kcr_external_secrets_io 3.20260124.94613

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --docs --derive=Default --derive=PartialEq --smart-derive-elision --filename crd-catalog/external-secrets/external-secrets/external-secrets.io/v1alpha1/clustersecretstores.yaml
// kopium version: 0.22.5

#[allow(unused_imports)]
mod prelude {
    pub use kube::CustomResource;
    pub use serde::{Serialize, Deserialize};
    pub use std::collections::BTreeMap;
    pub use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
}
use self::prelude::*;

/// SecretStoreSpec defines the desired state of SecretStore.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[kube(group = "external-secrets.io", version = "v1alpha1", kind = "ClusterSecretStore", plural = "clustersecretstores")]
#[kube(status = "ClusterSecretStoreStatus")]
#[kube(schema = "disabled")]
#[kube(derive="Default")]
#[kube(derive="PartialEq")]
pub struct ClusterSecretStoreSpec {
    /// Used to select the correct ESO controller (think: ingress.ingressClassName)
    /// The ESO controller is instantiated with a specific controller name and filters ES based on this property
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub controller: Option<String>,
    /// Used to configure the provider. Only one provider may be set
    pub provider: ClusterSecretStoreProvider,
    /// Used to configure http retries if failed
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "retrySettings")]
    pub retry_settings: Option<ClusterSecretStoreRetrySettings>,
}

/// Used to configure the provider. Only one provider may be set
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProvider {
    /// Akeyless configures this store to sync secrets using Akeyless Vault provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub akeyless: Option<ClusterSecretStoreProviderAkeyless>,
    /// Alibaba configures this store to sync secrets using Alibaba Cloud provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub alibaba: Option<ClusterSecretStoreProviderAlibaba>,
    /// AWS configures this store to sync secrets using AWS Secret Manager provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<ClusterSecretStoreProviderAws>,
    /// AzureKV configures this store to sync secrets using Azure Key Vault provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub azurekv: Option<ClusterSecretStoreProviderAzurekv>,
    /// Fake configures a store with static key/value pairs
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fake: Option<ClusterSecretStoreProviderFake>,
    /// GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub gcpsm: Option<ClusterSecretStoreProviderGcpsm>,
    /// GitLab configures this store to sync secrets using GitLab Variables provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub gitlab: Option<ClusterSecretStoreProviderGitlab>,
    /// IBM configures this store to sync secrets using IBM Cloud provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ibm: Option<ClusterSecretStoreProviderIbm>,
    /// Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kubernetes: Option<ClusterSecretStoreProviderKubernetes>,
    /// Oracle configures this store to sync secrets using Oracle Vault provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub oracle: Option<ClusterSecretStoreProviderOracle>,
    /// Configures a store to sync secrets with a Password Depot instance.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub passworddepot: Option<ClusterSecretStoreProviderPassworddepot>,
    /// Vault configures this store to sync secrets using Hashi provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub vault: Option<ClusterSecretStoreProviderVault>,
    /// Webhook configures this store to sync secrets using a generic templated webhook
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub webhook: Option<ClusterSecretStoreProviderWebhook>,
    /// YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub yandexlockbox: Option<ClusterSecretStoreProviderYandexlockbox>,
}

/// Akeyless configures this store to sync secrets using Akeyless Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeyless {
    /// Akeyless GW API Url from which the secrets to be fetched from.
    #[serde(rename = "akeylessGWApiURL")]
    pub akeyless_gw_api_url: String,
    /// Auth configures how the operator authenticates with Akeyless.
    #[serde(rename = "authSecretRef")]
    pub auth_secret_ref: ClusterSecretStoreProviderAkeylessAuthSecretRef,
    /// PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
    /// if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
    /// are used to validate the TLS connection.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// The provider for the CA bundle to use to validate Akeyless Gateway certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderAkeylessCaProvider>,
}

/// Auth configures how the operator authenticates with Akeyless.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRef {
    /// Kubernetes authenticates with Akeyless by passing the ServiceAccount
    /// token stored in the named Secret resource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "kubernetesAuth")]
    pub kubernetes_auth: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuth>,
    /// Reference to a Secret that contains the details
    /// to authenticate with Akeyless.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRef>,
}

/// Kubernetes authenticates with Akeyless by passing the ServiceAccount
/// token stored in the named Secret resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuth {
    /// the Akeyless Kubernetes auth-method access-id
    #[serde(rename = "accessID")]
    pub access_id: String,
    /// Kubernetes-auth configuration name in Akeyless-Gateway
    #[serde(rename = "k8sConfName")]
    pub k8s_conf_name: String,
    /// Optional secret field containing a Kubernetes ServiceAccount JWT used
    /// for authenticating with Akeyless. If a name is specified without a key,
    /// `token` is the default. If one is not specified, the one bound to
    /// the controller will be used.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuthSecretRef>,
    /// Optional service account field containing the name of a kubernetes ServiceAccount.
    /// If the service account is specified, the service account secret token JWT will be used
    /// for authenticating with Akeyless. If the service account selector is not supplied,
    /// the secretRef will be used instead.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef>,
}

/// Optional secret field containing a Kubernetes ServiceAccount JWT used
/// for authenticating with Akeyless. If a name is specified without a key,
/// `token` is the default. If one is not specified, the one bound to
/// the controller will be used.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuthSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Optional service account field containing the name of a kubernetes ServiceAccount.
/// If the service account is specified, the service account secret token JWT will be used
/// for authenticating with Akeyless. If the service account selector is not supplied,
/// the secretRef will be used instead.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Reference to a Secret that contains the details
/// to authenticate with Akeyless.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRef {
    /// The SecretAccessID is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessID")]
    pub access_id: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessId>,
    /// A reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessType")]
    pub access_type: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessType>,
    /// A reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessTypeParam")]
    pub access_type_param: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessTypeParam>,
}

/// The SecretAccessID is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// A reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessType {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// A reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessTypeParam {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The provider for the CA bundle to use to validate Akeyless Gateway certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderAkeylessCaProviderType,
}

/// The provider for the CA bundle to use to validate Akeyless Gateway certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderAkeylessCaProviderType {
    Secret,
    ConfigMap,
}

/// Alibaba configures this store to sync secrets using Alibaba Cloud provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibaba {
    /// AlibabaAuth contains a secretRef for credentials.
    pub auth: ClusterSecretStoreProviderAlibabaAuth,
    /// Alibaba Region to be used for the provider
    #[serde(rename = "regionID")]
    pub region_id: String,
}

/// AlibabaAuth contains a secretRef for credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuth {
    /// Authenticate against Alibaba using RRSA.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub rrsa: Option<ClusterSecretStoreProviderAlibabaAuthRrsa>,
    /// AlibabaAuthSecretRef holds secret references for Alibaba credentials.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderAlibabaAuthSecretRef>,
}

/// Authenticate against Alibaba using RRSA.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuthRrsa {
    #[serde(rename = "oidcProviderArn")]
    pub oidc_provider_arn: String,
    #[serde(rename = "oidcTokenFilePath")]
    pub oidc_token_file_path: String,
    #[serde(rename = "roleArn")]
    pub role_arn: String,
    #[serde(rename = "sessionName")]
    pub session_name: String,
}

/// AlibabaAuthSecretRef holds secret references for Alibaba credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuthSecretRef {
    /// The AccessKeyID is used for authentication
    #[serde(rename = "accessKeyIDSecretRef")]
    pub access_key_id_secret_ref: ClusterSecretStoreProviderAlibabaAuthSecretRefAccessKeyIdSecretRef,
    /// The AccessKeySecret is used for authentication
    #[serde(rename = "accessKeySecretSecretRef")]
    pub access_key_secret_secret_ref: ClusterSecretStoreProviderAlibabaAuthSecretRefAccessKeySecretSecretRef,
}

/// The AccessKeyID is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuthSecretRefAccessKeyIdSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The AccessKeySecret is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuthSecretRefAccessKeySecretSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AWS configures this store to sync secrets using AWS Secret Manager provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderAws {
    /// Auth defines the information necessary to authenticate against AWS
    /// if not set aws sdk will infer credentials from your environment
    /// see: <https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderAwsAuth>,
    /// AWS Region to be used for the provider
    pub region: String,
    /// Role is a Role ARN which the SecretManager provider will assume
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Service defines which service should be used to fetch the secrets
    pub service: ClusterSecretStoreProviderAwsService,
}

/// Auth defines the information necessary to authenticate against AWS
/// if not set aws sdk will infer credentials from your environment
/// see: <https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuth {
    /// Authenticate against AWS using service account tokens.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub jwt: Option<ClusterSecretStoreProviderAwsAuthJwt>,
    /// AWSAuthSecretRef holds secret references for AWS credentials
    /// both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderAwsAuthSecretRef>,
}

/// Authenticate against AWS using service account tokens.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthJwt {
    /// A reference to a ServiceAccount resource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderAwsAuthJwtServiceAccountRef>,
}

/// A reference to a ServiceAccount resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthJwtServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AWSAuthSecretRef holds secret references for AWS credentials
/// both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthSecretRef {
    /// The AccessKeyID is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessKeyIDSecretRef")]
    pub access_key_id_secret_ref: Option<ClusterSecretStoreProviderAwsAuthSecretRefAccessKeyIdSecretRef>,
    /// The SecretAccessKey is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretAccessKeySecretRef")]
    pub secret_access_key_secret_ref: Option<ClusterSecretStoreProviderAwsAuthSecretRefSecretAccessKeySecretRef>,
}

/// The AccessKeyID is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthSecretRefAccessKeyIdSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The SecretAccessKey is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthSecretRefSecretAccessKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AWS configures this store to sync secrets using AWS Secret Manager provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderAwsService {
    SecretsManager,
    ParameterStore,
}

/// AzureKV configures this store to sync secrets using Azure Key Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekv {
    /// Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authSecretRef")]
    pub auth_secret_ref: Option<ClusterSecretStoreProviderAzurekvAuthSecretRef>,
    /// Auth type defines how to authenticate to the keyvault service.
    /// Valid values are:
    /// - "ServicePrincipal" (default): Using a service principal (tenantId, clientId, clientSecret)
    /// - "ManagedIdentity": Using Managed Identity assigned to the pod (see aad-pod-identity)
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authType")]
    pub auth_type: Option<ClusterSecretStoreProviderAzurekvAuthType>,
    /// If multiple Managed Identity is assigned to the pod, you can select the one to be used
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "identityId")]
    pub identity_id: Option<String>,
    /// ServiceAccountRef specified the service account
    /// that should be used when authenticating with WorkloadIdentity.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderAzurekvServiceAccountRef>,
    /// TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tenantId")]
    pub tenant_id: Option<String>,
    /// Vault Url from which the secrets to be fetched from.
    #[serde(rename = "vaultUrl")]
    pub vault_url: String,
}

/// Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvAuthSecretRef {
    /// The Azure clientId of the service principle used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientId")]
    pub client_id: Option<ClusterSecretStoreProviderAzurekvAuthSecretRefClientId>,
    /// The Azure ClientSecret of the service principle used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientSecret")]
    pub client_secret: Option<ClusterSecretStoreProviderAzurekvAuthSecretRefClientSecret>,
}

/// The Azure clientId of the service principle used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvAuthSecretRefClientId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The Azure ClientSecret of the service principle used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvAuthSecretRefClientSecret {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AzureKV configures this store to sync secrets using Azure Key Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderAzurekvAuthType {
    ServicePrincipal,
    ManagedIdentity,
    WorkloadIdentity,
}

/// ServiceAccountRef specified the service account
/// that should be used when authenticating with WorkloadIdentity.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Fake configures a store with static key/value pairs
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderFake {
    pub data: Vec<ClusterSecretStoreProviderFakeData>,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderFakeData {
    pub key: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "valueMap")]
    pub value_map: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
}

/// GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsm {
    /// Auth defines the information necessary to authenticate against GCP
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderGcpsmAuth>,
    /// ProjectID project where secret is located
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "projectID")]
    pub project_id: Option<String>,
}

/// Auth defines the information necessary to authenticate against GCP
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuth {
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderGcpsmAuthSecretRef>,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "workloadIdentity")]
    pub workload_identity: Option<ClusterSecretStoreProviderGcpsmAuthWorkloadIdentity>,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthSecretRef {
    /// The SecretAccessKey is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretAccessKeySecretRef")]
    pub secret_access_key_secret_ref: Option<ClusterSecretStoreProviderGcpsmAuthSecretRefSecretAccessKeySecretRef>,
}

/// The SecretAccessKey is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthSecretRefSecretAccessKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentity {
    #[serde(rename = "clusterLocation")]
    pub cluster_location: String,
    #[serde(rename = "clusterName")]
    pub cluster_name: String,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clusterProjectID")]
    pub cluster_project_id: Option<String>,
    /// A reference to a ServiceAccount resource.
    #[serde(rename = "serviceAccountRef")]
    pub service_account_ref: ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityServiceAccountRef,
}

/// A reference to a ServiceAccount resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// GitLab configures this store to sync secrets using GitLab Variables provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGitlab {
    /// Auth configures how secret-manager authenticates with a GitLab instance.
    pub auth: ClusterSecretStoreProviderGitlabAuth,
    /// ProjectID specifies a project where secrets are located.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "projectID")]
    pub project_id: Option<String>,
    /// URL configures the GitLab instance URL. Defaults to <https://gitlab.com/.>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// Auth configures how secret-manager authenticates with a GitLab instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGitlabAuth {
    #[serde(rename = "SecretRef")]
    pub secret_ref: ClusterSecretStoreProviderGitlabAuthSecretRef,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGitlabAuthSecretRef {
    /// AccessToken is used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessToken")]
    pub access_token: Option<ClusterSecretStoreProviderGitlabAuthSecretRefAccessToken>,
}

/// AccessToken is used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGitlabAuthSecretRefAccessToken {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// IBM configures this store to sync secrets using IBM Cloud provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbm {
    /// Auth configures how secret-manager authenticates with the IBM secrets manager.
    pub auth: ClusterSecretStoreProviderIbmAuth,
    /// ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceUrl")]
    pub service_url: Option<String>,
}

/// Auth configures how secret-manager authenticates with the IBM secrets manager.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbmAuth {
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderIbmAuthSecretRef,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbmAuthSecretRef {
    /// The SecretAccessKey is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretApiKeySecretRef")]
    pub secret_api_key_secret_ref: Option<ClusterSecretStoreProviderIbmAuthSecretRefSecretApiKeySecretRef>,
}

/// The SecretAccessKey is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbmAuthSecretRefSecretApiKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetes {
    /// Auth configures how secret-manager authenticates with a Kubernetes instance.
    pub auth: ClusterSecretStoreProviderKubernetesAuth,
    /// Remote namespace to fetch the secrets from
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "remoteNamespace")]
    pub remote_namespace: Option<String>,
    /// configures the Kubernetes server Address.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub server: Option<ClusterSecretStoreProviderKubernetesServer>,
}

/// Auth configures how secret-manager authenticates with a Kubernetes instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuth {
    /// has both clientCert and clientKey as secretKeySelector
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cert: Option<ClusterSecretStoreProviderKubernetesAuthCert>,
    /// points to a service account that should be used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccount")]
    pub service_account: Option<ClusterSecretStoreProviderKubernetesAuthServiceAccount>,
    /// use static token to authenticate with
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub token: Option<ClusterSecretStoreProviderKubernetesAuthToken>,
}

/// has both clientCert and clientKey as secretKeySelector
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthCert {
    /// A reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCert")]
    pub client_cert: Option<ClusterSecretStoreProviderKubernetesAuthCertClientCert>,
    /// A reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientKey")]
    pub client_key: Option<ClusterSecretStoreProviderKubernetesAuthCertClientKey>,
}

/// A reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthCertClientCert {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// A reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthCertClientKey {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// points to a service account that should be used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthServiceAccount {
    /// A reference to a ServiceAccount resource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccount")]
    pub service_account: Option<ClusterSecretStoreProviderKubernetesAuthServiceAccountServiceAccount>,
}

/// A reference to a ServiceAccount resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthServiceAccountServiceAccount {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// use static token to authenticate with
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthToken {
    /// A reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "bearerToken")]
    pub bearer_token: Option<ClusterSecretStoreProviderKubernetesAuthTokenBearerToken>,
}

/// A reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthTokenBearerToken {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// configures the Kubernetes server Address.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesServer {
    /// CABundle is a base64-encoded CA certificate
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// see: <https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderKubernetesServerCaProvider>,
    /// configures the Kubernetes server Address.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// see: <https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesServerCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderKubernetesServerCaProviderType,
}

/// see: <https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderKubernetesServerCaProviderType {
    Secret,
    ConfigMap,
}

/// Oracle configures this store to sync secrets using Oracle Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracle {
    /// Auth configures how secret-manager authenticates with the Oracle Vault.
    /// If empty, instance principal is used. Optionally, the authenticating principal type
    /// and/or user data may be supplied for the use of workload identity and user principal.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderOracleAuth>,
    /// Compartment is the vault compartment OCID.
    /// Required for PushSecret
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub compartment: Option<String>,
    /// EncryptionKey is the OCID of the encryption key within the vault.
    /// Required for PushSecret
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "encryptionKey")]
    pub encryption_key: Option<String>,
    /// The type of principal to use for authentication. If left blank, the Auth struct will
    /// determine the principal type. This optional field must be specified if using
    /// workload identity.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "principalType")]
    pub principal_type: Option<ClusterSecretStoreProviderOraclePrincipalType>,
    /// Region is the region where vault is located.
    pub region: String,
    /// ServiceAccountRef specified the service account
    /// that should be used when authenticating with WorkloadIdentity.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderOracleServiceAccountRef>,
    /// Vault is the vault's OCID of the specific vault where secret is located.
    pub vault: String,
}

/// Auth configures how secret-manager authenticates with the Oracle Vault.
/// If empty, instance principal is used. Optionally, the authenticating principal type
/// and/or user data may be supplied for the use of workload identity and user principal.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleAuth {
    /// SecretRef to pass through sensitive information.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderOracleAuthSecretRef,
    /// Tenancy is the tenancy OCID where user is located.
    pub tenancy: String,
    /// User is an access OCID specific to the account.
    pub user: String,
}

/// SecretRef to pass through sensitive information.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleAuthSecretRef {
    /// Fingerprint is the fingerprint of the API private key.
    pub fingerprint: ClusterSecretStoreProviderOracleAuthSecretRefFingerprint,
    /// PrivateKey is the user's API Signing Key in PEM format, used for authentication.
    pub privatekey: ClusterSecretStoreProviderOracleAuthSecretRefPrivatekey,
}

/// Fingerprint is the fingerprint of the API private key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleAuthSecretRefFingerprint {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PrivateKey is the user's API Signing Key in PEM format, used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleAuthSecretRefPrivatekey {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Oracle configures this store to sync secrets using Oracle Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderOraclePrincipalType {
    #[serde(rename = "")]
    KopiumEmpty,
    UserPrincipal,
    InstancePrincipal,
    Workload,
}

/// ServiceAccountRef specified the service account
/// that should be used when authenticating with WorkloadIdentity.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Configures a store to sync secrets with a Password Depot instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassworddepot {
    /// Auth configures how secret-manager authenticates with a Password Depot instance.
    pub auth: ClusterSecretStoreProviderPassworddepotAuth,
    /// Database to use as source
    pub database: String,
    /// URL configures the Password Depot instance URL.
    pub host: String,
}

/// Auth configures how secret-manager authenticates with a Password Depot instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassworddepotAuth {
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderPassworddepotAuthSecretRef,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassworddepotAuthSecretRef {
    /// Username / Password is used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub credentials: Option<ClusterSecretStoreProviderPassworddepotAuthSecretRefCredentials>,
}

/// Username / Password is used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassworddepotAuthSecretRefCredentials {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Vault configures this store to sync secrets using Hashi provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVault {
    /// Auth configures how secret-manager authenticates with the Vault server.
    pub auth: ClusterSecretStoreProviderVaultAuth,
    /// PEM encoded CA bundle used to validate Vault server certificate. Only used
    /// if the Server URL is using HTTPS protocol. This parameter is ignored for
    /// plain HTTP protocol connection. If not set the system root certificates
    /// are used to validate the TLS connection.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// The provider for the CA bundle to use to validate Vault server certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderVaultCaProvider>,
    /// ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
    /// leader instead of simply retrying within a loop. This can increase performance if
    /// the option is enabled serverside.
    /// <https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "forwardInconsistent")]
    pub forward_inconsistent: Option<bool>,
    /// Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
    /// Vault environments to support Secure Multi-tenancy. e.g: "ns1".
    /// More about namespaces can be found here <https://www.vaultproject.io/docs/enterprise/namespaces>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// Path is the mount path of the Vault KV backend endpoint, e.g:
    /// "secret". The v2 KV secret engine version specific "/data" path suffix
    /// for fetching secrets from Vault is optional and will be appended
    /// if not present in specified path.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
    /// ReadYourWrites ensures isolated read-after-write semantics by
    /// providing discovered cluster replication states in each request.
    /// More information about eventual consistency in Vault can be found here
    /// <https://www.vaultproject.io/docs/enterprise/consistency>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readYourWrites")]
    pub read_your_writes: Option<bool>,
    /// Server is the connection address for the Vault server, e.g: "<https://vault.example.com:8200".>
    pub server: String,
    /// Version is the Vault KV secret engine version. This can be either "v1" or
    /// "v2". Version defaults to "v2".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<ClusterSecretStoreProviderVaultVersion>,
}

/// Auth configures how secret-manager authenticates with the Vault server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuth {
    /// AppRole authenticates with Vault using the App Role auth mechanism,
    /// with the role and secret stored in a Kubernetes Secret resource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appRole")]
    pub app_role: Option<ClusterSecretStoreProviderVaultAuthAppRole>,
    /// Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
    /// Cert authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cert: Option<ClusterSecretStoreProviderVaultAuthCert>,
    /// Jwt authenticates with Vault by passing role and JWT token using the
    /// JWT/OIDC authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub jwt: Option<ClusterSecretStoreProviderVaultAuthJwt>,
    /// Kubernetes authenticates with Vault by passing the ServiceAccount
    /// token stored in the named Secret resource to the Vault server.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kubernetes: Option<ClusterSecretStoreProviderVaultAuthKubernetes>,
    /// Ldap authenticates with Vault by passing username/password pair using
    /// the LDAP authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ldap: Option<ClusterSecretStoreProviderVaultAuthLdap>,
    /// TokenSecretRef authenticates with Vault by presenting a token.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tokenSecretRef")]
    pub token_secret_ref: Option<ClusterSecretStoreProviderVaultAuthTokenSecretRef>,
}

/// AppRole authenticates with Vault using the App Role auth mechanism,
/// with the role and secret stored in a Kubernetes Secret resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthAppRole {
    /// Path where the App Role authentication backend is mounted
    /// in Vault, e.g: "approle"
    pub path: String,
    /// RoleID configured in the App Role authentication backend when setting
    /// up the authentication backend in Vault.
    #[serde(rename = "roleId")]
    pub role_id: String,
    /// Reference to a key in a Secret that contains the App Role secret used
    /// to authenticate with Vault.
    /// The `key` field must be specified and denotes which entry within the Secret
    /// resource is used as the app role secret.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderVaultAuthAppRoleSecretRef,
}

/// Reference to a key in a Secret that contains the App Role secret used
/// to authenticate with Vault.
/// The `key` field must be specified and denotes which entry within the Secret
/// resource is used as the app role secret.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthAppRoleSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
/// Cert authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthCert {
    /// ClientCert is a certificate to authenticate using the Cert Vault
    /// authentication method
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCert")]
    pub client_cert: Option<ClusterSecretStoreProviderVaultAuthCertClientCert>,
    /// SecretRef to a key in a Secret resource containing client private key to
    /// authenticate with Vault using the Cert authentication method
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthCertSecretRef>,
}

/// ClientCert is a certificate to authenticate using the Cert Vault
/// authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthCertClientCert {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretRef to a key in a Secret resource containing client private key to
/// authenticate with Vault using the Cert authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthCertSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Jwt authenticates with Vault by passing role and JWT token using the
/// JWT/OIDC authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthJwt {
    /// Optional ServiceAccountToken specifies the Kubernetes service account for which to request
    /// a token for with the `TokenRequest` API.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "kubernetesServiceAccountToken")]
    pub kubernetes_service_account_token: Option<ClusterSecretStoreProviderVaultAuthJwtKubernetesServiceAccountToken>,
    /// Path where the JWT authentication backend is mounted
    /// in Vault, e.g: "jwt"
    pub path: String,
    /// Role is a JWT role to authenticate using the JWT/OIDC Vault
    /// authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Optional SecretRef that refers to a key in a Secret resource containing JWT token to
    /// authenticate with Vault using the JWT/OIDC authentication method.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthJwtSecretRef>,
}

/// Optional ServiceAccountToken specifies the Kubernetes service account for which to request
/// a token for with the `TokenRequest` API.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthJwtKubernetesServiceAccountToken {
    /// Optional audiences field that will be used to request a temporary Kubernetes service
    /// account token for the service account referenced by `serviceAccountRef`.
    /// Defaults to a single audience `vault` it not specified.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// Optional expiration time in seconds that will be used to request a temporary
    /// Kubernetes service account token for the service account referenced by
    /// `serviceAccountRef`.
    /// Defaults to 10 minutes.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "expirationSeconds")]
    pub expiration_seconds: Option<i64>,
    /// Service account field containing the name of a kubernetes ServiceAccount.
    #[serde(rename = "serviceAccountRef")]
    pub service_account_ref: ClusterSecretStoreProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef,
}

/// Service account field containing the name of a kubernetes ServiceAccount.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Optional SecretRef that refers to a key in a Secret resource containing JWT token to
/// authenticate with Vault using the JWT/OIDC authentication method.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthJwtSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Kubernetes authenticates with Vault by passing the ServiceAccount
/// token stored in the named Secret resource to the Vault server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthKubernetes {
    /// Path where the Kubernetes authentication backend is mounted in Vault, e.g:
    /// "kubernetes"
    #[serde(rename = "mountPath")]
    pub mount_path: String,
    /// A required field containing the Vault Role to assume. A Role binds a
    /// Kubernetes ServiceAccount with a set of Vault policies.
    pub role: String,
    /// Optional secret field containing a Kubernetes ServiceAccount JWT used
    /// for authenticating with Vault. If a name is specified without a key,
    /// `token` is the default. If one is not specified, the one bound to
    /// the controller will be used.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthKubernetesSecretRef>,
    /// Optional service account field containing the name of a kubernetes ServiceAccount.
    /// If the service account is specified, the service account secret token JWT will be used
    /// for authenticating with Vault. If the service account selector is not supplied,
    /// the secretRef will be used instead.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderVaultAuthKubernetesServiceAccountRef>,
}

/// Optional secret field containing a Kubernetes ServiceAccount JWT used
/// for authenticating with Vault. If a name is specified without a key,
/// `token` is the default. If one is not specified, the one bound to
/// the controller will be used.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthKubernetesSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Optional service account field containing the name of a kubernetes ServiceAccount.
/// If the service account is specified, the service account secret token JWT will be used
/// for authenticating with Vault. If the service account selector is not supplied,
/// the secretRef will be used instead.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthKubernetesServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Ldap authenticates with Vault by passing username/password pair using
/// the LDAP authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthLdap {
    /// Path where the LDAP authentication backend is mounted
    /// in Vault, e.g: "ldap"
    pub path: String,
    /// SecretRef to a key in a Secret resource containing password for the LDAP
    /// user used to authenticate with Vault using the LDAP authentication
    /// method
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthLdapSecretRef>,
    /// Username is a LDAP user name used to authenticate using the LDAP Vault
    /// authentication method
    pub username: String,
}

/// SecretRef to a key in a Secret resource containing password for the LDAP
/// user used to authenticate with Vault using the LDAP authentication
/// method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthLdapSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// TokenSecretRef authenticates with Vault by presenting a token.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthTokenSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The provider for the CA bundle to use to validate Vault server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderVaultCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderVaultCaProviderType,
}

/// The provider for the CA bundle to use to validate Vault server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderVaultCaProviderType {
    Secret,
    ConfigMap,
}

/// Vault configures this store to sync secrets using Hashi provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderVaultVersion {
    #[serde(rename = "v1")]
    V1,
    #[serde(rename = "v2")]
    V2,
}

/// Webhook configures this store to sync secrets using a generic templated webhook
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhook {
    /// Body
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub body: Option<String>,
    /// PEM encoded CA bundle used to validate webhook server certificate. Only used
    /// if the Server URL is using HTTPS protocol. This parameter is ignored for
    /// plain HTTP protocol connection. If not set the system root certificates
    /// are used to validate the TLS connection.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// The provider for the CA bundle to use to validate webhook server certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderWebhookCaProvider>,
    /// Headers
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub headers: Option<BTreeMap<String, String>>,
    /// Webhook Method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub method: Option<String>,
    /// Result formatting
    pub result: ClusterSecretStoreProviderWebhookResult,
    /// Secrets to fill in templates
    /// These secrets will be passed to the templating function as key value pairs under the given name
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secrets: Option<Vec<ClusterSecretStoreProviderWebhookSecrets>>,
    /// Timeout
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub timeout: Option<String>,
    /// Webhook url to call
    pub url: String,
}

/// The provider for the CA bundle to use to validate webhook server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderWebhookCaProviderType,
}

/// The provider for the CA bundle to use to validate webhook server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderWebhookCaProviderType {
    Secret,
    ConfigMap,
}

/// Result formatting
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookResult {
    /// Json path of return value
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "jsonPath")]
    pub json_path: Option<String>,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookSecrets {
    /// Name of this secret in templates
    pub name: String,
    /// Secret ref to fill in credentials
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderWebhookSecretsSecretRef,
}

/// Secret ref to fill in credentials
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookSecretsSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockbox {
    /// Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiEndpoint")]
    pub api_endpoint: Option<String>,
    /// Auth defines the information necessary to authenticate against Yandex Lockbox
    pub auth: ClusterSecretStoreProviderYandexlockboxAuth,
    /// The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderYandexlockboxCaProvider>,
}

/// Auth defines the information necessary to authenticate against Yandex Lockbox
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxAuth {
    /// The authorized key used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authorizedKeySecretRef")]
    pub authorized_key_secret_ref: Option<ClusterSecretStoreProviderYandexlockboxAuthAuthorizedKeySecretRef>,
}

/// The authorized key used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxAuthAuthorizedKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxCaProvider {
    /// A reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "certSecretRef")]
    pub cert_secret_ref: Option<ClusterSecretStoreProviderYandexlockboxCaProviderCertSecretRef>,
}

/// A reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxCaProviderCertSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Used to configure http retries if failed
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreRetrySettings {
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "maxRetries")]
    pub max_retries: Option<i32>,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "retryInterval")]
    pub retry_interval: Option<String>,
}

/// SecretStoreStatus defines the observed state of the SecretStore.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreStatus {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
}