v1

type Certificate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CertificateSpec   `json:"spec,omitempty"`
	Status CertificateStatus `json:"status,omitempty"`
}

type CertificateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Certificate `json:"items"`
}

type CertificateSpec struct {
	// Requested set of X509 certificate subject attributes.
	// More info: https://pkgo.dev/crypto/x509/pkix#Name
	//
	// Name represents an X.509 distinguished name.
	// Note that Name is only an approximation of the X.509 structure.
	Subject *X509PkixSubject `json:"subject,omitempty"`

	// Requested DNS subject alternative names.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	DNSName string `json:"dnsName,omitempty"`

	// Requested email subject alternative names.
	// +optional
	EmailAddresses []string `json:"emailAddresses,omitempty"`

	// Requested 'validity' (i.e. lifetime) of the Certificate.
	//
	// If unset, this defaults to 360 days.
	// Minimum accepted duration is 1 hour.
	// +kubebuilder:validation:Pattern=`^\d+[hdy]$`
	// +kubebuilder:validation:Required
	Validity string `json:"validity,omitempty"`

	// How long before the currently issued certificate's expiry cert-manager should
	// renew the certificate. For example, if a certificate is valid for 60 minutes,
	// and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
	// 50 minutes after it was issued (i.e. when there are 10 minutes remaining until
	// the certificate is no longer valid).
	//
	// NOTE: The actual lifetime of the issued certificate is used to determine the
	// renewal time. If an issuer returns a certificate with a different lifetime than
	// the one requested, cert-manager will use the lifetime of the issued certificate.
	//
	// If unset, this defaults to 1/3 of the issued certificate's lifetime.
	// Minimum accepted value is 5 minutes.
	// Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
	// Cannot be set if the `renewBeforePercentage` field is set.
	// +kubebuilder:validation:Pattern=`^\d+[mh]$`
	// +optional
	RenewBefore string `json:"renewBefore,omitempty"`

	// Name of the Secret resource that will be automatically created and
	// managed by this Certificate resource. It will be populated with a
	// private key and certificate, signed by the denoted issuer. The Secret
	// resource lives in the same namespace as the Certificate resource.
	// +kubebuilder:validation:Required
	SecretRef SecretRef `json:"secretRef"`
}

type CertificateStatus struct {
	ExpiryDate         metav1.Time `json:"expiryDate,omitempty"`
	RenewedAt          metav1.Time `json:"renewedAt,omitempty"`
	ObservedGeneration int64       `json:"observedGeneration,omitempty"`
	SecretRef          string      `json:"secretRef,omitempty"`
}

type SecretRef struct {
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name,omitempty"`
}

type X509PkixSubject struct {
	// Country to be used on the Certificate.
	// +optional
	Country []string `json:"country,omitempty"`
	// Organization to be used on the Certificate.
	// +optional
	Organization []string `json:"organization,omitempty"`
	// Organizational Unit to be used on the Certificate.
	// +optional
	OrganizationalUnit []string `json:"organizationalUnit,omitempty"`
	// Common Name to be used on the Certificate
	// +optional
	CommonName string `json:"commonName,omitempty"`
	// Serial number to be used on the Certificate.
	// +optional
	SerialNumber string `json:"serialNumber,omitempty"`
}