/*
Copyright (c) 2021 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// This file was autogenerated by go-to-protobuf. Do not edit it manually!

syntax = 'proto2';

package github.com.gardener.gardener.pkg.apis.core.v1beta1;

import "k8s.io/api/autoscaling/v1/generated.proto";
import "k8s.io/api/core/v1/generated.proto";
import "k8s.io/api/rbac/v1/generated.proto";
import "k8s.io/apimachinery/pkg/api/resource/generated.proto";
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
import "k8s.io/apimachinery/pkg/util/intstr/generated.proto";

// Package-wide variables from generator "generated".
option go_package = "v1beta1";

// Addon allows enabling or disabling a specific addon and is used to derive from.
message Addon {
  // Enabled indicates whether the addon is enabled or not.
  optional bool enabled = 1;
}

// Addons is a collection of configuration for specific addons which are managed by the Gardener.
message Addons {
  // KubernetesDashboard holds configuration settings for the kubernetes dashboard addon.
  // +optional
  optional KubernetesDashboard kubernetesDashboard = 1;

  // NginxIngress holds configuration settings for the nginx-ingress addon.
  // +optional
  optional NginxIngress nginxIngress = 2;
}

// AdmissionPlugin contains information about a specific admission plugin and its corresponding configuration.
message AdmissionPlugin {
  // Name is the name of the plugin.
  optional string name = 1;

  // Config is the configuration of the plugin.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension config = 2;
}

// Alerting contains information about how alerting will be done (i.e. who will receive alerts and how).
message Alerting {
  // MonitoringEmailReceivers is a list of recipients for alerts
  // +optional
  repeated string emailReceivers = 1;
}

// AuditConfig contains settings for audit of the api server
message AuditConfig {
  // AuditPolicy contains configuration settings for audit policy of the kube-apiserver.
  // +optional
  optional AuditPolicy auditPolicy = 1;
}

// AuditPolicy contains audit policy for kube-apiserver
message AuditPolicy {
  // ConfigMapRef is a reference to a ConfigMap object in the same namespace,
  // which contains the audit policy for the kube-apiserver.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference configMapRef = 1;
}

// AvailabilityZone is an availability zone.
message AvailabilityZone {
  // Name is an an availability zone name.
  optional string name = 1;

  // UnavailableMachineTypes is a list of machine type names that are not availability in this zone.
  // +optional
  repeated string unavailableMachineTypes = 2;

  // UnavailableVolumeTypes is a list of volume type names that are not availability in this zone.
  // +optional
  repeated string unavailableVolumeTypes = 3;
}

// BackupBucket holds details about backup bucket
message BackupBucket {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Specification of the Backup Bucket.
  optional BackupBucketSpec spec = 2;

  // Most recently observed status of the Backup Bucket.
  optional BackupBucketStatus status = 3;
}

// BackupBucketList is a list of BackupBucket objects.
message BackupBucketList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of BackupBucket.
  repeated BackupBucket items = 2;
}

// BackupBucketProvider holds the details of cloud provider of the object store.
message BackupBucketProvider {
  // Type is the type of provider.
  optional string type = 1;

  // Region is the region of the bucket.
  optional string region = 2;
}

// BackupBucketSpec is the specification of a Backup Bucket.
message BackupBucketSpec {
  // Provider hold the details of cloud provider of the object store.
  optional BackupBucketProvider provider = 1;

  // ProviderConfig is the configuration passed to BackupBucket resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;

  // SecretRef is a reference to a secret that contains the credentials to access object store.
  optional k8s.io.api.core.v1.SecretReference secretRef = 3;

  // SeedName holds the name of the seed allocated to BackupBucket for running controller.
  // +optional
  optional string seedName = 4;
}

// BackupBucketStatus holds the most recently observed status of the Backup Bucket.
message BackupBucketStatus {
  // ProviderStatus is the configuration passed to BackupBucket resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerStatus = 1;

  // LastOperation holds information about the last operation on the BackupBucket.
  // +optional
  optional LastOperation lastOperation = 2;

  // LastError holds information about the last occurred error during an operation.
  // +optional
  optional LastError lastError = 3;

  // ObservedGeneration is the most recent generation observed for this BackupBucket. It corresponds to the
  // BackupBucket's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 4;

  // GeneratedSecretRef is reference to the secret generated by backup bucket, which
  // will have object store specific credentials.
  // +optional
  optional k8s.io.api.core.v1.SecretReference generatedSecretRef = 5;
}

// BackupEntry holds details about shoot backup.
message BackupEntry {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of the Backup Entry.
  // +optional
  optional BackupEntrySpec spec = 2;

  // Status contains the most recently observed status of the Backup Entry.
  // +optional
  optional BackupEntryStatus status = 3;
}

// BackupEntryList is a list of BackupEntry objects.
message BackupEntryList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of BackupEntry.
  repeated BackupEntry items = 2;
}

// BackupEntrySpec is the specification of a Backup Entry.
message BackupEntrySpec {
  // BucketName is the name of backup bucket for this Backup Entry.
  optional string bucketName = 1;

  // SeedName holds the name of the seed allocated to BackupEntry for running controller.
  // +optional
  optional string seedName = 2;
}

// BackupEntryStatus holds the most recently observed status of the Backup Entry.
message BackupEntryStatus {
  // LastOperation holds information about the last operation on the BackupEntry.
  // +optional
  optional LastOperation lastOperation = 1;

  // LastError holds information about the last occurred error during an operation.
  // +optional
  optional LastError lastError = 2;

  // ObservedGeneration is the most recent generation observed for this BackupEntry. It corresponds to the
  // BackupEntry's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 3;
}

// CRI contains information about the Container Runtimes.
message CRI {
  // The name of the CRI library
  optional string name = 1;

  // ContainerRuntimes is the list of the required container runtimes supported for a worker pool.
  // +optional
  repeated ContainerRuntime containerRuntimes = 2;
}

// CloudInfo contains information about the cloud
message CloudInfo {
  // Type is the cloud type
  optional string type = 1;

  // Region is the cloud region
  optional string region = 2;
}

// CloudProfile represents certain properties about a provider environment.
message CloudProfile {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec defines the provider environment properties.
  // +optional
  optional CloudProfileSpec spec = 2;
}

// CloudProfileList is a collection of CloudProfiles.
message CloudProfileList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of CloudProfiles.
  repeated CloudProfile items = 2;
}

// CloudProfileSpec is the specification of a CloudProfile.
// It must contain exactly one of its defined keys.
message CloudProfileSpec {
  // CABundle is a certificate bundle which will be installed onto every host machine of shoot cluster targeting this profile.
  // +optional
  optional string caBundle = 1;

  // Kubernetes contains constraints regarding allowed values of the 'kubernetes' block in the Shoot specification.
  optional KubernetesSettings kubernetes = 2;

  // MachineImages contains constraints regarding allowed values for machine images in the Shoot specification.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated MachineImage machineImages = 3;

  // MachineTypes contains constraints regarding allowed values for machine types in the 'workers' block in the Shoot specification.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated MachineType machineTypes = 4;

  // ProviderConfig contains provider-specific configuration for the profile.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 5;

  // Regions contains constraints regarding allowed values for regions and zones.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated Region regions = 6;

  // SeedSelector contains an optional list of labels on `Seed` resources that marks those seeds whose shoots may use this provider profile.
  // An empty list means that all seeds of the same provider type are supported.
  // This is useful for environments that are of the same type (like openstack) but may have different "instances"/landscapes.
  // Optionally a list of possible providers can be added to enable cross-provider scheduling. By default, the provider
  // type of the seed must match the shoot's provider.
  // +optional
  optional SeedSelector seedSelector = 7;

  // Type is the name of the provider.
  optional string type = 8;

  // VolumeTypes contains constraints regarding allowed values for volume types in the 'workers' block in the Shoot specification.
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated VolumeType volumeTypes = 9;
}

// ClusterAutoscaler contains the configuration flags for the Kubernetes cluster autoscaler.
message ClusterAutoscaler {
  // ScaleDownDelayAfterAdd defines how long after scale up that scale down evaluation resumes (default: 1 hour).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scaleDownDelayAfterAdd = 1;

  // ScaleDownDelayAfterDelete how long after node deletion that scale down evaluation resumes, defaults to scanInterval (defaults to ScanInterval).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scaleDownDelayAfterDelete = 2;

  // ScaleDownDelayAfterFailure how long after scale down failure that scale down evaluation resumes (default: 3 mins).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scaleDownDelayAfterFailure = 3;

  // ScaleDownUnneededTime defines how long a node should be unneeded before it is eligible for scale down (default: 30 mins).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scaleDownUnneededTime = 4;

  // ScaleDownUtilizationThreshold defines the threshold in % under which a node is being removed
  // +optional
  optional double scaleDownUtilizationThreshold = 5;

  // ScanInterval how often cluster is reevaluated for scale up or down (default: 10 secs).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration scanInterval = 6;
}

// ClusterInfo contains information about the Plant cluster
message ClusterInfo {
  // Cloud describes the cloud information
  optional CloudInfo cloud = 1;

  // Kubernetes describes kubernetes meta information (e.g., version)
  optional KubernetesInfo kubernetes = 2;
}

// Condition holds the information about the state of a resource.
message Condition {
  // Type of the Shoot condition.
  optional string type = 1;

  // Status of the condition, one of True, False, Unknown.
  optional string status = 2;

  // Last time the condition transitioned from one status to another.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;

  // Last time the condition was updated.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 4;

  // The reason for the condition's last transition.
  optional string reason = 5;

  // A human readable message indicating details about the transition.
  optional string message = 6;

  // Well-defined error codes in case the condition reports a problem.
  // +optional
  repeated string codes = 7;
}

// ContainerRuntime contains information about worker's available container runtime
message ContainerRuntime {
  // Type is the type of the Container Runtime.
  optional string type = 1;

  // ProviderConfig is the configuration passed to container runtime resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;
}

// ControllerDeployment contains information for how this controller is deployed.
message ControllerDeployment {
  // Type is the deployment type.
  optional string type = 1;

  // ProviderConfig contains type-specific configuration.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;

  // Policy controls how the controller is deployed. It defaults to 'OnDemand'.
  // +optional
  optional string policy = 3;

  // SeedSelector contains an optional label selector for seeds. Only if the labels match then this controller will be
  // considered for a deployment.
  // An empty list means that all seeds are selected.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector seedSelector = 4;
}

// ControllerInstallation represents an installation request for an external controller.
message ControllerInstallation {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of this installation.
  optional ControllerInstallationSpec spec = 2;

  // Status contains the status of this installation.
  optional ControllerInstallationStatus status = 3;
}

// ControllerInstallationList is a collection of ControllerInstallations.
message ControllerInstallationList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of ControllerInstallations.
  repeated ControllerInstallation items = 2;
}

// ControllerInstallationSpec is the specification of a ControllerInstallation.
message ControllerInstallationSpec {
  // RegistrationRef is used to reference a ControllerRegistration resources.
  optional k8s.io.api.core.v1.ObjectReference registrationRef = 1;

  // SeedRef is used to reference a Seed resources.
  optional k8s.io.api.core.v1.ObjectReference seedRef = 2;
}

// ControllerInstallationStatus is the status of a ControllerInstallation.
message ControllerInstallationStatus {
  // Conditions represents the latest available observations of a ControllerInstallations's current state.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated Condition conditions = 1;

  // ProviderStatus contains type-specific status.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerStatus = 2;
}

// ControllerRegistration represents a registration of an external controller.
message ControllerRegistration {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of this registration.
  optional ControllerRegistrationSpec spec = 2;
}

// ControllerRegistrationList is a collection of ControllerRegistrations.
message ControllerRegistrationList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of ControllerRegistrations.
  repeated ControllerRegistration items = 2;
}

// ControllerRegistrationSpec is the specification of a ControllerRegistration.
message ControllerRegistrationSpec {
  // Resources is a list of combinations of kinds (DNSProvider, Infrastructure, Generic, ...) and their actual types
  // (aws-route53, gcp, auditlog, ...).
  // +optional
  repeated ControllerResource resources = 1;

  // Deployment contains information for how this controller is deployed.
  // +optional
  optional ControllerDeployment deployment = 2;
}

// ControllerResource is a combination of a kind (DNSProvider, Infrastructure, Generic, ...) and the actual type for this
// kind (aws-route53, gcp, auditlog, ...).
message ControllerResource {
  // Kind is the resource kind, for example "OperatingSystemConfig".
  optional string kind = 1;

  // Type is the resource type, for example "coreos" or "ubuntu".
  optional string type = 2;

  // GloballyEnabled determines if this ControllerResource is required by all Shoot clusters.
  // +optional
  optional bool globallyEnabled = 3;

  // ReconcileTimeout defines how long Gardener should wait for the resource reconciliation.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration reconcileTimeout = 4;

  // Primary determines if the controller backed by this ControllerRegistration is responsible for the extension
  // resource's lifecycle. This field defaults to true. There must be exactly one primary controller for this kind/type
  // combination.
  // +optional
  optional bool primary = 5;
}

// DNS holds information about the provider, the hosted zone id and the domain.
message DNS {
  // Domain is the external available domain of the Shoot cluster. This domain will be written into the
  // kubeconfig that is handed out to end-users. Once set it is immutable.
  // +optional
  optional string domain = 1;

  // Providers is a list of DNS providers that shall be enabled for this shoot cluster. Only relevant if
  // not a default domain is used.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated DNSProvider providers = 2;
}

message DNSIncludeExclude {
  // Include is a list of resources that shall be included.
  // +optional
  repeated string include = 1;

  // Exclude is a list of resources that shall be excluded.
  // +optional
  repeated string exclude = 2;
}

// DNSProvider contains information about a DNS provider.
message DNSProvider {
  // Domains contains information about which domains shall be included/excluded for this provider.
  // +optional
  optional DNSIncludeExclude domains = 1;

  // Primary indicates that this DNSProvider is used for shoot related domains.
  // +optional
  optional bool primary = 2;

  // SecretName is a name of a secret containing credentials for the stated domain and the
  // provider. When not specified, the Gardener will use the cloud provider credentials referenced
  // by the Shoot and try to find respective credentials there (primary provider only). Specifying this field may override
  // this behavior, i.e. forcing the Gardener to only look into the given secret.
  // +optional
  optional string secretName = 3;

  // Type is the DNS provider type.
  // +optional
  optional string type = 4;

  // Zones contains information about which hosted zones shall be included/excluded for this provider.
  // +optional
  optional DNSIncludeExclude zones = 5;
}

// DataVolume contains information about a data volume.
message DataVolume {
  // Name of the volume to make it referencable.
  optional string name = 1;

  // Type is the type of the volume.
  // +optional
  optional string type = 2;

  // VolumeSize is the size of the volume.
  optional string size = 3;

  // Encrypted determines if the volume should be encrypted.
  // +optional
  optional bool encrypted = 4;
}

// Endpoint is an endpoint for monitoring, logging and other services around the plant.
message Endpoint {
  // Name is the name of the endpoint
  optional string name = 1;

  // URL is the url of the endpoint
  optional string url = 2;

  // Purpose is the purpose of the endpoint
  optional string purpose = 3;
}

// ExpirableVersion contains a version and an expiration date.
message ExpirableVersion {
  // Version is the version identifier.
  optional string version = 1;

  // ExpirationDate defines the time at which this version expires.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time expirationDate = 2;

  // Classification defines the state of a version (preview, supported, deprecated)
  // +optional
  optional string classification = 3;
}

// Extension contains type and provider information for Shoot extensions.
message Extension {
  // Type is the type of the extension resource.
  optional string type = 1;

  // ProviderConfig is the configuration passed to extension resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;

  // Disabled allows to disable extensions that were marked as 'globally enabled' by Gardener administrators.
  // +optional
  optional bool disabled = 3;
}

// Gardener holds the information about the Gardener version that operated a resource.
message Gardener {
  // ID is the Docker container id of the Gardener which last acted on a resource.
  optional string id = 1;

  // Name is the hostname (pod name) of the Gardener which last acted on a resource.
  optional string name = 2;

  // Version is the version of the Gardener which last acted on a resource.
  optional string version = 3;
}

// Hibernation contains information whether the Shoot is suspended or not.
message Hibernation {
  // Enabled specifies whether the Shoot needs to be hibernated or not. If it is true, the Shoot's desired state is to be hibernated.
  // If it is false or nil, the Shoot's desired state is to be awaken.
  // +optional
  optional bool enabled = 1;

  // Schedules determine the hibernation schedules.
  // +optional
  repeated HibernationSchedule schedules = 2;
}

// HibernationSchedule determines the hibernation schedule of a Shoot.
// A Shoot will be regularly hibernated at each start time and will be woken up at each end time.
// Start or End can be omitted, though at least one of each has to be specified.
message HibernationSchedule {
  // Start is a Cron spec at which time a Shoot will be hibernated.
  // +optional
  optional string start = 1;

  // End is a Cron spec at which time a Shoot will be woken up.
  // +optional
  optional string end = 2;

  // Location is the time location in which both start and and shall be evaluated.
  // +optional
  optional string location = 3;
}

// HorizontalPodAutoscalerConfig contains horizontal pod autoscaler configuration settings for the kube-controller-manager.
// Note: Descriptions were taken from the Kubernetes documentation.
message HorizontalPodAutoscalerConfig {
  // The period after which a ready pod transition is considered to be the first.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration cpuInitializationPeriod = 1;

  // The period since last downscale, before another downscale can be performed in horizontal pod autoscaler.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration downscaleDelay = 2;

  // The configurable window at which the controller will choose the highest recommendation for autoscaling.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration downscaleStabilization = 3;

  // The configurable period at which the horizontal pod autoscaler considers a Pod “not yet ready” given that it’s unready and it has  transitioned to unready during that time.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration initialReadinessDelay = 4;

  // The period for syncing the number of pods in horizontal pod autoscaler.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration syncPeriod = 5;

  // The minimum change (from 1.0) in the desired-to-actual metrics ratio for the horizontal pod autoscaler to consider scaling.
  // +optional
  optional double tolerance = 6;

  // The period since last upscale, before another upscale can be performed in horizontal pod autoscaler.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration upscaleDelay = 7;
}

// Ingress configures the Ingress specific settings of the Seed cluster
message Ingress {
  // Domain specifies the IngressDomain of the Seed cluster pointing to the ingress controller endpoint. It will be used
  // to construct ingress URLs for system applications running in Shoot clusters. Once set this field is immutable.
  optional string domain = 1;

  // Controller configures a Gardener managed Ingress Controller listening on the ingressDomain
  optional IngressController controller = 2;
}

// IngressController enables a Gardener managed Ingress Controller listening on the ingressDomain
message IngressController {
  // Kind defines which kind of IngressController to use, for example `nginx`
  optional string kind = 1;

  // ProviderConfig specifies infrastructure specific configuration for the ingressController
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;
}

// KubeAPIServerConfig contains configuration settings for the kube-apiserver.
message KubeAPIServerConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // AdmissionPlugins contains the list of user-defined admission plugins (additional to those managed by Gardener), and, if desired, the corresponding
  // configuration.
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated AdmissionPlugin admissionPlugins = 2;

  // APIAudiences are the identifiers of the API. The service account token authenticator will
  // validate that tokens used against the API are bound to at least one of these audiences.
  // Defaults to ["kubernetes"].
  // +optional
  repeated string apiAudiences = 3;

  // AuditConfig contains configuration settings for the audit of the kube-apiserver.
  // +optional
  optional AuditConfig auditConfig = 4;

  // EnableBasicAuthentication defines whether basic authentication should be enabled for this cluster or not.
  // +optional
  optional bool enableBasicAuthentication = 5;

  // OIDCConfig contains configuration settings for the OIDC provider.
  // +optional
  optional OIDCConfig oidcConfig = 6;

  // RuntimeConfig contains information about enabled or disabled APIs.
  // +optional
  map<string, bool> runtimeConfig = 7;

  // ServiceAccountConfig contains configuration settings for the service account handling
  // of the kube-apiserver.
  // +optional
  optional ServiceAccountConfig serviceAccountConfig = 8;

  // WatchCacheSizes contains configuration of the API server's watch cache sizes.
  // Configuring these flags might be useful for large-scale Shoot clusters with a lot of parallel update requests
  // and a lot of watching controllers (e.g. large shooted Seed clusters). When the API server's watch cache's
  // capacity is too small to cope with the amount of update requests and watchers for a particular resource, it
  // might happen that controller watches are permanently stopped with `too old resource version` errors.
  // Starting from kubernetes v1.19, the API server's watch cache size is adapted dynamically and setting the watch
  // cache size flags will have no effect, except when setting it to 0 (which disables the watch cache).
  // +optional
  optional WatchCacheSizes watchCacheSizes = 9;

  // Requests contains configuration for request-specific settings for the kube-apiserver.
  // +optional
  optional KubeAPIServerRequests requests = 10;
}

// KubeAPIServerRequests contains configuration for request-specific settings for the kube-apiserver.
message KubeAPIServerRequests {
  // MaxNonMutatingInflight is the maximum number of non-mutating requests in flight at a given time. When the server
  // exceeds this, it rejects requests.
  // +optional
  optional int32 maxNonMutatingInflight = 1;

  // MaxMutatingInflight is the maximum number of mutating requests in flight at a given time. When the server
  // exceeds this, it rejects requests.
  // +optional
  optional int32 maxMutatingInflight = 2;
}

// KubeControllerManagerConfig contains configuration settings for the kube-controller-manager.
message KubeControllerManagerConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // HorizontalPodAutoscalerConfig contains horizontal pod autoscaler configuration settings for the kube-controller-manager.
  // +optional
  optional HorizontalPodAutoscalerConfig horizontalPodAutoscaler = 2;

  // NodeCIDRMaskSize defines the mask size for node cidr in cluster (default is 24)
  // +optional
  optional int32 nodeCIDRMaskSize = 3;

  // PodEvictionTimeout defines the grace period for deleting pods on failed nodes. Defaults to 2m.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration podEvictionTimeout = 4;
}

// KubeProxyConfig contains configuration settings for the kube-proxy.
message KubeProxyConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // Mode specifies which proxy mode to use.
  // defaults to IPTables.
  // +optional
  optional string mode = 2;
}

// KubeSchedulerConfig contains configuration settings for the kube-scheduler.
message KubeSchedulerConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // KubeMaxPDVols allows to configure the `KUBE_MAX_PD_VOLS` environment variable for the kube-scheduler.
  // Please find more information here: https://kubernetes.io/docs/concepts/storage/storage-limits/#custom-limits
  // Note that using this field is considered alpha-/experimental-level and is on your own risk. You should be aware
  // of all the side-effects and consequences when changing it.
  // +optional
  optional string kubeMaxPDVols = 2;
}

// KubeletConfig contains configuration settings for the kubelet.
message KubeletConfig {
  optional KubernetesConfig kubernetesConfig = 1;

  // CPUCFSQuota allows you to disable/enable CPU throttling for Pods.
  // +optional
  optional bool cpuCFSQuota = 2;

  // CPUManagerPolicy allows to set alternative CPU management policies (default: none).
  // +optional
  optional string cpuManagerPolicy = 3;

  // EvictionHard describes a set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a Pod eviction.
  // +optional
  // Default:
  //   memory.available:   "100Mi/1Gi/5%"
  //   nodefs.available:   "5%"
  //   nodefs.inodesFree:  "5%"
  //   imagefs.available:  "5%"
  //   imagefs.inodesFree: "5%"
  optional KubeletConfigEviction evictionHard = 4;

  // EvictionMaxPodGracePeriod describes the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met.
  // +optional
  // Default: 90
  optional int32 evictionMaxPodGracePeriod = 5;

  // EvictionMinimumReclaim configures the amount of resources below the configured eviction threshold that the kubelet attempts to reclaim whenever the kubelet observes resource pressure.
  // +optional
  // Default: 0 for each resource
  optional KubeletConfigEvictionMinimumReclaim evictionMinimumReclaim = 6;

  // EvictionPressureTransitionPeriod is the duration for which the kubelet has to wait before transitioning out of an eviction pressure condition.
  // +optional
  // Default: 4m0s
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration evictionPressureTransitionPeriod = 7;

  // EvictionSoft describes a set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a Pod eviction.
  // +optional
  // Default:
  //   memory.available:   "200Mi/1.5Gi/10%"
  //   nodefs.available:   "10%"
  //   nodefs.inodesFree:  "10%"
  //   imagefs.available:  "10%"
  //   imagefs.inodesFree: "10%"
  optional KubeletConfigEviction evictionSoft = 8;

  // EvictionSoftGracePeriod describes a set of eviction grace periods (e.g. memory.available=1m30s) that correspond to how long a soft eviction threshold must hold before triggering a Pod eviction.
  // +optional
  // Default:
  //   memory.available:   1m30s
  //   nodefs.available:   1m30s
  //   nodefs.inodesFree:  1m30s
  //   imagefs.available:  1m30s
  //   imagefs.inodesFree: 1m30s
  optional KubeletConfigEvictionSoftGracePeriod evictionSoftGracePeriod = 9;

  // MaxPods is the maximum number of Pods that are allowed by the Kubelet.
  // +optional
  // Default: 110
  optional int32 maxPods = 10;

  // PodPIDsLimit is the maximum number of process IDs per pod allowed by the kubelet.
  // +optional
  optional int64 podPidsLimit = 11;

  // ImagePullProgressDeadline describes the time limit under which if no pulling progress is made, the image pulling will be cancelled.
  // +optional
  // Default: 1m
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration imagePullProgressDeadline = 12;

  // FailSwapOn makes the Kubelet fail to start if swap is enabled on the node. (default true).
  // +optional
  optional bool failSwapOn = 13;

  // KubeReserved is the configuration for resources reserved for kubernetes node components (mainly kubelet and container runtime).
  // When updating these values, be aware that cgroup resizes may not succeed on active worker nodes. Look for the NodeAllocatableEnforced event to determine if the configuration was applied.
  // +optional
  // Default: cpu=80m,memory=1Gi,pid=20k
  optional KubeletConfigReserved kubeReserved = 14;

  // SystemReserved is the configuration for resources reserved for system processes not managed by kubernetes (e.g. journald).
  // When updating these values, be aware that cgroup resizes may not succeed on active worker nodes. Look for the NodeAllocatableEnforced event to determine if the configuration was applied.
  // +optional
  optional KubeletConfigReserved systemReserved = 15;
}

// KubeletConfigEviction contains kubelet eviction thresholds supporting either a resource.Quantity or a percentage based value.
message KubeletConfigEviction {
  // MemoryAvailable is the threshold for the free memory on the host server.
  // +optional
  optional string memoryAvailable = 1;

  // ImageFSAvailable is the threshold for the free disk space in the imagefs filesystem (docker images and container writable layers).
  // +optional
  optional string imageFSAvailable = 2;

  // ImageFSInodesFree is the threshold for the available inodes in the imagefs filesystem.
  // +optional
  optional string imageFSInodesFree = 3;

  // NodeFSAvailable is the threshold for the free disk space in the nodefs filesystem (docker volumes, logs, etc).
  // +optional
  optional string nodeFSAvailable = 4;

  // NodeFSInodesFree is the threshold for the available inodes in the nodefs filesystem.
  // +optional
  optional string nodeFSInodesFree = 5;
}

// KubeletConfigEvictionMinimumReclaim contains configuration for the kubelet eviction minimum reclaim.
message KubeletConfigEvictionMinimumReclaim {
  // MemoryAvailable is the threshold for the memory reclaim on the host server.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity memoryAvailable = 1;

  // ImageFSAvailable is the threshold for the disk space reclaim in the imagefs filesystem (docker images and container writable layers).
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity imageFSAvailable = 2;

  // ImageFSInodesFree is the threshold for the inodes reclaim in the imagefs filesystem.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity imageFSInodesFree = 3;

  // NodeFSAvailable is the threshold for the disk space reclaim in the nodefs filesystem (docker volumes, logs, etc).
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity nodeFSAvailable = 4;

  // NodeFSInodesFree is the threshold for the inodes reclaim in the nodefs filesystem.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity nodeFSInodesFree = 5;
}

// KubeletConfigEvictionSoftGracePeriod contains grace periods for kubelet eviction thresholds.
message KubeletConfigEvictionSoftGracePeriod {
  // MemoryAvailable is the grace period for the MemoryAvailable eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration memoryAvailable = 1;

  // ImageFSAvailable is the grace period for the ImageFSAvailable eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration imageFSAvailable = 2;

  // ImageFSInodesFree is the grace period for the ImageFSInodesFree eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration imageFSInodesFree = 3;

  // NodeFSAvailable is the grace period for the NodeFSAvailable eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration nodeFSAvailable = 4;

  // NodeFSInodesFree is the grace period for the NodeFSInodesFree eviction threshold.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration nodeFSInodesFree = 5;
}

// KubeletConfigReserved contains reserved resources for daemons
message KubeletConfigReserved {
  // CPU is the reserved cpu.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity cpu = 1;

  // Memory is the reserved memory.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity memory = 2;

  // EphemeralStorage is the reserved ephemeral-storage.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity ephemeralStorage = 3;

  // PID is the reserved process-ids.
  // To reserve PID, the SupportNodePidsLimit feature gate must be enabled in Kubernetes versions < 1.15.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity pid = 4;
}

// Kubernetes contains the version and configuration variables for the Shoot control plane.
message Kubernetes {
  // AllowPrivilegedContainers indicates whether privileged containers are allowed in the Shoot (default: true).
  // +optional
  optional bool allowPrivilegedContainers = 1;

  // ClusterAutoscaler contains the configuration flags for the Kubernetes cluster autoscaler.
  // +optional
  optional ClusterAutoscaler clusterAutoscaler = 2;

  // KubeAPIServer contains configuration settings for the kube-apiserver.
  // +optional
  optional KubeAPIServerConfig kubeAPIServer = 3;

  // KubeControllerManager contains configuration settings for the kube-controller-manager.
  // +optional
  optional KubeControllerManagerConfig kubeControllerManager = 4;

  // KubeScheduler contains configuration settings for the kube-scheduler.
  // +optional
  optional KubeSchedulerConfig kubeScheduler = 5;

  // KubeProxy contains configuration settings for the kube-proxy.
  // +optional
  optional KubeProxyConfig kubeProxy = 6;

  // Kubelet contains configuration settings for the kubelet.
  // +optional
  optional KubeletConfig kubelet = 7;

  // Version is the semantic Kubernetes version to use for the Shoot cluster.
  optional string version = 8;

  // VerticalPodAutoscaler contains the configuration flags for the Kubernetes vertical pod autoscaler.
  // +optional
  optional VerticalPodAutoscaler verticalPodAutoscaler = 9;
}

// KubernetesConfig contains common configuration fields for the control plane components.
message KubernetesConfig {
  // FeatureGates contains information about enabled feature gates.
  // +optional
  map<string, bool> featureGates = 1;
}

// KubernetesDashboard describes configuration values for the kubernetes-dashboard addon.
message KubernetesDashboard {
  optional Addon addon = 2;

  // AuthenticationMode defines the authentication mode for the kubernetes-dashboard.
  // +optional
  optional string authenticationMode = 1;
}

// KubernetesInfo contains the version and configuration variables for the Plant cluster.
message KubernetesInfo {
  // Version is the semantic Kubernetes version to use for the Plant cluster.
  optional string version = 1;
}

// KubernetesSettings contains constraints regarding allowed values of the 'kubernetes' block in the Shoot specification.
message KubernetesSettings {
  // Versions is the list of allowed Kubernetes versions with optional expiration dates for Shoot clusters.
  // +patchMergeKey=version
  // +patchStrategy=merge
  // +optional
  repeated ExpirableVersion versions = 1;
}

// LastError indicates the last occurred error for an operation on a resource.
message LastError {
  // A human readable message indicating details about the last error.
  optional string description = 1;

  // ID of the task which caused this last error
  // +optional
  optional string taskID = 2;

  // Well-defined error codes of the last error(s).
  // +optional
  repeated string codes = 3;

  // Last time the error was reported
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 4;
}

// LastOperation indicates the type and the state of the last operation, along with a description
// message and a progress indicator.
message LastOperation {
  // A human readable message indicating details about the last operation.
  optional string description = 1;

  // Last time the operation state transitioned from one to another.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 2;

  // The progress in percentage (0-100) of the last operation.
  optional int32 progress = 3;

  // Status of the last operation, one of Aborted, Processing, Succeeded, Error, Failed.
  optional string state = 4;

  // Type of the last operation, one of Create, Reconcile, Delete.
  optional string type = 5;
}

// Machine contains information about the machine type and image.
message Machine {
  // Type is the machine type of the worker group.
  optional string type = 1;

  // Image holds information about the machine image to use for all nodes of this pool. It will default to the
  // latest version of the first image stated in the referenced CloudProfile if no value has been provided.
  // +optional
  optional ShootMachineImage image = 2;
}

// MachineControllerManagerSettings contains configurations for different worker-pools. Eg. MachineDrainTimeout, MachineHealthTimeout.
message MachineControllerManagerSettings {
  // MachineDrainTimeout is the period after which machine is forcefully deleted.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration machineDrainTimeout = 1;

  // MachineHealthTimeout is the period after which machine is declared failed.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration machineHealthTimeout = 2;

  // MachineCreationTimeout is the period after which creation of the machine is declared failed.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration machineCreationTimeout = 3;

  // MaxEvictRetries are the number of eviction retries on a pod after which drain is declared failed, and forceful deletion is triggered.
  // +optional
  optional int32 maxEvictRetries = 4;

  // NodeConditions are the set of conditions if set to true for the period of MachineHealthTimeout, machine will be declared failed.
  // +optional
  repeated string nodeConditions = 5;
}

// MachineImage defines the name and multiple versions of the machine image in any environment.
message MachineImage {
  // Name is the name of the image.
  optional string name = 1;

  // Versions contains versions, expiration dates and container runtimes of the machine image
  // +patchMergeKey=version
  // +patchStrategy=merge
  repeated MachineImageVersion versions = 2;
}

// MachineImageVersion is an expirable version with list of supported container runtimes and interfaces
message MachineImageVersion {
  optional ExpirableVersion expirableVersion = 1;

  // CRI list of supported container runtime and interfaces supported by this version
  // +optional
  repeated CRI cri = 2;
}

// MachineType contains certain properties of a machine type.
message MachineType {
  // CPU is the number of CPUs for this machine type.
  optional k8s.io.apimachinery.pkg.api.resource.Quantity cpu = 1;

  // GPU is the number of GPUs for this machine type.
  optional k8s.io.apimachinery.pkg.api.resource.Quantity gpu = 2;

  // Memory is the amount of memory for this machine type.
  optional k8s.io.apimachinery.pkg.api.resource.Quantity memory = 3;

  // Name is the name of the machine type.
  optional string name = 4;

  // Storage is the amount of storage associated with the root volume of this machine type.
  // +optional
  optional MachineTypeStorage storage = 5;

  // Usable defines if the machine type can be used for shoot clusters.
  // +optional
  optional bool usable = 6;
}

// MachineTypeStorage is the amount of storage associated with the root volume of this machine type.
message MachineTypeStorage {
  // Class is the class of the storage type.
  optional string class = 1;

  // StorageSize is the storage size.
  optional k8s.io.apimachinery.pkg.api.resource.Quantity size = 2;

  // Type is the type of the storage.
  optional string type = 3;
}

// Maintenance contains information about the time window for maintenance operations and which
// operations should be performed.
message Maintenance {
  // AutoUpdate contains information about which constraints should be automatically updated.
  // +optional
  optional MaintenanceAutoUpdate autoUpdate = 1;

  // TimeWindow contains information about the time window for maintenance operations.
  // +optional
  optional MaintenanceTimeWindow timeWindow = 2;

  // ConfineSpecUpdateRollout prevents that changes/updates to the shoot specification will be rolled out immediately.
  // Instead, they are rolled out during the shoot's maintenance time window. There is one exception that will trigger
  // an immediate roll out which is changes to the Spec.Hibernation.Enabled field.
  // +optional
  optional bool confineSpecUpdateRollout = 3;
}

// MaintenanceAutoUpdate contains information about which constraints should be automatically updated.
message MaintenanceAutoUpdate {
  // KubernetesVersion indicates whether the patch Kubernetes version may be automatically updated (default: true).
  optional bool kubernetesVersion = 1;

  // MachineImageVersion indicates whether the machine image version may be automatically updated (default: true).
  optional bool machineImageVersion = 2;
}

// MaintenanceTimeWindow contains information about the time window for maintenance operations.
message MaintenanceTimeWindow {
  // Begin is the beginning of the time window in the format HHMMSS+ZONE, e.g. "220000+0100".
  // If not present, a random value will be computed.
  optional string begin = 1;

  // End is the end of the time window in the format HHMMSS+ZONE, e.g. "220000+0100".
  // If not present, the value will be computed based on the "Begin" value.
  optional string end = 2;
}

// Monitoring contains information about the monitoring configuration for the shoot.
message Monitoring {
  // Alerting contains information about the alerting configuration for the shoot cluster.
  // +optional
  optional Alerting alerting = 1;
}

// NamedResourceReference is a named reference to a resource.
message NamedResourceReference {
  // Name of the resource reference.
  optional string name = 1;

  // ResourceRef is a reference to a resource.
  optional k8s.io.api.autoscaling.v1.CrossVersionObjectReference resourceRef = 2;
}

// Networking defines networking parameters for the shoot cluster.
message Networking {
  // Type identifies the type of the networking plugin.
  optional string type = 1;

  // ProviderConfig is the configuration passed to network resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;

  // Pods is the CIDR of the pod network.
  // +optional
  optional string pods = 3;

  // Nodes is the CIDR of the entire node network.
  // +optional
  optional string nodes = 4;

  // Services is the CIDR of the service network.
  // +optional
  optional string services = 5;
}

// NginxIngress describes configuration values for the nginx-ingress addon.
message NginxIngress {
  optional Addon addon = 1;

  // LoadBalancerSourceRanges is list of allowed IP sources for NginxIngress
  // +optional
  repeated string loadBalancerSourceRanges = 2;

  // Config contains custom configuration for the nginx-ingress-controller configuration.
  // See https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/configmap.md#configuration-options
  // +optional
  map<string, string> config = 3;

  // ExternalTrafficPolicy controls the `.spec.externalTrafficPolicy` value of the load balancer `Service`
  // exposing the nginx-ingress. Defaults to `Cluster`.
  // +optional
  optional string externalTrafficPolicy = 4;
}

// OIDCConfig contains configuration settings for the OIDC provider.
// Note: Descriptions were taken from the Kubernetes documentation.
message OIDCConfig {
  // If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used.
  // +optional
  optional string caBundle = 1;

  // ClientAuthentication can optionally contain client configuration used for kubeconfig generation.
  // +optional
  optional OpenIDConnectClientAuthentication clientAuthentication = 2;

  // The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
  // +optional
  optional string clientID = 3;

  // If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be a string or array of strings. This flag is experimental, please see the authentication documentation for further details.
  // +optional
  optional string groupsClaim = 4;

  // If provided, all groups will be prefixed with this value to prevent conflicts with other authentication strategies.
  // +optional
  optional string groupsPrefix = 5;

  // The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT).
  // +optional
  optional string issuerURL = 6;

  // ATTENTION: Only meaningful for Kubernetes >= 1.11
  // key=value pairs that describes a required claim in the ID Token. If set, the claim is verified to be present in the ID Token with a matching value.
  // +optional
  map<string, string> requiredClaims = 7;

  // List of allowed JOSE asymmetric signing algorithms. JWTs with a 'alg' header value not in this list will be rejected. Values are defined by RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1
  // +optional
  repeated string signingAlgs = 8;

  // The OpenID claim to use as the user name. Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. This flag is experimental, please see the authentication documentation for further details. (default "sub")
  // +optional
  optional string usernameClaim = 9;

  // If provided, all usernames will be prefixed with this value. If not provided, username claims other than 'email' are prefixed by the issuer URL to avoid clashes. To skip any prefixing, provide the value '-'.
  // +optional
  optional string usernamePrefix = 10;
}

// OpenIDConnectClientAuthentication contains configuration for OIDC clients.
message OpenIDConnectClientAuthentication {
  // Extra configuration added to kubeconfig's auth-provider.
  // Must not be any of idp-issuer-url, client-id, client-secret, idp-certificate-authority, idp-certificate-authority-data, id-token or refresh-token
  // +optional
  map<string, string> extraConfig = 1;

  // The client Secret for the OpenID Connect client.
  // +optional
  optional string secret = 2;
}

message Plant {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of this Plant.
  optional PlantSpec spec = 2;

  // Status contains the status of this Plant.
  optional PlantStatus status = 3;
}

// PlantList is a collection of Plants.
message PlantList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Plants.
  repeated Plant items = 2;
}

// PlantSpec is the specification of a Plant.
message PlantSpec {
  // SecretRef is a reference to a Secret object containing the Kubeconfig of the external kubernetes
  // clusters to be added to Gardener.
  optional k8s.io.api.core.v1.LocalObjectReference secretRef = 1;

  // Endpoints is the configuration plant endpoints
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated Endpoint endpoints = 2;
}

// PlantStatus is the status of a Plant.
message PlantStatus {
  // Conditions represents the latest available observations of a Plant's current state.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated Condition conditions = 1;

  // ObservedGeneration is the most recent generation observed for this Plant. It corresponds to the
  // Plant's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 2;

  // ClusterInfo is additional computed information about the newly added cluster (Plant)
  optional ClusterInfo clusterInfo = 3;
}

// Project holds certain properties about a Gardener project.
message Project {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec defines the project properties.
  // +optional
  optional ProjectSpec spec = 2;

  // Most recently observed status of the Project.
  // +optional
  optional ProjectStatus status = 3;
}

// ProjectList is a collection of Projects.
message ProjectList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Projects.
  repeated Project items = 2;
}

// ProjectMember is a member of a project.
message ProjectMember {
  // Subject is representing a user name, an email address, or any other identifier of a user, group, or service
  // account that has a certain role.
  optional k8s.io.api.rbac.v1.Subject subject = 1;

  // Role represents the role of this member.
  // IMPORTANT: Be aware that this field will be removed in the `v1` version of this API in favor of the `roles`
  // list.
  // TODO: Remove this field in favor of the `owner` role in `v1`.
  optional string role = 2;

  // Roles represents the list of roles of this member.
  // +optional
  repeated string roles = 3;
}

// ProjectSpec is the specification of a Project.
message ProjectSpec {
  // CreatedBy is a subject representing a user name, an email address, or any other identifier of a user
  // who created the project.
  // +optional
  optional k8s.io.api.rbac.v1.Subject createdBy = 1;

  // Description is a human-readable description of what the project is used for.
  // +optional
  optional string description = 2;

  // Owner is a subject representing a user name, an email address, or any other identifier of a user owning
  // the project.
  // IMPORTANT: Be aware that this field will be removed in the `v1` version of this API in favor of the `owner`
  // role. The only way to change the owner will be by moving the `owner` role. In this API version the only way
  // to change the owner is to use this field.
  // +optional
  // TODO: Remove this field in favor of the `owner` role in `v1`.
  optional k8s.io.api.rbac.v1.Subject owner = 3;

  // Purpose is a human-readable explanation of the project's purpose.
  // +optional
  optional string purpose = 4;

  // Members is a list of subjects representing a user name, an email address, or any other identifier of a user,
  // group, or service account that has a certain role.
  // +optional
  repeated ProjectMember members = 5;

  // Namespace is the name of the namespace that has been created for the Project object.
  // A nil value means that Gardener will determine the name of the namespace.
  // +optional
  optional string namespace = 6;

  // Tolerations contains the tolerations for taints on seed clusters.
  // +optional
  optional ProjectTolerations tolerations = 7;
}

// ProjectStatus holds the most recently observed status of the project.
message ProjectStatus {
  // ObservedGeneration is the most recent generation observed for this project.
  // +optional
  optional int64 observedGeneration = 1;

  // Phase is the current phase of the project.
  optional string phase = 2;

  // StaleSinceTimestamp contains the timestamp when the project was first discovered to be stale/unused.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time staleSinceTimestamp = 3;

  // StaleAutoDeleteTimestamp contains the timestamp when the project will be garbage-collected/automatically deleted
  // because it's stale/unused.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time staleAutoDeleteTimestamp = 4;
}

// ProjectTolerations contains the tolerations for taints on seed clusters.
message ProjectTolerations {
  // Defaults contains a list of tolerations that are added to the shoots in this project by default.
  // +patchMergeKey=key
  // +patchStrategy=merge
  // +optional
  repeated Toleration defaults = 1;

  // Whitelist contains a list of tolerations that are allowed to be added to the shoots in this project. Please note
  // that this list may only be added by users having the `spec-tolerations-whitelist` verb for project resources.
  // +patchMergeKey=key
  // +patchStrategy=merge
  // +optional
  repeated Toleration whitelist = 2;
}

// Provider contains provider-specific information that are handed-over to the provider-specific
// extension controller.
message Provider {
  // Type is the type of the provider.
  optional string type = 1;

  // ControlPlaneConfig contains the provider-specific control plane config blob. Please look up the concrete
  // definition in the documentation of your provider extension.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension controlPlaneConfig = 2;

  // InfrastructureConfig contains the provider-specific infrastructure config blob. Please look up the concrete
  // definition in the documentation of your provider extension.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension infrastructureConfig = 3;

  // Workers is a list of worker groups.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated Worker workers = 4;
}

message Quota {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec defines the Quota constraints.
  // +optional
  optional QuotaSpec spec = 2;
}

// QuotaList is a collection of Quotas.
message QuotaList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Quotas.
  repeated Quota items = 2;
}

// QuotaSpec is the specification of a Quota.
message QuotaSpec {
  // ClusterLifetimeDays is the lifetime of a Shoot cluster in days before it will be terminated automatically.
  // +optional
  optional int32 clusterLifetimeDays = 1;

  // Metrics is a list of resources which will be put under constraints.
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> metrics = 2;

  // Scope is the scope of the Quota object, either 'project' or 'secret'.
  optional k8s.io.api.core.v1.ObjectReference scope = 3;
}

// Region contains certain properties of a region.
message Region {
  // Name is a region name.
  optional string name = 1;

  // Zones is a list of availability zones in this region.
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated AvailabilityZone zones = 2;

  // Labels is an optional set of key-value pairs that contain certain administrator-controlled labels for this region.
  // It can be used by Gardener administrators/operators to provide additional information about a region, e.g. wrt
  // quality, reliability, access restrictions, etc.
  // +optional
  map<string, string> labels = 3;
}

// ResourceWatchCacheSize contains configuration of the API server's watch cache size for one specific resource.
message ResourceWatchCacheSize {
  // APIGroup is the API group of the resource for which the watch cache size should be configured.
  // An unset value is used to specify the legacy core API (e.g. for `secrets`).
  // +optional
  optional string apiGroup = 1;

  // Resource is the name of the resource for which the watch cache size should be configured
  // (in lowercase plural form, e.g. `secrets`).
  optional string resource = 2;

  // CacheSize specifies the watch cache size that should be configured for the specified resource.
  optional int32 size = 3;
}

message SecretBinding {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // SecretRef is a reference to a secret object in the same or another namespace.
  optional k8s.io.api.core.v1.SecretReference secretRef = 2;

  // Quotas is a list of references to Quota objects in the same or another namespace.
  // +optional
  repeated k8s.io.api.core.v1.ObjectReference quotas = 3;
}

// SecretBindingList is a collection of SecretBindings.
message SecretBindingList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of SecretBindings.
  repeated SecretBinding items = 2;
}

// Seed represents an installation request for an external controller.
message Seed {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec contains the specification of this installation.
  optional SeedSpec spec = 2;

  // Status contains the status of this installation.
  optional SeedStatus status = 3;
}

// SeedBackup contains the object store configuration for backups for shoot (currently only etcd).
message SeedBackup {
  // Provider is a provider name.
  optional string provider = 1;

  // ProviderConfig is the configuration passed to BackupBucket resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;

  // Region is a region name.
  // +optional
  optional string region = 3;

  // SecretRef is a reference to a Secret object containing the cloud provider credentials for
  // the object store where backups should be stored. It should have enough privileges to manipulate
  // the objects as well as buckets.
  optional k8s.io.api.core.v1.SecretReference secretRef = 4;
}

// SeedDNS contains DNS-relevant information about this seed cluster.
message SeedDNS {
  // IngressDomain is the domain of the Seed cluster pointing to the ingress controller endpoint. It will be used
  // to construct ingress URLs for system applications running in Shoot clusters. Once set this field is immutable.
  // This will be removed in the next API version and replaced by spec.ingress.domain.
  // +optional
  optional string ingressDomain = 1;

  // Provider configures a DNSProvider
  // +optional
  optional SeedDNSProvider provider = 2;
}

// SeedDNSProvider configures a DNSProvider for Seeds
message SeedDNSProvider {
  // Type describes the type of the dns-provider, for example `aws-route53`
  optional string type = 1;

  // SecretRef is a reference to a Secret object containing cloud provider credentials used for registering external domains.
  optional k8s.io.api.core.v1.SecretReference secretRef = 2;

  // Domains contains information about which domains shall be included/excluded for this provider.
  // +optional
  optional DNSIncludeExclude domains = 3;

  // Zones contains information about which hosted zones shall be included/excluded for this provider.
  // +optional
  optional DNSIncludeExclude zones = 4;
}

// SeedList is a collection of Seeds.
message SeedList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Seeds.
  repeated Seed items = 2;
}

// SeedNetworks contains CIDRs for the pod, service and node networks of a Kubernetes cluster.
message SeedNetworks {
  // Nodes is the CIDR of the node network.
  // +optional
  optional string nodes = 1;

  // Pods is the CIDR of the pod network.
  optional string pods = 2;

  // Services is the CIDR of the service network.
  optional string services = 3;

  // ShootDefaults contains the default networks CIDRs for shoots.
  // +optional
  optional ShootNetworks shootDefaults = 4;

  // BlockCIDRs is a list of network addresses that should be blocked for shoot control plane components running
  // in the seed cluster.
  // +optional
  repeated string blockCIDRs = 5;
}

// SeedProvider defines the provider type and region for this Seed cluster.
message SeedProvider {
  // Type is the name of the provider.
  optional string type = 1;

  // ProviderConfig is the configuration passed to Seed resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;

  // Region is a name of a region.
  optional string region = 3;
}

// SeedSelector contains constraints for selecting seed to be usable for shoots using a profile
message SeedSelector {
  // LabelSelector is optional and can be used to select seeds by their label settings
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector labelSelector = 1;

  // Providers is optional and can be used by restricting seeds by their provider type. '*' can be used to enable seeds regardless of their provider type.
  // +optional
  repeated string providerTypes = 2;
}

// SeedSettingExcessCapacityReservation controls the excess capacity reservation for shoot control planes in the
// seed. When enabled then this is done via PodPriority and requires the Seed cluster to have Kubernetes version 1.11
// or the PodPriority feature gate as well as the scheduling.k8s.io/v1alpha1 API group enabled.
message SeedSettingExcessCapacityReservation {
  // Enabled controls whether the excess capacity reservation should be enabled.
  optional bool enabled = 1;
}

// SeedSettingLoadBalancerServices controls certain settings for services of type load balancer that are created in the
// seed.
message SeedSettingLoadBalancerServices {
  // Annotations is a map of annotations that will be injected/merged into every load balancer service object.
  // +optional
  map<string, string> annotations = 1;
}

// SeedSettingScheduling controls settings for scheduling decisions for the seed.
message SeedSettingScheduling {
  // Visible controls whether the gardener-scheduler shall consider this seed when scheduling shoots. Invisible seeds
  // are not considered by the scheduler.
  optional bool visible = 1;
}

// SeedSettingShootDNS controls the shoot DNS settings for the seed.
message SeedSettingShootDNS {
  // Enabled controls whether the DNS for shoot clusters should be enabled. When disabled then all shoots using the
  // seed won't get any DNS providers, DNS records, and no DNS extension controller is required to be installed here.
  // This is useful for environments where DNS is not required.
  optional bool enabled = 1;
}

// SeedSettingVerticalPodAutoscaler controls certain settings for the vertical pod autoscaler components deployed in the
// seed.
message SeedSettingVerticalPodAutoscaler {
  // Enabled controls whether the VPA components shall be deployed into the garden namespace in the seed cluster. It
  // is enabled by default because Gardener heavily relies on a VPA being deployed. You should only disable this if
  // your seed cluster already has another, manually/custom managed VPA deployment.
  optional bool enabled = 1;
}

// SeedSettings contains certain settings for this seed cluster.
message SeedSettings {
  // ExcessCapacityReservation controls the excess capacity reservation for shoot control planes in the seed.
  // +optional
  optional SeedSettingExcessCapacityReservation excessCapacityReservation = 1;

  // Scheduling controls settings for scheduling decisions for the seed.
  // +optional
  optional SeedSettingScheduling scheduling = 2;

  // ShootDNS controls the shoot DNS settings for the seed.
  // +optional
  optional SeedSettingShootDNS shootDNS = 3;

  // LoadBalancerServices controls certain settings for services of type load balancer that are created in the
  // seed.
  // +optional
  optional SeedSettingLoadBalancerServices loadBalancerServices = 4;

  // VerticalPodAutoscaler controls certain settings for the vertical pod autoscaler components deployed in the seed.
  // +optional
  optional SeedSettingVerticalPodAutoscaler verticalPodAutoscaler = 5;
}

// SeedSpec is the specification of a Seed.
message SeedSpec {
  // Backup holds the object store configuration for the backups of shoot (currently only etcd).
  // If it is not specified, then there won't be any backups taken for shoots associated with this seed.
  // If backup field is present in seed, then backups of the etcd from shoot control plane will be stored
  // under the configured object store.
  // +optional
  optional SeedBackup backup = 1;

  // DNS contains DNS-relevant information about this seed cluster.
  optional SeedDNS dns = 2;

  // Networks defines the pod, service and worker network of the Seed cluster.
  optional SeedNetworks networks = 3;

  // Provider defines the provider type and region for this Seed cluster.
  optional SeedProvider provider = 4;

  // SecretRef is a reference to a Secret object containing the Kubeconfig and the cloud provider credentials for
  // the account the Seed cluster has been deployed to.
  // +optional
  optional k8s.io.api.core.v1.SecretReference secretRef = 5;

  // Taints describes taints on the seed.
  // +optional
  repeated SeedTaint taints = 6;

  // Volume contains settings for persistentvolumes created in the seed cluster.
  // +optional
  optional SeedVolume volume = 7;

  // Settings contains certain settings for this seed cluster.
  // +optional
  optional SeedSettings settings = 8;

  // Ingress configures Ingress specific settings of the Seed cluster.
  // +optional
  optional Ingress ingress = 9;
}

// SeedStatus is the status of a Seed.
message SeedStatus {
  // Gardener holds information about the Gardener which last acted on the Shoot.
  // +optional
  optional Gardener gardener = 1;

  // KubernetesVersion is the Kubernetes version of the seed cluster.
  // +optional
  optional string kubernetesVersion = 2;

  // Conditions represents the latest available observations of a Seed's current state.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated Condition conditions = 3;

  // ObservedGeneration is the most recent generation observed for this Seed. It corresponds to the
  // Seed's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 4;

  // ClusterIdentity is the identity of the Seed cluster
  // +optional
  optional string clusterIdentity = 5;

  // Capacity represents the total resources of a seed.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> capacity = 6;

  // Allocatable represents the resources of a seed that are available for scheduling.
  // Defaults to Capacity.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> allocatable = 7;
}

// SeedTaint describes a taint on a seed.
message SeedTaint {
  // Key is the taint key to be applied to a seed.
  optional string key = 1;

  // Value is the taint value corresponding to the taint key.
  // +optional
  optional string value = 2;
}

// SeedVolume contains settings for persistentvolumes created in the seed cluster.
message SeedVolume {
  // MinimumSize defines the minimum size that should be used for PVCs in the seed.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity minimumSize = 1;

  // Providers is a list of storage class provisioner types for the seed.
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +optional
  repeated SeedVolumeProvider providers = 2;
}

// SeedVolumeProvider is a storage class provisioner type.
message SeedVolumeProvider {
  // Purpose is the purpose of this provider.
  optional string purpose = 1;

  // Name is the name of the storage class provisioner type.
  optional string name = 2;
}

// ServiceAccountConfig is the kube-apiserver configuration for service accounts.
message ServiceAccountConfig {
  // Issuer is the identifier of the service account token issuer. The issuer will assert this
  // identifier in "iss" claim of issued tokens. This value is a string or URI.
  // Defaults to URI of the API server.
  // +optional
  optional string issuer = 1;

  // SigningKeySecret is a reference to a secret that contains an optional private key of the
  // service account token issuer. The issuer will sign issued ID tokens with this private key.
  // Only useful if service account tokens are also issued by another external system.
  // +optional
  optional k8s.io.api.core.v1.LocalObjectReference signingKeySecretName = 2;
}

message Shoot {
  // Standard object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Specification of the Shoot cluster.
  // +optional
  optional ShootSpec spec = 2;

  // Most recently observed status of the Shoot cluster.
  // +optional
  optional ShootStatus status = 3;
}

// ShootList is a list of Shoot objects.
message ShootList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Shoots.
  repeated Shoot items = 2;
}

// ShootMachineImage defines the name and the version of the shoot's machine image in any environment. Has to be
// defined in the respective CloudProfile.
message ShootMachineImage {
  // Name is the name of the image.
  optional string name = 1;

  // ProviderConfig is the shoot's individual configuration passed to an extension resource.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 2;

  // Version is the version of the shoot's image.
  // If version is not provided, it will be defaulted to the latest version from the CloudProfile.
  // +optional
  optional string version = 3;
}

// ShootNetworks contains the default networks CIDRs for shoots.
message ShootNetworks {
  // Pods is the CIDR of the pod network.
  // +optional
  optional string pods = 1;

  // Services is the CIDR of the service network.
  // +optional
  optional string services = 2;
}

// ShootSpec is the specification of a Shoot.
message ShootSpec {
  // Addons contains information about enabled/disabled addons and their configuration.
  // +optional
  optional Addons addons = 1;

  // CloudProfileName is a name of a CloudProfile object.
  optional string cloudProfileName = 2;

  // DNS contains information about the DNS settings of the Shoot.
  // +optional
  optional DNS dns = 3;

  // Extensions contain type and provider information for Shoot extensions.
  // +optional
  repeated Extension extensions = 4;

  // Hibernation contains information whether the Shoot is suspended or not.
  // +optional
  optional Hibernation hibernation = 5;

  // Kubernetes contains the version and configuration settings of the control plane components.
  optional Kubernetes kubernetes = 6;

  // Networking contains information about cluster networking such as CNI Plugin type, CIDRs, ...etc.
  optional Networking networking = 7;

  // Maintenance contains information about the time window for maintenance operations and which
  // operations should be performed.
  // +optional
  optional Maintenance maintenance = 8;

  // Monitoring contains information about custom monitoring configurations for the shoot.
  // +optional
  optional Monitoring monitoring = 9;

  // Provider contains all provider-specific and provider-relevant information.
  optional Provider provider = 10;

  // Purpose is the purpose class for this cluster.
  // +optional
  optional string purpose = 11;

  // Region is a name of a region.
  optional string region = 12;

  // SecretBindingName is the name of the a SecretBinding that has a reference to the provider secret.
  // The credentials inside the provider secret will be used to create the shoot in the respective account.
  optional string secretBindingName = 13;

  // SeedName is the name of the seed cluster that runs the control plane of the Shoot.
  // +optional
  optional string seedName = 14;

  // SeedSelector is an optional selector which must match a seed's labels for the shoot to be scheduled on that seed.
  // +optional
  optional SeedSelector seedSelector = 15;

  // Resources holds a list of named resource references that can be referred to in extension configs by their names.
  // +optional
  repeated NamedResourceReference resources = 16;

  // Tolerations contains the tolerations for taints on seed clusters.
  // +patchMergeKey=key
  // +patchStrategy=merge
  // +optional
  repeated Toleration tolerations = 17;
}

// ShootStatus holds the most recently observed status of the Shoot cluster.
message ShootStatus {
  // Conditions represents the latest available observations of a Shoots's current state.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated Condition conditions = 1;

  // Constraints represents conditions of a Shoot's current state that constraint some operations on it.
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +optional
  repeated Condition constraints = 2;

  // Gardener holds information about the Gardener which last acted on the Shoot.
  optional Gardener gardener = 3;

  // IsHibernated indicates whether the Shoot is currently hibernated.
  optional bool hibernated = 4;

  // LastOperation holds information about the last operation on the Shoot.
  // +optional
  optional LastOperation lastOperation = 5;

  // LastErrors holds information about the last occurred error(s) during an operation.
  // +optional
  repeated LastError lastErrors = 6;

  // ObservedGeneration is the most recent generation observed for this Shoot. It corresponds to the
  // Shoot's generation, which is updated on mutation by the API Server.
  // +optional
  optional int64 observedGeneration = 7;

  // RetryCycleStartTime is the start time of the last retry cycle (used to determine how often an operation
  // must be retried until we give up).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time retryCycleStartTime = 8;

  // SeedName is the name of the seed cluster that runs the control plane of the Shoot. This value is only written
  // after a successful create/reconcile operation. It will be used when control planes are moved between Seeds.
  // +optional
  optional string seedName = 9;

  // TechnicalID is the name that is used for creating the Seed namespace, the infrastructure resources, and
  // basically everything that is related to this particular Shoot.
  optional string technicalID = 10;

  // UID is a unique identifier for the Shoot cluster to avoid portability between Kubernetes clusters.
  // It is used to compute unique hashes.
  optional string uid = 11;

  // ClusterIdentity is the identity of the Shoot cluster
  // +optional
  optional string clusterIdentity = 12;
}

// Toleration is a toleration for a seed taint.
message Toleration {
  // Key is the toleration key to be applied to a project or shoot.
  optional string key = 1;

  // Value is the toleration value corresponding to the toleration key.
  // +optional
  optional string value = 2;
}

// VerticalPodAutoscaler contains the configuration flags for the Kubernetes vertical pod autoscaler.
message VerticalPodAutoscaler {
  // Enabled specifies whether the Kubernetes VPA shall be enabled for the shoot cluster.
  optional bool enabled = 1;

  // EvictAfterOOMThreshold defines the threshold that will lead to pod eviction in case it OOMed in less than the given
  // threshold since its start and if it has only one container (default: 10m0s).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration evictAfterOOMThreshold = 2;

  // EvictionRateBurst defines the burst of pods that can be evicted (default: 1)
  // +optional
  optional int32 evictionRateBurst = 3;

  // EvictionRateLimit defines the number of pods that can be evicted per second. A rate limit set to 0 or -1 will
  // disable the rate limiter (default: -1).
  // +optional
  optional double evictionRateLimit = 4;

  // EvictionTolerance defines the fraction of replica count that can be evicted for update in case more than one
  // pod can be evicted (default: 0.5).
  // +optional
  optional double evictionTolerance = 5;

  // RecommendationMarginFraction is the fraction of usage added as the safety margin to the recommended request
  // (default: 0.15).
  // +optional
  optional double recommendationMarginFraction = 6;

  // UpdaterInterval is the interval how often the updater should run (default: 1m0s).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration updaterInterval = 7;

  // RecommenderInterval is the interval how often metrics should be fetched (default: 1m0s).
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Duration recommenderInterval = 8;
}

// Volume contains information about the volume type, size, and encryption.
message Volume {
  // Name of the volume to make it referencable.
  // +optional
  optional string name = 1;

  // Type is the type of the volume.
  // +optional
  optional string type = 2;

  // VolumeSize is the size of the volume.
  optional string size = 3;

  // Encrypted determines if the volume should be encrypted.
  // +optional
  optional bool encrypted = 4;
}

// VolumeType contains certain properties of a volume type.
message VolumeType {
  // Class is the class of the volume type.
  optional string class = 1;

  // Name is the name of the volume type.
  optional string name = 2;

  // Usable defines if the volume type can be used for shoot clusters.
  // +optional
  optional bool usable = 3;
}

// WatchCacheSizes contains configuration of the API server's watch cache sizes.
message WatchCacheSizes {
  // Default configures the default watch cache size of the kube-apiserver
  // (flag `--default-watch-cache-size`, defaults to 100).
  // See: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
  // +optional
  optional int32 default = 1;

  // Resources configures the watch cache size of the kube-apiserver per resource
  // (flag `--watch-cache-sizes`).
  // See: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
  // +optional
  repeated ResourceWatchCacheSize resources = 2;
}

// Worker is the base definition of a worker group.
message Worker {
  // Annotations is a map of key/value pairs for annotations for all the `Node` objects in this worker pool.
  // +optional
  map<string, string> annotations = 1;

  // CABundle is a certificate bundle which will be installed onto every machine of this worker pool.
  // +optional
  optional string caBundle = 2;

  // CRI contains configurations of CRI support of every machine in the worker pool
  // +optional
  optional CRI cri = 3;

  // Kubernetes contains configuration for Kubernetes components related to this worker pool.
  // +optional
  optional WorkerKubernetes kubernetes = 4;

  // Labels is a map of key/value pairs for labels for all the `Node` objects in this worker pool.
  // +optional
  map<string, string> labels = 5;

  // Name is the name of the worker group.
  optional string name = 6;

  // Machine contains information about the machine type and image.
  optional Machine machine = 7;

  // Maximum is the maximum number of VMs to create.
  optional int32 maximum = 8;

  // Minimum is the minimum number of VMs to create.
  optional int32 minimum = 9;

  // MaxSurge is maximum number of VMs that are created during an update.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxSurge = 10;

  // MaxUnavailable is the maximum number of VMs that can be unavailable during an update.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxUnavailable = 11;

  // ProviderConfig is the provider-specific configuration for this worker pool.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension providerConfig = 12;

  // Taints is a list of taints for all the `Node` objects in this worker pool.
  // +optional
  repeated k8s.io.api.core.v1.Taint taints = 13;

  // Volume contains information about the volume type and size.
  // +optional
  optional Volume volume = 14;

  // DataVolumes contains a list of additional worker volumes.
  // +optional
  repeated DataVolume dataVolumes = 15;

  // KubeletDataVolumeName contains the name of a dataVolume that should be used for storing kubelet state.
  // +optional
  optional string kubeletDataVolumeName = 16;

  // Zones is a list of availability zones that are used to evenly distribute this worker pool. Optional
  // as not every provider may support availability zones.
  // +optional
  repeated string zones = 17;

  // SystemComponents contains configuration for system components related to this worker pool
  // +optional
  optional WorkerSystemComponents systemComponents = 18;

  // MachineControllerManagerSettings contains configurations for different worker-pools. Eg. MachineDrainTimeout, MachineHealthTimeout.
  // +optional
  optional MachineControllerManagerSettings machineControllerManager = 19;
}

// WorkerKubernetes contains configuration for Kubernetes components related to this worker pool.
message WorkerKubernetes {
  // Kubelet contains configuration settings for all kubelets of this worker pool.
  // +optional
  optional KubeletConfig kubelet = 1;
}

// WorkerSystemComponents contains configuration for system components related to this worker pool
message WorkerSystemComponents {
  // Allow determines whether the pool should be allowed to host system components or not (defaults to true)
  optional bool allow = 1;
}

