@intentius/chant-lexicon-cpln 0.53.0

package/src/generated/index.d.ts

@@ -0,0 +1,1649 @@
+// Code generated by chant cpln generate. DO NOT EDIT.
+
+// --- Control Plane resource classes ---
+
+export declare class Domain {
+  constructor(props: {
+    name: string;
+    description?: string;
+    spec?: DomainSpec;
+    tags?: Record<string, string>;
+  });
+  readonly created: string;
+  readonly id: string;
+  readonly lastModified: string;
+  readonly links: Record<string, unknown>[];
+  readonly status: Record<string, unknown>;
+  readonly version: number;
+}
+
+export declare class Gvc {
+  constructor(props: {
+    name: string;
+    description?: string;
+    spec?: GvcSpec;
+    tags?: Record<string, string>;
+  });
+  readonly alias: string;
+  readonly created: string;
+  readonly id: string;
+  readonly lastModified: string;
+  readonly links: Record<string, unknown>[];
+  readonly status: Record<string, unknown>;
+  readonly version: number;
+}
+
+export declare class Identity {
+  constructor(props: {
+    /** Name of the GVC this resource belongs to. */
+    gvc: string;
+    name: string;
+    aws?: IdentityAws;
+    azure?: IdentityAzure;
+    description?: string;
+    gcp?: IdentityGcp;
+    memcacheAccess?: IdentityMemcacheAccess[];
+    nativeNetworkResources?: IdentityNativeNetworkResources[];
+    networkResources?: NetworkResource[];
+    ngs?: IdentityNgs;
+    spicedbAccess?: IdentitySpicedbAccess[];
+    tags?: Record<string, string>;
+  });
+  readonly created: string;
+  readonly id: string;
+  readonly lastModified: string;
+  readonly links: Record<string, unknown>[];
+  readonly status: Record<string, unknown>;
+  readonly version: number;
+}
+
+export declare class IpSet {
+  constructor(props: {
+    name: string;
+    description?: string;
+    spec?: IpSetSpec;
+    tags?: Record<string, string>;
+  });
+  readonly created: string;
+  readonly id: string;
+  readonly lastModified: string;
+  readonly links: Record<string, unknown>[];
+  readonly status: Record<string, unknown>;
+  readonly version: number;
+}
+
+export declare class Policy {
+  constructor(props: {
+    name: string;
+    targetKind: "accessreport" | "agent" | "auditctx" | "cloudaccount" | "command" | "dbcluster" | "deployment" | "domain" | "event" | "group" | "gvc" | "identity" | "image" | "imagesummary" | "ipset" | "location" | "memcachecluster" | "mk8s" | "org" | "permissions" | "policy" | "policymembership" | "quota" | "resource" | "resourcepolicy" | "secret" | "serviceaccount" | "spicedbcluster" | "task" | "tenant" | "user" | "volumeset" | "workload";
+    bindings?: PolicyBinding[];
+    description?: string;
+    origin?: "builtin" | "default";
+    tags?: Record<string, string>;
+    target?: "all";
+    targetLinks?: string[];
+    targetQuery?: Query;
+  });
+  readonly created: string;
+  readonly id: string;
+  readonly lastModified: string;
+  readonly links: Record<string, unknown>[];
+  readonly version: number;
+}
+
+export declare class Secret {
+  constructor(props: {
+    name: string;
+    type: "aws" | "azure-connector" | "azure-sdk" | "dictionary" | "docker" | "ecr" | "gcp" | "keypair" | "nats-account" | "opaque" | "tls" | "userpass";
+    data?: SecretOpaque | SecretTls | string | SecretAwskey | Record<string, unknown> | SecretUserpass | SecretKeypair;
+    description?: string;
+    tags?: Record<string, string>;
+  });
+  readonly created: string;
+  readonly id: string;
+  readonly lastModified: string;
+  readonly links: Record<string, unknown>[];
+  readonly version: number;
+}
+
+export declare class VolumeSet {
+  constructor(props: {
+    /** Name of the GVC this resource belongs to. */
+    gvc: string;
+    name: string;
+    description?: string;
+    spec?: VolumeSetSpec;
+    tags?: Record<string, string>;
+  });
+  readonly created: string;
+  readonly id: string;
+  readonly lastModified: string;
+  readonly links: Record<string, unknown>[];
+  readonly status: Record<string, unknown>;
+  readonly version: number;
+}
+
+export declare class Workload {
+  constructor(props: {
+    /** Name of the GVC this resource belongs to. */
+    gvc: string;
+    /** Name of the workload (max 49 characters) */
+    name: string;
+    description?: string;
+    /** Workload specification */
+    spec?: WorkloadSpec;
+    tags?: Record<string, string>;
+  });
+  readonly created: string;
+  readonly health: Record<string, unknown>;
+  readonly id: string;
+  readonly lastModified: string;
+  readonly links: Record<string, unknown>[];
+  readonly status: Record<string, unknown>;
+  readonly version: number;
+}
+
+// --- Property type classes ---
+
+export declare class DomainSpec {
+  constructor(props: {
+    acceptAllHosts?: boolean;
+    acceptAllSubdomains?: boolean;
+    certChallengeType?: "dns01" | "http01";
+    /** In 'cname' dnsMode, Control Plane will configure workloads to accept traffic for the domain but will not manage DNS records for the domain.
+      End users configure CNAME records in their own DNS pointed to the canonical workload endpoint.
+      Currently 'cname' dnsMode requires that a tls.serverCertificate is configured when subdomain based routing is used.
+      In 'ns' dnsMode, Control Plane will manage the subdomains and create all necessary DNS records.
+      End users configure an NS record to forward DNS requests to the Control Plane managed DNS servers. */
+    dnsMode?: "cname" | "ns";
+    /** One of gvcLink and routes may be provided. When gvcLink is configured each workload in the GVC will receive a subdomain in the form ${workload.name}.${domain.name} */
+    gvcLink?: string;
+    ports?: DomainSpecPorts[];
+    workloadLink?: string;
+  });
+}
+
+export declare class DomainSpecPorts {
+  constructor(props: {
+    cors?: DomainSpecPortsCors;
+    number?: number;
+    protocol?: "http" | "http2" | "tcp";
+    /** A list of mappings to workloads. */
+    routes?: DomainSpecPortsRoutes[];
+    /** Used for TLS connections for this Domain. End users are responsible for certificate updates. */
+    tls?: DomainSpecPortsTls;
+  });
+}
+
+export declare class DomainSpecPortsCors {
+  constructor(props: {
+    allowCredentials?: boolean;
+    allowHeaders?: string[];
+    allowMethods?: string[];
+    allowOrigins?: DomainSpecPortsCorsAllowOrigins[];
+    exposeHeaders?: string[];
+    maxAge?: string;
+  });
+}
+
+export declare class DomainSpecPortsCorsAllowOrigins {
+  constructor(props: {
+    exact?: string;
+    regex?: string;
+  });
+}
+
+export declare class DomainSpecPortsRoutes {
+  constructor(props: {
+    /** Split traffic for this route across one or more additional workloads by weight. */
+    canaries?: DomainSpecPortsRoutesCanaries[];
+    /** Modify the headers for all http requests for this route. */
+    headers?: DomainSpecPortsRoutesHeaders;
+    /** This option allows forwarding traffic for different host headers to different workloads.
+This will only be used when the target GVC has dedicated load balancing enabled and the Domain is configure for wildcard support.
+Contact your account manager for details. */
+    hostPrefix?: string;
+    /** A regex to match the host header. 
+This will only be used when the target GVC has dedicated load balancing enabled and the Domain is configure for wildcard support. 
+Contact your account manager for details. */
+    hostRegex?: string;
+    mirror?: DomainSpecPortsRoutesMirror[];
+    port?: number;
+    prefix?: string;
+    /** Used to match URI paths.
+One of prefix OR regex may be provided.
+Uses the google re2 regex syntax */
+    regex?: string;
+    /** When provided, the URI prefix will be replaced with this string before the request is sent to the workload. */
+    replacePrefix?: string;
+    /** The replica number of a stateful workload to route to. If not provided, traffic will be routed to all replicas. */
+    replica?: number;
+    workloadLink?: string;
+  });
+}
+
+export declare class DomainSpecPortsRoutesCanaries {
+  constructor(props: {
+    /** The port to send canary traffic to. If not provided, the first configured port on the workload is used. */
+    port?: number;
+    /** The percentage of traffic to send to this canary workload. A weight of 0 disables the canary so it can be toggled on and off without removing it. */
+    weight?: number;
+    /** The canary workload to route a weighted percentage of traffic to. */
+    workloadLink?: string;
+  });
+}
+
+export declare class DomainSpecPortsRoutesHeaders {
+  constructor(props: {
+    /** Manipulates HTTP headers */
+    request?: DomainSpecPortsRoutesHeadersRequest;
+  });
+}
+
+export declare class DomainSpecPortsRoutesHeadersRequest {
+  constructor(props: {
+    /** Sets or overrides headers to all http requests for this route. */
+    set?: Record<string, unknown>;
+  });
+}
+
+export declare class DomainSpecPortsRoutesMirror {
+  constructor(props: {
+    /** The percentage of traffic to mirror to the specified workload. */
+    percent?: number;
+    /** The port to send mirrored traffic to. If not provided, traffic will be mirrored to the first discovered port on the mirrored workload */
+    port?: number;
+    /** The workload to mirror traffic to. */
+    workloadLink?: string;
+  });
+}
+
+export declare class DomainSpecPortsTls {
+  constructor(props: {
+    cipherSuites?: ("AES128-GCM-SHA256" | "AES128-SHA" | "AES256-GCM-SHA384" | "AES256-SHA" | "DES-CBC3-SHA" | "ECDHE-ECDSA-AES128-GCM-SHA256" | "ECDHE-ECDSA-AES256-GCM-SHA384" | "ECDHE-ECDSA-CHACHA20-POLY1305" | "ECDHE-RSA-AES128-GCM-SHA256" | "ECDHE-RSA-AES128-SHA" | "ECDHE-RSA-AES256-GCM-SHA384" | "ECDHE-RSA-AES256-SHA" | "ECDHE-RSA-CHACHA20-POLY1305" | "TLS_AES_128_GCM_SHA256" | "TLS_AES_256_GCM_SHA384" | "TLS_CHACHA20_POLY1305_SHA256" | "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" | "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" | "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" | "TLS_RSA_WITH_AES_128_GCM_SHA256" | "TLS_RSA_WITH_AES_256_GCM_SHA384")[];
+    /** When clientCertificate is defined, requests may optionally supply a client certificate. The certificate details are included in the x-forwarded-client-cert header. */
+    clientCertificate?: DomainSpecPortsTlsClientCertificate;
+    minProtocolVersion?: "TLSV1_0" | "TLSV1_1" | "TLSV1_2" | "TLSV1_3";
+    /** Configure an optional custom server certificate for the domain. When the port number is 443 and this is not supplied, a certificate is provisioned automatically. */
+    serverCertificate?: DomainSpecPortsTlsServerCertificate;
+  });
+}
+
+export declare class DomainSpecPortsTlsClientCertificate {
+  constructor(props: {
+    /** The secret will include a client certificate authority cert in PEM format used to verify requests which include client certificates. The key subject must match the domain and the key usage properties must be configured for client certificate authorization. The secret type must be keypair. */
+    secretLink?: string;
+  });
+}
+
+export declare class DomainSpecPortsTlsServerCertificate {
+  constructor(props: {
+    /** When provided, this is used as the server certificate authority. The secret type must be keypair and the content must be PEM encoded. */
+    secretLink?: string;
+  });
+}
+
+export declare class GvcSpec {
+  constructor(props: {
+    /** Workload in this GVC whose canonical endpoint backs the GVC alias DNS record.
+When set, ${alias}.cpln.app is published as a CNAME to the workload's canonical endpoint,
+inheriting its HTTP health probes and per-location geo failover. When unset, the alias
+resolves directly to cluster ingress endpoints with no application-level health awareness.
+Has no effect while the referenced workload is globally suspended (defaultOptions.suspend
+or defaultOptions.autoscaling.maxScale == 0); per-location suspends are ignored. */
+    aliasWorkloadLink?: string;
+    domain?: string;
+    /** Customizes the subdomain format for the canonical workload endpoint.
+`default` leaves it as ${workloadName}-${gvcName}.cpln.app
+`org` follows the scheme ${workloadName}-${gvcName}.${org}.cpln.app */
+    endpointNamingFormat?: "default" | "legacy" | "org";
+    /** These environment variables will be available to any workload in the GVC. Note: a workload must opt-in to receive these variables. */
+    env?: GvcSpecEnv[];
+    keda?: GvcSpecKeda;
+    loadBalancer?: GvcSpecLoadBalancer;
+    pullSecretLinks?: string[];
+    sidecar?: GvcSpecSidecar;
+    staticPlacement?: GvcSpecStaticPlacement;
+    tracing?: GvcSpecTracing;
+  });
+}
+
+export declare class GvcSpecEnv {
+  constructor(props: {
+    name?: string;
+    value?: string;
+  });
+}
+
+export declare class GvcSpecKeda {
+  constructor(props: {
+    /** Enable KEDA for this GVC.
+KEDA is a Kubernetes-based event-driven autoscaler that allows you to scale workloads based on external events.
+When enabled,a keda operator will be deployed in the GVC and workloads in the GVC can use KEDA to scale based on external metrics. */
+    enabled?: boolean;
+    /** A link to an Identity resource that will be used for KEDA.
+This will allow the keda operator to access cloud and network resources. */
+    identityLink?: string;
+    /** A list of secrets to be used as TriggerAuthentication objects.
+The TriggerAuthentication object will be named after the secret and can be used by triggers on workloads in this GVC. */
+    secrets?: string[];
+  });
+}
+
+export declare class GvcSpecLoadBalancer {
+  constructor(props: {
+    /** Creates a dedicated load balancer in each location and enables additional Domain features: custom ports, protocols and wildcard hostnames. Charges apply for each location. */
+    dedicated?: boolean;
+    /** A link to an IPSet resource that will be used for this load balancer */
+    ipSet?: string;
+    multiZone?: GvcSpecLoadBalancerMultiZone;
+    /** Specify the url to be redirected to for different http status codes. */
+    redirect?: GvcSpecLoadBalancerRedirect;
+    /** Controls the address used for request logging and for setting the X-Envoy-External-Address header.
+If set to 1, then the last address in an existing X-Forwarded-For header will be used in place of the source client IP address.
+If set to 2, then the second to last address in an existing X-Forwarded-For header will be used in place of the source client IP address. If the XFF header does not have at least two addresses or does not exist then the source client IP address will be used instead. */
+    trustedProxies?: number;
+  });
+}
+
+export declare class GvcSpecLoadBalancerMultiZone {
+  constructor(props: {
+    enabled?: boolean;
+  });
+}
+
+export declare class GvcSpecLoadBalancerRedirect {
+  constructor(props: {
+    /** Specify the redirect url for all status codes in a class */
+    class?: GvcSpecLoadBalancerRedirectClass;
+  });
+}
+
+export declare class GvcSpecLoadBalancerRedirectClass {
+  constructor(props: {
+    /** An optional url redirect for 401 responses.
+Supports envoy format strings to include request information.
+E.g. https://your-oauth-server/oauth2/authorize?return_to=%REQ(:path)%&client_id=your-client-id
+ */
+    status401?: string;
+    /** Specify the redirect url for any 500 level status code */
+    status5xx?: string;
+  });
+}
+
+export declare class GvcSpecSidecar {
+  constructor(props: {
+    envoy?: Record<string, unknown>;
+  });
+}
+
+export declare class GvcSpecStaticPlacement {
+  constructor(props: {
+    locationLinks?: string[];
+    /** Per-location routing options for DNS geo routing. Allows configuring priority-based failover and latency adjustments per location. */
+    locationOptions?: GvcSpecStaticPlacementLocationOptions[];
+    locationQuery?: GvcSpecStaticPlacementLocationQuery;
+  });
+}
+
+export declare class GvcSpecStaticPlacementLocationOptions {
+  constructor(props: {
+    /** Artificial latency offset in milliseconds added to measured latency. Positive values push traffic away from this location, negative values attract traffic. Default: 0. */
+    latencyOffsetMs?: number;
+    /** Maximum acceptable latency in milliseconds. If measured latency exceeds this latencyToleranceMs, the location is treated as unavailable for DNS geo routing. */
+    latencyToleranceMs?: number;
+    locationLink?: string;
+    /** Routing tier for DNS geo routing. Lower value = higher priority. Locations with the same routingTier form a group; within a group, lowest latency wins. If all locations in the highest-priority group are unavailable, the next group is used. */
+    routingTier?: number;
+  });
+}
+
+export declare class GvcSpecStaticPlacementLocationQuery {
+  constructor(props: {
+    kind?: string;
+    spec?: GvcSpecStaticPlacementLocationQuerySpec;
+  });
+}
+
+export declare class GvcSpecStaticPlacementLocationQuerySpec {
+  constructor(props: {
+    match?: "all" | "any" | "none";
+    sort?: GvcSpecStaticPlacementLocationQuerySpecSort;
+    terms?: GvcSpecStaticPlacementLocationQuerySpecTerms[];
+  });
+}
+
+export declare class GvcSpecStaticPlacementLocationQuerySpecSort {
+  constructor(props: {
+    by?: string;
+    order?: "asc" | "desc";
+  });
+}
+
+export declare class GvcSpecStaticPlacementLocationQuerySpecTerms {
+  constructor(props: {
+    op?: "!=" | "!exists" | "<" | "<=" | "=" | "=~" | ">" | ">=" | "contains" | "exists" | "~";
+    property?: string;
+    rel?: string;
+    tag?: string;
+    value?: string | number | boolean;
+  });
+}
+
+export declare class GvcSpecTracing {
+  constructor(props: {
+    customTags?: Record<string, unknown>;
+    lightstep?: GvcSpecTracingLightstep;
+    provider?: GvcSpecTracingProvider;
+    sampling?: number;
+  });
+}
+
+export declare class GvcSpecTracingLightstep {
+  constructor(props: {
+    credentials?: string;
+    endpoint?: string;
+  });
+}
+
+export declare class GvcSpecTracingProvider {
+  constructor(props: {
+    controlplane?: Record<string, unknown>;
+    lightstep?: GvcSpecTracingProviderLightstep;
+    otel?: GvcSpecTracingProviderOtel;
+  });
+}
+
+export declare class GvcSpecTracingProviderLightstep {
+  constructor(props: {
+    credentials?: string;
+    endpoint?: string;
+  });
+}
+
+export declare class GvcSpecTracingProviderOtel {
+  constructor(props: {
+    endpoint?: string;
+  });
+}
+
+export declare class IdentityAws {
+  constructor(props: {
+    cloudAccountLink?: string;
+    policyRefs?: string[];
+    roleName?: string;
+    trustPolicy?: IdentityAwsTrustPolicy;
+  });
+}
+
+export declare class IdentityAwsTrustPolicy {
+  constructor(props: {
+    Statement?: Record<string, unknown>[];
+    Version?: string;
+  });
+}
+
+export declare class IdentityAzure {
+  constructor(props: {
+    cloudAccountLink?: string;
+    roleAssignments?: IdentityAzureRoleAssignments[];
+  });
+}
+
+export declare class IdentityAzureRoleAssignments {
+  constructor(props: {
+    roles?: string[];
+    scope?: string;
+  });
+}
+
+export declare class IdentityGcp {
+  constructor(props: {
+    bindings?: IdentityGcpBindings[];
+    cloudAccountLink?: string;
+    scopes?: string[];
+    serviceAccount?: string;
+  });
+}
+
+export declare class IdentityGcpBindings {
+  constructor(props: {
+    resource?: string;
+    roles?: string[];
+  });
+}
+
+export declare class IdentityMemcacheAccess {
+  constructor(props: {
+    clusterLink?: string;
+    role?: "readWrite";
+  });
+}
+
+export declare class IdentityNativeNetworkResources {
+  constructor(props: {
+    awsPrivateLink?: IdentityNativeNetworkResourcesAwsPrivateLink;
+    FQDN?: string;
+    gcpServiceConnect?: IdentityNativeNetworkResourcesGcpServiceConnect;
+    name?: string;
+    ports?: number[];
+  });
+}
+
+export declare class IdentityNativeNetworkResourcesAwsPrivateLink {
+  constructor(props: {
+    endpointServiceName?: string;
+  });
+}
+
+export declare class IdentityNativeNetworkResourcesGcpServiceConnect {
+  constructor(props: {
+    targetService?: string;
+  });
+}
+
+export declare class IdentityNgs {
+  constructor(props: {
+    cloudAccountLink?: string;
+    /** Max number of bytes a connection can send */
+    data?: number;
+    /** Max message payload */
+    payload?: number;
+    pub?: IdentityNgsPub;
+    resp?: IdentityNgsResp;
+    sub?: IdentityNgsSub;
+    /** Max number of subscriptions per connection */
+    subs?: number;
+  });
+}
+
+export declare class IdentityNgsPub {
+  constructor(props: {
+    allow?: string[];
+    deny?: string[];
+  });
+}
+
+export declare class IdentityNgsResp {
+  constructor(props: {
+    /** Number of responses allowed on the replyTo subject, -1 means no limit */
+    max?: number;
+    /** Deadline to send replies on the replyTo subject [#ms(millis) | #s(econds) | m(inutes) | h(ours)]. -1 means no restriction */
+    ttl?: string;
+  });
+}
+
+export declare class IdentityNgsSub {
+  constructor(props: {
+    allow?: string[];
+    deny?: string[];
+  });
+}
+
+export declare class IdentitySpicedbAccess {
+  constructor(props: {
+    clusterLink?: string;
+    role?: "checkPermission" | "read" | "write";
+  });
+}
+
+export declare class IpSetLocation {
+  constructor(props: {
+    name?: string;
+    retentionPolicy?: "free" | "keep";
+  });
+}
+
+export declare class IpSetSpec {
+  constructor(props: {
+    link?: string;
+    locations?: IpSetLocation[];
+  });
+}
+
+export declare class NetworkResource {
+  constructor(props: {
+    agentLink?: string;
+    FQDN?: string;
+    IPs?: string[];
+    name?: string;
+    ports?: number[];
+    resolverIP?: string;
+  });
+}
+
+export declare class PolicyBinding {
+  constructor(props: {
+    permissions?: string[];
+    principalLinks?: string[];
+  });
+}
+
+export declare class Query {
+  constructor(props: {
+    kind?: string;
+    spec?: QuerySpec;
+  });
+}
+
+export declare class QuerySpec {
+  constructor(props: {
+    match?: "all" | "any" | "none";
+    sort?: QuerySpecSort;
+    terms?: QuerySpecTerms[];
+  });
+}
+
+export declare class QuerySpecSort {
+  constructor(props: {
+    by?: string;
+    order?: "asc" | "desc";
+  });
+}
+
+export declare class QuerySpecTerms {
+  constructor(props: {
+    op?: "!=" | "!exists" | "<" | "<=" | "=" | "=~" | ">" | ">=" | "contains" | "exists" | "~";
+    property?: string;
+    rel?: string;
+    tag?: string;
+    value?: string | number | boolean;
+  });
+}
+
+export declare class SecretAwskey {
+  constructor(props: {
+    accessKey?: string;
+    externalId?: string;
+    roleArn?: string;
+    secretKey?: string;
+  });
+}
+
+export declare class SecretKeypair {
+  constructor(props: {
+    passphrase?: string;
+    publicKey?: string;
+    secretKey?: string;
+  });
+}
+
+export declare class SecretOpaque {
+  constructor(props: {
+    encoding?: "base64" | "plain";
+    payload?: string;
+  });
+}
+
+export declare class SecretTls {
+  constructor(props: {
+    cert?: string;
+    chain?: string;
+    key?: string;
+  });
+}
+
+export declare class SecretUserpass {
+  constructor(props: {
+    encoding?: "base64" | "plain";
+    password?: string;
+    username?: string;
+  });
+}
+
+export declare class VolumeSetSpec {
+  constructor(props: {
+    autoscaling?: VolumeSetSpecAutoscaling;
+    /** Configure customer-managed encryption keys for volumes in this set on a per-region basis. Region names must follow the format: {cloud-provider}-{region} (e.g., aws-us-east-1). */
+    customEncryption?: VolumeSetSpecCustomEncryption;
+    fileSystemType?: "ext4" | "shared" | "xfs";
+    /** The initial size in GB of volumes in this set. */
+    initialCapacity?: number;
+    /** A list of mount options to use when mounting volumes in this set. */
+    mountOptions?: VolumeSetSpecMountOptions;
+    performanceClass?: "general-purpose-ssd" | "high-throughput-ssd" | "shared";
+    snapshots?: VolumeSetSpecSnapshots;
+    /** For self-hosted locations only. The storage class used for volumes in this set will be {performanceClass}-{fileSystemType}-{storageClassSuffix} if it exists, otherwise it will be {performanceClass}-{fileSystemType} */
+    storageClassSuffix?: string;
+  });
+}
+
+export declare class VolumeSetSpecAutoscaling {
+  constructor(props: {
+    /** The maximum size in GB for a volume in this set. A volume cannot grow to be bigger than this. */
+    maxCapacity?: number;
+    /** The guaranteed free space on the volume as a percentage of the volume's total size. ControlPlane will try to maintain at least that many percent free by scaling up the total size */
+    minFreePercentage?: number;
+    /** Predictive scaling configuration. When enabled, proactively expands volumes based on historical growth rate projections. */
+    predictive?: VolumeSetSpecAutoscalingPredictive;
+    /** When scaling is necessary, then new_capacity = current_capacity * storageScalingFactor. */
+    scalingFactor?: number;
+  });
+}
+
+export declare class VolumeSetSpecAutoscalingPredictive {
+  constructor(props: {
+    /** Enable predictive scaling based on historical growth rates. Default: false. */
+    enabled?: boolean;
+    /** Hours of historical data to analyze. Default: 24. Max: 168 (1 week). */
+    lookbackHours?: number;
+    /** Minimum data points required for reliable growth rate calculation. Default: 10. */
+    minDataPoints?: number;
+    /** Minimum growth rate (GB/hour) to trigger predictive expansion. Default: 0.01. */
+    minGrowthRateGBPerHour?: number;
+    /** Hours into the future to project storage needs. Default: 6. */
+    projectionHours?: number;
+    /** Scaling factor for predictive expansion. If not set, uses the parent autoscaling.scalingFactor. Use a lower value (e.g., 1.2) for gentler proactive scaling. */
+    scalingFactor?: number;
+  });
+}
+
+export declare class VolumeSetSpecCustomEncryption {
+  constructor(props: {
+    regions?: Record<string, unknown>;
+  });
+}
+
+export declare class VolumeSetSpecMountOptions {
+  constructor(props: {
+    /** For volume sets using the shared file system, this object specifies the CPU and memory resources allotted to each mount point */
+    resources?: VolumeSetSpecMountOptionsResources;
+  });
+}
+
+export declare class VolumeSetSpecMountOptionsResources {
+  constructor(props: {
+    /** CPU allocation specified as millicores (e.g., 50m, 1000m) */
+    maxCpu?: string;
+    /** Memory allocation specified as a string with units (e.g., 128Mi, 1Gi, 512M). Supports G, M, k, Gi, Mi, Ki suffixes. */
+    maxMemory?: string;
+    /** CPU allocation specified as millicores (e.g., 50m, 1000m) */
+    minCpu?: string;
+    /** Memory allocation specified as a string with units (e.g., 128Mi, 1Gi, 512M). Supports G, M, k, Gi, Mi, Ki suffixes. */
+    minMemory?: string;
+  });
+}
+
+export declare class VolumeSetSpecSnapshots {
+  constructor(props: {
+    /** If true, a volume snapshot will be created immediately before deletion of any volume in this set */
+    createFinalSnapshot?: boolean;
+    /** The default retention period for volume snapshots. This string should contain a floating point number followed by either d, h, or m. For example, "10d" would retain snapshots for 10 days. */
+    retentionDuration?: string;
+    /** A standard cron schedule expression used to determine when your job should execute. */
+    schedule?: string;
+  });
+}
+
+export declare class WorkloadSpec {
+  constructor(props: {
+    /** List of containers that make up the workload */
+    containers?: WorkloadSpecContainers[];
+    /** Set defaultOptions for the workload in all Control Plane Locations. */
+    defaultOptions?: WorkloadSpecDefaultOptions;
+    /** Additional Kubernetes customizations for BYOK */
+    extras?: WorkloadSpecExtras;
+    /** Optional control of inbound and outbound access to the workload for external (public) and internal (service to service) traffic. Access is restricted by default. */
+    firewallConfig?: WorkloadSpecFirewallConfig;
+    /** The identityLink is used as the access scope for 3rd party cloud resources. A single identity can provide access to multiple cloud providers. */
+    identityLink?: string;
+    /** Job configuration for cron workloads */
+    job?: WorkloadSpecJob;
+    /** Load balancer configuration */
+    loadBalancer?: WorkloadSpecLoadBalancer;
+    /** Override defaultOptions for the workload in specific Control Plane Locations. */
+    localOptions?: WorkloadSpecLocalOptions[];
+    /** Policy for retrying failed requests */
+    requestRetryPolicy?: WorkloadSpecRequestRetryPolicy;
+    /** Configuration for how workload updates are rolled out */
+    rolloutOptions?: WorkloadSpecRolloutOptions;
+    /** Security context for the workload */
+    securityOptions?: WorkloadSpecSecurityOptions;
+    /** Sidecar container configuration */
+    sidecar?: WorkloadSpecSidecar;
+    /** If this is enabled, Control Plane will automatically redeploy your workload when one of the container images is updated in the container registry. */
+    supportDynamicTags?: boolean;
+    /** Type of workload: standard (always running), cron (scheduled jobs), stateful (persistent state), serverless (rapid autoscaling), or vm (KubeVirt-backed virtual machine). */
+    type?: "cron" | "serverless" | "standard" | "stateful" | "vm";
+    /** VM-only configuration. Required when type=vm; rejected otherwise. */
+    vm?: WorkloadSpecVm;
+  });
+}
+
+export declare class WorkloadSpecContainers {
+  constructor(props: {
+    /** Command line arguments passed to the container at runtime. Replaces the CMD arguments of the running container. It is an ordered list. */
+    args?: string[];
+    /** Optionally override the entrypoint */
+    command?: string;
+    /** reserved CPU of the workload when capacityAI is disabled. maximum CPU when CapacityAI is enabled. */
+    cpu?: string;
+    /** Environment variables for the container at runtime. Default environment variables are also provided: CPLN_GVC, CPLN_LOCATION, CPLN_ORG, CPLN_PROVIDER, CPLN_WORKLOAD */
+    env?: WorkloadSpecContainersEnv[];
+    /** Reserved GPU resources for the workload. */
+    gpu?: WorkloadSpecContainersGpu;
+    /** The full image and tag path for a public or private docker registry. Private container images must have valid credentials configured in 'pullSecretLinks' on the GVC (Global Virtual Cloud). Required for all workload types except 'vm', which boots from spec.vm.bootDisk.source instead. */
+    image?: string;
+    /** Enables inheritance of GVC environment variables. A variable in spec.env will override a GVC variable with the same name. */
+    inheritEnv?: boolean;
+    /** Lifecycle hooks for the container */
+    lifecycle?: WorkloadSpecContainersLifecycle;
+    /** A Probe to check if the workload is healthy or should be restarted. */
+    livenessProbe?: WorkloadSpecContainersLivenessProbe;
+    /** reserved memory of the workload when capacityAI is disabled. maximum memory when CapacityAI is enabled. */
+    memory?: string;
+    /** Prometheus metrics configuration for the container */
+    metrics?: WorkloadSpecContainersMetrics;
+    /** Minimum CPU when capacityAI is enabled. */
+    minCpu?: string;
+    /** Minimum memory when capacityAI is enabled */
+    minMemory?: string;
+    /** The name of the container. */
+    name?: string;
+    /** The port in the container which receives external traffic or traffic from other workloads. Only one container is allowed to specify a port. */
+    port?: number;
+    /** The ports in the container which can receive internal and external traffic.  For serverless workloads only the first port will be used. */
+    ports?: WorkloadSpecContainersPorts[];
+    /** A Probe to check if the workload is ready to receive additional traffic. */
+    readinessProbe?: WorkloadSpecContainersReadinessProbe;
+    /** Mount Object Store (S3, GCS, AzureBlob) buckets as file system */
+    volumes?: WorkloadSpecContainersVolumes[];
+    /** The working directory for the container process */
+    workingDir?: string;
+  });
+}
+
+export declare class WorkloadSpecContainersEnv {
+  constructor(props: {
+    name?: string;
+    value?: string;
+  });
+}
+
+export declare class WorkloadSpecContainersGpu {
+  constructor(props: {
+    /** Custom GPU resource specification for non-NVIDIA GPUs */
+    custom?: WorkloadSpecContainersGpuCustom;
+    /** NVIDIA GPU resource specification */
+    nvidia?: WorkloadSpecContainersGpuNvidia;
+  });
+}
+
+export declare class WorkloadSpecContainersGpuCustom {
+  constructor(props: {
+    /** Number of custom GPUs to allocate */
+    quantity?: number;
+    /** Custom GPU resource name (e.g., amd.com/gpu) */
+    resource?: string;
+    /** Runtime class for custom GPU */
+    runtimeClass?: string;
+  });
+}
+
+export declare class WorkloadSpecContainersGpuNvidia {
+  constructor(props: {
+    /** NVIDIA GPU model (t4 or a10g) */
+    model?: Record<string, unknown>;
+    /** Number of NVIDIA GPUs to allocate */
+    quantity?: number;
+  });
+}
+
+export declare class WorkloadSpecContainersLifecycle {
+  constructor(props: {
+    /** Actions to perform after the container starts */
+    postStart?: WorkloadSpecContainersLifecyclePostStart;
+    /** Actions to perform before the container stops */
+    preStop?: WorkloadSpecContainersLifecyclePreStop;
+  });
+}
+
+export declare class WorkloadSpecContainersLifecyclePostStart {
+  constructor(props: {
+    /** Execute a command when the container starts */
+    exec?: WorkloadSpecContainersLifecyclePostStartExec;
+  });
+}
+
+export declare class WorkloadSpecContainersLifecyclePostStartExec {
+  constructor(props: {
+    /** Command and arguments executed immediately after the container is created. */
+    command?: string[];
+  });
+}
+
+export declare class WorkloadSpecContainersLifecyclePreStop {
+  constructor(props: {
+    /** Execute a command before the container stops */
+    exec?: WorkloadSpecContainersLifecyclePreStopExec;
+  });
+}
+
+export declare class WorkloadSpecContainersLifecyclePreStopExec {
+  constructor(props: {
+    /** Command and arguments executed immediately before the container is stopped. */
+    command?: string[];
+  });
+}
+
+export declare class WorkloadSpecContainersLivenessProbe {
+  constructor(props: {
+    /** Execute a command to check health */
+    exec?: WorkloadSpecContainersLivenessProbeExec;
+    /** Minimum consecutive failures for the health check to be considered failed after having succeeded */
+    failureThreshold?: number;
+    /** Perform a gRPC health check */
+    grpc?: WorkloadSpecContainersLivenessProbeGrpc;
+    /** Perform an HTTP GET health check */
+    httpGet?: WorkloadSpecContainersLivenessProbeHttpGet;
+    /** Number of seconds to wait before performing the first health check */
+    initialDelaySeconds?: number;
+    /** How often (in seconds) to perform the health check */
+    periodSeconds?: number;
+    /** Minimum consecutive successes for the health check to be considered successful after having failed */
+    successThreshold?: number;
+    /** Perform a TCP socket health check */
+    tcpSocket?: WorkloadSpecContainersLivenessProbeTcpSocket;
+    /** Number of seconds after which the health check times out */
+    timeoutSeconds?: number;
+  });
+}
+
+export declare class WorkloadSpecContainersLivenessProbeExec {
+  constructor(props: {
+    /** Command to execute for the health check */
+    command?: string[];
+  });
+}
+
+export declare class WorkloadSpecContainersLivenessProbeGrpc {
+  constructor(props: {
+    /** Port to perform the gRPC health check on */
+    port?: number;
+  });
+}
+
+export declare class WorkloadSpecContainersLivenessProbeHttpGet {
+  constructor(props: {
+    /** Custom HTTP headers to include in the health check request */
+    httpHeaders?: WorkloadSpecContainersLivenessProbeHttpGetHttpHeaders[];
+    /** HTTP path to request for the health check */
+    path?: string;
+    /** Port to perform the HTTP health check on */
+    port?: number;
+    /** HTTP scheme to use (HTTP or HTTPS) */
+    scheme?: "HTTP" | "HTTPS";
+  });
+}
+
+export declare class WorkloadSpecContainersLivenessProbeHttpGetHttpHeaders {
+  constructor(props: {
+    /** HTTP header name */
+    name?: string;
+    /** HTTP header value */
+    value?: string;
+  });
+}
+
+export declare class WorkloadSpecContainersLivenessProbeTcpSocket {
+  constructor(props: {
+    /** Port to perform the TCP socket check on */
+    port?: number;
+  });
+}
+
+export declare class WorkloadSpecContainersMetrics {
+  constructor(props: {
+    /** Drop metrics that match given patterns */
+    dropMetrics?: string[];
+    /** HTTP path where Prometheus metrics are exposed */
+    path?: string;
+    /** Port where Prometheus metrics are exposed */
+    port?: number;
+  });
+}
+
+export declare class WorkloadSpecContainersPorts {
+  constructor(props: {
+    /** Port number */
+    number?: number;
+    /** Protocol used by the port (http, http2, grpc, or tcp) */
+    protocol?: "grpc" | "http" | "http2" | "tcp";
+  });
+}
+
+export declare class WorkloadSpecContainersReadinessProbe {
+  constructor(props: {
+    /** Execute a command to check health */
+    exec?: WorkloadSpecContainersReadinessProbeExec;
+    /** Minimum consecutive failures for the health check to be considered failed after having succeeded */
+    failureThreshold?: number;
+    /** Perform a gRPC health check */
+    grpc?: WorkloadSpecContainersReadinessProbeGrpc;
+    /** Perform an HTTP GET health check */
+    httpGet?: WorkloadSpecContainersReadinessProbeHttpGet;
+    /** Number of seconds to wait before performing the first health check */
+    initialDelaySeconds?: number;
+    /** How often (in seconds) to perform the health check */
+    periodSeconds?: number;
+    /** Minimum consecutive successes for the health check to be considered successful after having failed */
+    successThreshold?: number;
+    /** Perform a TCP socket health check */
+    tcpSocket?: WorkloadSpecContainersReadinessProbeTcpSocket;
+    /** Number of seconds after which the health check times out */
+    timeoutSeconds?: number;
+  });
+}
+
+export declare class WorkloadSpecContainersReadinessProbeExec {
+  constructor(props: {
+    /** Command to execute for the health check */
+    command?: string[];
+  });
+}
+
+export declare class WorkloadSpecContainersReadinessProbeGrpc {
+  constructor(props: {
+    /** Port to perform the gRPC health check on */
+    port?: number;
+  });
+}
+
+export declare class WorkloadSpecContainersReadinessProbeHttpGet {
+  constructor(props: {
+    /** Custom HTTP headers to include in the health check request */
+    httpHeaders?: WorkloadSpecContainersReadinessProbeHttpGetHttpHeaders[];
+    /** HTTP path to request for the health check */
+    path?: string;
+    /** Port to perform the HTTP health check on */
+    port?: number;
+    /** HTTP scheme to use (HTTP or HTTPS) */
+    scheme?: "HTTP" | "HTTPS";
+  });
+}
+
+export declare class WorkloadSpecContainersReadinessProbeHttpGetHttpHeaders {
+  constructor(props: {
+    /** HTTP header name */
+    name?: string;
+    /** HTTP header value */
+    value?: string;
+  });
+}
+
+export declare class WorkloadSpecContainersReadinessProbeTcpSocket {
+  constructor(props: {
+    /** Port to perform the TCP socket check on */
+    port?: number;
+  });
+}
+
+export declare class WorkloadSpecContainersVolumes {
+  constructor(props: {
+    /** VM disk boot order. Only valid for type=vm. */
+    bootOrder?: number;
+    /** VM disk bus. Only valid for type=vm. A cpln://secret/ volume on a sata or scsi bus is presented to the guest as a read-only CD-ROM. */
+    bus?: "sata" | "scsi" | "virtio";
+    /** VM disk name. Required for type=vm; rejected for other workload types. */
+    name?: string;
+    /** Mount path inside the container. Required for non-vm workloads; rejected for type=vm. */
+    path?: string;
+    /** Only applicable to persistent volumes, this determines what Control Plane will do when creating a new workload replica if a corresponding volume exists. */
+    recoveryPolicy?: "recycle" | "retain";
+    uri?: string;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptions {
+  constructor(props: {
+    autoscaling?: WorkloadSpecDefaultOptionsAutoscaling;
+    /** Enables intelligent dynamic resource allocation of CPU and Memory   for each container by setting resource reservations using analysis of historical usage data.   This can significantly reduce cost but may cause temporary performance   issues for workloads with sudden spikes in usage. */
+    capacityAI?: boolean;
+    /** The highest frequency capacity AI is allowed to update resource reservations when CapacityAI is enabled. */
+    capacityAIUpdateMinutes?: number;
+    /** Enables debug response headers when the headers "x-cpln-debug: true" is in the request. */
+    debug?: boolean;
+    multiZone?: WorkloadSpecDefaultOptionsMultiZone;
+    /** Enables use of spot instances to reduce cost of running workloads with an increasedpotential of rescheduling workloads onto new nodes when they are forced to terminate. */
+    spot?: boolean;
+    suspend?: boolean;
+    /** The maximum request duration that is allowed for Control Plane to respond.This timeout can be reached when the Control Plane is waiting for the workload to respond or waitingfor a new workload to become available when using Autoscaling. */
+    timeoutSeconds?: number;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsAutoscaling {
+  constructor(props: {
+    keda?: WorkloadSpecDefaultOptionsAutoscalingKeda;
+    /** A hard maximum for the number of concurrent requests allowed to a replica.   If no replicas are available to fulfill the request then it will be queued until a replica with capacity is available   and delivered as soon as one is available again. Capacity can be available from requests completing   or when a new replica is available from scale out. A value of 0 allows all requests. */
+    maxConcurrency?: number;
+    /** The maximum allowed number of replicas. */
+    maxScale?: number;
+    /** Controls the metric which will be used for scaling decisions.The goal is to maintain the target across all replicas of a deployment.'concurrency' uses the number of concurrent requests for the target.'cpu' uses % processor time for the target.'memory' memory in Mi for the target.'rps' uses requests per second for the target.'latency' uses the average request response time for the target. */
+    metric?: "concurrency" | "cpu" | "disabled" | "keda" | "latency" | "memory" | "rps";
+    /** For metrics represented as a distribution (e.g. latency) a percentile within the distribution must be chosen as the target. */
+    metricPercentile?: "p50" | "p75" | "p99";
+    /** The minimum allowed number of replicas.   Control Plane can scale the workload down to 0 when there is no traffic and   scale up immediately to fulfill new requests. */
+    minScale?: number;
+    multi?: WorkloadSpecDefaultOptionsAutoscalingMulti[];
+    /** The amount of time with no requests received before a workload is scaled to 0. */
+    scaleToZeroDelay?: number;
+    /** Control Plane will scale the number of replicas for this deployment up/downin order to be as close as possible to the target metric across all replicas of a deployment. */
+    target?: number;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsAutoscalingKeda {
+  constructor(props: {
+    advanced?: WorkloadSpecDefaultOptionsAutoscalingKedaAdvanced;
+    cooldownPeriod?: number;
+    fallback?: WorkloadSpecDefaultOptionsAutoscalingKedaFallback;
+    initialCooldownPeriod?: number;
+    pollingInterval?: number;
+    /** An array of KEDA triggers to be used for scaling workloads in this GVC. */
+    triggers?: WorkloadSpecDefaultOptionsAutoscalingKedaTriggers[];
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsAutoscalingKedaAdvanced {
+  constructor(props: {
+    scalingModifiers?: WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedScalingModifiers;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedScalingModifiers {
+  constructor(props: {
+    /** defines the new activation target value to scale on for the composed metric. */
+    activationTarget?: string;
+    /** composes metrics together and allows them to be modified/manipulated. It accepts mathematical/conditional statements */
+    formula?: string;
+    /** defines metric type used for this new composite-metric. */
+    metricType?: "AverageValue" | "Utilization" | "Value";
+    /** defines new target value to scale on for the composed metric. */
+    target?: string;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsAutoscalingKedaFallback {
+  constructor(props: {
+    /** Behavior to apply when fallback is triggered. */
+    behavior?: "currentReplicas" | "currentReplicasIfHigher" | "currentReplicasIfLower" | "static";
+    /** Number of consecutive failures required to trigger fallback behavior. */
+    failureThreshold?: number;
+    /** Number of replicas to scale to when fallback is triggered. */
+    replicas?: number;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsAutoscalingKedaTriggers {
+  constructor(props: {
+    authenticationRef?: WorkloadSpecDefaultOptionsAutoscalingKedaTriggersAuthenticationRef;
+    /** The configuration parameters that the trigger requires */
+    metadata?: Record<string, unknown>;
+    /** The type of metric to be used for scaling. */
+    metricType?: "AverageValue" | "Utilization" | "Value";
+    /** An optional name for the trigger. If not provided, a default name will be generated based on the trigger type. */
+    name?: string;
+    /** The type of KEDA trigger, e.g "prometheus", "aws-sqs", etc. */
+    type?: string;
+    /** Enables caching of metric values during polling interval */
+    useCachedMetrics?: boolean;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsAutoscalingKedaTriggersAuthenticationRef {
+  constructor(props: {
+    /** The name of secret listed in the GVC spec.keda.secrets */
+    name?: string;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsAutoscalingMulti {
+  constructor(props: {
+    metric?: Record<string, unknown>;
+    /** Control Plane will scale the number of replicas for this deployment up/downin order to be as close as possible to the target metric across all replicas of a deployment. */
+    target?: number;
+  });
+}
+
+export declare class WorkloadSpecDefaultOptionsMultiZone {
+  constructor(props: {
+    enabled?: boolean;
+  });
+}
+
+export declare class WorkloadSpecExtras {
+  constructor(props: {
+    /** Kubernetes pod affinity and anti-affinity rules */
+    affinity?: Record<string, unknown>;
+    /** Kubernetes pod tolerations for node taints */
+    tolerations?: Record<string, unknown>[];
+    /** Kubernetes topology spread constraints for pod distribution */
+    topologySpreadConstraints?: Record<string, unknown>[];
+  });
+}
+
+export declare class WorkloadSpecFirewallConfig {
+  constructor(props: {
+    /** The external firewall is used to control access to and from the public internet. */
+    external?: WorkloadSpecFirewallConfigExternal;
+    /** The internal firewall is used to control access between workloads. */
+    internal?: WorkloadSpecFirewallConfigInternal;
+  });
+}
+
+export declare class WorkloadSpecFirewallConfigExternal {
+  constructor(props: {
+    /** firewall options for HTTP workloads */
+    http?: WorkloadSpecFirewallConfigExternalHttp;
+    inboundAllowCIDR?: string[];
+    inboundBlockedCIDR?: string[];
+    /** The list of ipv4/ipv6 addresses or cidr blocks that this workload is allowed reach. No outbound access is allowed by default. Specify '0.0.0.0/0' to allow outbound access to the public internet (not recommended). */
+    outboundAllowCIDR?: string[];
+    /** The list of public hostnames that this workload is allowed to reach. No outbound access is allowed by default. A wildcard '*' is allowed on the prefix of the hostname only, ex: '*.amazonaws.com'. Use 'outboundAllowCIDR' to allow access to all external websites (not recommended). The ports 80, 443 & 445 are allowed by default. This can be modified using the outboundAllowPort setting. */
+    outboundAllowHostname?: string[];
+    /** Allow outbound access to specific ports and protocols. When not specified, communication to address ranges in outboundAllowCIDR is allowed on all ports and communication to names in outboundAllowHostname is allowed on ports 80/443. */
+    outboundAllowPort?: WorkloadSpecFirewallConfigExternalOutboundAllowPort[];
+    /** The list of ipv4/ipv6 addresses or cidr blocks that this workload is NOT allowed reach. Addresses in the allow list will only be allowed if they do not exist in this list. */
+    outboundBlockedCIDR?: string[];
+  });
+}
+
+export declare class WorkloadSpecFirewallConfigExternalHttp {
+  constructor(props: {
+    /** A list of header filters for HTTP workloads. */
+    inboundHeaderFilter?: WorkloadSpecFirewallConfigExternalHttpInboundHeaderFilter[];
+  });
+}
+
+export declare class WorkloadSpecFirewallConfigExternalHttpInboundHeaderFilter {
+  constructor(props: {
+    /** A list of regular expressions to match for allowed header values. 
+Headers that do not match ANY of these values will be filtered and will not reach the workload. */
+    allowedValues?: string[];
+    /** A list of regular expressions to match for blocked header values.
+Headers that match ANY of these values will be filtered and will not reach the workload. */
+    blockedValues?: string[];
+    /** The header to match for. */
+    key?: string;
+  });
+}
+
+export declare class WorkloadSpecFirewallConfigExternalOutboundAllowPort {
+  constructor(props: {
+    /** Port number to allow */
+    number?: number;
+    /** Protocol to allow (http, https, or tcp) */
+    protocol?: "http" | "https" | "tcp";
+  });
+}
+
+export declare class WorkloadSpecFirewallConfigInternal {
+  constructor(props: {
+    /** Used to control the internal firewall configuration and mutual tls. 'none': no access is allowed between this workload and other workloads on Control Plane. 'same-gvc': workloads running on the same Global Virtual Cloud are allowed to access this workload internally. 'same-org': workloads running on the same Control Plane Organization are allowed to access this workload internally. 'workload-list': specific workloads provided in the 'inboundAllowWorkload' array are allowed to access this workload internally. */
+    inboundAllowType?: "none" | "same-gvc" | "same-org" | "workload-list";
+    /** A list of specific workloads which are allowed to access this workload internally. */
+    inboundAllowWorkload?: string[];
+  });
+}
+
+export declare class WorkloadSpecJob {
+  constructor(props: {
+    /** The maximum number of seconds Control Plane will wait for the job to complete. If a job does not succeed or fail in the allotted time, Control Plane will stop the job, moving it into the Removed status. */
+    activeDeadlineSeconds?: number;
+    /** Either 'Forbid', 'Replace', or 'Allow'. This determines what Control Plane will do when the schedule requires a job to start, while a prior instance of the job is still running. */
+    concurrencyPolicy?: "Allow" | "Forbid" | "Replace";
+    /** The maximum number of completed job instances to display. This should be an integer between 1 and 10. */
+    historyLimit?: number;
+    /** Either 'OnFailure' or 'Never'. This determines what Control Plane will do when a job instance fails. */
+    restartPolicy?: "Never" | "OnFailure";
+    /** A standard cron schedule expression (5 fields). */
+    schedule?: string;
+  });
+}
+
+export declare class WorkloadSpecLoadBalancer {
+  constructor(props: {
+    /** direct load balancers are created in each location that a workload is running in and are configured for the standard endpoints of the workload. Customers are responsible for configuring the workload with certificates if TLS is required */
+    direct?: WorkloadSpecLoadBalancerDirect;
+    /** Geo location header configuration */
+    geoLocation?: WorkloadSpecLoadBalancerGeoLocation;
+    /** When enabled, individual replicas of the workload can be reached directly using the subdomain prefix replica-<index>.
+For example, replica-0.my-workload.my-gvc.cpln.local or replica-0.my-workload-<gvc-alias>.cpln.app
+Can only be used with stateful workloads. */
+    replicaDirect?: boolean;
+  });
+}
+
+export declare class WorkloadSpecLoadBalancerDirect {
+  constructor(props: {
+    /** when disabled, this load balancer will be stopped */
+    enabled?: boolean;
+    /** IP set to use for dedicated IPs */
+    ipSet?: string;
+    /** list of ports that will be exposed by this load balancer */
+    ports?: WorkloadSpecLoadBalancerDirectPorts[];
+  });
+}
+
+export declare class WorkloadSpecLoadBalancerDirectPorts {
+  constructor(props: {
+    /** The port on the container tha will receive this traffic */
+    containerPort?: number;
+    /** The port that is available publicly */
+    externalPort?: number;
+    /** The protocol that is exposed publicly */
+    protocol?: "TCP" | "UDP";
+    /** overrides the default `https` url scheme that will be used for links in the UI and status */
+    scheme?: "http" | "https" | "tcp" | "ws" | "wss";
+  });
+}
+
+export declare class WorkloadSpecLoadBalancerGeoLocation {
+  constructor(props: {
+    /** When enabled, geo location headers will be included on inbound http requests. Existing headers will be replaced. */
+    enabled?: boolean;
+    /** Custom header names for geo location data */
+    headers?: WorkloadSpecLoadBalancerGeoLocationHeaders;
+  });
+}
+
+export declare class WorkloadSpecLoadBalancerGeoLocationHeaders {
+  constructor(props: {
+    /** The geo asn header */
+    asn?: string;
+    /** The geo city header */
+    city?: string;
+    /** The geo country header */
+    country?: string;
+    /** The geo region header */
+    region?: string;
+  });
+}
+
+export declare class WorkloadSpecLocalOptions {
+  constructor(props: {
+    autoscaling?: WorkloadSpecLocalOptionsAutoscaling;
+    /** Enables intelligent dynamic resource allocation of CPU and Memory   for each container by setting resource reservations using analysis of historical usage data.   This can significantly reduce cost but may cause temporary performance   issues for workloads with sudden spikes in usage. */
+    capacityAI?: boolean;
+    /** The highest frequency capacity AI is allowed to update resource reservations when CapacityAI is enabled. */
+    capacityAIUpdateMinutes?: number;
+    /** Enables debug response headers when the headers "x-cpln-debug: true" is in the request. */
+    debug?: boolean;
+    location?: string;
+    multiZone?: WorkloadSpecLocalOptionsMultiZone;
+    /** Enables use of spot instances to reduce cost of running workloads with an increasedpotential of rescheduling workloads onto new nodes when they are forced to terminate. */
+    spot?: boolean;
+    suspend?: boolean;
+    /** The maximum request duration that is allowed for Control Plane to respond.This timeout can be reached when the Control Plane is waiting for the workload to respond or waitingfor a new workload to become available when using Autoscaling. */
+    timeoutSeconds?: number;
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsAutoscaling {
+  constructor(props: {
+    keda?: WorkloadSpecLocalOptionsAutoscalingKeda;
+    /** A hard maximum for the number of concurrent requests allowed to a replica.   If no replicas are available to fulfill the request then it will be queued until a replica with capacity is available   and delivered as soon as one is available again. Capacity can be available from requests completing   or when a new replica is available from scale out. A value of 0 allows all requests. */
+    maxConcurrency?: number;
+    /** The maximum allowed number of replicas. */
+    maxScale?: number;
+    /** Controls the metric which will be used for scaling decisions.The goal is to maintain the target across all replicas of a deployment.'concurrency' uses the number of concurrent requests for the target.'cpu' uses % processor time for the target.'memory' memory in Mi for the target.'rps' uses requests per second for the target.'latency' uses the average request response time for the target. */
+    metric?: "concurrency" | "cpu" | "disabled" | "keda" | "latency" | "memory" | "rps";
+    /** For metrics represented as a distribution (e.g. latency) a percentile within the distribution must be chosen as the target. */
+    metricPercentile?: "p50" | "p75" | "p99";
+    /** The minimum allowed number of replicas.   Control Plane can scale the workload down to 0 when there is no traffic and   scale up immediately to fulfill new requests. */
+    minScale?: number;
+    multi?: WorkloadSpecLocalOptionsAutoscalingMulti[];
+    /** The amount of time with no requests received before a workload is scaled to 0. */
+    scaleToZeroDelay?: number;
+    /** Control Plane will scale the number of replicas for this deployment up/downin order to be as close as possible to the target metric across all replicas of a deployment. */
+    target?: number;
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsAutoscalingKeda {
+  constructor(props: {
+    advanced?: WorkloadSpecLocalOptionsAutoscalingKedaAdvanced;
+    cooldownPeriod?: number;
+    fallback?: WorkloadSpecLocalOptionsAutoscalingKedaFallback;
+    initialCooldownPeriod?: number;
+    pollingInterval?: number;
+    /** An array of KEDA triggers to be used for scaling workloads in this GVC. */
+    triggers?: WorkloadSpecLocalOptionsAutoscalingKedaTriggers[];
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsAutoscalingKedaAdvanced {
+  constructor(props: {
+    scalingModifiers?: WorkloadSpecLocalOptionsAutoscalingKedaAdvancedScalingModifiers;
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsAutoscalingKedaAdvancedScalingModifiers {
+  constructor(props: {
+    /** defines the new activation target value to scale on for the composed metric. */
+    activationTarget?: string;
+    /** composes metrics together and allows them to be modified/manipulated. It accepts mathematical/conditional statements */
+    formula?: string;
+    /** defines metric type used for this new composite-metric. */
+    metricType?: "AverageValue" | "Utilization" | "Value";
+    /** defines new target value to scale on for the composed metric. */
+    target?: string;
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsAutoscalingKedaFallback {
+  constructor(props: {
+    /** Behavior to apply when fallback is triggered. */
+    behavior?: "currentReplicas" | "currentReplicasIfHigher" | "currentReplicasIfLower" | "static";
+    /** Number of consecutive failures required to trigger fallback behavior. */
+    failureThreshold?: number;
+    /** Number of replicas to scale to when fallback is triggered. */
+    replicas?: number;
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsAutoscalingKedaTriggers {
+  constructor(props: {
+    authenticationRef?: WorkloadSpecLocalOptionsAutoscalingKedaTriggersAuthenticationRef;
+    /** The configuration parameters that the trigger requires */
+    metadata?: Record<string, unknown>;
+    /** The type of metric to be used for scaling. */
+    metricType?: "AverageValue" | "Utilization" | "Value";
+    /** An optional name for the trigger. If not provided, a default name will be generated based on the trigger type. */
+    name?: string;
+    /** The type of KEDA trigger, e.g "prometheus", "aws-sqs", etc. */
+    type?: string;
+    /** Enables caching of metric values during polling interval */
+    useCachedMetrics?: boolean;
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsAutoscalingKedaTriggersAuthenticationRef {
+  constructor(props: {
+    /** The name of secret listed in the GVC spec.keda.secrets */
+    name?: string;
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsAutoscalingMulti {
+  constructor(props: {
+    metric?: Record<string, unknown>;
+    /** Control Plane will scale the number of replicas for this deployment up/downin order to be as close as possible to the target metric across all replicas of a deployment. */
+    target?: number;
+  });
+}
+
+export declare class WorkloadSpecLocalOptionsMultiZone {
+  constructor(props: {
+    enabled?: boolean;
+  });
+}
+
+export declare class WorkloadSpecRequestRetryPolicy {
+  constructor(props: {
+    /** Maximum number of retry attempts for failed requests */
+    attempts?: number;
+    /** List of conditions that trigger request retries (e.g., 5xx, gateway-error, connect-failure, unavailable) */
+    retryOn?: string[];
+  });
+}
+
+export declare class WorkloadSpecRolloutOptions {
+  constructor(props: {
+    /** Maximum number or percentage of replicas that can be created above the desired count during a rollout */
+    maxSurgeReplicas?: string;
+    /** Maximum number or percentage of replicas that can be unavailable during a rollout */
+    maxUnavailableReplicas?: string;
+    /** The minimum number of seconds a container must run without crashing to be considered available */
+    minReadySeconds?: number;
+    /** Determines whether replicas are scaled in order (OrderedReady) or in parallel (Parallel) */
+    scalingPolicy?: "OrderedReady" | "Parallel";
+    /** The amount of time in seconds a workload has to gracefully terminate before forcefully terminating it.
+This includes the time it takes for the preStop hook to run. */
+    terminationGracePeriodSeconds?: number;
+  });
+}
+
+export declare class WorkloadSpecSecurityOptions {
+  constructor(props: {
+    /** The group id assigned to any mounted volume */
+    filesystemGroupId?: number;
+    /** The user id assigned to all container processes */
+    runAsUser?: number;
+  });
+}
+
+export declare class WorkloadSpecSidecar {
+  constructor(props: {
+    /** Envoy proxy filters */
+    envoy?: Record<string, unknown>;
+  });
+}
+
+export declare class WorkloadSpecVm {
+  constructor(props: {
+    accessCredentials?: WorkloadSpecVmAccessCredentials[];
+    /** Boot disk configuration. When source is omitted, containers[0].image is used as an OCI containerDisk. */
+    bootDisk?: WorkloadSpecVmBootDisk;
+    clock?: WorkloadSpecVmClock;
+    cloudInit?: WorkloadSpecVmCloudInit;
+    cpu?: WorkloadSpecVmCpu;
+    firmware?: WorkloadSpecVmFirmware;
+    /** Guest operating system family. Drives per-OS cloud-init payload (file paths, init system, env/hosts injection, SSH CA bootstrap). */
+    guestOS?: "linux" | "windows";
+    hostname?: string;
+    /** Pod-network interfaces for the VM. v1 supports a single network; multi-network arrives with per-interface port routing. */
+    networks?: WorkloadSpecVmNetworks[];
+    /** KubeVirt RunStrategy. Use Halted to keep the pool defined but powered off. */
+    runStrategy?: "Always" | "Halted" | "Manual" | "RerunOnFailure";
+    subdomain?: string;
+  });
+}
+
+export declare class WorkloadSpecVmAccessCredentials {
+  constructor(props: {
+    deliveryMethod?: "configDrive" | "qemuGuestAgent";
+    sshPublicKeySecret?: string;
+    users?: string[];
+  });
+}
+
+export declare class WorkloadSpecVmBootDisk {
+  constructor(props: {
+    bootOrder?: number;
+    bus?: "sata" | "scsi" | "virtio";
+    /** Per-replica boot PVC populated via CDI. Required for any non-OCI source. */
+    persist?: WorkloadSpecVmBootDiskPersist;
+    /** Exactly one source must be specified. */
+    source?: WorkloadSpecVmBootDiskSource;
+  });
+}
+
+export declare class WorkloadSpecVmBootDiskPersist {
+  constructor(props: {
+    /** VolumeSet URI used to provision one PVC per replica for the boot disk. Format: cpln://volumeset/<name>. */
+    volumeSet?: string;
+  });
+}
+
+export declare class WorkloadSpecVmBootDiskSource {
+  constructor(props: {
+    /** Boot disk image fetched over HTTP/HTTPS. Requires persist.volumeSet. */
+    http?: WorkloadSpecVmBootDiskSourceHttp;
+    /** Boot from an OCI containerDisk image. Default when no boot source is set; otherwise overrides containers[0].image. */
+    oci?: WorkloadSpecVmBootDiskSourceOci;
+  });
+}
+
+export declare class WorkloadSpecVmBootDiskSourceHttp {
+  constructor(props: {
+    /** Disk image checksum, formatted as "sha256:<hex>" or "sha512:<hex>" */
+    checksum?: string;
+    url?: string;
+  });
+}
+
+export declare class WorkloadSpecVmBootDiskSourceOci {
+  constructor(props: {
+    /** Full image reference of a containerDisk (e.g., quay.io/containerdisks/ubuntu:22.04 or /org/<org>/image/<name>:<tag>) */
+    image?: string;
+  });
+}
+
+export declare class WorkloadSpecVmClock {
+  constructor(props: {
+    timezone?: string;
+  });
+}
+
+export declare class WorkloadSpecVmCloudInit {
+  constructor(props: {
+    /** SSH public keys injected via cloud-init. Each Secret may carry one or more keys. */
+    sshPublicKeySecrets?: string[];
+    /** Inline cloud-init user-data. Not encrypted at rest in the data-service — use userDataSecret for sensitive payloads. */
+    userData?: string;
+    /** Inline cloud-init user-data, base64-encoded. Same caveats as userData. */
+    userDataBase64?: string;
+    /** Secret containing cloud-init user-data (key: userdata or user-data). */
+    userDataSecret?: string;
+  });
+}
+
+export declare class WorkloadSpecVmCpu {
+  constructor(props: {
+    /** CPU sockets visible to the guest. Cores are derived from containers[0].cpu. */
+    sockets?: number;
+    /** CPU threads per core visible to the guest. */
+    threads?: number;
+  });
+}
+
+export declare class WorkloadSpecVmFirmware {
+  constructor(props: {
+    bootloader?: "bios" | "efi";
+    /** Enable UEFI Secure Boot. Not yet supported: pending persistent EFI NVRAM, without which the guest is unbootable after a reboot. */
+    secureBoot?: boolean;
+    /** SMBIOS system serial number reported to the guest. */
+    serial?: string;
+    smbios?: WorkloadSpecVmFirmwareSmbios;
+    /** Fixed SMBIOS UUID for the VM. KubeVirt generates one when omitted. */
+    uuid?: string;
+  });
+}
+
+export declare class WorkloadSpecVmFirmwareSmbios {
+  constructor(props: {
+    family?: string;
+    manufacturer?: string;
+    product?: string;
+    sku?: string;
+    version?: string;
+  });
+}
+
+export declare class WorkloadSpecVmNetworks {
+  constructor(props: {
+    name?: string;
+  });
+}