with a matching value.
  // +optional
  map<string, string> requiredClaims = 7;

  // List of allowed JOSE asymmetric signing algorithms. JWTs with a 'alg' header value not in this list will be rejected. Values are defined by RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1
  // +optional
  repeated string signingAlgs = 8;

  // The OpenID claim to use as the user name. Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. This flag is experimental, please see the authentication documentation for further details. (default "sub")
  // +optional
  optional string usernameClaim = 9;

  // If provided, all usernames will be prefixed with this value. If not provided, username claims other than 'email' are prefixed by the issuer URL to avoid clashes. To skip any prefixing, provide the value '-'.
  // +optional
  optional string usernamePrefix = 10;
}

// OpenIDConnectClientAuthentication contains configuration for OIDC clients.
message OpenIDConnectClientAuthentication {
  // Extra configuration added to kubeconfig's auth-provider.
  // Must not be any of idp-issuer-url, client-id, client-secret, idp-certificate-authority, idp-certificate-authority-data, id-token or refresh-token
  // +optional
  map<string, string> extraConfig = 1;

  // The client Secret for the OpenID Connect client.
  // +optional
  optional string secret = 2;
}

message Plant {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of this Plant.
  optional PlantSpec spec = 2;

  // Status contains the status of this Plant.
  optional PlantStatus status = 3;
}

// PlantList is a collection of Plants.
message PlantList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Plants.
  repeated Plant items = 2;
}

// PlantSpec is the specification of a Plant.
message PlantSpec {
  // SecretRef is a reference to a Secret object containing the Kubeconfig of the external kubernetes
  // clusters to be added to Gardener.
  optional k8s.io.api.core.v1.LocalObjectReference secretRef = 1;

  // Endpoints is the configuration plant endpoints
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated Endpoint endpoints = 2;
}

// PlantStatus is the status of a Plant.
message PlantStatus {
  // Conditions represents the latest available observations of a Plant's current state.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated Condition conditions = 1;

  // ObservedGeneration is the most recent generation observed for this Plant. It corresponds to the
  // Plant's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 2;

  // ClusterInfo is additional computed information about the newly added cluster (Plant)
  optional ClusterInfo clusterInfo = 3;
}

// Project holds certain properties about a Gardener project.
message Project {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec defines the project properties.
  // +optional
  optional ProjectSpec spec = 2;

  // Most recently observed status of the Project.
  // +optional
  optional ProjectStatus status = 3;
}

// ProjectList is a collection of Projects.
message ProjectList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Projects.
  repeated Project items = 2;
}

// ProjectMember is a member of a project.
message ProjectMember {
  // Subject is representing a user name, an email address, or any other identifier of a user, group, or service
  // account that has a certain role.
  optional k8s.io.api.rbac.v1.Subject subject = 1;

  // Role represents the role of this member.
  // IMPORTANT: Be aware that this field will be removed in the `v1` version of this API in favor of the `roles`
  // list.
  // TODO: Remove this field in favor of the `owner` role in `v1`.
  optional string role = 2;

  // Roles represents the list of roles of this member.
  // +optional
  repeated string roles = 3;
}

// ProjectSpec is the specification of a Project.
message ProjectSpec {
  // CreatedBy is a subject representing a user name, an email address, or any other identifier of a user
  // who created the project.
  // +optional
  optional k8s.io.api.rbac.v1.Subject createdBy = 1;

  // Description is a human-readable description of what the project is used for.
  // +optional
  optional string description = 2;

  // Owner is a subject representing a user name, an email address, or any other identifier of a user owning
  // the project.
  // IMPORTANT: Be aware that this field will be removed in the `v1` version of this API in favor of the `owner`
  // role. The only way to change the owner will be by moving the `owner` role. In this API version the only way
  // to change the owner is to use this field.
  // +optional
  // TODO: Remove this field in favor of the `owner` role in `v1`.
  optional k8s.io.api.rbac.v1.Subject owner = 3;

  // Purpose is a human-readable explanation of the project's purpose.
  // +optional
  optional string purpose = 4;

  // Members is a list of subjects representing a user name, an email address, or any other identifier of a user,
  // group, or service account that has a certain role.
  // +optional
  repeated ProjectMember members = 5;

  // Namespace is the name of the namespace that has been created for the Project object.
  // A nil value means that Gardener will determine the name of the namespace.
  // +optional
  optional string namespace = 6;
}

// ProjectStatus holds the most recently observed status of the project.
message ProjectStatus {
  // ObservedGeneration is the most recent generation observed for this project.
  // +optional
  optional int64 observedGeneration = 1;

  // Phase is the current phase of the project.
  optional string phase = 2;
}

// Provider contains provider-specific information that are handed-over to the provider-specific
// extension controller.
message Provider {
  // Type is the type of the provider.
  optional string type = 1;

  // ControlPlaneConfig contains the provider-specific control plane config blob. Please look up the concrete
  // definition in the documentation of your provider extension.
  // +optional
  optional ProviderConfig controlPlaneConfig = 2;

  // InfrastructureConfig contains the provider-specific infrastructure config blob. Please look up the concrete
  // definition in the documentation of your provider extension.
  // +optional
  optional ProviderConfig infrastructureConfig = 3;

  // Workers is a list of worker groups.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated Worker workers = 4;
}

// ProviderConfig is a workaround for missing OpenAPI functions on runtime.RawExtension struct.
// https://github.com/kubernetes/kubernetes/issues/55890
// https://github.com/kubernetes-sigs/cluster-api/issues/137
message ProviderConfig {
  optional k8s.io.apimachinery.pkg.runtime.RawExtension rawExtension = 1;
}

message Quota {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec defines the Quota constraints.
  // +optional
  optional QuotaSpec spec = 2;
}

// QuotaList is a collection of Quotas.
message QuotaList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Quotas.
  repeated Quota items = 2;
}

// QuotaSpec is the specification of a Quota.
message QuotaSpec {
  // ClusterLifetimeDays is the lifetime of a Shoot cluster in days before it will be terminated automatically.
  // +optional
  optional int32 clusterLifetimeDays = 1;

  // Metrics is a list of resources which will be put under constraints.
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> metrics = 2;

  // Scope is the scope of the Quota object, either 'project' or 'secret'.
  optional k8s.io.api.core.v1.ObjectReference scope = 3;
}

// Region contains certain properties of a region.
message Region {
  // Name is a region name.
  optional string name = 1;

  // Zones is a list of availability zones in this region.
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated AvailabilityZone zones = 2;
}

message SecretBinding {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // SecretRef is a reference to a secret object in the same or another namespace.
  optional k8s.io.api.core.v1.SecretReference secretRef = 2;

  // Quotas is a list of references to Quota objects in the same or another namespace.
  // +optional
  repeated k8s.io.api.core.v1.ObjectReference quotas = 3;
}

// SecretBindingList is a collection of SecretBindings.
message SecretBindingList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of SecretBindings.
  repeated SecretBinding items = 2;
}

// Seed represents an installation request for an external controller.
message Seed {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of this installation.
  optional SeedSpec spec = 2;

  // Status contains the status of this installation.
  optional SeedStatus status = 3;
}

// SeedBackup contains the object store configuration for backups for shoot (currently only etcd).
message SeedBackup {
  // Provider is a provider name.
  optional string provider = 1;

  // ProviderConfig is the configuration passed to BackupBucket resource.
  // +optional
  optional ProviderConfig providerConfig = 2;

  // Region is a region name.
  // +optional
  optional string region = 3;

  // SecretRef is a reference to a Secret object containing the cloud provider credentials for
  // the object store where backups should be stored. It should have enough privileges to manipulate
  // the objects as well as buckets.
  optional k8s.io.api.core.v1.SecretReference secretRef = 4;
}

// SeedDNS contains DNS-relevant information about this seed cluster.
message SeedDNS {
  // IngressDomain is the domain of the Seed cluster pointing to the ingress controller endpoint. It will be used
  // to construct ingress URLs for system applications running in Shoot clusters.
  optional string ingressDomain = 1;
}

// SeedList is a collection of Seeds.
message SeedList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Seeds.
  repeated Seed items = 2;
}

// SeedNetworks contains CIDRs for the pod, service and node networks of a Kubernetes cluster.
message SeedNetworks {
  // Nodes is the CIDR of the node network.
  // +optional
  optional string nodes = 1;

  // Pods is the CIDR of the pod network.
  optional string pods = 2;

  // Services is the CIDR of the service network.
  optional string services = 3;

  // ShootDefaults contains the default networks CIDRs for shoots.
  // +optional
  optional ShootNetworks shootDefaults = 4;
}

// SeedProvider defines the provider type and region for this Seed cluster.
message SeedProvider {
  // Type is the name of the provider.
  optional string type = 1;

  // ProviderConfig is the configuration passed to Seed resource.
  // +optional
  optional ProviderConfig providerConfig = 2;

  // Region is a name of a region.
  optional string region = 3;
}

// SeedSpec is the specification of a Seed.
message SeedSpec {
  // Backup holds the object store configuration for the backups of shoot (currently only etcd).
  // If it is not specified, then there won't be any backups taken for shoots associated with this seed.
  // If backup field is present in seed, then backups of the etcd from shoot control plane will be stored
  // under the configured object store.
  // +optional
  optional SeedBackup backup = 1;

  // BlockCIDRs is a list of network addresses that should be blocked for shoot control plane components running
  // in the seed cluster.
  // +optional
  repeated string blockCIDRs = 2;

  // DNS contains DNS-relevant information about this seed cluster.
  optional SeedDNS dns = 3;

  // Networks defines the pod, service and worker network of the Seed cluster.
  optional SeedNetworks networks = 4;

  // Provider defines the provider type and region for this Seed cluster.
  optional SeedProvider provider = 5;

  // SecretRef is a reference to a Secret object containing the Kubeconfig and the cloud provider credentials for
  // the account the Seed cluster has been deployed to.
  // +optional
  optional k8s.io.api.core.v1.SecretReference secretRef = 6;

  // Taints describes taints on the seed.
  // +optional
  repeated SeedTaint taints = 7;

  // Volume contains settings for persistentvolumes created in the seed cluster.
  // +optional
  optional SeedVolume volume = 8;
}

// SeedStatus is the status of a Seed.
message SeedStatus {
  // Conditions represents the latest available observations of a Seed's current state.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated Condition conditions = 1;

  // Gardener holds information about the Gardener instance which last acted on the Seed.
  // +optional
  optional Gardener gardener = 2;

  // KubernetesVersion is the Kubernetes version of the seed cluster.
  // +optional
  optional string kubernetesVersion = 3;

  // ObservedGeneration is the most recent generation observed for this Seed. It corresponds to the
  // Seed's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 4;
}

// SeedTaint describes a taint on a seed.
message SeedTaint {
  // Key is the taint key to be applied to a seed.
  optional string key = 1;

  // Value is the taint value corresponding to the taint key.
  // +optional
  optional string value = 2;
}

// SeedVolume contains settings for persistentvolumes created in the seed cluster.
message SeedVolume {
  // MinimumSize defines the minimum size that should be used for PVCs in the seed.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity minimumSize = 1;

  // Providers is a list of storage class provisioner types for the seed.
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated SeedVolumeProvider providers = 2;
}

// SeedVolumeProvider is a storage class provisioner type.
message SeedVolumeProvider {
  // Purpose is the purpose of this provider.
  optional string purpose = 1;

  // Name is the name of the storage class provisioner type.
  optional string name = 2;
}

// ServiceAccountConfig is the kube-apiserver configuration for service accounts.
message ServiceAccountConfig {
  // Issuer is the identifier of the service account token issuer. The issuer will assert this
  // identifier in "iss" claim of issued tokens. This value is a string or URI.
  // Defaults to URI of the API server.
  // +optional
  optional string issuer = 1;

  // SigningKeySecret is a reference to a secret that contains an optional private key of the
  // service account token issuer. The issuer will sign issued ID tokens with this private key.
  // Only useful if service account tokens are also issued by another external system.
  // +optional
  optional k8s.io.api.core.v1.LocalObjectReference signingKeySecretName = 2;
}

message Shoot {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Specification of the Shoot cluster.
  // +optional
  optional ShootSpec spec = 2;

  // Most recently observed status of the Shoot cluster.
  // +optional
  optional ShootStatus status = 3;
}

// ShootList is a list of Shoot objects.
message ShootList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Shoots.
  repeated Shoot items = 2;
}

// ShootMachineImage defines the name and the version of the shoot's machine image in any environment. Has to be
// defined in the respective CloudProfile.
message ShootMachineImage {
  // Name is the name of the image.
  optional string name = 1;

  // ProviderConfig is the shoot's individual configuration passed to an extension resource.
  // +optional
  optional ProviderConfig providerConfig = 2;

  // Version is the version of the shoot's image.
  // If version is not provided, it will be defaulted to the latest version from the CloudProfile.
  // +optional
  optional string version = 3;
}

// ShootNetworks contains the default networks CIDRs for shoots.
message ShootNetworks {
  // Pods is the CIDR of the pod network.
  // +optional
  optional string pods = 1;

  // Services is the CIDR of the service network.
  // +optional
  optional string services = 2;
}

// ShootSpec is the specification of a Shoot.
message ShootSpec {
  // Addons contains information about enabled/disabled addons and their configuration.
  // +optional
  optional Addons addons = 1;

  // CloudProfileName is a name of a CloudProfile object.
  optional string cloudProfileName = 2;

  // DNS contains information about the DNS settings of the Shoot.
  // +optional
  optional DNS dns = 3;

  // Extensions contain type and provider information for Shoot extensions.
  // +optional
  repeated Extension extensions = 4;

  // Hibernation contains information whether the Shoot is suspended or not.
  // +optional
  optional Hibernation hibernation = 5;

  // Kubernetes contains the version and configuration settings of the control plane components.
  optional Kubernetes kubernetes = 6;

  // Networking contains information about cluster networking such as CNI Plugin type, CIDRs, ...etc.
  optional Networking networking = 7;

  // Maintenance contains information about the time window for maintenance operations and which
  // operations should be performed.
  // +optional
  optional Maintenance maintenance = 8;

  // Monitoring contains information about custom monitoring configurations for the shoot.
  // +optional
  optional Monitoring monitoring = 9;

  // Provider contains all provider-specific and provider-relevant information.
  optional Provider provider = 10;

  // Purpose is the purpose class for this cluster.
  // +optional
  optional string purpose = 11;

  // Region is a name of a region.
  optional string region = 12;

  // SecretBindingName is the name of the a SecretBinding that has a reference to the provider secret.
  // The credentials inside the provider secret will be used to create the shoot in the respective account.
  optional string secretBindingName = 13;

  // SeedName is the name of the seed cluster that runs the control plane of the Shoot.
  // +optional
  optional string seedName = 14;

  // LoadBalancerSourceRanges is the loadBalancerSourceRange of shoot apiserver
  // +optional
  repeated string loadBalancerSourceRanges = 15;
}

// ShootState contains a snapshot of the Shoot's state required to migrate the Shoot's control plane to a new Seed.
message ShootState {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Specification of the ShootState.
  // +optional
  optional ShootStateSpec spec = 2;
}

// ShootStateList is a list of ShootState objects.
message ShootStateList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of ShootStates.
  repeated ShootState items = 2;
}

// ShootStateSpec is the specification of the ShootState.
message ShootStateSpec {
  // Gardener holds the data required to generate resources deployed by the gardenlet
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated GardenerResourceData gardener = 1;

  // Extensions holds the state of custom resources reconciled by extension controllers in the seed
  // +optional
  repeated ExtensionResourceState extensions = 2;
}

// ShootStatus holds the most recently observed status of the Shoot cluster.
message ShootStatus {
  // Conditions represents the latest available observations of a Shoots's current state.
  // +optional
  // +patchMergeKey=type
  // +patchStrategy=merge
  repeated Condition conditions = 1;

  // Constraints represents conditions of a Shoot's current state that constraint some operations on it.
  // +optional
  // +patchMergeKey=type
  // +patchStrategy=merge
  repeated Condition constraints = 2;

  // Gardener holds information about the Gardener which last acted on the Shoot.
  optional Gardener gardener = 3;

  // IsHibernated indicates whether the Shoot is currently hibernated.
  optional bool hibernated = 4;

  // LastOperation holds information about the last operation on the Shoot.
  // +optional
  optional LastOperation lastOperation = 5;

  // LastError holds information about the last occurred error during an operation.
  // +optional
  optional LastError lastError = 6;

  // LastErrors holds information about the last occurred error(s) during an operation.
  // +optional
  repeated LastError lastErrors = 7;

  // ObservedGeneration is the most recent generation observed for this Shoot. It corresponds to the
  // Shoot's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 8;

  // RetryCycleStartTime is the start time of the last retry cycle (used to determine how often an operation
  // must be retried until we give up).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time retryCycleStartTime = 9;

  // Seed is the name of the seed cluster that runs the control plane of the Shoot. This value is only written
  // after a successful create/reconcile operation. It will be used when control planes are moved between Seeds.
  // +optional
  optional string seed = 10;

  // TechnicalID is the name that is used for creating the Seed namespace, the infrastructure resources, and
  // basically everything that is related to this particular Shoot.
  optional string technicalID = 11;

  // UID is a unique identifier for the Shoot cluster to avoid portability between Kubernetes clusters.
  // It is used to compute unique hashes.
  optional string uid = 12;

  // InfrastructureProviderStatus is a raw extension field that contains the provider status that has
  // been generated by the controller responsible for the `Infrastructure` resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension infrastructureProviderStatus = 13;
}

// Volume contains information about the volume type and size.
message Volume {
  // Name of the volume to make it referencable.
  // +optional
  optional string name = 1;

  // Type is the type of the volume.
  // +optional
  optional string type = 2;

  // Size is the size of the volume.
  optional string size = 3;

  // Encrypted determines if the volume should be encrypted.
  // +optional
  optional bool primary = 4;
}

// VolumeType contains certain properties of a volume type.
message VolumeType {
  // Class is the class of the volume type.
  optional string class = 1;

  // Name is the name of the volume type.
  optional string name = 2;

  // Usable defines if the volume type can be used for shoot clusters.
  // +optional
  optional bool usable = 3;
}

// Worker is the base definition of a worker group.
message Worker {
  // Annotations is a map of key/value pairs for annotations for all the `Node` objects in this worker pool.
  // +optional
  map<string, string> annotations = 1;

  // CABundle is a certificate bundle which will be installed onto every machine of this worker pool.
  // +optional
  optional string caBundle = 2;

  // CRI contains configurations of CRI support of every machine in the worker pool
  // +optional
  optional CRI cri = 3;

  // Kubernetes contains configuration for Kubernetes components related to this worker pool.
  // +optional
  optional WorkerKubernetes kubernetes = 4;

  // Labels is a map of key/value pairs for labels for all the `Node` objects in this worker pool.
  // +optional
  map<string, string> labels = 5;

  // Name is the name of the worker group.
  optional string name = 6;

  // Machine contains information about the machine type and image.
  optional Machine machine = 7;

  // Maximum is the maximum number of VMs to create.
  optional int32 maximum = 8;

  // Minimum is the minimum number of VMs to create.
  optional int32 minimum = 9;

  // MaxSurge is maximum number of VMs that are created during an update.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxSurge = 10;

  // MaxUnavailable is the maximum number of VMs that can be unavailable during an update.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxUnavailable = 11;

  // ProviderConfig is the provider-specific configuration for this worker pool.
  // +optional
  optional ProviderConfig providerConfig = 12;

  // Taints is a list of taints for all the `Node` objects in this worker pool.
  // +optional
  repeated k8s.io.api.core.v1.Taint taints = 13;

  // Volume contains information about the volume type and size.
  // +optional
  optional Volume volume = 14;

  // DataVolumes contains a list of additional worker volumes.
  // +optional
  repeated Volume dataVolumes = 15;

  // KubeletDataVolumeName contains the name of a dataVolume that should be used for storing kubelet state.
  // +optional
  optional string kubeletDataVolumeName = 16;

  // Zones is a list of availability zones that are used to evenly distribute this worker pool. Optional
  // as not every provider may support availability zones.
  // +optional
  repeated string zones = 17;
}

// WorkerKubernetes contains configuration for Kubernetes components related to this worker pool.
message WorkerKubernetes {
  // Kubelet contains configuration settings for all kubelets of this worker pool.
  // +optional
  optional KubeletConfig kubelet = 1;
}