use crate::prelude::*;

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium -f /home/mmoreiradj/git/crd-rs/crds/cilium/v2/ciliumnetworkpolicies.yaml --schema=derived -d --hide-prelude
// kopium version: 0.22.5

/// Spec is the desired Cilium specific rule specification.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, JsonSchema)]
#[kube(
    group = "cilium.io",
    version = "v2",
    kind = "CiliumNetworkPolicy",
    plural = "ciliumnetworkpolicies"
)]
#[kube(namespaced)]
#[kube(status = "CiliumNetworkPolicyStatus")]
pub struct CiliumNetworkPolicySpec {
    /// Description is a free form string, it can be used by the creator of
    /// the rule to store human readable explanation of the purpose of this
    /// rule. Rules cannot be identified by comment.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub description: Option<String>,
    /// Egress is a list of EgressRule which are enforced at egress.
    /// If omitted or empty, this rule does not apply at egress.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub egress: Option<Vec<CiliumNetworkPolicyEgress>>,
    /// EgressDeny is a list of EgressDenyRule which are enforced at egress.
    /// Any rule inserted here will be denied regardless of the allowed egress
    /// rules in the 'egress' field.
    /// If omitted or empty, this rule does not apply at egress.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "egressDeny"
    )]
    pub egress_deny: Option<Vec<CiliumNetworkPolicyEgressDeny>>,
    /// EnableDefaultDeny determines whether this policy configures the
    /// subject endpoint(s) to have a default deny mode. If enabled,
    /// this causes all traffic not explicitly allowed by a network policy
    /// to be dropped.
    ///
    /// If not specified, the default is true for each traffic direction
    /// that has rules, and false otherwise. For example, if a policy
    /// only has Ingress or IngressDeny rules, then the default for
    /// ingress is true and egress is false.
    ///
    /// If multiple policies apply to an endpoint, that endpoint's default deny
    /// will be enabled if any policy requests it.
    ///
    /// This is useful for creating broad-based network policies that will not
    /// cause endpoints to enter default-deny mode.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "enableDefaultDeny"
    )]
    pub enable_default_deny: Option<CiliumNetworkPolicyEnableDefaultDeny>,
    /// EndpointSelector selects all endpoints which should be subject to
    /// this rule. EndpointSelector and NodeSelector cannot be both empty and
    /// are mutually exclusive.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "endpointSelector"
    )]
    pub endpoint_selector: Option<CiliumNetworkPolicyEndpointSelector>,
    /// Ingress is a list of IngressRule which are enforced at ingress.
    /// If omitted or empty, this rule does not apply at ingress.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ingress: Option<Vec<CiliumNetworkPolicyIngress>>,
    /// IngressDeny is a list of IngressDenyRule which are enforced at ingress.
    /// Any rule inserted here will be denied regardless of the allowed ingress
    /// rules in the 'ingress' field.
    /// If omitted or empty, this rule does not apply at ingress.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "ingressDeny"
    )]
    pub ingress_deny: Option<Vec<CiliumNetworkPolicyIngressDeny>>,
    /// Labels is a list of optional strings which can be used to
    /// re-identify the rule or to store metadata. It is possible to lookup
    /// or delete strings based on labels. Labels are not required to be
    /// unique, multiple rules can have overlapping or identical labels.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<Vec<CiliumNetworkPolicyLabels>>,
    /// Log specifies custom policy-specific Hubble logging configuration.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub log: Option<CiliumNetworkPolicyLog>,
    /// NodeSelector selects all nodes which should be subject to this rule.
    /// EndpointSelector and NodeSelector cannot be both empty and are mutually
    /// exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "nodeSelector"
    )]
    pub node_selector: Option<CiliumNetworkPolicyNodeSelector>,
}

/// EgressRule contains all rule types which can be applied at egress, i.e.
/// network traffic that originates inside the endpoint and exits the endpoint
/// selected by the endpointSelector.
///
///   - All members of this structure are optional. If omitted or empty, the
///     member will have no effect on the rule.
///
///   - If multiple members of the structure are specified, then all members
///     must match in order for the rule to take effect.
///
///   - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
///     mutually exclusive. Only one of these members may be present within an
///     individual rule.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgress {
    /// Authentication is the required authentication type for the allowed traffic, if any.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub authentication: Option<CiliumNetworkPolicyEgressAuthentication>,
    /// ICMPs is a list of ICMP rule identified by type number
    /// which the endpoint subject to the rule is allowed to connect to.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" is allowed to initiate
    /// type 8 ICMP connections.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icmps: Option<Vec<CiliumNetworkPolicyEgressIcmps>>,
    /// ToCIDR is a list of IP blocks which the endpoint subject to the rule
    /// is allowed to initiate connections. Only connections destined for
    /// outside of the cluster and not targeting the host will be subject
    /// to CIDR rules.  This will match on the destination IP address of
    /// outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
    /// with no ExcludeCIDRs is equivalent. Overlaps are allowed between
    /// ToCIDR and ToCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=database-proxy" is allowed to
    /// initiate connections to 10.2.3.0/24
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toCIDR")]
    pub to_cidr: Option<Vec<String>>,
    /// ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
    /// is allowed to initiate connections to in addition to connections
    /// which are allowed via ToEndpoints, along with a list of subnets contained
    /// within their corresponding IP block to which traffic should not be
    /// allowed. This will match on the destination IP address of outgoing
    /// connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
    /// ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
    /// ToCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=database-proxy" is allowed to
    /// initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toCIDRSet")]
    pub to_cidr_set: Option<Vec<CiliumNetworkPolicyEgressToCidrSet>>,
    /// ToEndpoints is a list of endpoints identified by an EndpointSelector to
    /// which the endpoints subject to the rule are allowed to communicate.
    ///
    /// Example:
    /// Any endpoint with the label "role=frontend" can communicate with any
    /// endpoint carrying the label "role=backend".
    ///
    /// Note that while an empty non-nil ToEndpoints does not select anything,
    /// nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
    /// are also specified.
    /// To select everything, use one EndpointSelector without any match requirements.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toEndpoints"
    )]
    pub to_endpoints: Option<Vec<CiliumNetworkPolicyEgressToEndpoints>>,
    /// ToEntities is a list of special entities to which the endpoint subject
    /// to the rule is allowed to initiate connections. Supported entities are
    /// `world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
    /// `health`, `unmanaged`, `none` and `all`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toEntities"
    )]
    pub to_entities: Option<Vec<String>>,
    /// ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
    /// from DNS resolution of `ToFQDN.MatchName`s are added to the same
    /// EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
    /// L7 rules within this EgressRule will also apply to these IPs.
    /// The DNS -> IP mapping is re-resolved periodically from within the
    /// cilium-agent, and the IPs in the DNS response are effected in the policy
    /// for selected pods as-is (i.e. the list of IPs is not modified in any way).
    /// Note: An explicit rule to allow for DNS traffic is needed for the pods, as
    /// ToFQDN counts as an egress rule and will enforce egress policy when
    /// PolicyEnforcment=default.
    /// Note: If the resolved IPs are IPs within the kubernetes cluster, the
    /// ToFQDN rule will not apply to that IP.
    /// Note: ToFQDN cannot occur in the same policy as other To* rules.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toFQDNs")]
    pub to_fqd_ns: Option<Vec<CiliumNetworkPolicyEgressToFqdNs>>,
    /// ToGroups is a directive that allows the integration with multiple outside
    /// providers. Currently, only AWS is supported, and the rule can select by
    /// multiple sub directives:
    ///
    /// Example:
    /// toGroups:
    /// - aws:
    ///     securityGroupsIds:
    ///     - 'sg-XXXXXXXXXXXXX'
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toGroups")]
    pub to_groups: Option<Vec<CiliumNetworkPolicyEgressToGroups>>,
    /// ToNodes is a list of nodes identified by an
    /// EndpointSelector to which endpoints subject to the rule is allowed to communicate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toNodes")]
    pub to_nodes: Option<Vec<CiliumNetworkPolicyEgressToNodes>>,
    /// ToPorts is a list of destination ports identified by port number and
    /// protocol which the endpoint subject to the rule is allowed to
    /// connect to.
    ///
    /// Example:
    /// Any endpoint with the label "role=frontend" is allowed to initiate
    /// connections to destination port 8080/tcp
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPorts")]
    pub to_ports: Option<Vec<CiliumNetworkPolicyEgressToPorts>>,
    /// Deprecated.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toRequires"
    )]
    pub to_requires: Option<Vec<String>>,
    /// ToServices is a list of services to which the endpoint subject
    /// to the rule is allowed to initiate connections.
    /// Currently Cilium only supports toServices for K8s services.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toServices"
    )]
    pub to_services: Option<Vec<CiliumNetworkPolicyEgressToServices>>,
}

/// Authentication is the required authentication type for the allowed traffic, if any.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressAuthentication {
    /// Mode is the required authentication mode for the allowed traffic, if any.
    pub mode: CiliumNetworkPolicyEgressAuthenticationMode,
}

/// Authentication is the required authentication type for the allowed traffic, if any.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressAuthenticationMode {
    #[serde(rename = "disabled")]
    Disabled,
    #[serde(rename = "required")]
    Required,
    #[serde(rename = "test-always-fail")]
    TestAlwaysFail,
}

/// ICMPRule is a list of ICMP fields.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressIcmps {
    /// Fields is a list of ICMP fields.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fields: Option<Vec<CiliumNetworkPolicyEgressIcmpsFields>>,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressIcmpsFields {
    /// Family is a IP address version.
    /// Currently, we support `IPv4` and `IPv6`.
    /// `IPv4` is set as default.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub family: Option<CiliumNetworkPolicyEgressIcmpsFieldsFamily>,
    /// Type is a ICMP-type.
    /// It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
    /// Allowed ICMP types are:
    ///     Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
    /// 		     RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
    /// 			 Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
    ///     Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
    /// 			 EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
    /// 			 MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
    /// 			 NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
    /// 			 ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
    /// 			 HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
    /// 			 MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
    /// 			 ExtendedEchoRequest | ExtendedEchoReply
    #[serde(rename = "type")]
    pub r#type: IntOrString,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressIcmpsFieldsFamily {
    IPv4,
    IPv6,
}

/// CIDRRule is a rule that specifies a CIDR prefix to/from which outside
/// communication  is allowed, along with an optional list of subnets within that
/// CIDR prefix to/from which outside communication is not allowed.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToCidrSet {
    /// CIDR is a CIDR prefix / IP Block.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cidr: Option<String>,
    /// CIDRGroupRef is a reference to a CiliumCIDRGroup object.
    /// A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
    /// the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
    /// connections from.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupRef"
    )]
    pub cidr_group_ref: Option<String>,
    /// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
    /// rather than by name.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupSelector"
    )]
    pub cidr_group_selector: Option<CiliumNetworkPolicyEgressToCidrSetCidrGroupSelector>,
    /// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
    /// is not allowed to initiate connections to. These CIDR prefixes should be
    /// contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
    /// supported yet.
    /// These exceptions are only applied to the Cidr in this CIDRRule, and do not
    /// apply to any other CIDR prefixes in any other CIDRRules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub except: Option<Vec<String>>,
}

/// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
/// rather than by name.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToCidrSetCidrGroupSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicyEgressToCidrSetCidrGroupSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToCidrSetCidrGroupSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyEgressToCidrSetCidrGroupSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressToCidrSetCidrGroupSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToEndpoints {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressToEndpointsMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToEndpointsMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyEgressToEndpointsMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressToEndpointsMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToFqdNs {
    /// MatchName matches literal DNS names. A trailing "." is automatically added
    /// when missing.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchName")]
    pub match_name: Option<String>,
    /// MatchPattern allows using wildcards to match DNS names. All wildcards are
    /// case insensitive. The wildcards are:
    /// - "*" matches 0 or more DNS valid characters, and may occur anywhere in
    /// the pattern. As a special case a "*" as the leftmost character, without a
    /// following "." matches all subdomains as well as the name to the right.
    /// A trailing "." is automatically added when missing.
    /// - "**." is a special prefix which matches all multilevel subdomains in the prefix.
    ///
    /// Examples:
    /// 1. `*.cilium.io` matches subdomains of cilium at that level
    ///   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
    /// 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
    ///   except those containing "." separator, subcilium.io and sub-cilium.io match,
    ///   www.cilium.io and blog.cilium.io does not
    /// 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
    ///   begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
    ///   blog.cilium.io, cilium.io and google.com do not
    /// 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
    ///   "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchPattern"
    )]
    pub match_pattern: Option<String>,
}

/// Groups structure to store all kinds of new integrations that needs a new
/// derivative policy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToGroups {
    /// AWSGroup is an structure that can be used to whitelisting information from AWS integration
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<CiliumNetworkPolicyEgressToGroupsAws>,
}

/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToGroupsAws {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsIds"
    )]
    pub security_groups_ids: Option<Vec<String>>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsNames"
    )]
    pub security_groups_names: Option<Vec<String>>,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToNodes {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressToNodesMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToNodesMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyEgressToNodesMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressToNodesMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// PortRule is a list of ports/protocol combinations with optional Layer 7
/// rules which must be met.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPorts {
    /// listener specifies the name of a custom Envoy listener to which this traffic should be
    /// redirected to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub listener: Option<CiliumNetworkPolicyEgressToPortsListener>,
    /// OriginatingTLS is the TLS context for the connections originated by
    /// the L7 proxy.  For egress policy this specifies the client-side TLS
    /// parameters for the upstream connection originating from the L7 proxy
    /// to the remote destination. For ingress policy this specifies the
    /// client-side TLS parameters for the connection from the L7 proxy to
    /// the local endpoint.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "originatingTLS"
    )]
    pub originating_tls: Option<CiliumNetworkPolicyEgressToPortsOriginatingTls>,
    /// Ports is a list of L4 port/protocol
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<CiliumNetworkPolicyEgressToPortsPorts>>,
    /// Rules is a list of additional port level rules which must be met in
    /// order for the PortRule to allow the traffic. If omitted or empty,
    /// no layer 7 rules are enforced.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub rules: Option<CiliumNetworkPolicyEgressToPortsRules>,
    /// ServerNames is a list of allowed TLS SNI values. If not empty, then
    /// TLS must be present and one of the provided SNIs must be indicated in the
    /// TLS handshake.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serverNames"
    )]
    pub server_names: Option<Vec<String>>,
    /// TerminatingTLS is the TLS context for the connection terminated by
    /// the L7 proxy.  For egress policy this specifies the server-side TLS
    /// parameters to be applied on the connections originated from the local
    /// endpoint and terminated by the L7 proxy. For ingress policy this specifies
    /// the server-side TLS parameters to be applied on the connections
    /// originated from a remote source and terminated by the L7 proxy.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "terminatingTLS"
    )]
    pub terminating_tls: Option<CiliumNetworkPolicyEgressToPortsTerminatingTls>,
}

/// listener specifies the name of a custom Envoy listener to which this traffic should be
/// redirected to.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsListener {
    /// EnvoyConfig is a reference to the CEC or CCEC resource in which
    /// the listener is defined.
    #[serde(rename = "envoyConfig")]
    pub envoy_config: CiliumNetworkPolicyEgressToPortsListenerEnvoyConfig,
    /// Name is the name of the listener.
    pub name: String,
    /// Priority for this Listener that is used when multiple rules would apply different
    /// listeners to a policy map entry. Behavior of this is implementation dependent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub priority: Option<i64>,
}

/// EnvoyConfig is a reference to the CEC or CCEC resource in which
/// the listener is defined.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsListenerEnvoyConfig {
    /// Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
    /// CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
    /// respectively. The only case this is currently explicitly needed is when referring to a
    /// CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
    /// from a cluster scoped policy is not allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kind: Option<CiliumNetworkPolicyEgressToPortsListenerEnvoyConfigKind>,
    /// Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
    /// the listener is defined in.
    pub name: String,
}

/// EnvoyConfig is a reference to the CEC or CCEC resource in which
/// the listener is defined.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressToPortsListenerEnvoyConfigKind {
    CiliumEnvoyConfig,
    CiliumClusterwideEnvoyConfig,
}

/// OriginatingTLS is the TLS context for the connections originated by
/// the L7 proxy.  For egress policy this specifies the client-side TLS
/// parameters for the upstream connection originating from the L7 proxy
/// to the remote destination. For ingress policy this specifies the
/// client-side TLS parameters for the connection from the L7 proxy to
/// the local endpoint.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsOriginatingTls {
    /// Certificate is the file name or k8s secret item name for the certificate
    /// chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
    /// item must exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<String>,
    /// PrivateKey is the file name or k8s secret item name for the private key
    /// matching the certificate chain. If omitted, 'tls.key' is assumed, if it
    /// exists. If given, the item must exist.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "privateKey"
    )]
    pub private_key: Option<String>,
    /// Secret is the secret that contains the certificates and private key for
    /// the TLS context.
    /// By default, Cilium will search in this secret for the following items:
    ///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
    ///  - 'tls.crt' - Which represents the public key certificate.
    ///  - 'tls.key' - Which represents the private key matching the public key
    ///                certificate.
    pub secret: CiliumNetworkPolicyEgressToPortsOriginatingTlsSecret,
    /// TrustedCA is the file name or k8s secret item name for the trusted CA.
    /// If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
    /// exist.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCA")]
    pub trusted_ca: Option<String>,
}

/// Secret is the secret that contains the certificates and private key for
/// the TLS context.
/// By default, Cilium will search in this secret for the following items:
///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
///  - 'tls.crt' - Which represents the public key certificate.
///  - 'tls.key' - Which represents the private key matching the public key
///                certificate.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsOriginatingTlsSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsPorts {
    /// EndPort can only be an L4 port number.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "endPort")]
    pub end_port: Option<i32>,
    /// Port can be an L4 port number, or a name in the form of "http"
    /// or "http-8080".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<String>,
    /// Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
    /// with transport ports (TCP, UDP, SCTP) match.
    ///
    /// Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "ANY"
    ///
    /// Matching on ICMP is not supported.
    ///
    /// Named port specified for a container may narrow this down, but may not
    /// contradict this.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub protocol: Option<CiliumNetworkPolicyEgressToPortsPortsProtocol>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressToPortsPortsProtocol {
    #[serde(rename = "TCP")]
    Tcp,
    #[serde(rename = "UDP")]
    Udp,
    #[serde(rename = "SCTP")]
    Sctp,
    #[serde(rename = "VRRP")]
    Vrrp,
    #[serde(rename = "IGMP")]
    Igmp,
    #[serde(rename = "ANY")]
    Any,
}

/// Rules is a list of additional port level rules which must be met in
/// order for the PortRule to allow the traffic. If omitted or empty,
/// no layer 7 rules are enforced.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsRules {
    /// DNS-specific rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub dns: Option<Vec<CiliumNetworkPolicyEgressToPortsRulesDns>>,
    /// HTTP specific rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub http: Option<Vec<CiliumNetworkPolicyEgressToPortsRulesHttp>>,
    /// Kafka-specific rules.
    /// Deprecated: This beta feature is deprecated and will be removed in a future release.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kafka: Option<Vec<CiliumNetworkPolicyEgressToPortsRulesKafka>>,
    /// Key-value pair rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub l7: Option<Vec<BTreeMap<String, String>>>,
    /// Name of the L7 protocol for which the Key-value pair rules apply.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub l7proto: Option<String>,
}

/// PortRuleDNS is a list of allowed DNS lookups.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsRulesDns {
    /// MatchName matches literal DNS names. A trailing "." is automatically added
    /// when missing.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchName")]
    pub match_name: Option<String>,
    /// MatchPattern allows using wildcards to match DNS names. All wildcards are
    /// case insensitive. The wildcards are:
    /// - "*" matches 0 or more DNS valid characters, and may occur anywhere in
    /// the pattern. As a special case a "*" as the leftmost character, without a
    /// following "." matches all subdomains as well as the name to the right.
    /// A trailing "." is automatically added when missing.
    /// - "**." is a special prefix which matches all multilevel subdomains in the prefix.
    ///
    /// Examples:
    /// 1. `*.cilium.io` matches subdomains of cilium at that level
    ///   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
    /// 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
    ///   except those containing "." separator, subcilium.io and sub-cilium.io match,
    ///   www.cilium.io and blog.cilium.io does not
    /// 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
    ///   begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
    ///   blog.cilium.io, cilium.io and google.com do not
    /// 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
    ///   "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchPattern"
    )]
    pub match_pattern: Option<String>,
}

/// PortRuleHTTP is a list of HTTP protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule does not have any
/// effect.
///
/// All fields of this type are extended POSIX regex as defined by IEEE Std
/// 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
/// matched against the path of an incoming request. Currently it can contain
/// characters disallowed from the conventional "path" part of a URL as defined
/// by RFC 3986.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsRulesHttp {
    /// HeaderMatches is a list of HTTP headers which must be
    /// present and match against the given values. Mismatch field can be used
    /// to specify what to do when there is no match.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "headerMatches"
    )]
    pub header_matches: Option<Vec<CiliumNetworkPolicyEgressToPortsRulesHttpHeaderMatches>>,
    /// Headers is a list of HTTP headers which must be present in the
    /// request. If omitted or empty, requests are allowed regardless of
    /// headers present.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub headers: Option<Vec<String>>,
    /// Host is an extended POSIX regex matched against the host header of a
    /// request. Examples:
    ///
    /// - foo.bar.com will match the host fooXbar.com or foo-bar.com
    /// - foo\.bar\.com will only match the host foo.bar.com
    ///
    /// If omitted or empty, the value of the host header is ignored.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub host: Option<String>,
    /// Method is an extended POSIX regex matched against the method of a
    /// request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
    ///
    /// If omitted or empty, all methods are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub method: Option<String>,
    /// Path is an extended POSIX regex matched against the path of a
    /// request. Currently it can contain characters disallowed from the
    /// conventional "path" part of a URL as defined by RFC 3986.
    ///
    /// If omitted or empty, all paths are all allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
}

/// HeaderMatch extends the HeaderValue for matching requirement of a
/// named header field against an immediate string or a secret value.
/// If none of the optional fields is present, then the
/// header value is not matched, only presence of the header is enough.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsRulesHttpHeaderMatches {
    /// Mismatch identifies what to do in case there is no match. The default is
    /// to drop the request. Otherwise the overall rule is still considered as
    /// matching, but the mismatches are logged in the access log.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub mismatch: Option<CiliumNetworkPolicyEgressToPortsRulesHttpHeaderMatchesMismatch>,
    /// Name identifies the header.
    pub name: String,
    /// Secret refers to a secret that contains the value to be matched against.
    /// The secret must only contain one entry. If the referred secret does not
    /// exist, and there is no "Value" specified, the match will fail.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secret: Option<CiliumNetworkPolicyEgressToPortsRulesHttpHeaderMatchesSecret>,
    /// Value matches the exact value of the header. Can be specified either
    /// alone or together with "Secret"; will be used as the header value if the
    /// secret can not be found in the latter case.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// HeaderMatch extends the HeaderValue for matching requirement of a
/// named header field against an immediate string or a secret value.
/// If none of the optional fields is present, then the
/// header value is not matched, only presence of the header is enough.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressToPortsRulesHttpHeaderMatchesMismatch {
    #[serde(rename = "LOG")]
    Log,
    #[serde(rename = "ADD")]
    Add,
    #[serde(rename = "DELETE")]
    Delete,
    #[serde(rename = "REPLACE")]
    Replace,
}

/// Secret refers to a secret that contains the value to be matched against.
/// The secret must only contain one entry. If the referred secret does not
/// exist, and there is no "Value" specified, the match will fail.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsRulesHttpHeaderMatchesSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PortRule is a list of Kafka protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule will match all
/// Kafka messages.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsRulesKafka {
    /// APIKey is a case-insensitive string matched against the key of a
    /// request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al
    /// Reference: <https://kafka.apache.org/protocol#protocol_api_keys>
    ///
    /// If omitted or empty, and if Role is not specified, then all keys are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiKey")]
    pub api_key: Option<String>,
    /// APIVersion is the version matched against the api version of the
    /// Kafka message. If set, it has to be a string representing a positive
    /// integer.
    ///
    /// If omitted or empty, all versions are allowed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "apiVersion"
    )]
    pub api_version: Option<String>,
    /// ClientID is the client identifier as provided in the request.
    ///
    /// From Kafka protocol documentation:
    /// This is a user supplied identifier for the client application. The
    /// user can use any identifier they like and it will be used when
    /// logging errors, monitoring aggregates, etc. For example, one might
    /// want to monitor not just the requests per second overall, but the
    /// number coming from each client application (each of which could
    /// reside on multiple servers). This id acts as a logical grouping
    /// across all requests from a particular client.
    ///
    /// If omitted or empty, all client identifiers are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientID")]
    pub client_id: Option<String>,
    /// Role is a case-insensitive string and describes a group of API keys
    /// necessary to perform certain higher-level Kafka operations such as "produce"
    /// or "consume". A Role automatically expands into all APIKeys required
    /// to perform the specified higher-level operation.
    ///
    /// The following values are supported:
    ///  - "produce": Allow producing to the topics specified in the rule
    ///  - "consume": Allow consuming from the topics specified in the rule
    ///
    /// This field is incompatible with the APIKey field, i.e APIKey and Role
    /// cannot both be specified in the same rule.
    ///
    /// If omitted or empty, and if APIKey is not specified, then all keys are
    /// allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<CiliumNetworkPolicyEgressToPortsRulesKafkaRole>,
    /// Topic is the topic name contained in the message. If a Kafka request
    /// contains multiple topics, then all topics must be allowed or the
    /// message will be rejected.
    ///
    /// This constraint is ignored if the matched request message type
    /// doesn't contain any topic. Maximum size of Topic can be 249
    /// characters as per recent Kafka spec and allowed characters are
    /// a-z, A-Z, 0-9, -, . and _.
    ///
    /// Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10
    /// version the length was changed from 255 to 249. For compatibility
    /// reasons we are using 255.
    ///
    /// If omitted or empty, all topics are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub topic: Option<String>,
}

/// PortRule is a list of Kafka protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule will match all
/// Kafka messages.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressToPortsRulesKafkaRole {
    #[serde(rename = "produce")]
    Produce,
    #[serde(rename = "consume")]
    Consume,
}

/// TerminatingTLS is the TLS context for the connection terminated by
/// the L7 proxy.  For egress policy this specifies the server-side TLS
/// parameters to be applied on the connections originated from the local
/// endpoint and terminated by the L7 proxy. For ingress policy this specifies
/// the server-side TLS parameters to be applied on the connections
/// originated from a remote source and terminated by the L7 proxy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsTerminatingTls {
    /// Certificate is the file name or k8s secret item name for the certificate
    /// chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
    /// item must exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<String>,
    /// PrivateKey is the file name or k8s secret item name for the private key
    /// matching the certificate chain. If omitted, 'tls.key' is assumed, if it
    /// exists. If given, the item must exist.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "privateKey"
    )]
    pub private_key: Option<String>,
    /// Secret is the secret that contains the certificates and private key for
    /// the TLS context.
    /// By default, Cilium will search in this secret for the following items:
    ///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
    ///  - 'tls.crt' - Which represents the public key certificate.
    ///  - 'tls.key' - Which represents the private key matching the public key
    ///                certificate.
    pub secret: CiliumNetworkPolicyEgressToPortsTerminatingTlsSecret,
    /// TrustedCA is the file name or k8s secret item name for the trusted CA.
    /// If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
    /// exist.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCA")]
    pub trusted_ca: Option<String>,
}

/// Secret is the secret that contains the certificates and private key for
/// the TLS context.
/// By default, Cilium will search in this secret for the following items:
///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
///  - 'tls.crt' - Which represents the public key certificate.
///  - 'tls.key' - Which represents the private key matching the public key
///                certificate.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToPortsTerminatingTlsSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Service selects policy targets that are bundled as part of a
/// logical load-balanced service.
///
/// Currently only Kubernetes-based Services are supported.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToServices {
    /// K8sService selects service by name and namespace pair
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "k8sService"
    )]
    pub k8s_service: Option<CiliumNetworkPolicyEgressToServicesK8sService>,
    /// K8sServiceSelector selects services by k8s labels and namespace
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "k8sServiceSelector"
    )]
    pub k8s_service_selector: Option<CiliumNetworkPolicyEgressToServicesK8sServiceSelector>,
}

/// K8sService selects service by name and namespace pair
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToServicesK8sService {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serviceName"
    )]
    pub service_name: Option<String>,
}

/// K8sServiceSelector selects services by k8s labels and namespace
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToServicesK8sServiceSelector {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// ServiceSelector is a label selector for k8s services
    pub selector: CiliumNetworkPolicyEgressToServicesK8sServiceSelectorSelector,
}

/// ServiceSelector is a label selector for k8s services
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToServicesK8sServiceSelectorSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicyEgressToServicesK8sServiceSelectorSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressToServicesK8sServiceSelectorSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator:
        CiliumNetworkPolicyEgressToServicesK8sServiceSelectorSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressToServicesK8sServiceSelectorSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EgressDenyRule contains all rule types which can be applied at egress, i.e.
/// network traffic that originates inside the endpoint and exits the endpoint
/// selected by the endpointSelector.
///
///   - All members of this structure are optional. If omitted or empty, the
///     member will have no effect on the rule.
///
///   - If multiple members of the structure are specified, then all members
///     must match in order for the rule to take effect.
///
///   - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
///     mutually exclusive. Only one of these members may be present within an
///     individual rule.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDeny {
    /// ICMPs is a list of ICMP rule identified by type number
    /// which the endpoint subject to the rule is not allowed to connect to.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" is not allowed to initiate
    /// type 8 ICMP connections.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icmps: Option<Vec<CiliumNetworkPolicyEgressDenyIcmps>>,
    /// ToCIDR is a list of IP blocks which the endpoint subject to the rule
    /// is allowed to initiate connections. Only connections destined for
    /// outside of the cluster and not targeting the host will be subject
    /// to CIDR rules.  This will match on the destination IP address of
    /// outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
    /// with no ExcludeCIDRs is equivalent. Overlaps are allowed between
    /// ToCIDR and ToCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=database-proxy" is allowed to
    /// initiate connections to 10.2.3.0/24
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toCIDR")]
    pub to_cidr: Option<Vec<String>>,
    /// ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
    /// is allowed to initiate connections to in addition to connections
    /// which are allowed via ToEndpoints, along with a list of subnets contained
    /// within their corresponding IP block to which traffic should not be
    /// allowed. This will match on the destination IP address of outgoing
    /// connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
    /// ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
    /// ToCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=database-proxy" is allowed to
    /// initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toCIDRSet")]
    pub to_cidr_set: Option<Vec<CiliumNetworkPolicyEgressDenyToCidrSet>>,
    /// ToEndpoints is a list of endpoints identified by an EndpointSelector to
    /// which the endpoints subject to the rule are allowed to communicate.
    ///
    /// Example:
    /// Any endpoint with the label "role=frontend" can communicate with any
    /// endpoint carrying the label "role=backend".
    ///
    /// Note that while an empty non-nil ToEndpoints does not select anything,
    /// nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
    /// are also specified.
    /// To select everything, use one EndpointSelector without any match requirements.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toEndpoints"
    )]
    pub to_endpoints: Option<Vec<CiliumNetworkPolicyEgressDenyToEndpoints>>,
    /// ToEntities is a list of special entities to which the endpoint subject
    /// to the rule is allowed to initiate connections. Supported entities are
    /// `world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
    /// `health`, `unmanaged`, `none` and `all`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toEntities"
    )]
    pub to_entities: Option<Vec<String>>,
    /// ToGroups is a directive that allows the integration with multiple outside
    /// providers. Currently, only AWS is supported, and the rule can select by
    /// multiple sub directives:
    ///
    /// Example:
    /// toGroups:
    /// - aws:
    ///     securityGroupsIds:
    ///     - 'sg-XXXXXXXXXXXXX'
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toGroups")]
    pub to_groups: Option<Vec<CiliumNetworkPolicyEgressDenyToGroups>>,
    /// ToNodes is a list of nodes identified by an
    /// EndpointSelector to which endpoints subject to the rule is allowed to communicate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toNodes")]
    pub to_nodes: Option<Vec<CiliumNetworkPolicyEgressDenyToNodes>>,
    /// ToPorts is a list of destination ports identified by port number and
    /// protocol which the endpoint subject to the rule is not allowed to connect
    /// to.
    ///
    /// Example:
    /// Any endpoint with the label "role=frontend" is not allowed to initiate
    /// connections to destination port 8080/tcp
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPorts")]
    pub to_ports: Option<Vec<CiliumNetworkPolicyEgressDenyToPorts>>,
    /// Deprecated.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toRequires"
    )]
    pub to_requires: Option<Vec<String>>,
    /// ToServices is a list of services to which the endpoint subject
    /// to the rule is allowed to initiate connections.
    /// Currently Cilium only supports toServices for K8s services.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toServices"
    )]
    pub to_services: Option<Vec<CiliumNetworkPolicyEgressDenyToServices>>,
}

/// ICMPRule is a list of ICMP fields.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyIcmps {
    /// Fields is a list of ICMP fields.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fields: Option<Vec<CiliumNetworkPolicyEgressDenyIcmpsFields>>,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyIcmpsFields {
    /// Family is a IP address version.
    /// Currently, we support `IPv4` and `IPv6`.
    /// `IPv4` is set as default.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub family: Option<CiliumNetworkPolicyEgressDenyIcmpsFieldsFamily>,
    /// Type is a ICMP-type.
    /// It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
    /// Allowed ICMP types are:
    ///     Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
    /// 		     RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
    /// 			 Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
    ///     Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
    /// 			 EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
    /// 			 MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
    /// 			 NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
    /// 			 ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
    /// 			 HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
    /// 			 MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
    /// 			 ExtendedEchoRequest | ExtendedEchoReply
    #[serde(rename = "type")]
    pub r#type: IntOrString,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressDenyIcmpsFieldsFamily {
    IPv4,
    IPv6,
}

/// CIDRRule is a rule that specifies a CIDR prefix to/from which outside
/// communication  is allowed, along with an optional list of subnets within that
/// CIDR prefix to/from which outside communication is not allowed.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToCidrSet {
    /// CIDR is a CIDR prefix / IP Block.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cidr: Option<String>,
    /// CIDRGroupRef is a reference to a CiliumCIDRGroup object.
    /// A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
    /// the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
    /// connections from.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupRef"
    )]
    pub cidr_group_ref: Option<String>,
    /// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
    /// rather than by name.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupSelector"
    )]
    pub cidr_group_selector: Option<CiliumNetworkPolicyEgressDenyToCidrSetCidrGroupSelector>,
    /// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
    /// is not allowed to initiate connections to. These CIDR prefixes should be
    /// contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
    /// supported yet.
    /// These exceptions are only applied to the Cidr in this CIDRRule, and do not
    /// apply to any other CIDR prefixes in any other CIDRRules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub except: Option<Vec<String>>,
}

/// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
/// rather than by name.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToCidrSetCidrGroupSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicyEgressDenyToCidrSetCidrGroupSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToCidrSetCidrGroupSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyEgressDenyToCidrSetCidrGroupSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressDenyToCidrSetCidrGroupSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToEndpoints {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressDenyToEndpointsMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToEndpointsMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyEgressDenyToEndpointsMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressDenyToEndpointsMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// Groups structure to store all kinds of new integrations that needs a new
/// derivative policy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToGroups {
    /// AWSGroup is an structure that can be used to whitelisting information from AWS integration
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<CiliumNetworkPolicyEgressDenyToGroupsAws>,
}

/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToGroupsAws {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsIds"
    )]
    pub security_groups_ids: Option<Vec<String>>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsNames"
    )]
    pub security_groups_names: Option<Vec<String>>,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToNodes {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressDenyToNodesMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToNodesMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyEgressDenyToNodesMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressDenyToNodesMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// PortDenyRule is a list of ports/protocol that should be used for deny
/// policies. This structure lacks the L7Rules since it's not supported in deny
/// policies.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToPorts {
    /// Ports is a list of L4 port/protocol
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<CiliumNetworkPolicyEgressDenyToPortsPorts>>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToPortsPorts {
    /// EndPort can only be an L4 port number.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "endPort")]
    pub end_port: Option<i32>,
    /// Port can be an L4 port number, or a name in the form of "http"
    /// or "http-8080".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<String>,
    /// Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
    /// with transport ports (TCP, UDP, SCTP) match.
    ///
    /// Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "ANY"
    ///
    /// Matching on ICMP is not supported.
    ///
    /// Named port specified for a container may narrow this down, but may not
    /// contradict this.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub protocol: Option<CiliumNetworkPolicyEgressDenyToPortsPortsProtocol>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressDenyToPortsPortsProtocol {
    #[serde(rename = "TCP")]
    Tcp,
    #[serde(rename = "UDP")]
    Udp,
    #[serde(rename = "SCTP")]
    Sctp,
    #[serde(rename = "VRRP")]
    Vrrp,
    #[serde(rename = "IGMP")]
    Igmp,
    #[serde(rename = "ANY")]
    Any,
}

/// Service selects policy targets that are bundled as part of a
/// logical load-balanced service.
///
/// Currently only Kubernetes-based Services are supported.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToServices {
    /// K8sService selects service by name and namespace pair
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "k8sService"
    )]
    pub k8s_service: Option<CiliumNetworkPolicyEgressDenyToServicesK8sService>,
    /// K8sServiceSelector selects services by k8s labels and namespace
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "k8sServiceSelector"
    )]
    pub k8s_service_selector: Option<CiliumNetworkPolicyEgressDenyToServicesK8sServiceSelector>,
}

/// K8sService selects service by name and namespace pair
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToServicesK8sService {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serviceName"
    )]
    pub service_name: Option<String>,
}

/// K8sServiceSelector selects services by k8s labels and namespace
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToServicesK8sServiceSelector {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// ServiceSelector is a label selector for k8s services
    pub selector: CiliumNetworkPolicyEgressDenyToServicesK8sServiceSelectorSelector,
}

/// ServiceSelector is a label selector for k8s services
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToServicesK8sServiceSelectorSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<
        Vec<CiliumNetworkPolicyEgressDenyToServicesK8sServiceSelectorSelectorMatchExpressions>,
    >,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEgressDenyToServicesK8sServiceSelectorSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator:
        CiliumNetworkPolicyEgressDenyToServicesK8sServiceSelectorSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEgressDenyToServicesK8sServiceSelectorSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EnableDefaultDeny determines whether this policy configures the
/// subject endpoint(s) to have a default deny mode. If enabled,
/// this causes all traffic not explicitly allowed by a network policy
/// to be dropped.
///
/// If not specified, the default is true for each traffic direction
/// that has rules, and false otherwise. For example, if a policy
/// only has Ingress or IngressDeny rules, then the default for
/// ingress is true and egress is false.
///
/// If multiple policies apply to an endpoint, that endpoint's default deny
/// will be enabled if any policy requests it.
///
/// This is useful for creating broad-based network policies that will not
/// cause endpoints to enter default-deny mode.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEnableDefaultDeny {
    /// Whether or not the endpoint should have a default-deny rule applied
    /// to egress traffic.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub egress: Option<bool>,
    /// Whether or not the endpoint should have a default-deny rule applied
    /// to ingress traffic.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ingress: Option<bool>,
}

/// EndpointSelector selects all endpoints which should be subject to
/// this rule. EndpointSelector and NodeSelector cannot be both empty and
/// are mutually exclusive.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEndpointSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyEndpointSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyEndpointSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyEndpointSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyEndpointSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// IngressRule contains all rule types which can be applied at ingress,
/// i.e. network traffic that originates outside of the endpoint and
/// is entering the endpoint selected by the endpointSelector.
///
///   - All members of this structure are optional. If omitted or empty, the
///     member will have no effect on the rule.
///
///   - If multiple members are set, all of them need to match in order for
///     the rule to take effect.
///
///   - FromEndpoints, FromCIDR, FromCIDRSet and FromEntities are mutually
///     exclusive. Only one of these members may be present within an individual
///     rule.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngress {
    /// Authentication is the required authentication type for the allowed traffic, if any.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub authentication: Option<CiliumNetworkPolicyIngressAuthentication>,
    /// FromCIDR is a list of IP blocks which the endpoint subject to the
    /// rule is allowed to receive connections from. Only connections which
    /// do *not* originate from the cluster or from the local host are subject
    /// to CIDR rules. In order to allow in-cluster connectivity, use the
    /// FromEndpoints field.  This will match on the source IP address of
    /// incoming connections. Adding  a prefix into FromCIDR or into
    /// FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
    /// allowed between FromCIDR and FromCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
    /// connections from 10.3.9.1
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromCIDR")]
    pub from_cidr: Option<Vec<String>>,
    /// FromCIDRSet is a list of IP blocks which the endpoint subject to the
    /// rule is allowed to receive connections from in addition to FromEndpoints,
    /// along with a list of subnets contained within their corresponding IP block
    /// from which traffic should not be allowed.
    /// This will match on the source IP address of incoming connections. Adding
    /// a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
    /// equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
    /// connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromCIDRSet"
    )]
    pub from_cidr_set: Option<Vec<CiliumNetworkPolicyIngressFromCidrSet>>,
    /// FromEndpoints is a list of endpoints identified by an
    /// EndpointSelector which are allowed to communicate with the endpoint
    /// subject to the rule.
    ///
    /// Example:
    /// Any endpoint with the label "role=backend" can be consumed by any
    /// endpoint carrying the label "role=frontend".
    ///
    /// Note that while an empty non-nil FromEndpoints does not select anything,
    /// nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
    /// are also specified.
    /// To select everything, use one EndpointSelector without any match requirements.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromEndpoints"
    )]
    pub from_endpoints: Option<Vec<CiliumNetworkPolicyIngressFromEndpoints>>,
    /// FromEntities is a list of special entities which the endpoint subject
    /// to the rule is allowed to receive connections from. Supported entities are
    /// `world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
    /// `health`, `unmanaged`, `none` and `all`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromEntities"
    )]
    pub from_entities: Option<Vec<String>>,
    /// FromGroups is a directive that allows the integration with multiple outside
    /// providers. Currently, only AWS is supported, and the rule can select by
    /// multiple sub directives:
    ///
    /// Example:
    /// FromGroups:
    /// - aws:
    ///     securityGroupsIds:
    ///     - 'sg-XXXXXXXXXXXXX'
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromGroups"
    )]
    pub from_groups: Option<Vec<CiliumNetworkPolicyIngressFromGroups>>,
    /// FromNodes is a list of nodes identified by an
    /// EndpointSelector which are allowed to communicate with the endpoint
    /// subject to the rule.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromNodes")]
    pub from_nodes: Option<Vec<CiliumNetworkPolicyIngressFromNodes>>,
    /// Deprecated.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromRequires"
    )]
    pub from_requires: Option<Vec<String>>,
    /// ICMPs is a list of ICMP rule identified by type number
    /// which the endpoint subject to the rule is allowed to
    /// receive connections on.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" can only accept incoming
    /// type 8 ICMP connections.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icmps: Option<Vec<CiliumNetworkPolicyIngressIcmps>>,
    /// ToPorts is a list of destination ports identified by port number and
    /// protocol which the endpoint subject to the rule is allowed to
    /// receive connections on.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" can only accept incoming
    /// connections on port 80/tcp.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPorts")]
    pub to_ports: Option<Vec<CiliumNetworkPolicyIngressToPorts>>,
}

/// Authentication is the required authentication type for the allowed traffic, if any.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressAuthentication {
    /// Mode is the required authentication mode for the allowed traffic, if any.
    pub mode: CiliumNetworkPolicyIngressAuthenticationMode,
}

/// Authentication is the required authentication type for the allowed traffic, if any.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressAuthenticationMode {
    #[serde(rename = "disabled")]
    Disabled,
    #[serde(rename = "required")]
    Required,
    #[serde(rename = "test-always-fail")]
    TestAlwaysFail,
}

/// CIDRRule is a rule that specifies a CIDR prefix to/from which outside
/// communication  is allowed, along with an optional list of subnets within that
/// CIDR prefix to/from which outside communication is not allowed.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromCidrSet {
    /// CIDR is a CIDR prefix / IP Block.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cidr: Option<String>,
    /// CIDRGroupRef is a reference to a CiliumCIDRGroup object.
    /// A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
    /// the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
    /// connections from.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupRef"
    )]
    pub cidr_group_ref: Option<String>,
    /// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
    /// rather than by name.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupSelector"
    )]
    pub cidr_group_selector: Option<CiliumNetworkPolicyIngressFromCidrSetCidrGroupSelector>,
    /// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
    /// is not allowed to initiate connections to. These CIDR prefixes should be
    /// contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
    /// supported yet.
    /// These exceptions are only applied to the Cidr in this CIDRRule, and do not
    /// apply to any other CIDR prefixes in any other CIDRRules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub except: Option<Vec<String>>,
}

/// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
/// rather than by name.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromCidrSetCidrGroupSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicyIngressFromCidrSetCidrGroupSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromCidrSetCidrGroupSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyIngressFromCidrSetCidrGroupSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressFromCidrSetCidrGroupSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromEndpoints {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressFromEndpointsMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromEndpointsMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyIngressFromEndpointsMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressFromEndpointsMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// Groups structure to store all kinds of new integrations that needs a new
/// derivative policy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromGroups {
    /// AWSGroup is an structure that can be used to whitelisting information from AWS integration
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<CiliumNetworkPolicyIngressFromGroupsAws>,
}

/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromGroupsAws {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsIds"
    )]
    pub security_groups_ids: Option<Vec<String>>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsNames"
    )]
    pub security_groups_names: Option<Vec<String>>,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromNodes {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressFromNodesMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressFromNodesMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyIngressFromNodesMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressFromNodesMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// ICMPRule is a list of ICMP fields.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressIcmps {
    /// Fields is a list of ICMP fields.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fields: Option<Vec<CiliumNetworkPolicyIngressIcmpsFields>>,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressIcmpsFields {
    /// Family is a IP address version.
    /// Currently, we support `IPv4` and `IPv6`.
    /// `IPv4` is set as default.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub family: Option<CiliumNetworkPolicyIngressIcmpsFieldsFamily>,
    /// Type is a ICMP-type.
    /// It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
    /// Allowed ICMP types are:
    ///     Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
    /// 		     RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
    /// 			 Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
    ///     Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
    /// 			 EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
    /// 			 MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
    /// 			 NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
    /// 			 ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
    /// 			 HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
    /// 			 MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
    /// 			 ExtendedEchoRequest | ExtendedEchoReply
    #[serde(rename = "type")]
    pub r#type: IntOrString,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressIcmpsFieldsFamily {
    IPv4,
    IPv6,
}

/// PortRule is a list of ports/protocol combinations with optional Layer 7
/// rules which must be met.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPorts {
    /// listener specifies the name of a custom Envoy listener to which this traffic should be
    /// redirected to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub listener: Option<CiliumNetworkPolicyIngressToPortsListener>,
    /// OriginatingTLS is the TLS context for the connections originated by
    /// the L7 proxy.  For egress policy this specifies the client-side TLS
    /// parameters for the upstream connection originating from the L7 proxy
    /// to the remote destination. For ingress policy this specifies the
    /// client-side TLS parameters for the connection from the L7 proxy to
    /// the local endpoint.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "originatingTLS"
    )]
    pub originating_tls: Option<CiliumNetworkPolicyIngressToPortsOriginatingTls>,
    /// Ports is a list of L4 port/protocol
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<CiliumNetworkPolicyIngressToPortsPorts>>,
    /// Rules is a list of additional port level rules which must be met in
    /// order for the PortRule to allow the traffic. If omitted or empty,
    /// no layer 7 rules are enforced.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub rules: Option<CiliumNetworkPolicyIngressToPortsRules>,
    /// ServerNames is a list of allowed TLS SNI values. If not empty, then
    /// TLS must be present and one of the provided SNIs must be indicated in the
    /// TLS handshake.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serverNames"
    )]
    pub server_names: Option<Vec<String>>,
    /// TerminatingTLS is the TLS context for the connection terminated by
    /// the L7 proxy.  For egress policy this specifies the server-side TLS
    /// parameters to be applied on the connections originated from the local
    /// endpoint and terminated by the L7 proxy. For ingress policy this specifies
    /// the server-side TLS parameters to be applied on the connections
    /// originated from a remote source and terminated by the L7 proxy.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "terminatingTLS"
    )]
    pub terminating_tls: Option<CiliumNetworkPolicyIngressToPortsTerminatingTls>,
}

/// listener specifies the name of a custom Envoy listener to which this traffic should be
/// redirected to.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsListener {
    /// EnvoyConfig is a reference to the CEC or CCEC resource in which
    /// the listener is defined.
    #[serde(rename = "envoyConfig")]
    pub envoy_config: CiliumNetworkPolicyIngressToPortsListenerEnvoyConfig,
    /// Name is the name of the listener.
    pub name: String,
    /// Priority for this Listener that is used when multiple rules would apply different
    /// listeners to a policy map entry. Behavior of this is implementation dependent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub priority: Option<i64>,
}

/// EnvoyConfig is a reference to the CEC or CCEC resource in which
/// the listener is defined.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsListenerEnvoyConfig {
    /// Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
    /// CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
    /// respectively. The only case this is currently explicitly needed is when referring to a
    /// CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
    /// from a cluster scoped policy is not allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kind: Option<CiliumNetworkPolicyIngressToPortsListenerEnvoyConfigKind>,
    /// Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
    /// the listener is defined in.
    pub name: String,
}

/// EnvoyConfig is a reference to the CEC or CCEC resource in which
/// the listener is defined.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressToPortsListenerEnvoyConfigKind {
    CiliumEnvoyConfig,
    CiliumClusterwideEnvoyConfig,
}

/// OriginatingTLS is the TLS context for the connections originated by
/// the L7 proxy.  For egress policy this specifies the client-side TLS
/// parameters for the upstream connection originating from the L7 proxy
/// to the remote destination. For ingress policy this specifies the
/// client-side TLS parameters for the connection from the L7 proxy to
/// the local endpoint.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsOriginatingTls {
    /// Certificate is the file name or k8s secret item name for the certificate
    /// chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
    /// item must exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<String>,
    /// PrivateKey is the file name or k8s secret item name for the private key
    /// matching the certificate chain. If omitted, 'tls.key' is assumed, if it
    /// exists. If given, the item must exist.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "privateKey"
    )]
    pub private_key: Option<String>,
    /// Secret is the secret that contains the certificates and private key for
    /// the TLS context.
    /// By default, Cilium will search in this secret for the following items:
    ///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
    ///  - 'tls.crt' - Which represents the public key certificate.
    ///  - 'tls.key' - Which represents the private key matching the public key
    ///                certificate.
    pub secret: CiliumNetworkPolicyIngressToPortsOriginatingTlsSecret,
    /// TrustedCA is the file name or k8s secret item name for the trusted CA.
    /// If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
    /// exist.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCA")]
    pub trusted_ca: Option<String>,
}

/// Secret is the secret that contains the certificates and private key for
/// the TLS context.
/// By default, Cilium will search in this secret for the following items:
///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
///  - 'tls.crt' - Which represents the public key certificate.
///  - 'tls.key' - Which represents the private key matching the public key
///                certificate.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsOriginatingTlsSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsPorts {
    /// EndPort can only be an L4 port number.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "endPort")]
    pub end_port: Option<i32>,
    /// Port can be an L4 port number, or a name in the form of "http"
    /// or "http-8080".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<String>,
    /// Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
    /// with transport ports (TCP, UDP, SCTP) match.
    ///
    /// Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "ANY"
    ///
    /// Matching on ICMP is not supported.
    ///
    /// Named port specified for a container may narrow this down, but may not
    /// contradict this.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub protocol: Option<CiliumNetworkPolicyIngressToPortsPortsProtocol>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressToPortsPortsProtocol {
    #[serde(rename = "TCP")]
    Tcp,
    #[serde(rename = "UDP")]
    Udp,
    #[serde(rename = "SCTP")]
    Sctp,
    #[serde(rename = "VRRP")]
    Vrrp,
    #[serde(rename = "IGMP")]
    Igmp,
    #[serde(rename = "ANY")]
    Any,
}

/// Rules is a list of additional port level rules which must be met in
/// order for the PortRule to allow the traffic. If omitted or empty,
/// no layer 7 rules are enforced.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsRules {
    /// DNS-specific rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub dns: Option<Vec<CiliumNetworkPolicyIngressToPortsRulesDns>>,
    /// HTTP specific rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub http: Option<Vec<CiliumNetworkPolicyIngressToPortsRulesHttp>>,
    /// Kafka-specific rules.
    /// Deprecated: This beta feature is deprecated and will be removed in a future release.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kafka: Option<Vec<CiliumNetworkPolicyIngressToPortsRulesKafka>>,
    /// Key-value pair rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub l7: Option<Vec<BTreeMap<String, String>>>,
    /// Name of the L7 protocol for which the Key-value pair rules apply.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub l7proto: Option<String>,
}

/// PortRuleDNS is a list of allowed DNS lookups.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsRulesDns {
    /// MatchName matches literal DNS names. A trailing "." is automatically added
    /// when missing.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchName")]
    pub match_name: Option<String>,
    /// MatchPattern allows using wildcards to match DNS names. All wildcards are
    /// case insensitive. The wildcards are:
    /// - "*" matches 0 or more DNS valid characters, and may occur anywhere in
    /// the pattern. As a special case a "*" as the leftmost character, without a
    /// following "." matches all subdomains as well as the name to the right.
    /// A trailing "." is automatically added when missing.
    /// - "**." is a special prefix which matches all multilevel subdomains in the prefix.
    ///
    /// Examples:
    /// 1. `*.cilium.io` matches subdomains of cilium at that level
    ///   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
    /// 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
    ///   except those containing "." separator, subcilium.io and sub-cilium.io match,
    ///   www.cilium.io and blog.cilium.io does not
    /// 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
    ///   begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
    ///   blog.cilium.io, cilium.io and google.com do not
    /// 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
    ///   "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchPattern"
    )]
    pub match_pattern: Option<String>,
}

/// PortRuleHTTP is a list of HTTP protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule does not have any
/// effect.
///
/// All fields of this type are extended POSIX regex as defined by IEEE Std
/// 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
/// matched against the path of an incoming request. Currently it can contain
/// characters disallowed from the conventional "path" part of a URL as defined
/// by RFC 3986.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsRulesHttp {
    /// HeaderMatches is a list of HTTP headers which must be
    /// present and match against the given values. Mismatch field can be used
    /// to specify what to do when there is no match.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "headerMatches"
    )]
    pub header_matches: Option<Vec<CiliumNetworkPolicyIngressToPortsRulesHttpHeaderMatches>>,
    /// Headers is a list of HTTP headers which must be present in the
    /// request. If omitted or empty, requests are allowed regardless of
    /// headers present.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub headers: Option<Vec<String>>,
    /// Host is an extended POSIX regex matched against the host header of a
    /// request. Examples:
    ///
    /// - foo.bar.com will match the host fooXbar.com or foo-bar.com
    /// - foo\.bar\.com will only match the host foo.bar.com
    ///
    /// If omitted or empty, the value of the host header is ignored.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub host: Option<String>,
    /// Method is an extended POSIX regex matched against the method of a
    /// request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
    ///
    /// If omitted or empty, all methods are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub method: Option<String>,
    /// Path is an extended POSIX regex matched against the path of a
    /// request. Currently it can contain characters disallowed from the
    /// conventional "path" part of a URL as defined by RFC 3986.
    ///
    /// If omitted or empty, all paths are all allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
}

/// HeaderMatch extends the HeaderValue for matching requirement of a
/// named header field against an immediate string or a secret value.
/// If none of the optional fields is present, then the
/// header value is not matched, only presence of the header is enough.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsRulesHttpHeaderMatches {
    /// Mismatch identifies what to do in case there is no match. The default is
    /// to drop the request. Otherwise the overall rule is still considered as
    /// matching, but the mismatches are logged in the access log.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub mismatch: Option<CiliumNetworkPolicyIngressToPortsRulesHttpHeaderMatchesMismatch>,
    /// Name identifies the header.
    pub name: String,
    /// Secret refers to a secret that contains the value to be matched against.
    /// The secret must only contain one entry. If the referred secret does not
    /// exist, and there is no "Value" specified, the match will fail.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secret: Option<CiliumNetworkPolicyIngressToPortsRulesHttpHeaderMatchesSecret>,
    /// Value matches the exact value of the header. Can be specified either
    /// alone or together with "Secret"; will be used as the header value if the
    /// secret can not be found in the latter case.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// HeaderMatch extends the HeaderValue for matching requirement of a
/// named header field against an immediate string or a secret value.
/// If none of the optional fields is present, then the
/// header value is not matched, only presence of the header is enough.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressToPortsRulesHttpHeaderMatchesMismatch {
    #[serde(rename = "LOG")]
    Log,
    #[serde(rename = "ADD")]
    Add,
    #[serde(rename = "DELETE")]
    Delete,
    #[serde(rename = "REPLACE")]
    Replace,
}

/// Secret refers to a secret that contains the value to be matched against.
/// The secret must only contain one entry. If the referred secret does not
/// exist, and there is no "Value" specified, the match will fail.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsRulesHttpHeaderMatchesSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PortRule is a list of Kafka protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule will match all
/// Kafka messages.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsRulesKafka {
    /// APIKey is a case-insensitive string matched against the key of a
    /// request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al
    /// Reference: <https://kafka.apache.org/protocol#protocol_api_keys>
    ///
    /// If omitted or empty, and if Role is not specified, then all keys are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiKey")]
    pub api_key: Option<String>,
    /// APIVersion is the version matched against the api version of the
    /// Kafka message. If set, it has to be a string representing a positive
    /// integer.
    ///
    /// If omitted or empty, all versions are allowed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "apiVersion"
    )]
    pub api_version: Option<String>,
    /// ClientID is the client identifier as provided in the request.
    ///
    /// From Kafka protocol documentation:
    /// This is a user supplied identifier for the client application. The
    /// user can use any identifier they like and it will be used when
    /// logging errors, monitoring aggregates, etc. For example, one might
    /// want to monitor not just the requests per second overall, but the
    /// number coming from each client application (each of which could
    /// reside on multiple servers). This id acts as a logical grouping
    /// across all requests from a particular client.
    ///
    /// If omitted or empty, all client identifiers are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientID")]
    pub client_id: Option<String>,
    /// Role is a case-insensitive string and describes a group of API keys
    /// necessary to perform certain higher-level Kafka operations such as "produce"
    /// or "consume". A Role automatically expands into all APIKeys required
    /// to perform the specified higher-level operation.
    ///
    /// The following values are supported:
    ///  - "produce": Allow producing to the topics specified in the rule
    ///  - "consume": Allow consuming from the topics specified in the rule
    ///
    /// This field is incompatible with the APIKey field, i.e APIKey and Role
    /// cannot both be specified in the same rule.
    ///
    /// If omitted or empty, and if APIKey is not specified, then all keys are
    /// allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<CiliumNetworkPolicyIngressToPortsRulesKafkaRole>,
    /// Topic is the topic name contained in the message. If a Kafka request
    /// contains multiple topics, then all topics must be allowed or the
    /// message will be rejected.
    ///
    /// This constraint is ignored if the matched request message type
    /// doesn't contain any topic. Maximum size of Topic can be 249
    /// characters as per recent Kafka spec and allowed characters are
    /// a-z, A-Z, 0-9, -, . and _.
    ///
    /// Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10
    /// version the length was changed from 255 to 249. For compatibility
    /// reasons we are using 255.
    ///
    /// If omitted or empty, all topics are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub topic: Option<String>,
}

/// PortRule is a list of Kafka protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule will match all
/// Kafka messages.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressToPortsRulesKafkaRole {
    #[serde(rename = "produce")]
    Produce,
    #[serde(rename = "consume")]
    Consume,
}

/// TerminatingTLS is the TLS context for the connection terminated by
/// the L7 proxy.  For egress policy this specifies the server-side TLS
/// parameters to be applied on the connections originated from the local
/// endpoint and terminated by the L7 proxy. For ingress policy this specifies
/// the server-side TLS parameters to be applied on the connections
/// originated from a remote source and terminated by the L7 proxy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsTerminatingTls {
    /// Certificate is the file name or k8s secret item name for the certificate
    /// chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
    /// item must exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<String>,
    /// PrivateKey is the file name or k8s secret item name for the private key
    /// matching the certificate chain. If omitted, 'tls.key' is assumed, if it
    /// exists. If given, the item must exist.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "privateKey"
    )]
    pub private_key: Option<String>,
    /// Secret is the secret that contains the certificates and private key for
    /// the TLS context.
    /// By default, Cilium will search in this secret for the following items:
    ///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
    ///  - 'tls.crt' - Which represents the public key certificate.
    ///  - 'tls.key' - Which represents the private key matching the public key
    ///                certificate.
    pub secret: CiliumNetworkPolicyIngressToPortsTerminatingTlsSecret,
    /// TrustedCA is the file name or k8s secret item name for the trusted CA.
    /// If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
    /// exist.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCA")]
    pub trusted_ca: Option<String>,
}

/// Secret is the secret that contains the certificates and private key for
/// the TLS context.
/// By default, Cilium will search in this secret for the following items:
///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
///  - 'tls.crt' - Which represents the public key certificate.
///  - 'tls.key' - Which represents the private key matching the public key
///                certificate.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressToPortsTerminatingTlsSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// IngressDenyRule contains all rule types which can be applied at ingress,
/// i.e. network traffic that originates outside of the endpoint and
/// is entering the endpoint selected by the endpointSelector.
///
///   - All members of this structure are optional. If omitted or empty, the
///     member will have no effect on the rule.
///
///   - If multiple members are set, all of them need to match in order for
///     the rule to take effect.
///
///   - FromEndpoints, FromCIDR, FromCIDRSet, FromGroups and FromEntities are mutually
///     exclusive. Only one of these members may be present within an individual
///     rule.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDeny {
    /// FromCIDR is a list of IP blocks which the endpoint subject to the
    /// rule is allowed to receive connections from. Only connections which
    /// do *not* originate from the cluster or from the local host are subject
    /// to CIDR rules. In order to allow in-cluster connectivity, use the
    /// FromEndpoints field.  This will match on the source IP address of
    /// incoming connections. Adding  a prefix into FromCIDR or into
    /// FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
    /// allowed between FromCIDR and FromCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
    /// connections from 10.3.9.1
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromCIDR")]
    pub from_cidr: Option<Vec<String>>,
    /// FromCIDRSet is a list of IP blocks which the endpoint subject to the
    /// rule is allowed to receive connections from in addition to FromEndpoints,
    /// along with a list of subnets contained within their corresponding IP block
    /// from which traffic should not be allowed.
    /// This will match on the source IP address of incoming connections. Adding
    /// a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
    /// equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
    /// connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromCIDRSet"
    )]
    pub from_cidr_set: Option<Vec<CiliumNetworkPolicyIngressDenyFromCidrSet>>,
    /// FromEndpoints is a list of endpoints identified by an
    /// EndpointSelector which are allowed to communicate with the endpoint
    /// subject to the rule.
    ///
    /// Example:
    /// Any endpoint with the label "role=backend" can be consumed by any
    /// endpoint carrying the label "role=frontend".
    ///
    /// Note that while an empty non-nil FromEndpoints does not select anything,
    /// nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
    /// are also specified.
    /// To select everything, use one EndpointSelector without any match requirements.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromEndpoints"
    )]
    pub from_endpoints: Option<Vec<CiliumNetworkPolicyIngressDenyFromEndpoints>>,
    /// FromEntities is a list of special entities which the endpoint subject
    /// to the rule is allowed to receive connections from. Supported entities are
    /// `world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
    /// `health`, `unmanaged`, `none` and `all`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromEntities"
    )]
    pub from_entities: Option<Vec<String>>,
    /// FromGroups is a directive that allows the integration with multiple outside
    /// providers. Currently, only AWS is supported, and the rule can select by
    /// multiple sub directives:
    ///
    /// Example:
    /// FromGroups:
    /// - aws:
    ///     securityGroupsIds:
    ///     - 'sg-XXXXXXXXXXXXX'
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromGroups"
    )]
    pub from_groups: Option<Vec<CiliumNetworkPolicyIngressDenyFromGroups>>,
    /// FromNodes is a list of nodes identified by an
    /// EndpointSelector which are allowed to communicate with the endpoint
    /// subject to the rule.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromNodes")]
    pub from_nodes: Option<Vec<CiliumNetworkPolicyIngressDenyFromNodes>>,
    /// Deprecated.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromRequires"
    )]
    pub from_requires: Option<Vec<String>>,
    /// ICMPs is a list of ICMP rule identified by type number
    /// which the endpoint subject to the rule is not allowed to
    /// receive connections on.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" can not accept incoming
    /// type 8 ICMP connections.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icmps: Option<Vec<CiliumNetworkPolicyIngressDenyIcmps>>,
    /// ToPorts is a list of destination ports identified by port number and
    /// protocol which the endpoint subject to the rule is not allowed to
    /// receive connections on.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" can not accept incoming
    /// connections on port 80/tcp.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPorts")]
    pub to_ports: Option<Vec<CiliumNetworkPolicyIngressDenyToPorts>>,
}

/// CIDRRule is a rule that specifies a CIDR prefix to/from which outside
/// communication  is allowed, along with an optional list of subnets within that
/// CIDR prefix to/from which outside communication is not allowed.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromCidrSet {
    /// CIDR is a CIDR prefix / IP Block.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cidr: Option<String>,
    /// CIDRGroupRef is a reference to a CiliumCIDRGroup object.
    /// A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
    /// the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
    /// connections from.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupRef"
    )]
    pub cidr_group_ref: Option<String>,
    /// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
    /// rather than by name.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupSelector"
    )]
    pub cidr_group_selector: Option<CiliumNetworkPolicyIngressDenyFromCidrSetCidrGroupSelector>,
    /// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
    /// is not allowed to initiate connections to. These CIDR prefixes should be
    /// contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
    /// supported yet.
    /// These exceptions are only applied to the Cidr in this CIDRRule, and do not
    /// apply to any other CIDR prefixes in any other CIDRRules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub except: Option<Vec<String>>,
}

/// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
/// rather than by name.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromCidrSetCidrGroupSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicyIngressDenyFromCidrSetCidrGroupSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromCidrSetCidrGroupSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator:
        CiliumNetworkPolicyIngressDenyFromCidrSetCidrGroupSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressDenyFromCidrSetCidrGroupSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromEndpoints {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressDenyFromEndpointsMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromEndpointsMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyIngressDenyFromEndpointsMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressDenyFromEndpointsMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// Groups structure to store all kinds of new integrations that needs a new
/// derivative policy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromGroups {
    /// AWSGroup is an structure that can be used to whitelisting information from AWS integration
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<CiliumNetworkPolicyIngressDenyFromGroupsAws>,
}

/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromGroupsAws {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsIds"
    )]
    pub security_groups_ids: Option<Vec<String>>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsNames"
    )]
    pub security_groups_names: Option<Vec<String>>,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromNodes {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressDenyFromNodesMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyFromNodesMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyIngressDenyFromNodesMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressDenyFromNodesMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// ICMPRule is a list of ICMP fields.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyIcmps {
    /// Fields is a list of ICMP fields.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fields: Option<Vec<CiliumNetworkPolicyIngressDenyIcmpsFields>>,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyIcmpsFields {
    /// Family is a IP address version.
    /// Currently, we support `IPv4` and `IPv6`.
    /// `IPv4` is set as default.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub family: Option<CiliumNetworkPolicyIngressDenyIcmpsFieldsFamily>,
    /// Type is a ICMP-type.
    /// It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
    /// Allowed ICMP types are:
    ///     Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
    /// 		     RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
    /// 			 Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
    ///     Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
    /// 			 EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
    /// 			 MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
    /// 			 NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
    /// 			 ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
    /// 			 HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
    /// 			 MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
    /// 			 ExtendedEchoRequest | ExtendedEchoReply
    #[serde(rename = "type")]
    pub r#type: IntOrString,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressDenyIcmpsFieldsFamily {
    IPv4,
    IPv6,
}

/// PortDenyRule is a list of ports/protocol that should be used for deny
/// policies. This structure lacks the L7Rules since it's not supported in deny
/// policies.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyToPorts {
    /// Ports is a list of L4 port/protocol
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<CiliumNetworkPolicyIngressDenyToPortsPorts>>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyIngressDenyToPortsPorts {
    /// EndPort can only be an L4 port number.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "endPort")]
    pub end_port: Option<i32>,
    /// Port can be an L4 port number, or a name in the form of "http"
    /// or "http-8080".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<String>,
    /// Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
    /// with transport ports (TCP, UDP, SCTP) match.
    ///
    /// Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "ANY"
    ///
    /// Matching on ICMP is not supported.
    ///
    /// Named port specified for a container may narrow this down, but may not
    /// contradict this.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub protocol: Option<CiliumNetworkPolicyIngressDenyToPortsPortsProtocol>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyIngressDenyToPortsPortsProtocol {
    #[serde(rename = "TCP")]
    Tcp,
    #[serde(rename = "UDP")]
    Udp,
    #[serde(rename = "SCTP")]
    Sctp,
    #[serde(rename = "VRRP")]
    Vrrp,
    #[serde(rename = "IGMP")]
    Igmp,
    #[serde(rename = "ANY")]
    Any,
}

/// Label is the Cilium's representation of a container label.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyLabels {
    pub key: String,
    /// Source can be one of the above values (e.g.: LabelSourceContainer).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub source: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// Log specifies custom policy-specific Hubble logging configuration.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyLog {
    /// Value is a free-form string that is included in Hubble flows
    /// that match this policy. The string is limited to 32 printable characters.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// NodeSelector selects all nodes which should be subject to this rule.
/// EndpointSelector and NodeSelector cannot be both empty and are mutually
/// exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyNodeSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicyNodeSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyNodeSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicyNodeSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicyNodeSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// Rule is a policy rule which must be applied to all endpoints which match the
/// labels contained in the endpointSelector
///
/// Each rule is split into an ingress section which contains all rules
/// applicable at ingress, and an egress section applicable at egress. For rule
/// types such as `L4Rule` and `CIDR` which can be applied at both ingress and
/// egress, both ingress and egress side have to either specifically allow the
/// connection or one side has to be omitted.
///
/// Either ingress, egress, or both can be provided. If both ingress and egress
/// are omitted, the rule has no effect.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicys {
    /// Description is a free form string, it can be used by the creator of
    /// the rule to store human readable explanation of the purpose of this
    /// rule. Rules cannot be identified by comment.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub description: Option<String>,
    /// Egress is a list of EgressRule which are enforced at egress.
    /// If omitted or empty, this rule does not apply at egress.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub egress: Option<Vec<CiliumNetworkPolicysEgress>>,
    /// EgressDeny is a list of EgressDenyRule which are enforced at egress.
    /// Any rule inserted here will be denied regardless of the allowed egress
    /// rules in the 'egress' field.
    /// If omitted or empty, this rule does not apply at egress.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "egressDeny"
    )]
    pub egress_deny: Option<Vec<CiliumNetworkPolicysEgressDeny>>,
    /// EnableDefaultDeny determines whether this policy configures the
    /// subject endpoint(s) to have a default deny mode. If enabled,
    /// this causes all traffic not explicitly allowed by a network policy
    /// to be dropped.
    ///
    /// If not specified, the default is true for each traffic direction
    /// that has rules, and false otherwise. For example, if a policy
    /// only has Ingress or IngressDeny rules, then the default for
    /// ingress is true and egress is false.
    ///
    /// If multiple policies apply to an endpoint, that endpoint's default deny
    /// will be enabled if any policy requests it.
    ///
    /// This is useful for creating broad-based network policies that will not
    /// cause endpoints to enter default-deny mode.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "enableDefaultDeny"
    )]
    pub enable_default_deny: Option<CiliumNetworkPolicysEnableDefaultDeny>,
    /// EndpointSelector selects all endpoints which should be subject to
    /// this rule. EndpointSelector and NodeSelector cannot be both empty and
    /// are mutually exclusive.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "endpointSelector"
    )]
    pub endpoint_selector: Option<CiliumNetworkPolicysEndpointSelector>,
    /// Ingress is a list of IngressRule which are enforced at ingress.
    /// If omitted or empty, this rule does not apply at ingress.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ingress: Option<Vec<CiliumNetworkPolicysIngress>>,
    /// IngressDeny is a list of IngressDenyRule which are enforced at ingress.
    /// Any rule inserted here will be denied regardless of the allowed ingress
    /// rules in the 'ingress' field.
    /// If omitted or empty, this rule does not apply at ingress.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "ingressDeny"
    )]
    pub ingress_deny: Option<Vec<CiliumNetworkPolicysIngressDeny>>,
    /// Labels is a list of optional strings which can be used to
    /// re-identify the rule or to store metadata. It is possible to lookup
    /// or delete strings based on labels. Labels are not required to be
    /// unique, multiple rules can have overlapping or identical labels.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<Vec<CiliumNetworkPolicysLabels>>,
    /// Log specifies custom policy-specific Hubble logging configuration.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub log: Option<CiliumNetworkPolicysLog>,
    /// NodeSelector selects all nodes which should be subject to this rule.
    /// EndpointSelector and NodeSelector cannot be both empty and are mutually
    /// exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "nodeSelector"
    )]
    pub node_selector: Option<CiliumNetworkPolicysNodeSelector>,
}

/// EgressRule contains all rule types which can be applied at egress, i.e.
/// network traffic that originates inside the endpoint and exits the endpoint
/// selected by the endpointSelector.
///
///   - All members of this structure are optional. If omitted or empty, the
///     member will have no effect on the rule.
///
///   - If multiple members of the structure are specified, then all members
///     must match in order for the rule to take effect.
///
///   - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
///     mutually exclusive. Only one of these members may be present within an
///     individual rule.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgress {
    /// Authentication is the required authentication type for the allowed traffic, if any.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub authentication: Option<CiliumNetworkPolicysEgressAuthentication>,
    /// ICMPs is a list of ICMP rule identified by type number
    /// which the endpoint subject to the rule is allowed to connect to.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" is allowed to initiate
    /// type 8 ICMP connections.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icmps: Option<Vec<CiliumNetworkPolicysEgressIcmps>>,
    /// ToCIDR is a list of IP blocks which the endpoint subject to the rule
    /// is allowed to initiate connections. Only connections destined for
    /// outside of the cluster and not targeting the host will be subject
    /// to CIDR rules.  This will match on the destination IP address of
    /// outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
    /// with no ExcludeCIDRs is equivalent. Overlaps are allowed between
    /// ToCIDR and ToCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=database-proxy" is allowed to
    /// initiate connections to 10.2.3.0/24
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toCIDR")]
    pub to_cidr: Option<Vec<String>>,
    /// ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
    /// is allowed to initiate connections to in addition to connections
    /// which are allowed via ToEndpoints, along with a list of subnets contained
    /// within their corresponding IP block to which traffic should not be
    /// allowed. This will match on the destination IP address of outgoing
    /// connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
    /// ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
    /// ToCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=database-proxy" is allowed to
    /// initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toCIDRSet")]
    pub to_cidr_set: Option<Vec<CiliumNetworkPolicysEgressToCidrSet>>,
    /// ToEndpoints is a list of endpoints identified by an EndpointSelector to
    /// which the endpoints subject to the rule are allowed to communicate.
    ///
    /// Example:
    /// Any endpoint with the label "role=frontend" can communicate with any
    /// endpoint carrying the label "role=backend".
    ///
    /// Note that while an empty non-nil ToEndpoints does not select anything,
    /// nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
    /// are also specified.
    /// To select everything, use one EndpointSelector without any match requirements.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toEndpoints"
    )]
    pub to_endpoints: Option<Vec<CiliumNetworkPolicysEgressToEndpoints>>,
    /// ToEntities is a list of special entities to which the endpoint subject
    /// to the rule is allowed to initiate connections. Supported entities are
    /// `world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
    /// `health`, `unmanaged`, `none` and `all`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toEntities"
    )]
    pub to_entities: Option<Vec<String>>,
    /// ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
    /// from DNS resolution of `ToFQDN.MatchName`s are added to the same
    /// EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
    /// L7 rules within this EgressRule will also apply to these IPs.
    /// The DNS -> IP mapping is re-resolved periodically from within the
    /// cilium-agent, and the IPs in the DNS response are effected in the policy
    /// for selected pods as-is (i.e. the list of IPs is not modified in any way).
    /// Note: An explicit rule to allow for DNS traffic is needed for the pods, as
    /// ToFQDN counts as an egress rule and will enforce egress policy when
    /// PolicyEnforcment=default.
    /// Note: If the resolved IPs are IPs within the kubernetes cluster, the
    /// ToFQDN rule will not apply to that IP.
    /// Note: ToFQDN cannot occur in the same policy as other To* rules.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toFQDNs")]
    pub to_fqd_ns: Option<Vec<CiliumNetworkPolicysEgressToFqdNs>>,
    /// ToGroups is a directive that allows the integration with multiple outside
    /// providers. Currently, only AWS is supported, and the rule can select by
    /// multiple sub directives:
    ///
    /// Example:
    /// toGroups:
    /// - aws:
    ///     securityGroupsIds:
    ///     - 'sg-XXXXXXXXXXXXX'
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toGroups")]
    pub to_groups: Option<Vec<CiliumNetworkPolicysEgressToGroups>>,
    /// ToNodes is a list of nodes identified by an
    /// EndpointSelector to which endpoints subject to the rule is allowed to communicate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toNodes")]
    pub to_nodes: Option<Vec<CiliumNetworkPolicysEgressToNodes>>,
    /// ToPorts is a list of destination ports identified by port number and
    /// protocol which the endpoint subject to the rule is allowed to
    /// connect to.
    ///
    /// Example:
    /// Any endpoint with the label "role=frontend" is allowed to initiate
    /// connections to destination port 8080/tcp
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPorts")]
    pub to_ports: Option<Vec<CiliumNetworkPolicysEgressToPorts>>,
    /// Deprecated.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toRequires"
    )]
    pub to_requires: Option<Vec<String>>,
    /// ToServices is a list of services to which the endpoint subject
    /// to the rule is allowed to initiate connections.
    /// Currently Cilium only supports toServices for K8s services.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toServices"
    )]
    pub to_services: Option<Vec<CiliumNetworkPolicysEgressToServices>>,
}

/// Authentication is the required authentication type for the allowed traffic, if any.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressAuthentication {
    /// Mode is the required authentication mode for the allowed traffic, if any.
    pub mode: CiliumNetworkPolicysEgressAuthenticationMode,
}

/// Authentication is the required authentication type for the allowed traffic, if any.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressAuthenticationMode {
    #[serde(rename = "disabled")]
    Disabled,
    #[serde(rename = "required")]
    Required,
    #[serde(rename = "test-always-fail")]
    TestAlwaysFail,
}

/// ICMPRule is a list of ICMP fields.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressIcmps {
    /// Fields is a list of ICMP fields.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fields: Option<Vec<CiliumNetworkPolicysEgressIcmpsFields>>,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressIcmpsFields {
    /// Family is a IP address version.
    /// Currently, we support `IPv4` and `IPv6`.
    /// `IPv4` is set as default.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub family: Option<CiliumNetworkPolicysEgressIcmpsFieldsFamily>,
    /// Type is a ICMP-type.
    /// It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
    /// Allowed ICMP types are:
    ///     Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
    /// 		     RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
    /// 			 Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
    ///     Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
    /// 			 EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
    /// 			 MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
    /// 			 NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
    /// 			 ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
    /// 			 HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
    /// 			 MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
    /// 			 ExtendedEchoRequest | ExtendedEchoReply
    #[serde(rename = "type")]
    pub r#type: IntOrString,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressIcmpsFieldsFamily {
    IPv4,
    IPv6,
}

/// CIDRRule is a rule that specifies a CIDR prefix to/from which outside
/// communication  is allowed, along with an optional list of subnets within that
/// CIDR prefix to/from which outside communication is not allowed.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToCidrSet {
    /// CIDR is a CIDR prefix / IP Block.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cidr: Option<String>,
    /// CIDRGroupRef is a reference to a CiliumCIDRGroup object.
    /// A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
    /// the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
    /// connections from.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupRef"
    )]
    pub cidr_group_ref: Option<String>,
    /// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
    /// rather than by name.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupSelector"
    )]
    pub cidr_group_selector: Option<CiliumNetworkPolicysEgressToCidrSetCidrGroupSelector>,
    /// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
    /// is not allowed to initiate connections to. These CIDR prefixes should be
    /// contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
    /// supported yet.
    /// These exceptions are only applied to the Cidr in this CIDRRule, and do not
    /// apply to any other CIDR prefixes in any other CIDRRules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub except: Option<Vec<String>>,
}

/// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
/// rather than by name.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToCidrSetCidrGroupSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicysEgressToCidrSetCidrGroupSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToCidrSetCidrGroupSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysEgressToCidrSetCidrGroupSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressToCidrSetCidrGroupSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToEndpoints {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysEgressToEndpointsMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToEndpointsMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysEgressToEndpointsMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressToEndpointsMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToFqdNs {
    /// MatchName matches literal DNS names. A trailing "." is automatically added
    /// when missing.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchName")]
    pub match_name: Option<String>,
    /// MatchPattern allows using wildcards to match DNS names. All wildcards are
    /// case insensitive. The wildcards are:
    /// - "*" matches 0 or more DNS valid characters, and may occur anywhere in
    /// the pattern. As a special case a "*" as the leftmost character, without a
    /// following "." matches all subdomains as well as the name to the right.
    /// A trailing "." is automatically added when missing.
    /// - "**." is a special prefix which matches all multilevel subdomains in the prefix.
    ///
    /// Examples:
    /// 1. `*.cilium.io` matches subdomains of cilium at that level
    ///   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
    /// 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
    ///   except those containing "." separator, subcilium.io and sub-cilium.io match,
    ///   www.cilium.io and blog.cilium.io does not
    /// 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
    ///   begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
    ///   blog.cilium.io, cilium.io and google.com do not
    /// 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
    ///   "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchPattern"
    )]
    pub match_pattern: Option<String>,
}

/// Groups structure to store all kinds of new integrations that needs a new
/// derivative policy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToGroups {
    /// AWSGroup is an structure that can be used to whitelisting information from AWS integration
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<CiliumNetworkPolicysEgressToGroupsAws>,
}

/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToGroupsAws {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsIds"
    )]
    pub security_groups_ids: Option<Vec<String>>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsNames"
    )]
    pub security_groups_names: Option<Vec<String>>,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToNodes {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysEgressToNodesMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToNodesMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysEgressToNodesMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressToNodesMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// PortRule is a list of ports/protocol combinations with optional Layer 7
/// rules which must be met.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPorts {
    /// listener specifies the name of a custom Envoy listener to which this traffic should be
    /// redirected to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub listener: Option<CiliumNetworkPolicysEgressToPortsListener>,
    /// OriginatingTLS is the TLS context for the connections originated by
    /// the L7 proxy.  For egress policy this specifies the client-side TLS
    /// parameters for the upstream connection originating from the L7 proxy
    /// to the remote destination. For ingress policy this specifies the
    /// client-side TLS parameters for the connection from the L7 proxy to
    /// the local endpoint.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "originatingTLS"
    )]
    pub originating_tls: Option<CiliumNetworkPolicysEgressToPortsOriginatingTls>,
    /// Ports is a list of L4 port/protocol
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<CiliumNetworkPolicysEgressToPortsPorts>>,
    /// Rules is a list of additional port level rules which must be met in
    /// order for the PortRule to allow the traffic. If omitted or empty,
    /// no layer 7 rules are enforced.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub rules: Option<CiliumNetworkPolicysEgressToPortsRules>,
    /// ServerNames is a list of allowed TLS SNI values. If not empty, then
    /// TLS must be present and one of the provided SNIs must be indicated in the
    /// TLS handshake.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serverNames"
    )]
    pub server_names: Option<Vec<String>>,
    /// TerminatingTLS is the TLS context for the connection terminated by
    /// the L7 proxy.  For egress policy this specifies the server-side TLS
    /// parameters to be applied on the connections originated from the local
    /// endpoint and terminated by the L7 proxy. For ingress policy this specifies
    /// the server-side TLS parameters to be applied on the connections
    /// originated from a remote source and terminated by the L7 proxy.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "terminatingTLS"
    )]
    pub terminating_tls: Option<CiliumNetworkPolicysEgressToPortsTerminatingTls>,
}

/// listener specifies the name of a custom Envoy listener to which this traffic should be
/// redirected to.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsListener {
    /// EnvoyConfig is a reference to the CEC or CCEC resource in which
    /// the listener is defined.
    #[serde(rename = "envoyConfig")]
    pub envoy_config: CiliumNetworkPolicysEgressToPortsListenerEnvoyConfig,
    /// Name is the name of the listener.
    pub name: String,
    /// Priority for this Listener that is used when multiple rules would apply different
    /// listeners to a policy map entry. Behavior of this is implementation dependent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub priority: Option<i64>,
}

/// EnvoyConfig is a reference to the CEC or CCEC resource in which
/// the listener is defined.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsListenerEnvoyConfig {
    /// Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
    /// CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
    /// respectively. The only case this is currently explicitly needed is when referring to a
    /// CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
    /// from a cluster scoped policy is not allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kind: Option<CiliumNetworkPolicysEgressToPortsListenerEnvoyConfigKind>,
    /// Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
    /// the listener is defined in.
    pub name: String,
}

/// EnvoyConfig is a reference to the CEC or CCEC resource in which
/// the listener is defined.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressToPortsListenerEnvoyConfigKind {
    CiliumEnvoyConfig,
    CiliumClusterwideEnvoyConfig,
}

/// OriginatingTLS is the TLS context for the connections originated by
/// the L7 proxy.  For egress policy this specifies the client-side TLS
/// parameters for the upstream connection originating from the L7 proxy
/// to the remote destination. For ingress policy this specifies the
/// client-side TLS parameters for the connection from the L7 proxy to
/// the local endpoint.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsOriginatingTls {
    /// Certificate is the file name or k8s secret item name for the certificate
    /// chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
    /// item must exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<String>,
    /// PrivateKey is the file name or k8s secret item name for the private key
    /// matching the certificate chain. If omitted, 'tls.key' is assumed, if it
    /// exists. If given, the item must exist.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "privateKey"
    )]
    pub private_key: Option<String>,
    /// Secret is the secret that contains the certificates and private key for
    /// the TLS context.
    /// By default, Cilium will search in this secret for the following items:
    ///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
    ///  - 'tls.crt' - Which represents the public key certificate.
    ///  - 'tls.key' - Which represents the private key matching the public key
    ///                certificate.
    pub secret: CiliumNetworkPolicysEgressToPortsOriginatingTlsSecret,
    /// TrustedCA is the file name or k8s secret item name for the trusted CA.
    /// If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
    /// exist.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCA")]
    pub trusted_ca: Option<String>,
}

/// Secret is the secret that contains the certificates and private key for
/// the TLS context.
/// By default, Cilium will search in this secret for the following items:
///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
///  - 'tls.crt' - Which represents the public key certificate.
///  - 'tls.key' - Which represents the private key matching the public key
///                certificate.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsOriginatingTlsSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsPorts {
    /// EndPort can only be an L4 port number.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "endPort")]
    pub end_port: Option<i32>,
    /// Port can be an L4 port number, or a name in the form of "http"
    /// or "http-8080".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<String>,
    /// Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
    /// with transport ports (TCP, UDP, SCTP) match.
    ///
    /// Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "ANY"
    ///
    /// Matching on ICMP is not supported.
    ///
    /// Named port specified for a container may narrow this down, but may not
    /// contradict this.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub protocol: Option<CiliumNetworkPolicysEgressToPortsPortsProtocol>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressToPortsPortsProtocol {
    #[serde(rename = "TCP")]
    Tcp,
    #[serde(rename = "UDP")]
    Udp,
    #[serde(rename = "SCTP")]
    Sctp,
    #[serde(rename = "VRRP")]
    Vrrp,
    #[serde(rename = "IGMP")]
    Igmp,
    #[serde(rename = "ANY")]
    Any,
}

/// Rules is a list of additional port level rules which must be met in
/// order for the PortRule to allow the traffic. If omitted or empty,
/// no layer 7 rules are enforced.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsRules {
    /// DNS-specific rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub dns: Option<Vec<CiliumNetworkPolicysEgressToPortsRulesDns>>,
    /// HTTP specific rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub http: Option<Vec<CiliumNetworkPolicysEgressToPortsRulesHttp>>,
    /// Kafka-specific rules.
    /// Deprecated: This beta feature is deprecated and will be removed in a future release.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kafka: Option<Vec<CiliumNetworkPolicysEgressToPortsRulesKafka>>,
    /// Key-value pair rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub l7: Option<Vec<BTreeMap<String, String>>>,
    /// Name of the L7 protocol for which the Key-value pair rules apply.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub l7proto: Option<String>,
}

/// PortRuleDNS is a list of allowed DNS lookups.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsRulesDns {
    /// MatchName matches literal DNS names. A trailing "." is automatically added
    /// when missing.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchName")]
    pub match_name: Option<String>,
    /// MatchPattern allows using wildcards to match DNS names. All wildcards are
    /// case insensitive. The wildcards are:
    /// - "*" matches 0 or more DNS valid characters, and may occur anywhere in
    /// the pattern. As a special case a "*" as the leftmost character, without a
    /// following "." matches all subdomains as well as the name to the right.
    /// A trailing "." is automatically added when missing.
    /// - "**." is a special prefix which matches all multilevel subdomains in the prefix.
    ///
    /// Examples:
    /// 1. `*.cilium.io` matches subdomains of cilium at that level
    ///   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
    /// 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
    ///   except those containing "." separator, subcilium.io and sub-cilium.io match,
    ///   www.cilium.io and blog.cilium.io does not
    /// 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
    ///   begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
    ///   blog.cilium.io, cilium.io and google.com do not
    /// 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
    ///   "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchPattern"
    )]
    pub match_pattern: Option<String>,
}

/// PortRuleHTTP is a list of HTTP protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule does not have any
/// effect.
///
/// All fields of this type are extended POSIX regex as defined by IEEE Std
/// 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
/// matched against the path of an incoming request. Currently it can contain
/// characters disallowed from the conventional "path" part of a URL as defined
/// by RFC 3986.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsRulesHttp {
    /// HeaderMatches is a list of HTTP headers which must be
    /// present and match against the given values. Mismatch field can be used
    /// to specify what to do when there is no match.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "headerMatches"
    )]
    pub header_matches: Option<Vec<CiliumNetworkPolicysEgressToPortsRulesHttpHeaderMatches>>,
    /// Headers is a list of HTTP headers which must be present in the
    /// request. If omitted or empty, requests are allowed regardless of
    /// headers present.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub headers: Option<Vec<String>>,
    /// Host is an extended POSIX regex matched against the host header of a
    /// request. Examples:
    ///
    /// - foo.bar.com will match the host fooXbar.com or foo-bar.com
    /// - foo\.bar\.com will only match the host foo.bar.com
    ///
    /// If omitted or empty, the value of the host header is ignored.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub host: Option<String>,
    /// Method is an extended POSIX regex matched against the method of a
    /// request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
    ///
    /// If omitted or empty, all methods are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub method: Option<String>,
    /// Path is an extended POSIX regex matched against the path of a
    /// request. Currently it can contain characters disallowed from the
    /// conventional "path" part of a URL as defined by RFC 3986.
    ///
    /// If omitted or empty, all paths are all allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
}

/// HeaderMatch extends the HeaderValue for matching requirement of a
/// named header field against an immediate string or a secret value.
/// If none of the optional fields is present, then the
/// header value is not matched, only presence of the header is enough.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsRulesHttpHeaderMatches {
    /// Mismatch identifies what to do in case there is no match. The default is
    /// to drop the request. Otherwise the overall rule is still considered as
    /// matching, but the mismatches are logged in the access log.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub mismatch: Option<CiliumNetworkPolicysEgressToPortsRulesHttpHeaderMatchesMismatch>,
    /// Name identifies the header.
    pub name: String,
    /// Secret refers to a secret that contains the value to be matched against.
    /// The secret must only contain one entry. If the referred secret does not
    /// exist, and there is no "Value" specified, the match will fail.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secret: Option<CiliumNetworkPolicysEgressToPortsRulesHttpHeaderMatchesSecret>,
    /// Value matches the exact value of the header. Can be specified either
    /// alone or together with "Secret"; will be used as the header value if the
    /// secret can not be found in the latter case.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// HeaderMatch extends the HeaderValue for matching requirement of a
/// named header field against an immediate string or a secret value.
/// If none of the optional fields is present, then the
/// header value is not matched, only presence of the header is enough.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressToPortsRulesHttpHeaderMatchesMismatch {
    #[serde(rename = "LOG")]
    Log,
    #[serde(rename = "ADD")]
    Add,
    #[serde(rename = "DELETE")]
    Delete,
    #[serde(rename = "REPLACE")]
    Replace,
}

/// Secret refers to a secret that contains the value to be matched against.
/// The secret must only contain one entry. If the referred secret does not
/// exist, and there is no "Value" specified, the match will fail.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsRulesHttpHeaderMatchesSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PortRule is a list of Kafka protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule will match all
/// Kafka messages.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsRulesKafka {
    /// APIKey is a case-insensitive string matched against the key of a
    /// request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al
    /// Reference: <https://kafka.apache.org/protocol#protocol_api_keys>
    ///
    /// If omitted or empty, and if Role is not specified, then all keys are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiKey")]
    pub api_key: Option<String>,
    /// APIVersion is the version matched against the api version of the
    /// Kafka message. If set, it has to be a string representing a positive
    /// integer.
    ///
    /// If omitted or empty, all versions are allowed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "apiVersion"
    )]
    pub api_version: Option<String>,
    /// ClientID is the client identifier as provided in the request.
    ///
    /// From Kafka protocol documentation:
    /// This is a user supplied identifier for the client application. The
    /// user can use any identifier they like and it will be used when
    /// logging errors, monitoring aggregates, etc. For example, one might
    /// want to monitor not just the requests per second overall, but the
    /// number coming from each client application (each of which could
    /// reside on multiple servers). This id acts as a logical grouping
    /// across all requests from a particular client.
    ///
    /// If omitted or empty, all client identifiers are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientID")]
    pub client_id: Option<String>,
    /// Role is a case-insensitive string and describes a group of API keys
    /// necessary to perform certain higher-level Kafka operations such as "produce"
    /// or "consume". A Role automatically expands into all APIKeys required
    /// to perform the specified higher-level operation.
    ///
    /// The following values are supported:
    ///  - "produce": Allow producing to the topics specified in the rule
    ///  - "consume": Allow consuming from the topics specified in the rule
    ///
    /// This field is incompatible with the APIKey field, i.e APIKey and Role
    /// cannot both be specified in the same rule.
    ///
    /// If omitted or empty, and if APIKey is not specified, then all keys are
    /// allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<CiliumNetworkPolicysEgressToPortsRulesKafkaRole>,
    /// Topic is the topic name contained in the message. If a Kafka request
    /// contains multiple topics, then all topics must be allowed or the
    /// message will be rejected.
    ///
    /// This constraint is ignored if the matched request message type
    /// doesn't contain any topic. Maximum size of Topic can be 249
    /// characters as per recent Kafka spec and allowed characters are
    /// a-z, A-Z, 0-9, -, . and _.
    ///
    /// Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10
    /// version the length was changed from 255 to 249. For compatibility
    /// reasons we are using 255.
    ///
    /// If omitted or empty, all topics are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub topic: Option<String>,
}

/// PortRule is a list of Kafka protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule will match all
/// Kafka messages.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressToPortsRulesKafkaRole {
    #[serde(rename = "produce")]
    Produce,
    #[serde(rename = "consume")]
    Consume,
}

/// TerminatingTLS is the TLS context for the connection terminated by
/// the L7 proxy.  For egress policy this specifies the server-side TLS
/// parameters to be applied on the connections originated from the local
/// endpoint and terminated by the L7 proxy. For ingress policy this specifies
/// the server-side TLS parameters to be applied on the connections
/// originated from a remote source and terminated by the L7 proxy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsTerminatingTls {
    /// Certificate is the file name or k8s secret item name for the certificate
    /// chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
    /// item must exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<String>,
    /// PrivateKey is the file name or k8s secret item name for the private key
    /// matching the certificate chain. If omitted, 'tls.key' is assumed, if it
    /// exists. If given, the item must exist.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "privateKey"
    )]
    pub private_key: Option<String>,
    /// Secret is the secret that contains the certificates and private key for
    /// the TLS context.
    /// By default, Cilium will search in this secret for the following items:
    ///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
    ///  - 'tls.crt' - Which represents the public key certificate.
    ///  - 'tls.key' - Which represents the private key matching the public key
    ///                certificate.
    pub secret: CiliumNetworkPolicysEgressToPortsTerminatingTlsSecret,
    /// TrustedCA is the file name or k8s secret item name for the trusted CA.
    /// If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
    /// exist.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCA")]
    pub trusted_ca: Option<String>,
}

/// Secret is the secret that contains the certificates and private key for
/// the TLS context.
/// By default, Cilium will search in this secret for the following items:
///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
///  - 'tls.crt' - Which represents the public key certificate.
///  - 'tls.key' - Which represents the private key matching the public key
///                certificate.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToPortsTerminatingTlsSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Service selects policy targets that are bundled as part of a
/// logical load-balanced service.
///
/// Currently only Kubernetes-based Services are supported.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToServices {
    /// K8sService selects service by name and namespace pair
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "k8sService"
    )]
    pub k8s_service: Option<CiliumNetworkPolicysEgressToServicesK8sService>,
    /// K8sServiceSelector selects services by k8s labels and namespace
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "k8sServiceSelector"
    )]
    pub k8s_service_selector: Option<CiliumNetworkPolicysEgressToServicesK8sServiceSelector>,
}

/// K8sService selects service by name and namespace pair
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToServicesK8sService {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serviceName"
    )]
    pub service_name: Option<String>,
}

/// K8sServiceSelector selects services by k8s labels and namespace
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToServicesK8sServiceSelector {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// ServiceSelector is a label selector for k8s services
    pub selector: CiliumNetworkPolicysEgressToServicesK8sServiceSelectorSelector,
}

/// ServiceSelector is a label selector for k8s services
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToServicesK8sServiceSelectorSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicysEgressToServicesK8sServiceSelectorSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressToServicesK8sServiceSelectorSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator:
        CiliumNetworkPolicysEgressToServicesK8sServiceSelectorSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressToServicesK8sServiceSelectorSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EgressDenyRule contains all rule types which can be applied at egress, i.e.
/// network traffic that originates inside the endpoint and exits the endpoint
/// selected by the endpointSelector.
///
///   - All members of this structure are optional. If omitted or empty, the
///     member will have no effect on the rule.
///
///   - If multiple members of the structure are specified, then all members
///     must match in order for the rule to take effect.
///
///   - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
///     mutually exclusive. Only one of these members may be present within an
///     individual rule.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDeny {
    /// ICMPs is a list of ICMP rule identified by type number
    /// which the endpoint subject to the rule is not allowed to connect to.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" is not allowed to initiate
    /// type 8 ICMP connections.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icmps: Option<Vec<CiliumNetworkPolicysEgressDenyIcmps>>,
    /// ToCIDR is a list of IP blocks which the endpoint subject to the rule
    /// is allowed to initiate connections. Only connections destined for
    /// outside of the cluster and not targeting the host will be subject
    /// to CIDR rules.  This will match on the destination IP address of
    /// outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
    /// with no ExcludeCIDRs is equivalent. Overlaps are allowed between
    /// ToCIDR and ToCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=database-proxy" is allowed to
    /// initiate connections to 10.2.3.0/24
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toCIDR")]
    pub to_cidr: Option<Vec<String>>,
    /// ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
    /// is allowed to initiate connections to in addition to connections
    /// which are allowed via ToEndpoints, along with a list of subnets contained
    /// within their corresponding IP block to which traffic should not be
    /// allowed. This will match on the destination IP address of outgoing
    /// connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
    /// ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
    /// ToCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=database-proxy" is allowed to
    /// initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toCIDRSet")]
    pub to_cidr_set: Option<Vec<CiliumNetworkPolicysEgressDenyToCidrSet>>,
    /// ToEndpoints is a list of endpoints identified by an EndpointSelector to
    /// which the endpoints subject to the rule are allowed to communicate.
    ///
    /// Example:
    /// Any endpoint with the label "role=frontend" can communicate with any
    /// endpoint carrying the label "role=backend".
    ///
    /// Note that while an empty non-nil ToEndpoints does not select anything,
    /// nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
    /// are also specified.
    /// To select everything, use one EndpointSelector without any match requirements.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toEndpoints"
    )]
    pub to_endpoints: Option<Vec<CiliumNetworkPolicysEgressDenyToEndpoints>>,
    /// ToEntities is a list of special entities to which the endpoint subject
    /// to the rule is allowed to initiate connections. Supported entities are
    /// `world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
    /// `health`, `unmanaged`, `none` and `all`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toEntities"
    )]
    pub to_entities: Option<Vec<String>>,
    /// ToGroups is a directive that allows the integration with multiple outside
    /// providers. Currently, only AWS is supported, and the rule can select by
    /// multiple sub directives:
    ///
    /// Example:
    /// toGroups:
    /// - aws:
    ///     securityGroupsIds:
    ///     - 'sg-XXXXXXXXXXXXX'
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toGroups")]
    pub to_groups: Option<Vec<CiliumNetworkPolicysEgressDenyToGroups>>,
    /// ToNodes is a list of nodes identified by an
    /// EndpointSelector to which endpoints subject to the rule is allowed to communicate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toNodes")]
    pub to_nodes: Option<Vec<CiliumNetworkPolicysEgressDenyToNodes>>,
    /// ToPorts is a list of destination ports identified by port number and
    /// protocol which the endpoint subject to the rule is not allowed to connect
    /// to.
    ///
    /// Example:
    /// Any endpoint with the label "role=frontend" is not allowed to initiate
    /// connections to destination port 8080/tcp
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPorts")]
    pub to_ports: Option<Vec<CiliumNetworkPolicysEgressDenyToPorts>>,
    /// Deprecated.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toRequires"
    )]
    pub to_requires: Option<Vec<String>>,
    /// ToServices is a list of services to which the endpoint subject
    /// to the rule is allowed to initiate connections.
    /// Currently Cilium only supports toServices for K8s services.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "toServices"
    )]
    pub to_services: Option<Vec<CiliumNetworkPolicysEgressDenyToServices>>,
}

/// ICMPRule is a list of ICMP fields.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyIcmps {
    /// Fields is a list of ICMP fields.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fields: Option<Vec<CiliumNetworkPolicysEgressDenyIcmpsFields>>,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyIcmpsFields {
    /// Family is a IP address version.
    /// Currently, we support `IPv4` and `IPv6`.
    /// `IPv4` is set as default.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub family: Option<CiliumNetworkPolicysEgressDenyIcmpsFieldsFamily>,
    /// Type is a ICMP-type.
    /// It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
    /// Allowed ICMP types are:
    ///     Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
    /// 		     RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
    /// 			 Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
    ///     Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
    /// 			 EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
    /// 			 MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
    /// 			 NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
    /// 			 ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
    /// 			 HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
    /// 			 MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
    /// 			 ExtendedEchoRequest | ExtendedEchoReply
    #[serde(rename = "type")]
    pub r#type: IntOrString,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressDenyIcmpsFieldsFamily {
    IPv4,
    IPv6,
}

/// CIDRRule is a rule that specifies a CIDR prefix to/from which outside
/// communication  is allowed, along with an optional list of subnets within that
/// CIDR prefix to/from which outside communication is not allowed.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToCidrSet {
    /// CIDR is a CIDR prefix / IP Block.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cidr: Option<String>,
    /// CIDRGroupRef is a reference to a CiliumCIDRGroup object.
    /// A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
    /// the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
    /// connections from.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupRef"
    )]
    pub cidr_group_ref: Option<String>,
    /// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
    /// rather than by name.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupSelector"
    )]
    pub cidr_group_selector: Option<CiliumNetworkPolicysEgressDenyToCidrSetCidrGroupSelector>,
    /// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
    /// is not allowed to initiate connections to. These CIDR prefixes should be
    /// contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
    /// supported yet.
    /// These exceptions are only applied to the Cidr in this CIDRRule, and do not
    /// apply to any other CIDR prefixes in any other CIDRRules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub except: Option<Vec<String>>,
}

/// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
/// rather than by name.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToCidrSetCidrGroupSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicysEgressDenyToCidrSetCidrGroupSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToCidrSetCidrGroupSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysEgressDenyToCidrSetCidrGroupSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressDenyToCidrSetCidrGroupSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToEndpoints {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysEgressDenyToEndpointsMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToEndpointsMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysEgressDenyToEndpointsMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressDenyToEndpointsMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// Groups structure to store all kinds of new integrations that needs a new
/// derivative policy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToGroups {
    /// AWSGroup is an structure that can be used to whitelisting information from AWS integration
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<CiliumNetworkPolicysEgressDenyToGroupsAws>,
}

/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToGroupsAws {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsIds"
    )]
    pub security_groups_ids: Option<Vec<String>>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsNames"
    )]
    pub security_groups_names: Option<Vec<String>>,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToNodes {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysEgressDenyToNodesMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToNodesMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysEgressDenyToNodesMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressDenyToNodesMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// PortDenyRule is a list of ports/protocol that should be used for deny
/// policies. This structure lacks the L7Rules since it's not supported in deny
/// policies.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToPorts {
    /// Ports is a list of L4 port/protocol
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<CiliumNetworkPolicysEgressDenyToPortsPorts>>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToPortsPorts {
    /// EndPort can only be an L4 port number.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "endPort")]
    pub end_port: Option<i32>,
    /// Port can be an L4 port number, or a name in the form of "http"
    /// or "http-8080".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<String>,
    /// Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
    /// with transport ports (TCP, UDP, SCTP) match.
    ///
    /// Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "ANY"
    ///
    /// Matching on ICMP is not supported.
    ///
    /// Named port specified for a container may narrow this down, but may not
    /// contradict this.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub protocol: Option<CiliumNetworkPolicysEgressDenyToPortsPortsProtocol>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressDenyToPortsPortsProtocol {
    #[serde(rename = "TCP")]
    Tcp,
    #[serde(rename = "UDP")]
    Udp,
    #[serde(rename = "SCTP")]
    Sctp,
    #[serde(rename = "VRRP")]
    Vrrp,
    #[serde(rename = "IGMP")]
    Igmp,
    #[serde(rename = "ANY")]
    Any,
}

/// Service selects policy targets that are bundled as part of a
/// logical load-balanced service.
///
/// Currently only Kubernetes-based Services are supported.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToServices {
    /// K8sService selects service by name and namespace pair
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "k8sService"
    )]
    pub k8s_service: Option<CiliumNetworkPolicysEgressDenyToServicesK8sService>,
    /// K8sServiceSelector selects services by k8s labels and namespace
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "k8sServiceSelector"
    )]
    pub k8s_service_selector: Option<CiliumNetworkPolicysEgressDenyToServicesK8sServiceSelector>,
}

/// K8sService selects service by name and namespace pair
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToServicesK8sService {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serviceName"
    )]
    pub service_name: Option<String>,
}

/// K8sServiceSelector selects services by k8s labels and namespace
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToServicesK8sServiceSelector {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// ServiceSelector is a label selector for k8s services
    pub selector: CiliumNetworkPolicysEgressDenyToServicesK8sServiceSelectorSelector,
}

/// ServiceSelector is a label selector for k8s services
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToServicesK8sServiceSelectorSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<
        Vec<CiliumNetworkPolicysEgressDenyToServicesK8sServiceSelectorSelectorMatchExpressions>,
    >,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEgressDenyToServicesK8sServiceSelectorSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator:
        CiliumNetworkPolicysEgressDenyToServicesK8sServiceSelectorSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEgressDenyToServicesK8sServiceSelectorSelectorMatchExpressionsOperator
{
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EnableDefaultDeny determines whether this policy configures the
/// subject endpoint(s) to have a default deny mode. If enabled,
/// this causes all traffic not explicitly allowed by a network policy
/// to be dropped.
///
/// If not specified, the default is true for each traffic direction
/// that has rules, and false otherwise. For example, if a policy
/// only has Ingress or IngressDeny rules, then the default for
/// ingress is true and egress is false.
///
/// If multiple policies apply to an endpoint, that endpoint's default deny
/// will be enabled if any policy requests it.
///
/// This is useful for creating broad-based network policies that will not
/// cause endpoints to enter default-deny mode.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEnableDefaultDeny {
    /// Whether or not the endpoint should have a default-deny rule applied
    /// to egress traffic.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub egress: Option<bool>,
    /// Whether or not the endpoint should have a default-deny rule applied
    /// to ingress traffic.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ingress: Option<bool>,
}

/// EndpointSelector selects all endpoints which should be subject to
/// this rule. EndpointSelector and NodeSelector cannot be both empty and
/// are mutually exclusive.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEndpointSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysEndpointSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysEndpointSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysEndpointSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysEndpointSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// IngressRule contains all rule types which can be applied at ingress,
/// i.e. network traffic that originates outside of the endpoint and
/// is entering the endpoint selected by the endpointSelector.
///
///   - All members of this structure are optional. If omitted or empty, the
///     member will have no effect on the rule.
///
///   - If multiple members are set, all of them need to match in order for
///     the rule to take effect.
///
///   - FromEndpoints, FromCIDR, FromCIDRSet and FromEntities are mutually
///     exclusive. Only one of these members may be present within an individual
///     rule.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngress {
    /// Authentication is the required authentication type for the allowed traffic, if any.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub authentication: Option<CiliumNetworkPolicysIngressAuthentication>,
    /// FromCIDR is a list of IP blocks which the endpoint subject to the
    /// rule is allowed to receive connections from. Only connections which
    /// do *not* originate from the cluster or from the local host are subject
    /// to CIDR rules. In order to allow in-cluster connectivity, use the
    /// FromEndpoints field.  This will match on the source IP address of
    /// incoming connections. Adding  a prefix into FromCIDR or into
    /// FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
    /// allowed between FromCIDR and FromCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
    /// connections from 10.3.9.1
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromCIDR")]
    pub from_cidr: Option<Vec<String>>,
    /// FromCIDRSet is a list of IP blocks which the endpoint subject to the
    /// rule is allowed to receive connections from in addition to FromEndpoints,
    /// along with a list of subnets contained within their corresponding IP block
    /// from which traffic should not be allowed.
    /// This will match on the source IP address of incoming connections. Adding
    /// a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
    /// equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
    /// connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromCIDRSet"
    )]
    pub from_cidr_set: Option<Vec<CiliumNetworkPolicysIngressFromCidrSet>>,
    /// FromEndpoints is a list of endpoints identified by an
    /// EndpointSelector which are allowed to communicate with the endpoint
    /// subject to the rule.
    ///
    /// Example:
    /// Any endpoint with the label "role=backend" can be consumed by any
    /// endpoint carrying the label "role=frontend".
    ///
    /// Note that while an empty non-nil FromEndpoints does not select anything,
    /// nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
    /// are also specified.
    /// To select everything, use one EndpointSelector without any match requirements.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromEndpoints"
    )]
    pub from_endpoints: Option<Vec<CiliumNetworkPolicysIngressFromEndpoints>>,
    /// FromEntities is a list of special entities which the endpoint subject
    /// to the rule is allowed to receive connections from. Supported entities are
    /// `world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
    /// `health`, `unmanaged`, `none` and `all`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromEntities"
    )]
    pub from_entities: Option<Vec<String>>,
    /// FromGroups is a directive that allows the integration with multiple outside
    /// providers. Currently, only AWS is supported, and the rule can select by
    /// multiple sub directives:
    ///
    /// Example:
    /// FromGroups:
    /// - aws:
    ///     securityGroupsIds:
    ///     - 'sg-XXXXXXXXXXXXX'
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromGroups"
    )]
    pub from_groups: Option<Vec<CiliumNetworkPolicysIngressFromGroups>>,
    /// FromNodes is a list of nodes identified by an
    /// EndpointSelector which are allowed to communicate with the endpoint
    /// subject to the rule.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromNodes")]
    pub from_nodes: Option<Vec<CiliumNetworkPolicysIngressFromNodes>>,
    /// Deprecated.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromRequires"
    )]
    pub from_requires: Option<Vec<String>>,
    /// ICMPs is a list of ICMP rule identified by type number
    /// which the endpoint subject to the rule is allowed to
    /// receive connections on.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" can only accept incoming
    /// type 8 ICMP connections.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icmps: Option<Vec<CiliumNetworkPolicysIngressIcmps>>,
    /// ToPorts is a list of destination ports identified by port number and
    /// protocol which the endpoint subject to the rule is allowed to
    /// receive connections on.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" can only accept incoming
    /// connections on port 80/tcp.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPorts")]
    pub to_ports: Option<Vec<CiliumNetworkPolicysIngressToPorts>>,
}

/// Authentication is the required authentication type for the allowed traffic, if any.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressAuthentication {
    /// Mode is the required authentication mode for the allowed traffic, if any.
    pub mode: CiliumNetworkPolicysIngressAuthenticationMode,
}

/// Authentication is the required authentication type for the allowed traffic, if any.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressAuthenticationMode {
    #[serde(rename = "disabled")]
    Disabled,
    #[serde(rename = "required")]
    Required,
    #[serde(rename = "test-always-fail")]
    TestAlwaysFail,
}

/// CIDRRule is a rule that specifies a CIDR prefix to/from which outside
/// communication  is allowed, along with an optional list of subnets within that
/// CIDR prefix to/from which outside communication is not allowed.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromCidrSet {
    /// CIDR is a CIDR prefix / IP Block.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cidr: Option<String>,
    /// CIDRGroupRef is a reference to a CiliumCIDRGroup object.
    /// A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
    /// the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
    /// connections from.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupRef"
    )]
    pub cidr_group_ref: Option<String>,
    /// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
    /// rather than by name.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupSelector"
    )]
    pub cidr_group_selector: Option<CiliumNetworkPolicysIngressFromCidrSetCidrGroupSelector>,
    /// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
    /// is not allowed to initiate connections to. These CIDR prefixes should be
    /// contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
    /// supported yet.
    /// These exceptions are only applied to the Cidr in this CIDRRule, and do not
    /// apply to any other CIDR prefixes in any other CIDRRules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub except: Option<Vec<String>>,
}

/// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
/// rather than by name.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromCidrSetCidrGroupSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicysIngressFromCidrSetCidrGroupSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromCidrSetCidrGroupSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysIngressFromCidrSetCidrGroupSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressFromCidrSetCidrGroupSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromEndpoints {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysIngressFromEndpointsMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromEndpointsMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysIngressFromEndpointsMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressFromEndpointsMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// Groups structure to store all kinds of new integrations that needs a new
/// derivative policy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromGroups {
    /// AWSGroup is an structure that can be used to whitelisting information from AWS integration
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<CiliumNetworkPolicysIngressFromGroupsAws>,
}

/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromGroupsAws {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsIds"
    )]
    pub security_groups_ids: Option<Vec<String>>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsNames"
    )]
    pub security_groups_names: Option<Vec<String>>,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromNodes {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysIngressFromNodesMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressFromNodesMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysIngressFromNodesMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressFromNodesMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// ICMPRule is a list of ICMP fields.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressIcmps {
    /// Fields is a list of ICMP fields.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fields: Option<Vec<CiliumNetworkPolicysIngressIcmpsFields>>,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressIcmpsFields {
    /// Family is a IP address version.
    /// Currently, we support `IPv4` and `IPv6`.
    /// `IPv4` is set as default.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub family: Option<CiliumNetworkPolicysIngressIcmpsFieldsFamily>,
    /// Type is a ICMP-type.
    /// It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
    /// Allowed ICMP types are:
    ///     Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
    /// 		     RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
    /// 			 Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
    ///     Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
    /// 			 EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
    /// 			 MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
    /// 			 NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
    /// 			 ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
    /// 			 HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
    /// 			 MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
    /// 			 ExtendedEchoRequest | ExtendedEchoReply
    #[serde(rename = "type")]
    pub r#type: IntOrString,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressIcmpsFieldsFamily {
    IPv4,
    IPv6,
}

/// PortRule is a list of ports/protocol combinations with optional Layer 7
/// rules which must be met.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPorts {
    /// listener specifies the name of a custom Envoy listener to which this traffic should be
    /// redirected to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub listener: Option<CiliumNetworkPolicysIngressToPortsListener>,
    /// OriginatingTLS is the TLS context for the connections originated by
    /// the L7 proxy.  For egress policy this specifies the client-side TLS
    /// parameters for the upstream connection originating from the L7 proxy
    /// to the remote destination. For ingress policy this specifies the
    /// client-side TLS parameters for the connection from the L7 proxy to
    /// the local endpoint.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "originatingTLS"
    )]
    pub originating_tls: Option<CiliumNetworkPolicysIngressToPortsOriginatingTls>,
    /// Ports is a list of L4 port/protocol
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<CiliumNetworkPolicysIngressToPortsPorts>>,
    /// Rules is a list of additional port level rules which must be met in
    /// order for the PortRule to allow the traffic. If omitted or empty,
    /// no layer 7 rules are enforced.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub rules: Option<CiliumNetworkPolicysIngressToPortsRules>,
    /// ServerNames is a list of allowed TLS SNI values. If not empty, then
    /// TLS must be present and one of the provided SNIs must be indicated in the
    /// TLS handshake.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "serverNames"
    )]
    pub server_names: Option<Vec<String>>,
    /// TerminatingTLS is the TLS context for the connection terminated by
    /// the L7 proxy.  For egress policy this specifies the server-side TLS
    /// parameters to be applied on the connections originated from the local
    /// endpoint and terminated by the L7 proxy. For ingress policy this specifies
    /// the server-side TLS parameters to be applied on the connections
    /// originated from a remote source and terminated by the L7 proxy.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "terminatingTLS"
    )]
    pub terminating_tls: Option<CiliumNetworkPolicysIngressToPortsTerminatingTls>,
}

/// listener specifies the name of a custom Envoy listener to which this traffic should be
/// redirected to.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsListener {
    /// EnvoyConfig is a reference to the CEC or CCEC resource in which
    /// the listener is defined.
    #[serde(rename = "envoyConfig")]
    pub envoy_config: CiliumNetworkPolicysIngressToPortsListenerEnvoyConfig,
    /// Name is the name of the listener.
    pub name: String,
    /// Priority for this Listener that is used when multiple rules would apply different
    /// listeners to a policy map entry. Behavior of this is implementation dependent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub priority: Option<i64>,
}

/// EnvoyConfig is a reference to the CEC or CCEC resource in which
/// the listener is defined.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsListenerEnvoyConfig {
    /// Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
    /// CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
    /// respectively. The only case this is currently explicitly needed is when referring to a
    /// CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
    /// from a cluster scoped policy is not allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kind: Option<CiliumNetworkPolicysIngressToPortsListenerEnvoyConfigKind>,
    /// Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
    /// the listener is defined in.
    pub name: String,
}

/// EnvoyConfig is a reference to the CEC or CCEC resource in which
/// the listener is defined.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressToPortsListenerEnvoyConfigKind {
    CiliumEnvoyConfig,
    CiliumClusterwideEnvoyConfig,
}

/// OriginatingTLS is the TLS context for the connections originated by
/// the L7 proxy.  For egress policy this specifies the client-side TLS
/// parameters for the upstream connection originating from the L7 proxy
/// to the remote destination. For ingress policy this specifies the
/// client-side TLS parameters for the connection from the L7 proxy to
/// the local endpoint.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsOriginatingTls {
    /// Certificate is the file name or k8s secret item name for the certificate
    /// chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
    /// item must exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<String>,
    /// PrivateKey is the file name or k8s secret item name for the private key
    /// matching the certificate chain. If omitted, 'tls.key' is assumed, if it
    /// exists. If given, the item must exist.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "privateKey"
    )]
    pub private_key: Option<String>,
    /// Secret is the secret that contains the certificates and private key for
    /// the TLS context.
    /// By default, Cilium will search in this secret for the following items:
    ///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
    ///  - 'tls.crt' - Which represents the public key certificate.
    ///  - 'tls.key' - Which represents the private key matching the public key
    ///                certificate.
    pub secret: CiliumNetworkPolicysIngressToPortsOriginatingTlsSecret,
    /// TrustedCA is the file name or k8s secret item name for the trusted CA.
    /// If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
    /// exist.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCA")]
    pub trusted_ca: Option<String>,
}

/// Secret is the secret that contains the certificates and private key for
/// the TLS context.
/// By default, Cilium will search in this secret for the following items:
///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
///  - 'tls.crt' - Which represents the public key certificate.
///  - 'tls.key' - Which represents the private key matching the public key
///                certificate.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsOriginatingTlsSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsPorts {
    /// EndPort can only be an L4 port number.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "endPort")]
    pub end_port: Option<i32>,
    /// Port can be an L4 port number, or a name in the form of "http"
    /// or "http-8080".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<String>,
    /// Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
    /// with transport ports (TCP, UDP, SCTP) match.
    ///
    /// Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "ANY"
    ///
    /// Matching on ICMP is not supported.
    ///
    /// Named port specified for a container may narrow this down, but may not
    /// contradict this.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub protocol: Option<CiliumNetworkPolicysIngressToPortsPortsProtocol>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressToPortsPortsProtocol {
    #[serde(rename = "TCP")]
    Tcp,
    #[serde(rename = "UDP")]
    Udp,
    #[serde(rename = "SCTP")]
    Sctp,
    #[serde(rename = "VRRP")]
    Vrrp,
    #[serde(rename = "IGMP")]
    Igmp,
    #[serde(rename = "ANY")]
    Any,
}

/// Rules is a list of additional port level rules which must be met in
/// order for the PortRule to allow the traffic. If omitted or empty,
/// no layer 7 rules are enforced.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsRules {
    /// DNS-specific rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub dns: Option<Vec<CiliumNetworkPolicysIngressToPortsRulesDns>>,
    /// HTTP specific rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub http: Option<Vec<CiliumNetworkPolicysIngressToPortsRulesHttp>>,
    /// Kafka-specific rules.
    /// Deprecated: This beta feature is deprecated and will be removed in a future release.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kafka: Option<Vec<CiliumNetworkPolicysIngressToPortsRulesKafka>>,
    /// Key-value pair rules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub l7: Option<Vec<BTreeMap<String, String>>>,
    /// Name of the L7 protocol for which the Key-value pair rules apply.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub l7proto: Option<String>,
}

/// PortRuleDNS is a list of allowed DNS lookups.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsRulesDns {
    /// MatchName matches literal DNS names. A trailing "." is automatically added
    /// when missing.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchName")]
    pub match_name: Option<String>,
    /// MatchPattern allows using wildcards to match DNS names. All wildcards are
    /// case insensitive. The wildcards are:
    /// - "*" matches 0 or more DNS valid characters, and may occur anywhere in
    /// the pattern. As a special case a "*" as the leftmost character, without a
    /// following "." matches all subdomains as well as the name to the right.
    /// A trailing "." is automatically added when missing.
    /// - "**." is a special prefix which matches all multilevel subdomains in the prefix.
    ///
    /// Examples:
    /// 1. `*.cilium.io` matches subdomains of cilium at that level
    ///   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
    /// 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
    ///   except those containing "." separator, subcilium.io and sub-cilium.io match,
    ///   www.cilium.io and blog.cilium.io does not
    /// 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
    ///   begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
    ///   blog.cilium.io, cilium.io and google.com do not
    /// 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
    ///   "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchPattern"
    )]
    pub match_pattern: Option<String>,
}

/// PortRuleHTTP is a list of HTTP protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule does not have any
/// effect.
///
/// All fields of this type are extended POSIX regex as defined by IEEE Std
/// 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
/// matched against the path of an incoming request. Currently it can contain
/// characters disallowed from the conventional "path" part of a URL as defined
/// by RFC 3986.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsRulesHttp {
    /// HeaderMatches is a list of HTTP headers which must be
    /// present and match against the given values. Mismatch field can be used
    /// to specify what to do when there is no match.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "headerMatches"
    )]
    pub header_matches: Option<Vec<CiliumNetworkPolicysIngressToPortsRulesHttpHeaderMatches>>,
    /// Headers is a list of HTTP headers which must be present in the
    /// request. If omitted or empty, requests are allowed regardless of
    /// headers present.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub headers: Option<Vec<String>>,
    /// Host is an extended POSIX regex matched against the host header of a
    /// request. Examples:
    ///
    /// - foo.bar.com will match the host fooXbar.com or foo-bar.com
    /// - foo\.bar\.com will only match the host foo.bar.com
    ///
    /// If omitted or empty, the value of the host header is ignored.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub host: Option<String>,
    /// Method is an extended POSIX regex matched against the method of a
    /// request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
    ///
    /// If omitted or empty, all methods are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub method: Option<String>,
    /// Path is an extended POSIX regex matched against the path of a
    /// request. Currently it can contain characters disallowed from the
    /// conventional "path" part of a URL as defined by RFC 3986.
    ///
    /// If omitted or empty, all paths are all allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
}

/// HeaderMatch extends the HeaderValue for matching requirement of a
/// named header field against an immediate string or a secret value.
/// If none of the optional fields is present, then the
/// header value is not matched, only presence of the header is enough.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsRulesHttpHeaderMatches {
    /// Mismatch identifies what to do in case there is no match. The default is
    /// to drop the request. Otherwise the overall rule is still considered as
    /// matching, but the mismatches are logged in the access log.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub mismatch: Option<CiliumNetworkPolicysIngressToPortsRulesHttpHeaderMatchesMismatch>,
    /// Name identifies the header.
    pub name: String,
    /// Secret refers to a secret that contains the value to be matched against.
    /// The secret must only contain one entry. If the referred secret does not
    /// exist, and there is no "Value" specified, the match will fail.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secret: Option<CiliumNetworkPolicysIngressToPortsRulesHttpHeaderMatchesSecret>,
    /// Value matches the exact value of the header. Can be specified either
    /// alone or together with "Secret"; will be used as the header value if the
    /// secret can not be found in the latter case.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// HeaderMatch extends the HeaderValue for matching requirement of a
/// named header field against an immediate string or a secret value.
/// If none of the optional fields is present, then the
/// header value is not matched, only presence of the header is enough.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressToPortsRulesHttpHeaderMatchesMismatch {
    #[serde(rename = "LOG")]
    Log,
    #[serde(rename = "ADD")]
    Add,
    #[serde(rename = "DELETE")]
    Delete,
    #[serde(rename = "REPLACE")]
    Replace,
}

/// Secret refers to a secret that contains the value to be matched against.
/// The secret must only contain one entry. If the referred secret does not
/// exist, and there is no "Value" specified, the match will fail.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsRulesHttpHeaderMatchesSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PortRule is a list of Kafka protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule will match all
/// Kafka messages.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsRulesKafka {
    /// APIKey is a case-insensitive string matched against the key of a
    /// request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al
    /// Reference: <https://kafka.apache.org/protocol#protocol_api_keys>
    ///
    /// If omitted or empty, and if Role is not specified, then all keys are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiKey")]
    pub api_key: Option<String>,
    /// APIVersion is the version matched against the api version of the
    /// Kafka message. If set, it has to be a string representing a positive
    /// integer.
    ///
    /// If omitted or empty, all versions are allowed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "apiVersion"
    )]
    pub api_version: Option<String>,
    /// ClientID is the client identifier as provided in the request.
    ///
    /// From Kafka protocol documentation:
    /// This is a user supplied identifier for the client application. The
    /// user can use any identifier they like and it will be used when
    /// logging errors, monitoring aggregates, etc. For example, one might
    /// want to monitor not just the requests per second overall, but the
    /// number coming from each client application (each of which could
    /// reside on multiple servers). This id acts as a logical grouping
    /// across all requests from a particular client.
    ///
    /// If omitted or empty, all client identifiers are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientID")]
    pub client_id: Option<String>,
    /// Role is a case-insensitive string and describes a group of API keys
    /// necessary to perform certain higher-level Kafka operations such as "produce"
    /// or "consume". A Role automatically expands into all APIKeys required
    /// to perform the specified higher-level operation.
    ///
    /// The following values are supported:
    ///  - "produce": Allow producing to the topics specified in the rule
    ///  - "consume": Allow consuming from the topics specified in the rule
    ///
    /// This field is incompatible with the APIKey field, i.e APIKey and Role
    /// cannot both be specified in the same rule.
    ///
    /// If omitted or empty, and if APIKey is not specified, then all keys are
    /// allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<CiliumNetworkPolicysIngressToPortsRulesKafkaRole>,
    /// Topic is the topic name contained in the message. If a Kafka request
    /// contains multiple topics, then all topics must be allowed or the
    /// message will be rejected.
    ///
    /// This constraint is ignored if the matched request message type
    /// doesn't contain any topic. Maximum size of Topic can be 249
    /// characters as per recent Kafka spec and allowed characters are
    /// a-z, A-Z, 0-9, -, . and _.
    ///
    /// Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10
    /// version the length was changed from 255 to 249. For compatibility
    /// reasons we are using 255.
    ///
    /// If omitted or empty, all topics are allowed.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub topic: Option<String>,
}

/// PortRule is a list of Kafka protocol constraints. All fields are
/// optional, if all fields are empty or missing, the rule will match all
/// Kafka messages.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressToPortsRulesKafkaRole {
    #[serde(rename = "produce")]
    Produce,
    #[serde(rename = "consume")]
    Consume,
}

/// TerminatingTLS is the TLS context for the connection terminated by
/// the L7 proxy.  For egress policy this specifies the server-side TLS
/// parameters to be applied on the connections originated from the local
/// endpoint and terminated by the L7 proxy. For ingress policy this specifies
/// the server-side TLS parameters to be applied on the connections
/// originated from a remote source and terminated by the L7 proxy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsTerminatingTls {
    /// Certificate is the file name or k8s secret item name for the certificate
    /// chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
    /// item must exist.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<String>,
    /// PrivateKey is the file name or k8s secret item name for the private key
    /// matching the certificate chain. If omitted, 'tls.key' is assumed, if it
    /// exists. If given, the item must exist.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "privateKey"
    )]
    pub private_key: Option<String>,
    /// Secret is the secret that contains the certificates and private key for
    /// the TLS context.
    /// By default, Cilium will search in this secret for the following items:
    ///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
    ///  - 'tls.crt' - Which represents the public key certificate.
    ///  - 'tls.key' - Which represents the private key matching the public key
    ///                certificate.
    pub secret: CiliumNetworkPolicysIngressToPortsTerminatingTlsSecret,
    /// TrustedCA is the file name or k8s secret item name for the trusted CA.
    /// If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
    /// exist.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "trustedCA")]
    pub trusted_ca: Option<String>,
}

/// Secret is the secret that contains the certificates and private key for
/// the TLS context.
/// By default, Cilium will search in this secret for the following items:
///  - 'ca.crt'  - Which represents the trusted CA to verify remote source.
///  - 'tls.crt' - Which represents the public key certificate.
///  - 'tls.key' - Which represents the private key matching the public key
///                certificate.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressToPortsTerminatingTlsSecret {
    /// Name is the name of the secret.
    pub name: String,
    /// Namespace is the namespace in which the secret exists. Context of use
    /// determines the default value if left out (e.g., "default").
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// IngressDenyRule contains all rule types which can be applied at ingress,
/// i.e. network traffic that originates outside of the endpoint and
/// is entering the endpoint selected by the endpointSelector.
///
///   - All members of this structure are optional. If omitted or empty, the
///     member will have no effect on the rule.
///
///   - If multiple members are set, all of them need to match in order for
///     the rule to take effect.
///
///   - FromEndpoints, FromCIDR, FromCIDRSet, FromGroups and FromEntities are mutually
///     exclusive. Only one of these members may be present within an individual
///     rule.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDeny {
    /// FromCIDR is a list of IP blocks which the endpoint subject to the
    /// rule is allowed to receive connections from. Only connections which
    /// do *not* originate from the cluster or from the local host are subject
    /// to CIDR rules. In order to allow in-cluster connectivity, use the
    /// FromEndpoints field.  This will match on the source IP address of
    /// incoming connections. Adding  a prefix into FromCIDR or into
    /// FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
    /// allowed between FromCIDR and FromCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
    /// connections from 10.3.9.1
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromCIDR")]
    pub from_cidr: Option<Vec<String>>,
    /// FromCIDRSet is a list of IP blocks which the endpoint subject to the
    /// rule is allowed to receive connections from in addition to FromEndpoints,
    /// along with a list of subnets contained within their corresponding IP block
    /// from which traffic should not be allowed.
    /// This will match on the source IP address of incoming connections. Adding
    /// a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
    /// equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
    ///
    /// Example:
    /// Any endpoint with the label "app=my-legacy-pet" is allowed to receive
    /// connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromCIDRSet"
    )]
    pub from_cidr_set: Option<Vec<CiliumNetworkPolicysIngressDenyFromCidrSet>>,
    /// FromEndpoints is a list of endpoints identified by an
    /// EndpointSelector which are allowed to communicate with the endpoint
    /// subject to the rule.
    ///
    /// Example:
    /// Any endpoint with the label "role=backend" can be consumed by any
    /// endpoint carrying the label "role=frontend".
    ///
    /// Note that while an empty non-nil FromEndpoints does not select anything,
    /// nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
    /// are also specified.
    /// To select everything, use one EndpointSelector without any match requirements.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromEndpoints"
    )]
    pub from_endpoints: Option<Vec<CiliumNetworkPolicysIngressDenyFromEndpoints>>,
    /// FromEntities is a list of special entities which the endpoint subject
    /// to the rule is allowed to receive connections from. Supported entities are
    /// `world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
    /// `health`, `unmanaged`, `none` and `all`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromEntities"
    )]
    pub from_entities: Option<Vec<String>>,
    /// FromGroups is a directive that allows the integration with multiple outside
    /// providers. Currently, only AWS is supported, and the rule can select by
    /// multiple sub directives:
    ///
    /// Example:
    /// FromGroups:
    /// - aws:
    ///     securityGroupsIds:
    ///     - 'sg-XXXXXXXXXXXXX'
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromGroups"
    )]
    pub from_groups: Option<Vec<CiliumNetworkPolicysIngressDenyFromGroups>>,
    /// FromNodes is a list of nodes identified by an
    /// EndpointSelector which are allowed to communicate with the endpoint
    /// subject to the rule.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "fromNodes")]
    pub from_nodes: Option<Vec<CiliumNetworkPolicysIngressDenyFromNodes>>,
    /// Deprecated.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "fromRequires"
    )]
    pub from_requires: Option<Vec<String>>,
    /// ICMPs is a list of ICMP rule identified by type number
    /// which the endpoint subject to the rule is not allowed to
    /// receive connections on.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" can not accept incoming
    /// type 8 ICMP connections.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub icmps: Option<Vec<CiliumNetworkPolicysIngressDenyIcmps>>,
    /// ToPorts is a list of destination ports identified by port number and
    /// protocol which the endpoint subject to the rule is not allowed to
    /// receive connections on.
    ///
    /// Example:
    /// Any endpoint with the label "app=httpd" can not accept incoming
    /// connections on port 80/tcp.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "toPorts")]
    pub to_ports: Option<Vec<CiliumNetworkPolicysIngressDenyToPorts>>,
}

/// CIDRRule is a rule that specifies a CIDR prefix to/from which outside
/// communication  is allowed, along with an optional list of subnets within that
/// CIDR prefix to/from which outside communication is not allowed.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromCidrSet {
    /// CIDR is a CIDR prefix / IP Block.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cidr: Option<String>,
    /// CIDRGroupRef is a reference to a CiliumCIDRGroup object.
    /// A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
    /// the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
    /// connections from.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupRef"
    )]
    pub cidr_group_ref: Option<String>,
    /// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
    /// rather than by name.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "cidrGroupSelector"
    )]
    pub cidr_group_selector: Option<CiliumNetworkPolicysIngressDenyFromCidrSetCidrGroupSelector>,
    /// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
    /// is not allowed to initiate connections to. These CIDR prefixes should be
    /// contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
    /// supported yet.
    /// These exceptions are only applied to the Cidr in this CIDRRule, and do not
    /// apply to any other CIDR prefixes in any other CIDRRules.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub except: Option<Vec<String>>,
}

/// CIDRGroupSelector selects CiliumCIDRGroups by their labels,
/// rather than by name.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromCidrSetCidrGroupSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicysIngressDenyFromCidrSetCidrGroupSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromCidrSetCidrGroupSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator:
        CiliumNetworkPolicysIngressDenyFromCidrSetCidrGroupSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressDenyFromCidrSetCidrGroupSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromEndpoints {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions:
        Option<Vec<CiliumNetworkPolicysIngressDenyFromEndpointsMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromEndpointsMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysIngressDenyFromEndpointsMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressDenyFromEndpointsMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// Groups structure to store all kinds of new integrations that needs a new
/// derivative policy.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromGroups {
    /// AWSGroup is an structure that can be used to whitelisting information from AWS integration
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<CiliumNetworkPolicysIngressDenyFromGroupsAws>,
}

/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromGroupsAws {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub labels: Option<BTreeMap<String, String>>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsIds"
    )]
    pub security_groups_ids: Option<Vec<String>>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "securityGroupsNames"
    )]
    pub security_groups_names: Option<Vec<String>>,
}

/// EndpointSelector is a wrapper for k8s LabelSelector.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromNodes {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysIngressDenyFromNodesMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyFromNodesMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysIngressDenyFromNodesMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressDenyFromNodesMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// ICMPRule is a list of ICMP fields.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyIcmps {
    /// Fields is a list of ICMP fields.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fields: Option<Vec<CiliumNetworkPolicysIngressDenyIcmpsFields>>,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyIcmpsFields {
    /// Family is a IP address version.
    /// Currently, we support `IPv4` and `IPv6`.
    /// `IPv4` is set as default.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub family: Option<CiliumNetworkPolicysIngressDenyIcmpsFieldsFamily>,
    /// Type is a ICMP-type.
    /// It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
    /// Allowed ICMP types are:
    ///     Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
    /// 		     RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
    /// 			 Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
    ///     Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
    /// 			 EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
    /// 			 MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
    /// 			 NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
    /// 			 ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
    /// 			 HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
    /// 			 MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
    /// 			 ExtendedEchoRequest | ExtendedEchoReply
    #[serde(rename = "type")]
    pub r#type: IntOrString,
}

/// ICMPField is a ICMP field.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressDenyIcmpsFieldsFamily {
    IPv4,
    IPv6,
}

/// PortDenyRule is a list of ports/protocol that should be used for deny
/// policies. This structure lacks the L7Rules since it's not supported in deny
/// policies.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyToPorts {
    /// Ports is a list of L4 port/protocol
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<CiliumNetworkPolicysIngressDenyToPortsPorts>>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysIngressDenyToPortsPorts {
    /// EndPort can only be an L4 port number.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "endPort")]
    pub end_port: Option<i32>,
    /// Port can be an L4 port number, or a name in the form of "http"
    /// or "http-8080".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub port: Option<String>,
    /// Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
    /// with transport ports (TCP, UDP, SCTP) match.
    ///
    /// Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "ANY"
    ///
    /// Matching on ICMP is not supported.
    ///
    /// Named port specified for a container may narrow this down, but may not
    /// contradict this.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub protocol: Option<CiliumNetworkPolicysIngressDenyToPortsPortsProtocol>,
}

/// PortProtocol specifies an L4 port with an optional transport protocol
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysIngressDenyToPortsPortsProtocol {
    #[serde(rename = "TCP")]
    Tcp,
    #[serde(rename = "UDP")]
    Udp,
    #[serde(rename = "SCTP")]
    Sctp,
    #[serde(rename = "VRRP")]
    Vrrp,
    #[serde(rename = "IGMP")]
    Igmp,
    #[serde(rename = "ANY")]
    Any,
}

/// Label is the Cilium's representation of a container label.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysLabels {
    pub key: String,
    /// Source can be one of the above values (e.g.: LabelSourceContainer).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub source: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// Log specifies custom policy-specific Hubble logging configuration.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysLog {
    /// Value is a free-form string that is included in Hubble flows
    /// that match this policy. The string is limited to 32 printable characters.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// NodeSelector selects all nodes which should be subject to this rule.
/// EndpointSelector and NodeSelector cannot be both empty and are mutually
/// exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysNodeSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchExpressions"
    )]
    pub match_expressions: Option<Vec<CiliumNetworkPolicysNodeSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "matchLabels"
    )]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicysNodeSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: CiliumNetworkPolicysNodeSelectorMatchExpressionsOperator,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum CiliumNetworkPolicysNodeSelectorMatchExpressionsOperator {
    In,
    NotIn,
    Exists,
    DoesNotExist,
}

/// Status is the status of the Cilium policy rule
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyStatus {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
    /// DerivativePolicies is the status of all policies derived from the Cilium
    /// policy
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "derivativePolicies"
    )]
    pub derivative_policies: Option<BTreeMap<String, CiliumNetworkPolicyStatusDerivativePolicies>>,
}

/// DerivativePolicies is the status of all policies derived from the Cilium
/// policy
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct CiliumNetworkPolicyStatusDerivativePolicies {
    /// Annotations corresponds to the Annotations in the ObjectMeta of the CNP
    /// that have been realized on the node for CNP. That is, if a CNP has been
    /// imported and has been assigned annotation X=Y by the user,
    /// Annotations in CiliumNetworkPolicyNodeStatus will be X=Y once the
    /// CNP that was imported corresponding to Annotation X=Y has been realized on
    /// the node.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub annotations: Option<BTreeMap<String, String>>,
    /// Enforcing is set to true once all endpoints present at the time the
    /// policy has been imported are enforcing this policy.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub enforcing: Option<bool>,
    /// Error describes any error that occurred when parsing or importing the
    /// policy, or realizing the policy for the endpoints to which it applies
    /// on the node.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub error: Option<String>,
    /// LastUpdated contains the last time this status was updated
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "lastUpdated"
    )]
    pub last_updated: Option<String>,
    /// Revision is the policy revision of the repository which first implemented
    /// this policy.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "localPolicyRevision"
    )]
    pub local_policy_revision: Option<i64>,
    /// OK is true when the policy has been parsed and imported successfully
    /// into the in-memory policy repository on the node.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ok: Option<bool>,
}
