// Copyright (c) 2026 Tigera, Inc. All rights reserved.

// Code generated by applyconfiguration-gen. DO NOT EDIT.

package v3

import (
	numorstring "github.com/projectcalico/api/pkg/lib/numorstring"
)

// EntityRuleApplyConfiguration represents a declarative configuration of the EntityRule type for use
// with apply.
//
// An EntityRule is a sub-component of a Rule comprising the match criteria specific
// to a particular entity (that is either the source or destination).
//
// A source EntityRule matches the source endpoint and originating traffic.
// A destination EntityRule matches the destination endpoint and terminating traffic.
type EntityRuleApplyConfiguration struct {
	// Nets is an optional field that restricts the rule to only apply to traffic that
	// originates from (or terminates at) IP addresses in any of the given subnets.
	Nets []string `json:"nets,omitempty"`
	// Selector is an optional field that contains a selector expression (see Policy for
	// sample syntax).  Only traffic that originates from (terminates at) endpoints matching
	// the selector will be matched.
	//
	// Note that: in addition to the negated version of the Selector (see NotSelector below), the
	// selector expression syntax itself supports negation.  The two types of negation are subtly
	// different. One negates the set of matched endpoints, the other negates the whole match:
	//
	// Selector = "!has(my_label)" matches packets that are from other Calico-controlled
	// endpoints that do not have the label "my_label".
	//
	// NotSelector = "has(my_label)" matches packets that are not from Calico-controlled
	// endpoints that do have the label "my_label".
	//
	// The effect is that the latter will accept packets from non-Calico sources whereas the
	// former is limited to packets from Calico-controlled endpoints.
	Selector *string `json:"selector,omitempty"`
	// NamespaceSelector is an optional field that contains a selector expression. Only traffic
	// that originates from (or terminates at) endpoints within the selected namespaces will be
	// matched. When both NamespaceSelector and another selector are defined on the same rule, then only
	// workload endpoints that are matched by both selectors will be selected by the rule.
	//
	// For NetworkPolicy, an empty NamespaceSelector implies that the Selector is limited to selecting
	// only workload endpoints in the same namespace as the NetworkPolicy.
	//
	// For NetworkPolicy, `global()` NamespaceSelector implies that the Selector is limited to selecting
	// only GlobalNetworkSet or HostEndpoint.
	//
	// For GlobalNetworkPolicy, an empty NamespaceSelector implies the Selector applies to workload
	// endpoints across all namespaces.
	NamespaceSelector *string `json:"namespaceSelector,omitempty"`
	// Services is an optional field that contains options for matching Kubernetes Services.
	// If specified, only traffic that originates from or terminates at endpoints within the selected
	// service(s) will be matched, and only to/from each endpoint's port.
	//
	// Services cannot be specified on the same rule as Selector, NotSelector, NamespaceSelector, Nets,
	// NotNets or ServiceAccounts.
	//
	// Ports and NotPorts can only be specified with Services on ingress rules.
	Services *ServiceMatchApplyConfiguration `json:"services,omitempty"`
	// Ports is an optional field that restricts the rule to only apply to traffic that has a
	// source (destination) port that matches one of these ranges/values. This value is a
	// list of integers or strings that represent ranges of ports.
	//
	// Since only some protocols have ports, if any ports are specified it requires the
	// Protocol match in the Rule to be set to "TCP" or "UDP".
	Ports []numorstring.Port `json:"ports,omitempty"`
	// NotNets is the negated version of the Nets field.
	// listType=set
	NotNets []string `json:"notNets,omitempty"`
	// NotSelector is the negated version of the Selector field.  See Selector field for
	// subtleties with negated selectors.
	NotSelector *string `json:"notSelector,omitempty"`
	// NotPorts is the negated version of the Ports field.
	// Since only some protocols have ports, if any ports are specified it requires the
	// Protocol match in the Rule to be set to "TCP" or "UDP".
	NotPorts []numorstring.Port `json:"notPorts,omitempty"`
	// ServiceAccounts is an optional field that restricts the rule to only apply to traffic that originates from (or
	// terminates at) a pod running as a matching service account.
	ServiceAccounts *ServiceAccountMatchApplyConfiguration `json:"serviceAccounts,omitempty"`
}

// EntityRuleApplyConfiguration constructs a declarative configuration of the EntityRule type for use with
// apply.
func EntityRule() *EntityRuleApplyConfiguration {
	return &EntityRuleApplyConfiguration{}
}

// WithNets adds the given value to the Nets field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the Nets field.
func (b *EntityRuleApplyConfiguration) WithNets(values ...string) *EntityRuleApplyConfiguration {
	for i := range values {
		b.Nets = append(b.Nets, values[i])
	}
	return b
}

// WithSelector sets the Selector field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Selector field is set to the value of the last call.
func (b *EntityRuleApplyConfiguration) WithSelector(value string) *EntityRuleApplyConfiguration {
	b.Selector = &value
	return b
}

// WithNamespaceSelector sets the NamespaceSelector field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the NamespaceSelector field is set to the value of the last call.
func (b *EntityRuleApplyConfiguration) WithNamespaceSelector(value string) *EntityRuleApplyConfiguration {
	b.NamespaceSelector = &value
	return b
}

// WithServices sets the Services field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Services field is set to the value of the last call.
func (b *EntityRuleApplyConfiguration) WithServices(value *ServiceMatchApplyConfiguration) *EntityRuleApplyConfiguration {
	b.Services = value
	return b
}

// WithPorts adds the given value to the Ports field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the Ports field.
func (b *EntityRuleApplyConfiguration) WithPorts(values ...numorstring.Port) *EntityRuleApplyConfiguration {
	for i := range values {
		b.Ports = append(b.Ports, values[i])
	}
	return b
}

// WithNotNets adds the given value to the NotNets field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the NotNets field.
func (b *EntityRuleApplyConfiguration) WithNotNets(values ...string) *EntityRuleApplyConfiguration {
	for i := range values {
		b.NotNets = append(b.NotNets, values[i])
	}
	return b
}

// WithNotSelector sets the NotSelector field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the NotSelector field is set to the value of the last call.
func (b *EntityRuleApplyConfiguration) WithNotSelector(value string) *EntityRuleApplyConfiguration {
	b.NotSelector = &value
	return b
}

// WithNotPorts adds the given value to the NotPorts field in the declarative configuration
// and returns the receiver, so that objects can be build by chaining "With" function invocations.
// If called multiple times, values provided by each call will be appended to the NotPorts field.
func (b *EntityRuleApplyConfiguration) WithNotPorts(values ...numorstring.Port) *EntityRuleApplyConfiguration {
	for i := range values {
		b.NotPorts = append(b.NotPorts, values[i])
	}
	return b
}

// WithServiceAccounts sets the ServiceAccounts field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the ServiceAccounts field is set to the value of the last call.
func (b *EntityRuleApplyConfiguration) WithServiceAccounts(value *ServiceAccountMatchApplyConfiguration) *EntityRuleApplyConfiguration {
	b.ServiceAccounts = value
	return b
}
