kcr_operator_cryostat_io 3.20260112.192212

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --docs --derive=Default --derive=PartialEq --smart-derive-elision --filename crd-catalog/cryostatio/cryostat-operator/operator.cryostat.io/v1beta2/cryostats.yaml
// kopium version: 0.22.5

#[allow(unused_imports)]
mod prelude {
    pub use kube::CustomResource;
    pub use serde::{Serialize, Deserialize};
    pub use std::collections::BTreeMap;
    pub use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
    pub use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
}
use self::prelude::*;

/// CryostatSpec defines the desired state of Cryostat.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[kube(group = "operator.cryostat.io", version = "v1beta2", kind = "Cryostat", plural = "cryostats")]
#[kube(namespaced)]
#[kube(status = "CryostatStatus")]
#[kube(schema = "disabled")]
#[kube(derive="Default")]
#[kube(derive="PartialEq")]
pub struct CryostatSpec {
    /// Options to control how the operator configures Cryostat Agents
    /// to communicate with this Cryostat instance.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "agentOptions")]
    pub agent_options: Option<CryostatAgentOptions>,
    /// Additional configuration options for the authorization proxy.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authorizationOptions")]
    pub authorization_options: Option<CryostatAuthorizationOptions>,
    /// List of Automated Rule Json Files to preconfigure in Cryostat.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "automatedRules")]
    pub automated_rules: Option<Vec<CryostatAutomatedRules>>,
    /// Options to configure the Cryostat application's database.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "databaseOptions")]
    pub database_options: Option<CryostatDatabaseOptions>,
    /// List of Stored Credentials to preconfigure in Cryostat.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "declarativeCredentials")]
    pub declarative_credentials: Option<Vec<CryostatDeclarativeCredentials>>,
    /// Use cert-manager to secure in-cluster communication between Cryostat components.
    /// Requires cert-manager to be installed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "enableCertManager")]
    pub enable_cert_manager: Option<bool>,
    /// List of Flight Recorder Event Templates to preconfigure in Cryostat.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "eventTemplates")]
    pub event_templates: Option<Vec<CryostatEventTemplates>>,
    /// Options to control how the operator exposes the application outside of the cluster,
    /// such as using an Ingress or Route.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "networkOptions")]
    pub network_options: Option<CryostatNetworkOptions>,
    /// Options to customize the NetworkPolicy objects created for Cryostat's various Services.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "networkPolicies")]
    pub network_policies: Option<CryostatNetworkPolicies>,
    /// Options to configure the Cryostat application's object storage. If not provided, a managed instance will be automatically provisioned.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "objectStorageOptions")]
    pub object_storage_options: Option<CryostatObjectStorageOptions>,
    /// Options to configure the Cryostat deployments and pods metadata
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "operandMetadata")]
    pub operand_metadata: Option<CryostatOperandMetadata>,
    /// List of JMC Agent Probe Templates to preconfigure in Cryostat.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "probeTemplates")]
    pub probe_templates: Option<Vec<CryostatProbeTemplates>>,
    /// Options to configure Cryostat Automated Report Analysis.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "reportOptions")]
    pub report_options: Option<CryostatReportOptions>,
    /// Resource requirements for the Cryostat deployment. Default resource requests will be added to each
    /// container unless specified. Default resource limits will be added to each container if neither
    /// resource requests or limits are specified.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resources: Option<CryostatResources>,
    /// Options to configure scheduling for the Cryostat deployment
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "schedulingOptions")]
    pub scheduling_options: Option<CryostatSchedulingOptions>,
    /// Options to configure the Security Contexts for the Cryostat application.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "securityOptions")]
    pub security_options: Option<CryostatSecurityOptions>,
    /// Options to customize the services created for the Cryostat application.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceOptions")]
    pub service_options: Option<CryostatServiceOptions>,
    /// Options to customize the storage provisioned for the database and object storage.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageOptions")]
    pub storage_options: Option<CryostatStorageOptions>,
    /// Options to customize the target connections cache for the Cryostat application.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "targetConnectionCacheOptions")]
    pub target_connection_cache_options: Option<CryostatTargetConnectionCacheOptions>,
    /// Options to configure the Cryostat application's target discovery mechanisms.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "targetDiscoveryOptions")]
    pub target_discovery_options: Option<CryostatTargetDiscoveryOptions>,
    /// List of namespaces whose workloads Cryostat should be
    /// permitted to access and profile. Defaults to this Cryostat's namespace.
    /// Warning: All Cryostat users will be able to create and manage
    /// recordings for workloads in the listed namespaces.
    /// More details: <https://github.com/cryostatio/cryostat-operator/blob/v4.0.0/docs/config.md#data-isolation>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "targetNamespaces")]
    pub target_namespaces: Option<Vec<String>>,
    /// List of TLS certificates to trust when connecting to targets.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCertSecrets")]
    pub trusted_cert_secrets: Option<Vec<CryostatTrustedCertSecrets>>,
}

/// Options to control how the operator configures Cryostat Agents
/// to communicate with this Cryostat instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAgentOptions {
    /// Allow insecure (non-TLS) HTTP connections to Cryostat Agents.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowInsecure")]
    pub allow_insecure: Option<bool>,
    /// Disables hostname verification when Cryostat connects to Agents over TLS.
    /// Consider enabling this if the Cryostat Agent fails to determine the hostname of your pod.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "disableHostnameVerification")]
    pub disable_hostname_verification: Option<bool>,
    /// The resources allocated to the init container used to inject the Cryostat agent,
    /// when using the operator's agent auto-configuration feature.
    /// Default resource requests will be added to the init container unless specified.
    /// Default resource limits will be added to the init container if neither resource requests or limits are specified.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resources: Option<CryostatAgentOptionsResources>,
}

/// The resources allocated to the init container used to inject the Cryostat agent,
/// when using the operator's agent auto-configuration feature.
/// Default resource requests will be added to the init container unless specified.
/// Default resource limits will be added to the init container if neither resource requests or limits are specified.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAgentOptionsResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatAgentOptionsResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAgentOptionsResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Additional configuration options for the authorization proxy.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAuthorizationOptions {
    /// Reference to a secret and file name containing the Basic authentication htpasswd file. If deploying on OpenShift this
    /// defines additional user accounts that can access the Cryostat application, on top of the OpenShift user accounts which
    /// pass the OpenShift SSO Roles checks. If not on OpenShift then this defines the only user accounts that have access.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "basicAuth")]
    pub basic_auth: Option<CryostatAuthorizationOptionsBasicAuth>,
    /// Configuration for OpenShift RBAC to define which OpenShift user accounts may access the Cryostat application.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "openShiftSSO")]
    pub open_shift_sso: Option<CryostatAuthorizationOptionsOpenShiftSso>,
}

/// Reference to a secret and file name containing the Basic authentication htpasswd file. If deploying on OpenShift this
/// defines additional user accounts that can access the Cryostat application, on top of the OpenShift user accounts which
/// pass the OpenShift SSO Roles checks. If not on OpenShift then this defines the only user accounts that have access.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAuthorizationOptionsBasicAuth {
    /// Name of the file within the secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub filename: Option<String>,
    /// Name of the secret to reference.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretName")]
    pub secret_name: Option<String>,
}

/// Configuration for OpenShift RBAC to define which OpenShift user accounts may access the Cryostat application.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAuthorizationOptionsOpenShiftSso {
    /// The SubjectAccessReview or TokenAccessReview that all clients (users visiting the application via web browser as well
    /// as CLI utilities and other programs presenting Bearer auth tokens) must pass in order to access the application.
    /// If not specified, the default role required is "create pods/exec" in the Cryostat application's installation namespace.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessReview")]
    pub access_review: Option<CryostatAuthorizationOptionsOpenShiftSsoAccessReview>,
    /// Disable OpenShift SSO integration and allow all users to access the application without authentication. This
    /// will also bypass the BasicAuth, if specified.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub disable: Option<bool>,
}

/// The SubjectAccessReview or TokenAccessReview that all clients (users visiting the application via web browser as well
/// as CLI utilities and other programs presenting Bearer auth tokens) must pass in order to access the application.
/// If not specified, the default role required is "create pods/exec" in the Cryostat application's installation namespace.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAuthorizationOptionsOpenShiftSsoAccessReview {
    /// fieldSelector describes the limitation on access based on field.  It can only limit access, not broaden it.
    /// 
    /// This field  is alpha-level. To use this field, you must enable the
    /// `AuthorizeWithSelectors` feature gate (disabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fieldSelector")]
    pub field_selector: Option<CryostatAuthorizationOptionsOpenShiftSsoAccessReviewFieldSelector>,
    /// Group is the API Group of the Resource.  "*" means all.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub group: Option<String>,
    /// labelSelector describes the limitation on access based on labels.  It can only limit access, not broaden it.
    /// 
    /// This field  is alpha-level. To use this field, you must enable the
    /// `AuthorizeWithSelectors` feature gate (disabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatAuthorizationOptionsOpenShiftSsoAccessReviewLabelSelector>,
    /// Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
    /// "" (empty) is defaulted for LocalSubjectAccessReviews
    /// "" (empty) is empty for cluster-scoped resources
    /// "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// Resource is one of the existing resource types.  "*" means all.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resource: Option<String>,
    /// Subresource is one of the existing resource types.  "" means none.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub subresource: Option<String>,
    /// Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy.  "*" means all.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub verb: Option<String>,
    /// Version is the API Version of the Resource.  "*" means all.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
}

/// fieldSelector describes the limitation on access based on field.  It can only limit access, not broaden it.
/// 
/// This field  is alpha-level. To use this field, you must enable the
/// `AuthorizeWithSelectors` feature gate (disabled by default).
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAuthorizationOptionsOpenShiftSsoAccessReviewFieldSelector {
    /// rawSelector is the serialization of a field selector that would be included in a query parameter.
    /// Webhook implementations are encouraged to ignore rawSelector.
    /// The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "rawSelector")]
    pub raw_selector: Option<String>,
    /// requirements is the parsed interpretation of a field selector.
    /// All requirements must be met for a resource instance to match the selector.
    /// Webhook implementations should handle requirements, but how to handle them is up to the webhook.
    /// Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements
    /// are not understood.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requirements: Option<Vec<CryostatAuthorizationOptionsOpenShiftSsoAccessReviewFieldSelectorRequirements>>,
}

/// FieldSelectorRequirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAuthorizationOptionsOpenShiftSsoAccessReviewFieldSelectorRequirements {
    /// key is the field selector key that the requirement applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist.
    /// The list of operators may grow in the future.
    pub operator: String,
    /// values is an array of string values.
    /// If the operator is In or NotIn, the values array must be non-empty.
    /// If the operator is Exists or DoesNotExist, the values array must be empty.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// labelSelector describes the limitation on access based on labels.  It can only limit access, not broaden it.
/// 
/// This field  is alpha-level. To use this field, you must enable the
/// `AuthorizeWithSelectors` feature gate (disabled by default).
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAuthorizationOptionsOpenShiftSsoAccessReviewLabelSelector {
    /// rawSelector is the serialization of a field selector that would be included in a query parameter.
    /// Webhook implementations are encouraged to ignore rawSelector.
    /// The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "rawSelector")]
    pub raw_selector: Option<String>,
    /// requirements is the parsed interpretation of a label selector.
    /// All requirements must be met for a resource instance to match the selector.
    /// Webhook implementations should handle requirements, but how to handle them is up to the webhook.
    /// Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements
    /// are not understood.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requirements: Option<Vec<CryostatAuthorizationOptionsOpenShiftSsoAccessReviewLabelSelectorRequirements>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAuthorizationOptionsOpenShiftSsoAccessReviewLabelSelectorRequirements {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A ConfigMap containing a .json automated rule file.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatAutomatedRules {
    /// Name of config map in the local namespace.
    #[serde(rename = "configMapName")]
    pub config_map_name: String,
    /// Filename within config map containing the automated rule file.
    pub filename: String,
}

/// Options to configure the Cryostat application's database.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatDatabaseOptions {
    /// Name of the secret containing database keys. This secret must contain a CONNECTION_KEY secret which is the
    /// database connection password, and an ENCRYPTION_KEY secret which is the key used to encrypt sensitive data
    /// stored within the database, such as the target credentials keyring. This field cannot be updated.
    /// It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data.
    /// More details: <https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretName")]
    pub secret_name: Option<String>,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatDeclarativeCredentials {
    /// Name of secret in the local namespace. The contents of that secret are expected to be a list of json
    /// representations of stored credentials in the format
    /// { "username": "$USERNAME", "password": "$PASSWORD", "matchExpression": "$MATCHEXPRESSION" }
    #[serde(rename = "secretName")]
    pub secret_name: String,
}

/// A ConfigMap containing a .jfc template file.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatEventTemplates {
    /// Name of config map in the local namespace.
    #[serde(rename = "configMapName")]
    pub config_map_name: String,
    /// Filename within config map containing the template file.
    pub filename: String,
}

/// Options to control how the operator exposes the application outside of the cluster,
/// such as using an Ingress or Route.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptions {
    /// Specifications for how to expose the Cryostat service,
    /// which serves the Cryostat application.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "coreConfig")]
    pub core_config: Option<CryostatNetworkOptionsCoreConfig>,
}

/// Specifications for how to expose the Cryostat service,
/// which serves the Cryostat application.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfig {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// Externally routable host to be used to reach this
    /// Cryostat service. Used to define a Route's host on
    /// OpenShift when it is first created.
    /// On Kubernetes, define this using "spec.ingressSpec".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "externalHost")]
    pub external_host: Option<String>,
    /// Configuration for an Ingress object.
    /// Currently subpaths are not supported, so unique hosts must be specified
    /// (if a single external IP is being used) to differentiate between ingresses/services.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ingressSpec")]
    pub ingress_spec: Option<CryostatNetworkOptionsCoreConfigIngressSpec>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
}

/// Configuration for an Ingress object.
/// Currently subpaths are not supported, so unique hosts must be specified
/// (if a single external IP is being used) to differentiate between ingresses/services.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpec {
    /// defaultBackend is the backend that should handle requests that don't
    /// match any rule. If Rules are not specified, DefaultBackend must be specified.
    /// If DefaultBackend is not set, the handling of requests that do not match any
    /// of the rules will be up to the Ingress controller.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "defaultBackend")]
    pub default_backend: Option<CryostatNetworkOptionsCoreConfigIngressSpecDefaultBackend>,
    /// ingressClassName is the name of an IngressClass cluster resource. Ingress
    /// controller implementations use this field to know whether they should be
    /// serving this Ingress resource, by a transitive connection
    /// (controller -> IngressClass -> Ingress resource). Although the
    /// `kubernetes.io/ingress.class` annotation (simple constant name) was never
    /// formally defined, it was widely supported by Ingress controllers to create
    /// a direct binding between Ingress controller and Ingress resources. Newly
    /// created Ingress resources should prefer using the field. However, even
    /// though the annotation is officially deprecated, for backwards compatibility
    /// reasons, ingress controllers should still honor that annotation if present.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ingressClassName")]
    pub ingress_class_name: Option<String>,
    /// rules is a list of host rules used to configure the Ingress. If unspecified,
    /// or no rule matches, all traffic is sent to the default backend.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub rules: Option<Vec<CryostatNetworkOptionsCoreConfigIngressSpecRules>>,
    /// tls represents the TLS configuration. Currently the Ingress only supports a
    /// single TLS port, 443. If multiple members of this list specify different hosts,
    /// they will be multiplexed on the same port according to the hostname specified
    /// through the SNI TLS extension, if the ingress controller fulfilling the
    /// ingress supports SNI.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tls: Option<Vec<CryostatNetworkOptionsCoreConfigIngressSpecTls>>,
}

/// defaultBackend is the backend that should handle requests that don't
/// match any rule. If Rules are not specified, DefaultBackend must be specified.
/// If DefaultBackend is not set, the handling of requests that do not match any
/// of the rules will be up to the Ingress controller.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecDefaultBackend {
    /// resource is an ObjectRef to another Kubernetes resource in the namespace
    /// of the Ingress object. If resource is specified, a service.Name and
    /// service.Port must not be specified.
    /// This is a mutually exclusive setting with "Service".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resource: Option<CryostatNetworkOptionsCoreConfigIngressSpecDefaultBackendResource>,
    /// service references a service as a backend.
    /// This is a mutually exclusive setting with "Resource".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub service: Option<CryostatNetworkOptionsCoreConfigIngressSpecDefaultBackendService>,
}

/// resource is an ObjectRef to another Kubernetes resource in the namespace
/// of the Ingress object. If resource is specified, a service.Name and
/// service.Port must not be specified.
/// This is a mutually exclusive setting with "Service".
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecDefaultBackendResource {
    /// APIGroup is the group for the resource being referenced.
    /// If APIGroup is not specified, the specified Kind must be in the core API group.
    /// For any other third-party types, APIGroup is required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
    pub api_group: Option<String>,
    /// Kind is the type of resource being referenced
    pub kind: String,
    /// Name is the name of resource being referenced
    pub name: String,
}

/// service references a service as a backend.
/// This is a mutually exclusive setting with "Resource".
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecDefaultBackendService {
    /// name is the referenced service. The service must exist in
    /// the same namespace as the Ingress object.
    pub name: String,
    /// port of the referenced service. A port name or port number
    /// is required for a IngressServiceBackend.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<CryostatNetworkOptionsCoreConfigIngressSpecDefaultBackendServicePort>,
}

/// port of the referenced service. A port name or port number
/// is required for a IngressServiceBackend.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecDefaultBackendServicePort {
    /// name is the name of the port on the Service.
    /// This is a mutually exclusive setting with "Number".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// number is the numerical port number (e.g. 80) on the Service.
    /// This is a mutually exclusive setting with "Name".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub number: Option<i32>,
}

/// IngressRule represents the rules mapping the paths under a specified host to
/// the related backend services. Incoming requests are first evaluated for a host
/// match, then routed to the backend associated with the matching IngressRuleValue.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecRules {
    /// host is the fully qualified domain name of a network host, as defined by RFC 3986.
    /// Note the following deviations from the "host" part of the
    /// URI as defined in RFC 3986:
    /// 1. IPs are not allowed. Currently an IngressRuleValue can only apply to
    ///    the IP in the Spec of the parent Ingress.
    /// 2. The `:` delimiter is not respected because ports are not allowed.
    /// 	  Currently the port of an Ingress is implicitly :80 for http and
    /// 	  :443 for https.
    /// Both these may change in the future.
    /// Incoming requests are matched against the host before the
    /// IngressRuleValue. If the host is unspecified, the Ingress routes all
    /// traffic based on the specified IngressRuleValue.
    /// 
    /// host can be "precise" which is a domain name without the terminating dot of
    /// a network host (e.g. "foo.bar.com") or "wildcard", which is a domain name
    /// prefixed with a single wildcard label (e.g. "*.foo.com").
    /// The wildcard character '*' must appear by itself as the first DNS label and
    /// matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
    /// Requests will be matched against the Host field in the following way:
    /// 1. If host is precise, the request matches this rule if the http host header is equal to Host.
    /// 2. If host is a wildcard, then the request matches this rule if the http host header
    /// is to equal to the suffix (removing the first label) of the wildcard rule.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub host: Option<String>,
    /// HTTPIngressRuleValue is a list of http selectors pointing to backends.
    /// In the example: <http://<host>/<path>?<searchpart>> -> backend where
    /// where parts of the url correspond to RFC 3986, this resource will be used
    /// to match against everything after the last '/' and before the first '?'
    /// or '#'.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub http: Option<CryostatNetworkOptionsCoreConfigIngressSpecRulesHttp>,
}

/// HTTPIngressRuleValue is a list of http selectors pointing to backends.
/// In the example: <http://<host>/<path>?<searchpart>> -> backend where
/// where parts of the url correspond to RFC 3986, this resource will be used
/// to match against everything after the last '/' and before the first '?'
/// or '#'.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecRulesHttp {
    /// paths is a collection of paths that map requests to backends.
    pub paths: Vec<CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPaths>,
}

/// HTTPIngressPath associates a path with a backend. Incoming urls matching the
/// path are forwarded to the backend.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPaths {
    /// backend defines the referenced service endpoint to which the traffic
    /// will be forwarded to.
    pub backend: CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPathsBackend,
    /// path is matched against the path of an incoming request. Currently it can
    /// contain characters disallowed from the conventional "path" part of a URL
    /// as defined by RFC 3986. Paths must begin with a '/' and must be present
    /// when using PathType with value "Exact" or "Prefix".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
    /// pathType determines the interpretation of the path matching. PathType can
    /// be one of the following values:
    /// * Exact: Matches the URL path exactly.
    /// * Prefix: Matches based on a URL path prefix split by '/'. Matching is
    ///   done on a path element by element basis. A path element refers is the
    ///   list of labels in the path split by the '/' separator. A request is a
    ///   match for path p if every p is an element-wise prefix of p of the
    ///   request path. Note that if the last element of the path is a substring
    ///   of the last element in request path, it is not a match (e.g. /foo/bar
    ///   matches /foo/bar/baz, but does not match /foo/barbaz).
    /// * ImplementationSpecific: Interpretation of the Path matching is up to
    ///   the IngressClass. Implementations can treat this as a separate PathType
    ///   or treat it identically to Prefix or Exact path types.
    /// Implementations are required to support all path types.
    #[serde(rename = "pathType")]
    pub path_type: String,
}

/// backend defines the referenced service endpoint to which the traffic
/// will be forwarded to.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPathsBackend {
    /// resource is an ObjectRef to another Kubernetes resource in the namespace
    /// of the Ingress object. If resource is specified, a service.Name and
    /// service.Port must not be specified.
    /// This is a mutually exclusive setting with "Service".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resource: Option<CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPathsBackendResource>,
    /// service references a service as a backend.
    /// This is a mutually exclusive setting with "Resource".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub service: Option<CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPathsBackendService>,
}

/// resource is an ObjectRef to another Kubernetes resource in the namespace
/// of the Ingress object. If resource is specified, a service.Name and
/// service.Port must not be specified.
/// This is a mutually exclusive setting with "Service".
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPathsBackendResource {
    /// APIGroup is the group for the resource being referenced.
    /// If APIGroup is not specified, the specified Kind must be in the core API group.
    /// For any other third-party types, APIGroup is required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
    pub api_group: Option<String>,
    /// Kind is the type of resource being referenced
    pub kind: String,
    /// Name is the name of resource being referenced
    pub name: String,
}

/// service references a service as a backend.
/// This is a mutually exclusive setting with "Resource".
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPathsBackendService {
    /// name is the referenced service. The service must exist in
    /// the same namespace as the Ingress object.
    pub name: String,
    /// port of the referenced service. A port name or port number
    /// is required for a IngressServiceBackend.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPathsBackendServicePort>,
}

/// port of the referenced service. A port name or port number
/// is required for a IngressServiceBackend.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecRulesHttpPathsBackendServicePort {
    /// name is the name of the port on the Service.
    /// This is a mutually exclusive setting with "Number".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// number is the numerical port number (e.g. 80) on the Service.
    /// This is a mutually exclusive setting with "Name".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub number: Option<i32>,
}

/// IngressTLS describes the transport layer security associated with an ingress.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkOptionsCoreConfigIngressSpecTls {
    /// hosts is a list of hosts included in the TLS certificate. The values in
    /// this list must match the name/s used in the tlsSecret. Defaults to the
    /// wildcard host setting for the loadbalancer controller fulfilling this
    /// Ingress, if left unspecified.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub hosts: Option<Vec<String>>,
    /// secretName is the name of the secret used to terminate TLS traffic on
    /// port 443. Field is left optional to allow TLS routing based on SNI
    /// hostname alone. If the SNI host in a listener conflicts with the "Host"
    /// header field used by an IngressRule, the SNI host is used for termination
    /// and value of the "Host" header is used for routing.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretName")]
    pub secret_name: Option<String>,
}

/// Options to customize the NetworkPolicy objects created for Cryostat's various Services.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkPolicies {
    /// NetworkPolicy configuration for the Cryostat application service.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "coreConfig")]
    pub core_config: Option<CryostatNetworkPoliciesCoreConfig>,
    /// NetworkPolicy configuration for the database service.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "databaseConfig")]
    pub database_config: Option<CryostatNetworkPoliciesDatabaseConfig>,
    /// NetworkPolicy configuration for the cryostat-reports service.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "reportsConfig")]
    pub reports_config: Option<CryostatNetworkPoliciesReportsConfig>,
    /// NetworkPolicy configuration for the storage service.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageConfig")]
    pub storage_config: Option<CryostatNetworkPoliciesStorageConfig>,
}

/// NetworkPolicy configuration for the Cryostat application service.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkPoliciesCoreConfig {
    /// Disable the NetworkPolicies (Ingress and Egress) for a given service.
    /// Deprecated: use IngressDisabled and EgressEnabled instead.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub disabled: Option<bool>,
    /// Enable the NetworkPolicy for egress from a given pod. Disabled by default.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "egressEnabled")]
    pub egress_enabled: Option<bool>,
    /// Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ingressDisabled")]
    pub ingress_disabled: Option<bool>,
}

/// NetworkPolicy configuration for the database service.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkPoliciesDatabaseConfig {
    /// Disable the NetworkPolicies (Ingress and Egress) for a given service.
    /// Deprecated: use IngressDisabled and EgressEnabled instead.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub disabled: Option<bool>,
    /// Enable the NetworkPolicy for egress from a given pod. Disabled by default.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "egressEnabled")]
    pub egress_enabled: Option<bool>,
    /// Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ingressDisabled")]
    pub ingress_disabled: Option<bool>,
}

/// NetworkPolicy configuration for the cryostat-reports service.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkPoliciesReportsConfig {
    /// Disable the NetworkPolicies (Ingress and Egress) for a given service.
    /// Deprecated: use IngressDisabled and EgressEnabled instead.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub disabled: Option<bool>,
    /// Enable the NetworkPolicy for egress from a given pod. Disabled by default.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "egressEnabled")]
    pub egress_enabled: Option<bool>,
    /// Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ingressDisabled")]
    pub ingress_disabled: Option<bool>,
}

/// NetworkPolicy configuration for the storage service.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatNetworkPoliciesStorageConfig {
    /// Disable the NetworkPolicies (Ingress and Egress) for a given service.
    /// Deprecated: use IngressDisabled and EgressEnabled instead.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub disabled: Option<bool>,
    /// Enable the NetworkPolicy for egress from a given pod. Disabled by default.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "egressEnabled")]
    pub egress_enabled: Option<bool>,
    /// Disable the NetworkPolicy for ingress to a given pod. Enabled by default.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ingressDisabled")]
    pub ingress_disabled: Option<bool>,
}

/// Options to configure the Cryostat application's object storage. If not provided, a managed instance will be automatically provisioned.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatObjectStorageOptions {
    /// Configuration for external object storage providers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub provider: Option<CryostatObjectStorageOptionsProvider>,
    /// Name of the secret containing the object storage secret access key. This secret must contain a
    /// ACCESS_KEY secret which is the object storage access key ID, and a SECRET_KEY secret which is the object storage secret access key.
    /// If using an external S3 provider requiring authentication then this must be provided.
    /// It is recommended that the secret should be marked as immutable to avoid accidental changes to secret's data.
    /// More details: [Kubernetes Secrets](<https://kubernetes.io/docs/concepts/configuration/secret/#secret-immutable)>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretName")]
    pub secret_name: Option<String>,
    /// Configuration for object storage buckets. Only applies when external storage is configured, ie. .spec.ObjectStorageProviderOptions is non-nil.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageBucketNameOptions")]
    pub storage_bucket_name_options: Option<CryostatObjectStorageOptionsStorageBucketNameOptions>,
}

/// Configuration for external object storage providers.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatObjectStorageOptionsProvider {
    /// Whether file downloads from storage to the user's browser should be performed using presigned URLs, or by Cryostat acting as a "network pipe." Enabling this reduces network utilization and latency and removes some I/O from Cryostat, but requires that the object storage container URLs are accessible to the user's browser. Defaults to inheriting the .spec.objectStorageProviderOptions.disablePresignedFileTransfers value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "disablePresignedDownloads")]
    pub disable_presigned_downloads: Option<bool>,
    /// Whether file transfers should be performed using presigned URLs, or by Cryostat acting as a "network pipe" to the other containers. Defaults to false (presigned transfers enabled) for performance.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "disablePresignedFileTransfers")]
    pub disable_presigned_file_transfers: Option<bool>,
    /// The strategy Cryostat will use for storing files' metadata. The default 'tagging' strategy stores all metadata as object Tags.
    /// The 'metadata' strategy stores metadata as object Metadata, which is immutable but allows for more entries than Tags.
    /// The 'bucket' strategy stores metadata as separate files (ex. JSON object maps) in a dedicated bucket,
    /// with prefixes to differentiate the kind of object the metadata belongs to.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "metadataMode")]
    pub metadata_mode: Option<CryostatObjectStorageOptionsProviderMetadataMode>,
    /// The object storage provider region.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    /// Whether Cryostat should trust all TLS certificates presented by the external object storage provider. Defaults to false.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tlsTrustAll")]
    pub tls_trust_all: Option<bool>,
    /// The complete URL (not including authentication information) to the external object storage provider.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
    /// Whether virtual host subdomain access should be used, as opposed to path-style access. Defaults to false for compatibility.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "useVirtualHostAccess")]
    pub use_virtual_host_access: Option<bool>,
}

/// Configuration for external object storage providers.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum CryostatObjectStorageOptionsProviderMetadataMode {
    #[serde(rename = "tagging")]
    Tagging,
    #[serde(rename = "metadata")]
    Metadata,
    #[serde(rename = "bucket")]
    Bucket,
}

/// Configuration for object storage buckets. Only applies when external storage is configured, ie. .spec.ObjectStorageProviderOptions is non-nil.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatObjectStorageOptionsStorageBucketNameOptions {
    /// The name of the bucket used to store Archived JFR files.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "archivedRecordings")]
    pub archived_recordings: Option<String>,
    /// The name of the bucket used to store a cache of Automated Analysis reports attached to Archived JFR files.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "archivedReports")]
    pub archived_reports: Option<String>,
    /// The name of the bucket used to store custom Event Templates.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "eventTemplates")]
    pub event_templates: Option<String>,
    /// The name of the bucket used to store JVM heap dumps.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "heapDumps")]
    pub heap_dumps: Option<String>,
    /// The name of the bucket used to store JMC Agent Probe templates.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "jmcAgentProbeTemplates")]
    pub jmc_agent_probe_templates: Option<String>,
    /// The name of the bucket used to storage metadata for other objects (ex. archived recordings). This is only used if the .spec.objectStorageOptions.provider.metadataMode is set to 'bucket'.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metadata: Option<String>,
    /// The name of the bucket used to storage JVM thread dumps.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "threadDumps")]
    pub thread_dumps: Option<String>,
}

/// Options to configure the Cryostat deployments and pods metadata
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatOperandMetadata {
    /// Options to configure the Cryostat deployments metadata
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "deploymentMetadata")]
    pub deployment_metadata: Option<CryostatOperandMetadataDeploymentMetadata>,
    /// Options to configure the Cryostat pods metadata
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "podMetadata")]
    pub pod_metadata: Option<CryostatOperandMetadataPodMetadata>,
}

/// Options to configure the Cryostat deployments metadata
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatOperandMetadataDeploymentMetadata {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
}

/// Options to configure the Cryostat pods metadata
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatOperandMetadataPodMetadata {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
}

/// A ConfigMap containing a .xml JMC Agent probe template file.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatProbeTemplates {
    /// Name of config map in the local namespace.
    #[serde(rename = "configMapName")]
    pub config_map_name: String,
    /// Filename within config map containing the automated rule file.
    pub filename: String,
}

/// Options to configure Cryostat Automated Report Analysis.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptions {
    /// The number of report sidecar replica containers to deploy.
    /// Each replica can service one report generation request at a time.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub replicas: Option<i32>,
    /// The resources allocated to each sidecar replica.
    /// A replica with more resources can handle larger input recordings and will process them faster.
    /// Default resource requests will be added to the container unless specified.
    /// Default resource limits will be added to each container if neither resource requests or limits are specified.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resources: Option<CryostatReportOptionsResources>,
    /// Options to configure scheduling for the reports deployment
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "schedulingOptions")]
    pub scheduling_options: Option<CryostatReportOptionsSchedulingOptions>,
    /// Options to configure the Security Contexts for the Cryostat report generator.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "securityOptions")]
    pub security_options: Option<CryostatReportOptionsSecurityOptions>,
    /// When zero report sidecar replicas are requested, SubProcessMaxHeapSize configures
    /// the maximum heap size of the basic subprocess report generator in MiB.
    /// The default heap size is `200` (MiB).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "subProcessMaxHeapSize")]
    pub sub_process_max_heap_size: Option<i32>,
}

/// The resources allocated to each sidecar replica.
/// A replica with more resources can handle larger input recordings and will process them faster.
/// Default resource requests will be added to the container unless specified.
/// Default resource limits will be added to each container if neither resource requests or limits are specified.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatReportOptionsResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Options to configure scheduling for the reports deployment
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptions {
    /// Affinity rules for scheduling Cryostat pods.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub affinity: Option<CryostatReportOptionsSchedulingOptionsAffinity>,
    /// Label selector used to schedule a Cryostat pod to a node. See: <https://kubernetes.io/docs/concepts/configuration/assign-pod-node/>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "nodeSelector")]
    pub node_selector: Option<BTreeMap<String, String>>,
    /// Tolerations to allow scheduling of Cryostat pods to tainted nodes. See: <https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tolerations: Option<Vec<CryostatReportOptionsSchedulingOptionsTolerations>>,
}

/// Affinity rules for scheduling Cryostat pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinity {
    /// Node affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#NodeAffinity>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "nodeAffinity")]
    pub node_affinity: Option<CryostatReportOptionsSchedulingOptionsAffinityNodeAffinity>,
    /// Pod affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodAffinity>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "podAffinity")]
    pub pod_affinity: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAffinity>,
    /// Pod anti-affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodAntiAffinity>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "podAntiAffinity")]
    pub pod_anti_affinity: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinity>,
}

/// Node affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#NodeAffinity>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinity {
    /// The scheduler will prefer to schedule pods to nodes that satisfy
    /// the affinity expressions specified by this field, but it may choose
    /// a node that violates one or more of the expressions. The node that is
    /// most preferred is the one with the greatest sum of weights, i.e.
    /// for each node that meets all of the scheduling requirements (resource
    /// request, requiredDuringScheduling affinity expressions, etc.),
    /// compute a sum by iterating through the elements of this field and adding
    /// "weight" to the sum if the node matches the corresponding matchExpressions; the
    /// node(s) with the highest sum are the most preferred.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "preferredDuringSchedulingIgnoredDuringExecution")]
    pub preferred_during_scheduling_ignored_during_execution: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecution>>,
    /// If the affinity requirements specified by this field are not met at
    /// scheduling time, the pod will not be scheduled onto the node.
    /// If the affinity requirements specified by this field cease to be met
    /// at some point during pod execution (e.g. due to an update), the system
    /// may or may not try to eventually evict the pod from its node.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "requiredDuringSchedulingIgnoredDuringExecution")]
    pub required_during_scheduling_ignored_during_execution: Option<CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecution>,
}

/// An empty preferred scheduling term matches all objects with implicit weight 0
/// (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecution {
    /// A node selector term, associated with the corresponding weight.
    pub preference: CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreference,
    /// Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
    pub weight: i32,
}

/// A node selector term, associated with the corresponding weight.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreference {
    /// A list of node selector requirements by node's labels.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreferenceMatchExpressions>>,
    /// A list of node selector requirements by node's fields.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchFields")]
    pub match_fields: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreferenceMatchFields>>,
}

/// A node selector requirement is a selector that contains values, a key, and an operator
/// that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreferenceMatchExpressions {
    /// The label key that the selector applies to.
    pub key: String,
    /// Represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    pub operator: String,
    /// An array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. If the operator is Gt or Lt, the values
    /// array must have a single element, which will be interpreted as an integer.
    /// This array is replaced during a strategic merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A node selector requirement is a selector that contains values, a key, and an operator
/// that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreferenceMatchFields {
    /// The label key that the selector applies to.
    pub key: String,
    /// Represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    pub operator: String,
    /// An array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. If the operator is Gt or Lt, the values
    /// array must have a single element, which will be interpreted as an integer.
    /// This array is replaced during a strategic merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// If the affinity requirements specified by this field are not met at
/// scheduling time, the pod will not be scheduled onto the node.
/// If the affinity requirements specified by this field cease to be met
/// at some point during pod execution (e.g. due to an update), the system
/// may or may not try to eventually evict the pod from its node.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecution {
    /// Required. A list of node selector terms. The terms are ORed.
    #[serde(rename = "nodeSelectorTerms")]
    pub node_selector_terms: Vec<CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTerms>,
}

/// A null or empty node selector term matches no objects. The requirements of
/// them are ANDed.
/// The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTerms {
    /// A list of node selector requirements by node's labels.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTermsMatchExpressions>>,
    /// A list of node selector requirements by node's fields.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchFields")]
    pub match_fields: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTermsMatchFields>>,
}

/// A node selector requirement is a selector that contains values, a key, and an operator
/// that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTermsMatchExpressions {
    /// The label key that the selector applies to.
    pub key: String,
    /// Represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    pub operator: String,
    /// An array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. If the operator is Gt or Lt, the values
    /// array must have a single element, which will be interpreted as an integer.
    /// This array is replaced during a strategic merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A node selector requirement is a selector that contains values, a key, and an operator
/// that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTermsMatchFields {
    /// The label key that the selector applies to.
    pub key: String,
    /// Represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    pub operator: String,
    /// An array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. If the operator is Gt or Lt, the values
    /// array must have a single element, which will be interpreted as an integer.
    /// This array is replaced during a strategic merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Pod affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodAffinity>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinity {
    /// The scheduler will prefer to schedule pods to nodes that satisfy
    /// the affinity expressions specified by this field, but it may choose
    /// a node that violates one or more of the expressions. The node that is
    /// most preferred is the one with the greatest sum of weights, i.e.
    /// for each node that meets all of the scheduling requirements (resource
    /// request, requiredDuringScheduling affinity expressions, etc.),
    /// compute a sum by iterating through the elements of this field and adding
    /// "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
    /// node(s) with the highest sum are the most preferred.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "preferredDuringSchedulingIgnoredDuringExecution")]
    pub preferred_during_scheduling_ignored_during_execution: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecution>>,
    /// If the affinity requirements specified by this field are not met at
    /// scheduling time, the pod will not be scheduled onto the node.
    /// If the affinity requirements specified by this field cease to be met
    /// at some point during pod execution (e.g. due to a pod label update), the
    /// system may or may not try to eventually evict the pod from its node.
    /// When there are multiple elements, the lists of nodes corresponding to each
    /// podAffinityTerm are intersected, i.e. all terms must be satisfied.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "requiredDuringSchedulingIgnoredDuringExecution")]
    pub required_during_scheduling_ignored_during_execution: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecution>>,
}

/// The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecution {
    /// Required. A pod affinity term, associated with the corresponding weight.
    #[serde(rename = "podAffinityTerm")]
    pub pod_affinity_term: CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTerm,
    /// weight associated with matching the corresponding podAffinityTerm,
    /// in the range 1-100.
    pub weight: i32,
}

/// Required. A pod affinity term, associated with the corresponding weight.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTerm {
    /// A label query over a set of resources, in this case pods.
    /// If it's null, this PodAffinityTerm matches with no Pods.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelector>,
    /// MatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both matchLabelKeys and labelSelector.
    /// Also, matchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabelKeys")]
    pub match_label_keys: Option<Vec<String>>,
    /// MismatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
    /// Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mismatchLabelKeys")]
    pub mismatch_label_keys: Option<Vec<String>>,
    /// A label query over the set of namespaces that the term applies to.
    /// The term is applied to the union of the namespaces selected by this field
    /// and the ones listed in the namespaces field.
    /// null selector and null or empty namespaces list means "this pod's namespace".
    /// An empty selector ({}) matches all namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>,
    /// namespaces specifies a static list of namespace names that the term applies to.
    /// The term is applied to the union of the namespaces listed in this field
    /// and the ones selected by namespaceSelector.
    /// null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
    /// the labelSelector in the specified namespaces, where co-located is defined as running on a node
    /// whose value of the label with key topologyKey matches that of any node on which any of the
    /// selected pods is running.
    /// Empty topologyKey is not allowed.
    #[serde(rename = "topologyKey")]
    pub topology_key: String,
}

/// A label query over a set of resources, in this case pods.
/// If it's null, this PodAffinityTerm matches with no Pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label query over the set of namespaces that the term applies to.
/// The term is applied to the union of the namespaces selected by this field
/// and the ones listed in the namespaces field.
/// null selector and null or empty namespaces list means "this pod's namespace".
/// An empty selector ({}) matches all namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Defines a set of pods (namely those matching the labelSelector
/// relative to the given namespace(s)) that this pod should be
/// co-located (affinity) or not co-located (anti-affinity) with,
/// where co-located is defined as running on a node whose value of
/// the label with key <topologyKey> matches that of any node on which
/// a pod of the set of pods is running
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecution {
    /// A label query over a set of resources, in this case pods.
    /// If it's null, this PodAffinityTerm matches with no Pods.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelector>,
    /// MatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both matchLabelKeys and labelSelector.
    /// Also, matchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabelKeys")]
    pub match_label_keys: Option<Vec<String>>,
    /// MismatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
    /// Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mismatchLabelKeys")]
    pub mismatch_label_keys: Option<Vec<String>>,
    /// A label query over the set of namespaces that the term applies to.
    /// The term is applied to the union of the namespaces selected by this field
    /// and the ones listed in the namespaces field.
    /// null selector and null or empty namespaces list means "this pod's namespace".
    /// An empty selector ({}) matches all namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>,
    /// namespaces specifies a static list of namespace names that the term applies to.
    /// The term is applied to the union of the namespaces listed in this field
    /// and the ones selected by namespaceSelector.
    /// null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
    /// the labelSelector in the specified namespaces, where co-located is defined as running on a node
    /// whose value of the label with key topologyKey matches that of any node on which any of the
    /// selected pods is running.
    /// Empty topologyKey is not allowed.
    #[serde(rename = "topologyKey")]
    pub topology_key: String,
}

/// A label query over a set of resources, in this case pods.
/// If it's null, this PodAffinityTerm matches with no Pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label query over the set of namespaces that the term applies to.
/// The term is applied to the union of the namespaces selected by this field
/// and the ones listed in the namespaces field.
/// null selector and null or empty namespaces list means "this pod's namespace".
/// An empty selector ({}) matches all namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Pod anti-affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodAntiAffinity>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinity {
    /// The scheduler will prefer to schedule pods to nodes that satisfy
    /// the anti-affinity expressions specified by this field, but it may choose
    /// a node that violates one or more of the expressions. The node that is
    /// most preferred is the one with the greatest sum of weights, i.e.
    /// for each node that meets all of the scheduling requirements (resource
    /// request, requiredDuringScheduling anti-affinity expressions, etc.),
    /// compute a sum by iterating through the elements of this field and adding
    /// "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
    /// node(s) with the highest sum are the most preferred.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "preferredDuringSchedulingIgnoredDuringExecution")]
    pub preferred_during_scheduling_ignored_during_execution: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecution>>,
    /// If the anti-affinity requirements specified by this field are not met at
    /// scheduling time, the pod will not be scheduled onto the node.
    /// If the anti-affinity requirements specified by this field cease to be met
    /// at some point during pod execution (e.g. due to a pod label update), the
    /// system may or may not try to eventually evict the pod from its node.
    /// When there are multiple elements, the lists of nodes corresponding to each
    /// podAffinityTerm are intersected, i.e. all terms must be satisfied.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "requiredDuringSchedulingIgnoredDuringExecution")]
    pub required_during_scheduling_ignored_during_execution: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecution>>,
}

/// The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecution {
    /// Required. A pod affinity term, associated with the corresponding weight.
    #[serde(rename = "podAffinityTerm")]
    pub pod_affinity_term: CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTerm,
    /// weight associated with matching the corresponding podAffinityTerm,
    /// in the range 1-100.
    pub weight: i32,
}

/// Required. A pod affinity term, associated with the corresponding weight.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTerm {
    /// A label query over a set of resources, in this case pods.
    /// If it's null, this PodAffinityTerm matches with no Pods.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelector>,
    /// MatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both matchLabelKeys and labelSelector.
    /// Also, matchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabelKeys")]
    pub match_label_keys: Option<Vec<String>>,
    /// MismatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
    /// Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mismatchLabelKeys")]
    pub mismatch_label_keys: Option<Vec<String>>,
    /// A label query over the set of namespaces that the term applies to.
    /// The term is applied to the union of the namespaces selected by this field
    /// and the ones listed in the namespaces field.
    /// null selector and null or empty namespaces list means "this pod's namespace".
    /// An empty selector ({}) matches all namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>,
    /// namespaces specifies a static list of namespace names that the term applies to.
    /// The term is applied to the union of the namespaces listed in this field
    /// and the ones selected by namespaceSelector.
    /// null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
    /// the labelSelector in the specified namespaces, where co-located is defined as running on a node
    /// whose value of the label with key topologyKey matches that of any node on which any of the
    /// selected pods is running.
    /// Empty topologyKey is not allowed.
    #[serde(rename = "topologyKey")]
    pub topology_key: String,
}

/// A label query over a set of resources, in this case pods.
/// If it's null, this PodAffinityTerm matches with no Pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label query over the set of namespaces that the term applies to.
/// The term is applied to the union of the namespaces selected by this field
/// and the ones listed in the namespaces field.
/// null selector and null or empty namespaces list means "this pod's namespace".
/// An empty selector ({}) matches all namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Defines a set of pods (namely those matching the labelSelector
/// relative to the given namespace(s)) that this pod should be
/// co-located (affinity) or not co-located (anti-affinity) with,
/// where co-located is defined as running on a node whose value of
/// the label with key <topologyKey> matches that of any node on which
/// a pod of the set of pods is running
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecution {
    /// A label query over a set of resources, in this case pods.
    /// If it's null, this PodAffinityTerm matches with no Pods.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelector>,
    /// MatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both matchLabelKeys and labelSelector.
    /// Also, matchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabelKeys")]
    pub match_label_keys: Option<Vec<String>>,
    /// MismatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
    /// Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mismatchLabelKeys")]
    pub mismatch_label_keys: Option<Vec<String>>,
    /// A label query over the set of namespaces that the term applies to.
    /// The term is applied to the union of the namespaces selected by this field
    /// and the ones listed in the namespaces field.
    /// null selector and null or empty namespaces list means "this pod's namespace".
    /// An empty selector ({}) matches all namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>,
    /// namespaces specifies a static list of namespace names that the term applies to.
    /// The term is applied to the union of the namespaces listed in this field
    /// and the ones selected by namespaceSelector.
    /// null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
    /// the labelSelector in the specified namespaces, where co-located is defined as running on a node
    /// whose value of the label with key topologyKey matches that of any node on which any of the
    /// selected pods is running.
    /// Empty topologyKey is not allowed.
    #[serde(rename = "topologyKey")]
    pub topology_key: String,
}

/// A label query over a set of resources, in this case pods.
/// If it's null, this PodAffinityTerm matches with no Pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label query over the set of namespaces that the term applies to.
/// The term is applied to the union of the namespaces selected by this field
/// and the ones listed in the namespaces field.
/// null selector and null or empty namespaces list means "this pod's namespace".
/// An empty selector ({}) matches all namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// The pod this Toleration is attached to tolerates any taint that matches
/// the triple <key,value,effect> using the matching operator <operator>.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSchedulingOptionsTolerations {
    /// Effect indicates the taint effect to match. Empty means match all taint effects.
    /// When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub effect: Option<String>,
    /// Key is the taint key that the toleration applies to. Empty means match all taint keys.
    /// If the key is empty, operator must be Exists; this combination means to match all values and all keys.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// Operator represents a key's relationship to the value.
    /// Valid operators are Exists and Equal. Defaults to Equal.
    /// Exists is equivalent to wildcard for value, so that a pod can
    /// tolerate all taints of a particular category.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub operator: Option<String>,
    /// TolerationSeconds represents the period of time the toleration (which must be
    /// of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
    /// it is not set, which means tolerate the taint forever (do not evict). Zero and
    /// negative values will be treated as 0 (evict immediately) by the system.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tolerationSeconds")]
    pub toleration_seconds: Option<i64>,
    /// Value is the taint value the toleration matches to.
    /// If the operator is Exists, the value should be empty, otherwise just a regular string.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// Options to configure the Security Contexts for the Cryostat report generator.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptions {
    /// Security Context to apply to the Cryostat report generator pod.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "podSecurityContext")]
    pub pod_security_context: Option<CryostatReportOptionsSecurityOptionsPodSecurityContext>,
    /// Security Context to apply to the Cryostat report generator container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "reportsSecurityContext")]
    pub reports_security_context: Option<CryostatReportOptionsSecurityOptionsReportsSecurityContext>,
}

/// Security Context to apply to the Cryostat report generator pod.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsPodSecurityContext {
    /// appArmorProfile is the AppArmor options to use by the containers in this pod.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatReportOptionsSecurityOptionsPodSecurityContextAppArmorProfile>,
    /// A special supplemental group that applies to all containers in a pod.
    /// Some volume types allow the Kubelet to change the ownership of that volume
    /// to be owned by the pod:
    /// 
    /// 1. The owning GID will be the FSGroup
    /// 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
    /// 3. The permission bits are OR'd with rw-rw----
    /// 
    /// If unset, the Kubelet will not modify the ownership and permissions of any volume.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fsGroup")]
    pub fs_group: Option<i64>,
    /// fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
    /// before being exposed inside Pod. This field will only apply to
    /// volume types which support fsGroup based ownership(and permissions).
    /// It will have no effect on ephemeral volume types such as: secret, configmaps
    /// and emptydir.
    /// Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fsGroupChangePolicy")]
    pub fs_group_change_policy: Option<String>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in SecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence
    /// for that container.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in SecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in SecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence
    /// for that container.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to all containers.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in SecurityContext.  If set in
    /// both SecurityContext and PodSecurityContext, the value specified in SecurityContext
    /// takes precedence for that container.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatReportOptionsSecurityOptionsPodSecurityContextSeLinuxOptions>,
    /// The seccomp options to use by the containers in this pod.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatReportOptionsSecurityOptionsPodSecurityContextSeccompProfile>,
    /// A list of groups applied to the first process run in each container, in
    /// addition to the container's primary GID and fsGroup (if specified).  If
    /// the SupplementalGroupsPolicy feature is enabled, the
    /// supplementalGroupsPolicy field determines whether these are in addition
    /// to or instead of any group memberships defined in the container image.
    /// If unspecified, no additional groups are added, though group memberships
    /// defined in the container image may still be used, depending on the
    /// supplementalGroupsPolicy field.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "supplementalGroups")]
    pub supplemental_groups: Option<Vec<i64>>,
    /// Defines how supplemental groups of the first container processes are calculated.
    /// Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
    /// (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
    /// and the container runtime must implement support for this feature.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "supplementalGroupsPolicy")]
    pub supplemental_groups_policy: Option<String>,
    /// Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
    /// sysctls (by the container runtime) might fail to launch.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub sysctls: Option<Vec<CryostatReportOptionsSecurityOptionsPodSecurityContextSysctls>>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options within a container's SecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatReportOptionsSecurityOptionsPodSecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by the containers in this pod.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsPodSecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The SELinux context to be applied to all containers.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in SecurityContext.  If set in
/// both SecurityContext and PodSecurityContext, the value specified in SecurityContext
/// takes precedence for that container.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsPodSecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by the containers in this pod.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsPodSecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// Sysctl defines a kernel parameter to be set
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsPodSecurityContextSysctls {
    /// Name of a property to set
    pub name: String,
    /// Value of a property to set
    pub value: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options within a container's SecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsPodSecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Security Context to apply to the Cryostat report generator container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsReportsSecurityContext {
    /// AllowPrivilegeEscalation controls whether a process can gain more
    /// privileges than its parent process. This bool directly controls if
    /// the no_new_privs flag will be set on the container process.
    /// AllowPrivilegeEscalation is true always when the container is:
    /// 1) run as Privileged
    /// 2) has CAP_SYS_ADMIN
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowPrivilegeEscalation")]
    pub allow_privilege_escalation: Option<bool>,
    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
    /// overrides the pod's appArmorProfile.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatReportOptionsSecurityOptionsReportsSecurityContextAppArmorProfile>,
    /// The capabilities to add/drop when running containers.
    /// Defaults to the default set of capabilities granted by the container runtime.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<CryostatReportOptionsSecurityOptionsReportsSecurityContextCapabilities>,
    /// Run container in privileged mode.
    /// Processes in privileged containers are essentially equivalent to root on the host.
    /// Defaults to false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub privileged: Option<bool>,
    /// procMount denotes the type of proc mount to use for the containers.
    /// The default value is Default which uses the container runtime defaults for
    /// readonly paths and masked paths.
    /// This requires the ProcMountType feature flag to be enabled.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
    pub proc_mount: Option<String>,
    /// Whether this container has a read-only root filesystem.
    /// Default is false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnlyRootFilesystem")]
    pub read_only_root_filesystem: Option<bool>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to the container.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatReportOptionsSecurityOptionsReportsSecurityContextSeLinuxOptions>,
    /// The seccomp options to use by this container. If seccomp options are
    /// provided at both the pod & container level, the container options
    /// override the pod options.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatReportOptionsSecurityOptionsReportsSecurityContextSeccompProfile>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options from the PodSecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatReportOptionsSecurityOptionsReportsSecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
/// overrides the pod's appArmorProfile.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsReportsSecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The capabilities to add/drop when running containers.
/// Defaults to the default set of capabilities granted by the container runtime.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsReportsSecurityContextCapabilities {
    /// Added capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub add: Option<Vec<String>>,
    /// Removed capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drop: Option<Vec<String>>,
}

/// The SELinux context to be applied to the container.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
/// PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsReportsSecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by this container. If seccomp options are
/// provided at both the pod & container level, the container options
/// override the pod options.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsReportsSecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options from the PodSecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatReportOptionsSecurityOptionsReportsSecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Resource requirements for the Cryostat deployment. Default resource requests will be added to each
/// container unless specified. Default resource limits will be added to each container if neither
/// resource requests or limits are specified.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResources {
    /// Resource requirements for the agent proxy container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "agentProxyResources")]
    pub agent_proxy_resources: Option<CryostatResourcesAgentProxyResources>,
    /// Resource requirements for the auth proxy.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authProxyResources")]
    pub auth_proxy_resources: Option<CryostatResourcesAuthProxyResources>,
    /// Resource requirements for the Cryostat application. If specifying a memory limit, at least 384MiB is recommended.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "coreResources")]
    pub core_resources: Option<CryostatResourcesCoreResources>,
    /// Resource requirements for the JFR Data Source container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSourceResources")]
    pub data_source_resources: Option<CryostatResourcesDataSourceResources>,
    /// Resource requirements for the database container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "databaseResources")]
    pub database_resources: Option<CryostatResourcesDatabaseResources>,
    /// Resource requirements for the Grafana container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "grafanaResources")]
    pub grafana_resources: Option<CryostatResourcesGrafanaResources>,
    /// Resource requirements for the object storage container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "objectStorageResources")]
    pub object_storage_resources: Option<CryostatResourcesObjectStorageResources>,
}

/// Resource requirements for the agent proxy container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesAgentProxyResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatResourcesAgentProxyResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesAgentProxyResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Resource requirements for the auth proxy.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesAuthProxyResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatResourcesAuthProxyResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesAuthProxyResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Resource requirements for the Cryostat application. If specifying a memory limit, at least 384MiB is recommended.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesCoreResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatResourcesCoreResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesCoreResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Resource requirements for the JFR Data Source container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesDataSourceResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatResourcesDataSourceResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesDataSourceResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Resource requirements for the database container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesDatabaseResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatResourcesDatabaseResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesDatabaseResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Resource requirements for the Grafana container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesGrafanaResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatResourcesGrafanaResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesGrafanaResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Resource requirements for the object storage container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesObjectStorageResources {
    /// Claims lists the names of resources, defined in spec.resourceClaims,
    /// that are used by this container.
    /// 
    /// This is an alpha field and requires enabling the
    /// DynamicResourceAllocation feature gate.
    /// 
    /// This field is immutable. It can only be set for containers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub claims: Option<Vec<CryostatResourcesObjectStorageResourcesClaims>>,
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatResourcesObjectStorageResourcesClaims {
    /// Name must match the name of one entry in pod.spec.resourceClaims of
    /// the Pod where this field is used. It makes that resource available
    /// inside a container.
    pub name: String,
    /// Request is the name chosen for a request in the referenced claim.
    /// If empty, everything from the claim is made available, otherwise
    /// only the result of this request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request: Option<String>,
}

/// Options to configure scheduling for the Cryostat deployment
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptions {
    /// Affinity rules for scheduling Cryostat pods.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub affinity: Option<CryostatSchedulingOptionsAffinity>,
    /// Label selector used to schedule a Cryostat pod to a node. See: <https://kubernetes.io/docs/concepts/configuration/assign-pod-node/>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "nodeSelector")]
    pub node_selector: Option<BTreeMap<String, String>>,
    /// Tolerations to allow scheduling of Cryostat pods to tainted nodes. See: <https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tolerations: Option<Vec<CryostatSchedulingOptionsTolerations>>,
}

/// Affinity rules for scheduling Cryostat pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinity {
    /// Node affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#NodeAffinity>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "nodeAffinity")]
    pub node_affinity: Option<CryostatSchedulingOptionsAffinityNodeAffinity>,
    /// Pod affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodAffinity>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "podAffinity")]
    pub pod_affinity: Option<CryostatSchedulingOptionsAffinityPodAffinity>,
    /// Pod anti-affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodAntiAffinity>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "podAntiAffinity")]
    pub pod_anti_affinity: Option<CryostatSchedulingOptionsAffinityPodAntiAffinity>,
}

/// Node affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#NodeAffinity>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinity {
    /// The scheduler will prefer to schedule pods to nodes that satisfy
    /// the affinity expressions specified by this field, but it may choose
    /// a node that violates one or more of the expressions. The node that is
    /// most preferred is the one with the greatest sum of weights, i.e.
    /// for each node that meets all of the scheduling requirements (resource
    /// request, requiredDuringScheduling affinity expressions, etc.),
    /// compute a sum by iterating through the elements of this field and adding
    /// "weight" to the sum if the node matches the corresponding matchExpressions; the
    /// node(s) with the highest sum are the most preferred.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "preferredDuringSchedulingIgnoredDuringExecution")]
    pub preferred_during_scheduling_ignored_during_execution: Option<Vec<CryostatSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecution>>,
    /// If the affinity requirements specified by this field are not met at
    /// scheduling time, the pod will not be scheduled onto the node.
    /// If the affinity requirements specified by this field cease to be met
    /// at some point during pod execution (e.g. due to an update), the system
    /// may or may not try to eventually evict the pod from its node.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "requiredDuringSchedulingIgnoredDuringExecution")]
    pub required_during_scheduling_ignored_during_execution: Option<CryostatSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecution>,
}

/// An empty preferred scheduling term matches all objects with implicit weight 0
/// (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecution {
    /// A node selector term, associated with the corresponding weight.
    pub preference: CryostatSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreference,
    /// Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
    pub weight: i32,
}

/// A node selector term, associated with the corresponding weight.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreference {
    /// A list of node selector requirements by node's labels.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreferenceMatchExpressions>>,
    /// A list of node selector requirements by node's fields.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchFields")]
    pub match_fields: Option<Vec<CryostatSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreferenceMatchFields>>,
}

/// A node selector requirement is a selector that contains values, a key, and an operator
/// that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreferenceMatchExpressions {
    /// The label key that the selector applies to.
    pub key: String,
    /// Represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    pub operator: String,
    /// An array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. If the operator is Gt or Lt, the values
    /// array must have a single element, which will be interpreted as an integer.
    /// This array is replaced during a strategic merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A node selector requirement is a selector that contains values, a key, and an operator
/// that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinityPreferredDuringSchedulingIgnoredDuringExecutionPreferenceMatchFields {
    /// The label key that the selector applies to.
    pub key: String,
    /// Represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    pub operator: String,
    /// An array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. If the operator is Gt or Lt, the values
    /// array must have a single element, which will be interpreted as an integer.
    /// This array is replaced during a strategic merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// If the affinity requirements specified by this field are not met at
/// scheduling time, the pod will not be scheduled onto the node.
/// If the affinity requirements specified by this field cease to be met
/// at some point during pod execution (e.g. due to an update), the system
/// may or may not try to eventually evict the pod from its node.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecution {
    /// Required. A list of node selector terms. The terms are ORed.
    #[serde(rename = "nodeSelectorTerms")]
    pub node_selector_terms: Vec<CryostatSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTerms>,
}

/// A null or empty node selector term matches no objects. The requirements of
/// them are ANDed.
/// The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTerms {
    /// A list of node selector requirements by node's labels.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTermsMatchExpressions>>,
    /// A list of node selector requirements by node's fields.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchFields")]
    pub match_fields: Option<Vec<CryostatSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTermsMatchFields>>,
}

/// A node selector requirement is a selector that contains values, a key, and an operator
/// that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTermsMatchExpressions {
    /// The label key that the selector applies to.
    pub key: String,
    /// Represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    pub operator: String,
    /// An array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. If the operator is Gt or Lt, the values
    /// array must have a single element, which will be interpreted as an integer.
    /// This array is replaced during a strategic merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A node selector requirement is a selector that contains values, a key, and an operator
/// that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityNodeAffinityRequiredDuringSchedulingIgnoredDuringExecutionNodeSelectorTermsMatchFields {
    /// The label key that the selector applies to.
    pub key: String,
    /// Represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    pub operator: String,
    /// An array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. If the operator is Gt or Lt, the values
    /// array must have a single element, which will be interpreted as an integer.
    /// This array is replaced during a strategic merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Pod affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodAffinity>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinity {
    /// The scheduler will prefer to schedule pods to nodes that satisfy
    /// the affinity expressions specified by this field, but it may choose
    /// a node that violates one or more of the expressions. The node that is
    /// most preferred is the one with the greatest sum of weights, i.e.
    /// for each node that meets all of the scheduling requirements (resource
    /// request, requiredDuringScheduling affinity expressions, etc.),
    /// compute a sum by iterating through the elements of this field and adding
    /// "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
    /// node(s) with the highest sum are the most preferred.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "preferredDuringSchedulingIgnoredDuringExecution")]
    pub preferred_during_scheduling_ignored_during_execution: Option<Vec<CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecution>>,
    /// If the affinity requirements specified by this field are not met at
    /// scheduling time, the pod will not be scheduled onto the node.
    /// If the affinity requirements specified by this field cease to be met
    /// at some point during pod execution (e.g. due to a pod label update), the
    /// system may or may not try to eventually evict the pod from its node.
    /// When there are multiple elements, the lists of nodes corresponding to each
    /// podAffinityTerm are intersected, i.e. all terms must be satisfied.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "requiredDuringSchedulingIgnoredDuringExecution")]
    pub required_during_scheduling_ignored_during_execution: Option<Vec<CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecution>>,
}

/// The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecution {
    /// Required. A pod affinity term, associated with the corresponding weight.
    #[serde(rename = "podAffinityTerm")]
    pub pod_affinity_term: CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTerm,
    /// weight associated with matching the corresponding podAffinityTerm,
    /// in the range 1-100.
    pub weight: i32,
}

/// Required. A pod affinity term, associated with the corresponding weight.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTerm {
    /// A label query over a set of resources, in this case pods.
    /// If it's null, this PodAffinityTerm matches with no Pods.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelector>,
    /// MatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both matchLabelKeys and labelSelector.
    /// Also, matchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabelKeys")]
    pub match_label_keys: Option<Vec<String>>,
    /// MismatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
    /// Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mismatchLabelKeys")]
    pub mismatch_label_keys: Option<Vec<String>>,
    /// A label query over the set of namespaces that the term applies to.
    /// The term is applied to the union of the namespaces selected by this field
    /// and the ones listed in the namespaces field.
    /// null selector and null or empty namespaces list means "this pod's namespace".
    /// An empty selector ({}) matches all namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>,
    /// namespaces specifies a static list of namespace names that the term applies to.
    /// The term is applied to the union of the namespaces listed in this field
    /// and the ones selected by namespaceSelector.
    /// null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
    /// the labelSelector in the specified namespaces, where co-located is defined as running on a node
    /// whose value of the label with key topologyKey matches that of any node on which any of the
    /// selected pods is running.
    /// Empty topologyKey is not allowed.
    #[serde(rename = "topologyKey")]
    pub topology_key: String,
}

/// A label query over a set of resources, in this case pods.
/// If it's null, this PodAffinityTerm matches with no Pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label query over the set of namespaces that the term applies to.
/// The term is applied to the union of the namespaces selected by this field
/// and the ones listed in the namespaces field.
/// null selector and null or empty namespaces list means "this pod's namespace".
/// An empty selector ({}) matches all namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Defines a set of pods (namely those matching the labelSelector
/// relative to the given namespace(s)) that this pod should be
/// co-located (affinity) or not co-located (anti-affinity) with,
/// where co-located is defined as running on a node whose value of
/// the label with key <topologyKey> matches that of any node on which
/// a pod of the set of pods is running
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecution {
    /// A label query over a set of resources, in this case pods.
    /// If it's null, this PodAffinityTerm matches with no Pods.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelector>,
    /// MatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both matchLabelKeys and labelSelector.
    /// Also, matchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabelKeys")]
    pub match_label_keys: Option<Vec<String>>,
    /// MismatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
    /// Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mismatchLabelKeys")]
    pub mismatch_label_keys: Option<Vec<String>>,
    /// A label query over the set of namespaces that the term applies to.
    /// The term is applied to the union of the namespaces selected by this field
    /// and the ones listed in the namespaces field.
    /// null selector and null or empty namespaces list means "this pod's namespace".
    /// An empty selector ({}) matches all namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>,
    /// namespaces specifies a static list of namespace names that the term applies to.
    /// The term is applied to the union of the namespaces listed in this field
    /// and the ones selected by namespaceSelector.
    /// null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
    /// the labelSelector in the specified namespaces, where co-located is defined as running on a node
    /// whose value of the label with key topologyKey matches that of any node on which any of the
    /// selected pods is running.
    /// Empty topologyKey is not allowed.
    #[serde(rename = "topologyKey")]
    pub topology_key: String,
}

/// A label query over a set of resources, in this case pods.
/// If it's null, this PodAffinityTerm matches with no Pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label query over the set of namespaces that the term applies to.
/// The term is applied to the union of the namespaces selected by this field
/// and the ones listed in the namespaces field.
/// null selector and null or empty namespaces list means "this pod's namespace".
/// An empty selector ({}) matches all namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Pod anti-affinity scheduling rules for a Cryostat pod. See: <https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodAntiAffinity>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinity {
    /// The scheduler will prefer to schedule pods to nodes that satisfy
    /// the anti-affinity expressions specified by this field, but it may choose
    /// a node that violates one or more of the expressions. The node that is
    /// most preferred is the one with the greatest sum of weights, i.e.
    /// for each node that meets all of the scheduling requirements (resource
    /// request, requiredDuringScheduling anti-affinity expressions, etc.),
    /// compute a sum by iterating through the elements of this field and adding
    /// "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
    /// node(s) with the highest sum are the most preferred.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "preferredDuringSchedulingIgnoredDuringExecution")]
    pub preferred_during_scheduling_ignored_during_execution: Option<Vec<CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecution>>,
    /// If the anti-affinity requirements specified by this field are not met at
    /// scheduling time, the pod will not be scheduled onto the node.
    /// If the anti-affinity requirements specified by this field cease to be met
    /// at some point during pod execution (e.g. due to a pod label update), the
    /// system may or may not try to eventually evict the pod from its node.
    /// When there are multiple elements, the lists of nodes corresponding to each
    /// podAffinityTerm are intersected, i.e. all terms must be satisfied.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "requiredDuringSchedulingIgnoredDuringExecution")]
    pub required_during_scheduling_ignored_during_execution: Option<Vec<CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecution>>,
}

/// The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecution {
    /// Required. A pod affinity term, associated with the corresponding weight.
    #[serde(rename = "podAffinityTerm")]
    pub pod_affinity_term: CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTerm,
    /// weight associated with matching the corresponding podAffinityTerm,
    /// in the range 1-100.
    pub weight: i32,
}

/// Required. A pod affinity term, associated with the corresponding weight.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTerm {
    /// A label query over a set of resources, in this case pods.
    /// If it's null, this PodAffinityTerm matches with no Pods.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelector>,
    /// MatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both matchLabelKeys and labelSelector.
    /// Also, matchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabelKeys")]
    pub match_label_keys: Option<Vec<String>>,
    /// MismatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
    /// Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mismatchLabelKeys")]
    pub mismatch_label_keys: Option<Vec<String>>,
    /// A label query over the set of namespaces that the term applies to.
    /// The term is applied to the union of the namespaces selected by this field
    /// and the ones listed in the namespaces field.
    /// null selector and null or empty namespaces list means "this pod's namespace".
    /// An empty selector ({}) matches all namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>,
    /// namespaces specifies a static list of namespace names that the term applies to.
    /// The term is applied to the union of the namespaces listed in this field
    /// and the ones selected by namespaceSelector.
    /// null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
    /// the labelSelector in the specified namespaces, where co-located is defined as running on a node
    /// whose value of the label with key topologyKey matches that of any node on which any of the
    /// selected pods is running.
    /// Empty topologyKey is not allowed.
    #[serde(rename = "topologyKey")]
    pub topology_key: String,
}

/// A label query over a set of resources, in this case pods.
/// If it's null, this PodAffinityTerm matches with no Pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermLabelSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label query over the set of namespaces that the term applies to.
/// The term is applied to the union of the namespaces selected by this field
/// and the ones listed in the namespaces field.
/// null selector and null or empty namespaces list means "this pod's namespace".
/// An empty selector ({}) matches all namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Defines a set of pods (namely those matching the labelSelector
/// relative to the given namespace(s)) that this pod should be
/// co-located (affinity) or not co-located (anti-affinity) with,
/// where co-located is defined as running on a node whose value of
/// the label with key <topologyKey> matches that of any node on which
/// a pod of the set of pods is running
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecution {
    /// A label query over a set of resources, in this case pods.
    /// If it's null, this PodAffinityTerm matches with no Pods.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "labelSelector")]
    pub label_selector: Option<CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelector>,
    /// MatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both matchLabelKeys and labelSelector.
    /// Also, matchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabelKeys")]
    pub match_label_keys: Option<Vec<String>>,
    /// MismatchLabelKeys is a set of pod label keys to select which pods will
    /// be taken into consideration. The keys are used to lookup values from the
    /// incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
    /// to select the group of existing pods which pods will be taken into consideration
    /// for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
    /// pod labels will be ignored. The default value is empty.
    /// The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
    /// Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
    /// This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "mismatchLabelKeys")]
    pub mismatch_label_keys: Option<Vec<String>>,
    /// A label query over the set of namespaces that the term applies to.
    /// The term is applied to the union of the namespaces selected by this field
    /// and the ones listed in the namespaces field.
    /// null selector and null or empty namespaces list means "this pod's namespace".
    /// An empty selector ({}) matches all namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>,
    /// namespaces specifies a static list of namespace names that the term applies to.
    /// The term is applied to the union of the namespaces listed in this field
    /// and the ones selected by namespaceSelector.
    /// null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
    /// the labelSelector in the specified namespaces, where co-located is defined as running on a node
    /// whose value of the label with key topologyKey matches that of any node on which any of the
    /// selected pods is running.
    /// Empty topologyKey is not allowed.
    #[serde(rename = "topologyKey")]
    pub topology_key: String,
}

/// A label query over a set of resources, in this case pods.
/// If it's null, this PodAffinityTerm matches with no Pods.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionLabelSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label query over the set of namespaces that the term applies to.
/// The term is applied to the union of the namespaces selected by this field
/// and the ones listed in the namespaces field.
/// null selector and null or empty namespaces list means "this pod's namespace".
/// An empty selector ({}) matches all namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// The pod this Toleration is attached to tolerates any taint that matches
/// the triple <key,value,effect> using the matching operator <operator>.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSchedulingOptionsTolerations {
    /// Effect indicates the taint effect to match. Empty means match all taint effects.
    /// When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub effect: Option<String>,
    /// Key is the taint key that the toleration applies to. Empty means match all taint keys.
    /// If the key is empty, operator must be Exists; this combination means to match all values and all keys.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// Operator represents a key's relationship to the value.
    /// Valid operators are Exists and Equal. Defaults to Equal.
    /// Exists is equivalent to wildcard for value, so that a pod can
    /// tolerate all taints of a particular category.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub operator: Option<String>,
    /// TolerationSeconds represents the period of time the toleration (which must be
    /// of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
    /// it is not set, which means tolerate the taint forever (do not evict). Zero and
    /// negative values will be treated as 0 (evict immediately) by the system.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tolerationSeconds")]
    pub toleration_seconds: Option<i64>,
    /// Value is the taint value the toleration matches to.
    /// If the operator is Exists, the value should be empty, otherwise just a regular string.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// Options to configure the Security Contexts for the Cryostat application.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptions {
    /// Security Context to apply to the agent proxy container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "agentProxySecurityContext")]
    pub agent_proxy_security_context: Option<CryostatSecurityOptionsAgentProxySecurityContext>,
    /// Security Context to apply to the auth proxy container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authProxySecurityContext")]
    pub auth_proxy_security_context: Option<CryostatSecurityOptionsAuthProxySecurityContext>,
    /// Security Context to apply to the Cryostat application container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "coreSecurityContext")]
    pub core_security_context: Option<CryostatSecurityOptionsCoreSecurityContext>,
    /// Security Context to apply to the JFR Data Source container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSourceSecurityContext")]
    pub data_source_security_context: Option<CryostatSecurityOptionsDataSourceSecurityContext>,
    /// Security Context to apply to the database container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "databaseSecurityContext")]
    pub database_security_context: Option<CryostatSecurityOptionsDatabaseSecurityContext>,
    /// Security Context to apply to the Grafana container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "grafanaSecurityContext")]
    pub grafana_security_context: Option<CryostatSecurityOptionsGrafanaSecurityContext>,
    /// Security Context to apply to the Cryostat pod.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "podSecurityContext")]
    pub pod_security_context: Option<CryostatSecurityOptionsPodSecurityContext>,
    /// Security Context to apply to the storage container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageSecurityContext")]
    pub storage_security_context: Option<CryostatSecurityOptionsStorageSecurityContext>,
}

/// Security Context to apply to the agent proxy container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAgentProxySecurityContext {
    /// AllowPrivilegeEscalation controls whether a process can gain more
    /// privileges than its parent process. This bool directly controls if
    /// the no_new_privs flag will be set on the container process.
    /// AllowPrivilegeEscalation is true always when the container is:
    /// 1) run as Privileged
    /// 2) has CAP_SYS_ADMIN
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowPrivilegeEscalation")]
    pub allow_privilege_escalation: Option<bool>,
    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
    /// overrides the pod's appArmorProfile.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatSecurityOptionsAgentProxySecurityContextAppArmorProfile>,
    /// The capabilities to add/drop when running containers.
    /// Defaults to the default set of capabilities granted by the container runtime.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<CryostatSecurityOptionsAgentProxySecurityContextCapabilities>,
    /// Run container in privileged mode.
    /// Processes in privileged containers are essentially equivalent to root on the host.
    /// Defaults to false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub privileged: Option<bool>,
    /// procMount denotes the type of proc mount to use for the containers.
    /// The default value is Default which uses the container runtime defaults for
    /// readonly paths and masked paths.
    /// This requires the ProcMountType feature flag to be enabled.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
    pub proc_mount: Option<String>,
    /// Whether this container has a read-only root filesystem.
    /// Default is false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnlyRootFilesystem")]
    pub read_only_root_filesystem: Option<bool>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to the container.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatSecurityOptionsAgentProxySecurityContextSeLinuxOptions>,
    /// The seccomp options to use by this container. If seccomp options are
    /// provided at both the pod & container level, the container options
    /// override the pod options.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatSecurityOptionsAgentProxySecurityContextSeccompProfile>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options from the PodSecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatSecurityOptionsAgentProxySecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
/// overrides the pod's appArmorProfile.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAgentProxySecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The capabilities to add/drop when running containers.
/// Defaults to the default set of capabilities granted by the container runtime.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAgentProxySecurityContextCapabilities {
    /// Added capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub add: Option<Vec<String>>,
    /// Removed capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drop: Option<Vec<String>>,
}

/// The SELinux context to be applied to the container.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
/// PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAgentProxySecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by this container. If seccomp options are
/// provided at both the pod & container level, the container options
/// override the pod options.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAgentProxySecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options from the PodSecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAgentProxySecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Security Context to apply to the auth proxy container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAuthProxySecurityContext {
    /// AllowPrivilegeEscalation controls whether a process can gain more
    /// privileges than its parent process. This bool directly controls if
    /// the no_new_privs flag will be set on the container process.
    /// AllowPrivilegeEscalation is true always when the container is:
    /// 1) run as Privileged
    /// 2) has CAP_SYS_ADMIN
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowPrivilegeEscalation")]
    pub allow_privilege_escalation: Option<bool>,
    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
    /// overrides the pod's appArmorProfile.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatSecurityOptionsAuthProxySecurityContextAppArmorProfile>,
    /// The capabilities to add/drop when running containers.
    /// Defaults to the default set of capabilities granted by the container runtime.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<CryostatSecurityOptionsAuthProxySecurityContextCapabilities>,
    /// Run container in privileged mode.
    /// Processes in privileged containers are essentially equivalent to root on the host.
    /// Defaults to false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub privileged: Option<bool>,
    /// procMount denotes the type of proc mount to use for the containers.
    /// The default value is Default which uses the container runtime defaults for
    /// readonly paths and masked paths.
    /// This requires the ProcMountType feature flag to be enabled.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
    pub proc_mount: Option<String>,
    /// Whether this container has a read-only root filesystem.
    /// Default is false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnlyRootFilesystem")]
    pub read_only_root_filesystem: Option<bool>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to the container.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatSecurityOptionsAuthProxySecurityContextSeLinuxOptions>,
    /// The seccomp options to use by this container. If seccomp options are
    /// provided at both the pod & container level, the container options
    /// override the pod options.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatSecurityOptionsAuthProxySecurityContextSeccompProfile>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options from the PodSecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatSecurityOptionsAuthProxySecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
/// overrides the pod's appArmorProfile.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAuthProxySecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The capabilities to add/drop when running containers.
/// Defaults to the default set of capabilities granted by the container runtime.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAuthProxySecurityContextCapabilities {
    /// Added capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub add: Option<Vec<String>>,
    /// Removed capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drop: Option<Vec<String>>,
}

/// The SELinux context to be applied to the container.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
/// PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAuthProxySecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by this container. If seccomp options are
/// provided at both the pod & container level, the container options
/// override the pod options.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAuthProxySecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options from the PodSecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsAuthProxySecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Security Context to apply to the Cryostat application container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsCoreSecurityContext {
    /// AllowPrivilegeEscalation controls whether a process can gain more
    /// privileges than its parent process. This bool directly controls if
    /// the no_new_privs flag will be set on the container process.
    /// AllowPrivilegeEscalation is true always when the container is:
    /// 1) run as Privileged
    /// 2) has CAP_SYS_ADMIN
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowPrivilegeEscalation")]
    pub allow_privilege_escalation: Option<bool>,
    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
    /// overrides the pod's appArmorProfile.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatSecurityOptionsCoreSecurityContextAppArmorProfile>,
    /// The capabilities to add/drop when running containers.
    /// Defaults to the default set of capabilities granted by the container runtime.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<CryostatSecurityOptionsCoreSecurityContextCapabilities>,
    /// Run container in privileged mode.
    /// Processes in privileged containers are essentially equivalent to root on the host.
    /// Defaults to false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub privileged: Option<bool>,
    /// procMount denotes the type of proc mount to use for the containers.
    /// The default value is Default which uses the container runtime defaults for
    /// readonly paths and masked paths.
    /// This requires the ProcMountType feature flag to be enabled.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
    pub proc_mount: Option<String>,
    /// Whether this container has a read-only root filesystem.
    /// Default is false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnlyRootFilesystem")]
    pub read_only_root_filesystem: Option<bool>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to the container.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatSecurityOptionsCoreSecurityContextSeLinuxOptions>,
    /// The seccomp options to use by this container. If seccomp options are
    /// provided at both the pod & container level, the container options
    /// override the pod options.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatSecurityOptionsCoreSecurityContextSeccompProfile>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options from the PodSecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatSecurityOptionsCoreSecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
/// overrides the pod's appArmorProfile.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsCoreSecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The capabilities to add/drop when running containers.
/// Defaults to the default set of capabilities granted by the container runtime.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsCoreSecurityContextCapabilities {
    /// Added capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub add: Option<Vec<String>>,
    /// Removed capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drop: Option<Vec<String>>,
}

/// The SELinux context to be applied to the container.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
/// PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsCoreSecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by this container. If seccomp options are
/// provided at both the pod & container level, the container options
/// override the pod options.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsCoreSecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options from the PodSecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsCoreSecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Security Context to apply to the JFR Data Source container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDataSourceSecurityContext {
    /// AllowPrivilegeEscalation controls whether a process can gain more
    /// privileges than its parent process. This bool directly controls if
    /// the no_new_privs flag will be set on the container process.
    /// AllowPrivilegeEscalation is true always when the container is:
    /// 1) run as Privileged
    /// 2) has CAP_SYS_ADMIN
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowPrivilegeEscalation")]
    pub allow_privilege_escalation: Option<bool>,
    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
    /// overrides the pod's appArmorProfile.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatSecurityOptionsDataSourceSecurityContextAppArmorProfile>,
    /// The capabilities to add/drop when running containers.
    /// Defaults to the default set of capabilities granted by the container runtime.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<CryostatSecurityOptionsDataSourceSecurityContextCapabilities>,
    /// Run container in privileged mode.
    /// Processes in privileged containers are essentially equivalent to root on the host.
    /// Defaults to false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub privileged: Option<bool>,
    /// procMount denotes the type of proc mount to use for the containers.
    /// The default value is Default which uses the container runtime defaults for
    /// readonly paths and masked paths.
    /// This requires the ProcMountType feature flag to be enabled.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
    pub proc_mount: Option<String>,
    /// Whether this container has a read-only root filesystem.
    /// Default is false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnlyRootFilesystem")]
    pub read_only_root_filesystem: Option<bool>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to the container.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatSecurityOptionsDataSourceSecurityContextSeLinuxOptions>,
    /// The seccomp options to use by this container. If seccomp options are
    /// provided at both the pod & container level, the container options
    /// override the pod options.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatSecurityOptionsDataSourceSecurityContextSeccompProfile>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options from the PodSecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatSecurityOptionsDataSourceSecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
/// overrides the pod's appArmorProfile.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDataSourceSecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The capabilities to add/drop when running containers.
/// Defaults to the default set of capabilities granted by the container runtime.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDataSourceSecurityContextCapabilities {
    /// Added capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub add: Option<Vec<String>>,
    /// Removed capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drop: Option<Vec<String>>,
}

/// The SELinux context to be applied to the container.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
/// PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDataSourceSecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by this container. If seccomp options are
/// provided at both the pod & container level, the container options
/// override the pod options.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDataSourceSecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options from the PodSecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDataSourceSecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Security Context to apply to the database container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDatabaseSecurityContext {
    /// AllowPrivilegeEscalation controls whether a process can gain more
    /// privileges than its parent process. This bool directly controls if
    /// the no_new_privs flag will be set on the container process.
    /// AllowPrivilegeEscalation is true always when the container is:
    /// 1) run as Privileged
    /// 2) has CAP_SYS_ADMIN
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowPrivilegeEscalation")]
    pub allow_privilege_escalation: Option<bool>,
    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
    /// overrides the pod's appArmorProfile.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatSecurityOptionsDatabaseSecurityContextAppArmorProfile>,
    /// The capabilities to add/drop when running containers.
    /// Defaults to the default set of capabilities granted by the container runtime.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<CryostatSecurityOptionsDatabaseSecurityContextCapabilities>,
    /// Run container in privileged mode.
    /// Processes in privileged containers are essentially equivalent to root on the host.
    /// Defaults to false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub privileged: Option<bool>,
    /// procMount denotes the type of proc mount to use for the containers.
    /// The default value is Default which uses the container runtime defaults for
    /// readonly paths and masked paths.
    /// This requires the ProcMountType feature flag to be enabled.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
    pub proc_mount: Option<String>,
    /// Whether this container has a read-only root filesystem.
    /// Default is false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnlyRootFilesystem")]
    pub read_only_root_filesystem: Option<bool>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to the container.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatSecurityOptionsDatabaseSecurityContextSeLinuxOptions>,
    /// The seccomp options to use by this container. If seccomp options are
    /// provided at both the pod & container level, the container options
    /// override the pod options.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatSecurityOptionsDatabaseSecurityContextSeccompProfile>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options from the PodSecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatSecurityOptionsDatabaseSecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
/// overrides the pod's appArmorProfile.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDatabaseSecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The capabilities to add/drop when running containers.
/// Defaults to the default set of capabilities granted by the container runtime.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDatabaseSecurityContextCapabilities {
    /// Added capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub add: Option<Vec<String>>,
    /// Removed capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drop: Option<Vec<String>>,
}

/// The SELinux context to be applied to the container.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
/// PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDatabaseSecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by this container. If seccomp options are
/// provided at both the pod & container level, the container options
/// override the pod options.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDatabaseSecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options from the PodSecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsDatabaseSecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Security Context to apply to the Grafana container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsGrafanaSecurityContext {
    /// AllowPrivilegeEscalation controls whether a process can gain more
    /// privileges than its parent process. This bool directly controls if
    /// the no_new_privs flag will be set on the container process.
    /// AllowPrivilegeEscalation is true always when the container is:
    /// 1) run as Privileged
    /// 2) has CAP_SYS_ADMIN
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowPrivilegeEscalation")]
    pub allow_privilege_escalation: Option<bool>,
    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
    /// overrides the pod's appArmorProfile.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatSecurityOptionsGrafanaSecurityContextAppArmorProfile>,
    /// The capabilities to add/drop when running containers.
    /// Defaults to the default set of capabilities granted by the container runtime.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<CryostatSecurityOptionsGrafanaSecurityContextCapabilities>,
    /// Run container in privileged mode.
    /// Processes in privileged containers are essentially equivalent to root on the host.
    /// Defaults to false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub privileged: Option<bool>,
    /// procMount denotes the type of proc mount to use for the containers.
    /// The default value is Default which uses the container runtime defaults for
    /// readonly paths and masked paths.
    /// This requires the ProcMountType feature flag to be enabled.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
    pub proc_mount: Option<String>,
    /// Whether this container has a read-only root filesystem.
    /// Default is false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnlyRootFilesystem")]
    pub read_only_root_filesystem: Option<bool>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to the container.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatSecurityOptionsGrafanaSecurityContextSeLinuxOptions>,
    /// The seccomp options to use by this container. If seccomp options are
    /// provided at both the pod & container level, the container options
    /// override the pod options.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatSecurityOptionsGrafanaSecurityContextSeccompProfile>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options from the PodSecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatSecurityOptionsGrafanaSecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
/// overrides the pod's appArmorProfile.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsGrafanaSecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The capabilities to add/drop when running containers.
/// Defaults to the default set of capabilities granted by the container runtime.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsGrafanaSecurityContextCapabilities {
    /// Added capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub add: Option<Vec<String>>,
    /// Removed capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drop: Option<Vec<String>>,
}

/// The SELinux context to be applied to the container.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
/// PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsGrafanaSecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by this container. If seccomp options are
/// provided at both the pod & container level, the container options
/// override the pod options.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsGrafanaSecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options from the PodSecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsGrafanaSecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Security Context to apply to the Cryostat pod.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsPodSecurityContext {
    /// appArmorProfile is the AppArmor options to use by the containers in this pod.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatSecurityOptionsPodSecurityContextAppArmorProfile>,
    /// A special supplemental group that applies to all containers in a pod.
    /// Some volume types allow the Kubelet to change the ownership of that volume
    /// to be owned by the pod:
    /// 
    /// 1. The owning GID will be the FSGroup
    /// 2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
    /// 3. The permission bits are OR'd with rw-rw----
    /// 
    /// If unset, the Kubelet will not modify the ownership and permissions of any volume.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fsGroup")]
    pub fs_group: Option<i64>,
    /// fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
    /// before being exposed inside Pod. This field will only apply to
    /// volume types which support fsGroup based ownership(and permissions).
    /// It will have no effect on ephemeral volume types such as: secret, configmaps
    /// and emptydir.
    /// Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fsGroupChangePolicy")]
    pub fs_group_change_policy: Option<String>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in SecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence
    /// for that container.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in SecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in SecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence
    /// for that container.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to all containers.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in SecurityContext.  If set in
    /// both SecurityContext and PodSecurityContext, the value specified in SecurityContext
    /// takes precedence for that container.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatSecurityOptionsPodSecurityContextSeLinuxOptions>,
    /// The seccomp options to use by the containers in this pod.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatSecurityOptionsPodSecurityContextSeccompProfile>,
    /// A list of groups applied to the first process run in each container, in
    /// addition to the container's primary GID and fsGroup (if specified).  If
    /// the SupplementalGroupsPolicy feature is enabled, the
    /// supplementalGroupsPolicy field determines whether these are in addition
    /// to or instead of any group memberships defined in the container image.
    /// If unspecified, no additional groups are added, though group memberships
    /// defined in the container image may still be used, depending on the
    /// supplementalGroupsPolicy field.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "supplementalGroups")]
    pub supplemental_groups: Option<Vec<i64>>,
    /// Defines how supplemental groups of the first container processes are calculated.
    /// Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
    /// (Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
    /// and the container runtime must implement support for this feature.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "supplementalGroupsPolicy")]
    pub supplemental_groups_policy: Option<String>,
    /// Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
    /// sysctls (by the container runtime) might fail to launch.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub sysctls: Option<Vec<CryostatSecurityOptionsPodSecurityContextSysctls>>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options within a container's SecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatSecurityOptionsPodSecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by the containers in this pod.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsPodSecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The SELinux context to be applied to all containers.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in SecurityContext.  If set in
/// both SecurityContext and PodSecurityContext, the value specified in SecurityContext
/// takes precedence for that container.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsPodSecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by the containers in this pod.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsPodSecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// Sysctl defines a kernel parameter to be set
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsPodSecurityContextSysctls {
    /// Name of a property to set
    pub name: String,
    /// Value of a property to set
    pub value: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options within a container's SecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsPodSecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Security Context to apply to the storage container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsStorageSecurityContext {
    /// AllowPrivilegeEscalation controls whether a process can gain more
    /// privileges than its parent process. This bool directly controls if
    /// the no_new_privs flag will be set on the container process.
    /// AllowPrivilegeEscalation is true always when the container is:
    /// 1) run as Privileged
    /// 2) has CAP_SYS_ADMIN
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "allowPrivilegeEscalation")]
    pub allow_privilege_escalation: Option<bool>,
    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile
    /// overrides the pod's appArmorProfile.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appArmorProfile")]
    pub app_armor_profile: Option<CryostatSecurityOptionsStorageSecurityContextAppArmorProfile>,
    /// The capabilities to add/drop when running containers.
    /// Defaults to the default set of capabilities granted by the container runtime.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<CryostatSecurityOptionsStorageSecurityContextCapabilities>,
    /// Run container in privileged mode.
    /// Processes in privileged containers are essentially equivalent to root on the host.
    /// Defaults to false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub privileged: Option<bool>,
    /// procMount denotes the type of proc mount to use for the containers.
    /// The default value is Default which uses the container runtime defaults for
    /// readonly paths and masked paths.
    /// This requires the ProcMountType feature flag to be enabled.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "procMount")]
    pub proc_mount: Option<String>,
    /// Whether this container has a read-only root filesystem.
    /// Default is false.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnlyRootFilesystem")]
    pub read_only_root_filesystem: Option<bool>,
    /// The GID to run the entrypoint of the container process.
    /// Uses runtime default if unset.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsGroup")]
    pub run_as_group: Option<i64>,
    /// Indicates that the container must run as a non-root user.
    /// If true, the Kubelet will validate the image at runtime to ensure that it
    /// does not run as UID 0 (root) and fail to start the container if it does.
    /// If unset or false, no such validation will be performed.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsNonRoot")]
    pub run_as_non_root: Option<bool>,
    /// The UID to run the entrypoint of the container process.
    /// Defaults to user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUser")]
    pub run_as_user: Option<i64>,
    /// The SELinux context to be applied to the container.
    /// If unspecified, the container runtime will allocate a random SELinux context for each
    /// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seLinuxOptions")]
    pub se_linux_options: Option<CryostatSecurityOptionsStorageSecurityContextSeLinuxOptions>,
    /// The seccomp options to use by this container. If seccomp options are
    /// provided at both the pod & container level, the container options
    /// override the pod options.
    /// Note that this field cannot be set when spec.os.name is windows.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "seccompProfile")]
    pub seccomp_profile: Option<CryostatSecurityOptionsStorageSecurityContextSeccompProfile>,
    /// The Windows specific settings applied to all containers.
    /// If unspecified, the options from the PodSecurityContext will be used.
    /// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    /// Note that this field cannot be set when spec.os.name is linux.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "windowsOptions")]
    pub windows_options: Option<CryostatSecurityOptionsStorageSecurityContextWindowsOptions>,
}

/// appArmorProfile is the AppArmor options to use by this container. If set, this profile
/// overrides the pod's appArmorProfile.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsStorageSecurityContextAppArmorProfile {
    /// localhostProfile indicates a profile loaded on the node that should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must match the loaded name of the profile.
    /// Must be set if and only if type is "Localhost".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of AppArmor profile will be applied.
    /// Valid options are:
    ///   Localhost - a profile pre-loaded on the node.
    ///   RuntimeDefault - the container runtime's default profile.
    ///   Unconfined - no AppArmor enforcement.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The capabilities to add/drop when running containers.
/// Defaults to the default set of capabilities granted by the container runtime.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsStorageSecurityContextCapabilities {
    /// Added capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub add: Option<Vec<String>>,
    /// Removed capabilities
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drop: Option<Vec<String>>,
}

/// The SELinux context to be applied to the container.
/// If unspecified, the container runtime will allocate a random SELinux context for each
/// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
/// PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsStorageSecurityContextSeLinuxOptions {
    /// Level is SELinux level label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub level: Option<String>,
    /// Role is a SELinux role label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Type is a SELinux type label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "type")]
    pub r#type: Option<String>,
    /// User is a SELinux user label that applies to the container.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub user: Option<String>,
}

/// The seccomp options to use by this container. If seccomp options are
/// provided at both the pod & container level, the container options
/// override the pod options.
/// Note that this field cannot be set when spec.os.name is windows.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsStorageSecurityContextSeccompProfile {
    /// localhostProfile indicates a profile defined in a file on the node should be used.
    /// The profile must be preconfigured on the node to work.
    /// Must be a descending path, relative to the kubelet's configured seccomp profile location.
    /// Must be set if type is "Localhost". Must NOT be set for any other type.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "localhostProfile")]
    pub localhost_profile: Option<String>,
    /// type indicates which kind of seccomp profile will be applied.
    /// Valid options are:
    /// 
    /// Localhost - a profile defined in a file on the node should be used.
    /// RuntimeDefault - the container runtime default profile should be used.
    /// Unconfined - no profile should be applied.
    #[serde(rename = "type")]
    pub r#type: String,
}

/// The Windows specific settings applied to all containers.
/// If unspecified, the options from the PodSecurityContext will be used.
/// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
/// Note that this field cannot be set when spec.os.name is linux.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatSecurityOptionsStorageSecurityContextWindowsOptions {
    /// GMSACredentialSpec is where the GMSA admission webhook
    /// (<https://github.com/kubernetes-sigs/windows-gmsa)> inlines the contents of the
    /// GMSA credential spec named by the GMSACredentialSpecName field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpec")]
    pub gmsa_credential_spec: Option<String>,
    /// GMSACredentialSpecName is the name of the GMSA credential spec to use.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gmsaCredentialSpecName")]
    pub gmsa_credential_spec_name: Option<String>,
    /// HostProcess determines if a container should be run as a 'Host Process' container.
    /// All of a Pod's containers must have the same effective HostProcess value
    /// (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
    /// In addition, if HostProcess is true then HostNetwork must also be set to true.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostProcess")]
    pub host_process: Option<bool>,
    /// The UserName in Windows to run the entrypoint of the container process.
    /// Defaults to the user specified in image metadata if unspecified.
    /// May also be set in PodSecurityContext. If set in both SecurityContext and
    /// PodSecurityContext, the value specified in SecurityContext takes precedence.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "runAsUserName")]
    pub run_as_user_name: Option<String>,
}

/// Options to customize the services created for the Cryostat application.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatServiceOptions {
    /// Specification for the headless services in each target namespace that allow Cryostat
    /// to communicate with agents in those namespaces.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "agentCallbackConfig")]
    pub agent_callback_config: Option<CryostatServiceOptionsAgentCallbackConfig>,
    /// Specification for the service responsible for agents to communicate with Cryostat.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "agentGatewayConfig")]
    pub agent_gateway_config: Option<CryostatServiceOptionsAgentGatewayConfig>,
    /// Specification for the service responsible for the Cryostat application.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "coreConfig")]
    pub core_config: Option<CryostatServiceOptionsCoreConfig>,
    /// Specification for the service responsible for the cryostat application's database.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "databaseConfig")]
    pub database_config: Option<CryostatServiceOptionsDatabaseConfig>,
    /// Specification for the service responsible for the cryostat-reports sidecars.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "reportsConfig")]
    pub reports_config: Option<CryostatServiceOptionsReportsConfig>,
    /// Specification for the service responsible for the storage to be created by the operator.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageConfig")]
    pub storage_config: Option<CryostatServiceOptionsStorageConfig>,
}

/// Specification for the headless services in each target namespace that allow Cryostat
/// to communicate with agents in those namespaces.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatServiceOptionsAgentCallbackConfig {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
}

/// Specification for the service responsible for agents to communicate with Cryostat.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatServiceOptionsAgentGatewayConfig {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// HTTP port number for the Cryostat agent API service.
    /// Defaults to 8282.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "httpPort")]
    pub http_port: Option<i32>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    /// Type of service to create. Defaults to "ClusterIP".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceType")]
    pub service_type: Option<String>,
}

/// Specification for the service responsible for the Cryostat application.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatServiceOptionsCoreConfig {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// HTTP port number for the Cryostat application service.
    /// Defaults to 8181.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "httpPort")]
    pub http_port: Option<i32>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    /// Type of service to create. Defaults to "ClusterIP".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceType")]
    pub service_type: Option<String>,
}

/// Specification for the service responsible for the cryostat application's database.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatServiceOptionsDatabaseConfig {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// DatabasePort number for the cryostat application's database.
    /// Defaults to 5432.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "databasePort")]
    pub database_port: Option<i32>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    /// Type of service to create. Defaults to "ClusterIP".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceType")]
    pub service_type: Option<String>,
}

/// Specification for the service responsible for the cryostat-reports sidecars.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatServiceOptionsReportsConfig {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// HTTP port number for the cryostat-reports service.
    /// Defaults to 10000.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "httpPort")]
    pub http_port: Option<i32>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    /// Type of service to create. Defaults to "ClusterIP".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceType")]
    pub service_type: Option<String>,
}

/// Specification for the service responsible for the storage to be created by the operator.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatServiceOptionsStorageConfig {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// HTTP port number for the storage to be created by the operator.
    /// Defaults to 8333.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "httpPort")]
    pub http_port: Option<i32>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    /// Type of service to create. Defaults to "ClusterIP".
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceType")]
    pub service_type: Option<String>,
}

/// Options to customize the storage provisioned for the database and object storage.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptions {
    /// Configuration for the Persistent Volume Claim to be created by the operator for the database.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub database: Option<CryostatStorageOptionsDatabase>,
    /// Configuration for an EmptyDir to be created
    /// by the operator instead of a PVC.
    /// Deprecated: use storageOptions.database and storageOptions.objectStorage
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "emptyDir")]
    pub empty_dir: Option<CryostatStorageOptionsEmptyDir>,
    /// Configuration for the Persistent Volume Claim to be created by the operator for the object storage.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "objectStorage")]
    pub object_storage: Option<CryostatStorageOptionsObjectStorage>,
    /// Configuration for the Persistent Volume Claim to be created
    /// by the operator.
    /// Deprecated: use storageOptions.database and storageOptions.objectStorage
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub pvc: Option<CryostatStorageOptionsPvc>,
}

/// Configuration for the Persistent Volume Claim to be created by the operator for the database.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabase {
    /// Configuration for an EmptyDir to be created
    /// by the operator instead of a PVC.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "emptyDir")]
    pub empty_dir: Option<CryostatStorageOptionsDatabaseEmptyDir>,
    /// Configuration for the Persistent Volume Claim to be created
    /// by the operator.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub pvc: Option<CryostatStorageOptionsDatabasePvc>,
}

/// Configuration for an EmptyDir to be created
/// by the operator instead of a PVC.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabaseEmptyDir {
    /// When enabled, Cryostat will use EmptyDir volumes instead of a Persistent Volume Claim. Any PVC configurations will be ignored.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub enabled: Option<bool>,
    /// Unless specified, the emptyDir volume will be mounted on
    /// the same storage medium backing the node. Setting this field to
    /// "Memory" will mount the emptyDir on a tmpfs (RAM-backed filesystem).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub medium: Option<String>,
    /// The maximum memory limit for the emptyDir. Default is unbounded.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "sizeLimit")]
    pub size_limit: Option<String>,
}

/// Configuration for the Persistent Volume Claim to be created
/// by the operator.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabasePvc {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    /// Spec for a Persistent Volume Claim, whose options will override the
    /// defaults used by the operator. Unless overriden, the PVC will be
    /// created with the default Storage Class and 500MiB of storage.
    /// Once the operator has created the PVC, changes to this field have
    /// no effect.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub spec: Option<CryostatStorageOptionsDatabasePvcSpec>,
}

/// Spec for a Persistent Volume Claim, whose options will override the
/// defaults used by the operator. Unless overriden, the PVC will be
/// created with the default Storage Class and 500MiB of storage.
/// Once the operator has created the PVC, changes to this field have
/// no effect.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabasePvcSpec {
    /// accessModes contains the desired access modes the volume should have.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessModes")]
    pub access_modes: Option<Vec<String>>,
    /// dataSource field can be used to specify either:
    /// * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
    /// * An existing PVC (PersistentVolumeClaim)
    /// If the provisioner or an external controller can support the specified data source,
    /// it will create a new volume based on the contents of the specified data source.
    /// When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
    /// and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
    /// If the namespace is specified, then dataSourceRef will not be copied to dataSource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSource")]
    pub data_source: Option<CryostatStorageOptionsDatabasePvcSpecDataSource>,
    /// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
    /// volume is desired. This may be any object from a non-empty API group (non
    /// core object) or a PersistentVolumeClaim object.
    /// When this field is specified, volume binding will only succeed if the type of
    /// the specified object matches some installed volume populator or dynamic
    /// provisioner.
    /// This field will replace the functionality of the dataSource field and as such
    /// if both fields are non-empty, they must have the same value. For backwards
    /// compatibility, when namespace isn't specified in dataSourceRef,
    /// both fields (dataSource and dataSourceRef) will be set to the same
    /// value automatically if one of them is empty and the other is non-empty.
    /// When namespace is specified in dataSourceRef,
    /// dataSource isn't set to the same value and must be empty.
    /// There are three important differences between dataSource and dataSourceRef:
    /// * While dataSource only allows two specific types of objects, dataSourceRef
    ///   allows any non-core object, as well as PersistentVolumeClaim objects.
    /// * While dataSource ignores disallowed values (dropping them), dataSourceRef
    ///   preserves all values, and generates an error if a disallowed value is
    ///   specified.
    /// * While dataSource only allows local objects, dataSourceRef allows objects
    ///   in any namespaces.
    /// (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
    /// (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSourceRef")]
    pub data_source_ref: Option<CryostatStorageOptionsDatabasePvcSpecDataSourceRef>,
    /// resources represents the minimum resources the volume should have.
    /// If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
    /// that are lower than previous value but must still be higher than capacity recorded in the
    /// status field of the claim.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resources: Option<CryostatStorageOptionsDatabasePvcSpecResources>,
    /// selector is a label query over volumes to consider for binding.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub selector: Option<CryostatStorageOptionsDatabasePvcSpecSelector>,
    /// storageClassName is the name of the StorageClass required by the claim.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageClassName")]
    pub storage_class_name: Option<String>,
    /// volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
    /// If specified, the CSI driver will create or update the volume with the attributes defined
    /// in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
    /// it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
    /// will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
    /// If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
    /// will be set by the persistentvolume controller if it exists.
    /// If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
    /// set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
    /// exists.
    /// More info: <https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/>
    /// (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeAttributesClassName")]
    pub volume_attributes_class_name: Option<String>,
    /// volumeMode defines what type of volume is required by the claim.
    /// Value of Filesystem is implied when not included in claim spec.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeMode")]
    pub volume_mode: Option<String>,
    /// volumeName is the binding reference to the PersistentVolume backing this claim.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeName")]
    pub volume_name: Option<String>,
}

/// dataSource field can be used to specify either:
/// * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
/// * An existing PVC (PersistentVolumeClaim)
/// If the provisioner or an external controller can support the specified data source,
/// it will create a new volume based on the contents of the specified data source.
/// When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
/// and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
/// If the namespace is specified, then dataSourceRef will not be copied to dataSource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabasePvcSpecDataSource {
    /// APIGroup is the group for the resource being referenced.
    /// If APIGroup is not specified, the specified Kind must be in the core API group.
    /// For any other third-party types, APIGroup is required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
    pub api_group: Option<String>,
    /// Kind is the type of resource being referenced
    pub kind: String,
    /// Name is the name of resource being referenced
    pub name: String,
}

/// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
/// volume is desired. This may be any object from a non-empty API group (non
/// core object) or a PersistentVolumeClaim object.
/// When this field is specified, volume binding will only succeed if the type of
/// the specified object matches some installed volume populator or dynamic
/// provisioner.
/// This field will replace the functionality of the dataSource field and as such
/// if both fields are non-empty, they must have the same value. For backwards
/// compatibility, when namespace isn't specified in dataSourceRef,
/// both fields (dataSource and dataSourceRef) will be set to the same
/// value automatically if one of them is empty and the other is non-empty.
/// When namespace is specified in dataSourceRef,
/// dataSource isn't set to the same value and must be empty.
/// There are three important differences between dataSource and dataSourceRef:
/// * While dataSource only allows two specific types of objects, dataSourceRef
///   allows any non-core object, as well as PersistentVolumeClaim objects.
/// * While dataSource ignores disallowed values (dropping them), dataSourceRef
///   preserves all values, and generates an error if a disallowed value is
///   specified.
/// * While dataSource only allows local objects, dataSourceRef allows objects
///   in any namespaces.
/// (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
/// (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabasePvcSpecDataSourceRef {
    /// APIGroup is the group for the resource being referenced.
    /// If APIGroup is not specified, the specified Kind must be in the core API group.
    /// For any other third-party types, APIGroup is required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
    pub api_group: Option<String>,
    /// Kind is the type of resource being referenced
    pub kind: String,
    /// Name is the name of resource being referenced
    pub name: String,
    /// Namespace is the namespace of resource being referenced
    /// Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
    /// (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// resources represents the minimum resources the volume should have.
/// If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
/// that are lower than previous value but must still be higher than capacity recorded in the
/// status field of the claim.
/// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabasePvcSpecResources {
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// selector is a label query over volumes to consider for binding.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabasePvcSpecSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatStorageOptionsDatabasePvcSpecSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsDatabasePvcSpecSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Configuration for an EmptyDir to be created
/// by the operator instead of a PVC.
/// Deprecated: use storageOptions.database and storageOptions.objectStorage
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsEmptyDir {
    /// When enabled, Cryostat will use EmptyDir volumes instead of a Persistent Volume Claim. Any PVC configurations will be ignored.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub enabled: Option<bool>,
    /// Unless specified, the emptyDir volume will be mounted on
    /// the same storage medium backing the node. Setting this field to
    /// "Memory" will mount the emptyDir on a tmpfs (RAM-backed filesystem).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub medium: Option<String>,
    /// The maximum memory limit for the emptyDir. Default is unbounded.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "sizeLimit")]
    pub size_limit: Option<String>,
}

/// Configuration for the Persistent Volume Claim to be created by the operator for the object storage.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStorage {
    /// Configuration for an EmptyDir to be created
    /// by the operator instead of a PVC.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "emptyDir")]
    pub empty_dir: Option<CryostatStorageOptionsObjectStorageEmptyDir>,
    /// Configuration for the Persistent Volume Claim to be created
    /// by the operator.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub pvc: Option<CryostatStorageOptionsObjectStoragePvc>,
}

/// Configuration for an EmptyDir to be created
/// by the operator instead of a PVC.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStorageEmptyDir {
    /// When enabled, Cryostat will use EmptyDir volumes instead of a Persistent Volume Claim. Any PVC configurations will be ignored.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub enabled: Option<bool>,
    /// Unless specified, the emptyDir volume will be mounted on
    /// the same storage medium backing the node. Setting this field to
    /// "Memory" will mount the emptyDir on a tmpfs (RAM-backed filesystem).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub medium: Option<String>,
    /// The maximum memory limit for the emptyDir. Default is unbounded.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "sizeLimit")]
    pub size_limit: Option<String>,
}

/// Configuration for the Persistent Volume Claim to be created
/// by the operator.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStoragePvc {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    /// Spec for a Persistent Volume Claim, whose options will override the
    /// defaults used by the operator. Unless overriden, the PVC will be
    /// created with the default Storage Class and 500MiB of storage.
    /// Once the operator has created the PVC, changes to this field have
    /// no effect.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub spec: Option<CryostatStorageOptionsObjectStoragePvcSpec>,
}

/// Spec for a Persistent Volume Claim, whose options will override the
/// defaults used by the operator. Unless overriden, the PVC will be
/// created with the default Storage Class and 500MiB of storage.
/// Once the operator has created the PVC, changes to this field have
/// no effect.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStoragePvcSpec {
    /// accessModes contains the desired access modes the volume should have.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessModes")]
    pub access_modes: Option<Vec<String>>,
    /// dataSource field can be used to specify either:
    /// * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
    /// * An existing PVC (PersistentVolumeClaim)
    /// If the provisioner or an external controller can support the specified data source,
    /// it will create a new volume based on the contents of the specified data source.
    /// When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
    /// and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
    /// If the namespace is specified, then dataSourceRef will not be copied to dataSource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSource")]
    pub data_source: Option<CryostatStorageOptionsObjectStoragePvcSpecDataSource>,
    /// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
    /// volume is desired. This may be any object from a non-empty API group (non
    /// core object) or a PersistentVolumeClaim object.
    /// When this field is specified, volume binding will only succeed if the type of
    /// the specified object matches some installed volume populator or dynamic
    /// provisioner.
    /// This field will replace the functionality of the dataSource field and as such
    /// if both fields are non-empty, they must have the same value. For backwards
    /// compatibility, when namespace isn't specified in dataSourceRef,
    /// both fields (dataSource and dataSourceRef) will be set to the same
    /// value automatically if one of them is empty and the other is non-empty.
    /// When namespace is specified in dataSourceRef,
    /// dataSource isn't set to the same value and must be empty.
    /// There are three important differences between dataSource and dataSourceRef:
    /// * While dataSource only allows two specific types of objects, dataSourceRef
    ///   allows any non-core object, as well as PersistentVolumeClaim objects.
    /// * While dataSource ignores disallowed values (dropping them), dataSourceRef
    ///   preserves all values, and generates an error if a disallowed value is
    ///   specified.
    /// * While dataSource only allows local objects, dataSourceRef allows objects
    ///   in any namespaces.
    /// (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
    /// (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSourceRef")]
    pub data_source_ref: Option<CryostatStorageOptionsObjectStoragePvcSpecDataSourceRef>,
    /// resources represents the minimum resources the volume should have.
    /// If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
    /// that are lower than previous value but must still be higher than capacity recorded in the
    /// status field of the claim.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resources: Option<CryostatStorageOptionsObjectStoragePvcSpecResources>,
    /// selector is a label query over volumes to consider for binding.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub selector: Option<CryostatStorageOptionsObjectStoragePvcSpecSelector>,
    /// storageClassName is the name of the StorageClass required by the claim.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageClassName")]
    pub storage_class_name: Option<String>,
    /// volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
    /// If specified, the CSI driver will create or update the volume with the attributes defined
    /// in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
    /// it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
    /// will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
    /// If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
    /// will be set by the persistentvolume controller if it exists.
    /// If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
    /// set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
    /// exists.
    /// More info: <https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/>
    /// (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeAttributesClassName")]
    pub volume_attributes_class_name: Option<String>,
    /// volumeMode defines what type of volume is required by the claim.
    /// Value of Filesystem is implied when not included in claim spec.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeMode")]
    pub volume_mode: Option<String>,
    /// volumeName is the binding reference to the PersistentVolume backing this claim.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeName")]
    pub volume_name: Option<String>,
}

/// dataSource field can be used to specify either:
/// * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
/// * An existing PVC (PersistentVolumeClaim)
/// If the provisioner or an external controller can support the specified data source,
/// it will create a new volume based on the contents of the specified data source.
/// When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
/// and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
/// If the namespace is specified, then dataSourceRef will not be copied to dataSource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStoragePvcSpecDataSource {
    /// APIGroup is the group for the resource being referenced.
    /// If APIGroup is not specified, the specified Kind must be in the core API group.
    /// For any other third-party types, APIGroup is required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
    pub api_group: Option<String>,
    /// Kind is the type of resource being referenced
    pub kind: String,
    /// Name is the name of resource being referenced
    pub name: String,
}

/// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
/// volume is desired. This may be any object from a non-empty API group (non
/// core object) or a PersistentVolumeClaim object.
/// When this field is specified, volume binding will only succeed if the type of
/// the specified object matches some installed volume populator or dynamic
/// provisioner.
/// This field will replace the functionality of the dataSource field and as such
/// if both fields are non-empty, they must have the same value. For backwards
/// compatibility, when namespace isn't specified in dataSourceRef,
/// both fields (dataSource and dataSourceRef) will be set to the same
/// value automatically if one of them is empty and the other is non-empty.
/// When namespace is specified in dataSourceRef,
/// dataSource isn't set to the same value and must be empty.
/// There are three important differences between dataSource and dataSourceRef:
/// * While dataSource only allows two specific types of objects, dataSourceRef
///   allows any non-core object, as well as PersistentVolumeClaim objects.
/// * While dataSource ignores disallowed values (dropping them), dataSourceRef
///   preserves all values, and generates an error if a disallowed value is
///   specified.
/// * While dataSource only allows local objects, dataSourceRef allows objects
///   in any namespaces.
/// (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
/// (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStoragePvcSpecDataSourceRef {
    /// APIGroup is the group for the resource being referenced.
    /// If APIGroup is not specified, the specified Kind must be in the core API group.
    /// For any other third-party types, APIGroup is required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
    pub api_group: Option<String>,
    /// Kind is the type of resource being referenced
    pub kind: String,
    /// Name is the name of resource being referenced
    pub name: String,
    /// Namespace is the namespace of resource being referenced
    /// Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
    /// (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// resources represents the minimum resources the volume should have.
/// If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
/// that are lower than previous value but must still be higher than capacity recorded in the
/// status field of the claim.
/// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStoragePvcSpecResources {
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// selector is a label query over volumes to consider for binding.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStoragePvcSpecSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatStorageOptionsObjectStoragePvcSpecSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsObjectStoragePvcSpecSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Configuration for the Persistent Volume Claim to be created
/// by the operator.
/// Deprecated: use storageOptions.database and storageOptions.objectStorage
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsPvc {
    /// Annotations to add to the object during its creation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// Labels to add to the object during its creation.
    /// The following label keys are reserved for use by the operator:
    /// "app", "component", "app.kubernetes.io/name", "app.kubernetes.io/instance",
    /// "app.kubernetes.io/component", and "app.kubernetes.io/part-of".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    /// Spec for a Persistent Volume Claim, whose options will override the
    /// defaults used by the operator. Unless overriden, the PVC will be
    /// created with the default Storage Class and 500MiB of storage.
    /// Once the operator has created the PVC, changes to this field have
    /// no effect.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub spec: Option<CryostatStorageOptionsPvcSpec>,
}

/// Spec for a Persistent Volume Claim, whose options will override the
/// defaults used by the operator. Unless overriden, the PVC will be
/// created with the default Storage Class and 500MiB of storage.
/// Once the operator has created the PVC, changes to this field have
/// no effect.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsPvcSpec {
    /// accessModes contains the desired access modes the volume should have.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessModes")]
    pub access_modes: Option<Vec<String>>,
    /// dataSource field can be used to specify either:
    /// * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
    /// * An existing PVC (PersistentVolumeClaim)
    /// If the provisioner or an external controller can support the specified data source,
    /// it will create a new volume based on the contents of the specified data source.
    /// When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
    /// and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
    /// If the namespace is specified, then dataSourceRef will not be copied to dataSource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSource")]
    pub data_source: Option<CryostatStorageOptionsPvcSpecDataSource>,
    /// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
    /// volume is desired. This may be any object from a non-empty API group (non
    /// core object) or a PersistentVolumeClaim object.
    /// When this field is specified, volume binding will only succeed if the type of
    /// the specified object matches some installed volume populator or dynamic
    /// provisioner.
    /// This field will replace the functionality of the dataSource field and as such
    /// if both fields are non-empty, they must have the same value. For backwards
    /// compatibility, when namespace isn't specified in dataSourceRef,
    /// both fields (dataSource and dataSourceRef) will be set to the same
    /// value automatically if one of them is empty and the other is non-empty.
    /// When namespace is specified in dataSourceRef,
    /// dataSource isn't set to the same value and must be empty.
    /// There are three important differences between dataSource and dataSourceRef:
    /// * While dataSource only allows two specific types of objects, dataSourceRef
    ///   allows any non-core object, as well as PersistentVolumeClaim objects.
    /// * While dataSource ignores disallowed values (dropping them), dataSourceRef
    ///   preserves all values, and generates an error if a disallowed value is
    ///   specified.
    /// * While dataSource only allows local objects, dataSourceRef allows objects
    ///   in any namespaces.
    /// (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
    /// (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSourceRef")]
    pub data_source_ref: Option<CryostatStorageOptionsPvcSpecDataSourceRef>,
    /// resources represents the minimum resources the volume should have.
    /// If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
    /// that are lower than previous value but must still be higher than capacity recorded in the
    /// status field of the claim.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resources: Option<CryostatStorageOptionsPvcSpecResources>,
    /// selector is a label query over volumes to consider for binding.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub selector: Option<CryostatStorageOptionsPvcSpecSelector>,
    /// storageClassName is the name of the StorageClass required by the claim.
    /// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageClassName")]
    pub storage_class_name: Option<String>,
    /// volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
    /// If specified, the CSI driver will create or update the volume with the attributes defined
    /// in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
    /// it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
    /// will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
    /// If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
    /// will be set by the persistentvolume controller if it exists.
    /// If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
    /// set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
    /// exists.
    /// More info: <https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/>
    /// (Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeAttributesClassName")]
    pub volume_attributes_class_name: Option<String>,
    /// volumeMode defines what type of volume is required by the claim.
    /// Value of Filesystem is implied when not included in claim spec.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeMode")]
    pub volume_mode: Option<String>,
    /// volumeName is the binding reference to the PersistentVolume backing this claim.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeName")]
    pub volume_name: Option<String>,
}

/// dataSource field can be used to specify either:
/// * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
/// * An existing PVC (PersistentVolumeClaim)
/// If the provisioner or an external controller can support the specified data source,
/// it will create a new volume based on the contents of the specified data source.
/// When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
/// and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
/// If the namespace is specified, then dataSourceRef will not be copied to dataSource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsPvcSpecDataSource {
    /// APIGroup is the group for the resource being referenced.
    /// If APIGroup is not specified, the specified Kind must be in the core API group.
    /// For any other third-party types, APIGroup is required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
    pub api_group: Option<String>,
    /// Kind is the type of resource being referenced
    pub kind: String,
    /// Name is the name of resource being referenced
    pub name: String,
}

/// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
/// volume is desired. This may be any object from a non-empty API group (non
/// core object) or a PersistentVolumeClaim object.
/// When this field is specified, volume binding will only succeed if the type of
/// the specified object matches some installed volume populator or dynamic
/// provisioner.
/// This field will replace the functionality of the dataSource field and as such
/// if both fields are non-empty, they must have the same value. For backwards
/// compatibility, when namespace isn't specified in dataSourceRef,
/// both fields (dataSource and dataSourceRef) will be set to the same
/// value automatically if one of them is empty and the other is non-empty.
/// When namespace is specified in dataSourceRef,
/// dataSource isn't set to the same value and must be empty.
/// There are three important differences between dataSource and dataSourceRef:
/// * While dataSource only allows two specific types of objects, dataSourceRef
///   allows any non-core object, as well as PersistentVolumeClaim objects.
/// * While dataSource ignores disallowed values (dropping them), dataSourceRef
///   preserves all values, and generates an error if a disallowed value is
///   specified.
/// * While dataSource only allows local objects, dataSourceRef allows objects
///   in any namespaces.
/// (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
/// (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsPvcSpecDataSourceRef {
    /// APIGroup is the group for the resource being referenced.
    /// If APIGroup is not specified, the specified Kind must be in the core API group.
    /// For any other third-party types, APIGroup is required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
    pub api_group: Option<String>,
    /// Kind is the type of resource being referenced
    pub kind: String,
    /// Name is the name of resource being referenced
    pub name: String,
    /// Namespace is the namespace of resource being referenced
    /// Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
    /// (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// resources represents the minimum resources the volume should have.
/// If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
/// that are lower than previous value but must still be higher than capacity recorded in the
/// status field of the claim.
/// More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsPvcSpecResources {
    /// Limits describes the maximum amount of compute resources allowed.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub limits: Option<BTreeMap<String, IntOrString>>,
    /// Requests describes the minimum amount of compute resources required.
    /// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    /// otherwise to an implementation-defined value. Requests cannot exceed Limits.
    /// More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub requests: Option<BTreeMap<String, IntOrString>>,
}

/// selector is a label query over volumes to consider for binding.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsPvcSpecSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<CryostatStorageOptionsPvcSpecSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStorageOptionsPvcSpecSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Options to customize the target connections cache for the Cryostat application.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatTargetConnectionCacheOptions {
    /// The maximum number of target connections to cache. Use `-1` for an unlimited cache size (TTL expiration only). Defaults to `-1`.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "targetCacheSize")]
    pub target_cache_size: Option<i32>,
    /// The time to live (in seconds) for cached target connections. Defaults to `10`.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "targetCacheTTL")]
    pub target_cache_ttl: Option<i32>,
}

/// Options to configure the Cryostat application's target discovery mechanisms.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatTargetDiscoveryOptions {
    /// When true, the Cryostat application will disable the built-in discovery mechanisms. Defaults to false
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "disableBuiltInDiscovery")]
    pub disable_built_in_discovery: Option<bool>,
    /// When false and discoveryPortNames is empty, the Cryostat application will use the default port name jfr-jmx to look for JMX connectable targets. Defaults to false.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "disableBuiltInPortNames")]
    pub disable_built_in_port_names: Option<bool>,
    /// When false and discoveryPortNumbers is empty, the Cryostat application will use the default port number 9091 to look for JMX connectable targets. Defaults to false.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "disableBuiltInPortNumbers")]
    pub disable_built_in_port_numbers: Option<bool>,
    /// List of port names that the Cryostat application should look for in order to consider a target as JMX connectable.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "discoveryPortNames")]
    pub discovery_port_names: Option<Vec<String>>,
    /// List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "discoveryPortNumbers")]
    pub discovery_port_numbers: Option<Vec<i64>>,
}

#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatTrustedCertSecrets {
    /// Key within secret containing the certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "certificateKey")]
    pub certificate_key: Option<String>,
    /// Name of secret in the local namespace.
    #[serde(rename = "secretName")]
    pub secret_name: String,
}

/// CryostatStatus defines the observed state of Cryostat.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct CryostatStatus {
    /// Address of the deployed Cryostat web application.
    #[serde(rename = "applicationUrl")]
    pub application_url: String,
    /// Conditions of the components managed by the Cryostat Operator.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
    /// Name of the Secret containing the Cryostat database connection and encryption keys.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "databaseSecret")]
    pub database_secret: Option<String>,
    /// Name of the Secret containing the Cryostat storage connection key.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "storageSecret")]
    pub storage_secret: Option<String>,
    /// List of namespaces that Cryostat has been configured
    /// and authorized to access and profile.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "targetNamespaces")]
    pub target_namespaces: Option<Vec<String>>,
}