fix: oidc auth url (#63)

The Renovate config in this repository needs migrating. Typically this
is because one or more configuration options you are using have been
renamed.

You don't need to merge this PR right away, because Renovate will
continue to migrate these fields internally each time it runs. But later
some of these fields may be fully deprecated and the migrations removed.
So it's a good idea to merge this migration PR soon.



#### [PLEASE
NOTE](https://docs.renovatebot.com/configuration-options#configmigration):
JSON5 config file migrated! All comments & trailing commas were removed.

🔕 **Ignore**: Close this PR and you won't be reminded about config
migration again, but one day your current config may no longer be valid.

❓ Got questions? Does something look wrong to you? Please don't hesitate
to [request help
here](https://redirect.github.com/renovatebot/renovate/discussions).


---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

Co-authored-by: Renovate Bot <renovate@whitesourcesoftware.com>

.github/workflows/main.yml

@@ -27,9 +27,9 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "${{ env.NODE_VERSION }}"
           registry-url: "${{ env.NODE_REGISTRY }}"
@@ -55,10 +55,12 @@ jobs:
 
       - name: Install dependencies
         run: pnpm install
+        working-directory: images/operator
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Run tests
+        working-directory: images/operator
         run: pnpm test
 
   update-release-draft:
@@ -71,9 +73,23 @@ jobs:
     environment: release
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v6
+      - id: create-release
+        uses: release-drafter/release-drafter@v6
         with:
           config-name: release-drafter-config.yml
           publish: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/checkout@v5
+
+      - name: Upload Release Asset
+        id: upload-release-asset
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ steps.create-release.outputs.upload_url }}
+          asset_path: ./operator.yaml
+          asset_name: operator.yaml
+          asset_content_type: application/yaml

.github/workflows/publish-backup-tag.yml

@@ -0,0 +1,65 @@
+name: Publish tag
+
+on:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+
+env:
+  environment: test
+  release_channel: latest
+  DO_NOT_TRACK: "1"
+  NODE_VERSION: "23.x"
+  DOCKER_REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}-backup
+  PNPM_VERSION: 10.6.0
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  release:
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      pages: write
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@032a4b3bda1b716928481836ac5bfe36e1feaad6
+        with:
+          images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@cb8fc7586f9ad9441b20c33e0f6e8b1b58d8b4c6
+        with:
+          context: ./images/backup
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.github/workflows/publish-tag.yml

@@ -3,7 +3,7 @@ name: Publish tag
 on:
   push:
     branches:
-      - 'main'
+      - "main"
     tags:
       - "v*"
 
@@ -31,12 +31,12 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
         with:
           registry: ${{ env.DOCKER_REGISTRY }}
           username: ${{ github.actor }}
@@ -44,21 +44,21 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        uses: docker/metadata-action@032a4b3bda1b716928481836ac5bfe36e1feaad6
         with:
           images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action@cb8fc7586f9ad9441b20c33e0f6e8b1b58d8b4c6
         with:
-          context: .
+          context: ./images/operator
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
           subject-digest: ${{ steps.push.outputs.digest }}

.github/workflows/renovate.yml

@@ -0,0 +1,16 @@
+name: Renovate
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 */6 * * *"
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v43.0.13
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          configurationFile: ./renovate.json5

.gitignore

@@ -1,34 +1,4 @@
-# dependencies (bun install)
-node_modules
-
-# output
-out
-dist
-*.tgz
-
-# code coverage
-coverage
-*.lcov
-
-# logs
-logs
-_.log
-report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
-
-# dotenv environment variable files
-.env
-.env.development.local
-.env.test.local
-.env.production.local
-.env.local
-
-# caches
-.eslintcache
-.cache
-*.tsbuildinfo
-
-# IntelliJ based IDEs
-.idea
-
-# Finder (MacOS) folder config
-.DS_Store
+/secret.*.yaml
+/data/
+/.envrc
+*.DS_Store

Dockerfile

@@ -1,6 +0,0 @@
-FROM node:23-alpine
-RUN corepack enable
-COPY package.json pnpm-lock.yaml ./
-RUN pnpm install --frozen-lockfile --prod
-COPY . .
-CMD ["node", "src/index.ts"]

Makefile

@@ -0,0 +1,14 @@
+.PHONY: dev-recreate dev-destroy server-install
+
+dev-destroy:
+	colima delete -f
+
+dev-recreate: dev-destroy
+	colima start --network-address --kubernetes -m 8 --k3s-arg="--disable helm-controller,local-storage,traefik --docker" # --mount ${PWD}/data:/data:w 
+	flux install --components="source-controller,helm-controller"
+
+setup-flux:
+	flux install --components="source-controller,helm-controller"
+
+server-install:
+	curl -sfL https://get.k3s.io | sh -s - --disable traefik,local-storage,helm-controller

README.md

@@ -1,282 +0,0 @@
-# homelab-operator
-
-A Kubernetes operator designed for homelab environments that simplifies the
-management of PostgreSQL databases and Kubernetes secrets. Built with TypeScript
-and designed to run efficiently in resource-constrained environments.
-
-## Features
-
-- **PostgreSQL Database Management**: Automatically create and manage PostgreSQL
-  databases and roles
-- **Secret Management**: Generate and manage Kubernetes secrets with
-  configurable data
-- **Owner References**: Automatic cleanup when resources are deleted
-- **Status Tracking**: Comprehensive status conditions and error reporting
-- **Lightweight**: Minimal resource footprint suitable for homelab environments
-
-## Architecture
-
-The operator manages two main Custom Resource Definitions (CRDs):
-
-### PostgresDatabase
-
-Manages PostgreSQL databases and their associated roles:
-
-- Creates a PostgreSQL role with a secure random password
-- Creates a database owned by that role
-- Generates a Kubernetes secret containing database credentials
-- Ensures proper cleanup through owner references
-
-### SecretRequest
-
-Generates Kubernetes secrets with configurable data:
-
-- Supports custom secret names
-- Configurable data fields with various encodings
-- Automatic secret lifecycle management
-
-## Installation
-
-### Prerequisites
-
-- Kubernetes cluster (1.20+)
-- PostgreSQL instance accessible from the cluster
-- Helm 3.x (for chart-based installation)
-
-### Using Helm Chart
-
-1. Clone the repository:
-
-```bash
-git clone <repository-url>
-cd homelab-operator
-```
-
-2. Install using Helm:
-
-```bash
-helm install homelab-operator ./chart \
-  --set-string env.POSTGRES_HOST=<your-postgres-host> \
-  --set-string env.POSTGRES_USER=<admin-user> \
-  --set-string env.POSTGRES_PASSWORD=<admin-password>
-```
-
-### Using kubectl
-
-1. Build and push the Docker image:
-
-```bash
-docker build -t your-registry/homelab-operator:latest .
-docker push your-registry/homelab-operator:latest
-```
-
-2. Apply the Kubernetes manifests:
-
-```bash
-kubectl apply -f chart/templates/
-```
-
-## Configuration
-
-The operator is configured through environment variables:
-
-| Variable            | Description                              | Required | Default |
-| ------------------- | ---------------------------------------- | -------- | ------- |
-| `POSTGRES_HOST`     | PostgreSQL server hostname               | Yes      | -       |
-| `POSTGRES_USER`     | PostgreSQL admin username                | Yes      | -       |
-| `POSTGRES_PASSWORD` | PostgreSQL admin password                | Yes      | -       |
-| `POSTGRES_PORT`     | PostgreSQL server port                   | No       | 5432    |
-| `LOG_LEVEL`         | Logging level (debug, info, warn, error) | No       | info    |
-
-## Usage
-
-### PostgreSQL Database
-
-Create a PostgreSQL database with an associated role:
-
-```yaml
-apiVersion: homelab.mortenolsen.pro/v1
-kind: PostgresDatabase
-metadata:
-  name: my-app-db
-  namespace: my-namespace
-spec: {}
-```
-
-This will create:
-
-- A PostgreSQL role named `my-app-db`
-- A PostgreSQL database named `my-namespace_my-app-db` owned by the role
-- A Kubernetes secret `postgres-database-my-app-db` containing:
-  - `name`: Base64-encoded database name
-  - `user`: Base64-encoded username
-  - `password`: Base64-encoded password
-
-### Secret Request
-
-Generate a Kubernetes secret with custom data:
-
-```yaml
-apiVersion: homelab.mortenolsen.pro/v1
-kind: SecretRequest
-metadata:
-  name: my-secret
-  namespace: my-namespace
-spec:
-  secretName: app-config
-  data:
-    - key: api-key
-      value: "my-api-key"
-      encoding: base64
-    - key: database-url
-      value: "postgresql://user:pass@host:5432/db"
-    - key: random-token
-      length: 32
-      chars: "abcdefghijklmnopqrstuvwxyz0123456789"
-```
-
-### Accessing Created Resources
-
-To retrieve database credentials:
-
-```bash
-# Get the secret
-kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.user}' | base64 -d
-kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.password}' | base64 -d
-kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.name}' | base64 -d
-```
-
-## Development
-
-### Prerequisites
-
-- [Bun](https://bun.sh/) runtime
-- [pnpm](https://pnpm.io/) package manager
-- Docker (for building images)
-- Access to a Kubernetes cluster for testing
-
-### Setup
-
-1. Clone the repository:
-
-```bash
-git clone <repository-url>
-cd homelab-operator
-```
-
-2. Install dependencies:
-
-```bash
-pnpm install
-```
-
-3. Set up development environment:
-
-```bash
-cp .env.example .env
-# Edit .env with your PostgreSQL connection details
-```
-
-### Running Locally
-
-For development, you can run the operator locally against a remote cluster:
-
-```bash
-# Ensure kubectl is configured for your development cluster
-export KUBECONFIG=~/.kube/config
-
-# Set PostgreSQL connection environment variables
-export POSTGRES_HOST=localhost
-export POSTGRES_USER=postgres
-export POSTGRES_PASSWORD=yourpassword
-
-# Run the operator
-bun run src/index.ts
-```
-
-### Development with Docker Compose
-
-A development environment with PostgreSQL is provided:
-
-```bash
-docker-compose -f docker-compose.dev.yaml up -d
-```
-
-### Building
-
-Build the Docker image:
-
-```bash
-docker build -t homelab-operator:latest .
-```
-
-### Testing
-
-```bash
-# Run linting
-pnpm run test:lint
-
-# Apply test resources
-kubectl apply -f test.yaml
-```
-
-## Contributing
-
-1. Fork the repository
-2. Create a feature branch: `git checkout -b feature/new-feature`
-3. Make your changes and add tests
-4. Run linting: `pnpm run test:lint`
-5. Commit your changes: `git commit -am 'Add new feature'`
-6. Push to the branch: `git push origin feature/new-feature`
-7. Submit a pull request
-
-## Project Structure
-
-```
-├── chart/                 # Helm chart for deployment
-├── src/
-│   ├── crds/             # Custom Resource Definitions
-│   │   ├── postgres/     # PostgreSQL database management
-│   │   └── secrets/      # Secret generation
-│   ├── custom-resource/   # Base CRD framework
-│   ├── database/         # Database migrations
-│   ├── services/         # Core services
-│   │   ├── config/       # Configuration management
-│   │   ├── k8s.ts        # Kubernetes API client
-│   │   ├── log/          # Logging service
-│   │   ├── postgres/     # PostgreSQL service
-│   │   └── secrets/      # Secret management
-│   └── utils/            # Utilities and constants
-├── Dockerfile            # Container build configuration
-└── docker-compose.dev.yaml  # Development environment
-```
-
-## License
-
-This project is licensed under the MIT License - see the LICENSE file for
-details.
-
-## Support
-
-For support and questions:
-
-- Create an issue in the GitHub repository
-- Check existing issues for similar problems
-- Review the logs using `kubectl logs -l app=homelab-operator`
-
-## Status Monitoring
-
-Monitor the operator status:
-
-```bash
-# Check operator logs
-kubectl logs -l app=homelab-operator -f
-
-# Check CRD status
-kubectl get postgresdatabases
-kubectl get secretrequests
-
-# Describe resources for detailed status
-kubectl describe postgresdatabase my-app-db
-kubectl describe secretrequest my-secret
-```

chart/templates/clusterrole.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "homelab-operator.fullname" . }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create", "get", "watch", "list"]
-- apiGroups: ["*"]
-  resources: ["*"]
-  verbs: ["get", "watch", "list", "patch"]
-- apiGroups: ["apiextensions.k8s.io"]
-  resources: ["customresourcedefinitions"]
-  verbs: ["get", "create", "replace"]

chart/templates/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "homelab-operator.fullname" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "homelab-operator.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ include "homelab-operator.fullname" . }}
-  apiGroup: rbac.authorization.k8s.io

charts/operator/templates/_storageclass.yaml

@@ -0,0 +1,12 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: {{ include "homelab-operator.fullname" . }}-local-path
+  labels:
+    {{- include "homelab-operator.labels" . | nindent 4 }}
+provisioner: reuse-local-path-provisioner
+parameters:
+  # Add any provisioner-specific parameters here
+reclaimPolicy: {{ .Values.storage.reclaimPolicy | default "Retain" }}
+allowVolumeExpansion: {{ .Values.storage.allowVolumeExpansion | default false }}
+volumeBindingMode: {{ .Values.storage.volumeBindingMode | default "WaitForFirstConsumer" }}

charts/operator/templates/clusterrole.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "homelab-operator.fullname" . }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "get", "watch", "list"]
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get", "list", "watch", "create", "update", "patch"]
+- apiGroups: [""]
+  resources: ["persistentvolumes"]
+  verbs: ["get", "list", "watch", "create", "delete", "patch", "update"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch", "update", "patch"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims/status"]
+  verbs: ["update", "patch"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
+- apiGroups: ["storage.k8s.io"]
+  resources: ["storageclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["get", "watch", "list", "patch", "create", "update", "replace"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["get", "create", "update", "replace", "patch"]

charts/operator/templates/clusterrolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: '{{ include "homelab-operator.fullname" . }}'
+subjects:
+  - kind: ServiceAccount
+    name: '{{ include "homelab-operator.serviceAccountName" . }}'
+    namespace: "{{ .Release.Namespace }}"
+roleRef:
+  kind: ClusterRole
+  name: '{{ include "homelab-operator.fullname" . }}'
+  apiGroup: rbac.authorization.k8s.io

charts/operator/templates/deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "homelab-operator.fullname" . }}
+  namespace: "{{ .Release.Namespace }}"
   labels:
     {{- include "homelab-operator.labels" . | nindent 4 }}
 spec:
@@ -33,6 +34,14 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: data-volumes
+              mountPath: {{ .Values.storage.path }}
+      volumes:
+        - name: data-volumes
+          hostPath:
+            path: {{ .Values.storage.path }}
+            type: DirectoryOrCreate
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/operator/templates/serviceaccount.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "homelab-operator.serviceAccountName" . }}
+  namespace: "{{ .Release.Namespace }}"
   labels:
     {{- include "homelab-operator.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}

charts/operator/values.yaml

@@ -4,14 +4,20 @@
 
 image:
   repository: ghcr.io/morten-olsen/homelab-operator
-  pullPolicy: Always
+  pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: main
+  tag: main@sha256:df20d7e4f48bd886cef63ab882de9c6df76b0b297724d1cdf3a79aba8de6f896
 
 imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+storage:
+  path: /data/volumes
+  reclaimPolicy: Retain
+  allowVolumeExpansion: false
+  volumeBindingMode: WaitForFirstConsumer
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true

cloudflare.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare
+  namespace: homelab
+data:
+  token: WDhqQ1Z2WGtHUVh4XzIzb0d2WmNUcWZkWm8zZGpsMXE0dGIxU0J3Zg==
+  account: ZThkZDYwMDQ5MTI2NDM3MDhhNGZlMDI4YjNkNWEzMzM=
+  tunnelName: aG9tZWxhYg==
+  tunnelId: YTI1ZTI1MDEtNzNiNi00MDc1LWI3MjYtZDc1YWViZmE4ZmNk
+  secret: UWgvRWtGNkY2MUNxSnFwMGlCQXJ3MUxyd245ZldtcTd1RDNrZk1VUEVBVT0=
+
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: lets-encrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: alice@alice.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            email: alice@alice.com
+            apiTokenSecretRef:
+              name: cloudflare
+              key: token

docker-compose.dev.yaml

@@ -1,12 +0,0 @@
-name: homelab
-services:
-  postgres:
-    image: postgres:17
-    ports:
-      - 5432:5432
-    environment:
-      POSTGRES_USER: $POSTGRES_USER
-      POSTGRES_PASSWORD: $POSTGRES_PASSWORD
-      POSTGRES_DB: ${POSTGRES_DB:-postgres}
-    volumes:
-      - $PWD/.data/local/postgres:/var/lib/postgresql/data

docs/monitoring.md

@@ -0,0 +1,476 @@
+# Home Kubernetes Cluster Setup: Monitoring & Security Quickstart
+
+This guide provides a practical, lightweight setup for monitoring and security on your home Kubernetes cluster. It uses Helm for easy installation and focuses on essential features with minimal complexity.
+
+## Overview
+
+This setup includes:
+
+*   **Monitoring:** Prometheus + node-exporter + kube-state-metrics + Grafana (via the `kube-prometheus-stack` Helm chart).
+*   **Image Scanning & Supply-Chain:** Trivy (Trivy Operator) for automated in-cluster image vulnerability scanning.
+*   **Policy / Admission Control / Pod Security:** Kyverno for policy enforcement and Kubernetes Pod Security Admission (PSA) for baseline security.
+*   **Runtime Security / IDS:** Falco to detect suspicious syscalls and pod activity.
+*   **Network Segmentation:** Calico (or Cilium) CNI with basic NetworkPolicy configuration.
+*   **Ad-Hoc Checks:**  kube-bench (CIS benchmarks), kube-linter/kube-score (static analysis), and kube-hunter (penetration testing).
+
+## Prerequisites
+
+*   A functional Kubernetes cluster (managed or self-hosted).
+*   `kubectl` installed and configured to connect to your cluster.
+*   Helm v3 installed.
+
+## Installation
+
+These instructions assume you have `kubectl` and Helm set up and authenticated to your cluster.
+
+### 1. Monitoring (Prometheus + Grafana)
+
+*   Add the Prometheus community Helm repository:
+
+    ```bash
+    helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+    helm repo update
+    ```
+
+*   Create the `monitoring` namespace and install the `kube-prometheus-stack` chart:
+
+    ```bash
+    kubectl create ns monitoring
+    helm install kube-prometheus prometheus-community/kube-prometheus-stack --namespace monitoring
+    ```
+
+    *Optional*: Customize the installation by creating a `values.yaml` file to configure persistence, resource limits, and scrape intervals.  See *Configuration* below for a potential `values.yaml` you can adapt.
+
+*   Access Grafana:
+
+    ```bash
+    kubectl -n monitoring port-forward svc/kube-prometheus-grafana 3000:80
+    ```
+
+    Open `http://localhost:3000` in your browser. The default `admin` user password can be found in the chart's secrets (check the Helm chart documentation).
+
+    This provides node-exporter, kube-state-metrics, a Prometheus server, Alertmanager, and pre-built dashboards for your cluster.
+
+### 2. Image Scanning (Trivy Operator)
+
+*   Add the Aqua Security Helm repository:
+
+    ```bash
+    helm repo add aqua https://aquasecurity.github.io/helm-charts
+    helm repo update
+    ```
+
+*   Create the `trivy-system` namespace and install the `trivy-operator` chart:
+
+    ```bash
+    kubectl create ns trivy-system
+    helm install trivy-operator aqua/trivy-operator --namespace trivy-system
+    ```
+
+    Trivy Operator creates `VulnerabilityReport` and `ConfigAuditReport` CRDs.  It scans images running in the cluster for vulnerabilities.
+
+### 3. Policy Admission (Kyverno)
+
+*   Create the `kyverno` namespace and install Kyverno:
+
+    ```bash
+    kubectl create ns kyverno
+    kubectl apply -f https://github.com/kyverno/kyverno/releases/latest/download/install.yaml
+    ```
+
+*   Apply the example `ClusterPolicy` to deny privileged containers and hostPath mounts:
+
+    ```yaml
+    apiVersion: kyverno.io/v1
+    kind: ClusterPolicy
+    metadata:
+      name: deny-privileged-and-hostpath
+    spec:
+      rules:
+      - name: deny-privileged
+        match:
+          resources:
+            kinds: ["Pod","PodTemplate","CronJob","Job","Deployment","StatefulSet"]
+        validate:
+          message: "Privileged containers are not allowed"
+          deny:
+            conditions:
+            - key: "{{ request.object.spec.containers[].securityContext.privileged }}"
+              operator: Equals
+              value: true
+      - name: deny-hostpath
+        match:
+          resources:
+            kinds: ["Pod","PodTemplate","Deployment","StatefulSet"]
+        validate:
+          message: "hostPath volumes are not allowed"
+          pattern:
+            spec:
+              volumes:
+              - "*":
+                  hostPath: null
+    ```
+
+    Save the above as `kyverno-policy.yaml` and apply it:
+
+    ```bash
+    kubectl apply -f kyverno-policy.yaml
+    ```
+
+    Adapt the `match` section to target specific workload types.  See *Example Kyverno Policy* below.
+
+### 4. Pod Security Admission (PSA)
+
+*   Apply the `baseline` Pod Security Standard to the `default` namespace:
+
+    ```bash
+    kubectl label ns default pod-security.kubernetes.io/enforce=baseline
+    ```
+
+*   For a stricter security posture, use the `restricted` profile:
+
+    ```bash
+    kubectl label ns default pod-security.kubernetes.io/enforce=restricted
+    ```
+
+    PSA provides controls like preventing privileged containers and restricting host networking.
+
+### 5. Runtime Detection (Falco)
+
+*   Add the Falco Helm repository:
+
+    ```bash
+    helm repo add falcosecurity https://falcosecurity.github.io/charts
+    helm repo update
+    ```
+
+*   Create the `falco` namespace and install the `falco` chart:
+
+    ```bash
+    kubectl create ns falco
+    helm install falco falcosecurity/falco --namespace falco
+    ```
+
+    Falco detects suspicious container behavior and system calls.
+
+### 6. Network Policy & CNI
+
+*   If you haven't already, install a CNI that supports NetworkPolicy, such as Calico:
+
+    ```bash
+    kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml
+    ```
+
+    Alternatively, consider Cilium.
+
+*   Implement a default-deny NetworkPolicy:
+
+    ```yaml
+    apiVersion: networking.k8s.io/v1
+    kind: NetworkPolicy
+    metadata:
+      name: default-deny
+      namespace: my-namespace
+    spec:
+      podSelector: {}
+      policyTypes:
+      - Ingress
+      - Egress
+    ```
+
+    Save the above as `default-deny.yaml` and apply it to your namespace:
+
+    ```bash
+    kubectl apply -f default-deny.yaml
+    ```
+
+    Follow this up with explicit `allow` policies for necessary services.
+
+### 7. Cluster Hardening & Scans
+
+*   **kube-bench (CIS Benchmarks):**
+
+    ```bash
+    kubectl run --rm -it --image aquasec/kube-bench:latest kube-bench -- /kube-bench --version 1.23
+    ```
+
+    Refer to the kube-bench documentation for running as a Job or Pod.
+
+*   **kube-linter / kube-score (Static Manifest Checks):**
+
+    Install the CLI tool locally and analyze your Kubernetes manifests.
+
+*   **kube-hunter (Penetration Testing):**
+
+    ```bash
+    docker run aquasec/kube-hunter:latest --remote <K8S_API_ENDPOINT>
+    ```
+
+## Configuration
+
+This section provides example configuration files and tips to customize the setup for a home Kubernetes cluster.
+
+### Example `values.yaml` for `kube-prometheus-stack`
+
+This reduces resource usage and avoids the need for external object storage for Alertmanager, which is not needed at home.  It disables default dashboards you might not need initially and cuts down some Prometheus retention.
+
+```yaml
+# values.yaml for kube-prometheus-stack
+
+prometheus:
+  prometheusSpec:
+    # reduce resource rqts / limits
+    resources:
+       requests:
+         memory: 1Gi
+         cpu: 200m
+       limits:
+         memory: 2Gi
+         cpu: 500m
+
+    # Reduce storage retention
+    retention: 7d
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: "local-path" # Or your storage class
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 10Gi # adjust as needed
+
+alertmanager:
+  enabled: false # for quick home setup, send directly to telegram etc.
+grafana:
+  enabled: true
+  defaultDashboardsEnabled: false   # Disable default dashboards
+  sidecar:
+    dashboards:
+      enabled: true
+      provider:
+        folders:
+          fromConfigMap: true # Load custom dashboards from ConfigMaps
+
+kube-state-metrics:
+ enabled: true
+
+nodeExporter:
+  enabled: true
+```
+
+To use this configuration, save it as `values.yaml` and run:
+
+```bash
+helm install kube-prometheus prometheus-community/kube-prometheus-stack --namespace monitoring -f values.yaml
+```
+
+Adapt the `storageClassName` and storage amounts to your environment.
+
+### Example Kyverno Policy - Disallow Root User / Require Distroless
+
+This example expands on the previous policy.  It requires images not run as UID 0 and suggests distroless images.  It still requires privilege escalation to be forbidden:
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-non-root-user-and-distroless
+  annotations:
+    policies.kyverno.io/title: Require Non-Root User and Distroless Images
+    policies.kyverno.io/category: Security
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Containers should not run as root, and ideally, be based on Distroless
+      images where possible. This policy requires that containers define
+      `runAsUser`, and that `runAsUser` is not `0`.  It also generates a warning
+      if the image is not based on a distroless image, although does not reject
+      the deployment.
+
+spec:
+  validationFailureAction: Enforce
+  rules:
+    - name: check-runasnonroot
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      validate:
+        message: "Containers must not run as root. Specify a non-zero runAsUser in securityContext."
+        pattern:
+          spec:
+            containers:
+              - securityContext:
+                  runAsUser: "!0" # not equal to zero
+    - name: check-allowprivilegeescalation
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      validate:
+        message: "Containers must set allowPrivilegeEscalation to false."
+        pattern:
+          spec:
+            containers:
+              - securityContext:
+                  allowPrivilegeEscalation: "false"
+    - name: warn-distroless
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "*"  # all images
+          attestations:
+            - policy:
+                subjects:
+                  - name: distroless
+                conditions:
+                  all:
+                    - key: "ghcr.io/distroless/static:latest"  # Example -  Check if the image is distroless.  You can use wildcards
+                      operator: In
+                      value: "{{ image.repoDigests }}"
+                  # You can add other keys and values to check
+
+      mutate:
+        overlay:
+          metadata:
+            annotations:
+              "image.distroless.warn": "This image isn't distroless -- see https://github.com/GoogleContainerTools/distroless"
+```
+
+### Alertmanager to Telegram
+
+1.  **Create a Telegram Bot:** Search for `@BotFather` on Telegram. Use the `/newbot` command. Give your bot a name and a unique username.  BotFather will give you the bot's API token.
+
+2.  **Get your Telegram Chat ID:** Send a message to your bot.  Then, in a browser, go to  `https://api.telegram.org/bot<YOUR_BOT_API_TOKEN>/getUpdates` (replace `<YOUR_BOT_API_TOKEN>`). The `chat.id` value in the JSON response is your chat ID.
+
+3.  **Create a Secret in Kubernetes:**
+
+    ```bash
+    kubectl create secret generic telegram-secrets \
+      --from-literal=bot_token="<YOUR_BOT_API_TOKEN>" \
+      --from-literal=chat_id="<YOUR_CHAT_ID>"
+    ```
+
+    Replace the placeholders with the correct values.
+
+4.  **Add Alertmanager Configuration:**
+
+    You'll need to patch the default Alertmanager configuration provided by `kube-prometheus-stack`.  Because we disabled the Alertmanager component from the chart for simplicitly's sake, we'll instead rely on defining an additional prometheusRule that sends alerts to a webhook (and have a small sidecar container forward them to telegram).
+
+Example:
+
+```yaml
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  labels:
+    prometheus: k8s
+    role: alert-rules
+  name: promethus-to-telegram
+  namespace: monitoring
+spec:
+  groups:
+    - name: kubernetes-home-cluster
+      rules:
+        - alert: PrometheusToTelegramAlert
+          annotations:
+            description: 'Alert sent from Prometheus goes to telegram'
+          expr: vector(1)
+          labels:
+            severity: critical
+          for: 1s
+          actions:
+            - name: SendToTelegramAction
+              url: 'http://localhost:8080/message'
+              parameters:
+                text: Alert from Prometheus: {{ .Alerts.Firing | len }} firing alert{{ if gt (len .Alerts.Firing) 1 }}s{{ end }}.\nSeverity: {{ .CommonLabels.severity }}\nDescription: {{ .CommonAnnotations.description }}
+```
+
+Now you will create a deployment that runs a small webhook server forwarding these alerts to telegram:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prometheus-telegram
+  namespace: monitoring
+spec:
+  selector:
+    matchLabels:
+      app: prometheus-telegram
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: prometheus-telegram
+    spec:
+      containers:
+      - name: webhook
+        image: nginx
+        ports:
+        - containerPort: 8080
+      - name: telegram-forwarder
+        image: alpine/curl
+        command: ["/bin/sh"]
+        args:
+        - "-c"
+        - |
+          while true; do
+            nc -l -p 8080 | sed 's/text=/text=Alert from Prometheus: /g' | curl -sS --fail -X POST "https://api.telegram.org/bot$(TELEGRAM_BOT_TOKEN)/sendMessage" -d chat_id=$(TELEGRAM_CHAT_ID) -d "$$(cat)"
+            sleep 1;
+          done
+        env:
+        - name: TELEGRAM_BOT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: telegram-secrets
+              key: bot_token
+        - name: TELEGRAM_CHAT_ID
+          valueFrom:
+            secretKeyRef:
+              name: telegram-secrets
+              key: chat_id
+```
+
+**Explanation:**
+
+*   It creates an Nginx pod for a HTTP listener to avoid unnecessary security errors in Promethues,
+*   The `telegram-forwarder` container uses `curl` and `nc` to forward the POST from Prometheus to the Telegram API, using the secrets for authentication.
+
+## Operational Tips
+
+*   **Resource Management:**  Set resource limits and requests for components, especially Prometheus and Grafana. Adjust scrape intervals for Prometheus to reduce load.
+*   **Persistence:**  Use persistent volumes for Grafana and Prometheus to preserve dashboards and historical data.
+*   **Alerting:**  Configure Alertmanager with a Telegram or Discord webhook for notifications. This is *simpler* than email for home setups.
+*   **Trivy & Image Blocking:** To automatically block vulnerable images, integrate Trivy with admission webhooks (using Kyverno to reject deployments based on Trivy reports).
+*   **Backups:** Regularly back up etcd (if self-hosting the control plane) and potentially Prometheus/Grafana data.
+
+## Getting Started Quickly
+
+Follow this installation order:
+
+1.  Install your `CNI`.
+2.  Install `kube-prometheus-stack`, using `values.yaml` to reduce resources.
+3.  Install Grafana and import dashboards.
+4.  Enable PSA on namespaces.
+5.  Install Kyverno and create deny policies.
+6.  Install Trivy Operator for image scanning visibility.
+7.  Install Falco for runtime detection.
+8.  Run `kube-bench` and `kube-linter` for initial assessment.
+
+## Useful Resources
+
+*   [kube-prometheus-stack (Helm)](https://github.com/prometheus-community/helm-charts)
+*   [trivy-operator](https://github.com/aquasecurity/trivy-operator)
+*   [Kyverno](https://kyverno.io/)
+*   [Falco](https://falco.org/)
+*   [Calico CNI](https://www.tigera.io/project-calico/)
+*  [Aqua kube-hunter, kube-bench, kube-linter](https://www.aquasec.com/)
+
+This README provides a solid foundation for setting up monitoring and security on your home Kubernetes cluster.  Adapt the configurations and policies to your specific needs and experiment!

docs/prepare-server.md

@@ -0,0 +1,216 @@
+Here's the guide formatted as a `README.md` file, ready for a GitHub repository or local documentation.
+
+```markdown
+# Optimizing Debian for K3s
+
+This guide outlines steps to optimize a Debian server for running K3s (Lightweight Kubernetes). Optimization involves a combination of general Linux best practices, K3s-specific recommendations, and considerations for your specific workload.
+
+## Table of Contents
+
+- [1. Debian Base System Optimization](#1-debian-base-system-optimization)
+  - [a. Kernel Parameters (sysctl.conf)](#a-kernel-parameters-sysctlconf)
+  - [b. User Limits (ulimit)](#b-user-limits-ulimit)
+  - [c. Disable Unnecessary Services](#c-disable-unnecessary-services)
+  - [d. Update System](#d-update-system)
+  - [e. Swap Configuration](#e-swap-configuration)
+- [2. K3s Specific Optimizations](#2-k3s-specific-optimizations)
+  - [a. Choose a Performant Storage Backend](#a-choose-a-performant-storage-backend)
+  - [b. Containerd Tuning](#b-containerd-tuning)
+  - [c. K3s Server and Agent Configuration](#c-k3s-server-and-agent-configuration)
+  - [d. CNI Choice](#d-cni-choice)
+- [3. General Server Best Practices](#3-general-server-best-practices)
+  - [a. Fast Storage](#a-fast-storage)
+  - [b. Adequate RAM and CPU](#b-adequate-ram-and-cpu)
+  - [c. Network Configuration](#c-network-configuration)
+  - [d. Monitoring](#d-monitoring)
+  - [e. Logging](#e-logging)
+- [4. Post-Optimization Verification](#4-post-optimization-verification)
+
+---
+
+## 1. Debian Base System Optimization
+
+These steps are generally beneficial for any server, but particularly important for containerized environments like K3s.
+
+### a. Kernel Parameters (sysctl.conf)
+
+Edit `/etc/sysctl.conf` and apply changes with `sudo sysctl -p`.
+
+```ini
+# Increase maximum open files (for container processes, K3s components)
+fs.inotify.max_user_watches = 524288 # For fs-based operations within containers
+fs.inotify.max_user_instances = 8192 # For fs-based operations within containers
+fs.file-max = 2097152 # Increase overall system file handle limit
+
+# Increase limits for network connections
+net.core.somaxconn = 65535 # Max backlog of pending connections
+net.ipv4.tcp_tw_reuse = 1 # Allow reuse of TIME_WAIT sockets (caution: can sometimes mask issues)
+net.ipv4.tcp_fin_timeout = 30 # Reduce TIME_WAIT duration
+net.ipv4.tcp_max_syn_backlog = 65535 # Max number of remembered connection requests
+net.ipv4.tcp_keepalive_time=600 # Shorter keepalive interval
+net.ipv4.tcp_keepalive_intvl=60 # Keepalive interval
+net.ipv4.tcp_keepalive_probes=3 # Keepalive probes
+
+# Increase memory limits for network buffers (especially if high network traffic)
+net.core.rmem_max = 26214400
+net.core.wmem_max = 26214400
+net.core.rmem_default = 26214400
+net.core.wmem_default = 26214400
+
+# Other useful parameters
+vm.max_map_count = 262144 # Essential for Elasticsearch, MongoDB, etc.
+vm.dirty_ratio = 5 # Reduce dirty page percentage for better write performance
+vm.dirty_background_ratio = 10 # Reduce dirty page percentage for better write performance
+kernel.pid_max = 4194304 # Increase max PIDs
+```
+
+**Explanation:**
+- `fs.file-max`: K3s and its deployed containers can open a large number of files. Increasing this prevents "Too many open files" errors.
+- `net.*`: These parameters help in handling a high number of concurrent network connections crucial for a Kubernetes cluster.
+- `vm.max_map_count`: Required by some applications that run on Kubernetes (e.g., Elasticsearch).
+
+### b. User Limits (ulimit)
+
+Edit `/etc/security/limits.conf` (or create a file like `/etc/security/limits.d/k3s.conf`) for all users, or specifically for the user K3s runs as (often `root` by default or a dedicated `k3s` user).
+
+```
+# For all users (or a specific k3s user if you configure it)
+*    soft nofile 65536
+*    hard nofile 131072
+*    soft nproc  65536
+*    hard nproc  131072
+```
+**Note:** A reboot or logging out/in is often required for these changes to take effect for user sessions. Services typically pick up new limits upon restart.
+
+**Explanation:**
+- `nofile` (number of open files): Sets the per-user/per-process limit. K3s and pods need a high limit.
+- `nproc` (number of processes): Each container consumes processes. A high limit prevents hitting a ceiling.
+
+### c. Disable Unnecessary Services
+
+Reducing background services frees up CPU, RAM, and I/O.
+```bash
+sudo systemctl disable --now apache2 # Example, replace with actual unused services
+sudo systemctl disable --now nginx    # Example
+sudo systemctl disable --now cups     # If not using printing
+sudo systemctl disable --now modemmanager # If not using a modem
+sudo systemctl disable --now bluetooth # If no bluetooth devices
+# Review active services using:
+# systemctl list-unit-files --type=service --state=enabled
+```
+
+### d. Update System
+
+Keep your system packages up-to-date for security and performance bug fixes.
+```bash
+sudo apt update
+sudo apt upgrade -y
+sudo apt dist-upgrade -y # For major version changes (if applicable)
+sudo apt autoremove -y
+sudo reboot # After significant kernel or base system updates
+```
+
+### e. Swap Configuration
+
+**It is generally recommended to disable swap on K3s nodes, especially worker nodes.** Swapping can severely degrade performance in containerized environments due to unpredictable latency.
+
+If you absolutely must have swap (e.g., very low memory server, not recommended for production):
+*   Reduce swappiness: `sudo sysctl vm.swappiness=10` (or even `1`). Add `vm.swappiness = 10` to `/etc/sysctl.conf`.
+*   Preferably, disable swap entirely if you have sufficient RAM:
+    ```bash
+    sudo swapoff -a
+    sudo sed -i '/ swap / s/^/#/' /etc/fstab
+    ```
+    **WARNING:** Only disable swap if your system has sufficient RAM to handle its workload without it. If nodes run out of memory without swap, processes will be OOM-killed, leading to instability.
+
+## 2. K3s Specific Optimizations
+
+### a. Choose a Performant Storage Backend
+
+The choice of K3s's data store significantly impacts performance and availability.
+
+*   **SQLite (Default):** Good for single-node setups or small, non-critical clusters. Performance can degrade with many changes or large clusters.
+*   **External Database (MariaDB/MySQL, PostgreSQL):**
+    *   **Recommended for Production:** Offers high availability and better performance than embedded SQLite for multi-node K3s server configurations.
+    *   **Placement:** Place the external database on a separate server or on a dedicated, fast storage volume.
+*   **External etcd:** Offers the best performance and scalability, but is more complex to manage and requires its own dedicated etcd cluster.
+
+### b. Containerd Tuning
+
+K3s uses containerd as its container runtime.
+
+*   **Fast Storage for Containerd:** Ensure the directories where containerd stores its data are on fast storage (NVMe SSDs are ideal).
+    *   `/var/lib/rancher/k3s/agent/containerd/io.containerd.snapshotter.v1.overlayfs` (K3s specific)
+    *   (`/var/lib/containerd` if using a standalone containerd setup)
+    This is critical for image pulls, container startup, and overlayfs performance.
+
+### c. K3s Server and Agent Configuration
+
+Configure K3s using a configuration file (e.g., `/etc/rancher/k3s/config.yaml`) or command-line flags.
+
+*   **Disable Unused Components:** Reduce resource consumption by disabling features you don't need.
+    *   `--disable traefik`: If using Nginx Ingress Controller or another ingress.
+    *   `--disable servicelb`: If using a cloud provider Load Balancer, MetalLB, or another solution.
+    *   `--disable local-storage`: If using cloud provider storage, NFS, or another remote storage solution.
+    *   `--disable metrics-server`: If using a different metrics solution or don't need it.
+    *   `--disable helm-controller`: If exclusively using `kubectl` for deployments.
+
+    **Example `/etc/rancher/k3s/config.yaml` for a server node:**
+    ```yaml
+    # /etc/rancher/k3s/config.yaml
+    server: true
+    disable:
+      - traefik
+      - servicelb
+      - local-storage
+      - metrics-server
+    # Example for external database
+    # datastore-endpoint: "mysql://k3s:password@tcp(db-server:3306)/kube?parseTime=true"
+    ```
+
+### d. CNI Choice
+
+K3s defaults to Flannel (with VXLAN), which is performant for many use cases.
+*   **Alternative CNIs (Calico, Cilium):** If you require advanced network policies, superior performance in high-throughput scenarios, or specific networking features, consider replacing Flannel. These can offer better raw throughput or lower latency but add complexity.
+    *   If installing K3s, you'd typically skip Flannel installation (`--flannel-backend=none`) then install your chosen CNI.
+    *   Ensure your chosen CNI is optimized with the correct kernel modules and sysctls.
+
+## 3. General Server Best Practices
+
+### a. Fast Storage
+
+*   **SSD/NVMe:** Absolutely crucial for K3s performance, especially for the K3s data directory (`$K3S_DATA_DIR`, default: `/var/lib/rancher/k3s`), `/var/lib/containerd`, and the operating system itself. Pod startup times, image pulls, and database operations are heavily I/O bound.
+*   **RAID:** If using multiple drives, consider RAID1 or RAID10 for redundancy and increased I/O performance.
+
+### b. Adequate RAM and CPU
+
+*   **RAM:** K3s servers (especially with embedded SQLite) require more RAM. Worker nodes also need ample RAM for their pods. Err on the side of more RAM.
+*   **CPU:** Ensure sufficient CPU cores for K3s components, containers, and your workloads.
+
+### c. Network Configuration
+
+*   **Gigabit Ethernet (at least):** 10Gbps or faster is ideal for larger clusters or high-bandwidth applications.
+*   **MTU:** Ensure consistent MTU settings across all nodes and your network infrastructure. K3s default CNI (Flannel VXLAN) might use a smaller MTU (e.g., 1450) due to encapsulation overhead. Misconfigured MTU can lead to packet fragmentation and performance issues.
+*   **Jumbo Frames:** If your network supports it and all components are configured for it, jumbo frames (e.g., 9000 bytes MTU) can reduce overhead and improve throughput, but requires careful and consistent configuration.
+
+### d. Monitoring
+
+*   **Prometheus/Grafana:** Essential for monitoring resource usage (CPU, RAM, disk I/O, network) of your nodes and K3s components. This helps identify and diagnose bottlenecks.
+*   **Kube-state-metrics:** Provides metrics about Kubernetes objects.
+*   **Node Exporter:** Provides system-level metrics.
+*   **cAdvisor (usually bundled with container runtimes):** Provides container-level metrics.
+
+### e. Logging
+
+*   **Centralized Logging (ELK Stack, Loki, etc.):** Stream logs from K3s components and pods to a central logging system for easier debugging, troubleshooting, and performance analysis.
+
+## 4. Post-Optimization Verification
+
+1.  **Reboot:** After making changes to kernel parameters or `limits.conf`, a full system reboot is often the safest way to ensure all changes are fully applied.
+2.  **Verify sysctl settings:** `sudo sysctl -a | grep -i <parameter_name>` (e.g., `sudo sysctl -a | grep -i fs.file-max`)
+3.  **Verify ulimits:** Check `ulimit -n` and `ulimit -u` in a new shell. For specific running processes, inspect `/proc/<pid>/limits`.
+4.  **Monitor Performance:** Use tools like `htop`, `iostat`, `netstat`, `dstat`, and your installed monitoring stack (Prometheus/Grafana) to observe the impact of your changes. Look for reduced CPU usage, lower I/O wait, improved network throughput, and stable memory usage.
+5.  **Test Workloads:** Deploy your actual applications and perform load testing to ensure the optimizations yield the desired performance benefits under realistic conditions.
+
+By diligently following these steps, you can establish a robust and highly performant Debian environment for your K3s cluster. Always test changes in a staging or development environment before applying them to production systems.
+```

images/backup/Dockerfile

@@ -0,0 +1,10 @@
+FROM alpine/git:latest@sha256:bd54f921f6d803dfa3a4fe14b7defe36df1b71349a3e416547e333aa960f86e3
+# or a more specific image like a Debian slim or Ubuntu base image.
+RUN apk add --no-cache restic fuse-overlayfs
+WORKDIR /app
+
+COPY backup.sh /app/backup.sh
+COPY cleanup.sh /app/cleanup.sh
+
+# Make scripts executable
+RUN chmod +x /app/backup.sh /app/cleanup.sh

images/backup/backup.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+if [ -z "$RESTIC_PASSWORD" ]; then
+  echo "Error: RESTIC_PASSWORD environment variable is not set." >&2
+  exit 1
+fi
+
+RESTIC_REPOSITORY="/mnt/backup"
+SOURCE_DIR="/mnt/source"
+
+mkdir -p "$SOURCE_DIR"
+mkdir -p "/mnt/backup"
+
+echo "Starting Restic backup from $SOURCE_DIR to $RESTIC_REPOSITORY"
+
+echo "Checking/Initializing Restic repository..."
+restic init --repo "$RESTIC_REPOSITORY" || true
+
+echo "Running Restic backup..."
+restic backup \
+  -r "$RESTIC_REPOSITORY" \
+  "$SOURCE_DIR" \
+  --verbose \
+  --tag "daily"
+
+if [ $? -eq 0 ]; then
+  echo "Restic backup completed successfully!"
+else
+  echo "Restic backup failed!"
+  exit 1
+fi
+
+echo "Backup finished."

images/backup/cleanup.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+set -e
+
+if [ -z "$RESTIC_PASSWORD" ]; then
+  echo "Error: RESTIC_PASSWORD environment variable is not set." >&2
+  exit 1
+fi
+RESTIC_REPOSITORY="/mnt/backup"
+
+echo "Starting Restic cleanup for repository $RESTIC_REPOSITORY"
+
+echo "Checking Restic repository existence..."
+restic snapshots --repository "$RESTIC_REPOSITORY"
+
+# Restic forget and prune strategy
+# --keep-daily 7: Keep 7 most recent daily backups
+# --keep-weekly 4: Keep 4 most recent weekly backups
+# --keep-monthly 6: Keep 6 most recent monthly backups
+# --keep-yearly 1: Keep 1 most recent yearly backup
+# --prune: Actually delete data that's no longer referenced
+# --group-by host,paths: Group snapshots for retention by host and path.
+echo "Running Restic forget and prune..."
+restic forget \
+  --group-by host,paths \
+  --tag "daily" \
+  --keep-daily 7 \
+  --keep-weekly 4 \
+  --keep-monthly 6 \
+  --keep-yearly 1 \
+  --prune \
+  --verbose \
+  --repository "$RESTIC_REPOSITORY"
+
+if [ $? -eq 0 ]; then
+  echo "Restic cleanup completed successfully!"
+else
+  echo "Restic cleanup failed!"
+  exit 1
+fi
+
+echo "Cleanup finished."

images/operator/.gitignore

@@ -0,0 +1,39 @@
+# dependencies (bun install)
+node_modules
+
+# output
+out
+dist
+*.tgz
+
+# code coverage
+coverage
+*.lcov
+
+# logs
+logs
+_.log
+report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
+
+# dotenv environment variable files
+.env
+.env.development.local
+.env.test.local
+.env.production.local
+.env.local
+
+# caches
+.eslintcache
+.cache
+*.tsbuildinfo
+
+# IntelliJ based IDEs
+.idea
+
+# Finder (MacOS) folder config
+.DS_Store
+
+/data/
+
+/cloudflare.yaml
+/secret.*.yaml

images/operator/Dockerfile

@@ -0,0 +1,8 @@
+FROM node:23-slim@sha256:86191b94d2a163be41f3dc7fe5e5fcaca8ba2f1be7275d98a06343483c17414a
+RUN corepack enable
+WORKDIR /app
+COPY package.json pnpm-lock.yaml ./
+COPY patches ./patches
+RUN pnpm install --frozen-lockfile --prod
+COPY . .
+CMD ["node", "src/index.ts"]

images/operator/package.json

@@ -5,13 +5,15 @@
   "private": true,
   "devDependencies": {
     "@eslint/eslintrc": "3.3.1",
-    "@eslint/js": "9.32.0",
-    "eslint": "9.32.0",
+    "@eslint/js": "9.36.0",
+    "@types/deep-equal": "^1.0.4",
+    "eslint": "9.36.0",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-import": "2.32.0",
-    "eslint-plugin-prettier": "5.5.3",
+    "eslint-plugin-prettier": "5.5.4",
+    "json-schema-to-typescript": "^15.0.4",
     "prettier": "3.6.2",
-    "typescript": "5.8.3",
+    "typescript": "5.9.2",
     "typescript-eslint": "8.38.0"
   },
   "peerDependencies": {
@@ -20,20 +22,34 @@
   "dependencies": {
     "@goauthentik/api": "2025.6.3-1751754396",
     "@kubernetes/client-node": "^1.3.0",
+    "cloudflare": "^5.0.0",
+    "cron": "^4.3.3",
+    "debounce": "^2.2.0",
+    "deep-equal": "^2.2.3",
     "dotenv": "^17.2.1",
+    "eventemitter3": "^5.0.1",
+    "execa": "^9.6.0",
     "knex": "^3.1.0",
+    "p-queue": "^8.1.0",
+    "p-retry": "^7.0.0",
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "yaml": "^2.8.0",
     "zod": "^4.0.14"
   },
-  "packageManager": "pnpm@10.6.0",
+  "imports": {
+    "#services/*": "./src/services/*",
+    "#resources/*": "./src/resources/*",
+    "#bootstrap/*": "./src/bootstrap/*",
+    "#utils/*": "./src/utils/*"
+  },
+  "packageManager": "pnpm@10.17.1",
   "pnpm": {
     "onlyBuiltDependencies": [
       "sqlite3"
     ],
     "patchedDependencies": {
-      "@kubernetes/client-node": "patches/@kubernetes__client-node.patch"
+      "@kubernetes/client-node": "./patches/@kubernetes__client-node.patch"
     }
   },
   "scripts": {

images/operator/src/__generated__/resources/K8SAddonV1.json

@@ -0,0 +1,31 @@
+{
+  "description": "Addon is used to track application of a manifest file on disk. It mostly exists so that the wrangler DesiredSet\nApply controller has an object to track as the owner, and ensure that all created resources are tracked when the\nmanifest is modified or removed.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "Spec provides information about the on-disk manifest backing this resource.",
+      "properties": {
+        "checksum": {
+          "description": "Checksum is the SHA256 checksum of the most recently successfully applied manifest file.",
+          "type": "string"
+        },
+        "source": {
+          "description": "Source is the Path on disk to the manifest file that this Addon tracks.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SAddonV1.ts

@@ -0,0 +1,43 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * Addon is used to track application of a manifest file on disk. It mostly exists so that the wrangler DesiredSet
+ * Apply controller has an object to track as the owner, and ensure that all created resources are tracked when the
+ * manifest is modified or removed.
+ */
+export interface K8SAddonV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * Spec provides information about the on-disk manifest backing this resource.
+   */
+  spec?: {
+    /**
+     * Checksum is the SHA256 checksum of the most recently successfully applied manifest file.
+     */
+    checksum?: string;
+    /**
+     * Source is the Path on disk to the manifest file that this Addon tracks.
+     */
+    source?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SAppProjectV1alpha1.json

@@ -0,0 +1,376 @@
+{
+  "description": "AppProject provides a logical grouping of applications, providing controls for:\n* where the apps may deploy to (cluster whitelist)\n* what may be deployed (repository whitelist, resource whitelist/blacklist)\n* who can access these applications (roles, OIDC group claims bindings)\n* and what they can do (RBAC policies)\n* automation access to these roles (JWT tokens)",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "AppProjectSpec is the specification of an AppProject",
+      "properties": {
+        "clusterResourceBlacklist": {
+          "description": "ClusterResourceBlacklist contains list of blacklisted cluster level resources",
+          "items": {
+            "description": "GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying\nconcepts during lookup stages without having partially valid types",
+            "type": "object",
+            "required": [
+              "group",
+              "kind"
+            ],
+            "properties": {
+              "group": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "clusterResourceWhitelist": {
+          "description": "ClusterResourceWhitelist contains list of whitelisted cluster level resources",
+          "items": {
+            "description": "GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying\nconcepts during lookup stages without having partially valid types",
+            "type": "object",
+            "required": [
+              "group",
+              "kind"
+            ],
+            "properties": {
+              "group": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "description": {
+          "description": "Description contains optional project description",
+          "type": "string"
+        },
+        "destinationServiceAccounts": {
+          "description": "DestinationServiceAccounts holds information about the service accounts to be impersonated for the application sync operation for each destination.",
+          "items": {
+            "description": "ApplicationDestinationServiceAccount holds information about the service account to be impersonated for the application sync operation.",
+            "type": "object",
+            "required": [
+              "defaultServiceAccount",
+              "server"
+            ],
+            "properties": {
+              "defaultServiceAccount": {
+                "description": "DefaultServiceAccount to be used for impersonation during the sync operation",
+                "type": "string"
+              },
+              "namespace": {
+                "description": "Namespace specifies the target namespace for the application's resources.",
+                "type": "string"
+              },
+              "server": {
+                "description": "Server specifies the URL of the target cluster's Kubernetes control plane API.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "destinations": {
+          "description": "Destinations contains list of destinations available for deployment",
+          "items": {
+            "description": "ApplicationDestination holds information about the application's destination",
+            "type": "object",
+            "properties": {
+              "name": {
+                "description": "Name is an alternate way of specifying the target cluster by its symbolic name. This must be set if Server is not set.",
+                "type": "string"
+              },
+              "namespace": {
+                "description": "Namespace specifies the target namespace for the application's resources.\nThe namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace",
+                "type": "string"
+              },
+              "server": {
+                "description": "Server specifies the URL of the target cluster's Kubernetes control plane API. This must be set if Name is not set.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "namespaceResourceBlacklist": {
+          "description": "NamespaceResourceBlacklist contains list of blacklisted namespace level resources",
+          "items": {
+            "description": "GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying\nconcepts during lookup stages without having partially valid types",
+            "type": "object",
+            "required": [
+              "group",
+              "kind"
+            ],
+            "properties": {
+              "group": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "namespaceResourceWhitelist": {
+          "description": "NamespaceResourceWhitelist contains list of whitelisted namespace level resources",
+          "items": {
+            "description": "GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying\nconcepts during lookup stages without having partially valid types",
+            "type": "object",
+            "required": [
+              "group",
+              "kind"
+            ],
+            "properties": {
+              "group": {
+                "type": "string"
+              },
+              "kind": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "orphanedResources": {
+          "description": "OrphanedResources specifies if controller should monitor orphaned resources of apps in this project",
+          "properties": {
+            "ignore": {
+              "description": "Ignore contains a list of resources that are to be excluded from orphaned resources monitoring",
+              "items": {
+                "description": "OrphanedResourceKey is a reference to a resource to be ignored from",
+                "type": "object",
+                "properties": {
+                  "group": {
+                    "type": "string"
+                  },
+                  "kind": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "type": "string"
+                  }
+                }
+              },
+              "type": "array"
+            },
+            "warn": {
+              "description": "Warn indicates if warning condition should be created for apps which have orphaned resources",
+              "type": "boolean"
+            }
+          },
+          "type": "object"
+        },
+        "permitOnlyProjectScopedClusters": {
+          "description": "PermitOnlyProjectScopedClusters determines whether destinations can only reference clusters which are project-scoped",
+          "type": "boolean"
+        },
+        "roles": {
+          "description": "Roles are user defined RBAC roles associated with this project",
+          "items": {
+            "description": "ProjectRole represents a role that has access to a project",
+            "type": "object",
+            "required": [
+              "name"
+            ],
+            "properties": {
+              "description": {
+                "description": "Description is a description of the role",
+                "type": "string"
+              },
+              "groups": {
+                "description": "Groups are a list of OIDC group claims bound to this role",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "jwtTokens": {
+                "description": "JWTTokens are a list of generated JWT tokens bound to this role",
+                "type": "array",
+                "items": {
+                  "description": "JWTToken holds the issuedAt and expiresAt values of a token",
+                  "type": "object",
+                  "required": [
+                    "iat"
+                  ],
+                  "properties": {
+                    "exp": {
+                      "type": "integer",
+                      "format": "int64"
+                    },
+                    "iat": {
+                      "type": "integer",
+                      "format": "int64"
+                    },
+                    "id": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "name": {
+                "description": "Name is a name for this role",
+                "type": "string"
+              },
+              "policies": {
+                "description": "Policies Stores a list of casbin formatted strings that define access policies for the role in the project",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "type": "array"
+        },
+        "signatureKeys": {
+          "description": "SignatureKeys contains a list of PGP key IDs that commits in Git must be signed with in order to be allowed for sync",
+          "items": {
+            "description": "SignatureKey is the specification of a key required to verify commit signatures with",
+            "type": "object",
+            "required": [
+              "keyID"
+            ],
+            "properties": {
+              "keyID": {
+                "description": "The ID of the key in hexadecimal notation",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "sourceNamespaces": {
+          "description": "SourceNamespaces defines the namespaces application resources are allowed to be created in",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "sourceRepos": {
+          "description": "SourceRepos contains list of repository URLs which can be used for deployment",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "syncWindows": {
+          "description": "SyncWindows controls when syncs can be run for apps in this project",
+          "items": {
+            "description": "SyncWindow contains the kind, time, duration and attributes that are used to assign the syncWindows to apps",
+            "type": "object",
+            "properties": {
+              "andOperator": {
+                "description": "UseAndOperator use AND operator for matching applications, namespaces and clusters instead of the default OR operator",
+                "type": "boolean"
+              },
+              "applications": {
+                "description": "Applications contains a list of applications that the window will apply to",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "clusters": {
+                "description": "Clusters contains a list of clusters that the window will apply to",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "duration": {
+                "description": "Duration is the amount of time the sync window will be open",
+                "type": "string"
+              },
+              "kind": {
+                "description": "Kind defines if the window allows or blocks syncs",
+                "type": "string"
+              },
+              "manualSync": {
+                "description": "ManualSync enables manual syncs when they would otherwise be blocked",
+                "type": "boolean"
+              },
+              "namespaces": {
+                "description": "Namespaces contains a list of namespaces that the window will apply to",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "schedule": {
+                "description": "Schedule is the time the window will begin, specified in cron format",
+                "type": "string"
+              },
+              "timeZone": {
+                "description": "TimeZone of the sync that will be applied to the schedule",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "status": {
+      "description": "AppProjectStatus contains status information for AppProject CRs",
+      "properties": {
+        "jwtTokensByRole": {
+          "additionalProperties": {
+            "description": "JWTTokens represents a list of JWT tokens",
+            "type": "object",
+            "properties": {
+              "items": {
+                "type": "array",
+                "items": {
+                  "description": "JWTToken holds the issuedAt and expiresAt values of a token",
+                  "type": "object",
+                  "required": [
+                    "iat"
+                  ],
+                  "properties": {
+                    "exp": {
+                      "type": "integer",
+                      "format": "int64"
+                    },
+                    "iat": {
+                      "type": "integer",
+                      "format": "int64"
+                    },
+                    "id": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "description": "JWTTokensByRole contains a list of JWT tokens issued for a given role",
+          "type": "object"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "required": [
+    "metadata",
+    "spec"
+  ],
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SAppProjectV1alpha1.ts

@@ -0,0 +1,233 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * AppProject provides a logical grouping of applications, providing controls for:
+ * * where the apps may deploy to (cluster whitelist)
+ * * what may be deployed (repository whitelist, resource whitelist/blacklist)
+ * * who can access these applications (roles, OIDC group claims bindings)
+ * * and what they can do (RBAC policies)
+ * * automation access to these roles (JWT tokens)
+ */
+export interface K8SAppProjectV1Alpha1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata: {};
+  /**
+   * AppProjectSpec is the specification of an AppProject
+   */
+  spec: {
+    /**
+     * ClusterResourceBlacklist contains list of blacklisted cluster level resources
+     */
+    clusterResourceBlacklist?: {
+      group: string;
+      kind: string;
+    }[];
+    /**
+     * ClusterResourceWhitelist contains list of whitelisted cluster level resources
+     */
+    clusterResourceWhitelist?: {
+      group: string;
+      kind: string;
+    }[];
+    /**
+     * Description contains optional project description
+     */
+    description?: string;
+    /**
+     * DestinationServiceAccounts holds information about the service accounts to be impersonated for the application sync operation for each destination.
+     */
+    destinationServiceAccounts?: {
+      /**
+       * DefaultServiceAccount to be used for impersonation during the sync operation
+       */
+      defaultServiceAccount: string;
+      /**
+       * Namespace specifies the target namespace for the application's resources.
+       */
+      namespace?: string;
+      /**
+       * Server specifies the URL of the target cluster's Kubernetes control plane API.
+       */
+      server: string;
+    }[];
+    /**
+     * Destinations contains list of destinations available for deployment
+     */
+    destinations?: {
+      /**
+       * Name is an alternate way of specifying the target cluster by its symbolic name. This must be set if Server is not set.
+       */
+      name?: string;
+      /**
+       * Namespace specifies the target namespace for the application's resources.
+       * The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace
+       */
+      namespace?: string;
+      /**
+       * Server specifies the URL of the target cluster's Kubernetes control plane API. This must be set if Name is not set.
+       */
+      server?: string;
+    }[];
+    /**
+     * NamespaceResourceBlacklist contains list of blacklisted namespace level resources
+     */
+    namespaceResourceBlacklist?: {
+      group: string;
+      kind: string;
+    }[];
+    /**
+     * NamespaceResourceWhitelist contains list of whitelisted namespace level resources
+     */
+    namespaceResourceWhitelist?: {
+      group: string;
+      kind: string;
+    }[];
+    /**
+     * OrphanedResources specifies if controller should monitor orphaned resources of apps in this project
+     */
+    orphanedResources?: {
+      /**
+       * Ignore contains a list of resources that are to be excluded from orphaned resources monitoring
+       */
+      ignore?: {
+        group?: string;
+        kind?: string;
+        name?: string;
+      }[];
+      /**
+       * Warn indicates if warning condition should be created for apps which have orphaned resources
+       */
+      warn?: boolean;
+    };
+    /**
+     * PermitOnlyProjectScopedClusters determines whether destinations can only reference clusters which are project-scoped
+     */
+    permitOnlyProjectScopedClusters?: boolean;
+    /**
+     * Roles are user defined RBAC roles associated with this project
+     */
+    roles?: {
+      /**
+       * Description is a description of the role
+       */
+      description?: string;
+      /**
+       * Groups are a list of OIDC group claims bound to this role
+       */
+      groups?: string[];
+      /**
+       * JWTTokens are a list of generated JWT tokens bound to this role
+       */
+      jwtTokens?: {
+        exp?: number;
+        iat: number;
+        id?: string;
+      }[];
+      /**
+       * Name is a name for this role
+       */
+      name: string;
+      /**
+       * Policies Stores a list of casbin formatted strings that define access policies for the role in the project
+       */
+      policies?: string[];
+    }[];
+    /**
+     * SignatureKeys contains a list of PGP key IDs that commits in Git must be signed with in order to be allowed for sync
+     */
+    signatureKeys?: {
+      /**
+       * The ID of the key in hexadecimal notation
+       */
+      keyID: string;
+    }[];
+    /**
+     * SourceNamespaces defines the namespaces application resources are allowed to be created in
+     */
+    sourceNamespaces?: string[];
+    /**
+     * SourceRepos contains list of repository URLs which can be used for deployment
+     */
+    sourceRepos?: string[];
+    /**
+     * SyncWindows controls when syncs can be run for apps in this project
+     */
+    syncWindows?: {
+      /**
+       * UseAndOperator use AND operator for matching applications, namespaces and clusters instead of the default OR operator
+       */
+      andOperator?: boolean;
+      /**
+       * Applications contains a list of applications that the window will apply to
+       */
+      applications?: string[];
+      /**
+       * Clusters contains a list of clusters that the window will apply to
+       */
+      clusters?: string[];
+      /**
+       * Duration is the amount of time the sync window will be open
+       */
+      duration?: string;
+      /**
+       * Kind defines if the window allows or blocks syncs
+       */
+      kind?: string;
+      /**
+       * ManualSync enables manual syncs when they would otherwise be blocked
+       */
+      manualSync?: boolean;
+      /**
+       * Namespaces contains a list of namespaces that the window will apply to
+       */
+      namespaces?: string[];
+      /**
+       * Schedule is the time the window will begin, specified in cron format
+       */
+      schedule?: string;
+      /**
+       * TimeZone of the sync that will be applied to the schedule
+       */
+      timeZone?: string;
+    }[];
+  };
+  /**
+   * AppProjectStatus contains status information for AppProject CRs
+   */
+  status?: {
+    /**
+     * JWTTokensByRole contains a list of JWT tokens issued for a given role
+     */
+    jwtTokensByRole?: {
+      /**
+       * JWTTokens represents a list of JWT tokens
+       */
+      [k: string]: {
+        items?: {
+          exp?: number;
+          iat: number;
+          id?: string;
+        }[];
+      };
+    };
+  };
+}

images/operator/src/__generated__/resources/K8SAuthentikClientV1.json

@@ -0,0 +1,116 @@
+{
+  "properties": {
+    "spec": {
+      "properties": {
+        "authentik": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "clientType": {
+          "_enum": [
+            "confidential",
+            "public"
+          ],
+          "type": "string"
+        },
+        "redirectUris": {
+          "items": {
+            "type": "object",
+            "required": [
+              "url",
+              "matchingMode"
+            ],
+            "properties": {
+              "matchingMode": {
+                "type": "string",
+                "enum": [
+                  "strict",
+                  "regex"
+                ]
+              },
+              "url": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "subMode": {
+          "_enum": [
+            "hashed_user_id",
+            "user_id",
+            "user_uuid",
+            "user_username",
+            "user_email",
+            "user_upn",
+            "11184809"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "authentik",
+        "redirectUris"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "type": "object",
+            "required": [
+              "type",
+              "status",
+              "lastTransitionTime"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "message": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              },
+              "status": {
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "type": "number"
+        }
+      },
+      "required": [
+        "observedGeneration",
+        "conditions"
+      ],
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SAuthentikClientV1.ts

@@ -0,0 +1,31 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SAuthentikClientV1 {
+  spec?: {
+    authentik: {
+      name: string;
+      namespace?: string;
+    };
+    clientType?: string;
+    redirectUris: {
+      matchingMode: "strict" | "regex";
+      url: string;
+    }[];
+    subMode?: string;
+  };
+  status?: {
+    conditions: {
+      lastTransitionTime: string;
+      message?: string;
+      reason?: string;
+      status: "True" | "False" | "Unknown";
+      type: string;
+    }[];
+    observedGeneration: number;
+  };
+}

images/operator/src/__generated__/resources/K8SAuthentikServerV1.json

@@ -0,0 +1,78 @@
+{
+  "properties": {
+    "spec": {
+      "properties": {
+        "domain": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "subdomain": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "domain",
+        "subdomain"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "type": "object",
+            "required": [
+              "type",
+              "status",
+              "lastTransitionTime"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "message": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              },
+              "status": {
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "type": "number"
+        }
+      },
+      "required": [
+        "observedGeneration",
+        "conditions"
+      ],
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SAuthentikServerV1.ts

@@ -0,0 +1,26 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SAuthentikServerV1 {
+  spec?: {
+    domain: {
+      name: string;
+      namespace?: string;
+    };
+    subdomain: string;
+  };
+  status?: {
+    conditions: {
+      lastTransitionTime: string;
+      message?: string;
+      reason?: string;
+      status: "True" | "False" | "Unknown";
+      type: string;
+    }[];
+    observedGeneration: number;
+  };
+}

images/operator/src/__generated__/resources/K8SAuthorizationPolicyV1.json

@@ -0,0 +1,463 @@
+{
+  "properties": {
+    "spec": {
+      "description": "Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html",
+      "oneOf": [
+        {
+          "not": {
+            "anyOf": [
+              {
+                "required": [
+                  "provider"
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "required": [
+            "provider"
+          ]
+        }
+      ],
+      "properties": {
+        "action": {
+          "description": "Optional.\n\nValid Options: ALLOW, DENY, AUDIT, CUSTOM",
+          "_enum": [
+            "ALLOW",
+            "DENY",
+            "AUDIT",
+            "CUSTOM"
+          ],
+          "type": "string"
+        },
+        "provider": {
+          "description": "Specifies detailed configuration of the CUSTOM action.",
+          "properties": {
+            "name": {
+              "description": "Specifies the name of the extension provider.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "rules": {
+          "description": "Optional.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "from": {
+                "description": "Optional.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "source": {
+                      "description": "Source specifies the source of a request.",
+                      "type": "object",
+                      "properties": {
+                        "ipBlocks": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "namespaces": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notIpBlocks": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notNamespaces": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notPrincipals": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notRemoteIpBlocks": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notRequestPrincipals": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "principals": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "remoteIpBlocks": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "requestPrincipals": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "to": {
+                "description": "Optional.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "operation": {
+                      "description": "Operation specifies the operation of a request.",
+                      "type": "object",
+                      "properties": {
+                        "hosts": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "methods": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notHosts": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notMethods": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notPaths": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notPorts": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "paths": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "ports": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "when": {
+                "description": "Optional.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "required": [
+                    "key"
+                  ],
+                  "properties": {
+                    "key": {
+                      "description": "The name of an Istio attribute.",
+                      "type": "string"
+                    },
+                    "notValues": {
+                      "description": "Optional.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "values": {
+                      "description": "Optional.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        },
+        "selector": {
+          "description": "Optional.",
+          "properties": {
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string",
+                "maxLength": 63,
+                "x-kubernetes-validations": [
+                  {
+                    "rule": "!self.contains('*')",
+                    "message": "wildcard not allowed in label value match"
+                  }
+                ]
+              },
+              "description": "One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.",
+              "maxProperties": 4096,
+              "type": "object",
+              "x_kubernetes_validations": [
+                {
+                  "message": "wildcard not allowed in label key match",
+                  "rule": "self.all(key, !key.contains('*'))"
+                },
+                {
+                  "message": "key must not be empty",
+                  "rule": "self.all(key, key.size() != 0)"
+                }
+              ]
+            }
+          },
+          "type": "object"
+        },
+        "targetRef": {
+          "properties": {
+            "group": {
+              "description": "group is the group of the target resource.",
+              "maxLength": 253,
+              "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
+              "type": "string"
+            },
+            "kind": {
+              "description": "kind is kind of the target resource.",
+              "maxLength": 63,
+              "minLength": 1,
+              "pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
+              "type": "string"
+            },
+            "name": {
+              "description": "name is the name of the target resource.",
+              "maxLength": 253,
+              "minLength": 1,
+              "type": "string"
+            },
+            "namespace": {
+              "description": "namespace is the namespace of the referent.",
+              "type": "string",
+              "x_kubernetes_validations": [
+                {
+                  "message": "cross namespace referencing is not currently supported",
+                  "rule": "self.size() == 0"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind",
+            "name"
+          ],
+          "type": "object",
+          "x_kubernetes_validations": [
+            {
+              "message": "Support kinds are core/Service, networking.istio.io/ServiceEntry, gateway.networking.k8s.io/Gateway",
+              "rule": "[self.group, self.kind] in [['core','Service'], ['','Service'], ['gateway.networking.k8s.io','Gateway'], ['networking.istio.io','ServiceEntry']]"
+            }
+          ]
+        },
+        "targetRefs": {
+          "description": "Optional.",
+          "items": {
+            "type": "object",
+            "required": [
+              "kind",
+              "name"
+            ],
+            "properties": {
+              "group": {
+                "description": "group is the group of the target resource.",
+                "type": "string",
+                "maxLength": 253,
+                "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+              },
+              "kind": {
+                "description": "kind is kind of the target resource.",
+                "type": "string",
+                "maxLength": 63,
+                "minLength": 1,
+                "pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$"
+              },
+              "name": {
+                "description": "name is the name of the target resource.",
+                "type": "string",
+                "maxLength": 253,
+                "minLength": 1
+              },
+              "namespace": {
+                "description": "namespace is the namespace of the referent.",
+                "type": "string",
+                "x-kubernetes-validations": [
+                  {
+                    "rule": "self.size() == 0",
+                    "message": "cross namespace referencing is not currently supported"
+                  }
+                ]
+              }
+            },
+            "x-kubernetes-validations": [
+              {
+                "rule": "[self.group, self.kind] in [['core','Service'], ['','Service'], ['gateway.networking.k8s.io','Gateway'], ['networking.istio.io','ServiceEntry']]",
+                "message": "Support kinds are core/Service, networking.istio.io/ServiceEntry, gateway.networking.k8s.io/Gateway"
+              }
+            ]
+          },
+          "maxItems": 16,
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_validations": [
+        {
+          "message": "only one of targetRefs or selector can be set",
+          "rule": "(has(self.selector)?1:0)+(has(self.targetRef)?1:0)+(has(self.targetRefs)?1:0)<=1"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "description": "Current service state of the resource.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "lastProbeTime": {
+                "description": "Last time we probed the condition.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "lastTransitionTime": {
+                "description": "Last time the condition transitioned from one status to another.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "Human-readable message indicating details about last transition.",
+                "type": "string"
+              },
+              "reason": {
+                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status is the status of the condition.",
+                "type": "string"
+              },
+              "type": {
+                "description": "Type is the type of the condition.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Resource Generation to which the Reconciled Condition refers.",
+          "x_kubernetes_int_or_string": true
+        },
+        "validationMessages": {
+          "description": "Includes any errors or warnings detected by Istio's analyzers.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "documentationUrl": {
+                "description": "A url pointing to the Istio documentation for this specific error type.",
+                "type": "string"
+              },
+              "level": {
+                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
+                "type": "string",
+                "enum": [
+                  "UNKNOWN",
+                  "ERROR",
+                  "WARNING",
+                  "INFO"
+                ]
+              },
+              "type": {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "A human-readable name for the message type.",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_preserve_unknown_fields": true
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SAuthorizationPolicyV1.ts

@@ -0,0 +1,75 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SAuthorizationPolicyV1 {
+  /**
+   * Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html
+   */
+  spec?: {
+    [k: string]: unknown;
+  };
+  status?: {
+    /**
+     * Current service state of the resource.
+     */
+    conditions?: {
+      /**
+       * Last time we probed the condition.
+       */
+      lastProbeTime?: string;
+      /**
+       * Last time the condition transitioned from one status to another.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Human-readable message indicating details about last transition.
+       */
+      message?: string;
+      /**
+       * Unique, one-word, CamelCase reason for the condition's last transition.
+       */
+      reason?: string;
+      /**
+       * Status is the status of the condition.
+       */
+      status?: string;
+      /**
+       * Type is the type of the condition.
+       */
+      type?: string;
+    }[];
+    /**
+     * Resource Generation to which the Reconciled Condition refers.
+     */
+    observedGeneration?: number | string;
+    /**
+     * Includes any errors or warnings detected by Istio's analyzers.
+     */
+    validationMessages?: {
+      /**
+       * A url pointing to the Istio documentation for this specific error type.
+       */
+      documentationUrl?: string;
+      /**
+       * Represents how severe a message is.
+       *
+       * Valid Options: UNKNOWN, ERROR, WARNING, INFO
+       */
+      level?: "UNKNOWN" | "ERROR" | "WARNING" | "INFO";
+      type?: {
+        /**
+         * A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+         */
+        code?: string;
+        /**
+         * A human-readable name for the message type.
+         */
+        name?: string;
+      };
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SAuthorizationPolicyV1beta1.json

@@ -0,0 +1,463 @@
+{
+  "properties": {
+    "spec": {
+      "description": "Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html",
+      "oneOf": [
+        {
+          "not": {
+            "anyOf": [
+              {
+                "required": [
+                  "provider"
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "required": [
+            "provider"
+          ]
+        }
+      ],
+      "properties": {
+        "action": {
+          "description": "Optional.\n\nValid Options: ALLOW, DENY, AUDIT, CUSTOM",
+          "_enum": [
+            "ALLOW",
+            "DENY",
+            "AUDIT",
+            "CUSTOM"
+          ],
+          "type": "string"
+        },
+        "provider": {
+          "description": "Specifies detailed configuration of the CUSTOM action.",
+          "properties": {
+            "name": {
+              "description": "Specifies the name of the extension provider.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "rules": {
+          "description": "Optional.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "from": {
+                "description": "Optional.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "source": {
+                      "description": "Source specifies the source of a request.",
+                      "type": "object",
+                      "properties": {
+                        "ipBlocks": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "namespaces": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notIpBlocks": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notNamespaces": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notPrincipals": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notRemoteIpBlocks": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notRequestPrincipals": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "principals": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "remoteIpBlocks": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "requestPrincipals": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "to": {
+                "description": "Optional.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "operation": {
+                      "description": "Operation specifies the operation of a request.",
+                      "type": "object",
+                      "properties": {
+                        "hosts": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "methods": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notHosts": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notMethods": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notPaths": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "notPorts": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "paths": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        },
+                        "ports": {
+                          "description": "Optional.",
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "when": {
+                "description": "Optional.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "required": [
+                    "key"
+                  ],
+                  "properties": {
+                    "key": {
+                      "description": "The name of an Istio attribute.",
+                      "type": "string"
+                    },
+                    "notValues": {
+                      "description": "Optional.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "values": {
+                      "description": "Optional.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        },
+        "selector": {
+          "description": "Optional.",
+          "properties": {
+            "matchLabels": {
+              "additionalProperties": {
+                "type": "string",
+                "maxLength": 63,
+                "x-kubernetes-validations": [
+                  {
+                    "rule": "!self.contains('*')",
+                    "message": "wildcard not allowed in label value match"
+                  }
+                ]
+              },
+              "description": "One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.",
+              "maxProperties": 4096,
+              "type": "object",
+              "x_kubernetes_validations": [
+                {
+                  "message": "wildcard not allowed in label key match",
+                  "rule": "self.all(key, !key.contains('*'))"
+                },
+                {
+                  "message": "key must not be empty",
+                  "rule": "self.all(key, key.size() != 0)"
+                }
+              ]
+            }
+          },
+          "type": "object"
+        },
+        "targetRef": {
+          "properties": {
+            "group": {
+              "description": "group is the group of the target resource.",
+              "maxLength": 253,
+              "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
+              "type": "string"
+            },
+            "kind": {
+              "description": "kind is kind of the target resource.",
+              "maxLength": 63,
+              "minLength": 1,
+              "pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
+              "type": "string"
+            },
+            "name": {
+              "description": "name is the name of the target resource.",
+              "maxLength": 253,
+              "minLength": 1,
+              "type": "string"
+            },
+            "namespace": {
+              "description": "namespace is the namespace of the referent.",
+              "type": "string",
+              "x_kubernetes_validations": [
+                {
+                  "message": "cross namespace referencing is not currently supported",
+                  "rule": "self.size() == 0"
+                }
+              ]
+            }
+          },
+          "required": [
+            "kind",
+            "name"
+          ],
+          "type": "object",
+          "x_kubernetes_validations": [
+            {
+              "message": "Support kinds are core/Service, networking.istio.io/ServiceEntry, gateway.networking.k8s.io/Gateway",
+              "rule": "[self.group, self.kind] in [['core','Service'], ['','Service'], ['gateway.networking.k8s.io','Gateway'], ['networking.istio.io','ServiceEntry']]"
+            }
+          ]
+        },
+        "targetRefs": {
+          "description": "Optional.",
+          "items": {
+            "type": "object",
+            "required": [
+              "kind",
+              "name"
+            ],
+            "properties": {
+              "group": {
+                "description": "group is the group of the target resource.",
+                "type": "string",
+                "maxLength": 253,
+                "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+              },
+              "kind": {
+                "description": "kind is kind of the target resource.",
+                "type": "string",
+                "maxLength": 63,
+                "minLength": 1,
+                "pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$"
+              },
+              "name": {
+                "description": "name is the name of the target resource.",
+                "type": "string",
+                "maxLength": 253,
+                "minLength": 1
+              },
+              "namespace": {
+                "description": "namespace is the namespace of the referent.",
+                "type": "string",
+                "x-kubernetes-validations": [
+                  {
+                    "rule": "self.size() == 0",
+                    "message": "cross namespace referencing is not currently supported"
+                  }
+                ]
+              }
+            },
+            "x-kubernetes-validations": [
+              {
+                "rule": "[self.group, self.kind] in [['core','Service'], ['','Service'], ['gateway.networking.k8s.io','Gateway'], ['networking.istio.io','ServiceEntry']]",
+                "message": "Support kinds are core/Service, networking.istio.io/ServiceEntry, gateway.networking.k8s.io/Gateway"
+              }
+            ]
+          },
+          "maxItems": 16,
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_validations": [
+        {
+          "message": "only one of targetRefs or selector can be set",
+          "rule": "(has(self.selector)?1:0)+(has(self.targetRef)?1:0)+(has(self.targetRefs)?1:0)<=1"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "description": "Current service state of the resource.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "lastProbeTime": {
+                "description": "Last time we probed the condition.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "lastTransitionTime": {
+                "description": "Last time the condition transitioned from one status to another.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "Human-readable message indicating details about last transition.",
+                "type": "string"
+              },
+              "reason": {
+                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status is the status of the condition.",
+                "type": "string"
+              },
+              "type": {
+                "description": "Type is the type of the condition.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Resource Generation to which the Reconciled Condition refers.",
+          "x_kubernetes_int_or_string": true
+        },
+        "validationMessages": {
+          "description": "Includes any errors or warnings detected by Istio's analyzers.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "documentationUrl": {
+                "description": "A url pointing to the Istio documentation for this specific error type.",
+                "type": "string"
+              },
+              "level": {
+                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
+                "type": "string",
+                "enum": [
+                  "UNKNOWN",
+                  "ERROR",
+                  "WARNING",
+                  "INFO"
+                ]
+              },
+              "type": {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "A human-readable name for the message type.",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_preserve_unknown_fields": true
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SAuthorizationPolicyV1beta1.ts

@@ -0,0 +1,75 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SAuthorizationPolicyV1Beta1 {
+  /**
+   * Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html
+   */
+  spec?: {
+    [k: string]: unknown;
+  };
+  status?: {
+    /**
+     * Current service state of the resource.
+     */
+    conditions?: {
+      /**
+       * Last time we probed the condition.
+       */
+      lastProbeTime?: string;
+      /**
+       * Last time the condition transitioned from one status to another.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Human-readable message indicating details about last transition.
+       */
+      message?: string;
+      /**
+       * Unique, one-word, CamelCase reason for the condition's last transition.
+       */
+      reason?: string;
+      /**
+       * Status is the status of the condition.
+       */
+      status?: string;
+      /**
+       * Type is the type of the condition.
+       */
+      type?: string;
+    }[];
+    /**
+     * Resource Generation to which the Reconciled Condition refers.
+     */
+    observedGeneration?: number | string;
+    /**
+     * Includes any errors or warnings detected by Istio's analyzers.
+     */
+    validationMessages?: {
+      /**
+       * A url pointing to the Istio documentation for this specific error type.
+       */
+      documentationUrl?: string;
+      /**
+       * Represents how severe a message is.
+       *
+       * Valid Options: UNKNOWN, ERROR, WARNING, INFO
+       */
+      level?: "UNKNOWN" | "ERROR" | "WARNING" | "INFO";
+      type?: {
+        /**
+         * A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+         */
+        code?: string;
+        /**
+         * A human-readable name for the message type.
+         */
+        name?: string;
+      };
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SBucketV1.json

@@ -0,0 +1,315 @@
+{
+  "description": "Bucket is the Schema for the buckets API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "BucketSpec specifies the required configuration to produce an Artifact for\nan object storage bucket.",
+      "properties": {
+        "bucketName": {
+          "description": "BucketName is the name of the object storage bucket.",
+          "type": "string"
+        },
+        "certSecretRef": {
+          "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nbucket. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `generic` provider.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "endpoint": {
+          "description": "Endpoint is the object storage address the BucketName is located at.",
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS HTTP Endpoint.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the Bucket Endpoint is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "prefix": {
+          "description": "Prefix to use for server-side filtering of files in the Bucket.",
+          "type": "string"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "Provider of the object storage bucket.\nDefaults to 'generic', which expects an S3 (API) compatible object\nstorage.",
+          "_enum": [
+            "generic",
+            "aws",
+            "gcp",
+            "azure"
+          ],
+          "type": "string"
+        },
+        "proxySecretRef": {
+          "description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the Bucket server.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "region": {
+          "description": "Region of the Endpoint where the BucketName is located in.",
+          "type": "string"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials\nfor the Bucket.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "sts": {
+          "description": "STS specifies the required configuration to use a Security Token\nService for fetching temporary credentials to authenticate in a\nBucket provider.\n\nThis field is only supported for the `aws` and `generic` providers.",
+          "properties": {
+            "certSecretRef": {
+              "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nSTS endpoint. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `ldap` provider.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            },
+            "endpoint": {
+              "description": "Endpoint is the HTTP/S endpoint of the Security Token Service from\nwhere temporary credentials will be fetched.",
+              "pattern": "^(http|https)://.*$",
+              "type": "string"
+            },
+            "provider": {
+              "description": "Provider of the Security Token Service.",
+              "_enum": [
+                "aws",
+                "ldap"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Secret containing authentication credentials\nfor the STS endpoint. This Secret must contain the fields `username`\nand `password` and is supported only for the `ldap` provider.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "endpoint",
+            "provider"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nBucket.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "Timeout for fetch operations, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "bucketName",
+        "endpoint",
+        "interval"
+      ],
+      "type": "object",
+      "x_kubernetes_validations": [
+        {
+          "message": "STS configuration is only supported for the 'aws' and 'generic' Bucket providers",
+          "rule": "self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)"
+        },
+        {
+          "message": "'aws' is the only supported STS provider for the 'aws' Bucket provider",
+          "rule": "self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws'"
+        },
+        {
+          "message": "'ldap' is the only supported STS provider for the 'generic' Bucket provider",
+          "rule": "self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap'"
+        },
+        {
+          "message": "spec.sts.secretRef is not required for the 'aws' STS provider",
+          "rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)"
+        },
+        {
+          "message": "spec.sts.certSecretRef is not required for the 'aws' STS provider",
+          "rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)"
+        }
+      ]
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "BucketStatus records the observed state of a Bucket.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful Bucket reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the Bucket.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the Bucket object.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SBucketV1.ts

@@ -0,0 +1,278 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * Bucket is the Schema for the buckets API.
+ */
+export interface K8SBucketV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * BucketSpec specifies the required configuration to produce an Artifact for
+   * an object storage bucket.
+   */
+  spec?: {
+    /**
+     * BucketName is the name of the object storage bucket.
+     */
+    bucketName: string;
+    /**
+     * CertSecretRef can be given the name of a Secret containing
+     * either or both of
+     *
+     * - a PEM-encoded client certificate (`tls.crt`) and private
+     * key (`tls.key`);
+     * - a PEM-encoded CA certificate (`ca.crt`)
+     *
+     * and whichever are supplied, will be used for connecting to the
+     * bucket. The client cert and key are useful if you are
+     * authenticating with a certificate; the CA cert is useful if
+     * you are using a self-signed server certificate. The Secret must
+     * be of type `Opaque` or `kubernetes.io/tls`.
+     *
+     * This field is only supported for the `generic` provider.
+     */
+    certSecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Endpoint is the object storage address the BucketName is located at.
+     */
+    endpoint: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Insecure allows connecting to a non-TLS HTTP Endpoint.
+     */
+    insecure?: boolean;
+    /**
+     * Interval at which the Bucket Endpoint is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * Prefix to use for server-side filtering of files in the Bucket.
+     */
+    prefix?: string;
+    /**
+     * Provider of the object storage bucket.
+     * Defaults to 'generic', which expects an S3 (API) compatible object
+     * storage.
+     */
+    provider?: string;
+    /**
+     * ProxySecretRef specifies the Secret containing the proxy configuration
+     * to use while communicating with the Bucket server.
+     */
+    proxySecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Region of the Endpoint where the BucketName is located in.
+     */
+    region?: string;
+    /**
+     * SecretRef specifies the Secret containing authentication credentials
+     * for the Bucket.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * STS specifies the required configuration to use a Security Token
+     * Service for fetching temporary credentials to authenticate in a
+     * Bucket provider.
+     *
+     * This field is only supported for the `aws` and `generic` providers.
+     */
+    sts?: {
+      /**
+       * CertSecretRef can be given the name of a Secret containing
+       * either or both of
+       *
+       * - a PEM-encoded client certificate (`tls.crt`) and private
+       * key (`tls.key`);
+       * - a PEM-encoded CA certificate (`ca.crt`)
+       *
+       * and whichever are supplied, will be used for connecting to the
+       * STS endpoint. The client cert and key are useful if you are
+       * authenticating with a certificate; the CA cert is useful if
+       * you are using a self-signed server certificate. The Secret must
+       * be of type `Opaque` or `kubernetes.io/tls`.
+       *
+       * This field is only supported for the `ldap` provider.
+       */
+      certSecretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * Endpoint is the HTTP/S endpoint of the Security Token Service from
+       * where temporary credentials will be fetched.
+       */
+      endpoint: string;
+      /**
+       * Provider of the Security Token Service.
+       */
+      provider: string;
+      /**
+       * SecretRef specifies the Secret containing authentication credentials
+       * for the STS endpoint. This Secret must contain the fields `username`
+       * and `password` and is supported only for the `ldap` provider.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * Bucket.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout for fetch operations, defaults to 60s.
+     */
+    timeout?: string;
+  };
+  /**
+   * BucketStatus records the observed state of a Bucket.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful Bucket reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the Bucket.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the Bucket object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * BucketStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SBucketV1beta1.json

@@ -0,0 +1,219 @@
+{
+  "description": "Bucket is the Schema for the buckets API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "BucketSpec defines the desired state of an S3 compatible bucket",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom defines an Access Control List for allowing cross-namespace references to this object.",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "bucketName": {
+          "description": "The bucket name.",
+          "type": "string"
+        },
+        "endpoint": {
+          "description": "The bucket endpoint address.",
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS S3 HTTP endpoint.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "The interval at which to check for bucket updates.",
+          "type": "string"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "The S3 compatible storage provider name, default ('generic').",
+          "_enum": [
+            "generic",
+            "aws",
+            "gcp"
+          ],
+          "type": "string"
+        },
+        "region": {
+          "description": "The bucket region.",
+          "type": "string"
+        },
+        "secretRef": {
+          "description": "The name of the secret containing authentication credentials\nfor the Bucket.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "The timeout for download operations, defaults to 60s.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "bucketName",
+        "endpoint",
+        "interval"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "BucketStatus defines the observed state of a bucket",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful Bucket sync.",
+          "properties": {
+            "checksum": {
+              "description": "Checksum is the SHA256 checksum of the artifact.",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "path": {
+              "description": "Path is the relative file path of this artifact.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+              "type": "string"
+            },
+            "url": {
+              "description": "URL is the HTTP address of this artifact.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the Bucket.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the download link for the artifact output of the last Bucket sync.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SBucketV1beta1.ts

@@ -0,0 +1,184 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * Bucket is the Schema for the buckets API
+ */
+export interface K8SBucketV1Beta1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * BucketSpec defines the desired state of an S3 compatible bucket
+   */
+  spec?: {
+    /**
+     * AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * The bucket name.
+     */
+    bucketName: string;
+    /**
+     * The bucket endpoint address.
+     */
+    endpoint: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Insecure allows connecting to a non-TLS S3 HTTP endpoint.
+     */
+    insecure?: boolean;
+    /**
+     * The interval at which to check for bucket updates.
+     */
+    interval: string;
+    /**
+     * The S3 compatible storage provider name, default ('generic').
+     */
+    provider?: string;
+    /**
+     * The bucket region.
+     */
+    region?: string;
+    /**
+     * The name of the secret containing authentication credentials
+     * for the Bucket.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * The timeout for download operations, defaults to 60s.
+     */
+    timeout?: string;
+  };
+  /**
+   * BucketStatus defines the observed state of a bucket
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful Bucket sync.
+     */
+    artifact?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the Bucket.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the download link for the artifact output of the last Bucket sync.
+     */
+    url?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SBucketV1beta2.json

@@ -0,0 +1,341 @@
+{
+  "description": "Bucket is the Schema for the buckets API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "BucketSpec specifies the required configuration to produce an Artifact for\nan object storage bucket.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom specifies an Access Control List for allowing cross-namespace\nreferences to this object.\nNOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "bucketName": {
+          "description": "BucketName is the name of the object storage bucket.",
+          "type": "string"
+        },
+        "certSecretRef": {
+          "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nbucket. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `generic` provider.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "endpoint": {
+          "description": "Endpoint is the object storage address the BucketName is located at.",
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS HTTP Endpoint.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the Bucket Endpoint is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "prefix": {
+          "description": "Prefix to use for server-side filtering of files in the Bucket.",
+          "type": "string"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "Provider of the object storage bucket.\nDefaults to 'generic', which expects an S3 (API) compatible object\nstorage.",
+          "_enum": [
+            "generic",
+            "aws",
+            "gcp",
+            "azure"
+          ],
+          "type": "string"
+        },
+        "proxySecretRef": {
+          "description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the Bucket server.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "region": {
+          "description": "Region of the Endpoint where the BucketName is located in.",
+          "type": "string"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials\nfor the Bucket.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "sts": {
+          "description": "STS specifies the required configuration to use a Security Token\nService for fetching temporary credentials to authenticate in a\nBucket provider.\n\nThis field is only supported for the `aws` and `generic` providers.",
+          "properties": {
+            "certSecretRef": {
+              "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nSTS endpoint. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `ldap` provider.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            },
+            "endpoint": {
+              "description": "Endpoint is the HTTP/S endpoint of the Security Token Service from\nwhere temporary credentials will be fetched.",
+              "pattern": "^(http|https)://.*$",
+              "type": "string"
+            },
+            "provider": {
+              "description": "Provider of the Security Token Service.",
+              "_enum": [
+                "aws",
+                "ldap"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Secret containing authentication credentials\nfor the STS endpoint. This Secret must contain the fields `username`\nand `password` and is supported only for the `ldap` provider.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "endpoint",
+            "provider"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nBucket.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "Timeout for fetch operations, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "bucketName",
+        "endpoint",
+        "interval"
+      ],
+      "type": "object",
+      "x_kubernetes_validations": [
+        {
+          "message": "STS configuration is only supported for the 'aws' and 'generic' Bucket providers",
+          "rule": "self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)"
+        },
+        {
+          "message": "'aws' is the only supported STS provider for the 'aws' Bucket provider",
+          "rule": "self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws'"
+        },
+        {
+          "message": "'ldap' is the only supported STS provider for the 'generic' Bucket provider",
+          "rule": "self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap'"
+        },
+        {
+          "message": "spec.sts.secretRef is not required for the 'aws' STS provider",
+          "rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)"
+        },
+        {
+          "message": "spec.sts.certSecretRef is not required for the 'aws' STS provider",
+          "rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)"
+        }
+      ]
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "BucketStatus records the observed state of a Bucket.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful Bucket reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the Bucket.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the Bucket object.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SBucketV1beta2.ts

@@ -0,0 +1,299 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * Bucket is the Schema for the buckets API.
+ */
+export interface K8SBucketV1Beta2 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * BucketSpec specifies the required configuration to produce an Artifact for
+   * an object storage bucket.
+   */
+  spec?: {
+    /**
+     * AccessFrom specifies an Access Control List for allowing cross-namespace
+     * references to this object.
+     * NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * BucketName is the name of the object storage bucket.
+     */
+    bucketName: string;
+    /**
+     * CertSecretRef can be given the name of a Secret containing
+     * either or both of
+     *
+     * - a PEM-encoded client certificate (`tls.crt`) and private
+     * key (`tls.key`);
+     * - a PEM-encoded CA certificate (`ca.crt`)
+     *
+     * and whichever are supplied, will be used for connecting to the
+     * bucket. The client cert and key are useful if you are
+     * authenticating with a certificate; the CA cert is useful if
+     * you are using a self-signed server certificate. The Secret must
+     * be of type `Opaque` or `kubernetes.io/tls`.
+     *
+     * This field is only supported for the `generic` provider.
+     */
+    certSecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Endpoint is the object storage address the BucketName is located at.
+     */
+    endpoint: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Insecure allows connecting to a non-TLS HTTP Endpoint.
+     */
+    insecure?: boolean;
+    /**
+     * Interval at which the Bucket Endpoint is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * Prefix to use for server-side filtering of files in the Bucket.
+     */
+    prefix?: string;
+    /**
+     * Provider of the object storage bucket.
+     * Defaults to 'generic', which expects an S3 (API) compatible object
+     * storage.
+     */
+    provider?: string;
+    /**
+     * ProxySecretRef specifies the Secret containing the proxy configuration
+     * to use while communicating with the Bucket server.
+     */
+    proxySecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Region of the Endpoint where the BucketName is located in.
+     */
+    region?: string;
+    /**
+     * SecretRef specifies the Secret containing authentication credentials
+     * for the Bucket.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * STS specifies the required configuration to use a Security Token
+     * Service for fetching temporary credentials to authenticate in a
+     * Bucket provider.
+     *
+     * This field is only supported for the `aws` and `generic` providers.
+     */
+    sts?: {
+      /**
+       * CertSecretRef can be given the name of a Secret containing
+       * either or both of
+       *
+       * - a PEM-encoded client certificate (`tls.crt`) and private
+       * key (`tls.key`);
+       * - a PEM-encoded CA certificate (`ca.crt`)
+       *
+       * and whichever are supplied, will be used for connecting to the
+       * STS endpoint. The client cert and key are useful if you are
+       * authenticating with a certificate; the CA cert is useful if
+       * you are using a self-signed server certificate. The Secret must
+       * be of type `Opaque` or `kubernetes.io/tls`.
+       *
+       * This field is only supported for the `ldap` provider.
+       */
+      certSecretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * Endpoint is the HTTP/S endpoint of the Security Token Service from
+       * where temporary credentials will be fetched.
+       */
+      endpoint: string;
+      /**
+       * Provider of the Security Token Service.
+       */
+      provider: string;
+      /**
+       * SecretRef specifies the Secret containing authentication credentials
+       * for the STS endpoint. This Secret must contain the fields `username`
+       * and `password` and is supported only for the `ldap` provider.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * Bucket.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout for fetch operations, defaults to 60s.
+     */
+    timeout?: string;
+  };
+  /**
+   * BucketStatus records the observed state of a Bucket.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful Bucket reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the Bucket.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the Bucket object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * BucketStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SCertificateRequestV1.json

@@ -0,0 +1,185 @@
+{
+  "description": "A CertificateRequest is used to request a signed certificate from one of the\nconfigured issuers.\n\nAll fields within the CertificateRequest's `spec` are immutable after creation.\nA CertificateRequest will either succeed or fail, as denoted by its `Ready` status\ncondition and its `status.failureTime` field.\n\nA CertificateRequest is a one-shot resource, meaning it represents a single\npoint in time request for a certificate and cannot be re-used.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "Specification of the desired state of the CertificateRequest resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+      "properties": {
+        "duration": {
+          "description": "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.",
+          "type": "string"
+        },
+        "extra": {
+          "additionalProperties": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "description": "Extra contains extra attributes of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
+          "type": "object"
+        },
+        "groups": {
+          "description": "Groups contains group membership of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "x_kubernetes_list_type": "atomic"
+        },
+        "isCA": {
+          "description": "Requested basic constraints isCA value. Note that the issuer may choose\nto ignore the requested isCA value, just like any other requested attribute.\n\nNOTE: If the CSR in the `Request` field has a BasicConstraints extension,\nit must have the same isCA value as specified here.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.",
+          "type": "boolean"
+        },
+        "issuerRef": {
+          "description": "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.",
+          "properties": {
+            "group": {
+              "description": "Group of the resource being referred to.",
+              "type": "string"
+            },
+            "kind": {
+              "description": "Kind of the resource being referred to.",
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the resource being referred to.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "request": {
+          "description": "The PEM-encoded X.509 certificate signing request to be submitted to the\nissuer for signing.\n\nIf the CSR has a BasicConstraints extension, its isCA attribute must\nmatch the `isCA` value of this CertificateRequest.\nIf the CSR has a KeyUsage extension, its key usages must match the\nkey usages in the `usages` field of this CertificateRequest.\nIf the CSR has a ExtKeyUsage extension, its extended key usages\nmust match the extended key usages in the `usages` field of this\nCertificateRequest.",
+          "format": "byte",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID contains the uid of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
+          "type": "string"
+        },
+        "usages": {
+          "description": "Requested key usages and extended key usages.\n\nNOTE: If the CSR in the `Request` field has uses the KeyUsage or\nExtKeyUsage extension, these extensions must have the same values\nas specified here without any additional values.\n\nIf unset, defaults to `digital signature` and `key encipherment`.",
+          "items": {
+            "description": "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"",
+            "type": "string",
+            "enum": [
+              "signing",
+              "digital signature",
+              "content commitment",
+              "key encipherment",
+              "key agreement",
+              "data encipherment",
+              "cert sign",
+              "crl sign",
+              "encipher only",
+              "decipher only",
+              "any",
+              "server auth",
+              "client auth",
+              "code signing",
+              "email protection",
+              "s/mime",
+              "ipsec end system",
+              "ipsec tunnel",
+              "ipsec user",
+              "timestamping",
+              "ocsp signing",
+              "microsoft sgc",
+              "netscape sgc"
+            ]
+          },
+          "type": "array"
+        },
+        "username": {
+          "description": "Username contains the name of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "issuerRef",
+        "request"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "description": "Status of the CertificateRequest.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+      "properties": {
+        "ca": {
+          "description": "The PEM encoded X.509 certificate of the signer, also known as the CA\n(Certificate Authority).\nThis is set on a best-effort basis by different issuers.\nIf not set, the CA is assumed to be unknown/not available.",
+          "format": "byte",
+          "type": "string"
+        },
+        "certificate": {
+          "description": "The PEM encoded X.509 certificate resulting from the certificate\nsigning request.\nIf not set, the CertificateRequest has either not been completed or has\nfailed. More information on failure can be found by checking the\n`conditions` field.",
+          "format": "byte",
+          "type": "string"
+        },
+        "conditions": {
+          "description": "List of status conditions to indicate the status of a CertificateRequest.\nKnown condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.",
+          "items": {
+            "description": "CertificateRequestCondition contains condition information for a CertificateRequest.",
+            "type": "object",
+            "required": [
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "Message is a human readable description of the details of the last\ntransition, complementing reason.",
+                "type": "string"
+              },
+              "reason": {
+                "description": "Reason is a brief machine readable explanation for the condition's last\ntransition.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status of the condition, one of (`True`, `False`, `Unknown`).",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "Type of the condition, known values are (`Ready`, `InvalidRequest`,\n`Approved`, `Denied`).",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array",
+          "x_kubernetes_list_map_keys": [
+            "type"
+          ],
+          "x_kubernetes_list_type": "map"
+        },
+        "failureTime": {
+          "description": "FailureTime stores the time that this CertificateRequest failed. This is\nused to influence garbage collection and back-off.",
+          "format": "date-time",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SCertificateRequestV1.ts

@@ -0,0 +1,208 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * A CertificateRequest is used to request a signed certificate from one of the
+ * configured issuers.
+ *
+ * All fields within the CertificateRequest's `spec` are immutable after creation.
+ * A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
+ * condition and its `status.failureTime` field.
+ *
+ * A CertificateRequest is a one-shot resource, meaning it represents a single
+ * point in time request for a certificate and cannot be re-used.
+ */
+export interface K8SCertificateRequestV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * Specification of the desired state of the CertificateRequest resource.
+   * https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+   */
+  spec?: {
+    /**
+     * Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
+     * issuer may choose to ignore the requested duration, just like any other
+     * requested attribute.
+     */
+    duration?: string;
+    /**
+     * Extra contains extra attributes of the user that created the CertificateRequest.
+     * Populated by the cert-manager webhook on creation and immutable.
+     */
+    extra?: {
+      [k: string]: string[];
+    };
+    /**
+     * Groups contains group membership of the user that created the CertificateRequest.
+     * Populated by the cert-manager webhook on creation and immutable.
+     */
+    groups?: string[];
+    /**
+     * Requested basic constraints isCA value. Note that the issuer may choose
+     * to ignore the requested isCA value, just like any other requested attribute.
+     *
+     * NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
+     * it must have the same isCA value as specified here.
+     *
+     * If true, this will automatically add the `cert sign` usage to the list
+     * of requested `usages`.
+     */
+    isCA?: boolean;
+    /**
+     * Reference to the issuer responsible for issuing the certificate.
+     * If the issuer is namespace-scoped, it must be in the same namespace
+     * as the Certificate. If the issuer is cluster-scoped, it can be used
+     * from any namespace.
+     *
+     * The `name` field of the reference must always be specified.
+     */
+    issuerRef: {
+      /**
+       * Group of the resource being referred to.
+       */
+      group?: string;
+      /**
+       * Kind of the resource being referred to.
+       */
+      kind?: string;
+      /**
+       * Name of the resource being referred to.
+       */
+      name: string;
+    };
+    /**
+     * The PEM-encoded X.509 certificate signing request to be submitted to the
+     * issuer for signing.
+     *
+     * If the CSR has a BasicConstraints extension, its isCA attribute must
+     * match the `isCA` value of this CertificateRequest.
+     * If the CSR has a KeyUsage extension, its key usages must match the
+     * key usages in the `usages` field of this CertificateRequest.
+     * If the CSR has a ExtKeyUsage extension, its extended key usages
+     * must match the extended key usages in the `usages` field of this
+     * CertificateRequest.
+     */
+    request: string;
+    /**
+     * UID contains the uid of the user that created the CertificateRequest.
+     * Populated by the cert-manager webhook on creation and immutable.
+     */
+    uid?: string;
+    /**
+     * Requested key usages and extended key usages.
+     *
+     * NOTE: If the CSR in the `Request` field has uses the KeyUsage or
+     * ExtKeyUsage extension, these extensions must have the same values
+     * as specified here without any additional values.
+     *
+     * If unset, defaults to `digital signature` and `key encipherment`.
+     */
+    usages?: (
+      | "signing"
+      | "digital signature"
+      | "content commitment"
+      | "key encipherment"
+      | "key agreement"
+      | "data encipherment"
+      | "cert sign"
+      | "crl sign"
+      | "encipher only"
+      | "decipher only"
+      | "any"
+      | "server auth"
+      | "client auth"
+      | "code signing"
+      | "email protection"
+      | "s/mime"
+      | "ipsec end system"
+      | "ipsec tunnel"
+      | "ipsec user"
+      | "timestamping"
+      | "ocsp signing"
+      | "microsoft sgc"
+      | "netscape sgc"
+    )[];
+    /**
+     * Username contains the name of the user that created the CertificateRequest.
+     * Populated by the cert-manager webhook on creation and immutable.
+     */
+    username?: string;
+  };
+  /**
+   * Status of the CertificateRequest.
+   * This is set and managed automatically.
+   * Read-only.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+   */
+  status?: {
+    /**
+     * The PEM encoded X.509 certificate of the signer, also known as the CA
+     * (Certificate Authority).
+     * This is set on a best-effort basis by different issuers.
+     * If not set, the CA is assumed to be unknown/not available.
+     */
+    ca?: string;
+    /**
+     * The PEM encoded X.509 certificate resulting from the certificate
+     * signing request.
+     * If not set, the CertificateRequest has either not been completed or has
+     * failed. More information on failure can be found by checking the
+     * `conditions` field.
+     */
+    certificate?: string;
+    /**
+     * List of status conditions to indicate the status of a CertificateRequest.
+     * Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
+     */
+    conditions?: {
+      /**
+       * LastTransitionTime is the timestamp corresponding to the last status
+       * change of this condition.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Message is a human readable description of the details of the last
+       * transition, complementing reason.
+       */
+      message?: string;
+      /**
+       * Reason is a brief machine readable explanation for the condition's last
+       * transition.
+       */
+      reason?: string;
+      /**
+       * Status of the condition, one of (`True`, `False`, `Unknown`).
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * Type of the condition, known values are (`Ready`, `InvalidRequest`,
+       * `Approved`, `Denied`).
+       */
+      type: string;
+    }[];
+    /**
+     * FailureTime stores the time that this CertificateRequest failed. This is
+     * used to influence garbage collection and back-off.
+     */
+    failureTime?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SCertificateV1.json

@@ -0,0 +1,564 @@
+{
+  "description": "A Certificate resource should be created to ensure an up to date and signed\nX.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.\n\nThe stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "Specification of the desired state of the Certificate resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+      "properties": {
+        "additionalOutputFormats": {
+          "description": "Defines extra output formats of the private key and signed certificate chain\nto be written to this Certificate's target Secret.",
+          "items": {
+            "description": "CertificateAdditionalOutputFormat defines an additional output format of a\nCertificate resource. These contain supplementary data formats of the signed\ncertificate chain and paired private key.",
+            "type": "object",
+            "required": [
+              "type"
+            ],
+            "properties": {
+              "type": {
+                "description": "Type is the name of the format type that should be written to the\nCertificate's target Secret.",
+                "type": "string",
+                "enum": [
+                  "DER",
+                  "CombinedPEM"
+                ]
+              }
+            }
+          },
+          "type": "array"
+        },
+        "commonName": {
+          "description": "Requested common name X509 certificate subject attribute.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\nNOTE: TLS clients will ignore this value when any subject alternative name is\nset (see https://tools.ietf.org/html/rfc6125#section-6.4.4).\n\nShould have a length of 64 characters or fewer to avoid generating invalid CSRs.\nCannot be set if the `literalSubject` field is set.",
+          "type": "string"
+        },
+        "dnsNames": {
+          "description": "Requested DNS subject alternative names.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "duration": {
+          "description": "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.\n\nIf unset, this defaults to 90 days.\nMinimum accepted duration is 1 hour.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.",
+          "type": "string"
+        },
+        "emailAddresses": {
+          "description": "Requested email subject alternative names.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "encodeUsagesInRequest": {
+          "description": "Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.\n\nThis option defaults to true, and should only be disabled if the target\nissuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.",
+          "type": "boolean"
+        },
+        "ipAddresses": {
+          "description": "Requested IP address subject alternative names.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "isCA": {
+          "description": "Requested basic constraints isCA value.\nThe isCA value is used to set the `isCA` field on the created CertificateRequest\nresources. Note that the issuer may choose to ignore the requested isCA value, just\nlike any other requested attribute.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.",
+          "type": "boolean"
+        },
+        "issuerRef": {
+          "description": "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.",
+          "properties": {
+            "group": {
+              "description": "Group of the resource being referred to.",
+              "type": "string"
+            },
+            "kind": {
+              "description": "Kind of the resource being referred to.",
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the resource being referred to.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "keystores": {
+          "description": "Additional keystore output formats to be stored in the Certificate's Secret.",
+          "properties": {
+            "jks": {
+              "description": "JKS configures options for storing a JKS keystore in the\n`spec.secretName` Secret resource.",
+              "properties": {
+                "alias": {
+                  "description": "Alias specifies the alias of the key in the keystore, required by the JKS format.\nIf not provided, the default alias `certificate` will be used.",
+                  "type": "string"
+                },
+                "create": {
+                  "description": "Create enables JKS keystore creation for the Certificate.\nIf true, a file named `keystore.jks` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.jks`\nwill also be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef`\ncontaining the issuing Certificate Authority",
+                  "type": "boolean"
+                },
+                "password": {
+                  "description": "Password provides a literal password used to encrypt the JKS keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
+                  "type": "string"
+                },
+                "passwordSecretRef": {
+                  "description": "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the JKS keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
+                  "properties": {
+                    "key": {
+                      "description": "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.",
+                      "type": "string"
+                    },
+                    "name": {
+                      "description": "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "name"
+                  ],
+                  "type": "object"
+                }
+              },
+              "required": [
+                "create"
+              ],
+              "type": "object"
+            },
+            "pkcs12": {
+              "description": "PKCS12 configures options for storing a PKCS12 keystore in the\n`spec.secretName` Secret resource.",
+              "properties": {
+                "create": {
+                  "description": "Create enables PKCS12 keystore creation for the Certificate.\nIf true, a file named `keystore.p12` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or in `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.p12` will\nalso be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef` containing the issuing Certificate\nAuthority",
+                  "type": "boolean"
+                },
+                "password": {
+                  "description": "Password provides a literal password used to encrypt the PKCS#12 keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
+                  "type": "string"
+                },
+                "passwordSecretRef": {
+                  "description": "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the PKCS#12 keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.",
+                  "properties": {
+                    "key": {
+                      "description": "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.",
+                      "type": "string"
+                    },
+                    "name": {
+                      "description": "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "name"
+                  ],
+                  "type": "object"
+                },
+                "profile": {
+                  "description": "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm\nused to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.\n\nIf provided, allowed values are:\n`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.\n`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.\n`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms\n(e.g., because of company policy). Please note that the security of the algorithm is not that important\nin reality, because the unencrypted certificate and private key are also stored in the Secret.",
+                  "_enum": [
+                    "LegacyRC2",
+                    "LegacyDES",
+                    "Modern2023"
+                  ],
+                  "type": "string"
+                }
+              },
+              "required": [
+                "create"
+              ],
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "literalSubject": {
+          "description": "Requested X.509 certificate subject, represented using the LDAP \"String\nRepresentation of a Distinguished Name\" [1].\nImportant: the LDAP string format also specifies the order of the attributes\nin the subject, this is important when issuing certs for LDAP authentication.\nExample: `CN=foo,DC=corp,DC=example,DC=com`\nMore info [1]: https://datatracker.ietf.org/doc/html/rfc4514\nMore info: https://github.com/cert-manager/cert-manager/issues/3203\nMore info: https://github.com/cert-manager/cert-manager/issues/4424\n\nCannot be set if the `subject` or `commonName` field is set.",
+          "type": "string"
+        },
+        "nameConstraints": {
+          "description": "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.\nMore Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10\n\nThis is an Alpha Feature and is only enabled with the\n`--feature-gates=NameConstraints=true` option set on both\nthe controller and webhook components.",
+          "properties": {
+            "critical": {
+              "description": "if true then the name constraints are marked critical.",
+              "type": "boolean"
+            },
+            "excluded": {
+              "description": "Excluded contains the constraints which must be disallowed. Any name matching a\nrestriction in the excluded field is invalid regardless\nof information appearing in the permitted",
+              "properties": {
+                "dnsDomains": {
+                  "description": "DNSDomains is a list of DNS domains that are permitted or excluded.",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                "emailAddresses": {
+                  "description": "EmailAddresses is a list of Email Addresses that are permitted or excluded.",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                "ipRanges": {
+                  "description": "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                "uriDomains": {
+                  "description": "URIDomains is a list of URI domains that are permitted or excluded.",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                }
+              },
+              "type": "object"
+            },
+            "permitted": {
+              "description": "Permitted contains the constraints in which the names must be located.",
+              "properties": {
+                "dnsDomains": {
+                  "description": "DNSDomains is a list of DNS domains that are permitted or excluded.",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                "emailAddresses": {
+                  "description": "EmailAddresses is a list of Email Addresses that are permitted or excluded.",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                "ipRanges": {
+                  "description": "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                },
+                "uriDomains": {
+                  "description": "URIDomains is a list of URI domains that are permitted or excluded.",
+                  "items": {
+                    "type": "string"
+                  },
+                  "type": "array"
+                }
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "otherNames": {
+          "description": "`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37\nAny UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.\nMost commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3\nYou should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "oid": {
+                "description": "OID is the object identifier for the otherName SAN.\nThe object identifier must be expressed as a dotted string, for\nexample, \"1.2.840.113556.1.4.221\".",
+                "type": "string"
+              },
+              "utf8Value": {
+                "description": "utf8Value is the string value of the otherName SAN.\nThe utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "privateKey": {
+          "description": "Private key options. These include the key algorithm and size, the used\nencoding and the rotation policy.",
+          "properties": {
+            "algorithm": {
+              "description": "Algorithm is the private key algorithm of the corresponding private key\nfor this certificate.\n\nIf provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.\nIf `algorithm` is specified and `size` is not provided,\nkey size of 2048 will be used for `RSA` key algorithm and\nkey size of 256 will be used for `ECDSA` key algorithm.\nkey size is ignored when using the `Ed25519` key algorithm.",
+              "_enum": [
+                "RSA",
+                "ECDSA",
+                "Ed25519"
+              ],
+              "type": "string"
+            },
+            "encoding": {
+              "description": "The private key cryptography standards (PKCS) encoding for this\ncertificate's private key to be encoded in.\n\nIf provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1\nand PKCS#8, respectively.\nDefaults to `PKCS1` if not specified.",
+              "_enum": [
+                "PKCS1",
+                "PKCS8"
+              ],
+              "type": "string"
+            },
+            "rotationPolicy": {
+              "description": "RotationPolicy controls how private keys should be regenerated when a\nre-issuance is being processed.\n\nIf set to `Never`, a private key will only be generated if one does not\nalready exist in the target `spec.secretName`. If one does exist but it\ndoes not have the correct algorithm or size, a warning will be raised\nto await user intervention.\nIf set to `Always`, a private key matching the specified requirements\nwill be generated whenever a re-issuance occurs.\nDefault is `Always`.\nThe default was changed from `Never` to `Always` in cert-manager >=v1.18.0.\nThe new default can be disabled by setting the\n`--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on\nthe controller component.",
+              "_enum": [
+                "Never",
+                "Always"
+              ],
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the key bit size of the corresponding private key for this certificate.\n\nIf `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,\nand will default to `2048` if not specified.\nIf `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,\nand will default to `256` if not specified.\nIf `algorithm` is set to `Ed25519`, Size is ignored.\nNo other values are allowed.",
+              "type": "integer"
+            }
+          },
+          "type": "object"
+        },
+        "renewBefore": {
+          "description": "How long before the currently issued certificate's expiry cert-manager should\nrenew the certificate. For example, if a certificate is valid for 60 minutes,\nand `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate\n50 minutes after it was issued (i.e. when there are 10 minutes remaining until\nthe certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nIf unset, this defaults to 1/3 of the issued certificate's lifetime.\nMinimum accepted value is 5 minutes.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.\nCannot be set if the `renewBeforePercentage` field is set.",
+          "type": "string"
+        },
+        "renewBeforePercentage": {
+          "description": "`renewBeforePercentage` is like `renewBefore`, except it is a relative percentage\nrather than an absolute duration. For example, if a certificate is valid for 60\nminutes, and  `renewBeforePercentage=25`, cert-manager will begin to attempt to\nrenew the certificate 45 minutes after it was issued (i.e. when there are 15\nminutes (25%) remaining until the certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nValue must be an integer in the range (0,100). The minimum effective\n`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5\nminutes.\nCannot be set if the `renewBefore` field is set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The maximum number of CertificateRequest revisions that are maintained in\nthe Certificate's history. Each revision represents a single `CertificateRequest`\ncreated by this Certificate, either when it was created, renewed, or Spec\nwas changed. Revisions will be removed by oldest first if the number of\nrevisions exceeds this number.\n\nIf set, revisionHistoryLimit must be a value of `1` or greater.\nDefault value is `1`.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "secretName": {
+          "description": "Name of the Secret resource that will be automatically created and\nmanaged by this Certificate resource. It will be populated with a\nprivate key and certificate, signed by the denoted issuer. The Secret\nresource lives in the same namespace as the Certificate resource.",
+          "type": "string"
+        },
+        "secretTemplate": {
+          "description": "Defines annotations and labels to be copied to the Certificate's Secret.\nLabels and annotations on the Secret will be changed as they appear on the\nSecretTemplate when added or removed. SecretTemplate annotations are added\nin conjunction with, and cannot overwrite, the base set of annotations\ncert-manager sets on the Certificate's Secret.",
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Annotations is a key value map to be copied to the target Kubernetes Secret.",
+              "type": "object"
+            },
+            "labels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Labels is a key value map to be copied to the target Kubernetes Secret.",
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "signatureAlgorithm": {
+          "description": "Signature algorithm to use.\nAllowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.\nAllowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.\nAllowed values for Ed25519 keys: PureEd25519.",
+          "_enum": [
+            "SHA256WithRSA",
+            "SHA384WithRSA",
+            "SHA512WithRSA",
+            "ECDSAWithSHA256",
+            "ECDSAWithSHA384",
+            "ECDSAWithSHA512",
+            "PureEd25519"
+          ],
+          "type": "string"
+        },
+        "subject": {
+          "description": "Requested set of X509 certificate subject attributes.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\n\nThe common name attribute is specified separately in the `commonName` field.\nCannot be set if the `literalSubject` field is set.",
+          "properties": {
+            "countries": {
+              "description": "Countries to be used on the Certificate.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "localities": {
+              "description": "Cities to be used on the Certificate.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "organizationalUnits": {
+              "description": "Organizational Units to be used on the Certificate.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "organizations": {
+              "description": "Organizations to be used on the Certificate.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "postalCodes": {
+              "description": "Postal codes to be used on the Certificate.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "provinces": {
+              "description": "State/Provinces to be used on the Certificate.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "serialNumber": {
+              "description": "Serial number to be used on the Certificate.",
+              "type": "string"
+            },
+            "streetAddresses": {
+              "description": "Street addresses to be used on the Certificate.",
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "uris": {
+          "description": "Requested URI subject alternative names.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "usages": {
+          "description": "Requested key usages and extended key usages.\nThese usages are used to set the `usages` field on the created CertificateRequest\nresources. If `encodeUsagesInRequest` is unset or set to `true`, the usages\nwill additionally be encoded in the `request` field which contains the CSR blob.\n\nIf unset, defaults to `digital signature` and `key encipherment`.",
+          "items": {
+            "description": "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"",
+            "type": "string",
+            "enum": [
+              "signing",
+              "digital signature",
+              "content commitment",
+              "key encipherment",
+              "key agreement",
+              "data encipherment",
+              "cert sign",
+              "crl sign",
+              "encipher only",
+              "decipher only",
+              "any",
+              "server auth",
+              "client auth",
+              "code signing",
+              "email protection",
+              "s/mime",
+              "ipsec end system",
+              "ipsec tunnel",
+              "ipsec user",
+              "timestamping",
+              "ocsp signing",
+              "microsoft sgc",
+              "netscape sgc"
+            ]
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "issuerRef",
+        "secretName"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "description": "Status of the Certificate.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+      "properties": {
+        "conditions": {
+          "description": "List of status conditions to indicate the status of certificates.\nKnown condition types are `Ready` and `Issuing`.",
+          "items": {
+            "description": "CertificateCondition contains condition information for a Certificate.",
+            "type": "object",
+            "required": [
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "Message is a human readable description of the details of the last\ntransition, complementing reason.",
+                "type": "string"
+              },
+              "observedGeneration": {
+                "description": "If set, this represents the .metadata.generation that the condition was\nset based upon.\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the Certificate.",
+                "type": "integer",
+                "format": "int64"
+              },
+              "reason": {
+                "description": "Reason is a brief machine readable explanation for the condition's last\ntransition.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status of the condition, one of (`True`, `False`, `Unknown`).",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "Type of the condition, known values are (`Ready`, `Issuing`).",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array",
+          "x_kubernetes_list_map_keys": [
+            "type"
+          ],
+          "x_kubernetes_list_type": "map"
+        },
+        "failedIssuanceAttempts": {
+          "description": "The number of continuous failed issuance attempts up till now. This\nfield gets removed (if set) on a successful issuance and gets set to\n1 if unset and an issuance has failed. If an issuance has failed, the\ndelay till the next issuance will be calculated using formula\ntime.Hour * 2 ^ (failedIssuanceAttempts - 1).",
+          "type": "integer"
+        },
+        "lastFailureTime": {
+          "description": "LastFailureTime is set only if the latest issuance for this\nCertificate failed and contains the time of the failure. If an\nissuance has failed, the delay till the next issuance will be\ncalculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -\n1). If the latest issuance has succeeded this field will be unset.",
+          "format": "date-time",
+          "type": "string"
+        },
+        "nextPrivateKeySecretName": {
+          "description": "The name of the Secret resource containing the private key to be used\nfor the next certificate iteration.\nThe keymanager controller will automatically set this field if the\n`Issuing` condition is set to `True`.\nIt will automatically unset this field when the Issuing condition is\nnot set or False.",
+          "type": "string"
+        },
+        "notAfter": {
+          "description": "The expiration time of the certificate stored in the secret named\nby this resource in `spec.secretName`.",
+          "format": "date-time",
+          "type": "string"
+        },
+        "notBefore": {
+          "description": "The time after which the certificate stored in the secret named\nby this resource in `spec.secretName` is valid.",
+          "format": "date-time",
+          "type": "string"
+        },
+        "renewalTime": {
+          "description": "RenewalTime is the time at which the certificate will be next\nrenewed.\nIf not set, no upcoming renewal is scheduled.",
+          "format": "date-time",
+          "type": "string"
+        },
+        "revision": {
+          "description": "The current 'revision' of the certificate as issued.\n\nWhen a CertificateRequest resource is created, it will have the\n`cert-manager.io/certificate-revision` set to one greater than the\ncurrent value of this field.\n\nUpon issuance, this field will be set to the value of the annotation\non the CertificateRequest resource used to issue the certificate.\n\nPersisting the value on the CertificateRequest resource allows the\ncertificates controller to know whether a request is part of an old\nissuance or if it is part of the ongoing revision's issuance by\nchecking if the revision value in the annotation is greater than this\nfield.",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SCertificateV1.ts

@@ -0,0 +1,634 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * A Certificate resource should be created to ensure an up to date and signed
+ * X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.
+ *
+ * The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).
+ */
+export interface K8SCertificateV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * Specification of the desired state of the Certificate resource.
+   * https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+   */
+  spec?: {
+    /**
+     * Defines extra output formats of the private key and signed certificate chain
+     * to be written to this Certificate's target Secret.
+     */
+    additionalOutputFormats?: {
+      /**
+       * Type is the name of the format type that should be written to the
+       * Certificate's target Secret.
+       */
+      type: "DER" | "CombinedPEM";
+    }[];
+    /**
+     * Requested common name X509 certificate subject attribute.
+     * More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
+     * NOTE: TLS clients will ignore this value when any subject alternative name is
+     * set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
+     *
+     * Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
+     * Cannot be set if the `literalSubject` field is set.
+     */
+    commonName?: string;
+    /**
+     * Requested DNS subject alternative names.
+     */
+    dnsNames?: string[];
+    /**
+     * Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
+     * issuer may choose to ignore the requested duration, just like any other
+     * requested attribute.
+     *
+     * If unset, this defaults to 90 days.
+     * Minimum accepted duration is 1 hour.
+     * Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+     */
+    duration?: string;
+    /**
+     * Requested email subject alternative names.
+     */
+    emailAddresses?: string[];
+    /**
+     * Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
+     *
+     * This option defaults to true, and should only be disabled if the target
+     * issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
+     */
+    encodeUsagesInRequest?: boolean;
+    /**
+     * Requested IP address subject alternative names.
+     */
+    ipAddresses?: string[];
+    /**
+     * Requested basic constraints isCA value.
+     * The isCA value is used to set the `isCA` field on the created CertificateRequest
+     * resources. Note that the issuer may choose to ignore the requested isCA value, just
+     * like any other requested attribute.
+     *
+     * If true, this will automatically add the `cert sign` usage to the list
+     * of requested `usages`.
+     */
+    isCA?: boolean;
+    /**
+     * Reference to the issuer responsible for issuing the certificate.
+     * If the issuer is namespace-scoped, it must be in the same namespace
+     * as the Certificate. If the issuer is cluster-scoped, it can be used
+     * from any namespace.
+     *
+     * The `name` field of the reference must always be specified.
+     */
+    issuerRef: {
+      /**
+       * Group of the resource being referred to.
+       */
+      group?: string;
+      /**
+       * Kind of the resource being referred to.
+       */
+      kind?: string;
+      /**
+       * Name of the resource being referred to.
+       */
+      name: string;
+    };
+    /**
+     * Additional keystore output formats to be stored in the Certificate's Secret.
+     */
+    keystores?: {
+      /**
+       * JKS configures options for storing a JKS keystore in the
+       * `spec.secretName` Secret resource.
+       */
+      jks?: {
+        /**
+         * Alias specifies the alias of the key in the keystore, required by the JKS format.
+         * If not provided, the default alias `certificate` will be used.
+         */
+        alias?: string;
+        /**
+         * Create enables JKS keystore creation for the Certificate.
+         * If true, a file named `keystore.jks` will be created in the target
+         * Secret resource, encrypted using the password stored in
+         * `passwordSecretRef` or `password`.
+         * The keystore file will be updated immediately.
+         * If the issuer provided a CA certificate, a file named `truststore.jks`
+         * will also be created in the target Secret resource, encrypted using the
+         * password stored in `passwordSecretRef`
+         * containing the issuing Certificate Authority
+         */
+        create: boolean;
+        /**
+         * Password provides a literal password used to encrypt the JKS keystore.
+         * Mutually exclusive with passwordSecretRef.
+         * One of password or passwordSecretRef must provide a password with a non-zero length.
+         */
+        password?: string;
+        /**
+         * PasswordSecretRef is a reference to a non-empty key in a Secret resource
+         * containing the password used to encrypt the JKS keystore.
+         * Mutually exclusive with password.
+         * One of password or passwordSecretRef must provide a password with a non-zero length.
+         */
+        passwordSecretRef?: {
+          /**
+           * The key of the entry in the Secret resource's `data` field to be used.
+           * Some instances of this field may be defaulted, in others it may be
+           * required.
+           */
+          key?: string;
+          /**
+           * Name of the resource being referred to.
+           * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+           */
+          name: string;
+        };
+      };
+      /**
+       * PKCS12 configures options for storing a PKCS12 keystore in the
+       * `spec.secretName` Secret resource.
+       */
+      pkcs12?: {
+        /**
+         * Create enables PKCS12 keystore creation for the Certificate.
+         * If true, a file named `keystore.p12` will be created in the target
+         * Secret resource, encrypted using the password stored in
+         * `passwordSecretRef` or in `password`.
+         * The keystore file will be updated immediately.
+         * If the issuer provided a CA certificate, a file named `truststore.p12` will
+         * also be created in the target Secret resource, encrypted using the
+         * password stored in `passwordSecretRef` containing the issuing Certificate
+         * Authority
+         */
+        create: boolean;
+        /**
+         * Password provides a literal password used to encrypt the PKCS#12 keystore.
+         * Mutually exclusive with passwordSecretRef.
+         * One of password or passwordSecretRef must provide a password with a non-zero length.
+         */
+        password?: string;
+        /**
+         * PasswordSecretRef is a reference to a non-empty key in a Secret resource
+         * containing the password used to encrypt the PKCS#12 keystore.
+         * Mutually exclusive with password.
+         * One of password or passwordSecretRef must provide a password with a non-zero length.
+         */
+        passwordSecretRef?: {
+          /**
+           * The key of the entry in the Secret resource's `data` field to be used.
+           * Some instances of this field may be defaulted, in others it may be
+           * required.
+           */
+          key?: string;
+          /**
+           * Name of the resource being referred to.
+           * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+           */
+          name: string;
+        };
+        /**
+         * Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
+         * used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
+         *
+         * If provided, allowed values are:
+         * `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
+         * `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
+         * `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
+         * (e.g., because of company policy). Please note that the security of the algorithm is not that important
+         * in reality, because the unencrypted certificate and private key are also stored in the Secret.
+         */
+        profile?: string;
+      };
+    };
+    /**
+     * Requested X.509 certificate subject, represented using the LDAP "String
+     * Representation of a Distinguished Name" [1].
+     * Important: the LDAP string format also specifies the order of the attributes
+     * in the subject, this is important when issuing certs for LDAP authentication.
+     * Example: `CN=foo,DC=corp,DC=example,DC=com`
+     * More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
+     * More info: https://github.com/cert-manager/cert-manager/issues/3203
+     * More info: https://github.com/cert-manager/cert-manager/issues/4424
+     *
+     * Cannot be set if the `subject` or `commonName` field is set.
+     */
+    literalSubject?: string;
+    /**
+     * x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
+     * More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
+     *
+     * This is an Alpha Feature and is only enabled with the
+     * `--feature-gates=NameConstraints=true` option set on both
+     * the controller and webhook components.
+     */
+    nameConstraints?: {
+      /**
+       * if true then the name constraints are marked critical.
+       */
+      critical?: boolean;
+      /**
+       * Excluded contains the constraints which must be disallowed. Any name matching a
+       * restriction in the excluded field is invalid regardless
+       * of information appearing in the permitted
+       */
+      excluded?: {
+        /**
+         * DNSDomains is a list of DNS domains that are permitted or excluded.
+         */
+        dnsDomains?: string[];
+        /**
+         * EmailAddresses is a list of Email Addresses that are permitted or excluded.
+         */
+        emailAddresses?: string[];
+        /**
+         * IPRanges is a list of IP Ranges that are permitted or excluded.
+         * This should be a valid CIDR notation.
+         */
+        ipRanges?: string[];
+        /**
+         * URIDomains is a list of URI domains that are permitted or excluded.
+         */
+        uriDomains?: string[];
+      };
+      /**
+       * Permitted contains the constraints in which the names must be located.
+       */
+      permitted?: {
+        /**
+         * DNSDomains is a list of DNS domains that are permitted or excluded.
+         */
+        dnsDomains?: string[];
+        /**
+         * EmailAddresses is a list of Email Addresses that are permitted or excluded.
+         */
+        emailAddresses?: string[];
+        /**
+         * IPRanges is a list of IP Ranges that are permitted or excluded.
+         * This should be a valid CIDR notation.
+         */
+        ipRanges?: string[];
+        /**
+         * URIDomains is a list of URI domains that are permitted or excluded.
+         */
+        uriDomains?: string[];
+      };
+    };
+    /**
+     * `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
+     * Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
+     * Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
+     * You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
+     */
+    otherNames?: {
+      /**
+       * OID is the object identifier for the otherName SAN.
+       * The object identifier must be expressed as a dotted string, for
+       * example, "1.2.840.113556.1.4.221".
+       */
+      oid?: string;
+      /**
+       * utf8Value is the string value of the otherName SAN.
+       * The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
+       */
+      utf8Value?: string;
+    }[];
+    /**
+     * Private key options. These include the key algorithm and size, the used
+     * encoding and the rotation policy.
+     */
+    privateKey?: {
+      /**
+       * Algorithm is the private key algorithm of the corresponding private key
+       * for this certificate.
+       *
+       * If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
+       * If `algorithm` is specified and `size` is not provided,
+       * key size of 2048 will be used for `RSA` key algorithm and
+       * key size of 256 will be used for `ECDSA` key algorithm.
+       * key size is ignored when using the `Ed25519` key algorithm.
+       */
+      algorithm?: string;
+      /**
+       * The private key cryptography standards (PKCS) encoding for this
+       * certificate's private key to be encoded in.
+       *
+       * If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
+       * and PKCS#8, respectively.
+       * Defaults to `PKCS1` if not specified.
+       */
+      encoding?: string;
+      /**
+       * RotationPolicy controls how private keys should be regenerated when a
+       * re-issuance is being processed.
+       *
+       * If set to `Never`, a private key will only be generated if one does not
+       * already exist in the target `spec.secretName`. If one does exist but it
+       * does not have the correct algorithm or size, a warning will be raised
+       * to await user intervention.
+       * If set to `Always`, a private key matching the specified requirements
+       * will be generated whenever a re-issuance occurs.
+       * Default is `Always`.
+       * The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
+       * The new default can be disabled by setting the
+       * `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
+       * the controller component.
+       */
+      rotationPolicy?: string;
+      /**
+       * Size is the key bit size of the corresponding private key for this certificate.
+       *
+       * If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
+       * and will default to `2048` if not specified.
+       * If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
+       * and will default to `256` if not specified.
+       * If `algorithm` is set to `Ed25519`, Size is ignored.
+       * No other values are allowed.
+       */
+      size?: number;
+    };
+    /**
+     * How long before the currently issued certificate's expiry cert-manager should
+     * renew the certificate. For example, if a certificate is valid for 60 minutes,
+     * and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
+     * 50 minutes after it was issued (i.e. when there are 10 minutes remaining until
+     * the certificate is no longer valid).
+     *
+     * NOTE: The actual lifetime of the issued certificate is used to determine the
+     * renewal time. If an issuer returns a certificate with a different lifetime than
+     * the one requested, cert-manager will use the lifetime of the issued certificate.
+     *
+     * If unset, this defaults to 1/3 of the issued certificate's lifetime.
+     * Minimum accepted value is 5 minutes.
+     * Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+     * Cannot be set if the `renewBeforePercentage` field is set.
+     */
+    renewBefore?: string;
+    /**
+     * `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
+     * rather than an absolute duration. For example, if a certificate is valid for 60
+     * minutes, and  `renewBeforePercentage=25`, cert-manager will begin to attempt to
+     * renew the certificate 45 minutes after it was issued (i.e. when there are 15
+     * minutes (25%) remaining until the certificate is no longer valid).
+     *
+     * NOTE: The actual lifetime of the issued certificate is used to determine the
+     * renewal time. If an issuer returns a certificate with a different lifetime than
+     * the one requested, cert-manager will use the lifetime of the issued certificate.
+     *
+     * Value must be an integer in the range (0,100). The minimum effective
+     * `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
+     * minutes.
+     * Cannot be set if the `renewBefore` field is set.
+     */
+    renewBeforePercentage?: number;
+    /**
+     * The maximum number of CertificateRequest revisions that are maintained in
+     * the Certificate's history. Each revision represents a single `CertificateRequest`
+     * created by this Certificate, either when it was created, renewed, or Spec
+     * was changed. Revisions will be removed by oldest first if the number of
+     * revisions exceeds this number.
+     *
+     * If set, revisionHistoryLimit must be a value of `1` or greater.
+     * Default value is `1`.
+     */
+    revisionHistoryLimit?: number;
+    /**
+     * Name of the Secret resource that will be automatically created and
+     * managed by this Certificate resource. It will be populated with a
+     * private key and certificate, signed by the denoted issuer. The Secret
+     * resource lives in the same namespace as the Certificate resource.
+     */
+    secretName: string;
+    /**
+     * Defines annotations and labels to be copied to the Certificate's Secret.
+     * Labels and annotations on the Secret will be changed as they appear on the
+     * SecretTemplate when added or removed. SecretTemplate annotations are added
+     * in conjunction with, and cannot overwrite, the base set of annotations
+     * cert-manager sets on the Certificate's Secret.
+     */
+    secretTemplate?: {
+      /**
+       * Annotations is a key value map to be copied to the target Kubernetes Secret.
+       */
+      annotations?: {
+        [k: string]: string;
+      };
+      /**
+       * Labels is a key value map to be copied to the target Kubernetes Secret.
+       */
+      labels?: {
+        [k: string]: string;
+      };
+    };
+    /**
+     * Signature algorithm to use.
+     * Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.
+     * Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.
+     * Allowed values for Ed25519 keys: PureEd25519.
+     */
+    signatureAlgorithm?: string;
+    /**
+     * Requested set of X509 certificate subject attributes.
+     * More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
+     *
+     * The common name attribute is specified separately in the `commonName` field.
+     * Cannot be set if the `literalSubject` field is set.
+     */
+    subject?: {
+      /**
+       * Countries to be used on the Certificate.
+       */
+      countries?: string[];
+      /**
+       * Cities to be used on the Certificate.
+       */
+      localities?: string[];
+      /**
+       * Organizational Units to be used on the Certificate.
+       */
+      organizationalUnits?: string[];
+      /**
+       * Organizations to be used on the Certificate.
+       */
+      organizations?: string[];
+      /**
+       * Postal codes to be used on the Certificate.
+       */
+      postalCodes?: string[];
+      /**
+       * State/Provinces to be used on the Certificate.
+       */
+      provinces?: string[];
+      /**
+       * Serial number to be used on the Certificate.
+       */
+      serialNumber?: string;
+      /**
+       * Street addresses to be used on the Certificate.
+       */
+      streetAddresses?: string[];
+    };
+    /**
+     * Requested URI subject alternative names.
+     */
+    uris?: string[];
+    /**
+     * Requested key usages and extended key usages.
+     * These usages are used to set the `usages` field on the created CertificateRequest
+     * resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
+     * will additionally be encoded in the `request` field which contains the CSR blob.
+     *
+     * If unset, defaults to `digital signature` and `key encipherment`.
+     */
+    usages?: (
+      | "signing"
+      | "digital signature"
+      | "content commitment"
+      | "key encipherment"
+      | "key agreement"
+      | "data encipherment"
+      | "cert sign"
+      | "crl sign"
+      | "encipher only"
+      | "decipher only"
+      | "any"
+      | "server auth"
+      | "client auth"
+      | "code signing"
+      | "email protection"
+      | "s/mime"
+      | "ipsec end system"
+      | "ipsec tunnel"
+      | "ipsec user"
+      | "timestamping"
+      | "ocsp signing"
+      | "microsoft sgc"
+      | "netscape sgc"
+    )[];
+  };
+  /**
+   * Status of the Certificate.
+   * This is set and managed automatically.
+   * Read-only.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+   */
+  status?: {
+    /**
+     * List of status conditions to indicate the status of certificates.
+     * Known condition types are `Ready` and `Issuing`.
+     */
+    conditions?: {
+      /**
+       * LastTransitionTime is the timestamp corresponding to the last status
+       * change of this condition.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Message is a human readable description of the details of the last
+       * transition, complementing reason.
+       */
+      message?: string;
+      /**
+       * If set, this represents the .metadata.generation that the condition was
+       * set based upon.
+       * For instance, if .metadata.generation is currently 12, but the
+       * .status.condition[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the Certificate.
+       */
+      observedGeneration?: number;
+      /**
+       * Reason is a brief machine readable explanation for the condition's last
+       * transition.
+       */
+      reason?: string;
+      /**
+       * Status of the condition, one of (`True`, `False`, `Unknown`).
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * Type of the condition, known values are (`Ready`, `Issuing`).
+       */
+      type: string;
+    }[];
+    /**
+     * The number of continuous failed issuance attempts up till now. This
+     * field gets removed (if set) on a successful issuance and gets set to
+     * 1 if unset and an issuance has failed. If an issuance has failed, the
+     * delay till the next issuance will be calculated using formula
+     * time.Hour * 2 ^ (failedIssuanceAttempts - 1).
+     */
+    failedIssuanceAttempts?: number;
+    /**
+     * LastFailureTime is set only if the latest issuance for this
+     * Certificate failed and contains the time of the failure. If an
+     * issuance has failed, the delay till the next issuance will be
+     * calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
+     * 1). If the latest issuance has succeeded this field will be unset.
+     */
+    lastFailureTime?: string;
+    /**
+     * The name of the Secret resource containing the private key to be used
+     * for the next certificate iteration.
+     * The keymanager controller will automatically set this field if the
+     * `Issuing` condition is set to `True`.
+     * It will automatically unset this field when the Issuing condition is
+     * not set or False.
+     */
+    nextPrivateKeySecretName?: string;
+    /**
+     * The expiration time of the certificate stored in the secret named
+     * by this resource in `spec.secretName`.
+     */
+    notAfter?: string;
+    /**
+     * The time after which the certificate stored in the secret named
+     * by this resource in `spec.secretName` is valid.
+     */
+    notBefore?: string;
+    /**
+     * RenewalTime is the time at which the certificate will be next
+     * renewed.
+     * If not set, no upcoming renewal is scheduled.
+     */
+    renewalTime?: string;
+    /**
+     * The current 'revision' of the certificate as issued.
+     *
+     * When a CertificateRequest resource is created, it will have the
+     * `cert-manager.io/certificate-revision` set to one greater than the
+     * current value of this field.
+     *
+     * Upon issuance, this field will be set to the value of the annotation
+     * on the CertificateRequest resource used to issue the certificate.
+     *
+     * Persisting the value on the CertificateRequest resource allows the
+     * certificates controller to know whether a request is part of an old
+     * issuance or if it is part of the ongoing revision's issuance by
+     * checking if the revision value in the annotation is greater than this
+     * field.
+     */
+    revision?: number;
+  };
+}

images/operator/src/__generated__/resources/K8SDestinationRuleV1.ts

@@ -0,0 +1,852 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SDestinationRuleV1 {
+  /**
+   * Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html
+   */
+  spec?: {
+    /**
+     * A list of namespaces to which this destination rule is exported.
+     */
+    exportTo?: string[];
+    /**
+     * The name of a service from the service registry.
+     */
+    host: string;
+    /**
+     * One or more named sets that represent individual versions of a service.
+     */
+    subsets?: {
+      /**
+       * Labels apply a filter over the endpoints of a service in the service registry.
+       */
+      labels?: {
+        [k: string]: string;
+      };
+      /**
+       * Name of the subset.
+       */
+      name: string;
+      /**
+       * Traffic policies that apply to this subset.
+       */
+      trafficPolicy?: {
+        connectionPool?: {
+          /**
+           * HTTP connection pool settings.
+           */
+          http?: {
+            /**
+             * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+             *
+             * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+             */
+            h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+            /**
+             * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+             */
+            http1MaxPendingRequests?: number;
+            /**
+             * Maximum number of active requests to a destination.
+             */
+            http2MaxRequests?: number;
+            /**
+             * The idle timeout for upstream connection pool connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+             */
+            maxConcurrentStreams?: number;
+            /**
+             * Maximum number of requests per connection to a backend.
+             */
+            maxRequestsPerConnection?: number;
+            /**
+             * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+             */
+            maxRetries?: number;
+            /**
+             * If set to true, client protocol will be preserved while initiating connection to backend.
+             */
+            useClientProtocol?: boolean;
+          };
+          /**
+           * Settings common to both HTTP and TCP upstream connections.
+           */
+          tcp?: {
+            /**
+             * TCP connection timeout.
+             */
+            connectTimeout?: string;
+            /**
+             * The idle timeout for TCP connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum duration of a connection.
+             */
+            maxConnectionDuration?: string;
+            /**
+             * Maximum number of HTTP1 /TCP connections to a destination host.
+             */
+            maxConnections?: number;
+            /**
+             * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+             */
+            tcpKeepalive?: {
+              /**
+               * The time duration between keep-alive probes.
+               */
+              interval?: string;
+              /**
+               * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+               */
+              probes?: number;
+              /**
+               * The time duration a connection needs to be idle before keep-alive probes start being sent.
+               */
+              time?: string;
+            };
+          };
+        };
+        /**
+         * Settings controlling the load balancer algorithms.
+         */
+        loadBalancer?: {
+          [k: string]: unknown;
+        };
+        outlierDetection?: {
+          /**
+           * Minimum ejection duration.
+           */
+          baseEjectionTime?: string;
+          /**
+           * Number of 5xx errors before a host is ejected from the connection pool.
+           */
+          consecutive5xxErrors?: number;
+          consecutiveErrors?: number;
+          /**
+           * Number of gateway errors before a host is ejected from the connection pool.
+           */
+          consecutiveGatewayErrors?: number;
+          /**
+           * The number of consecutive locally originated failures before ejection occurs.
+           */
+          consecutiveLocalOriginFailures?: number;
+          /**
+           * Time interval between ejection sweep analysis.
+           */
+          interval?: string;
+          /**
+           * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+           */
+          maxEjectionPercent?: number;
+          /**
+           * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+           */
+          minHealthPercent?: number;
+          /**
+           * Determines whether to distinguish local origin failures from external errors.
+           */
+          splitExternalLocalOriginErrors?: boolean;
+        };
+        /**
+         * Traffic policies specific to individual ports.
+         *
+         * @maxItems 4096
+         */
+        portLevelSettings?: {
+          connectionPool?: {
+            /**
+             * HTTP connection pool settings.
+             */
+            http?: {
+              /**
+               * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+               *
+               * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+               */
+              h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+              /**
+               * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+               */
+              http1MaxPendingRequests?: number;
+              /**
+               * Maximum number of active requests to a destination.
+               */
+              http2MaxRequests?: number;
+              /**
+               * The idle timeout for upstream connection pool connections.
+               */
+              idleTimeout?: string;
+              /**
+               * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+               */
+              maxConcurrentStreams?: number;
+              /**
+               * Maximum number of requests per connection to a backend.
+               */
+              maxRequestsPerConnection?: number;
+              /**
+               * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+               */
+              maxRetries?: number;
+              /**
+               * If set to true, client protocol will be preserved while initiating connection to backend.
+               */
+              useClientProtocol?: boolean;
+            };
+            /**
+             * Settings common to both HTTP and TCP upstream connections.
+             */
+            tcp?: {
+              /**
+               * TCP connection timeout.
+               */
+              connectTimeout?: string;
+              /**
+               * The idle timeout for TCP connections.
+               */
+              idleTimeout?: string;
+              /**
+               * The maximum duration of a connection.
+               */
+              maxConnectionDuration?: string;
+              /**
+               * Maximum number of HTTP1 /TCP connections to a destination host.
+               */
+              maxConnections?: number;
+              /**
+               * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+               */
+              tcpKeepalive?: {
+                /**
+                 * The time duration between keep-alive probes.
+                 */
+                interval?: string;
+                /**
+                 * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+                 */
+                probes?: number;
+                /**
+                 * The time duration a connection needs to be idle before keep-alive probes start being sent.
+                 */
+                time?: string;
+              };
+            };
+          };
+          /**
+           * Settings controlling the load balancer algorithms.
+           */
+          loadBalancer?: {
+            [k: string]: unknown;
+          };
+          outlierDetection?: {
+            /**
+             * Minimum ejection duration.
+             */
+            baseEjectionTime?: string;
+            /**
+             * Number of 5xx errors before a host is ejected from the connection pool.
+             */
+            consecutive5xxErrors?: number;
+            consecutiveErrors?: number;
+            /**
+             * Number of gateway errors before a host is ejected from the connection pool.
+             */
+            consecutiveGatewayErrors?: number;
+            /**
+             * The number of consecutive locally originated failures before ejection occurs.
+             */
+            consecutiveLocalOriginFailures?: number;
+            /**
+             * Time interval between ejection sweep analysis.
+             */
+            interval?: string;
+            /**
+             * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+             */
+            maxEjectionPercent?: number;
+            /**
+             * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+             */
+            minHealthPercent?: number;
+            /**
+             * Determines whether to distinguish local origin failures from external errors.
+             */
+            splitExternalLocalOriginErrors?: boolean;
+          };
+          /**
+           * Specifies the number of a port on the destination service on which this policy is being applied.
+           */
+          port?: {
+            number?: number;
+          };
+          /**
+           * TLS related settings for connections to the upstream service.
+           */
+          tls?: {
+            /**
+             * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+             */
+            caCertificates?: string;
+            /**
+             * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+             */
+            caCrl?: string;
+            /**
+             * REQUIRED if mode is `MUTUAL`.
+             */
+            clientCertificate?: string;
+            /**
+             * The name of the secret that holds the TLS certs for the client including the CA certificates.
+             */
+            credentialName?: string;
+            /**
+             * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+             */
+            insecureSkipVerify?: boolean;
+            /**
+             * Indicates whether connections to this port should be secured using TLS.
+             *
+             * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+             */
+            mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+            /**
+             * REQUIRED if mode is `MUTUAL`.
+             */
+            privateKey?: string;
+            /**
+             * SNI string to present to the server during TLS handshake.
+             */
+            sni?: string;
+            /**
+             * A list of alternate names to verify the subject identity in the certificate.
+             */
+            subjectAltNames?: string[];
+          };
+        }[];
+        /**
+         * The upstream PROXY protocol settings.
+         */
+        proxyProtocol?: {
+          /**
+           * The PROXY protocol version to use.
+           *
+           * Valid Options: V1, V2
+           */
+          version?: "V1" | "V2";
+        };
+        /**
+         * TLS related settings for connections to the upstream service.
+         */
+        tls?: {
+          /**
+           * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+           */
+          caCertificates?: string;
+          /**
+           * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+           */
+          caCrl?: string;
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          clientCertificate?: string;
+          /**
+           * The name of the secret that holds the TLS certs for the client including the CA certificates.
+           */
+          credentialName?: string;
+          /**
+           * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+           */
+          insecureSkipVerify?: boolean;
+          /**
+           * Indicates whether connections to this port should be secured using TLS.
+           *
+           * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+           */
+          mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          privateKey?: string;
+          /**
+           * SNI string to present to the server during TLS handshake.
+           */
+          sni?: string;
+          /**
+           * A list of alternate names to verify the subject identity in the certificate.
+           */
+          subjectAltNames?: string[];
+        };
+        /**
+         * Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule.
+         */
+        tunnel?: {
+          /**
+           * Specifies which protocol to use for tunneling the downstream connection.
+           */
+          protocol?: string;
+          /**
+           * Specifies a host to which the downstream connection is tunneled.
+           */
+          targetHost: string;
+          /**
+           * Specifies a port to which the downstream connection is tunneled.
+           */
+          targetPort: number;
+        };
+      };
+    }[];
+    /**
+     * Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection).
+     */
+    trafficPolicy?: {
+      connectionPool?: {
+        /**
+         * HTTP connection pool settings.
+         */
+        http?: {
+          /**
+           * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+           *
+           * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+           */
+          h2UpgradePolicy?: string;
+          /**
+           * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+           */
+          http1MaxPendingRequests?: number;
+          /**
+           * Maximum number of active requests to a destination.
+           */
+          http2MaxRequests?: number;
+          /**
+           * The idle timeout for upstream connection pool connections.
+           */
+          idleTimeout?: string;
+          /**
+           * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+           */
+          maxConcurrentStreams?: number;
+          /**
+           * Maximum number of requests per connection to a backend.
+           */
+          maxRequestsPerConnection?: number;
+          /**
+           * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+           */
+          maxRetries?: number;
+          /**
+           * If set to true, client protocol will be preserved while initiating connection to backend.
+           */
+          useClientProtocol?: boolean;
+        };
+        /**
+         * Settings common to both HTTP and TCP upstream connections.
+         */
+        tcp?: {
+          /**
+           * TCP connection timeout.
+           */
+          connectTimeout?: string;
+          /**
+           * The idle timeout for TCP connections.
+           */
+          idleTimeout?: string;
+          /**
+           * The maximum duration of a connection.
+           */
+          maxConnectionDuration?: string;
+          /**
+           * Maximum number of HTTP1 /TCP connections to a destination host.
+           */
+          maxConnections?: number;
+          /**
+           * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+           */
+          tcpKeepalive?: {
+            /**
+             * The time duration between keep-alive probes.
+             */
+            interval?: string;
+            /**
+             * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+             */
+            probes?: number;
+            /**
+             * The time duration a connection needs to be idle before keep-alive probes start being sent.
+             */
+            time?: string;
+          };
+        };
+      };
+      /**
+       * Settings controlling the load balancer algorithms.
+       */
+      loadBalancer?: {
+        [k: string]: unknown;
+      };
+      outlierDetection?: {
+        /**
+         * Minimum ejection duration.
+         */
+        baseEjectionTime?: string;
+        /**
+         * Number of 5xx errors before a host is ejected from the connection pool.
+         */
+        consecutive5xxErrors?: number;
+        consecutiveErrors?: number;
+        /**
+         * Number of gateway errors before a host is ejected from the connection pool.
+         */
+        consecutiveGatewayErrors?: number;
+        /**
+         * The number of consecutive locally originated failures before ejection occurs.
+         */
+        consecutiveLocalOriginFailures?: number;
+        /**
+         * Time interval between ejection sweep analysis.
+         */
+        interval?: string;
+        /**
+         * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+         */
+        maxEjectionPercent?: number;
+        /**
+         * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+         */
+        minHealthPercent?: number;
+        /**
+         * Determines whether to distinguish local origin failures from external errors.
+         */
+        splitExternalLocalOriginErrors?: boolean;
+      };
+      /**
+       * Traffic policies specific to individual ports.
+       *
+       * @maxItems 4096
+       */
+      portLevelSettings?: {
+        connectionPool?: {
+          /**
+           * HTTP connection pool settings.
+           */
+          http?: {
+            /**
+             * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+             *
+             * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+             */
+            h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+            /**
+             * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+             */
+            http1MaxPendingRequests?: number;
+            /**
+             * Maximum number of active requests to a destination.
+             */
+            http2MaxRequests?: number;
+            /**
+             * The idle timeout for upstream connection pool connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+             */
+            maxConcurrentStreams?: number;
+            /**
+             * Maximum number of requests per connection to a backend.
+             */
+            maxRequestsPerConnection?: number;
+            /**
+             * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+             */
+            maxRetries?: number;
+            /**
+             * If set to true, client protocol will be preserved while initiating connection to backend.
+             */
+            useClientProtocol?: boolean;
+          };
+          /**
+           * Settings common to both HTTP and TCP upstream connections.
+           */
+          tcp?: {
+            /**
+             * TCP connection timeout.
+             */
+            connectTimeout?: string;
+            /**
+             * The idle timeout for TCP connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum duration of a connection.
+             */
+            maxConnectionDuration?: string;
+            /**
+             * Maximum number of HTTP1 /TCP connections to a destination host.
+             */
+            maxConnections?: number;
+            /**
+             * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+             */
+            tcpKeepalive?: {
+              /**
+               * The time duration between keep-alive probes.
+               */
+              interval?: string;
+              /**
+               * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+               */
+              probes?: number;
+              /**
+               * The time duration a connection needs to be idle before keep-alive probes start being sent.
+               */
+              time?: string;
+            };
+          };
+        };
+        /**
+         * Settings controlling the load balancer algorithms.
+         */
+        loadBalancer?: {
+          [k: string]: unknown;
+        };
+        outlierDetection?: {
+          /**
+           * Minimum ejection duration.
+           */
+          baseEjectionTime?: string;
+          /**
+           * Number of 5xx errors before a host is ejected from the connection pool.
+           */
+          consecutive5xxErrors?: number;
+          consecutiveErrors?: number;
+          /**
+           * Number of gateway errors before a host is ejected from the connection pool.
+           */
+          consecutiveGatewayErrors?: number;
+          /**
+           * The number of consecutive locally originated failures before ejection occurs.
+           */
+          consecutiveLocalOriginFailures?: number;
+          /**
+           * Time interval between ejection sweep analysis.
+           */
+          interval?: string;
+          /**
+           * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+           */
+          maxEjectionPercent?: number;
+          /**
+           * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+           */
+          minHealthPercent?: number;
+          /**
+           * Determines whether to distinguish local origin failures from external errors.
+           */
+          splitExternalLocalOriginErrors?: boolean;
+        };
+        /**
+         * Specifies the number of a port on the destination service on which this policy is being applied.
+         */
+        port?: {
+          number?: number;
+        };
+        /**
+         * TLS related settings for connections to the upstream service.
+         */
+        tls?: {
+          /**
+           * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+           */
+          caCertificates?: string;
+          /**
+           * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+           */
+          caCrl?: string;
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          clientCertificate?: string;
+          /**
+           * The name of the secret that holds the TLS certs for the client including the CA certificates.
+           */
+          credentialName?: string;
+          /**
+           * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+           */
+          insecureSkipVerify?: boolean;
+          /**
+           * Indicates whether connections to this port should be secured using TLS.
+           *
+           * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+           */
+          mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          privateKey?: string;
+          /**
+           * SNI string to present to the server during TLS handshake.
+           */
+          sni?: string;
+          /**
+           * A list of alternate names to verify the subject identity in the certificate.
+           */
+          subjectAltNames?: string[];
+        };
+      }[];
+      /**
+       * The upstream PROXY protocol settings.
+       */
+      proxyProtocol?: {
+        /**
+         * The PROXY protocol version to use.
+         *
+         * Valid Options: V1, V2
+         */
+        version?: string;
+      };
+      /**
+       * TLS related settings for connections to the upstream service.
+       */
+      tls?: {
+        /**
+         * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+         */
+        caCertificates?: string;
+        /**
+         * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+         */
+        caCrl?: string;
+        /**
+         * REQUIRED if mode is `MUTUAL`.
+         */
+        clientCertificate?: string;
+        /**
+         * The name of the secret that holds the TLS certs for the client including the CA certificates.
+         */
+        credentialName?: string;
+        /**
+         * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+         */
+        insecureSkipVerify?: boolean;
+        /**
+         * Indicates whether connections to this port should be secured using TLS.
+         *
+         * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+         */
+        mode?: string;
+        /**
+         * REQUIRED if mode is `MUTUAL`.
+         */
+        privateKey?: string;
+        /**
+         * SNI string to present to the server during TLS handshake.
+         */
+        sni?: string;
+        /**
+         * A list of alternate names to verify the subject identity in the certificate.
+         */
+        subjectAltNames?: string[];
+      };
+      /**
+       * Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule.
+       */
+      tunnel?: {
+        /**
+         * Specifies which protocol to use for tunneling the downstream connection.
+         */
+        protocol?: string;
+        /**
+         * Specifies a host to which the downstream connection is tunneled.
+         */
+        targetHost: string;
+        /**
+         * Specifies a port to which the downstream connection is tunneled.
+         */
+        targetPort: number;
+      };
+    };
+    /**
+     * Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied.
+     */
+    workloadSelector?: {
+      /**
+       * One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+       */
+      matchLabels?: {
+        [k: string]: string;
+      };
+    };
+  };
+  status?: {
+    /**
+     * Current service state of the resource.
+     */
+    conditions?: {
+      /**
+       * Last time we probed the condition.
+       */
+      lastProbeTime?: string;
+      /**
+       * Last time the condition transitioned from one status to another.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Human-readable message indicating details about last transition.
+       */
+      message?: string;
+      /**
+       * Unique, one-word, CamelCase reason for the condition's last transition.
+       */
+      reason?: string;
+      /**
+       * Status is the status of the condition.
+       */
+      status?: string;
+      /**
+       * Type is the type of the condition.
+       */
+      type?: string;
+    }[];
+    /**
+     * Resource Generation to which the Reconciled Condition refers.
+     */
+    observedGeneration?: number | string;
+    /**
+     * Includes any errors or warnings detected by Istio's analyzers.
+     */
+    validationMessages?: {
+      /**
+       * A url pointing to the Istio documentation for this specific error type.
+       */
+      documentationUrl?: string;
+      /**
+       * Represents how severe a message is.
+       *
+       * Valid Options: UNKNOWN, ERROR, WARNING, INFO
+       */
+      level?: "UNKNOWN" | "ERROR" | "WARNING" | "INFO";
+      type?: {
+        /**
+         * A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+         */
+        code?: string;
+        /**
+         * A human-readable name for the message type.
+         */
+        name?: string;
+      };
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SDestinationRuleV1alpha3.ts

@@ -0,0 +1,852 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SDestinationRuleV1Alpha3 {
+  /**
+   * Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html
+   */
+  spec?: {
+    /**
+     * A list of namespaces to which this destination rule is exported.
+     */
+    exportTo?: string[];
+    /**
+     * The name of a service from the service registry.
+     */
+    host: string;
+    /**
+     * One or more named sets that represent individual versions of a service.
+     */
+    subsets?: {
+      /**
+       * Labels apply a filter over the endpoints of a service in the service registry.
+       */
+      labels?: {
+        [k: string]: string;
+      };
+      /**
+       * Name of the subset.
+       */
+      name: string;
+      /**
+       * Traffic policies that apply to this subset.
+       */
+      trafficPolicy?: {
+        connectionPool?: {
+          /**
+           * HTTP connection pool settings.
+           */
+          http?: {
+            /**
+             * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+             *
+             * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+             */
+            h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+            /**
+             * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+             */
+            http1MaxPendingRequests?: number;
+            /**
+             * Maximum number of active requests to a destination.
+             */
+            http2MaxRequests?: number;
+            /**
+             * The idle timeout for upstream connection pool connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+             */
+            maxConcurrentStreams?: number;
+            /**
+             * Maximum number of requests per connection to a backend.
+             */
+            maxRequestsPerConnection?: number;
+            /**
+             * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+             */
+            maxRetries?: number;
+            /**
+             * If set to true, client protocol will be preserved while initiating connection to backend.
+             */
+            useClientProtocol?: boolean;
+          };
+          /**
+           * Settings common to both HTTP and TCP upstream connections.
+           */
+          tcp?: {
+            /**
+             * TCP connection timeout.
+             */
+            connectTimeout?: string;
+            /**
+             * The idle timeout for TCP connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum duration of a connection.
+             */
+            maxConnectionDuration?: string;
+            /**
+             * Maximum number of HTTP1 /TCP connections to a destination host.
+             */
+            maxConnections?: number;
+            /**
+             * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+             */
+            tcpKeepalive?: {
+              /**
+               * The time duration between keep-alive probes.
+               */
+              interval?: string;
+              /**
+               * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+               */
+              probes?: number;
+              /**
+               * The time duration a connection needs to be idle before keep-alive probes start being sent.
+               */
+              time?: string;
+            };
+          };
+        };
+        /**
+         * Settings controlling the load balancer algorithms.
+         */
+        loadBalancer?: {
+          [k: string]: unknown;
+        };
+        outlierDetection?: {
+          /**
+           * Minimum ejection duration.
+           */
+          baseEjectionTime?: string;
+          /**
+           * Number of 5xx errors before a host is ejected from the connection pool.
+           */
+          consecutive5xxErrors?: number;
+          consecutiveErrors?: number;
+          /**
+           * Number of gateway errors before a host is ejected from the connection pool.
+           */
+          consecutiveGatewayErrors?: number;
+          /**
+           * The number of consecutive locally originated failures before ejection occurs.
+           */
+          consecutiveLocalOriginFailures?: number;
+          /**
+           * Time interval between ejection sweep analysis.
+           */
+          interval?: string;
+          /**
+           * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+           */
+          maxEjectionPercent?: number;
+          /**
+           * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+           */
+          minHealthPercent?: number;
+          /**
+           * Determines whether to distinguish local origin failures from external errors.
+           */
+          splitExternalLocalOriginErrors?: boolean;
+        };
+        /**
+         * Traffic policies specific to individual ports.
+         *
+         * @maxItems 4096
+         */
+        portLevelSettings?: {
+          connectionPool?: {
+            /**
+             * HTTP connection pool settings.
+             */
+            http?: {
+              /**
+               * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+               *
+               * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+               */
+              h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+              /**
+               * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+               */
+              http1MaxPendingRequests?: number;
+              /**
+               * Maximum number of active requests to a destination.
+               */
+              http2MaxRequests?: number;
+              /**
+               * The idle timeout for upstream connection pool connections.
+               */
+              idleTimeout?: string;
+              /**
+               * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+               */
+              maxConcurrentStreams?: number;
+              /**
+               * Maximum number of requests per connection to a backend.
+               */
+              maxRequestsPerConnection?: number;
+              /**
+               * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+               */
+              maxRetries?: number;
+              /**
+               * If set to true, client protocol will be preserved while initiating connection to backend.
+               */
+              useClientProtocol?: boolean;
+            };
+            /**
+             * Settings common to both HTTP and TCP upstream connections.
+             */
+            tcp?: {
+              /**
+               * TCP connection timeout.
+               */
+              connectTimeout?: string;
+              /**
+               * The idle timeout for TCP connections.
+               */
+              idleTimeout?: string;
+              /**
+               * The maximum duration of a connection.
+               */
+              maxConnectionDuration?: string;
+              /**
+               * Maximum number of HTTP1 /TCP connections to a destination host.
+               */
+              maxConnections?: number;
+              /**
+               * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+               */
+              tcpKeepalive?: {
+                /**
+                 * The time duration between keep-alive probes.
+                 */
+                interval?: string;
+                /**
+                 * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+                 */
+                probes?: number;
+                /**
+                 * The time duration a connection needs to be idle before keep-alive probes start being sent.
+                 */
+                time?: string;
+              };
+            };
+          };
+          /**
+           * Settings controlling the load balancer algorithms.
+           */
+          loadBalancer?: {
+            [k: string]: unknown;
+          };
+          outlierDetection?: {
+            /**
+             * Minimum ejection duration.
+             */
+            baseEjectionTime?: string;
+            /**
+             * Number of 5xx errors before a host is ejected from the connection pool.
+             */
+            consecutive5xxErrors?: number;
+            consecutiveErrors?: number;
+            /**
+             * Number of gateway errors before a host is ejected from the connection pool.
+             */
+            consecutiveGatewayErrors?: number;
+            /**
+             * The number of consecutive locally originated failures before ejection occurs.
+             */
+            consecutiveLocalOriginFailures?: number;
+            /**
+             * Time interval between ejection sweep analysis.
+             */
+            interval?: string;
+            /**
+             * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+             */
+            maxEjectionPercent?: number;
+            /**
+             * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+             */
+            minHealthPercent?: number;
+            /**
+             * Determines whether to distinguish local origin failures from external errors.
+             */
+            splitExternalLocalOriginErrors?: boolean;
+          };
+          /**
+           * Specifies the number of a port on the destination service on which this policy is being applied.
+           */
+          port?: {
+            number?: number;
+          };
+          /**
+           * TLS related settings for connections to the upstream service.
+           */
+          tls?: {
+            /**
+             * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+             */
+            caCertificates?: string;
+            /**
+             * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+             */
+            caCrl?: string;
+            /**
+             * REQUIRED if mode is `MUTUAL`.
+             */
+            clientCertificate?: string;
+            /**
+             * The name of the secret that holds the TLS certs for the client including the CA certificates.
+             */
+            credentialName?: string;
+            /**
+             * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+             */
+            insecureSkipVerify?: boolean;
+            /**
+             * Indicates whether connections to this port should be secured using TLS.
+             *
+             * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+             */
+            mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+            /**
+             * REQUIRED if mode is `MUTUAL`.
+             */
+            privateKey?: string;
+            /**
+             * SNI string to present to the server during TLS handshake.
+             */
+            sni?: string;
+            /**
+             * A list of alternate names to verify the subject identity in the certificate.
+             */
+            subjectAltNames?: string[];
+          };
+        }[];
+        /**
+         * The upstream PROXY protocol settings.
+         */
+        proxyProtocol?: {
+          /**
+           * The PROXY protocol version to use.
+           *
+           * Valid Options: V1, V2
+           */
+          version?: "V1" | "V2";
+        };
+        /**
+         * TLS related settings for connections to the upstream service.
+         */
+        tls?: {
+          /**
+           * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+           */
+          caCertificates?: string;
+          /**
+           * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+           */
+          caCrl?: string;
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          clientCertificate?: string;
+          /**
+           * The name of the secret that holds the TLS certs for the client including the CA certificates.
+           */
+          credentialName?: string;
+          /**
+           * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+           */
+          insecureSkipVerify?: boolean;
+          /**
+           * Indicates whether connections to this port should be secured using TLS.
+           *
+           * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+           */
+          mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          privateKey?: string;
+          /**
+           * SNI string to present to the server during TLS handshake.
+           */
+          sni?: string;
+          /**
+           * A list of alternate names to verify the subject identity in the certificate.
+           */
+          subjectAltNames?: string[];
+        };
+        /**
+         * Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule.
+         */
+        tunnel?: {
+          /**
+           * Specifies which protocol to use for tunneling the downstream connection.
+           */
+          protocol?: string;
+          /**
+           * Specifies a host to which the downstream connection is tunneled.
+           */
+          targetHost: string;
+          /**
+           * Specifies a port to which the downstream connection is tunneled.
+           */
+          targetPort: number;
+        };
+      };
+    }[];
+    /**
+     * Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection).
+     */
+    trafficPolicy?: {
+      connectionPool?: {
+        /**
+         * HTTP connection pool settings.
+         */
+        http?: {
+          /**
+           * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+           *
+           * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+           */
+          h2UpgradePolicy?: string;
+          /**
+           * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+           */
+          http1MaxPendingRequests?: number;
+          /**
+           * Maximum number of active requests to a destination.
+           */
+          http2MaxRequests?: number;
+          /**
+           * The idle timeout for upstream connection pool connections.
+           */
+          idleTimeout?: string;
+          /**
+           * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+           */
+          maxConcurrentStreams?: number;
+          /**
+           * Maximum number of requests per connection to a backend.
+           */
+          maxRequestsPerConnection?: number;
+          /**
+           * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+           */
+          maxRetries?: number;
+          /**
+           * If set to true, client protocol will be preserved while initiating connection to backend.
+           */
+          useClientProtocol?: boolean;
+        };
+        /**
+         * Settings common to both HTTP and TCP upstream connections.
+         */
+        tcp?: {
+          /**
+           * TCP connection timeout.
+           */
+          connectTimeout?: string;
+          /**
+           * The idle timeout for TCP connections.
+           */
+          idleTimeout?: string;
+          /**
+           * The maximum duration of a connection.
+           */
+          maxConnectionDuration?: string;
+          /**
+           * Maximum number of HTTP1 /TCP connections to a destination host.
+           */
+          maxConnections?: number;
+          /**
+           * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+           */
+          tcpKeepalive?: {
+            /**
+             * The time duration between keep-alive probes.
+             */
+            interval?: string;
+            /**
+             * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+             */
+            probes?: number;
+            /**
+             * The time duration a connection needs to be idle before keep-alive probes start being sent.
+             */
+            time?: string;
+          };
+        };
+      };
+      /**
+       * Settings controlling the load balancer algorithms.
+       */
+      loadBalancer?: {
+        [k: string]: unknown;
+      };
+      outlierDetection?: {
+        /**
+         * Minimum ejection duration.
+         */
+        baseEjectionTime?: string;
+        /**
+         * Number of 5xx errors before a host is ejected from the connection pool.
+         */
+        consecutive5xxErrors?: number;
+        consecutiveErrors?: number;
+        /**
+         * Number of gateway errors before a host is ejected from the connection pool.
+         */
+        consecutiveGatewayErrors?: number;
+        /**
+         * The number of consecutive locally originated failures before ejection occurs.
+         */
+        consecutiveLocalOriginFailures?: number;
+        /**
+         * Time interval between ejection sweep analysis.
+         */
+        interval?: string;
+        /**
+         * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+         */
+        maxEjectionPercent?: number;
+        /**
+         * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+         */
+        minHealthPercent?: number;
+        /**
+         * Determines whether to distinguish local origin failures from external errors.
+         */
+        splitExternalLocalOriginErrors?: boolean;
+      };
+      /**
+       * Traffic policies specific to individual ports.
+       *
+       * @maxItems 4096
+       */
+      portLevelSettings?: {
+        connectionPool?: {
+          /**
+           * HTTP connection pool settings.
+           */
+          http?: {
+            /**
+             * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+             *
+             * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+             */
+            h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+            /**
+             * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+             */
+            http1MaxPendingRequests?: number;
+            /**
+             * Maximum number of active requests to a destination.
+             */
+            http2MaxRequests?: number;
+            /**
+             * The idle timeout for upstream connection pool connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+             */
+            maxConcurrentStreams?: number;
+            /**
+             * Maximum number of requests per connection to a backend.
+             */
+            maxRequestsPerConnection?: number;
+            /**
+             * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+             */
+            maxRetries?: number;
+            /**
+             * If set to true, client protocol will be preserved while initiating connection to backend.
+             */
+            useClientProtocol?: boolean;
+          };
+          /**
+           * Settings common to both HTTP and TCP upstream connections.
+           */
+          tcp?: {
+            /**
+             * TCP connection timeout.
+             */
+            connectTimeout?: string;
+            /**
+             * The idle timeout for TCP connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum duration of a connection.
+             */
+            maxConnectionDuration?: string;
+            /**
+             * Maximum number of HTTP1 /TCP connections to a destination host.
+             */
+            maxConnections?: number;
+            /**
+             * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+             */
+            tcpKeepalive?: {
+              /**
+               * The time duration between keep-alive probes.
+               */
+              interval?: string;
+              /**
+               * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+               */
+              probes?: number;
+              /**
+               * The time duration a connection needs to be idle before keep-alive probes start being sent.
+               */
+              time?: string;
+            };
+          };
+        };
+        /**
+         * Settings controlling the load balancer algorithms.
+         */
+        loadBalancer?: {
+          [k: string]: unknown;
+        };
+        outlierDetection?: {
+          /**
+           * Minimum ejection duration.
+           */
+          baseEjectionTime?: string;
+          /**
+           * Number of 5xx errors before a host is ejected from the connection pool.
+           */
+          consecutive5xxErrors?: number;
+          consecutiveErrors?: number;
+          /**
+           * Number of gateway errors before a host is ejected from the connection pool.
+           */
+          consecutiveGatewayErrors?: number;
+          /**
+           * The number of consecutive locally originated failures before ejection occurs.
+           */
+          consecutiveLocalOriginFailures?: number;
+          /**
+           * Time interval between ejection sweep analysis.
+           */
+          interval?: string;
+          /**
+           * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+           */
+          maxEjectionPercent?: number;
+          /**
+           * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+           */
+          minHealthPercent?: number;
+          /**
+           * Determines whether to distinguish local origin failures from external errors.
+           */
+          splitExternalLocalOriginErrors?: boolean;
+        };
+        /**
+         * Specifies the number of a port on the destination service on which this policy is being applied.
+         */
+        port?: {
+          number?: number;
+        };
+        /**
+         * TLS related settings for connections to the upstream service.
+         */
+        tls?: {
+          /**
+           * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+           */
+          caCertificates?: string;
+          /**
+           * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+           */
+          caCrl?: string;
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          clientCertificate?: string;
+          /**
+           * The name of the secret that holds the TLS certs for the client including the CA certificates.
+           */
+          credentialName?: string;
+          /**
+           * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+           */
+          insecureSkipVerify?: boolean;
+          /**
+           * Indicates whether connections to this port should be secured using TLS.
+           *
+           * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+           */
+          mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          privateKey?: string;
+          /**
+           * SNI string to present to the server during TLS handshake.
+           */
+          sni?: string;
+          /**
+           * A list of alternate names to verify the subject identity in the certificate.
+           */
+          subjectAltNames?: string[];
+        };
+      }[];
+      /**
+       * The upstream PROXY protocol settings.
+       */
+      proxyProtocol?: {
+        /**
+         * The PROXY protocol version to use.
+         *
+         * Valid Options: V1, V2
+         */
+        version?: string;
+      };
+      /**
+       * TLS related settings for connections to the upstream service.
+       */
+      tls?: {
+        /**
+         * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+         */
+        caCertificates?: string;
+        /**
+         * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+         */
+        caCrl?: string;
+        /**
+         * REQUIRED if mode is `MUTUAL`.
+         */
+        clientCertificate?: string;
+        /**
+         * The name of the secret that holds the TLS certs for the client including the CA certificates.
+         */
+        credentialName?: string;
+        /**
+         * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+         */
+        insecureSkipVerify?: boolean;
+        /**
+         * Indicates whether connections to this port should be secured using TLS.
+         *
+         * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+         */
+        mode?: string;
+        /**
+         * REQUIRED if mode is `MUTUAL`.
+         */
+        privateKey?: string;
+        /**
+         * SNI string to present to the server during TLS handshake.
+         */
+        sni?: string;
+        /**
+         * A list of alternate names to verify the subject identity in the certificate.
+         */
+        subjectAltNames?: string[];
+      };
+      /**
+       * Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule.
+       */
+      tunnel?: {
+        /**
+         * Specifies which protocol to use for tunneling the downstream connection.
+         */
+        protocol?: string;
+        /**
+         * Specifies a host to which the downstream connection is tunneled.
+         */
+        targetHost: string;
+        /**
+         * Specifies a port to which the downstream connection is tunneled.
+         */
+        targetPort: number;
+      };
+    };
+    /**
+     * Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied.
+     */
+    workloadSelector?: {
+      /**
+       * One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+       */
+      matchLabels?: {
+        [k: string]: string;
+      };
+    };
+  };
+  status?: {
+    /**
+     * Current service state of the resource.
+     */
+    conditions?: {
+      /**
+       * Last time we probed the condition.
+       */
+      lastProbeTime?: string;
+      /**
+       * Last time the condition transitioned from one status to another.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Human-readable message indicating details about last transition.
+       */
+      message?: string;
+      /**
+       * Unique, one-word, CamelCase reason for the condition's last transition.
+       */
+      reason?: string;
+      /**
+       * Status is the status of the condition.
+       */
+      status?: string;
+      /**
+       * Type is the type of the condition.
+       */
+      type?: string;
+    }[];
+    /**
+     * Resource Generation to which the Reconciled Condition refers.
+     */
+    observedGeneration?: number | string;
+    /**
+     * Includes any errors or warnings detected by Istio's analyzers.
+     */
+    validationMessages?: {
+      /**
+       * A url pointing to the Istio documentation for this specific error type.
+       */
+      documentationUrl?: string;
+      /**
+       * Represents how severe a message is.
+       *
+       * Valid Options: UNKNOWN, ERROR, WARNING, INFO
+       */
+      level?: "UNKNOWN" | "ERROR" | "WARNING" | "INFO";
+      type?: {
+        /**
+         * A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+         */
+        code?: string;
+        /**
+         * A human-readable name for the message type.
+         */
+        name?: string;
+      };
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SDestinationRuleV1beta1.ts

@@ -0,0 +1,852 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SDestinationRuleV1Beta1 {
+  /**
+   * Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html
+   */
+  spec?: {
+    /**
+     * A list of namespaces to which this destination rule is exported.
+     */
+    exportTo?: string[];
+    /**
+     * The name of a service from the service registry.
+     */
+    host: string;
+    /**
+     * One or more named sets that represent individual versions of a service.
+     */
+    subsets?: {
+      /**
+       * Labels apply a filter over the endpoints of a service in the service registry.
+       */
+      labels?: {
+        [k: string]: string;
+      };
+      /**
+       * Name of the subset.
+       */
+      name: string;
+      /**
+       * Traffic policies that apply to this subset.
+       */
+      trafficPolicy?: {
+        connectionPool?: {
+          /**
+           * HTTP connection pool settings.
+           */
+          http?: {
+            /**
+             * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+             *
+             * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+             */
+            h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+            /**
+             * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+             */
+            http1MaxPendingRequests?: number;
+            /**
+             * Maximum number of active requests to a destination.
+             */
+            http2MaxRequests?: number;
+            /**
+             * The idle timeout for upstream connection pool connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+             */
+            maxConcurrentStreams?: number;
+            /**
+             * Maximum number of requests per connection to a backend.
+             */
+            maxRequestsPerConnection?: number;
+            /**
+             * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+             */
+            maxRetries?: number;
+            /**
+             * If set to true, client protocol will be preserved while initiating connection to backend.
+             */
+            useClientProtocol?: boolean;
+          };
+          /**
+           * Settings common to both HTTP and TCP upstream connections.
+           */
+          tcp?: {
+            /**
+             * TCP connection timeout.
+             */
+            connectTimeout?: string;
+            /**
+             * The idle timeout for TCP connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum duration of a connection.
+             */
+            maxConnectionDuration?: string;
+            /**
+             * Maximum number of HTTP1 /TCP connections to a destination host.
+             */
+            maxConnections?: number;
+            /**
+             * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+             */
+            tcpKeepalive?: {
+              /**
+               * The time duration between keep-alive probes.
+               */
+              interval?: string;
+              /**
+               * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+               */
+              probes?: number;
+              /**
+               * The time duration a connection needs to be idle before keep-alive probes start being sent.
+               */
+              time?: string;
+            };
+          };
+        };
+        /**
+         * Settings controlling the load balancer algorithms.
+         */
+        loadBalancer?: {
+          [k: string]: unknown;
+        };
+        outlierDetection?: {
+          /**
+           * Minimum ejection duration.
+           */
+          baseEjectionTime?: string;
+          /**
+           * Number of 5xx errors before a host is ejected from the connection pool.
+           */
+          consecutive5xxErrors?: number;
+          consecutiveErrors?: number;
+          /**
+           * Number of gateway errors before a host is ejected from the connection pool.
+           */
+          consecutiveGatewayErrors?: number;
+          /**
+           * The number of consecutive locally originated failures before ejection occurs.
+           */
+          consecutiveLocalOriginFailures?: number;
+          /**
+           * Time interval between ejection sweep analysis.
+           */
+          interval?: string;
+          /**
+           * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+           */
+          maxEjectionPercent?: number;
+          /**
+           * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+           */
+          minHealthPercent?: number;
+          /**
+           * Determines whether to distinguish local origin failures from external errors.
+           */
+          splitExternalLocalOriginErrors?: boolean;
+        };
+        /**
+         * Traffic policies specific to individual ports.
+         *
+         * @maxItems 4096
+         */
+        portLevelSettings?: {
+          connectionPool?: {
+            /**
+             * HTTP connection pool settings.
+             */
+            http?: {
+              /**
+               * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+               *
+               * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+               */
+              h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+              /**
+               * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+               */
+              http1MaxPendingRequests?: number;
+              /**
+               * Maximum number of active requests to a destination.
+               */
+              http2MaxRequests?: number;
+              /**
+               * The idle timeout for upstream connection pool connections.
+               */
+              idleTimeout?: string;
+              /**
+               * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+               */
+              maxConcurrentStreams?: number;
+              /**
+               * Maximum number of requests per connection to a backend.
+               */
+              maxRequestsPerConnection?: number;
+              /**
+               * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+               */
+              maxRetries?: number;
+              /**
+               * If set to true, client protocol will be preserved while initiating connection to backend.
+               */
+              useClientProtocol?: boolean;
+            };
+            /**
+             * Settings common to both HTTP and TCP upstream connections.
+             */
+            tcp?: {
+              /**
+               * TCP connection timeout.
+               */
+              connectTimeout?: string;
+              /**
+               * The idle timeout for TCP connections.
+               */
+              idleTimeout?: string;
+              /**
+               * The maximum duration of a connection.
+               */
+              maxConnectionDuration?: string;
+              /**
+               * Maximum number of HTTP1 /TCP connections to a destination host.
+               */
+              maxConnections?: number;
+              /**
+               * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+               */
+              tcpKeepalive?: {
+                /**
+                 * The time duration between keep-alive probes.
+                 */
+                interval?: string;
+                /**
+                 * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+                 */
+                probes?: number;
+                /**
+                 * The time duration a connection needs to be idle before keep-alive probes start being sent.
+                 */
+                time?: string;
+              };
+            };
+          };
+          /**
+           * Settings controlling the load balancer algorithms.
+           */
+          loadBalancer?: {
+            [k: string]: unknown;
+          };
+          outlierDetection?: {
+            /**
+             * Minimum ejection duration.
+             */
+            baseEjectionTime?: string;
+            /**
+             * Number of 5xx errors before a host is ejected from the connection pool.
+             */
+            consecutive5xxErrors?: number;
+            consecutiveErrors?: number;
+            /**
+             * Number of gateway errors before a host is ejected from the connection pool.
+             */
+            consecutiveGatewayErrors?: number;
+            /**
+             * The number of consecutive locally originated failures before ejection occurs.
+             */
+            consecutiveLocalOriginFailures?: number;
+            /**
+             * Time interval between ejection sweep analysis.
+             */
+            interval?: string;
+            /**
+             * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+             */
+            maxEjectionPercent?: number;
+            /**
+             * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+             */
+            minHealthPercent?: number;
+            /**
+             * Determines whether to distinguish local origin failures from external errors.
+             */
+            splitExternalLocalOriginErrors?: boolean;
+          };
+          /**
+           * Specifies the number of a port on the destination service on which this policy is being applied.
+           */
+          port?: {
+            number?: number;
+          };
+          /**
+           * TLS related settings for connections to the upstream service.
+           */
+          tls?: {
+            /**
+             * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+             */
+            caCertificates?: string;
+            /**
+             * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+             */
+            caCrl?: string;
+            /**
+             * REQUIRED if mode is `MUTUAL`.
+             */
+            clientCertificate?: string;
+            /**
+             * The name of the secret that holds the TLS certs for the client including the CA certificates.
+             */
+            credentialName?: string;
+            /**
+             * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+             */
+            insecureSkipVerify?: boolean;
+            /**
+             * Indicates whether connections to this port should be secured using TLS.
+             *
+             * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+             */
+            mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+            /**
+             * REQUIRED if mode is `MUTUAL`.
+             */
+            privateKey?: string;
+            /**
+             * SNI string to present to the server during TLS handshake.
+             */
+            sni?: string;
+            /**
+             * A list of alternate names to verify the subject identity in the certificate.
+             */
+            subjectAltNames?: string[];
+          };
+        }[];
+        /**
+         * The upstream PROXY protocol settings.
+         */
+        proxyProtocol?: {
+          /**
+           * The PROXY protocol version to use.
+           *
+           * Valid Options: V1, V2
+           */
+          version?: "V1" | "V2";
+        };
+        /**
+         * TLS related settings for connections to the upstream service.
+         */
+        tls?: {
+          /**
+           * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+           */
+          caCertificates?: string;
+          /**
+           * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+           */
+          caCrl?: string;
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          clientCertificate?: string;
+          /**
+           * The name of the secret that holds the TLS certs for the client including the CA certificates.
+           */
+          credentialName?: string;
+          /**
+           * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+           */
+          insecureSkipVerify?: boolean;
+          /**
+           * Indicates whether connections to this port should be secured using TLS.
+           *
+           * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+           */
+          mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          privateKey?: string;
+          /**
+           * SNI string to present to the server during TLS handshake.
+           */
+          sni?: string;
+          /**
+           * A list of alternate names to verify the subject identity in the certificate.
+           */
+          subjectAltNames?: string[];
+        };
+        /**
+         * Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule.
+         */
+        tunnel?: {
+          /**
+           * Specifies which protocol to use for tunneling the downstream connection.
+           */
+          protocol?: string;
+          /**
+           * Specifies a host to which the downstream connection is tunneled.
+           */
+          targetHost: string;
+          /**
+           * Specifies a port to which the downstream connection is tunneled.
+           */
+          targetPort: number;
+        };
+      };
+    }[];
+    /**
+     * Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection).
+     */
+    trafficPolicy?: {
+      connectionPool?: {
+        /**
+         * HTTP connection pool settings.
+         */
+        http?: {
+          /**
+           * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+           *
+           * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+           */
+          h2UpgradePolicy?: string;
+          /**
+           * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+           */
+          http1MaxPendingRequests?: number;
+          /**
+           * Maximum number of active requests to a destination.
+           */
+          http2MaxRequests?: number;
+          /**
+           * The idle timeout for upstream connection pool connections.
+           */
+          idleTimeout?: string;
+          /**
+           * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+           */
+          maxConcurrentStreams?: number;
+          /**
+           * Maximum number of requests per connection to a backend.
+           */
+          maxRequestsPerConnection?: number;
+          /**
+           * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+           */
+          maxRetries?: number;
+          /**
+           * If set to true, client protocol will be preserved while initiating connection to backend.
+           */
+          useClientProtocol?: boolean;
+        };
+        /**
+         * Settings common to both HTTP and TCP upstream connections.
+         */
+        tcp?: {
+          /**
+           * TCP connection timeout.
+           */
+          connectTimeout?: string;
+          /**
+           * The idle timeout for TCP connections.
+           */
+          idleTimeout?: string;
+          /**
+           * The maximum duration of a connection.
+           */
+          maxConnectionDuration?: string;
+          /**
+           * Maximum number of HTTP1 /TCP connections to a destination host.
+           */
+          maxConnections?: number;
+          /**
+           * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+           */
+          tcpKeepalive?: {
+            /**
+             * The time duration between keep-alive probes.
+             */
+            interval?: string;
+            /**
+             * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+             */
+            probes?: number;
+            /**
+             * The time duration a connection needs to be idle before keep-alive probes start being sent.
+             */
+            time?: string;
+          };
+        };
+      };
+      /**
+       * Settings controlling the load balancer algorithms.
+       */
+      loadBalancer?: {
+        [k: string]: unknown;
+      };
+      outlierDetection?: {
+        /**
+         * Minimum ejection duration.
+         */
+        baseEjectionTime?: string;
+        /**
+         * Number of 5xx errors before a host is ejected from the connection pool.
+         */
+        consecutive5xxErrors?: number;
+        consecutiveErrors?: number;
+        /**
+         * Number of gateway errors before a host is ejected from the connection pool.
+         */
+        consecutiveGatewayErrors?: number;
+        /**
+         * The number of consecutive locally originated failures before ejection occurs.
+         */
+        consecutiveLocalOriginFailures?: number;
+        /**
+         * Time interval between ejection sweep analysis.
+         */
+        interval?: string;
+        /**
+         * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+         */
+        maxEjectionPercent?: number;
+        /**
+         * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+         */
+        minHealthPercent?: number;
+        /**
+         * Determines whether to distinguish local origin failures from external errors.
+         */
+        splitExternalLocalOriginErrors?: boolean;
+      };
+      /**
+       * Traffic policies specific to individual ports.
+       *
+       * @maxItems 4096
+       */
+      portLevelSettings?: {
+        connectionPool?: {
+          /**
+           * HTTP connection pool settings.
+           */
+          http?: {
+            /**
+             * Specify if http1.1 connection should be upgraded to http2 for the associated destination.
+             *
+             * Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
+             */
+            h2UpgradePolicy?: "DEFAULT" | "DO_NOT_UPGRADE" | "UPGRADE";
+            /**
+             * Maximum number of requests that will be queued while waiting for a ready connection pool connection.
+             */
+            http1MaxPendingRequests?: number;
+            /**
+             * Maximum number of active requests to a destination.
+             */
+            http2MaxRequests?: number;
+            /**
+             * The idle timeout for upstream connection pool connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
+             */
+            maxConcurrentStreams?: number;
+            /**
+             * Maximum number of requests per connection to a backend.
+             */
+            maxRequestsPerConnection?: number;
+            /**
+             * Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
+             */
+            maxRetries?: number;
+            /**
+             * If set to true, client protocol will be preserved while initiating connection to backend.
+             */
+            useClientProtocol?: boolean;
+          };
+          /**
+           * Settings common to both HTTP and TCP upstream connections.
+           */
+          tcp?: {
+            /**
+             * TCP connection timeout.
+             */
+            connectTimeout?: string;
+            /**
+             * The idle timeout for TCP connections.
+             */
+            idleTimeout?: string;
+            /**
+             * The maximum duration of a connection.
+             */
+            maxConnectionDuration?: string;
+            /**
+             * Maximum number of HTTP1 /TCP connections to a destination host.
+             */
+            maxConnections?: number;
+            /**
+             * If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
+             */
+            tcpKeepalive?: {
+              /**
+               * The time duration between keep-alive probes.
+               */
+              interval?: string;
+              /**
+               * Maximum number of keepalive probes to send without response before deciding the connection is dead.
+               */
+              probes?: number;
+              /**
+               * The time duration a connection needs to be idle before keep-alive probes start being sent.
+               */
+              time?: string;
+            };
+          };
+        };
+        /**
+         * Settings controlling the load balancer algorithms.
+         */
+        loadBalancer?: {
+          [k: string]: unknown;
+        };
+        outlierDetection?: {
+          /**
+           * Minimum ejection duration.
+           */
+          baseEjectionTime?: string;
+          /**
+           * Number of 5xx errors before a host is ejected from the connection pool.
+           */
+          consecutive5xxErrors?: number;
+          consecutiveErrors?: number;
+          /**
+           * Number of gateway errors before a host is ejected from the connection pool.
+           */
+          consecutiveGatewayErrors?: number;
+          /**
+           * The number of consecutive locally originated failures before ejection occurs.
+           */
+          consecutiveLocalOriginFailures?: number;
+          /**
+           * Time interval between ejection sweep analysis.
+           */
+          interval?: string;
+          /**
+           * Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
+           */
+          maxEjectionPercent?: number;
+          /**
+           * Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
+           */
+          minHealthPercent?: number;
+          /**
+           * Determines whether to distinguish local origin failures from external errors.
+           */
+          splitExternalLocalOriginErrors?: boolean;
+        };
+        /**
+         * Specifies the number of a port on the destination service on which this policy is being applied.
+         */
+        port?: {
+          number?: number;
+        };
+        /**
+         * TLS related settings for connections to the upstream service.
+         */
+        tls?: {
+          /**
+           * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+           */
+          caCertificates?: string;
+          /**
+           * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+           */
+          caCrl?: string;
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          clientCertificate?: string;
+          /**
+           * The name of the secret that holds the TLS certs for the client including the CA certificates.
+           */
+          credentialName?: string;
+          /**
+           * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+           */
+          insecureSkipVerify?: boolean;
+          /**
+           * Indicates whether connections to this port should be secured using TLS.
+           *
+           * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+           */
+          mode?: "DISABLE" | "SIMPLE" | "MUTUAL" | "ISTIO_MUTUAL";
+          /**
+           * REQUIRED if mode is `MUTUAL`.
+           */
+          privateKey?: string;
+          /**
+           * SNI string to present to the server during TLS handshake.
+           */
+          sni?: string;
+          /**
+           * A list of alternate names to verify the subject identity in the certificate.
+           */
+          subjectAltNames?: string[];
+        };
+      }[];
+      /**
+       * The upstream PROXY protocol settings.
+       */
+      proxyProtocol?: {
+        /**
+         * The PROXY protocol version to use.
+         *
+         * Valid Options: V1, V2
+         */
+        version?: string;
+      };
+      /**
+       * TLS related settings for connections to the upstream service.
+       */
+      tls?: {
+        /**
+         * OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.
+         */
+        caCertificates?: string;
+        /**
+         * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.
+         */
+        caCrl?: string;
+        /**
+         * REQUIRED if mode is `MUTUAL`.
+         */
+        clientCertificate?: string;
+        /**
+         * The name of the secret that holds the TLS certs for the client including the CA certificates.
+         */
+        credentialName?: string;
+        /**
+         * `insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.
+         */
+        insecureSkipVerify?: boolean;
+        /**
+         * Indicates whether connections to this port should be secured using TLS.
+         *
+         * Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
+         */
+        mode?: string;
+        /**
+         * REQUIRED if mode is `MUTUAL`.
+         */
+        privateKey?: string;
+        /**
+         * SNI string to present to the server during TLS handshake.
+         */
+        sni?: string;
+        /**
+         * A list of alternate names to verify the subject identity in the certificate.
+         */
+        subjectAltNames?: string[];
+      };
+      /**
+       * Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule.
+       */
+      tunnel?: {
+        /**
+         * Specifies which protocol to use for tunneling the downstream connection.
+         */
+        protocol?: string;
+        /**
+         * Specifies a host to which the downstream connection is tunneled.
+         */
+        targetHost: string;
+        /**
+         * Specifies a port to which the downstream connection is tunneled.
+         */
+        targetPort: number;
+      };
+    };
+    /**
+     * Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied.
+     */
+    workloadSelector?: {
+      /**
+       * One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+       */
+      matchLabels?: {
+        [k: string]: string;
+      };
+    };
+  };
+  status?: {
+    /**
+     * Current service state of the resource.
+     */
+    conditions?: {
+      /**
+       * Last time we probed the condition.
+       */
+      lastProbeTime?: string;
+      /**
+       * Last time the condition transitioned from one status to another.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Human-readable message indicating details about last transition.
+       */
+      message?: string;
+      /**
+       * Unique, one-word, CamelCase reason for the condition's last transition.
+       */
+      reason?: string;
+      /**
+       * Status is the status of the condition.
+       */
+      status?: string;
+      /**
+       * Type is the type of the condition.
+       */
+      type?: string;
+    }[];
+    /**
+     * Resource Generation to which the Reconciled Condition refers.
+     */
+    observedGeneration?: number | string;
+    /**
+     * Includes any errors or warnings detected by Istio's analyzers.
+     */
+    validationMessages?: {
+      /**
+       * A url pointing to the Istio documentation for this specific error type.
+       */
+      documentationUrl?: string;
+      /**
+       * Represents how severe a message is.
+       *
+       * Valid Options: UNKNOWN, ERROR, WARNING, INFO
+       */
+      level?: "UNKNOWN" | "ERROR" | "WARNING" | "INFO";
+      type?: {
+        /**
+         * A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+         */
+        code?: string;
+        /**
+         * A human-readable name for the message type.
+         */
+        name?: string;
+      };
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SDomainEndpointV1.json

@@ -0,0 +1,94 @@
+{
+  "properties": {
+    "spec": {
+      "properties": {
+        "destination": {
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "namespace": {
+              "type": "string"
+            },
+            "port": {
+              "properties": {
+                "number": {
+                  "type": "number"
+                }
+              },
+              "required": [
+                "number"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "name",
+            "port"
+          ],
+          "type": "object"
+        },
+        "domain": {
+          "type": "string"
+        },
+        "subdomain": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "domain",
+        "subdomain",
+        "destination"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "type": "object",
+            "required": [
+              "type",
+              "status",
+              "lastTransitionTime"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "message": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              },
+              "status": {
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "type": "number"
+        }
+      },
+      "required": [
+        "observedGeneration",
+        "conditions"
+      ],
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SDomainEndpointV1.ts

@@ -0,0 +1,30 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SDomainEndpointV1 {
+  spec?: {
+    destination: {
+      name: string;
+      namespace?: string;
+      port: {
+        number: number;
+      };
+    };
+    domain: string;
+    subdomain: string;
+  };
+  status?: {
+    conditions: {
+      lastTransitionTime: string;
+      message?: string;
+      reason?: string;
+      status: "True" | "False" | "Unknown";
+      type: string;
+    }[];
+    observedGeneration: number;
+  };
+}

images/operator/src/__generated__/resources/K8SDomainV1.json

@@ -0,0 +1,63 @@
+{
+  "properties": {
+    "spec": {
+      "properties": {
+        "domain": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "domain"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "items": {
+            "type": "object",
+            "required": [
+              "type",
+              "status",
+              "lastTransitionTime"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "type": "string",
+                "format": "date-time",
+                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+              },
+              "message": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              },
+              "status": {
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "type": "number"
+        }
+      },
+      "required": [
+        "observedGeneration",
+        "conditions"
+      ],
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SDomainV1.ts

@@ -0,0 +1,22 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SDomainV1 {
+  spec?: {
+    domain: string;
+  };
+  status?: {
+    conditions: {
+      lastTransitionTime: string;
+      message?: string;
+      reason?: string;
+      status: "True" | "False" | "Unknown";
+      type: string;
+    }[];
+    observedGeneration: number;
+  };
+}

images/operator/src/__generated__/resources/K8SETCDSnapshotFileV1.json

@@ -0,0 +1,128 @@
+{
+  "description": "ETCDSnapshot tracks a point-in-time snapshot of the etcd datastore.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "Spec defines properties of an etcd snapshot file",
+      "properties": {
+        "location": {
+          "description": "Location is the absolute file:// or s3:// URI address of the snapshot.",
+          "type": "string"
+        },
+        "metadata": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Metadata contains point-in-time snapshot of the contents of the\nk3s-etcd-snapshot-extra-metadata ConfigMap's data field, at the time the\nsnapshot was taken. This is intended to contain data about cluster state\nthat may be important for an external system to have available when restoring\nthe snapshot.",
+          "type": "object"
+        },
+        "nodeName": {
+          "description": "NodeName contains the name of the node that took the snapshot.",
+          "type": "string"
+        },
+        "s3": {
+          "description": "S3 contains extra metadata about the S3 storage system holding the\nsnapshot. This is guaranteed to be set for all snapshots uploaded to S3.\nIf not specified, the snapshot was not uploaded to S3.",
+          "properties": {
+            "bucket": {
+              "description": "Bucket is the bucket holding the snapshot",
+              "type": "string"
+            },
+            "bucketLookup": {
+              "description": "BucketLookup is the bucket lookup type, one of 'auto', 'dns', 'path'. Default if empty is 'auto'.",
+              "type": "string"
+            },
+            "endpoint": {
+              "description": "Endpoint is the host or host:port of the S3 service",
+              "type": "string"
+            },
+            "endpointCA": {
+              "description": "EndpointCA is the path on disk to the S3 service's trusted CA list. Leave empty to use the OS CA bundle.",
+              "type": "string"
+            },
+            "insecure": {
+              "description": "Insecure is true if the S3 service uses HTTP instead of HTTPS",
+              "type": "boolean"
+            },
+            "prefix": {
+              "description": "Prefix is the prefix in which the snapshot file is stored.",
+              "type": "string"
+            },
+            "region": {
+              "description": "Region is the region of the S3 service",
+              "type": "string"
+            },
+            "skipSSLVerify": {
+              "description": "SkipSSLVerify is true if TLS certificate verification is disabled",
+              "type": "boolean"
+            }
+          },
+          "type": "object"
+        },
+        "snapshotName": {
+          "description": "SnapshotName contains the base name of the snapshot file. CLI actions that act\non snapshots stored locally or within a pre-configured S3 bucket and\nprefix usually take the snapshot name as their argument.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "location",
+        "nodeName",
+        "snapshotName"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "description": "Status represents current information about a snapshot.",
+      "properties": {
+        "creationTime": {
+          "description": "CreationTime is the timestamp when the snapshot was taken by etcd.",
+          "format": "date-time",
+          "type": "string"
+        },
+        "error": {
+          "description": "Error is the last observed error during snapshot creation, if any.\nIf the snapshot is retried, this field will be cleared on success.",
+          "properties": {
+            "message": {
+              "description": "Message is a string detailing the encountered error during snapshot creation if specified.\nNOTE: message may be logged, and it should not contain sensitive information.",
+              "type": "string"
+            },
+            "time": {
+              "description": "Time is the timestamp when the error was encountered.",
+              "format": "date-time",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "readyToUse": {
+          "description": "ReadyToUse indicates that the snapshot is available to be restored.",
+          "type": "boolean"
+        },
+        "size": {
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Size is the size of the snapshot file, in bytes. If not specified, the snapshot failed.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "x_kubernetes_int_or_string": true
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SETCDSnapshotFileV1.ts

@@ -0,0 +1,128 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * ETCDSnapshot tracks a point-in-time snapshot of the etcd datastore.
+ */
+export interface K8SETCDSnapshotFileV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * Spec defines properties of an etcd snapshot file
+   */
+  spec?: {
+    /**
+     * Location is the absolute file:// or s3:// URI address of the snapshot.
+     */
+    location: string;
+    /**
+     * Metadata contains point-in-time snapshot of the contents of the
+     * k3s-etcd-snapshot-extra-metadata ConfigMap's data field, at the time the
+     * snapshot was taken. This is intended to contain data about cluster state
+     * that may be important for an external system to have available when restoring
+     * the snapshot.
+     */
+    metadata?: {
+      [k: string]: string;
+    };
+    /**
+     * NodeName contains the name of the node that took the snapshot.
+     */
+    nodeName: string;
+    /**
+     * S3 contains extra metadata about the S3 storage system holding the
+     * snapshot. This is guaranteed to be set for all snapshots uploaded to S3.
+     * If not specified, the snapshot was not uploaded to S3.
+     */
+    s3?: {
+      /**
+       * Bucket is the bucket holding the snapshot
+       */
+      bucket?: string;
+      /**
+       * BucketLookup is the bucket lookup type, one of 'auto', 'dns', 'path'. Default if empty is 'auto'.
+       */
+      bucketLookup?: string;
+      /**
+       * Endpoint is the host or host:port of the S3 service
+       */
+      endpoint?: string;
+      /**
+       * EndpointCA is the path on disk to the S3 service's trusted CA list. Leave empty to use the OS CA bundle.
+       */
+      endpointCA?: string;
+      /**
+       * Insecure is true if the S3 service uses HTTP instead of HTTPS
+       */
+      insecure?: boolean;
+      /**
+       * Prefix is the prefix in which the snapshot file is stored.
+       */
+      prefix?: string;
+      /**
+       * Region is the region of the S3 service
+       */
+      region?: string;
+      /**
+       * SkipSSLVerify is true if TLS certificate verification is disabled
+       */
+      skipSSLVerify?: boolean;
+    };
+    /**
+     * SnapshotName contains the base name of the snapshot file. CLI actions that act
+     * on snapshots stored locally or within a pre-configured S3 bucket and
+     * prefix usually take the snapshot name as their argument.
+     */
+    snapshotName: string;
+  };
+  /**
+   * Status represents current information about a snapshot.
+   */
+  status?: {
+    /**
+     * CreationTime is the timestamp when the snapshot was taken by etcd.
+     */
+    creationTime?: string;
+    /**
+     * Error is the last observed error during snapshot creation, if any.
+     * If the snapshot is retried, this field will be cleared on success.
+     */
+    error?: {
+      /**
+       * Message is a string detailing the encountered error during snapshot creation if specified.
+       * NOTE: message may be logged, and it should not contain sensitive information.
+       */
+      message?: string;
+      /**
+       * Time is the timestamp when the error was encountered.
+       */
+      time?: string;
+    };
+    /**
+     * ReadyToUse indicates that the snapshot is available to be restored.
+     */
+    readyToUse?: boolean;
+    /**
+     * Size is the size of the snapshot file, in bytes. If not specified, the snapshot failed.
+     */
+    size?: number | string;
+  };
+}

images/operator/src/__generated__/resources/K8SEnvoyFilterV1alpha3.json

@@ -0,0 +1,463 @@
+{
+  "properties": {
+    "spec": {
+      "description": "Customizing Envoy configuration generated by Istio. See more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html",
+      "properties": {
+        "configPatches": {
+          "description": "One or more patches with match conditions.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "applyTo": {
+                "description": "Specifies where in the Envoy configuration, the patch should be applied.\n\nValid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER",
+                "type": "string",
+                "enum": [
+                  "INVALID",
+                  "LISTENER",
+                  "FILTER_CHAIN",
+                  "NETWORK_FILTER",
+                  "HTTP_FILTER",
+                  "ROUTE_CONFIGURATION",
+                  "VIRTUAL_HOST",
+                  "HTTP_ROUTE",
+                  "CLUSTER",
+                  "EXTENSION_CONFIG",
+                  "BOOTSTRAP",
+                  "LISTENER_FILTER"
+                ]
+              },
+              "match": {
+                "description": "Match on listener/route configuration/cluster.",
+                "type": "object",
+                "oneOf": [
+                  {
+                    "not": {
+                      "anyOf": [
+                        {
+                          "required": [
+                            "listener"
+                          ]
+                        },
+                        {
+                          "required": [
+                            "routeConfiguration"
+                          ]
+                        },
+                        {
+                          "required": [
+                            "cluster"
+                          ]
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "required": [
+                      "listener"
+                    ]
+                  },
+                  {
+                    "required": [
+                      "routeConfiguration"
+                    ]
+                  },
+                  {
+                    "required": [
+                      "cluster"
+                    ]
+                  }
+                ],
+                "properties": {
+                  "cluster": {
+                    "description": "Match on envoy cluster attributes.",
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "description": "The exact name of the cluster to match.",
+                        "type": "string"
+                      },
+                      "portNumber": {
+                        "description": "The service port for which this cluster was generated.",
+                        "type": "integer",
+                        "maximum": 4294967295,
+                        "minimum": 0
+                      },
+                      "service": {
+                        "description": "The fully qualified service name for this cluster.",
+                        "type": "string"
+                      },
+                      "subset": {
+                        "description": "The subset associated with the service.",
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "context": {
+                    "description": "The specific config generation context to match on.\n\nValid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY",
+                    "type": "string",
+                    "enum": [
+                      "ANY",
+                      "SIDECAR_INBOUND",
+                      "SIDECAR_OUTBOUND",
+                      "GATEWAY"
+                    ]
+                  },
+                  "listener": {
+                    "description": "Match on envoy listener attributes.",
+                    "type": "object",
+                    "properties": {
+                      "filterChain": {
+                        "description": "Match a specific filter chain in a listener.",
+                        "type": "object",
+                        "properties": {
+                          "applicationProtocols": {
+                            "description": "Applies only to sidecars.",
+                            "type": "string"
+                          },
+                          "destinationPort": {
+                            "description": "The destination_port value used by a filter chain's match condition.",
+                            "type": "integer",
+                            "maximum": 4294967295,
+                            "minimum": 0
+                          },
+                          "filter": {
+                            "description": "The name of a specific filter to apply the patch to.",
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "description": "The filter name to match on.",
+                                "type": "string"
+                              },
+                              "subFilter": {
+                                "description": "The next level filter within this filter to match upon.",
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "description": "The filter name to match on.",
+                                    "type": "string"
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "name": {
+                            "description": "The name assigned to the filter chain.",
+                            "type": "string"
+                          },
+                          "sni": {
+                            "description": "The SNI value used by a filter chain's match condition.",
+                            "type": "string"
+                          },
+                          "transportProtocol": {
+                            "description": "Applies only to `SIDECAR_INBOUND` context.",
+                            "type": "string"
+                          }
+                        }
+                      },
+                      "listenerFilter": {
+                        "description": "Match a specific listener filter.",
+                        "type": "string"
+                      },
+                      "name": {
+                        "description": "Match a specific listener by its name.",
+                        "type": "string"
+                      },
+                      "portName": {
+                        "type": "string"
+                      },
+                      "portNumber": {
+                        "description": "The service port/gateway port to which traffic is being sent/received.",
+                        "type": "integer",
+                        "maximum": 4294967295,
+                        "minimum": 0
+                      }
+                    }
+                  },
+                  "proxy": {
+                    "description": "Match on properties associated with a proxy.",
+                    "type": "object",
+                    "properties": {
+                      "metadata": {
+                        "description": "Match on the node metadata supplied by a proxy when connecting to istiod.",
+                        "type": "object",
+                        "additionalProperties": {
+                          "type": "string"
+                        }
+                      },
+                      "proxyVersion": {
+                        "description": "A regular expression in golang regex format (RE2) that can be used to select proxies using a specific version of istio proxy.",
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "routeConfiguration": {
+                    "description": "Match on envoy HTTP route configuration attributes.",
+                    "type": "object",
+                    "properties": {
+                      "gateway": {
+                        "description": "The Istio gateway config's namespace/name for which this route configuration was generated.",
+                        "type": "string"
+                      },
+                      "name": {
+                        "description": "Route configuration name to match on.",
+                        "type": "string"
+                      },
+                      "portName": {
+                        "description": "Applicable only for GATEWAY context.",
+                        "type": "string"
+                      },
+                      "portNumber": {
+                        "description": "The service port number or gateway server port number for which this route configuration was generated.",
+                        "type": "integer",
+                        "maximum": 4294967295,
+                        "minimum": 0
+                      },
+                      "vhost": {
+                        "description": "Match a specific virtual host in a route configuration and apply the patch to the virtual host.",
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "description": "The VirtualHosts objects generated by Istio are named as host:port, where the host typically corresponds to the VirtualService's host field or the hostname of a service in the registry.",
+                            "type": "string"
+                          },
+                          "route": {
+                            "description": "Match a specific route within the virtual host.",
+                            "type": "object",
+                            "properties": {
+                              "action": {
+                                "description": "Match a route with specific action type.\n\nValid Options: ANY, ROUTE, REDIRECT, DIRECT_RESPONSE",
+                                "type": "string",
+                                "enum": [
+                                  "ANY",
+                                  "ROUTE",
+                                  "REDIRECT",
+                                  "DIRECT_RESPONSE"
+                                ]
+                              },
+                              "name": {
+                                "description": "The Route objects generated by default are named as default.",
+                                "type": "string"
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "patch": {
+                "description": "The patch to apply along with the operation.",
+                "type": "object",
+                "properties": {
+                  "filterClass": {
+                    "description": "Determines the filter insertion order.\n\nValid Options: AUTHN, AUTHZ, STATS",
+                    "type": "string",
+                    "enum": [
+                      "UNSPECIFIED",
+                      "AUTHN",
+                      "AUTHZ",
+                      "STATS"
+                    ]
+                  },
+                  "operation": {
+                    "description": "Determines how the patch should be applied.\n\nValid Options: MERGE, ADD, REMOVE, INSERT_BEFORE, INSERT_AFTER, INSERT_FIRST, REPLACE",
+                    "type": "string",
+                    "enum": [
+                      "INVALID",
+                      "MERGE",
+                      "ADD",
+                      "REMOVE",
+                      "INSERT_BEFORE",
+                      "INSERT_AFTER",
+                      "INSERT_FIRST",
+                      "REPLACE"
+                    ]
+                  },
+                  "value": {
+                    "description": "The JSON config of the object being patched.",
+                    "type": "object",
+                    "x-kubernetes-preserve-unknown-fields": true
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        },
+        "priority": {
+          "description": "Priority defines the order in which patch sets are applied within a context.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "targetRefs": {
+          "description": "Optional.",
+          "items": {
+            "type": "object",
+            "required": [
+              "kind",
+              "name"
+            ],
+            "properties": {
+              "group": {
+                "description": "group is the group of the target resource.",
+                "type": "string",
+                "maxLength": 253,
+                "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+              },
+              "kind": {
+                "description": "kind is kind of the target resource.",
+                "type": "string",
+                "maxLength": 63,
+                "minLength": 1,
+                "pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$"
+              },
+              "name": {
+                "description": "name is the name of the target resource.",
+                "type": "string",
+                "maxLength": 253,
+                "minLength": 1
+              },
+              "namespace": {
+                "description": "namespace is the namespace of the referent.",
+                "type": "string",
+                "x-kubernetes-validations": [
+                  {
+                    "rule": "self.size() == 0",
+                    "message": "cross namespace referencing is not currently supported"
+                  }
+                ]
+              }
+            },
+            "x-kubernetes-validations": [
+              {
+                "rule": "[self.group, self.kind] in [['core','Service'], ['','Service'], ['gateway.networking.k8s.io','Gateway'], ['networking.istio.io','ServiceEntry']]",
+                "message": "Support kinds are core/Service, networking.istio.io/ServiceEntry, gateway.networking.k8s.io/Gateway"
+              }
+            ]
+          },
+          "maxItems": 16,
+          "type": "array"
+        },
+        "workloadSelector": {
+          "description": "Criteria used to select the specific set of pods/VMs on which this patch configuration should be applied.",
+          "properties": {
+            "labels": {
+              "additionalProperties": {
+                "type": "string",
+                "maxLength": 63,
+                "x-kubernetes-validations": [
+                  {
+                    "rule": "!self.contains('*')",
+                    "message": "wildcard is not supported in selector"
+                  }
+                ]
+              },
+              "description": "One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.",
+              "maxProperties": 256,
+              "type": "object"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_validations": [
+        {
+          "message": "only one of targetRefs or workloadSelector can be set",
+          "rule": "(has(self.workloadSelector)?1:0)+(has(self.targetRefs)?1:0)<=1"
+        }
+      ]
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "description": "Current service state of the resource.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "lastProbeTime": {
+                "description": "Last time we probed the condition.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "lastTransitionTime": {
+                "description": "Last time the condition transitioned from one status to another.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "Human-readable message indicating details about last transition.",
+                "type": "string"
+              },
+              "reason": {
+                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status is the status of the condition.",
+                "type": "string"
+              },
+              "type": {
+                "description": "Type is the type of the condition.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Resource Generation to which the Reconciled Condition refers.",
+          "x_kubernetes_int_or_string": true
+        },
+        "validationMessages": {
+          "description": "Includes any errors or warnings detected by Istio's analyzers.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "documentationUrl": {
+                "description": "A url pointing to the Istio documentation for this specific error type.",
+                "type": "string"
+              },
+              "level": {
+                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
+                "type": "string",
+                "enum": [
+                  "UNKNOWN",
+                  "ERROR",
+                  "WARNING",
+                  "INFO"
+                ]
+              },
+              "type": {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "A human-readable name for the message type.",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_preserve_unknown_fields": true
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SGatewayV1.json

@@ -0,0 +1,260 @@
+{
+  "properties": {
+    "spec": {
+      "description": "Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html",
+      "properties": {
+        "selector": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied.",
+          "type": "object"
+        },
+        "servers": {
+          "description": "A list of server specifications.",
+          "items": {
+            "type": "object",
+            "required": [
+              "port",
+              "hosts"
+            ],
+            "properties": {
+              "bind": {
+                "description": "The ip or the Unix domain socket to which the listener should be bound to.",
+                "type": "string"
+              },
+              "defaultEndpoint": {
+                "type": "string"
+              },
+              "hosts": {
+                "description": "One or more hosts exposed by this gateway.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "name": {
+                "description": "An optional name of the server, when set must be unique across all servers.",
+                "type": "string"
+              },
+              "port": {
+                "description": "The Port on which the proxy should listen for incoming connections.",
+                "type": "object",
+                "required": [
+                  "number",
+                  "protocol",
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Label assigned to the port.",
+                    "type": "string"
+                  },
+                  "number": {
+                    "description": "A valid non-negative integer port number.",
+                    "type": "integer",
+                    "maximum": 4294967295,
+                    "minimum": 0
+                  },
+                  "protocol": {
+                    "description": "The protocol exposed on the port.",
+                    "type": "string"
+                  },
+                  "targetPort": {
+                    "type": "integer",
+                    "maximum": 4294967295,
+                    "minimum": 0
+                  }
+                }
+              },
+              "tls": {
+                "description": "Set of TLS related options that govern the server's behavior.",
+                "type": "object",
+                "properties": {
+                  "caCertificates": {
+                    "description": "REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.",
+                    "type": "string"
+                  },
+                  "caCrl": {
+                    "description": "OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.",
+                    "type": "string"
+                  },
+                  "cipherSuites": {
+                    "description": "Optional: If specified, only support the specified cipher list.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "credentialName": {
+                    "description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.",
+                    "type": "string"
+                  },
+                  "httpsRedirect": {
+                    "description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
+                    "type": "boolean"
+                  },
+                  "maxProtocolVersion": {
+                    "description": "Optional: Maximum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
+                    "type": "string",
+                    "enum": [
+                      "TLS_AUTO",
+                      "TLSV1_0",
+                      "TLSV1_1",
+                      "TLSV1_2",
+                      "TLSV1_3"
+                    ]
+                  },
+                  "minProtocolVersion": {
+                    "description": "Optional: Minimum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
+                    "type": "string",
+                    "enum": [
+                      "TLS_AUTO",
+                      "TLSV1_0",
+                      "TLSV1_1",
+                      "TLSV1_2",
+                      "TLSV1_3"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Optional: Indicates whether connections to this port should be secured using TLS.\n\nValid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL",
+                    "type": "string",
+                    "enum": [
+                      "PASSTHROUGH",
+                      "SIMPLE",
+                      "MUTUAL",
+                      "AUTO_PASSTHROUGH",
+                      "ISTIO_MUTUAL",
+                      "OPTIONAL_MUTUAL"
+                    ]
+                  },
+                  "privateKey": {
+                    "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
+                    "type": "string"
+                  },
+                  "serverCertificate": {
+                    "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
+                    "type": "string"
+                  },
+                  "subjectAltNames": {
+                    "description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "verifyCertificateHash": {
+                    "description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "verifyCertificateSpki": {
+                    "description": "An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "description": "Current service state of the resource.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "lastProbeTime": {
+                "description": "Last time we probed the condition.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "lastTransitionTime": {
+                "description": "Last time the condition transitioned from one status to another.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "Human-readable message indicating details about last transition.",
+                "type": "string"
+              },
+              "reason": {
+                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status is the status of the condition.",
+                "type": "string"
+              },
+              "type": {
+                "description": "Type is the type of the condition.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Resource Generation to which the Reconciled Condition refers.",
+          "x_kubernetes_int_or_string": true
+        },
+        "validationMessages": {
+          "description": "Includes any errors or warnings detected by Istio's analyzers.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "documentationUrl": {
+                "description": "A url pointing to the Istio documentation for this specific error type.",
+                "type": "string"
+              },
+              "level": {
+                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
+                "type": "string",
+                "enum": [
+                  "UNKNOWN",
+                  "ERROR",
+                  "WARNING",
+                  "INFO"
+                ]
+              },
+              "type": {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "A human-readable name for the message type.",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_preserve_unknown_fields": true
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SGatewayV1.ts

@@ -0,0 +1,179 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SGatewayV1 {
+  /**
+   * Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html
+   */
+  spec?: {
+    /**
+     * One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied.
+     */
+    selector?: {
+      [k: string]: string;
+    };
+    /**
+     * A list of server specifications.
+     */
+    servers?: {
+      /**
+       * The ip or the Unix domain socket to which the listener should be bound to.
+       */
+      bind?: string;
+      defaultEndpoint?: string;
+      /**
+       * One or more hosts exposed by this gateway.
+       */
+      hosts: string[];
+      /**
+       * An optional name of the server, when set must be unique across all servers.
+       */
+      name?: string;
+      /**
+       * The Port on which the proxy should listen for incoming connections.
+       */
+      port: {
+        /**
+         * Label assigned to the port.
+         */
+        name: string;
+        /**
+         * A valid non-negative integer port number.
+         */
+        number: number;
+        /**
+         * The protocol exposed on the port.
+         */
+        protocol: string;
+        targetPort?: number;
+      };
+      /**
+       * Set of TLS related options that govern the server's behavior.
+       */
+      tls?: {
+        /**
+         * REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.
+         */
+        caCertificates?: string;
+        /**
+         * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.
+         */
+        caCrl?: string;
+        /**
+         * Optional: If specified, only support the specified cipher list.
+         */
+        cipherSuites?: string[];
+        /**
+         * For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.
+         */
+        credentialName?: string;
+        /**
+         * If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
+         */
+        httpsRedirect?: boolean;
+        /**
+         * Optional: Maximum TLS protocol version.
+         *
+         * Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
+         */
+        maxProtocolVersion?: "TLS_AUTO" | "TLSV1_0" | "TLSV1_1" | "TLSV1_2" | "TLSV1_3";
+        /**
+         * Optional: Minimum TLS protocol version.
+         *
+         * Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
+         */
+        minProtocolVersion?: "TLS_AUTO" | "TLSV1_0" | "TLSV1_1" | "TLSV1_2" | "TLSV1_3";
+        /**
+         * Optional: Indicates whether connections to this port should be secured using TLS.
+         *
+         * Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL
+         */
+        mode?: "PASSTHROUGH" | "SIMPLE" | "MUTUAL" | "AUTO_PASSTHROUGH" | "ISTIO_MUTUAL" | "OPTIONAL_MUTUAL";
+        /**
+         * REQUIRED if mode is `SIMPLE` or `MUTUAL`.
+         */
+        privateKey?: string;
+        /**
+         * REQUIRED if mode is `SIMPLE` or `MUTUAL`.
+         */
+        serverCertificate?: string;
+        /**
+         * A list of alternate names to verify the subject identity in the certificate presented by the client.
+         */
+        subjectAltNames?: string[];
+        /**
+         * An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.
+         */
+        verifyCertificateHash?: string[];
+        /**
+         * An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.
+         */
+        verifyCertificateSpki?: string[];
+      };
+    }[];
+  };
+  status?: {
+    /**
+     * Current service state of the resource.
+     */
+    conditions?: {
+      /**
+       * Last time we probed the condition.
+       */
+      lastProbeTime?: string;
+      /**
+       * Last time the condition transitioned from one status to another.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Human-readable message indicating details about last transition.
+       */
+      message?: string;
+      /**
+       * Unique, one-word, CamelCase reason for the condition's last transition.
+       */
+      reason?: string;
+      /**
+       * Status is the status of the condition.
+       */
+      status?: string;
+      /**
+       * Type is the type of the condition.
+       */
+      type?: string;
+    }[];
+    /**
+     * Resource Generation to which the Reconciled Condition refers.
+     */
+    observedGeneration?: number | string;
+    /**
+     * Includes any errors or warnings detected by Istio's analyzers.
+     */
+    validationMessages?: {
+      /**
+       * A url pointing to the Istio documentation for this specific error type.
+       */
+      documentationUrl?: string;
+      /**
+       * Represents how severe a message is.
+       *
+       * Valid Options: UNKNOWN, ERROR, WARNING, INFO
+       */
+      level?: "UNKNOWN" | "ERROR" | "WARNING" | "INFO";
+      type?: {
+        /**
+         * A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+         */
+        code?: string;
+        /**
+         * A human-readable name for the message type.
+         */
+        name?: string;
+      };
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SGatewayV1alpha3.json

@@ -0,0 +1,260 @@
+{
+  "properties": {
+    "spec": {
+      "description": "Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html",
+      "properties": {
+        "selector": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied.",
+          "type": "object"
+        },
+        "servers": {
+          "description": "A list of server specifications.",
+          "items": {
+            "type": "object",
+            "required": [
+              "port",
+              "hosts"
+            ],
+            "properties": {
+              "bind": {
+                "description": "The ip or the Unix domain socket to which the listener should be bound to.",
+                "type": "string"
+              },
+              "defaultEndpoint": {
+                "type": "string"
+              },
+              "hosts": {
+                "description": "One or more hosts exposed by this gateway.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "name": {
+                "description": "An optional name of the server, when set must be unique across all servers.",
+                "type": "string"
+              },
+              "port": {
+                "description": "The Port on which the proxy should listen for incoming connections.",
+                "type": "object",
+                "required": [
+                  "number",
+                  "protocol",
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Label assigned to the port.",
+                    "type": "string"
+                  },
+                  "number": {
+                    "description": "A valid non-negative integer port number.",
+                    "type": "integer",
+                    "maximum": 4294967295,
+                    "minimum": 0
+                  },
+                  "protocol": {
+                    "description": "The protocol exposed on the port.",
+                    "type": "string"
+                  },
+                  "targetPort": {
+                    "type": "integer",
+                    "maximum": 4294967295,
+                    "minimum": 0
+                  }
+                }
+              },
+              "tls": {
+                "description": "Set of TLS related options that govern the server's behavior.",
+                "type": "object",
+                "properties": {
+                  "caCertificates": {
+                    "description": "REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.",
+                    "type": "string"
+                  },
+                  "caCrl": {
+                    "description": "OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.",
+                    "type": "string"
+                  },
+                  "cipherSuites": {
+                    "description": "Optional: If specified, only support the specified cipher list.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "credentialName": {
+                    "description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.",
+                    "type": "string"
+                  },
+                  "httpsRedirect": {
+                    "description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
+                    "type": "boolean"
+                  },
+                  "maxProtocolVersion": {
+                    "description": "Optional: Maximum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
+                    "type": "string",
+                    "enum": [
+                      "TLS_AUTO",
+                      "TLSV1_0",
+                      "TLSV1_1",
+                      "TLSV1_2",
+                      "TLSV1_3"
+                    ]
+                  },
+                  "minProtocolVersion": {
+                    "description": "Optional: Minimum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
+                    "type": "string",
+                    "enum": [
+                      "TLS_AUTO",
+                      "TLSV1_0",
+                      "TLSV1_1",
+                      "TLSV1_2",
+                      "TLSV1_3"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Optional: Indicates whether connections to this port should be secured using TLS.\n\nValid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL",
+                    "type": "string",
+                    "enum": [
+                      "PASSTHROUGH",
+                      "SIMPLE",
+                      "MUTUAL",
+                      "AUTO_PASSTHROUGH",
+                      "ISTIO_MUTUAL",
+                      "OPTIONAL_MUTUAL"
+                    ]
+                  },
+                  "privateKey": {
+                    "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
+                    "type": "string"
+                  },
+                  "serverCertificate": {
+                    "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
+                    "type": "string"
+                  },
+                  "subjectAltNames": {
+                    "description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "verifyCertificateHash": {
+                    "description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "verifyCertificateSpki": {
+                    "description": "An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "description": "Current service state of the resource.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "lastProbeTime": {
+                "description": "Last time we probed the condition.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "lastTransitionTime": {
+                "description": "Last time the condition transitioned from one status to another.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "Human-readable message indicating details about last transition.",
+                "type": "string"
+              },
+              "reason": {
+                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status is the status of the condition.",
+                "type": "string"
+              },
+              "type": {
+                "description": "Type is the type of the condition.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Resource Generation to which the Reconciled Condition refers.",
+          "x_kubernetes_int_or_string": true
+        },
+        "validationMessages": {
+          "description": "Includes any errors or warnings detected by Istio's analyzers.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "documentationUrl": {
+                "description": "A url pointing to the Istio documentation for this specific error type.",
+                "type": "string"
+              },
+              "level": {
+                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
+                "type": "string",
+                "enum": [
+                  "UNKNOWN",
+                  "ERROR",
+                  "WARNING",
+                  "INFO"
+                ]
+              },
+              "type": {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "A human-readable name for the message type.",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_preserve_unknown_fields": true
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SGatewayV1alpha3.ts

@@ -0,0 +1,179 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SGatewayV1Alpha3 {
+  /**
+   * Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html
+   */
+  spec?: {
+    /**
+     * One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied.
+     */
+    selector?: {
+      [k: string]: string;
+    };
+    /**
+     * A list of server specifications.
+     */
+    servers?: {
+      /**
+       * The ip or the Unix domain socket to which the listener should be bound to.
+       */
+      bind?: string;
+      defaultEndpoint?: string;
+      /**
+       * One or more hosts exposed by this gateway.
+       */
+      hosts: string[];
+      /**
+       * An optional name of the server, when set must be unique across all servers.
+       */
+      name?: string;
+      /**
+       * The Port on which the proxy should listen for incoming connections.
+       */
+      port: {
+        /**
+         * Label assigned to the port.
+         */
+        name: string;
+        /**
+         * A valid non-negative integer port number.
+         */
+        number: number;
+        /**
+         * The protocol exposed on the port.
+         */
+        protocol: string;
+        targetPort?: number;
+      };
+      /**
+       * Set of TLS related options that govern the server's behavior.
+       */
+      tls?: {
+        /**
+         * REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.
+         */
+        caCertificates?: string;
+        /**
+         * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.
+         */
+        caCrl?: string;
+        /**
+         * Optional: If specified, only support the specified cipher list.
+         */
+        cipherSuites?: string[];
+        /**
+         * For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.
+         */
+        credentialName?: string;
+        /**
+         * If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
+         */
+        httpsRedirect?: boolean;
+        /**
+         * Optional: Maximum TLS protocol version.
+         *
+         * Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
+         */
+        maxProtocolVersion?: "TLS_AUTO" | "TLSV1_0" | "TLSV1_1" | "TLSV1_2" | "TLSV1_3";
+        /**
+         * Optional: Minimum TLS protocol version.
+         *
+         * Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
+         */
+        minProtocolVersion?: "TLS_AUTO" | "TLSV1_0" | "TLSV1_1" | "TLSV1_2" | "TLSV1_3";
+        /**
+         * Optional: Indicates whether connections to this port should be secured using TLS.
+         *
+         * Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL
+         */
+        mode?: "PASSTHROUGH" | "SIMPLE" | "MUTUAL" | "AUTO_PASSTHROUGH" | "ISTIO_MUTUAL" | "OPTIONAL_MUTUAL";
+        /**
+         * REQUIRED if mode is `SIMPLE` or `MUTUAL`.
+         */
+        privateKey?: string;
+        /**
+         * REQUIRED if mode is `SIMPLE` or `MUTUAL`.
+         */
+        serverCertificate?: string;
+        /**
+         * A list of alternate names to verify the subject identity in the certificate presented by the client.
+         */
+        subjectAltNames?: string[];
+        /**
+         * An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.
+         */
+        verifyCertificateHash?: string[];
+        /**
+         * An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.
+         */
+        verifyCertificateSpki?: string[];
+      };
+    }[];
+  };
+  status?: {
+    /**
+     * Current service state of the resource.
+     */
+    conditions?: {
+      /**
+       * Last time we probed the condition.
+       */
+      lastProbeTime?: string;
+      /**
+       * Last time the condition transitioned from one status to another.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Human-readable message indicating details about last transition.
+       */
+      message?: string;
+      /**
+       * Unique, one-word, CamelCase reason for the condition's last transition.
+       */
+      reason?: string;
+      /**
+       * Status is the status of the condition.
+       */
+      status?: string;
+      /**
+       * Type is the type of the condition.
+       */
+      type?: string;
+    }[];
+    /**
+     * Resource Generation to which the Reconciled Condition refers.
+     */
+    observedGeneration?: number | string;
+    /**
+     * Includes any errors or warnings detected by Istio's analyzers.
+     */
+    validationMessages?: {
+      /**
+       * A url pointing to the Istio documentation for this specific error type.
+       */
+      documentationUrl?: string;
+      /**
+       * Represents how severe a message is.
+       *
+       * Valid Options: UNKNOWN, ERROR, WARNING, INFO
+       */
+      level?: "UNKNOWN" | "ERROR" | "WARNING" | "INFO";
+      type?: {
+        /**
+         * A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+         */
+        code?: string;
+        /**
+         * A human-readable name for the message type.
+         */
+        name?: string;
+      };
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SGatewayV1beta1.json

@@ -0,0 +1,260 @@
+{
+  "properties": {
+    "spec": {
+      "description": "Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html",
+      "properties": {
+        "selector": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied.",
+          "type": "object"
+        },
+        "servers": {
+          "description": "A list of server specifications.",
+          "items": {
+            "type": "object",
+            "required": [
+              "port",
+              "hosts"
+            ],
+            "properties": {
+              "bind": {
+                "description": "The ip or the Unix domain socket to which the listener should be bound to.",
+                "type": "string"
+              },
+              "defaultEndpoint": {
+                "type": "string"
+              },
+              "hosts": {
+                "description": "One or more hosts exposed by this gateway.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "name": {
+                "description": "An optional name of the server, when set must be unique across all servers.",
+                "type": "string"
+              },
+              "port": {
+                "description": "The Port on which the proxy should listen for incoming connections.",
+                "type": "object",
+                "required": [
+                  "number",
+                  "protocol",
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Label assigned to the port.",
+                    "type": "string"
+                  },
+                  "number": {
+                    "description": "A valid non-negative integer port number.",
+                    "type": "integer",
+                    "maximum": 4294967295,
+                    "minimum": 0
+                  },
+                  "protocol": {
+                    "description": "The protocol exposed on the port.",
+                    "type": "string"
+                  },
+                  "targetPort": {
+                    "type": "integer",
+                    "maximum": 4294967295,
+                    "minimum": 0
+                  }
+                }
+              },
+              "tls": {
+                "description": "Set of TLS related options that govern the server's behavior.",
+                "type": "object",
+                "properties": {
+                  "caCertificates": {
+                    "description": "REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.",
+                    "type": "string"
+                  },
+                  "caCrl": {
+                    "description": "OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.",
+                    "type": "string"
+                  },
+                  "cipherSuites": {
+                    "description": "Optional: If specified, only support the specified cipher list.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "credentialName": {
+                    "description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.",
+                    "type": "string"
+                  },
+                  "httpsRedirect": {
+                    "description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
+                    "type": "boolean"
+                  },
+                  "maxProtocolVersion": {
+                    "description": "Optional: Maximum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
+                    "type": "string",
+                    "enum": [
+                      "TLS_AUTO",
+                      "TLSV1_0",
+                      "TLSV1_1",
+                      "TLSV1_2",
+                      "TLSV1_3"
+                    ]
+                  },
+                  "minProtocolVersion": {
+                    "description": "Optional: Minimum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
+                    "type": "string",
+                    "enum": [
+                      "TLS_AUTO",
+                      "TLSV1_0",
+                      "TLSV1_1",
+                      "TLSV1_2",
+                      "TLSV1_3"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Optional: Indicates whether connections to this port should be secured using TLS.\n\nValid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL",
+                    "type": "string",
+                    "enum": [
+                      "PASSTHROUGH",
+                      "SIMPLE",
+                      "MUTUAL",
+                      "AUTO_PASSTHROUGH",
+                      "ISTIO_MUTUAL",
+                      "OPTIONAL_MUTUAL"
+                    ]
+                  },
+                  "privateKey": {
+                    "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
+                    "type": "string"
+                  },
+                  "serverCertificate": {
+                    "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
+                    "type": "string"
+                  },
+                  "subjectAltNames": {
+                    "description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "verifyCertificateHash": {
+                    "description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "verifyCertificateSpki": {
+                    "description": "An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "status": {
+      "properties": {
+        "conditions": {
+          "description": "Current service state of the resource.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "lastProbeTime": {
+                "description": "Last time we probed the condition.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "lastTransitionTime": {
+                "description": "Last time the condition transitioned from one status to another.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "Human-readable message indicating details about last transition.",
+                "type": "string"
+              },
+              "reason": {
+                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status is the status of the condition.",
+                "type": "string"
+              },
+              "type": {
+                "description": "Type is the type of the condition.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedGeneration": {
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Resource Generation to which the Reconciled Condition refers.",
+          "x_kubernetes_int_or_string": true
+        },
+        "validationMessages": {
+          "description": "Includes any errors or warnings detected by Istio's analyzers.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "documentationUrl": {
+                "description": "A url pointing to the Istio documentation for this specific error type.",
+                "type": "string"
+              },
+              "level": {
+                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
+                "type": "string",
+                "enum": [
+                  "UNKNOWN",
+                  "ERROR",
+                  "WARNING",
+                  "INFO"
+                ]
+              },
+              "type": {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "A human-readable name for the message type.",
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object",
+      "x_kubernetes_preserve_unknown_fields": true
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SGatewayV1beta1.ts

@@ -0,0 +1,179 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+export interface K8SGatewayV1Beta1 {
+  /**
+   * Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html
+   */
+  spec?: {
+    /**
+     * One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied.
+     */
+    selector?: {
+      [k: string]: string;
+    };
+    /**
+     * A list of server specifications.
+     */
+    servers?: {
+      /**
+       * The ip or the Unix domain socket to which the listener should be bound to.
+       */
+      bind?: string;
+      defaultEndpoint?: string;
+      /**
+       * One or more hosts exposed by this gateway.
+       */
+      hosts: string[];
+      /**
+       * An optional name of the server, when set must be unique across all servers.
+       */
+      name?: string;
+      /**
+       * The Port on which the proxy should listen for incoming connections.
+       */
+      port: {
+        /**
+         * Label assigned to the port.
+         */
+        name: string;
+        /**
+         * A valid non-negative integer port number.
+         */
+        number: number;
+        /**
+         * The protocol exposed on the port.
+         */
+        protocol: string;
+        targetPort?: number;
+      };
+      /**
+       * Set of TLS related options that govern the server's behavior.
+       */
+      tls?: {
+        /**
+         * REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.
+         */
+        caCertificates?: string;
+        /**
+         * OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.
+         */
+        caCrl?: string;
+        /**
+         * Optional: If specified, only support the specified cipher list.
+         */
+        cipherSuites?: string[];
+        /**
+         * For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.
+         */
+        credentialName?: string;
+        /**
+         * If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
+         */
+        httpsRedirect?: boolean;
+        /**
+         * Optional: Maximum TLS protocol version.
+         *
+         * Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
+         */
+        maxProtocolVersion?: "TLS_AUTO" | "TLSV1_0" | "TLSV1_1" | "TLSV1_2" | "TLSV1_3";
+        /**
+         * Optional: Minimum TLS protocol version.
+         *
+         * Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
+         */
+        minProtocolVersion?: "TLS_AUTO" | "TLSV1_0" | "TLSV1_1" | "TLSV1_2" | "TLSV1_3";
+        /**
+         * Optional: Indicates whether connections to this port should be secured using TLS.
+         *
+         * Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL
+         */
+        mode?: "PASSTHROUGH" | "SIMPLE" | "MUTUAL" | "AUTO_PASSTHROUGH" | "ISTIO_MUTUAL" | "OPTIONAL_MUTUAL";
+        /**
+         * REQUIRED if mode is `SIMPLE` or `MUTUAL`.
+         */
+        privateKey?: string;
+        /**
+         * REQUIRED if mode is `SIMPLE` or `MUTUAL`.
+         */
+        serverCertificate?: string;
+        /**
+         * A list of alternate names to verify the subject identity in the certificate presented by the client.
+         */
+        subjectAltNames?: string[];
+        /**
+         * An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.
+         */
+        verifyCertificateHash?: string[];
+        /**
+         * An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.
+         */
+        verifyCertificateSpki?: string[];
+      };
+    }[];
+  };
+  status?: {
+    /**
+     * Current service state of the resource.
+     */
+    conditions?: {
+      /**
+       * Last time we probed the condition.
+       */
+      lastProbeTime?: string;
+      /**
+       * Last time the condition transitioned from one status to another.
+       */
+      lastTransitionTime?: string;
+      /**
+       * Human-readable message indicating details about last transition.
+       */
+      message?: string;
+      /**
+       * Unique, one-word, CamelCase reason for the condition's last transition.
+       */
+      reason?: string;
+      /**
+       * Status is the status of the condition.
+       */
+      status?: string;
+      /**
+       * Type is the type of the condition.
+       */
+      type?: string;
+    }[];
+    /**
+     * Resource Generation to which the Reconciled Condition refers.
+     */
+    observedGeneration?: number | string;
+    /**
+     * Includes any errors or warnings detected by Istio's analyzers.
+     */
+    validationMessages?: {
+      /**
+       * A url pointing to the Istio documentation for this specific error type.
+       */
+      documentationUrl?: string;
+      /**
+       * Represents how severe a message is.
+       *
+       * Valid Options: UNKNOWN, ERROR, WARNING, INFO
+       */
+      level?: "UNKNOWN" | "ERROR" | "WARNING" | "INFO";
+      type?: {
+        /**
+         * A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+         */
+        code?: string;
+        /**
+         * A human-readable name for the message type.
+         */
+        name?: string;
+      };
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SGitRepositoryV1.json

@@ -0,0 +1,412 @@
+{
+  "description": "GitRepository is the Schema for the gitrepositories API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "GitRepositorySpec specifies the required configuration to produce an\nArtifact for a Git repository.",
+      "properties": {
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "include": {
+          "description": "Include specifies a list of GitRepository resources which Artifacts\nshould be included in the Artifact produced for this GitRepository.",
+          "items": {
+            "description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "interval": {
+          "description": "Interval at which the GitRepository URL is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "provider": {
+          "description": "Provider used for authentication, can be 'azure', 'github', 'generic'.\nWhen not specified, defaults to 'generic'.",
+          "_enum": [
+            "generic",
+            "azure",
+            "github"
+          ],
+          "type": "string"
+        },
+        "proxySecretRef": {
+          "description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the Git server.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "recurseSubmodules": {
+          "description": "RecurseSubmodules enables the initialization of all submodules within\nthe GitRepository as cloned from the URL, using their default settings.",
+          "type": "boolean"
+        },
+        "ref": {
+          "description": "Reference specifies the Git reference to resolve and monitor for\nchanges, defaults to the 'master' branch.",
+          "properties": {
+            "branch": {
+              "description": "Branch to check out, defaults to 'master' if no other field is defined.",
+              "type": "string"
+            },
+            "commit": {
+              "description": "Commit SHA to check out, takes precedence over all reference fields.\n\nThis can be combined with Branch to shallow clone the branch, in which\nthe commit is expected to exist.",
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the reference to check out; takes precedence over Branch, Tag and SemVer.\n\nIt must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description\nExamples: \"refs/heads/main\", \"refs/tags/v0.1.0\", \"refs/pull/420/head\", \"refs/merge-requests/1/head\"",
+              "type": "string"
+            },
+            "semver": {
+              "description": "SemVer tag expression to check out, takes precedence over Tag.",
+              "type": "string"
+            },
+            "tag": {
+              "description": "Tag to check out, takes precedence over Branch.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials for\nthe GitRepository.\nFor HTTPS repositories the Secret must contain 'username' and 'password'\nfields for basic auth or 'bearerToken' field for token auth.\nFor SSH repositories the Secret must contain 'identity'\nand 'known_hosts' fields.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "sparseCheckout": {
+          "description": "SparseCheckout specifies a list of directories to checkout when cloning\nthe repository. If specified, only these directories are included in the\nArtifact produced for this GitRepository.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nGitRepository.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "Timeout for Git operations like cloning, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL specifies the Git repository URL, it can be an HTTP/S or SSH address.",
+          "pattern": "^(http|https|ssh)://.*$",
+          "type": "string"
+        },
+        "verify": {
+          "description": "Verification specifies the configuration to verify the Git commit\nsignature(s).",
+          "properties": {
+            "mode": {
+              "_default": "HEAD",
+              "description": "Mode specifies which Git object(s) should be verified.\n\nThe variants \"head\" and \"HEAD\" both imply the same thing, i.e. verify\nthe commit that the HEAD of the Git repository points to. The variant\n\"head\" solely exists to ensure backwards compatibility.",
+              "_enum": [
+                "head",
+                "HEAD",
+                "Tag",
+                "TagAndHEAD"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Secret containing the public keys of trusted Git\nauthors.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "secretRef"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "GitRepositoryStatus records the observed state of a Git repository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful GitRepository reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the GitRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "includedArtifacts": {
+          "description": "IncludedArtifacts contains a list of the last successfully included\nArtifacts as instructed by GitRepositorySpec.Include.",
+          "items": {
+            "description": "Artifact represents the output of a Source reconciliation.",
+            "type": "object",
+            "required": [
+              "lastUpdateTime",
+              "path",
+              "revision",
+              "url"
+            ],
+            "properties": {
+              "digest": {
+                "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$"
+              },
+              "lastUpdateTime": {
+                "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "metadata": {
+                "description": "Metadata holds upstream information such as OCI annotations.",
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string"
+                }
+              },
+              "path": {
+                "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+                "type": "string"
+              },
+              "revision": {
+                "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+                "type": "string"
+              },
+              "size": {
+                "description": "Size is the number of bytes in the file.",
+                "type": "integer",
+                "format": "int64"
+              },
+              "url": {
+                "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the GitRepository\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "observedInclude": {
+          "description": "ObservedInclude is the observed list of GitRepository resources used to\nproduce the current Artifact.",
+          "items": {
+            "description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedRecurseSubmodules": {
+          "description": "ObservedRecurseSubmodules is the observed resource submodules\nconfiguration used to produce the current Artifact.",
+          "type": "boolean"
+        },
+        "observedSparseCheckout": {
+          "description": "ObservedSparseCheckout is the observed list of directories used to\nproduce the current Artifact.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "sourceVerificationMode": {
+          "description": "SourceVerificationMode is the last used verification mode indicating\nwhich Git object(s) have been verified.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SGitRepositoryV1.ts

@@ -0,0 +1,363 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * GitRepository is the Schema for the gitrepositories API.
+ */
+export interface K8SGitRepositoryV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * GitRepositorySpec specifies the required configuration to produce an
+   * Artifact for a Git repository.
+   */
+  spec?: {
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Include specifies a list of GitRepository resources which Artifacts
+     * should be included in the Artifact produced for this GitRepository.
+     */
+    include?: {
+      /**
+       * FromPath specifies the path to copy contents from, defaults to the root
+       * of the Artifact.
+       */
+      fromPath?: string;
+      /**
+       * GitRepositoryRef specifies the GitRepository which Artifact contents
+       * must be included.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * ToPath specifies the path to copy contents to, defaults to the name of
+       * the GitRepositoryRef.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * Interval at which the GitRepository URL is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * Provider used for authentication, can be 'azure', 'github', 'generic'.
+     * When not specified, defaults to 'generic'.
+     */
+    provider?: string;
+    /**
+     * ProxySecretRef specifies the Secret containing the proxy configuration
+     * to use while communicating with the Git server.
+     */
+    proxySecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * RecurseSubmodules enables the initialization of all submodules within
+     * the GitRepository as cloned from the URL, using their default settings.
+     */
+    recurseSubmodules?: boolean;
+    /**
+     * Reference specifies the Git reference to resolve and monitor for
+     * changes, defaults to the 'master' branch.
+     */
+    ref?: {
+      /**
+       * Branch to check out, defaults to 'master' if no other field is defined.
+       */
+      branch?: string;
+      /**
+       * Commit SHA to check out, takes precedence over all reference fields.
+       *
+       * This can be combined with Branch to shallow clone the branch, in which
+       * the commit is expected to exist.
+       */
+      commit?: string;
+      /**
+       * Name of the reference to check out; takes precedence over Branch, Tag and SemVer.
+       *
+       * It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description
+       * Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head"
+       */
+      name?: string;
+      /**
+       * SemVer tag expression to check out, takes precedence over Tag.
+       */
+      semver?: string;
+      /**
+       * Tag to check out, takes precedence over Branch.
+       */
+      tag?: string;
+    };
+    /**
+     * SecretRef specifies the Secret containing authentication credentials for
+     * the GitRepository.
+     * For HTTPS repositories the Secret must contain 'username' and 'password'
+     * fields for basic auth or 'bearerToken' field for token auth.
+     * For SSH repositories the Secret must contain 'identity'
+     * and 'known_hosts' fields.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * SparseCheckout specifies a list of directories to checkout when cloning
+     * the repository. If specified, only these directories are included in the
+     * Artifact produced for this GitRepository.
+     */
+    sparseCheckout?: string[];
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * GitRepository.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout for Git operations like cloning, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * URL specifies the Git repository URL, it can be an HTTP/S or SSH address.
+     */
+    url: string;
+    /**
+     * Verification specifies the configuration to verify the Git commit
+     * signature(s).
+     */
+    verify?: {
+      /**
+       * Mode specifies which Git object(s) should be verified.
+       *
+       * The variants "head" and "HEAD" both imply the same thing, i.e. verify
+       * the commit that the HEAD of the Git repository points to. The variant
+       * "head" solely exists to ensure backwards compatibility.
+       */
+      mode?: string;
+      /**
+       * SecretRef specifies the Secret containing the public keys of trusted Git
+       * authors.
+       */
+      secretRef: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+  };
+  /**
+   * GitRepositoryStatus records the observed state of a Git repository.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful GitRepository reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the GitRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * IncludedArtifacts contains a list of the last successfully included
+     * Artifacts as instructed by GitRepositorySpec.Include.
+     */
+    includedArtifacts?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the GitRepository
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * ObservedInclude is the observed list of GitRepository resources used to
+     * produce the current Artifact.
+     */
+    observedInclude?: {
+      /**
+       * FromPath specifies the path to copy contents from, defaults to the root
+       * of the Artifact.
+       */
+      fromPath?: string;
+      /**
+       * GitRepositoryRef specifies the GitRepository which Artifact contents
+       * must be included.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * ToPath specifies the path to copy contents to, defaults to the name of
+       * the GitRepositoryRef.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * ObservedRecurseSubmodules is the observed resource submodules
+     * configuration used to produce the current Artifact.
+     */
+    observedRecurseSubmodules?: boolean;
+    /**
+     * ObservedSparseCheckout is the observed list of directories used to
+     * produce the current Artifact.
+     */
+    observedSparseCheckout?: string[];
+    /**
+     * SourceVerificationMode is the last used verification mode indicating
+     * which Git object(s) have been verified.
+     */
+    sourceVerificationMode?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SGitRepositoryV1beta1.json

@@ -0,0 +1,331 @@
+{
+  "description": "GitRepository is the Schema for the gitrepositories API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "GitRepositorySpec defines the desired state of a Git repository.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom defines an Access Control List for allowing cross-namespace references to this object.",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "gitImplementation": {
+          "_default": "go-git",
+          "description": "Determines which git client library to use.\nDefaults to go-git, valid values are ('go-git', 'libgit2').",
+          "_enum": [
+            "go-git",
+            "libgit2"
+          ],
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "include": {
+          "description": "Extra git repositories to map into the repository",
+          "items": {
+            "description": "GitRepositoryInclude defines a source with a from and to path.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "The path to copy contents from, defaults to the root directory.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "Reference to a GitRepository to include.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "The path to copy contents to, defaults to the name of the source ref.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "interval": {
+          "description": "The interval at which to check for repository updates.",
+          "type": "string"
+        },
+        "recurseSubmodules": {
+          "description": "When enabled, after the clone is created, initializes all submodules within,\nusing their default settings.\nThis option is available only when using the 'go-git' GitImplementation.",
+          "type": "boolean"
+        },
+        "ref": {
+          "description": "The Git reference to checkout and monitor for changes, defaults to\nmaster branch.",
+          "properties": {
+            "branch": {
+              "description": "The Git branch to checkout, defaults to master.",
+              "type": "string"
+            },
+            "commit": {
+              "description": "The Git commit SHA to checkout, if specified Tag filters will be ignored.",
+              "type": "string"
+            },
+            "semver": {
+              "description": "The Git tag semver expression, takes precedence over Tag.",
+              "type": "string"
+            },
+            "tag": {
+              "description": "The Git tag to checkout, takes precedence over Branch.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "secretRef": {
+          "description": "The secret name containing the Git credentials.\nFor HTTPS repositories the secret must contain username and password\nfields.\nFor SSH repositories the secret must contain identity and known_hosts\nfields.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "The timeout for remote Git operations like cloning, defaults to 60s.",
+          "type": "string"
+        },
+        "url": {
+          "description": "The repository URL, can be a HTTP/S or SSH address.",
+          "pattern": "^(http|https|ssh)://.*$",
+          "type": "string"
+        },
+        "verify": {
+          "description": "Verify OpenPGP signature for the Git commit HEAD points to.",
+          "properties": {
+            "mode": {
+              "description": "Mode describes what git object should be verified, currently ('head').",
+              "_enum": [
+                "head"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "The secret name containing the public keys of all trusted Git authors.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "mode"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "GitRepositoryStatus defines the observed state of a Git repository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful repository sync.",
+          "properties": {
+            "checksum": {
+              "description": "Checksum is the SHA256 checksum of the artifact.",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "path": {
+              "description": "Path is the relative file path of this artifact.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+              "type": "string"
+            },
+            "url": {
+              "description": "URL is the HTTP address of this artifact.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the GitRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "includedArtifacts": {
+          "description": "IncludedArtifacts represents the included artifacts from the last successful repository sync.",
+          "items": {
+            "description": "Artifact represents the output of a source synchronisation.",
+            "type": "object",
+            "required": [
+              "lastUpdateTime",
+              "path",
+              "url"
+            ],
+            "properties": {
+              "checksum": {
+                "description": "Checksum is the SHA256 checksum of the artifact.",
+                "type": "string"
+              },
+              "lastUpdateTime": {
+                "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "path": {
+                "description": "Path is the relative file path of this artifact.",
+                "type": "string"
+              },
+              "revision": {
+                "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+                "type": "string"
+              },
+              "url": {
+                "description": "URL is the HTTP address of this artifact.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the download link for the artifact output of the last repository\nsync.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SGitRepositoryV1beta1.ts

@@ -0,0 +1,273 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * GitRepository is the Schema for the gitrepositories API
+ */
+export interface K8SGitRepositoryV1Beta1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * GitRepositorySpec defines the desired state of a Git repository.
+   */
+  spec?: {
+    /**
+     * AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * Determines which git client library to use.
+     * Defaults to go-git, valid values are ('go-git', 'libgit2').
+     */
+    gitImplementation?: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Extra git repositories to map into the repository
+     */
+    include?: {
+      /**
+       * The path to copy contents from, defaults to the root directory.
+       */
+      fromPath?: string;
+      /**
+       * Reference to a GitRepository to include.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * The path to copy contents to, defaults to the name of the source ref.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * The interval at which to check for repository updates.
+     */
+    interval: string;
+    /**
+     * When enabled, after the clone is created, initializes all submodules within,
+     * using their default settings.
+     * This option is available only when using the 'go-git' GitImplementation.
+     */
+    recurseSubmodules?: boolean;
+    /**
+     * The Git reference to checkout and monitor for changes, defaults to
+     * master branch.
+     */
+    ref?: {
+      /**
+       * The Git branch to checkout, defaults to master.
+       */
+      branch?: string;
+      /**
+       * The Git commit SHA to checkout, if specified Tag filters will be ignored.
+       */
+      commit?: string;
+      /**
+       * The Git tag semver expression, takes precedence over Tag.
+       */
+      semver?: string;
+      /**
+       * The Git tag to checkout, takes precedence over Branch.
+       */
+      tag?: string;
+    };
+    /**
+     * The secret name containing the Git credentials.
+     * For HTTPS repositories the secret must contain username and password
+     * fields.
+     * For SSH repositories the secret must contain identity and known_hosts
+     * fields.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * The timeout for remote Git operations like cloning, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * The repository URL, can be a HTTP/S or SSH address.
+     */
+    url: string;
+    /**
+     * Verify OpenPGP signature for the Git commit HEAD points to.
+     */
+    verify?: {
+      /**
+       * Mode describes what git object should be verified, currently ('head').
+       */
+      mode: string;
+      /**
+       * The secret name containing the public keys of all trusted Git authors.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+  };
+  /**
+   * GitRepositoryStatus defines the observed state of a Git repository.
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful repository sync.
+     */
+    artifact?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the GitRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * IncludedArtifacts represents the included artifacts from the last successful repository sync.
+     */
+    includedArtifacts?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the download link for the artifact output of the last repository
+     * sync.
+     */
+    url?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SGitRepositoryV1beta2.json

@@ -0,0 +1,412 @@
+{
+  "description": "GitRepository is the Schema for the gitrepositories API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "GitRepositorySpec specifies the required configuration to produce an\nArtifact for a Git repository.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom specifies an Access Control List for allowing cross-namespace\nreferences to this object.\nNOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "gitImplementation": {
+          "_default": "go-git",
+          "description": "GitImplementation specifies which Git client library implementation to\nuse. Defaults to 'go-git', valid values are ('go-git', 'libgit2').\nDeprecated: gitImplementation is deprecated now that 'go-git' is the\nonly supported implementation.",
+          "_enum": [
+            "go-git",
+            "libgit2"
+          ],
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "include": {
+          "description": "Include specifies a list of GitRepository resources which Artifacts\nshould be included in the Artifact produced for this GitRepository.",
+          "items": {
+            "description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "interval": {
+          "description": "Interval at which to check the GitRepository for updates.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "recurseSubmodules": {
+          "description": "RecurseSubmodules enables the initialization of all submodules within\nthe GitRepository as cloned from the URL, using their default settings.",
+          "type": "boolean"
+        },
+        "ref": {
+          "description": "Reference specifies the Git reference to resolve and monitor for\nchanges, defaults to the 'master' branch.",
+          "properties": {
+            "branch": {
+              "description": "Branch to check out, defaults to 'master' if no other field is defined.",
+              "type": "string"
+            },
+            "commit": {
+              "description": "Commit SHA to check out, takes precedence over all reference fields.\n\nThis can be combined with Branch to shallow clone the branch, in which\nthe commit is expected to exist.",
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the reference to check out; takes precedence over Branch, Tag and SemVer.\n\nIt must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description\nExamples: \"refs/heads/main\", \"refs/tags/v0.1.0\", \"refs/pull/420/head\", \"refs/merge-requests/1/head\"",
+              "type": "string"
+            },
+            "semver": {
+              "description": "SemVer tag expression to check out, takes precedence over Tag.",
+              "type": "string"
+            },
+            "tag": {
+              "description": "Tag to check out, takes precedence over Branch.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials for\nthe GitRepository.\nFor HTTPS repositories the Secret must contain 'username' and 'password'\nfields for basic auth or 'bearerToken' field for token auth.\nFor SSH repositories the Secret must contain 'identity'\nand 'known_hosts' fields.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nGitRepository.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "Timeout for Git operations like cloning, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL specifies the Git repository URL, it can be an HTTP/S or SSH address.",
+          "pattern": "^(http|https|ssh)://.*$",
+          "type": "string"
+        },
+        "verify": {
+          "description": "Verification specifies the configuration to verify the Git commit\nsignature(s).",
+          "properties": {
+            "mode": {
+              "description": "Mode specifies what Git object should be verified, currently ('head').",
+              "_enum": [
+                "head"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Secret containing the public keys of trusted Git\nauthors.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "mode",
+            "secretRef"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "GitRepositoryStatus records the observed state of a Git repository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful GitRepository reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the GitRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "contentConfigChecksum": {
+          "description": "ContentConfigChecksum is a checksum of all the configurations related to\nthe content of the source artifact:\n - .spec.ignore\n - .spec.recurseSubmodules\n - .spec.included and the checksum of the included artifacts\nobserved in .status.observedGeneration version of the object. This can\nbe used to determine if the content of the included repository has\nchanged.\nIt has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.\n\nDeprecated: Replaced with explicit fields for observed artifact content\nconfig in the status.",
+          "type": "string"
+        },
+        "includedArtifacts": {
+          "description": "IncludedArtifacts contains a list of the last successfully included\nArtifacts as instructed by GitRepositorySpec.Include.",
+          "items": {
+            "description": "Artifact represents the output of a Source reconciliation.",
+            "type": "object",
+            "required": [
+              "lastUpdateTime",
+              "path",
+              "revision",
+              "url"
+            ],
+            "properties": {
+              "digest": {
+                "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$"
+              },
+              "lastUpdateTime": {
+                "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "metadata": {
+                "description": "Metadata holds upstream information such as OCI annotations.",
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string"
+                }
+              },
+              "path": {
+                "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+                "type": "string"
+              },
+              "revision": {
+                "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+                "type": "string"
+              },
+              "size": {
+                "description": "Size is the number of bytes in the file.",
+                "type": "integer",
+                "format": "int64"
+              },
+              "url": {
+                "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the GitRepository\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "observedInclude": {
+          "description": "ObservedInclude is the observed list of GitRepository resources used to\nto produce the current Artifact.",
+          "items": {
+            "description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedRecurseSubmodules": {
+          "description": "ObservedRecurseSubmodules is the observed resource submodules\nconfiguration used to produce the current Artifact.",
+          "type": "boolean"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nGitRepositoryStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SGitRepositoryV1beta2.ts

@@ -0,0 +1,375 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * GitRepository is the Schema for the gitrepositories API.
+ */
+export interface K8SGitRepositoryV1Beta2 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * GitRepositorySpec specifies the required configuration to produce an
+   * Artifact for a Git repository.
+   */
+  spec?: {
+    /**
+     * AccessFrom specifies an Access Control List for allowing cross-namespace
+     * references to this object.
+     * NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * GitImplementation specifies which Git client library implementation to
+     * use. Defaults to 'go-git', valid values are ('go-git', 'libgit2').
+     * Deprecated: gitImplementation is deprecated now that 'go-git' is the
+     * only supported implementation.
+     */
+    gitImplementation?: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Include specifies a list of GitRepository resources which Artifacts
+     * should be included in the Artifact produced for this GitRepository.
+     */
+    include?: {
+      /**
+       * FromPath specifies the path to copy contents from, defaults to the root
+       * of the Artifact.
+       */
+      fromPath?: string;
+      /**
+       * GitRepositoryRef specifies the GitRepository which Artifact contents
+       * must be included.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * ToPath specifies the path to copy contents to, defaults to the name of
+       * the GitRepositoryRef.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * Interval at which to check the GitRepository for updates.
+     */
+    interval: string;
+    /**
+     * RecurseSubmodules enables the initialization of all submodules within
+     * the GitRepository as cloned from the URL, using their default settings.
+     */
+    recurseSubmodules?: boolean;
+    /**
+     * Reference specifies the Git reference to resolve and monitor for
+     * changes, defaults to the 'master' branch.
+     */
+    ref?: {
+      /**
+       * Branch to check out, defaults to 'master' if no other field is defined.
+       */
+      branch?: string;
+      /**
+       * Commit SHA to check out, takes precedence over all reference fields.
+       *
+       * This can be combined with Branch to shallow clone the branch, in which
+       * the commit is expected to exist.
+       */
+      commit?: string;
+      /**
+       * Name of the reference to check out; takes precedence over Branch, Tag and SemVer.
+       *
+       * It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description
+       * Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head"
+       */
+      name?: string;
+      /**
+       * SemVer tag expression to check out, takes precedence over Tag.
+       */
+      semver?: string;
+      /**
+       * Tag to check out, takes precedence over Branch.
+       */
+      tag?: string;
+    };
+    /**
+     * SecretRef specifies the Secret containing authentication credentials for
+     * the GitRepository.
+     * For HTTPS repositories the Secret must contain 'username' and 'password'
+     * fields for basic auth or 'bearerToken' field for token auth.
+     * For SSH repositories the Secret must contain 'identity'
+     * and 'known_hosts' fields.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * GitRepository.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout for Git operations like cloning, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * URL specifies the Git repository URL, it can be an HTTP/S or SSH address.
+     */
+    url: string;
+    /**
+     * Verification specifies the configuration to verify the Git commit
+     * signature(s).
+     */
+    verify?: {
+      /**
+       * Mode specifies what Git object should be verified, currently ('head').
+       */
+      mode: string;
+      /**
+       * SecretRef specifies the Secret containing the public keys of trusted Git
+       * authors.
+       */
+      secretRef: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+  };
+  /**
+   * GitRepositoryStatus records the observed state of a Git repository.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful GitRepository reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the GitRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * ContentConfigChecksum is a checksum of all the configurations related to
+     * the content of the source artifact:
+     *  - .spec.ignore
+     *  - .spec.recurseSubmodules
+     *  - .spec.included and the checksum of the included artifacts
+     * observed in .status.observedGeneration version of the object. This can
+     * be used to determine if the content of the included repository has
+     * changed.
+     * It has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.
+     *
+     * Deprecated: Replaced with explicit fields for observed artifact content
+     * config in the status.
+     */
+    contentConfigChecksum?: string;
+    /**
+     * IncludedArtifacts contains a list of the last successfully included
+     * Artifacts as instructed by GitRepositorySpec.Include.
+     */
+    includedArtifacts?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the GitRepository
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * ObservedInclude is the observed list of GitRepository resources used to
+     * to produce the current Artifact.
+     */
+    observedInclude?: {
+      /**
+       * FromPath specifies the path to copy contents from, defaults to the root
+       * of the Artifact.
+       */
+      fromPath?: string;
+      /**
+       * GitRepositoryRef specifies the GitRepository which Artifact contents
+       * must be included.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * ToPath specifies the path to copy contents to, defaults to the name of
+       * the GitRepositoryRef.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * ObservedRecurseSubmodules is the observed resource submodules
+     * configuration used to produce the current Artifact.
+     */
+    observedRecurseSubmodules?: boolean;
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * GitRepositoryStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SHelmChartConfigV1.json

@@ -0,0 +1,61 @@
+{
+  "description": "HelmChartConfig represents additional configuration for the installation of Helm chart release.\nThis resource is intended for use when additional configuration needs to be passed to a HelmChart\nthat is managed by an external system.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmChartConfigSpec represents additional user-configurable details of an installed and configured Helm chart release.\nThese fields are merged with or override the corresponding fields on the related HelmChart resource.",
+      "properties": {
+        "failurePolicy": {
+          "_default": "reinstall",
+          "description": "Configures handling of failed chart installation or upgrades.\n- `reinstall` will perform a clean uninstall and reinstall of the chart.\n- `abort` will take no action and leave the chart in a failed state so that the administrator can manually resolve the error.",
+          "_enum": [
+            "abort",
+            "reinstall"
+          ],
+          "type": "string"
+        },
+        "valuesContent": {
+          "description": "Override complex Chart values via inline YAML content.\nHelm CLI positional argument/flag: `--values`",
+          "type": "string"
+        },
+        "valuesSecrets": {
+          "description": "Override complex Chart values via references to external Secrets.\nHelm CLI positional argument/flag: `--values`",
+          "items": {
+            "description": "SecretSpec describes a key in a secret to load chart values from.",
+            "type": "object",
+            "properties": {
+              "ignoreUpdates": {
+                "description": "Ignore changes to the secret, and mark the secret as optional.\nBy default, the secret must exist, and changes to the secret will trigger an upgrade of the chart to apply the updated values.\nIf `ignoreUpdates` is true, the secret is optional, and changes to the secret will not trigger an upgrade of the chart.",
+                "type": "boolean"
+              },
+              "keys": {
+                "description": "Keys to read values content from. If no keys are specified, the secret is not used.",
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "name": {
+                "description": "Name of the secret. Must be in the same namespace as the HelmChart resource.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SHelmChartConfigV1.ts

@@ -0,0 +1,67 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmChartConfig represents additional configuration for the installation of Helm chart release.
+ * This resource is intended for use when additional configuration needs to be passed to a HelmChart
+ * that is managed by an external system.
+ */
+export interface K8SHelmChartConfigV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmChartConfigSpec represents additional user-configurable details of an installed and configured Helm chart release.
+   * These fields are merged with or override the corresponding fields on the related HelmChart resource.
+   */
+  spec?: {
+    /**
+     * Configures handling of failed chart installation or upgrades.
+     * - `reinstall` will perform a clean uninstall and reinstall of the chart.
+     * - `abort` will take no action and leave the chart in a failed state so that the administrator can manually resolve the error.
+     */
+    failurePolicy?: string;
+    /**
+     * Override complex Chart values via inline YAML content.
+     * Helm CLI positional argument/flag: `--values`
+     */
+    valuesContent?: string;
+    /**
+     * Override complex Chart values via references to external Secrets.
+     * Helm CLI positional argument/flag: `--values`
+     */
+    valuesSecrets?: {
+      /**
+       * Ignore changes to the secret, and mark the secret as optional.
+       * By default, the secret must exist, and changes to the secret will trigger an upgrade of the chart to apply the updated values.
+       * If `ignoreUpdates` is true, the secret is optional, and changes to the secret will not trigger an upgrade of the chart.
+       */
+      ignoreUpdates?: boolean;
+      /**
+       * Keys to read values content from. If no keys are specified, the secret is not used.
+       */
+      keys?: string[];
+      /**
+       * Name of the secret. Must be in the same namespace as the HelmChart resource.
+       */
+      name?: string;
+    }[];
+  };
+}

images/operator/src/__generated__/resources/K8SHelmChartV1.json

@@ -0,0 +1,284 @@
+{
+  "description": "HelmChart is the Schema for the helmcharts API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmChartSpec specifies the desired state of a Helm chart.",
+      "properties": {
+        "chart": {
+          "description": "Chart is the name or path the Helm chart is available at in the\nSourceRef.",
+          "type": "string"
+        },
+        "ignoreMissingValuesFiles": {
+          "description": "IgnoreMissingValuesFiles controls whether to silently ignore missing values\nfiles rather than failing.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the HelmChart SourceRef is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "reconcileStrategy": {
+          "_default": "ChartVersion",
+          "description": "ReconcileStrategy determines what enables the creation of a new artifact.\nValid values are ('ChartVersion', 'Revision').\nSee the documentation of the values for an explanation on their behavior.\nDefaults to ChartVersion when omitted.",
+          "_enum": [
+            "ChartVersion",
+            "Revision"
+          ],
+          "type": "string"
+        },
+        "sourceRef": {
+          "description": "SourceRef is the reference to the Source the chart is available at.",
+          "properties": {
+            "apiVersion": {
+              "description": "APIVersion of the referent.",
+              "type": "string"
+            },
+            "kind": {
+              "description": "Kind of the referent, valid values are ('HelmRepository', 'GitRepository',\n'Bucket').",
+              "_enum": [
+                "HelmRepository",
+                "GitRepository",
+                "Bucket"
+              ],
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nsource.",
+          "type": "boolean"
+        },
+        "valuesFiles": {
+          "description": "ValuesFiles is an alternative list of values files to use as the chart\nvalues (values.yaml is not included by default), expected to be a\nrelative path in the SourceRef.\nValues files are merged in the order of this list with the last file\noverriding the first. Ignored when omitted.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "verify": {
+          "description": "Verify contains the secret name containing the trusted public keys\nused to verify the signature and specifies which provider to use to check\nwhether OCI image is authentic.\nThis field is only supported when using HelmRepository source with spec.type 'oci'.\nChart dependencies, which are not bundled in the umbrella chart artifact, are not verified.",
+          "properties": {
+            "matchOIDCIdentity": {
+              "description": "MatchOIDCIdentity specifies the identity matching criteria to use\nwhile verifying an OCI artifact which was signed using Cosign keyless\nsigning. The artifact's identity is deemed to be verified if any of the\nspecified matchers match against the identity.",
+              "items": {
+                "description": "OIDCIdentityMatch specifies options for verifying the certificate identity,\ni.e. the issuer and the subject of the certificate.",
+                "type": "object",
+                "required": [
+                  "issuer",
+                  "subject"
+                ],
+                "properties": {
+                  "issuer": {
+                    "description": "Issuer specifies the regex pattern to match against to verify\nthe OIDC issuer in the Fulcio certificate. The pattern must be a\nvalid Go regular expression.",
+                    "type": "string"
+                  },
+                  "subject": {
+                    "description": "Subject specifies the regex pattern to match against to verify\nthe identity subject in the Fulcio certificate. The pattern must\nbe a valid Go regular expression.",
+                    "type": "string"
+                  }
+                }
+              },
+              "type": "array"
+            },
+            "provider": {
+              "_default": "cosign",
+              "description": "Provider specifies the technology used to sign the OCI Artifact.",
+              "_enum": [
+                "cosign",
+                "notation"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Kubernetes Secret containing the\ntrusted public keys.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "provider"
+          ],
+          "type": "object"
+        },
+        "version": {
+          "_default": "*",
+          "description": "Version is the chart version semver expression, ignored for charts from\nGitRepository and Bucket sources. Defaults to latest when omitted.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "chart",
+        "interval",
+        "sourceRef"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmChartStatus records the observed state of the HelmChart.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the HelmChart.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedChartName": {
+          "description": "ObservedChartName is the last observed chart name as specified by the\nresolved chart reference.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the HelmChart\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedSourceArtifactRevision": {
+          "description": "ObservedSourceArtifactRevision is the last observed Artifact.Revision\nof the HelmChartSpec.SourceRef.",
+          "type": "string"
+        },
+        "observedValuesFiles": {
+          "description": "ObservedValuesFiles are the observed value files of the last successful\nreconciliation.\nIt matches the chart in the last successfully reconciled artifact.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SHelmChartV1.ts

@@ -0,0 +1,251 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmChart is the Schema for the helmcharts API.
+ */
+export interface K8SHelmChartV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmChartSpec specifies the desired state of a Helm chart.
+   */
+  spec?: {
+    /**
+     * Chart is the name or path the Helm chart is available at in the
+     * SourceRef.
+     */
+    chart: string;
+    /**
+     * IgnoreMissingValuesFiles controls whether to silently ignore missing values
+     * files rather than failing.
+     */
+    ignoreMissingValuesFiles?: boolean;
+    /**
+     * Interval at which the HelmChart SourceRef is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * ReconcileStrategy determines what enables the creation of a new artifact.
+     * Valid values are ('ChartVersion', 'Revision').
+     * See the documentation of the values for an explanation on their behavior.
+     * Defaults to ChartVersion when omitted.
+     */
+    reconcileStrategy?: string;
+    /**
+     * SourceRef is the reference to the Source the chart is available at.
+     */
+    sourceRef: {
+      /**
+       * APIVersion of the referent.
+       */
+      apiVersion?: string;
+      /**
+       * Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
+       * 'Bucket').
+       */
+      kind: string;
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * source.
+     */
+    suspend?: boolean;
+    /**
+     * ValuesFiles is an alternative list of values files to use as the chart
+     * values (values.yaml is not included by default), expected to be a
+     * relative path in the SourceRef.
+     * Values files are merged in the order of this list with the last file
+     * overriding the first. Ignored when omitted.
+     */
+    valuesFiles?: string[];
+    /**
+     * Verify contains the secret name containing the trusted public keys
+     * used to verify the signature and specifies which provider to use to check
+     * whether OCI image is authentic.
+     * This field is only supported when using HelmRepository source with spec.type 'oci'.
+     * Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
+     */
+    verify?: {
+      /**
+       * MatchOIDCIdentity specifies the identity matching criteria to use
+       * while verifying an OCI artifact which was signed using Cosign keyless
+       * signing. The artifact's identity is deemed to be verified if any of the
+       * specified matchers match against the identity.
+       */
+      matchOIDCIdentity?: {
+        /**
+         * Issuer specifies the regex pattern to match against to verify
+         * the OIDC issuer in the Fulcio certificate. The pattern must be a
+         * valid Go regular expression.
+         */
+        issuer: string;
+        /**
+         * Subject specifies the regex pattern to match against to verify
+         * the identity subject in the Fulcio certificate. The pattern must
+         * be a valid Go regular expression.
+         */
+        subject: string;
+      }[];
+      /**
+       * Provider specifies the technology used to sign the OCI Artifact.
+       */
+      provider: string;
+      /**
+       * SecretRef specifies the Kubernetes Secret containing the
+       * trusted public keys.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+    /**
+     * Version is the chart version semver expression, ignored for charts from
+     * GitRepository and Bucket sources. Defaults to latest when omitted.
+     */
+    version?: string;
+  };
+  /**
+   * HelmChartStatus records the observed state of the HelmChart.
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the HelmChart.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedChartName is the last observed chart name as specified by the
+     * resolved chart reference.
+     */
+    observedChartName?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the HelmChart
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedSourceArtifactRevision is the last observed Artifact.Revision
+     * of the HelmChartSpec.SourceRef.
+     */
+    observedSourceArtifactRevision?: string;
+    /**
+     * ObservedValuesFiles are the observed value files of the last successful
+     * reconciliation.
+     * It matches the chart in the last successfully reconciled artifact.
+     */
+    observedValuesFiles?: string[];
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * BucketStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SHelmChartV1beta1.json

@@ -0,0 +1,227 @@
+{
+  "description": "HelmChart is the Schema for the helmcharts API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmChartSpec defines the desired state of a Helm chart.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom defines an Access Control List for allowing cross-namespace references to this object.",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "chart": {
+          "description": "The name or path the Helm chart is available at in the SourceRef.",
+          "type": "string"
+        },
+        "interval": {
+          "description": "The interval at which to check the Source for updates.",
+          "type": "string"
+        },
+        "reconcileStrategy": {
+          "_default": "ChartVersion",
+          "description": "Determines what enables the creation of a new artifact. Valid values are\n('ChartVersion', 'Revision').\nSee the documentation of the values for an explanation on their behavior.\nDefaults to ChartVersion when omitted.",
+          "_enum": [
+            "ChartVersion",
+            "Revision"
+          ],
+          "type": "string"
+        },
+        "sourceRef": {
+          "description": "The reference to the Source the chart is available at.",
+          "properties": {
+            "apiVersion": {
+              "description": "APIVersion of the referent.",
+              "type": "string"
+            },
+            "kind": {
+              "description": "Kind of the referent, valid values are ('HelmRepository', 'GitRepository',\n'Bucket').",
+              "_enum": [
+                "HelmRepository",
+                "GitRepository",
+                "Bucket"
+              ],
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "valuesFile": {
+          "description": "Alternative values file to use as the default chart values, expected to\nbe a relative path in the SourceRef. Deprecated in favor of ValuesFiles,\nfor backwards compatibility the file defined here is merged before the\nValuesFiles items. Ignored when omitted.",
+          "type": "string"
+        },
+        "valuesFiles": {
+          "description": "Alternative list of values files to use as the chart values (values.yaml\nis not included by default), expected to be a relative path in the SourceRef.\nValues files are merged in the order of this list with the last file overriding\nthe first. Ignored when omitted.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "version": {
+          "_default": "*",
+          "description": "The chart version semver expression, ignored for charts from GitRepository\nand Bucket sources. Defaults to latest when omitted.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "chart",
+        "interval",
+        "sourceRef"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmChartStatus defines the observed state of the HelmChart.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful chart sync.",
+          "properties": {
+            "checksum": {
+              "description": "Checksum is the SHA256 checksum of the artifact.",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "path": {
+              "description": "Path is the relative file path of this artifact.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+              "type": "string"
+            },
+            "url": {
+              "description": "URL is the HTTP address of this artifact.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the HelmChart.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the download link for the last chart pulled.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

images/operator/src/__generated__/resources/K8SHelmChartV1beta1.ts

@@ -0,0 +1,192 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmChart is the Schema for the helmcharts API
+ */
+export interface K8SHelmChartV1Beta1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmChartSpec defines the desired state of a Helm chart.
+   */
+  spec?: {
+    /**
+     * AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * The name or path the Helm chart is available at in the SourceRef.
+     */
+    chart: string;
+    /**
+     * The interval at which to check the Source for updates.
+     */
+    interval: string;
+    /**
+     * Determines what enables the creation of a new artifact. Valid values are
+     * ('ChartVersion', 'Revision').
+     * See the documentation of the values for an explanation on their behavior.
+     * Defaults to ChartVersion when omitted.
+     */
+    reconcileStrategy?: string;
+    /**
+     * The reference to the Source the chart is available at.
+     */
+    sourceRef: {
+      /**
+       * APIVersion of the referent.
+       */
+      apiVersion?: string;
+      /**
+       * Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
+       * 'Bucket').
+       */
+      kind: string;
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * Alternative values file to use as the default chart values, expected to
+     * be a relative path in the SourceRef. Deprecated in favor of ValuesFiles,
+     * for backwards compatibility the file defined here is merged before the
+     * ValuesFiles items. Ignored when omitted.
+     */
+    valuesFile?: string;
+    /**
+     * Alternative list of values files to use as the chart values (values.yaml
+     * is not included by default), expected to be a relative path in the SourceRef.
+     * Values files are merged in the order of this list with the last file overriding
+     * the first. Ignored when omitted.
+     */
+    valuesFiles?: string[];
+    /**
+     * The chart version semver expression, ignored for charts from GitRepository
+     * and Bucket sources. Defaults to latest when omitted.
+     */
+    version?: string;
+  };
+  /**
+   * HelmChartStatus defines the observed state of the HelmChart.
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful chart sync.
+     */
+    artifact?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the HelmChart.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the download link for the last chart pulled.
+     */
+    url?: string;
+  };
+}

images/operator/src/__generated__/resources/K8SHelmChartV1beta2.json

@@ -0,0 +1,314 @@
+{
+  "description": "HelmChart is the Schema for the helmcharts API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmChartSpec specifies the desired state of a Helm chart.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom specifies an Access Control List for allowing cross-namespace\nreferences to this object.\nNOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "chart": {
+          "description": "Chart is the name or path the Helm chart is available at in the\nSourceRef.",
+          "type": "string"
+        },
+        "ignoreMissingValuesFiles": {
+          "description": "IgnoreMissingValuesFiles controls whether to silently ignore missing values\nfiles rather than failing.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the HelmChart SourceRef is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "reconcileStrategy": {
+          "_default": "ChartVersion",
+          "description": "ReconcileStrategy determines what enables the creation of a new artifact.\nValid values are ('ChartVersion', 'Revision').\nSee the documentation of the values for an explanation on their behavior.\nDefaults to ChartVersion when omitted.",
+          "_enum": [
+            "ChartVersion",
+            "Revision"
+          ],
+          "type": "string"
+        },
+        "sourceRef": {
+          "description": "SourceRef is the reference to the Source the chart is available at.",
+          "properties": {
+            "apiVersion": {
+              "description": "APIVersion of the referent.",
+              "type": "string"
+            },
+            "kind": {
+              "description": "Kind of the referent, valid values are ('HelmRepository', 'GitRepository',\n'Bucket').",
+              "_enum": [
+                "HelmRepository",
+                "GitRepository",
+                "Bucket"
+              ],
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nsource.",
+          "type": "boolean"
+        },
+        "valuesFile": {
+          "description": "ValuesFile is an alternative values file to use as the default chart\nvalues, expected to be a relative path in the SourceRef. Deprecated in\nfavor of ValuesFiles, for backwards compatibility the file specified here\nis merged before the ValuesFiles items. Ignored when omitted.",
+          "type": "string"
+        },
+        "valuesFiles": {
+          "description": "ValuesFiles is an alternative list of values files to use as the chart\nvalues (values.yaml is not included by default), expected to be a\nrelative path in the SourceRef.\nValues files are merged in the order of this list with the last file\noverriding the first. Ignored when omitted.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "verify": {
+          "description": "Verify contains the secret name containing the trusted public keys\nused to verify the signature and specifies which provider to use to check\nwhether OCI image is authentic.\nThis field is only supported when using HelmRepository source with spec.type 'oci'.\nChart dependencies, which are not bundled in the umbrella chart artifact, are not verified.",
+          "properties": {
+            "matchOIDCIdentity": {
+              "description": "MatchOIDCIdentity specifies the identity matching criteria to use\nwhile verifying an OCI artifact which was signed using Cosign keyless\nsigning. The artifact's identity is deemed to be verified if any of the\nspecified matchers match against the identity.",
+              "items": {
+                "description": "OIDCIdentityMatch specifies options for verifying the certificate identity,\ni.e. the issuer and the subject of the certificate.",
+                "type": "object",
+                "required": [
+                  "issuer",
+                  "subject"
+                ],
+                "properties": {
+                  "issuer": {
+                    "description": "Issuer specifies the regex pattern to match against to verify\nthe OIDC issuer in the Fulcio certificate. The pattern must be a\nvalid Go regular expression.",
+                    "type": "string"
+                  },
+                  "subject": {
+                    "description": "Subject specifies the regex pattern to match against to verify\nthe identity subject in the Fulcio certificate. The pattern must\nbe a valid Go regular expression.",
+                    "type": "string"
+                  }
+                }
+              },
+              "type": "array"
+            },
+            "provider": {
+              "_default": "cosign",
+              "description": "Provider specifies the technology used to sign the OCI Artifact.",
+              "_enum": [
+                "cosign",
+                "notation"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Kubernetes Secret containing the\ntrusted public keys.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "provider"
+          ],
+          "type": "object"
+        },
+        "version": {
+          "_default": "*",
+          "description": "Version is the chart version semver expression, ignored for charts from\nGitRepository and Bucket sources. Defaults to latest when omitted.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "chart",
+        "interval",
+        "sourceRef"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmChartStatus records the observed state of the HelmChart.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the HelmChart.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedChartName": {
+          "description": "ObservedChartName is the last observed chart name as specified by the\nresolved chart reference.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the HelmChart\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedSourceArtifactRevision": {
+          "description": "ObservedSourceArtifactRevision is the last observed Artifact.Revision\nof the HelmChartSpec.SourceRef.",
+          "type": "string"
+        },
+        "observedValuesFiles": {
+          "description": "ObservedValuesFiles are the observed value files of the last successful\nreconciliation.\nIt matches the chart in the last successfully reconciled artifact.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}