// Code generated by azure-service-operator-codegen. DO NOT EDIT.
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.
package arm

import "github.com/Azure/azure-service-operator/v2/pkg/genruntime"

type ManagedCluster_Spec struct {
	// ExtendedLocation: The extended location of the Virtual Machine.
	ExtendedLocation *ExtendedLocation `json:"extendedLocation,omitempty"`

	// Identity: The identity of the managed cluster, if configured.
	Identity *ManagedClusterIdentity `json:"identity,omitempty"`

	// Location: The geo-location where the resource lives
	Location *string `json:"location,omitempty"`
	Name     string  `json:"name,omitempty"`

	// Properties: Properties of a managed cluster.
	Properties *ManagedClusterProperties `json:"properties,omitempty"`

	// Sku: The managed cluster SKU.
	Sku *ManagedClusterSKU `json:"sku,omitempty"`

	// Tags: Resource tags.
	Tags map[string]string `json:"tags" serializationType:"explicitEmptyCollection"`
}

var _ genruntime.ARMResourceSpec = &ManagedCluster_Spec{}

// GetAPIVersion returns the ARM API version of the resource. This is always "2024-09-01"
func (cluster ManagedCluster_Spec) GetAPIVersion() string {
	return "2024-09-01"
}

// GetName returns the Name of the resource
func (cluster *ManagedCluster_Spec) GetName() string {
	return cluster.Name
}

// GetType returns the ARM Type of the resource. This is always "Microsoft.ContainerService/managedClusters"
func (cluster *ManagedCluster_Spec) GetType() string {
	return "Microsoft.ContainerService/managedClusters"
}

// The complex type of the extended location.
type ExtendedLocation struct {
	// Name: The name of the extended location.
	Name *string `json:"name,omitempty"`

	// Type: The type of the extended location.
	Type *ExtendedLocationType `json:"type,omitempty"`
}

// Identity for the managed cluster.
type ManagedClusterIdentity struct {
	// DelegatedResources: The delegated identity resources assigned to this managed cluster. This can only be set by another
	// Azure Resource Provider, and managed cluster only accept one delegated identity resource. Internal use only.
	DelegatedResources map[string]DelegatedResource `json:"delegatedResources"`

	// Type: For more information see [use managed identities in
	// AKS](https://docs.microsoft.com/azure/aks/use-managed-identity).
	Type                   *ManagedClusterIdentity_Type           `json:"type,omitempty"`
	UserAssignedIdentities map[string]UserAssignedIdentityDetails `json:"userAssignedIdentities,omitempty"`
}

// Properties of the managed cluster.
type ManagedClusterProperties struct {
	// AadProfile: The Azure Active Directory configuration.
	AadProfile *ManagedClusterAADProfile `json:"aadProfile,omitempty"`

	// AddonProfiles: The profile of managed cluster add-on.
	AddonProfiles map[string]ManagedClusterAddonProfile `json:"addonProfiles"`

	// AgentPoolProfiles: The agent pool properties.
	AgentPoolProfiles []ManagedClusterAgentPoolProfile `json:"agentPoolProfiles"`

	// ApiServerAccessProfile: The access profile for managed cluster API server.
	ApiServerAccessProfile *ManagedClusterAPIServerAccessProfile `json:"apiServerAccessProfile,omitempty"`

	// AutoScalerProfile: Parameters to be applied to the cluster-autoscaler when enabled
	AutoScalerProfile *ManagedClusterProperties_AutoScalerProfile `json:"autoScalerProfile,omitempty"`

	// AutoUpgradeProfile: The auto upgrade configuration.
	AutoUpgradeProfile *ManagedClusterAutoUpgradeProfile `json:"autoUpgradeProfile,omitempty"`

	// AzureMonitorProfile: Azure Monitor addon profiles for monitoring the managed cluster.
	AzureMonitorProfile *ManagedClusterAzureMonitorProfile `json:"azureMonitorProfile,omitempty"`

	// DisableLocalAccounts: If set to true, getting static credentials will be disabled for this cluster. This must only be
	// used on Managed Clusters that are AAD enabled. For more details see [disable local
	// accounts](https://docs.microsoft.com/azure/aks/managed-aad#disable-local-accounts-preview).
	DisableLocalAccounts *bool `json:"disableLocalAccounts,omitempty"`

	// DiskEncryptionSetID: This is of the form:
	// '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/diskEncryptionSets/{encryptionSetName}'
	DiskEncryptionSetID *string `json:"diskEncryptionSetID,omitempty"`

	// DnsPrefix: This cannot be updated once the Managed Cluster has been created.
	DnsPrefix *string `json:"dnsPrefix,omitempty"`

	// EnablePodSecurityPolicy: (DEPRECATED) Whether to enable Kubernetes pod security policy (preview). PodSecurityPolicy was
	// deprecated in Kubernetes v1.21, and removed from Kubernetes in v1.25. Learn more at https://aka.ms/k8s/psp and
	// https://aka.ms/aks/psp.
	EnablePodSecurityPolicy *bool `json:"enablePodSecurityPolicy,omitempty"`

	// EnableRBAC: Whether to enable Kubernetes Role-Based Access Control.
	EnableRBAC *bool `json:"enableRBAC,omitempty"`

	// FqdnSubdomain: This cannot be updated once the Managed Cluster has been created.
	FqdnSubdomain *string `json:"fqdnSubdomain,omitempty"`

	// HttpProxyConfig: Configurations for provisioning the cluster with HTTP proxy servers.
	HttpProxyConfig *ManagedClusterHTTPProxyConfig `json:"httpProxyConfig,omitempty"`

	// IdentityProfile: The user identity associated with the managed cluster. This identity will be used by the kubelet. Only
	// one user assigned identity is allowed. The only accepted key is "kubeletidentity", with value of "resourceId":
	// "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}".
	IdentityProfile map[string]UserAssignedIdentity `json:"identityProfile"`

	// IngressProfile: Ingress profile for the managed cluster.
	IngressProfile *ManagedClusterIngressProfile `json:"ingressProfile,omitempty"`

	// KubernetesVersion: Both patch version <major.minor.patch> (e.g. 1.20.13) and <major.minor> (e.g. 1.20) are supported.
	// When <major.minor> is specified, the latest supported GA patch version is chosen automatically. Updating the cluster
	// with the same <major.minor> once it has been created (e.g. 1.14.x -> 1.14) will not trigger an upgrade, even if a newer
	// patch version is available. When you upgrade a supported AKS cluster, Kubernetes minor versions cannot be skipped. All
	// upgrades must be performed sequentially by major version number. For example, upgrades between 1.14.x -> 1.15.x or
	// 1.15.x -> 1.16.x are allowed, however 1.14.x -> 1.16.x is not allowed. See [upgrading an AKS
	// cluster](https://docs.microsoft.com/azure/aks/upgrade-cluster) for more details.
	KubernetesVersion *string `json:"kubernetesVersion,omitempty"`

	// LinuxProfile: The profile for Linux VMs in the Managed Cluster.
	LinuxProfile *ContainerServiceLinuxProfile `json:"linuxProfile,omitempty"`

	// MetricsProfile: Optional cluster metrics configuration.
	MetricsProfile *ManagedClusterMetricsProfile `json:"metricsProfile,omitempty"`

	// NetworkProfile: The network configuration profile.
	NetworkProfile *ContainerServiceNetworkProfile `json:"networkProfile,omitempty"`

	// NodeResourceGroup: The name of the resource group containing agent pool nodes.
	NodeResourceGroup *string `json:"nodeResourceGroup,omitempty"`

	// NodeResourceGroupProfile: Profile of the node resource group configuration.
	NodeResourceGroupProfile *ManagedClusterNodeResourceGroupProfile `json:"nodeResourceGroupProfile,omitempty"`

	// OidcIssuerProfile: The OIDC issuer profile of the Managed Cluster.
	OidcIssuerProfile *ManagedClusterOIDCIssuerProfile `json:"oidcIssuerProfile,omitempty"`

	// PodIdentityProfile: See [use AAD pod identity](https://docs.microsoft.com/azure/aks/use-azure-ad-pod-identity) for more
	// details on AAD pod identity integration.
	PodIdentityProfile *ManagedClusterPodIdentityProfile `json:"podIdentityProfile,omitempty"`

	// PrivateLinkResources: Private link resources associated with the cluster.
	PrivateLinkResources []PrivateLinkResource `json:"privateLinkResources"`

	// PublicNetworkAccess: Allow or deny public network access for AKS
	PublicNetworkAccess *ManagedClusterProperties_PublicNetworkAccess `json:"publicNetworkAccess,omitempty"`

	// SecurityProfile: Security profile for the managed cluster.
	SecurityProfile *ManagedClusterSecurityProfile `json:"securityProfile,omitempty"`

	// ServiceMeshProfile: Service mesh profile for a managed cluster.
	ServiceMeshProfile *ServiceMeshProfile `json:"serviceMeshProfile,omitempty"`

	// ServicePrincipalProfile: Information about a service principal identity for the cluster to use for manipulating Azure
	// APIs.
	ServicePrincipalProfile *ManagedClusterServicePrincipalProfile `json:"servicePrincipalProfile,omitempty"`

	// StorageProfile: Storage profile for the managed cluster.
	StorageProfile *ManagedClusterStorageProfile `json:"storageProfile,omitempty"`

	// SupportPlan: The support plan for the Managed Cluster. If unspecified, the default is 'KubernetesOfficial'.
	SupportPlan *KubernetesSupportPlan `json:"supportPlan,omitempty"`

	// UpgradeSettings: Settings for upgrading a cluster.
	UpgradeSettings *ClusterUpgradeSettings `json:"upgradeSettings,omitempty"`

	// WindowsProfile: The profile for Windows VMs in the Managed Cluster.
	WindowsProfile *ManagedClusterWindowsProfile `json:"windowsProfile,omitempty"`

	// WorkloadAutoScalerProfile: Workload Auto-scaler profile for the managed cluster.
	WorkloadAutoScalerProfile *ManagedClusterWorkloadAutoScalerProfile `json:"workloadAutoScalerProfile,omitempty"`
}

// The SKU of a Managed Cluster.
type ManagedClusterSKU struct {
	// Name: The name of a managed cluster SKU.
	Name *ManagedClusterSKU_Name `json:"name,omitempty"`

	// Tier: If not specified, the default is 'Free'. See [AKS Pricing
	// Tier](https://learn.microsoft.com/azure/aks/free-standard-pricing-tiers) for more details.
	Tier *ManagedClusterSKU_Tier `json:"tier,omitempty"`
}

// Settings for upgrading a cluster.
type ClusterUpgradeSettings struct {
	// OverrideSettings: Settings for overrides.
	OverrideSettings *UpgradeOverrideSettings `json:"overrideSettings,omitempty"`
}

// Profile for Linux VMs in the container service cluster.
type ContainerServiceLinuxProfile struct {
	// AdminUsername: The administrator username to use for Linux VMs.
	AdminUsername *string `json:"adminUsername,omitempty"`

	// Ssh: The SSH configuration for Linux-based VMs running on Azure.
	Ssh *ContainerServiceSshConfiguration `json:"ssh,omitempty"`
}

// Profile of network configuration.
type ContainerServiceNetworkProfile struct {
	// AdvancedNetworking: Advanced Networking profile for enabling observability and security feature suite on a cluster. For
	// more information see  aka.ms/aksadvancednetworking.
	AdvancedNetworking *AdvancedNetworking `json:"advancedNetworking,omitempty"`

	// DnsServiceIP: An IP address assigned to the Kubernetes DNS service. It must be within the Kubernetes service address
	// range specified in serviceCidr.
	DnsServiceIP *string `json:"dnsServiceIP,omitempty"`

	// IpFamilies: IP families are used to determine single-stack or dual-stack clusters. For single-stack, the expected value
	// is IPv4. For dual-stack, the expected values are IPv4 and IPv6.
	IpFamilies []ContainerServiceNetworkProfile_IpFamilies `json:"ipFamilies"`

	// LoadBalancerProfile: Profile of the cluster load balancer.
	LoadBalancerProfile *ManagedClusterLoadBalancerProfile `json:"loadBalancerProfile,omitempty"`

	// LoadBalancerSku: The default is 'standard'. See [Azure Load Balancer
	// SKUs](https://docs.microsoft.com/azure/load-balancer/skus) for more information about the differences between load
	// balancer SKUs.
	LoadBalancerSku *ContainerServiceNetworkProfile_LoadBalancerSku `json:"loadBalancerSku,omitempty"`

	// NatGatewayProfile: Profile of the cluster NAT gateway.
	NatGatewayProfile *ManagedClusterNATGatewayProfile `json:"natGatewayProfile,omitempty"`

	// NetworkDataplane: Network dataplane used in the Kubernetes cluster.
	NetworkDataplane *ContainerServiceNetworkProfile_NetworkDataplane `json:"networkDataplane,omitempty"`

	// NetworkMode: This cannot be specified if networkPlugin is anything other than 'azure'.
	NetworkMode *ContainerServiceNetworkProfile_NetworkMode `json:"networkMode,omitempty"`

	// NetworkPlugin: Network plugin used for building the Kubernetes network.
	NetworkPlugin *ContainerServiceNetworkProfile_NetworkPlugin `json:"networkPlugin,omitempty"`

	// NetworkPluginMode: The mode the network plugin should use.
	NetworkPluginMode *ContainerServiceNetworkProfile_NetworkPluginMode `json:"networkPluginMode,omitempty"`

	// NetworkPolicy: Network policy used for building the Kubernetes network.
	NetworkPolicy *ContainerServiceNetworkProfile_NetworkPolicy `json:"networkPolicy,omitempty"`

	// OutboundType: This can only be set at cluster creation time and cannot be changed later. For more information see
	// [egress outbound type](https://docs.microsoft.com/azure/aks/egress-outboundtype).
	OutboundType *ContainerServiceNetworkProfile_OutboundType `json:"outboundType,omitempty"`

	// PodCidr: A CIDR notation IP range from which to assign pod IPs when kubenet is used.
	PodCidr *string `json:"podCidr,omitempty"`

	// PodCidrs: One IPv4 CIDR is expected for single-stack networking. Two CIDRs, one for each IP family (IPv4/IPv6), is
	// expected for dual-stack networking.
	PodCidrs []string `json:"podCidrs"`

	// ServiceCidr: A CIDR notation IP range from which to assign service cluster IPs. It must not overlap with any Subnet IP
	// ranges.
	ServiceCidr *string `json:"serviceCidr,omitempty"`

	// ServiceCidrs: One IPv4 CIDR is expected for single-stack networking. Two CIDRs, one for each IP family (IPv4/IPv6), is
	// expected for dual-stack networking. They must not overlap with any Subnet IP ranges.
	ServiceCidrs []string `json:"serviceCidrs"`
}

// Delegated resource properties - internal use only.
type DelegatedResource struct {
	// Location: The source resource location - internal use only.
	Location *string `json:"location,omitempty"`

	// ReferralResource: The delegation id of the referral delegation (optional) - internal use only.
	ReferralResource *string `json:"referralResource,omitempty"`

	// ResourceId: The ARM resource id of the delegated resource - internal use only.
	ResourceId *string `json:"resourceId,omitempty"`

	// TenantId: The tenant id of the delegated resource - internal use only.
	TenantId *string `json:"tenantId,omitempty"`
}

// The type of extendedLocation.
// +kubebuilder:validation:Enum={"EdgeZone"}
type ExtendedLocationType string

const ExtendedLocationType_EdgeZone = ExtendedLocationType("EdgeZone")

// Mapping from string to ExtendedLocationType
var extendedLocationType_Values = map[string]ExtendedLocationType{
	"edgezone": ExtendedLocationType_EdgeZone,
}

// Different support tiers for AKS managed clusters
// +kubebuilder:validation:Enum={"AKSLongTermSupport","KubernetesOfficial"}
type KubernetesSupportPlan string

const (
	KubernetesSupportPlan_AKSLongTermSupport = KubernetesSupportPlan("AKSLongTermSupport")
	KubernetesSupportPlan_KubernetesOfficial = KubernetesSupportPlan("KubernetesOfficial")
)

// Mapping from string to KubernetesSupportPlan
var kubernetesSupportPlan_Values = map[string]KubernetesSupportPlan{
	"akslongtermsupport": KubernetesSupportPlan_AKSLongTermSupport,
	"kubernetesofficial": KubernetesSupportPlan_KubernetesOfficial,
}

// For more details see [managed AAD on AKS](https://docs.microsoft.com/azure/aks/managed-aad).
type ManagedClusterAADProfile struct {
	// AdminGroupObjectIDs: The list of AAD group object IDs that will have admin role of the cluster.
	AdminGroupObjectIDs []string `json:"adminGroupObjectIDs"`

	// ClientAppID: (DEPRECATED) The client AAD application ID. Learn more at https://aka.ms/aks/aad-legacy.
	ClientAppID *string `json:"clientAppID,omitempty"`

	// EnableAzureRBAC: Whether to enable Azure RBAC for Kubernetes authorization.
	EnableAzureRBAC *bool `json:"enableAzureRBAC,omitempty"`

	// Managed: Whether to enable managed AAD.
	Managed *bool `json:"managed,omitempty"`

	// ServerAppID: (DEPRECATED) The server AAD application ID. Learn more at https://aka.ms/aks/aad-legacy.
	ServerAppID *string `json:"serverAppID,omitempty"`

	// ServerAppSecret: (DEPRECATED) The server AAD application secret. Learn more at https://aka.ms/aks/aad-legacy.
	ServerAppSecret *string `json:"serverAppSecret,omitempty"`

	// TenantID: The AAD tenant ID to use for authentication. If not specified, will use the tenant of the deployment
	// subscription.
	TenantID *string `json:"tenantID,omitempty"`
}

// A Kubernetes add-on profile for a managed cluster.
type ManagedClusterAddonProfile struct {
	// Config: Key-value pairs for configuring an add-on.
	Config map[string]string `json:"config"`

	// Enabled: Whether the add-on is enabled or not.
	Enabled *bool `json:"enabled,omitempty"`
}

// Profile for the container service agent pool.
type ManagedClusterAgentPoolProfile struct {
	// AvailabilityZones: The list of Availability zones to use for nodes. This can only be specified if the AgentPoolType
	// property is 'VirtualMachineScaleSets'.
	AvailabilityZones []string `json:"availabilityZones"`

	// CapacityReservationGroupID: AKS will associate the specified agent pool with the Capacity Reservation Group.
	CapacityReservationGroupID *string `json:"capacityReservationGroupID,omitempty"`

	// Count: Number of agents (VMs) to host docker containers. Allowed values must be in the range of 0 to 1000 (inclusive)
	// for user pools and in the range of 1 to 1000 (inclusive) for system pools. The default value is 1.
	Count *int `json:"count,omitempty"`

	// CreationData: CreationData to be used to specify the source Snapshot ID if the node pool will be created/upgraded using
	// a snapshot.
	CreationData *CreationData `json:"creationData,omitempty"`

	// EnableAutoScaling: Whether to enable auto-scaler
	EnableAutoScaling *bool `json:"enableAutoScaling,omitempty"`

	// EnableEncryptionAtHost: This is only supported on certain VM sizes and in certain Azure regions. For more information,
	// see: https://docs.microsoft.com/azure/aks/enable-host-encryption
	EnableEncryptionAtHost *bool `json:"enableEncryptionAtHost,omitempty"`

	// EnableFIPS: See [Add a FIPS-enabled node
	// pool](https://docs.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool-preview) for more
	// details.
	EnableFIPS *bool `json:"enableFIPS,omitempty"`

	// EnableNodePublicIP: Some scenarios may require nodes in a node pool to receive their own dedicated public IP addresses.
	// A common scenario is for gaming workloads, where a console needs to make a direct connection to a cloud virtual machine
	// to minimize hops. For more information see [assigning a public IP per
	// node](https://docs.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools). The
	// default is false.
	EnableNodePublicIP *bool `json:"enableNodePublicIP,omitempty"`

	// EnableUltraSSD: Whether to enable UltraSSD
	EnableUltraSSD *bool `json:"enableUltraSSD,omitempty"`

	// GpuInstanceProfile: GPUInstanceProfile to be used to specify GPU MIG instance profile for supported GPU VM SKU.
	GpuInstanceProfile *GPUInstanceProfile `json:"gpuInstanceProfile,omitempty"`

	// HostGroupID: This is of the form:
	// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/hostGroups/{hostGroupName}.
	// For more information see [Azure dedicated hosts](https://docs.microsoft.com/azure/virtual-machines/dedicated-hosts).
	HostGroupID *string `json:"hostGroupID,omitempty"`

	// KubeletConfig: The Kubelet configuration on the agent pool nodes.
	KubeletConfig *KubeletConfig `json:"kubeletConfig,omitempty"`

	// KubeletDiskType: Determines the placement of emptyDir volumes, container runtime data root, and Kubelet ephemeral
	// storage.
	KubeletDiskType *KubeletDiskType `json:"kubeletDiskType,omitempty"`

	// LinuxOSConfig: The OS configuration of Linux agent nodes.
	LinuxOSConfig *LinuxOSConfig `json:"linuxOSConfig,omitempty"`

	// MaxCount: The maximum number of nodes for auto-scaling
	MaxCount *int `json:"maxCount,omitempty"`

	// MaxPods: The maximum number of pods that can run on a node.
	MaxPods *int `json:"maxPods,omitempty"`

	// MinCount: The minimum number of nodes for auto-scaling
	MinCount *int `json:"minCount,omitempty"`

	// Mode: A cluster must have at least one 'System' Agent Pool at all times. For additional information on agent pool
	// restrictions  and best practices, see: https://docs.microsoft.com/azure/aks/use-system-pools
	Mode *AgentPoolMode `json:"mode,omitempty"`

	// Name: Windows agent pool names must be 6 characters or less.
	Name *string `json:"name,omitempty"`

	// NetworkProfile: Network-related settings of an agent pool.
	NetworkProfile *AgentPoolNetworkProfile `json:"networkProfile,omitempty"`

	// NodeLabels: The node labels to be persisted across all nodes in agent pool.
	NodeLabels map[string]string `json:"nodeLabels" serializationType:"explicitEmptyCollection"`

	// NodePublicIPPrefixID: This is of the form:
	// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/publicIPPrefixes/{publicIPPrefixName}
	NodePublicIPPrefixID *string `json:"nodePublicIPPrefixID,omitempty"`

	// NodeTaints: The taints added to new nodes during node pool create and scale. For example, key=value:NoSchedule.
	NodeTaints []string `json:"nodeTaints" serializationType:"explicitEmptyCollection"`

	// OrchestratorVersion: Both patch version <major.minor.patch> (e.g. 1.20.13) and <major.minor> (e.g. 1.20) are supported.
	// When <major.minor> is specified, the latest supported GA patch version is chosen automatically. Updating the cluster
	// with the same <major.minor> once it has been created (e.g. 1.14.x -> 1.14) will not trigger an upgrade, even if a newer
	// patch version is available. As a best practice, you should upgrade all node pools in an AKS cluster to the same
	// Kubernetes version. The node pool version must have the same major version as the control plane. The node pool minor
	// version must be within two minor versions of the control plane version. The node pool version cannot be greater than the
	// control plane version. For more information see [upgrading a node
	// pool](https://docs.microsoft.com/azure/aks/use-multiple-node-pools#upgrade-a-node-pool).
	OrchestratorVersion *string `json:"orchestratorVersion,omitempty"`
	OsDiskSizeGB        *int    `json:"osDiskSizeGB,omitempty"`

	// OsDiskType: The default is 'Ephemeral' if the VM supports it and has a cache disk larger than the requested
	// OSDiskSizeGB. Otherwise,  defaults to 'Managed'. May not be changed after creation. For more information see [Ephemeral
	// OS](https://docs.microsoft.com/azure/aks/cluster-configuration#ephemeral-os).
	OsDiskType *OSDiskType `json:"osDiskType,omitempty"`

	// OsSKU: Specifies the OS SKU used by the agent pool. The default is Ubuntu if OSType is Linux. The default is Windows2019
	// when  Kubernetes <= 1.24 or Windows2022 when Kubernetes >= 1.25 if OSType is Windows.
	OsSKU *OSSKU `json:"osSKU,omitempty"`

	// OsType: The operating system type. The default is Linux.
	OsType *OSType `json:"osType,omitempty"`

	// PodSubnetID: If omitted, pod IPs are statically assigned on the node subnet (see vnetSubnetID for more details). This is
	// of the form:
	// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkName}/subnets/{subnetName}
	PodSubnetID *string `json:"podSubnetID,omitempty"`

	// PowerState: When an Agent Pool is first created it is initially Running. The Agent Pool can be stopped by setting this
	// field to Stopped. A stopped Agent Pool stops all of its VMs and does not accrue billing charges. An Agent Pool can only
	// be stopped if it is Running and provisioning state is Succeeded
	PowerState *PowerState `json:"powerState,omitempty"`

	// ProximityPlacementGroupID: The ID for Proximity Placement Group.
	ProximityPlacementGroupID *string `json:"proximityPlacementGroupID,omitempty"`

	// ScaleDownMode: This also effects the cluster autoscaler behavior. If not specified, it defaults to Delete.
	ScaleDownMode *ScaleDownMode `json:"scaleDownMode,omitempty"`

	// ScaleSetEvictionPolicy: This cannot be specified unless the scaleSetPriority is 'Spot'. If not specified, the default is
	// 'Delete'.
	ScaleSetEvictionPolicy *ScaleSetEvictionPolicy `json:"scaleSetEvictionPolicy,omitempty"`

	// ScaleSetPriority: The Virtual Machine Scale Set priority. If not specified, the default is 'Regular'.
	ScaleSetPriority *ScaleSetPriority `json:"scaleSetPriority,omitempty"`

	// SecurityProfile: The security settings of an agent pool.
	SecurityProfile *AgentPoolSecurityProfile `json:"securityProfile,omitempty"`

	// SpotMaxPrice: Possible values are any decimal value greater than zero or -1 which indicates the willingness to pay any
	// on-demand price. For more details on spot pricing, see [spot VMs
	// pricing](https://docs.microsoft.com/azure/virtual-machines/spot-vms#pricing)
	SpotMaxPrice *float64 `json:"spotMaxPrice,omitempty"`

	// Tags: The tags to be persisted on the agent pool virtual machine scale set.
	Tags map[string]string `json:"tags" serializationType:"explicitEmptyCollection"`

	// Type: The type of Agent Pool.
	Type *AgentPoolType `json:"type,omitempty"`

	// UpgradeSettings: Settings for upgrading the agentpool
	UpgradeSettings *AgentPoolUpgradeSettings `json:"upgradeSettings,omitempty"`

	// VmSize: VM size availability varies by region. If a node contains insufficient compute resources (memory, cpu, etc) pods
	// might fail to run correctly. For more details on restricted VM sizes, see:
	// https://docs.microsoft.com/azure/aks/quotas-skus-regions
	VmSize *string `json:"vmSize,omitempty"`

	// VnetSubnetID: If this is not specified, a VNET and subnet will be generated and used. If no podSubnetID is specified,
	// this applies to nodes and pods, otherwise it applies to just nodes. This is of the form:
	// /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkName}/subnets/{subnetName}
	VnetSubnetID *string `json:"vnetSubnetID,omitempty"`

	// WindowsProfile: The Windows agent pool's specific profile.
	WindowsProfile *AgentPoolWindowsProfile `json:"windowsProfile,omitempty"`

	// WorkloadRuntime: Determines the type of workload a node can run.
	WorkloadRuntime *WorkloadRuntime `json:"workloadRuntime,omitempty"`
}

// Access profile for managed cluster API server.
type ManagedClusterAPIServerAccessProfile struct {
	// AuthorizedIPRanges: IP ranges are specified in CIDR format, e.g. 137.117.106.88/29. This feature is not compatible with
	// clusters that use Public IP Per Node, or clusters that are using a Basic Load Balancer. For more information see [API
	// server authorized IP ranges](https://docs.microsoft.com/azure/aks/api-server-authorized-ip-ranges).
	AuthorizedIPRanges []string `json:"authorizedIPRanges"`

	// DisableRunCommand: Whether to disable run command for the cluster or not.
	DisableRunCommand *bool `json:"disableRunCommand,omitempty"`

	// EnablePrivateCluster: For more details, see [Creating a private AKS
	// cluster](https://docs.microsoft.com/azure/aks/private-clusters).
	EnablePrivateCluster *bool `json:"enablePrivateCluster,omitempty"`

	// EnablePrivateClusterPublicFQDN: Whether to create additional public FQDN for private cluster or not.
	EnablePrivateClusterPublicFQDN *bool `json:"enablePrivateClusterPublicFQDN,omitempty"`

	// PrivateDNSZone: The default is System. For more details see [configure private DNS
	// zone](https://docs.microsoft.com/azure/aks/private-clusters#configure-private-dns-zone). Allowed values are 'system' and
	// 'none'.
	PrivateDNSZone *string `json:"privateDNSZone,omitempty"`
}

// Auto upgrade profile for a managed cluster.
type ManagedClusterAutoUpgradeProfile struct {
	// NodeOSUpgradeChannel: Manner in which the OS on your nodes is updated. The default is NodeImage.
	NodeOSUpgradeChannel *ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel `json:"nodeOSUpgradeChannel,omitempty"`

	// UpgradeChannel: For more information see [setting the AKS cluster auto-upgrade
	// channel](https://docs.microsoft.com/azure/aks/upgrade-cluster#set-auto-upgrade-channel).
	UpgradeChannel *ManagedClusterAutoUpgradeProfile_UpgradeChannel `json:"upgradeChannel,omitempty"`
}

// Azure Monitor addon profiles for monitoring the managed cluster.
type ManagedClusterAzureMonitorProfile struct {
	// Metrics: Metrics profile for the Azure Monitor managed service for Prometheus addon. Collect out-of-the-box Kubernetes
	// infrastructure metrics to send to an Azure Monitor Workspace and configure additional scraping for custom targets. See
	// aka.ms/AzureManagedPrometheus for an overview.
	Metrics *ManagedClusterAzureMonitorProfileMetrics `json:"metrics,omitempty"`
}

// Cluster HTTP proxy configuration.
type ManagedClusterHTTPProxyConfig struct {
	// HttpProxy: The HTTP proxy server endpoint to use.
	HttpProxy *string `json:"httpProxy,omitempty"`

	// HttpsProxy: The HTTPS proxy server endpoint to use.
	HttpsProxy *string `json:"httpsProxy,omitempty"`

	// NoProxy: The endpoints that should not go through proxy.
	NoProxy []string `json:"noProxy"`

	// TrustedCa: Alternative CA cert to use for connecting to proxy servers.
	TrustedCa *string `json:"trustedCa,omitempty"`
}

// +kubebuilder:validation:Enum={"None","SystemAssigned","UserAssigned"}
type ManagedClusterIdentity_Type string

const (
	ManagedClusterIdentity_Type_None           = ManagedClusterIdentity_Type("None")
	ManagedClusterIdentity_Type_SystemAssigned = ManagedClusterIdentity_Type("SystemAssigned")
	ManagedClusterIdentity_Type_UserAssigned   = ManagedClusterIdentity_Type("UserAssigned")
)

// Mapping from string to ManagedClusterIdentity_Type
var managedClusterIdentity_Type_Values = map[string]ManagedClusterIdentity_Type{
	"none":           ManagedClusterIdentity_Type_None,
	"systemassigned": ManagedClusterIdentity_Type_SystemAssigned,
	"userassigned":   ManagedClusterIdentity_Type_UserAssigned,
}

// Ingress profile for the container service cluster.
type ManagedClusterIngressProfile struct {
	// WebAppRouting: App Routing settings for the ingress profile. You can find an overview and onboarding guide for this
	// feature at https://learn.microsoft.com/en-us/azure/aks/app-routing?tabs=default%2Cdeploy-app-default.
	WebAppRouting *ManagedClusterIngressProfileWebAppRouting `json:"webAppRouting,omitempty"`
}

// The metrics profile for the ManagedCluster.
type ManagedClusterMetricsProfile struct {
	// CostAnalysis: The cost analysis configuration for the cluster
	CostAnalysis *ManagedClusterCostAnalysis `json:"costAnalysis,omitempty"`
}

// Node resource group lockdown profile for a managed cluster.
type ManagedClusterNodeResourceGroupProfile struct {
	// RestrictionLevel: The restriction level applied to the cluster's node resource group. If not specified, the default is
	// 'Unrestricted'
	RestrictionLevel *ManagedClusterNodeResourceGroupProfile_RestrictionLevel `json:"restrictionLevel,omitempty"`
}

// The OIDC issuer profile of the Managed Cluster.
type ManagedClusterOIDCIssuerProfile struct {
	// Enabled: Whether the OIDC issuer is enabled.
	Enabled *bool `json:"enabled,omitempty"`
}

// See [use AAD pod identity](https://docs.microsoft.com/azure/aks/use-azure-ad-pod-identity) for more details on pod
// identity integration.
type ManagedClusterPodIdentityProfile struct {
	// AllowNetworkPluginKubenet: Running in Kubenet is disabled by default due to the security related nature of AAD Pod
	// Identity and the risks of IP spoofing. See [using Kubenet network plugin with AAD Pod
	// Identity](https://docs.microsoft.com/azure/aks/use-azure-ad-pod-identity#using-kubenet-network-plugin-with-azure-active-directory-pod-managed-identities)
	// for more information.
	AllowNetworkPluginKubenet *bool `json:"allowNetworkPluginKubenet,omitempty"`

	// Enabled: Whether the pod identity addon is enabled.
	Enabled *bool `json:"enabled,omitempty"`

	// UserAssignedIdentities: The pod identities to use in the cluster.
	UserAssignedIdentities []ManagedClusterPodIdentity `json:"userAssignedIdentities"`

	// UserAssignedIdentityExceptions: The pod identity exceptions to allow.
	UserAssignedIdentityExceptions []ManagedClusterPodIdentityException `json:"userAssignedIdentityExceptions"`
}

type ManagedClusterProperties_AutoScalerProfile struct {
	// BalanceSimilarNodeGroups: Valid values are 'true' and 'false'
	BalanceSimilarNodeGroups *string `json:"balance-similar-node-groups,omitempty"`

	// DaemonsetEvictionForEmptyNodes: If set to true, all daemonset pods on empty nodes will be evicted before deletion of the
	// node. If the daemonset pod cannot be evicted another node will be chosen for scaling. If set to false, the node will be
	// deleted without ensuring that daemonset pods are deleted or evicted.
	DaemonsetEvictionForEmptyNodes *bool `json:"daemonset-eviction-for-empty-nodes,omitempty"`

	// DaemonsetEvictionForOccupiedNodes: If set to true, all daemonset pods on occupied nodes will be evicted before deletion
	// of the node. If the daemonset pod cannot be evicted another node will be chosen for scaling. If set to false, the node
	// will be deleted without ensuring that daemonset pods are deleted or evicted.
	DaemonsetEvictionForOccupiedNodes *bool `json:"daemonset-eviction-for-occupied-nodes,omitempty"`

	// Expander: If not specified, the default is 'random'. See
	// [expanders](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-expanders) for more
	// information.
	Expander *ManagedClusterProperties_AutoScalerProfile_Expander `json:"expander,omitempty"`

	// IgnoreDaemonsetsUtilization: If set to true, the resources used by daemonset will be taken into account when making
	// scaling down decisions.
	IgnoreDaemonsetsUtilization *bool `json:"ignore-daemonsets-utilization,omitempty"`

	// MaxEmptyBulkDelete: The default is 10.
	MaxEmptyBulkDelete *string `json:"max-empty-bulk-delete,omitempty"`

	// MaxGracefulTerminationSec: The default is 600.
	MaxGracefulTerminationSec *string `json:"max-graceful-termination-sec,omitempty"`

	// MaxNodeProvisionTime: The default is '15m'. Values must be an integer followed by an 'm'. No unit of time other than
	// minutes (m) is supported.
	MaxNodeProvisionTime *string `json:"max-node-provision-time,omitempty"`

	// MaxTotalUnreadyPercentage: The default is 45. The maximum is 100 and the minimum is 0.
	MaxTotalUnreadyPercentage *string `json:"max-total-unready-percentage,omitempty"`

	// NewPodScaleUpDelay: For scenarios like burst/batch scale where you don't want CA to act before the kubernetes scheduler
	// could schedule all the pods, you can tell CA to ignore unscheduled pods before they're a certain age. The default is
	// '0s'. Values must be an integer followed by a unit ('s' for seconds, 'm' for minutes, 'h' for hours, etc).
	NewPodScaleUpDelay *string `json:"new-pod-scale-up-delay,omitempty"`

	// OkTotalUnreadyCount: This must be an integer. The default is 3.
	OkTotalUnreadyCount *string `json:"ok-total-unready-count,omitempty"`

	// ScaleDownDelayAfterAdd: The default is '10m'. Values must be an integer followed by an 'm'. No unit of time other than
	// minutes (m) is supported.
	ScaleDownDelayAfterAdd *string `json:"scale-down-delay-after-add,omitempty"`

	// ScaleDownDelayAfterDelete: The default is the scan-interval. Values must be an integer followed by an 'm'. No unit of
	// time other than minutes (m) is supported.
	ScaleDownDelayAfterDelete *string `json:"scale-down-delay-after-delete,omitempty"`

	// ScaleDownDelayAfterFailure: The default is '3m'. Values must be an integer followed by an 'm'. No unit of time other
	// than minutes (m) is supported.
	ScaleDownDelayAfterFailure *string `json:"scale-down-delay-after-failure,omitempty"`

	// ScaleDownUnneededTime: The default is '10m'. Values must be an integer followed by an 'm'. No unit of time other than
	// minutes (m) is supported.
	ScaleDownUnneededTime *string `json:"scale-down-unneeded-time,omitempty"`

	// ScaleDownUnreadyTime: The default is '20m'. Values must be an integer followed by an 'm'. No unit of time other than
	// minutes (m) is supported.
	ScaleDownUnreadyTime *string `json:"scale-down-unready-time,omitempty"`

	// ScaleDownUtilizationThreshold: The default is '0.5'.
	ScaleDownUtilizationThreshold *string `json:"scale-down-utilization-threshold,omitempty"`

	// ScanInterval: The default is '10'. Values must be an integer number of seconds.
	ScanInterval *string `json:"scan-interval,omitempty"`

	// SkipNodesWithLocalStorage: The default is true.
	SkipNodesWithLocalStorage *string `json:"skip-nodes-with-local-storage,omitempty"`

	// SkipNodesWithSystemPods: The default is true.
	SkipNodesWithSystemPods *string `json:"skip-nodes-with-system-pods,omitempty"`
}

// +kubebuilder:validation:Enum={"Disabled","Enabled"}
type ManagedClusterProperties_PublicNetworkAccess string

const (
	ManagedClusterProperties_PublicNetworkAccess_Disabled = ManagedClusterProperties_PublicNetworkAccess("Disabled")
	ManagedClusterProperties_PublicNetworkAccess_Enabled  = ManagedClusterProperties_PublicNetworkAccess("Enabled")
)

// Mapping from string to ManagedClusterProperties_PublicNetworkAccess
var managedClusterProperties_PublicNetworkAccess_Values = map[string]ManagedClusterProperties_PublicNetworkAccess{
	"disabled": ManagedClusterProperties_PublicNetworkAccess_Disabled,
	"enabled":  ManagedClusterProperties_PublicNetworkAccess_Enabled,
}

// Security profile for the container service cluster.
type ManagedClusterSecurityProfile struct {
	// AzureKeyVaultKms: Azure Key Vault [key management
	// service](https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/) settings for the security profile.
	AzureKeyVaultKms *AzureKeyVaultKms `json:"azureKeyVaultKms,omitempty"`

	// Defender: Microsoft Defender settings for the security profile.
	Defender *ManagedClusterSecurityProfileDefender `json:"defender,omitempty"`

	// ImageCleaner: Image Cleaner settings for the security profile.
	ImageCleaner *ManagedClusterSecurityProfileImageCleaner `json:"imageCleaner,omitempty"`

	// WorkloadIdentity: Workload identity settings for the security profile. Workload identity enables Kubernetes applications
	// to access Azure cloud resources securely with Azure AD. See https://aka.ms/aks/wi for more details.
	WorkloadIdentity *ManagedClusterSecurityProfileWorkloadIdentity `json:"workloadIdentity,omitempty"`
}

// Information about a service principal identity for the cluster to use for manipulating Azure APIs.
type ManagedClusterServicePrincipalProfile struct {
	// ClientId: The ID for the service principal.
	ClientId *string `json:"clientId,omitempty"`

	// Secret: The secret password associated with the service principal in plain text.
	Secret *string `json:"secret,omitempty"`
}

// +kubebuilder:validation:Enum={"Base"}
type ManagedClusterSKU_Name string

const ManagedClusterSKU_Name_Base = ManagedClusterSKU_Name("Base")

// Mapping from string to ManagedClusterSKU_Name
var managedClusterSKU_Name_Values = map[string]ManagedClusterSKU_Name{
	"base": ManagedClusterSKU_Name_Base,
}

// +kubebuilder:validation:Enum={"Free","Premium","Standard"}
type ManagedClusterSKU_Tier string

const (
	ManagedClusterSKU_Tier_Free     = ManagedClusterSKU_Tier("Free")
	ManagedClusterSKU_Tier_Premium  = ManagedClusterSKU_Tier("Premium")
	ManagedClusterSKU_Tier_Standard = ManagedClusterSKU_Tier("Standard")
)

// Mapping from string to ManagedClusterSKU_Tier
var managedClusterSKU_Tier_Values = map[string]ManagedClusterSKU_Tier{
	"free":     ManagedClusterSKU_Tier_Free,
	"premium":  ManagedClusterSKU_Tier_Premium,
	"standard": ManagedClusterSKU_Tier_Standard,
}

// Storage profile for the container service cluster.
type ManagedClusterStorageProfile struct {
	// BlobCSIDriver: AzureBlob CSI Driver settings for the storage profile.
	BlobCSIDriver *ManagedClusterStorageProfileBlobCSIDriver `json:"blobCSIDriver,omitempty"`

	// DiskCSIDriver: AzureDisk CSI Driver settings for the storage profile.
	DiskCSIDriver *ManagedClusterStorageProfileDiskCSIDriver `json:"diskCSIDriver,omitempty"`

	// FileCSIDriver: AzureFile CSI Driver settings for the storage profile.
	FileCSIDriver *ManagedClusterStorageProfileFileCSIDriver `json:"fileCSIDriver,omitempty"`

	// SnapshotController: Snapshot Controller settings for the storage profile.
	SnapshotController *ManagedClusterStorageProfileSnapshotController `json:"snapshotController,omitempty"`
}

// Profile for Windows VMs in the managed cluster.
type ManagedClusterWindowsProfile struct {
	// AdminPassword: Specifies the password of the administrator account.
	// Minimum-length: 8 characters
	// Max-length: 123 characters
	// Complexity requirements: 3 out of 4 conditions below need to be fulfilled
	// Has lower characters
	// Has upper characters
	// Has a digit
	// Has a special character (Regex match [\W_])
	// Disallowed values: "abc@123", "P@$$w0rd", "P@ssw0rd", "P@ssword123", "Pa$$word", "pass@word1", "Password!", "Password1",
	// "Password22", "iloveyou!"
	AdminPassword *string `json:"adminPassword,omitempty"`

	// AdminUsername: Specifies the name of the administrator account.
	// Restriction: Cannot end in "."
	// Disallowed values: "administrator", "admin", "user", "user1", "test", "user2", "test1", "user3", "admin1", "1", "123",
	// "a", "actuser", "adm", "admin2", "aspnet", "backup", "console", "david", "guest", "john", "owner", "root", "server",
	// "sql", "support", "support_388945a0", "sys", "test2", "test3", "user4", "user5".
	// Minimum-length: 1 character
	// Max-length: 20 characters
	AdminUsername *string `json:"adminUsername,omitempty"`

	// EnableCSIProxy: For more details on CSI proxy, see the [CSI proxy GitHub
	// repo](https://github.com/kubernetes-csi/csi-proxy).
	EnableCSIProxy *bool `json:"enableCSIProxy,omitempty"`

	// GmsaProfile: The Windows gMSA Profile in the Managed Cluster.
	GmsaProfile *WindowsGmsaProfile `json:"gmsaProfile,omitempty"`

	// LicenseType: The license type to use for Windows VMs. See [Azure Hybrid User
	// Benefits](https://azure.microsoft.com/pricing/hybrid-benefit/faq/) for more details.
	LicenseType *ManagedClusterWindowsProfile_LicenseType `json:"licenseType,omitempty"`
}

// Workload Auto-scaler profile for the managed cluster.
type ManagedClusterWorkloadAutoScalerProfile struct {
	// Keda: KEDA (Kubernetes Event-driven Autoscaling) settings for the workload auto-scaler profile.
	Keda *ManagedClusterWorkloadAutoScalerProfileKeda `json:"keda,omitempty"`

	// VerticalPodAutoscaler: VPA (Vertical Pod Autoscaler) settings for the workload auto-scaler profile.
	VerticalPodAutoscaler *ManagedClusterWorkloadAutoScalerProfileVerticalPodAutoscaler `json:"verticalPodAutoscaler,omitempty"`
}

// A private link resource
type PrivateLinkResource struct {
	// GroupId: The group ID of the resource.
	GroupId *string `json:"groupId,omitempty"`

	// Id: The ID of the private link resource.
	Id *string `json:"id,omitempty"`

	// Name: The name of the private link resource.
	Name *string `json:"name,omitempty"`

	// RequiredMembers: The RequiredMembers of the resource
	RequiredMembers []string `json:"requiredMembers"`

	// Type: The resource type.
	Type *string `json:"type,omitempty"`
}

// Service mesh profile for a managed cluster.
type ServiceMeshProfile struct {
	// Istio: Istio service mesh configuration.
	Istio *IstioServiceMesh `json:"istio,omitempty"`

	// Mode: Mode of the service mesh.
	Mode *ServiceMeshProfile_Mode `json:"mode,omitempty"`
}

// Details about a user assigned identity.
type UserAssignedIdentity struct {
	// ClientId: The client ID of the user assigned identity.
	ClientId *string `json:"clientId,omitempty" optionalConfigMapPair:"ClientId"`

	// ObjectId: The object ID of the user assigned identity.
	ObjectId *string `json:"objectId,omitempty" optionalConfigMapPair:"ObjectId"`

	// ResourceId: The resource ID of the user assigned identity.
	ResourceId *string `json:"resourceId,omitempty"`
}

// Information about the user assigned identity for the resource
type UserAssignedIdentityDetails struct {
}

// Advanced Networking profile for enabling observability and security feature suite on a cluster. For more information see
// aka.ms/aksadvancednetworking.
type AdvancedNetworking struct {
	// Enabled: Indicates the enablement of Advanced Networking functionalities of observability and security on AKS clusters.
	// When this is set to true, all observability and security features will be set to enabled unless explicitly disabled. If
	// not specified, the default is false.
	Enabled *bool `json:"enabled,omitempty"`

	// Observability: Observability profile to enable advanced network metrics and flow logs with historical contexts.
	Observability *AdvancedNetworkingObservability `json:"observability,omitempty"`

	// Security: Security profile to enable security features on cilium based cluster.
	Security *AdvancedNetworkingSecurity `json:"security,omitempty"`
}

// Azure Key Vault key management service settings for the security profile.
type AzureKeyVaultKms struct {
	// Enabled: Whether to enable Azure Key Vault key management service. The default is false.
	Enabled *bool `json:"enabled,omitempty"`

	// KeyId: Identifier of Azure Key Vault key. See [key identifier
	// format](https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name)
	// for more details. When Azure Key Vault key management service is enabled, this field is required and must be a valid key
	// identifier. When Azure Key Vault key management service is disabled, leave the field empty.
	KeyId *string `json:"keyId,omitempty"`

	// KeyVaultNetworkAccess: Network access of key vault. The possible values are `Public` and `Private`. `Public` means the
	// key vault allows public access from all networks. `Private` means the key vault disables public access and enables
	// private link. The default value is `Public`.
	KeyVaultNetworkAccess *AzureKeyVaultKms_KeyVaultNetworkAccess `json:"keyVaultNetworkAccess,omitempty"`

	// KeyVaultResourceId: Resource ID of key vault. When keyVaultNetworkAccess is `Private`, this field is required and must
	// be a valid resource ID. When keyVaultNetworkAccess is `Public`, leave the field empty.
	KeyVaultResourceId *string `json:"keyVaultResourceId,omitempty"`
}

// +kubebuilder:validation:Enum={"IPv4","IPv6"}
type ContainerServiceNetworkProfile_IpFamilies string

const (
	ContainerServiceNetworkProfile_IpFamilies_IPv4 = ContainerServiceNetworkProfile_IpFamilies("IPv4")
	ContainerServiceNetworkProfile_IpFamilies_IPv6 = ContainerServiceNetworkProfile_IpFamilies("IPv6")
)

// Mapping from string to ContainerServiceNetworkProfile_IpFamilies
var containerServiceNetworkProfile_IpFamilies_Values = map[string]ContainerServiceNetworkProfile_IpFamilies{
	"ipv4": ContainerServiceNetworkProfile_IpFamilies_IPv4,
	"ipv6": ContainerServiceNetworkProfile_IpFamilies_IPv6,
}

// +kubebuilder:validation:Enum={"basic","standard"}
type ContainerServiceNetworkProfile_LoadBalancerSku string

const (
	ContainerServiceNetworkProfile_LoadBalancerSku_Basic    = ContainerServiceNetworkProfile_LoadBalancerSku("basic")
	ContainerServiceNetworkProfile_LoadBalancerSku_Standard = ContainerServiceNetworkProfile_LoadBalancerSku("standard")
)

// Mapping from string to ContainerServiceNetworkProfile_LoadBalancerSku
var containerServiceNetworkProfile_LoadBalancerSku_Values = map[string]ContainerServiceNetworkProfile_LoadBalancerSku{
	"basic":    ContainerServiceNetworkProfile_LoadBalancerSku_Basic,
	"standard": ContainerServiceNetworkProfile_LoadBalancerSku_Standard,
}

// +kubebuilder:validation:Enum={"azure","cilium"}
type ContainerServiceNetworkProfile_NetworkDataplane string

const (
	ContainerServiceNetworkProfile_NetworkDataplane_Azure  = ContainerServiceNetworkProfile_NetworkDataplane("azure")
	ContainerServiceNetworkProfile_NetworkDataplane_Cilium = ContainerServiceNetworkProfile_NetworkDataplane("cilium")
)

// Mapping from string to ContainerServiceNetworkProfile_NetworkDataplane
var containerServiceNetworkProfile_NetworkDataplane_Values = map[string]ContainerServiceNetworkProfile_NetworkDataplane{
	"azure":  ContainerServiceNetworkProfile_NetworkDataplane_Azure,
	"cilium": ContainerServiceNetworkProfile_NetworkDataplane_Cilium,
}

// +kubebuilder:validation:Enum={"bridge","transparent"}
type ContainerServiceNetworkProfile_NetworkMode string

const (
	ContainerServiceNetworkProfile_NetworkMode_Bridge      = ContainerServiceNetworkProfile_NetworkMode("bridge")
	ContainerServiceNetworkProfile_NetworkMode_Transparent = ContainerServiceNetworkProfile_NetworkMode("transparent")
)

// Mapping from string to ContainerServiceNetworkProfile_NetworkMode
var containerServiceNetworkProfile_NetworkMode_Values = map[string]ContainerServiceNetworkProfile_NetworkMode{
	"bridge":      ContainerServiceNetworkProfile_NetworkMode_Bridge,
	"transparent": ContainerServiceNetworkProfile_NetworkMode_Transparent,
}

// +kubebuilder:validation:Enum={"azure","kubenet","none"}
type ContainerServiceNetworkProfile_NetworkPlugin string

const (
	ContainerServiceNetworkProfile_NetworkPlugin_Azure   = ContainerServiceNetworkProfile_NetworkPlugin("azure")
	ContainerServiceNetworkProfile_NetworkPlugin_Kubenet = ContainerServiceNetworkProfile_NetworkPlugin("kubenet")
	ContainerServiceNetworkProfile_NetworkPlugin_None    = ContainerServiceNetworkProfile_NetworkPlugin("none")
)

// Mapping from string to ContainerServiceNetworkProfile_NetworkPlugin
var containerServiceNetworkProfile_NetworkPlugin_Values = map[string]ContainerServiceNetworkProfile_NetworkPlugin{
	"azure":   ContainerServiceNetworkProfile_NetworkPlugin_Azure,
	"kubenet": ContainerServiceNetworkProfile_NetworkPlugin_Kubenet,
	"none":    ContainerServiceNetworkProfile_NetworkPlugin_None,
}

// +kubebuilder:validation:Enum={"overlay"}
type ContainerServiceNetworkProfile_NetworkPluginMode string

const ContainerServiceNetworkProfile_NetworkPluginMode_Overlay = ContainerServiceNetworkProfile_NetworkPluginMode("overlay")

// Mapping from string to ContainerServiceNetworkProfile_NetworkPluginMode
var containerServiceNetworkProfile_NetworkPluginMode_Values = map[string]ContainerServiceNetworkProfile_NetworkPluginMode{
	"overlay": ContainerServiceNetworkProfile_NetworkPluginMode_Overlay,
}

// +kubebuilder:validation:Enum={"azure","calico","cilium","none"}
type ContainerServiceNetworkProfile_NetworkPolicy string

const (
	ContainerServiceNetworkProfile_NetworkPolicy_Azure  = ContainerServiceNetworkProfile_NetworkPolicy("azure")
	ContainerServiceNetworkProfile_NetworkPolicy_Calico = ContainerServiceNetworkProfile_NetworkPolicy("calico")
	ContainerServiceNetworkProfile_NetworkPolicy_Cilium = ContainerServiceNetworkProfile_NetworkPolicy("cilium")
	ContainerServiceNetworkProfile_NetworkPolicy_None   = ContainerServiceNetworkProfile_NetworkPolicy("none")
)

// Mapping from string to ContainerServiceNetworkProfile_NetworkPolicy
var containerServiceNetworkProfile_NetworkPolicy_Values = map[string]ContainerServiceNetworkProfile_NetworkPolicy{
	"azure":  ContainerServiceNetworkProfile_NetworkPolicy_Azure,
	"calico": ContainerServiceNetworkProfile_NetworkPolicy_Calico,
	"cilium": ContainerServiceNetworkProfile_NetworkPolicy_Cilium,
	"none":   ContainerServiceNetworkProfile_NetworkPolicy_None,
}

// +kubebuilder:validation:Enum={"loadBalancer","managedNATGateway","userAssignedNATGateway","userDefinedRouting"}
type ContainerServiceNetworkProfile_OutboundType string

const (
	ContainerServiceNetworkProfile_OutboundType_LoadBalancer           = ContainerServiceNetworkProfile_OutboundType("loadBalancer")
	ContainerServiceNetworkProfile_OutboundType_ManagedNATGateway      = ContainerServiceNetworkProfile_OutboundType("managedNATGateway")
	ContainerServiceNetworkProfile_OutboundType_UserAssignedNATGateway = ContainerServiceNetworkProfile_OutboundType("userAssignedNATGateway")
	ContainerServiceNetworkProfile_OutboundType_UserDefinedRouting     = ContainerServiceNetworkProfile_OutboundType("userDefinedRouting")
)

// Mapping from string to ContainerServiceNetworkProfile_OutboundType
var containerServiceNetworkProfile_OutboundType_Values = map[string]ContainerServiceNetworkProfile_OutboundType{
	"loadbalancer":           ContainerServiceNetworkProfile_OutboundType_LoadBalancer,
	"managednatgateway":      ContainerServiceNetworkProfile_OutboundType_ManagedNATGateway,
	"userassignednatgateway": ContainerServiceNetworkProfile_OutboundType_UserAssignedNATGateway,
	"userdefinedrouting":     ContainerServiceNetworkProfile_OutboundType_UserDefinedRouting,
}

// SSH configuration for Linux-based VMs running on Azure.
type ContainerServiceSshConfiguration struct {
	// PublicKeys: The list of SSH public keys used to authenticate with Linux-based VMs. A maximum of 1 key may be specified.
	PublicKeys []ContainerServiceSshPublicKey `json:"publicKeys"`
}

// Istio service mesh configuration.
type IstioServiceMesh struct {
	// CertificateAuthority: Istio Service Mesh Certificate Authority (CA) configuration. For now, we only support plugin
	// certificates as described  here https://aka.ms/asm-plugin-ca
	CertificateAuthority *IstioCertificateAuthority `json:"certificateAuthority,omitempty"`

	// Components: Istio components configuration.
	Components *IstioComponents `json:"components,omitempty"`

	// Revisions: The list of revisions of the Istio control plane. When an upgrade is not in progress, this holds one value.
	// When canary upgrade is in progress, this can only hold two consecutive values. For more information, see:
	// https://learn.microsoft.com/en-us/azure/aks/istio-upgrade
	Revisions []string `json:"revisions"`
}

// +kubebuilder:validation:Enum={"NodeImage","None","SecurityPatch","Unmanaged"}
type ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel string

const (
	ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_NodeImage     = ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel("NodeImage")
	ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_None          = ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel("None")
	ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_SecurityPatch = ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel("SecurityPatch")
	ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_Unmanaged     = ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel("Unmanaged")
)

// Mapping from string to ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel
var managedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_Values = map[string]ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel{
	"nodeimage":     ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_NodeImage,
	"none":          ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_None,
	"securitypatch": ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_SecurityPatch,
	"unmanaged":     ManagedClusterAutoUpgradeProfile_NodeOSUpgradeChannel_Unmanaged,
}

// +kubebuilder:validation:Enum={"node-image","none","patch","rapid","stable"}
type ManagedClusterAutoUpgradeProfile_UpgradeChannel string

const (
	ManagedClusterAutoUpgradeProfile_UpgradeChannel_NodeImage = ManagedClusterAutoUpgradeProfile_UpgradeChannel("node-image")
	ManagedClusterAutoUpgradeProfile_UpgradeChannel_None      = ManagedClusterAutoUpgradeProfile_UpgradeChannel("none")
	ManagedClusterAutoUpgradeProfile_UpgradeChannel_Patch     = ManagedClusterAutoUpgradeProfile_UpgradeChannel("patch")
	ManagedClusterAutoUpgradeProfile_UpgradeChannel_Rapid     = ManagedClusterAutoUpgradeProfile_UpgradeChannel("rapid")
	ManagedClusterAutoUpgradeProfile_UpgradeChannel_Stable    = ManagedClusterAutoUpgradeProfile_UpgradeChannel("stable")
)

// Mapping from string to ManagedClusterAutoUpgradeProfile_UpgradeChannel
var managedClusterAutoUpgradeProfile_UpgradeChannel_Values = map[string]ManagedClusterAutoUpgradeProfile_UpgradeChannel{
	"node-image": ManagedClusterAutoUpgradeProfile_UpgradeChannel_NodeImage,
	"none":       ManagedClusterAutoUpgradeProfile_UpgradeChannel_None,
	"patch":      ManagedClusterAutoUpgradeProfile_UpgradeChannel_Patch,
	"rapid":      ManagedClusterAutoUpgradeProfile_UpgradeChannel_Rapid,
	"stable":     ManagedClusterAutoUpgradeProfile_UpgradeChannel_Stable,
}

// Metrics profile for the Azure Monitor managed service for Prometheus addon. Collect out-of-the-box Kubernetes
// infrastructure metrics to send to an Azure Monitor Workspace and configure additional scraping for custom targets. See
// aka.ms/AzureManagedPrometheus for an overview.
type ManagedClusterAzureMonitorProfileMetrics struct {
	// Enabled: Whether to enable or disable the Azure Managed Prometheus addon for Prometheus monitoring. See
	// aka.ms/AzureManagedPrometheus-aks-enable for details on enabling and disabling.
	Enabled *bool `json:"enabled,omitempty"`

	// KubeStateMetrics: Kube State Metrics profile for the Azure Managed Prometheus addon. These optional settings are for the
	//  kube-state-metrics pod that is deployed with the addon. See aka.ms/AzureManagedPrometheus-optional-parameters for
	// details.
	KubeStateMetrics *ManagedClusterAzureMonitorProfileKubeStateMetrics `json:"kubeStateMetrics,omitempty"`
}

// The cost analysis configuration for the cluster
type ManagedClusterCostAnalysis struct {
	// Enabled: The Managed Cluster sku.tier must be set to 'Standard' or 'Premium' to enable this feature. Enabling this will
	// add Kubernetes Namespace and Deployment details to the Cost Analysis views in the Azure portal. If not specified, the
	// default is false. For more information see aka.ms/aks/docs/cost-analysis.
	Enabled *bool `json:"enabled,omitempty"`
}

// Application Routing add-on settings for the ingress profile.
type ManagedClusterIngressProfileWebAppRouting struct {
	// DnsZoneResourceIds: Resource IDs of the DNS zones to be associated with the Application Routing add-on. Used only when
	// Application Routing add-on is enabled. Public and private DNS zones can be in different resource groups, but all public
	// DNS zones must be in the same resource group and all private DNS zones must be in the same resource group.
	DnsZoneResourceIds []string `json:"dnsZoneResourceIds,omitempty"`

	// Enabled: Whether to enable the Application Routing add-on.
	Enabled *bool `json:"enabled,omitempty"`
}

// Profile of the managed cluster load balancer.
type ManagedClusterLoadBalancerProfile struct {
	// AllocatedOutboundPorts: The desired number of allocated SNAT ports per VM. Allowed values are in the range of 0 to 64000
	// (inclusive). The default value is 0 which results in Azure dynamically allocating ports.
	AllocatedOutboundPorts *int `json:"allocatedOutboundPorts,omitempty"`

	// BackendPoolType: The type of the managed inbound Load Balancer BackendPool.
	BackendPoolType *ManagedClusterLoadBalancerProfile_BackendPoolType `json:"backendPoolType,omitempty"`

	// EffectiveOutboundIPs: The effective outbound IP resources of the cluster load balancer.
	EffectiveOutboundIPs []ResourceReference `json:"effectiveOutboundIPs"`

	// EnableMultipleStandardLoadBalancers: Enable multiple standard load balancers per AKS cluster or not.
	EnableMultipleStandardLoadBalancers *bool `json:"enableMultipleStandardLoadBalancers,omitempty"`

	// IdleTimeoutInMinutes: Desired outbound flow idle timeout in minutes. Allowed values are in the range of 4 to 120
	// (inclusive). The default value is 30 minutes.
	IdleTimeoutInMinutes *int `json:"idleTimeoutInMinutes,omitempty"`

	// ManagedOutboundIPs: Desired managed outbound IPs for the cluster load balancer.
	ManagedOutboundIPs *ManagedClusterLoadBalancerProfile_ManagedOutboundIPs `json:"managedOutboundIPs,omitempty"`

	// OutboundIPPrefixes: Desired outbound IP Prefix resources for the cluster load balancer.
	OutboundIPPrefixes *ManagedClusterLoadBalancerProfile_OutboundIPPrefixes `json:"outboundIPPrefixes,omitempty"`

	// OutboundIPs: Desired outbound IP resources for the cluster load balancer.
	OutboundIPs *ManagedClusterLoadBalancerProfile_OutboundIPs `json:"outboundIPs,omitempty"`
}

// Profile of the managed cluster NAT gateway.
type ManagedClusterNATGatewayProfile struct {
	// EffectiveOutboundIPs: The effective outbound IP resources of the cluster NAT gateway.
	EffectiveOutboundIPs []ResourceReference `json:"effectiveOutboundIPs"`

	// IdleTimeoutInMinutes: Desired outbound flow idle timeout in minutes. Allowed values are in the range of 4 to 120
	// (inclusive). The default value is 4 minutes.
	IdleTimeoutInMinutes *int `json:"idleTimeoutInMinutes,omitempty"`

	// ManagedOutboundIPProfile: Profile of the managed outbound IP resources of the cluster NAT gateway.
	ManagedOutboundIPProfile *ManagedClusterManagedOutboundIPProfile `json:"managedOutboundIPProfile,omitempty"`
}

// +kubebuilder:validation:Enum={"ReadOnly","Unrestricted"}
type ManagedClusterNodeResourceGroupProfile_RestrictionLevel string

const (
	ManagedClusterNodeResourceGroupProfile_RestrictionLevel_ReadOnly     = ManagedClusterNodeResourceGroupProfile_RestrictionLevel("ReadOnly")
	ManagedClusterNodeResourceGroupProfile_RestrictionLevel_Unrestricted = ManagedClusterNodeResourceGroupProfile_RestrictionLevel("Unrestricted")
)

// Mapping from string to ManagedClusterNodeResourceGroupProfile_RestrictionLevel
var managedClusterNodeResourceGroupProfile_RestrictionLevel_Values = map[string]ManagedClusterNodeResourceGroupProfile_RestrictionLevel{
	"readonly":     ManagedClusterNodeResourceGroupProfile_RestrictionLevel_ReadOnly,
	"unrestricted": ManagedClusterNodeResourceGroupProfile_RestrictionLevel_Unrestricted,
}

// Details about the pod identity assigned to the Managed Cluster.
type ManagedClusterPodIdentity struct {
	// BindingSelector: The binding selector to use for the AzureIdentityBinding resource.
	BindingSelector *string `json:"bindingSelector,omitempty"`

	// Identity: The user assigned identity details.
	Identity *UserAssignedIdentity `json:"identity,omitempty"`

	// Name: The name of the pod identity.
	Name *string `json:"name,omitempty"`

	// Namespace: The namespace of the pod identity.
	Namespace *string `json:"namespace,omitempty"`
}

// See [disable AAD Pod Identity for a specific
// Pod/Application](https://azure.github.io/aad-pod-identity/docs/configure/application_exception/) for more details.
type ManagedClusterPodIdentityException struct {
	// Name: The name of the pod identity exception.
	Name *string `json:"name,omitempty"`

	// Namespace: The namespace of the pod identity exception.
	Namespace *string `json:"namespace,omitempty"`

	// PodLabels: The pod labels to match.
	PodLabels map[string]string `json:"podLabels"`
}

// +kubebuilder:validation:Enum={"least-waste","most-pods","priority","random"}
type ManagedClusterProperties_AutoScalerProfile_Expander string

const (
	ManagedClusterProperties_AutoScalerProfile_Expander_LeastWaste = ManagedClusterProperties_AutoScalerProfile_Expander("least-waste")
	ManagedClusterProperties_AutoScalerProfile_Expander_MostPods   = ManagedClusterProperties_AutoScalerProfile_Expander("most-pods")
	ManagedClusterProperties_AutoScalerProfile_Expander_Priority   = ManagedClusterProperties_AutoScalerProfile_Expander("priority")
	ManagedClusterProperties_AutoScalerProfile_Expander_Random     = ManagedClusterProperties_AutoScalerProfile_Expander("random")
)

// Mapping from string to ManagedClusterProperties_AutoScalerProfile_Expander
var managedClusterProperties_AutoScalerProfile_Expander_Values = map[string]ManagedClusterProperties_AutoScalerProfile_Expander{
	"least-waste": ManagedClusterProperties_AutoScalerProfile_Expander_LeastWaste,
	"most-pods":   ManagedClusterProperties_AutoScalerProfile_Expander_MostPods,
	"priority":    ManagedClusterProperties_AutoScalerProfile_Expander_Priority,
	"random":      ManagedClusterProperties_AutoScalerProfile_Expander_Random,
}

// Microsoft Defender settings for the security profile.
type ManagedClusterSecurityProfileDefender struct {
	// LogAnalyticsWorkspaceResourceId: Resource ID of the Log Analytics workspace to be associated with Microsoft Defender.
	// When Microsoft Defender is enabled, this field is required and must be a valid workspace resource ID. When Microsoft
	// Defender is disabled, leave the field empty.
	LogAnalyticsWorkspaceResourceId *string `json:"logAnalyticsWorkspaceResourceId,omitempty"`

	// SecurityMonitoring: Microsoft Defender threat detection for Cloud settings for the security profile.
	SecurityMonitoring *ManagedClusterSecurityProfileDefenderSecurityMonitoring `json:"securityMonitoring,omitempty"`
}

// Image Cleaner removes unused images from nodes, freeing up disk space and helping to reduce attack surface area. Here
// are settings for the security profile.
type ManagedClusterSecurityProfileImageCleaner struct {
	// Enabled: Whether to enable Image Cleaner on AKS cluster.
	Enabled *bool `json:"enabled,omitempty"`

	// IntervalHours: Image Cleaner scanning interval in hours.
	IntervalHours *int `json:"intervalHours,omitempty"`
}

// Workload identity settings for the security profile.
type ManagedClusterSecurityProfileWorkloadIdentity struct {
	// Enabled: Whether to enable workload identity.
	Enabled *bool `json:"enabled,omitempty"`
}

// AzureBlob CSI Driver settings for the storage profile.
type ManagedClusterStorageProfileBlobCSIDriver struct {
	// Enabled: Whether to enable AzureBlob CSI Driver. The default value is false.
	Enabled *bool `json:"enabled,omitempty"`
}

// AzureDisk CSI Driver settings for the storage profile.
type ManagedClusterStorageProfileDiskCSIDriver struct {
	// Enabled: Whether to enable AzureDisk CSI Driver. The default value is true.
	Enabled *bool `json:"enabled,omitempty"`
}

// AzureFile CSI Driver settings for the storage profile.
type ManagedClusterStorageProfileFileCSIDriver struct {
	// Enabled: Whether to enable AzureFile CSI Driver. The default value is true.
	Enabled *bool `json:"enabled,omitempty"`
}

// Snapshot Controller settings for the storage profile.
type ManagedClusterStorageProfileSnapshotController struct {
	// Enabled: Whether to enable Snapshot Controller. The default value is true.
	Enabled *bool `json:"enabled,omitempty"`
}

// +kubebuilder:validation:Enum={"None","Windows_Server"}
type ManagedClusterWindowsProfile_LicenseType string

const (
	ManagedClusterWindowsProfile_LicenseType_None           = ManagedClusterWindowsProfile_LicenseType("None")
	ManagedClusterWindowsProfile_LicenseType_Windows_Server = ManagedClusterWindowsProfile_LicenseType("Windows_Server")
)

// Mapping from string to ManagedClusterWindowsProfile_LicenseType
var managedClusterWindowsProfile_LicenseType_Values = map[string]ManagedClusterWindowsProfile_LicenseType{
	"none":           ManagedClusterWindowsProfile_LicenseType_None,
	"windows_server": ManagedClusterWindowsProfile_LicenseType_Windows_Server,
}

// KEDA (Kubernetes Event-driven Autoscaling) settings for the workload auto-scaler profile.
type ManagedClusterWorkloadAutoScalerProfileKeda struct {
	// Enabled: Whether to enable KEDA.
	Enabled *bool `json:"enabled,omitempty"`
}

// VPA (Vertical Pod Autoscaler) settings for the workload auto-scaler profile.
type ManagedClusterWorkloadAutoScalerProfileVerticalPodAutoscaler struct {
	// Enabled: Whether to enable VPA. Default value is false.
	Enabled *bool `json:"enabled,omitempty"`
}

// +kubebuilder:validation:Enum={"Disabled","Istio"}
type ServiceMeshProfile_Mode string

const (
	ServiceMeshProfile_Mode_Disabled = ServiceMeshProfile_Mode("Disabled")
	ServiceMeshProfile_Mode_Istio    = ServiceMeshProfile_Mode("Istio")
)

// Mapping from string to ServiceMeshProfile_Mode
var serviceMeshProfile_Mode_Values = map[string]ServiceMeshProfile_Mode{
	"disabled": ServiceMeshProfile_Mode_Disabled,
	"istio":    ServiceMeshProfile_Mode_Istio,
}

// Settings for overrides when upgrading a cluster.
type UpgradeOverrideSettings struct {
	// ForceUpgrade: Whether to force upgrade the cluster. Note that this option instructs upgrade operation to bypass upgrade
	// protections such as checking for deprecated API usage. Enable this option only with caution.
	ForceUpgrade *bool `json:"forceUpgrade,omitempty"`

	// Until: Until when the overrides are effective. Note that this only matches the start time of an upgrade, and the
	// effectiveness won't change once an upgrade starts even if the `until` expires as upgrade proceeds. This field is not set
	// by default. It must be set for the overrides to take effect.
	Until *string `json:"until,omitempty"`
}

// Windows gMSA Profile in the managed cluster.
type WindowsGmsaProfile struct {
	// DnsServer: Specifies the DNS server for Windows gMSA.
	// Set it to empty if you have configured the DNS server in the vnet which is used to create the managed cluster.
	DnsServer *string `json:"dnsServer,omitempty"`

	// Enabled: Specifies whether to enable Windows gMSA in the managed cluster.
	Enabled *bool `json:"enabled,omitempty"`

	// RootDomainName: Specifies the root domain name for Windows gMSA.
	// Set it to empty if you have configured the DNS server in the vnet which is used to create the managed cluster.
	RootDomainName *string `json:"rootDomainName,omitempty"`
}

// Observability profile to enable advanced network metrics and flow logs with historical contexts.
type AdvancedNetworkingObservability struct {
	// Enabled: Indicates the enablement of Advanced Networking observability functionalities on clusters.
	Enabled *bool `json:"enabled,omitempty"`
}

// Security profile to enable security features on cilium based cluster.
type AdvancedNetworkingSecurity struct {
	// Enabled: This feature allows user to configure network policy based on DNS (FQDN) names. It can be enabled only on
	// cilium based clusters. If not specified, the default is false.
	Enabled *bool `json:"enabled,omitempty"`
}

// +kubebuilder:validation:Enum={"Private","Public"}
type AzureKeyVaultKms_KeyVaultNetworkAccess string

const (
	AzureKeyVaultKms_KeyVaultNetworkAccess_Private = AzureKeyVaultKms_KeyVaultNetworkAccess("Private")
	AzureKeyVaultKms_KeyVaultNetworkAccess_Public  = AzureKeyVaultKms_KeyVaultNetworkAccess("Public")
)

// Mapping from string to AzureKeyVaultKms_KeyVaultNetworkAccess
var azureKeyVaultKms_KeyVaultNetworkAccess_Values = map[string]AzureKeyVaultKms_KeyVaultNetworkAccess{
	"private": AzureKeyVaultKms_KeyVaultNetworkAccess_Private,
	"public":  AzureKeyVaultKms_KeyVaultNetworkAccess_Public,
}

// Contains information about SSH certificate public key data.
type ContainerServiceSshPublicKey struct {
	// KeyData: Certificate public key used to authenticate with VMs through SSH. The certificate must be in PEM format with or
	// without headers.
	KeyData *string `json:"keyData,omitempty"`
}

// Istio Service Mesh Certificate Authority (CA) configuration. For now, we only support plugin certificates as described
// here https://aka.ms/asm-plugin-ca
type IstioCertificateAuthority struct {
	// Plugin: Plugin certificates information for Service Mesh.
	Plugin *IstioPluginCertificateAuthority `json:"plugin,omitempty"`
}

// Istio components configuration.
type IstioComponents struct {
	// EgressGateways: Istio egress gateways.
	EgressGateways []IstioEgressGateway `json:"egressGateways"`

	// IngressGateways: Istio ingress gateways.
	IngressGateways []IstioIngressGateway `json:"ingressGateways"`
}

// Kube State Metrics profile for the Azure Managed Prometheus addon. These optional settings are for the
// kube-state-metrics pod that is deployed with the addon. See aka.ms/AzureManagedPrometheus-optional-parameters for
// details.
type ManagedClusterAzureMonitorProfileKubeStateMetrics struct {
	// MetricAnnotationsAllowList: Comma-separated list of Kubernetes annotation keys that will be used in the resource's
	// labels metric (Example: 'namespaces=[kubernetes.io/team,...],pods=[kubernetes.io/team],...'). By default the metric
	// contains only resource name and namespace labels.
	MetricAnnotationsAllowList *string `json:"metricAnnotationsAllowList,omitempty"`

	// MetricLabelsAllowlist: Comma-separated list of additional Kubernetes label keys that will be used in the resource's
	// labels metric (Example: 'namespaces=[k8s-label-1,k8s-label-n,...],pods=[app],...'). By default the metric contains only
	// resource name and namespace labels.
	MetricLabelsAllowlist *string `json:"metricLabelsAllowlist,omitempty"`
}

// +kubebuilder:validation:Enum={"NodeIP","NodeIPConfiguration"}
type ManagedClusterLoadBalancerProfile_BackendPoolType string

const (
	ManagedClusterLoadBalancerProfile_BackendPoolType_NodeIP              = ManagedClusterLoadBalancerProfile_BackendPoolType("NodeIP")
	ManagedClusterLoadBalancerProfile_BackendPoolType_NodeIPConfiguration = ManagedClusterLoadBalancerProfile_BackendPoolType("NodeIPConfiguration")
)

// Mapping from string to ManagedClusterLoadBalancerProfile_BackendPoolType
var managedClusterLoadBalancerProfile_BackendPoolType_Values = map[string]ManagedClusterLoadBalancerProfile_BackendPoolType{
	"nodeip":              ManagedClusterLoadBalancerProfile_BackendPoolType_NodeIP,
	"nodeipconfiguration": ManagedClusterLoadBalancerProfile_BackendPoolType_NodeIPConfiguration,
}

type ManagedClusterLoadBalancerProfile_ManagedOutboundIPs struct {
	// Count: The desired number of IPv4 outbound IPs created/managed by Azure for the cluster load balancer. Allowed values
	// must be in the range of 1 to 100 (inclusive). The default value is 1.
	Count *int `json:"count,omitempty"`

	// CountIPv6: The desired number of IPv6 outbound IPs created/managed by Azure for the cluster load balancer. Allowed
	// values must be in the range of 1 to 100 (inclusive). The default value is 0 for single-stack and 1 for dual-stack.
	CountIPv6 *int `json:"countIPv6,omitempty"`
}

type ManagedClusterLoadBalancerProfile_OutboundIPPrefixes struct {
	// PublicIPPrefixes: A list of public IP prefix resources.
	PublicIPPrefixes []ResourceReference `json:"publicIPPrefixes"`
}

type ManagedClusterLoadBalancerProfile_OutboundIPs struct {
	// PublicIPs: A list of public IP resources.
	PublicIPs []ResourceReference `json:"publicIPs"`
}

// Profile of the managed outbound IP resources of the managed cluster.
type ManagedClusterManagedOutboundIPProfile struct {
	// Count: The desired number of outbound IPs created/managed by Azure. Allowed values must be in the range of 1 to 16
	// (inclusive). The default value is 1.
	Count *int `json:"count,omitempty"`
}

// Microsoft Defender settings for the security profile threat detection.
type ManagedClusterSecurityProfileDefenderSecurityMonitoring struct {
	// Enabled: Whether to enable Defender threat detection
	Enabled *bool `json:"enabled,omitempty"`
}

// A reference to an Azure resource.
type ResourceReference struct {
	// Id: The fully qualified Azure resource id.
	Id *string `json:"id,omitempty"`
}

// Istio egress gateway configuration.
type IstioEgressGateway struct {
	// Enabled: Whether to enable the egress gateway.
	Enabled *bool `json:"enabled,omitempty"`
}

// Istio ingress gateway configuration. For now, we support up to one external ingress gateway named
// `aks-istio-ingressgateway-external` and one internal ingress gateway named `aks-istio-ingressgateway-internal`.
type IstioIngressGateway struct {
	// Enabled: Whether to enable the ingress gateway.
	Enabled *bool `json:"enabled,omitempty"`

	// Mode: Mode of an ingress gateway.
	Mode *IstioIngressGateway_Mode `json:"mode,omitempty"`
}

// Plugin certificates information for Service Mesh.
type IstioPluginCertificateAuthority struct {
	// CertChainObjectName: Certificate chain object name in Azure Key Vault.
	CertChainObjectName *string `json:"certChainObjectName,omitempty"`

	// CertObjectName: Intermediate certificate object name in Azure Key Vault.
	CertObjectName *string `json:"certObjectName,omitempty"`

	// KeyObjectName: Intermediate certificate private key object name in Azure Key Vault.
	KeyObjectName *string `json:"keyObjectName,omitempty"`

	// KeyVaultId: The resource ID of the Key Vault.
	KeyVaultId *string `json:"keyVaultId,omitempty"`

	// RootCertObjectName: Root certificate object name in Azure Key Vault.
	RootCertObjectName *string `json:"rootCertObjectName,omitempty"`
}

// +kubebuilder:validation:Enum={"External","Internal"}
type IstioIngressGateway_Mode string

const (
	IstioIngressGateway_Mode_External = IstioIngressGateway_Mode("External")
	IstioIngressGateway_Mode_Internal = IstioIngressGateway_Mode("Internal")
)

// Mapping from string to IstioIngressGateway_Mode
var istioIngressGateway_Mode_Values = map[string]IstioIngressGateway_Mode{
	"external": IstioIngressGateway_Mode_External,
	"internal": IstioIngressGateway_Mode_Internal,
}
