--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.16.0 name: certificateauthorities.acmpca.aws.crossplane.io spec: group: acmpca.aws.crossplane.io names: categories: - crossplane - managed - aws kind: CertificateAuthority listKind: CertificateAuthorityList plural: certificateauthorities singular: certificateauthority scope: Cluster versions: - additionalPrinterColumns: - jsonPath: .spec.forProvider.type name: TYPE type: string - jsonPath: .spec.forProvider.status name: STATUS type: string - jsonPath: .status.conditions[?(@.type=='Ready')].status name: READY type: string - jsonPath: .status.conditions[?(@.type=='Synced')].status name: SYNCED type: string - jsonPath: .metadata.creationTimestamp name: AGE type: date deprecated: true deprecationWarning: Please use v1beta1 version of this resource that has identical schema. name: v1alpha1 schema: openAPIV3Schema: description: |- CertificateAuthority is a managed resource that represents an AWS CertificateAuthority Manager. Deprecated: Please use v1beta1 version of this resource. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: CertificateAuthoritySpec defines the desired state of CertificateAuthority properties: deletionPolicy: default: Delete description: |- DeletionPolicy specifies what will happen to the underlying external when this managed resource is deleted - either "Delete" or "Orphan" the external resource. This field is planned to be deprecated in favor of the ManagementPolicies field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 enum: - Orphan - Delete type: string forProvider: description: CertificateAuthorityParameters defines the desired state of an AWS CertificateAuthority. properties: certificateAuthorityConfiguration: description: CertificateAuthorityConfiguration to associate with the certificateAuthority. properties: keyAlgorithm: description: Type of the public key algorithm enum: - RSA_2048 - EC_secp384r1 - EC_prime256v1 - RSA_4096 type: string signingAlgorithm: description: Algorithm that private CA uses to sign certificate requests enum: - SHA512WITHECDSA - SHA256WITHECDSA - SHA384WITHECDSA - SHA512WITHRSA - SHA256WITHRSA - SHA384WITHRSA type: string subject: description: Subject is information of Certificate Authority properties: commonName: description: FQDN associated with the certificate subject type: string country: description: Two-digit code that specifies the country type: string distinguishedNameQualifier: description: Disambiguating information for the certificate subject. type: string generationQualifier: description: Typically a qualifier appended to the name of an individual type: string givenName: description: First name type: string initials: description: Concatenation of first letter of the GivenName, Middle name and SurName. type: string locality: description: The locality such as a city or town type: string organization: description: Organization legal name type: string organizationalUnit: description: Organization's subdivision or unit type: string pseudonym: description: Shortened version of a longer GivenName type: string serialNumber: description: The certificate serial number. type: string state: description: State in which the subject of the certificate is located type: string surname: description: Surname type: string title: description: Title type: string required: - commonName - country - locality - organization - organizationalUnit - state type: object required: - keyAlgorithm - signingAlgorithm - subject type: object permanentDeletionTimeInDays: description: The number of days to make a CA restorable after it has been deleted format: int32 type: integer region: description: Region is the region you'd like your CertificateAuthority to be created in. type: string revocationConfiguration: description: RevocationConfiguration to associate with the certificateAuthority. properties: customCname: description: Alias for the CRL distribution point type: string enabled: description: Boolean value that specifies certificate revocation type: boolean expirationInDays: description: Number of days until a certificate expires format: int32 type: integer s3BucketName: description: Name of the S3 bucket that contains the CRL type: string required: - enabled type: object status: description: |- Status of the certificate authority. This value cannot be configured at creation, but can be updated to set a CA to ACTIVE or DISABLED. enum: - ACTIVE - DISABLED type: string tags: description: One or more resource tags to associate with the certificateAuthority. items: description: Tag represents user-provided metadata that can be associated properties: key: description: The key name that can be used to look up or retrieve the associated value. type: string value: description: The value associated with this tag. type: string required: - key - value type: object type: array type: description: Type of the certificate authority enum: - ROOT - SUBORDINATE type: string required: - certificateAuthorityConfiguration - region - tags - type type: object managementPolicies: default: - '*' description: |- THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md items: description: |- A ManagementAction represents an action that the Crossplane controllers can take on an external resource. enum: - Observe - Create - Update - Delete - LateInitialize - '*' type: string type: array providerConfigRef: default: name: default description: |- ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object publishConnectionDetailsTo: description: |- PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. properties: configRef: default: name: default description: |- SecretStoreConfigRef specifies which secret store config should be used for this ConnectionSecret. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object metadata: description: Metadata is the metadata for connection secret. properties: annotations: additionalProperties: type: string description: |- Annotations are the annotations to be added to connection secret. - For Kubernetes secrets, this will be used as "metadata.annotations". - It is up to Secret Store implementation for others store types. type: object labels: additionalProperties: type: string description: |- Labels are the labels/tags to be added to connection secret. - For Kubernetes secrets, this will be used as "metadata.labels". - It is up to Secret Store implementation for others store types. type: object type: description: |- Type is the SecretType for the connection secret. - Only valid for Kubernetes Secret Stores. type: string type: object name: description: Name is the name of the connection secret. type: string required: - name type: object writeConnectionSecretToRef: description: |- WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other. properties: name: description: Name of the secret. type: string namespace: description: Namespace of the secret. type: string required: - name - namespace type: object required: - forProvider type: object status: description: An CertificateAuthorityStatus represents the observed state of an CertificateAuthority manager. properties: atProvider: description: CertificateAuthorityExternalStatus keeps the state of external resource properties: certificateAuthorityARN: description: String that contains the ARN of the issued certificate Authority type: string serial: description: Serial of the Certificate Authority type: string status: description: Status is the current status of the CertificateAuthority. type: string type: object conditions: description: Conditions of the resource. items: description: A Condition that may apply to a resource. properties: lastTransitionTime: description: |- LastTransitionTime is the last time this condition transitioned from one status to another. format: date-time type: string message: description: |- A Message containing details about this condition's last transition from one status to another, if any. type: string observedGeneration: description: |- ObservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 type: integer reason: description: A Reason for this condition's last transition from one status to another. type: string status: description: Status of this condition; is it currently True, False, or Unknown? type: string type: description: |- Type of this condition. At most one of each condition type may apply to a resource at any point in time. type: string required: - lastTransitionTime - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map observedGeneration: description: |- ObservedGeneration is the latest metadata.generation which resulted in either a ready state, or stalled due to error it can not recover from without human intervention. format: int64 type: integer type: object required: - spec type: object served: true storage: false subresources: status: {} - additionalPrinterColumns: - jsonPath: .spec.forProvider.type name: TYPE type: string - jsonPath: .spec.forProvider.status name: STATUS type: string - jsonPath: .status.conditions[?(@.type=='Ready')].status name: READY type: string - jsonPath: .status.conditions[?(@.type=='Synced')].status name: SYNCED type: string - jsonPath: .metadata.creationTimestamp name: AGE type: date name: v1beta1 schema: openAPIV3Schema: description: CertificateAuthority is a managed resource that represents an AWS CertificateAuthority Manager. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: CertificateAuthoritySpec defines the desired state of CertificateAuthority properties: deletionPolicy: default: Delete description: |- DeletionPolicy specifies what will happen to the underlying external when this managed resource is deleted - either "Delete" or "Orphan" the external resource. This field is planned to be deprecated in favor of the ManagementPolicies field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 enum: - Orphan - Delete type: string forProvider: description: CertificateAuthorityParameters defines the desired state of an AWS CertificateAuthority. properties: certificateAuthorityConfiguration: description: CertificateAuthorityConfiguration to associate with the certificateAuthority. properties: keyAlgorithm: description: Type of the public key algorithm enum: - RSA_2048 - EC_secp384r1 - EC_prime256v1 - RSA_4096 type: string signingAlgorithm: description: Algorithm that private CA uses to sign certificate requests enum: - SHA512WITHECDSA - SHA256WITHECDSA - SHA384WITHECDSA - SHA512WITHRSA - SHA256WITHRSA - SHA384WITHRSA type: string subject: description: Subject is information of Certificate Authority properties: commonName: description: FQDN associated with the certificate subject type: string country: description: Two-digit code that specifies the country type: string distinguishedNameQualifier: description: Disambiguating information for the certificate subject. type: string generationQualifier: description: Typically a qualifier appended to the name of an individual type: string givenName: description: First name type: string initials: description: Concatenation of first letter of the GivenName, Middle name and SurName. type: string locality: description: The locality such as a city or town type: string organization: description: Organization legal name type: string organizationalUnit: description: Organization's subdivision or unit type: string pseudonym: description: Shortened version of a longer GivenName type: string serialNumber: description: The certificate serial number. type: string state: description: State in which the subject of the certificate is located type: string surname: description: Surname type: string title: description: Title type: string required: - commonName - country - locality - organization - organizationalUnit - state type: object required: - keyAlgorithm - signingAlgorithm - subject type: object permanentDeletionTimeInDays: description: The number of days to make a CA restorable after it has been deleted format: int32 type: integer region: description: Region is the region you'd like your CertificateAuthority to be created in. type: string revocationConfiguration: description: RevocationConfiguration to associate with the certificateAuthority. properties: customCname: description: Alias for the CRL distribution point type: string enabled: description: Boolean value that specifies certificate revocation type: boolean expirationInDays: description: Number of days until a certificate expires format: int32 type: integer s3BucketName: description: Name of the S3 bucket that contains the CRL type: string required: - enabled type: object status: description: |- Status of the certificate authority. This value cannot be configured at creation, but can be updated to set a CA to ACTIVE or DISABLED. enum: - ACTIVE - DISABLED type: string tags: description: One or more resource tags to associate with the certificateAuthority. items: description: Tag represents user-provided metadata that can be associated properties: key: description: The key name that can be used to look up or retrieve the associated value. type: string value: description: The value associated with this tag. type: string required: - key - value type: object type: array type: description: Type of the certificate authority enum: - ROOT - SUBORDINATE type: string required: - certificateAuthorityConfiguration - region - tags - type type: object managementPolicies: default: - '*' description: |- THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md items: description: |- A ManagementAction represents an action that the Crossplane controllers can take on an external resource. enum: - Observe - Create - Update - Delete - LateInitialize - '*' type: string type: array providerConfigRef: default: name: default description: |- ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object publishConnectionDetailsTo: description: |- PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. properties: configRef: default: name: default description: |- SecretStoreConfigRef specifies which secret store config should be used for this ConnectionSecret. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object metadata: description: Metadata is the metadata for connection secret. properties: annotations: additionalProperties: type: string description: |- Annotations are the annotations to be added to connection secret. - For Kubernetes secrets, this will be used as "metadata.annotations". - It is up to Secret Store implementation for others store types. type: object labels: additionalProperties: type: string description: |- Labels are the labels/tags to be added to connection secret. - For Kubernetes secrets, this will be used as "metadata.labels". - It is up to Secret Store implementation for others store types. type: object type: description: |- Type is the SecretType for the connection secret. - Only valid for Kubernetes Secret Stores. type: string type: object name: description: Name is the name of the connection secret. type: string required: - name type: object writeConnectionSecretToRef: description: |- WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other. properties: name: description: Name of the secret. type: string namespace: description: Namespace of the secret. type: string required: - name - namespace type: object required: - forProvider type: object status: description: An CertificateAuthorityStatus represents the observed state of an CertificateAuthority manager. properties: atProvider: description: CertificateAuthorityExternalStatus keeps the state of external resource properties: certificateAuthorityARN: description: String that contains the ARN of the issued certificate Authority type: string serial: description: Serial of the Certificate Authority type: string status: description: Status is the current status of the CertificateAuthority. type: string type: object conditions: description: Conditions of the resource. items: description: A Condition that may apply to a resource. properties: lastTransitionTime: description: |- LastTransitionTime is the last time this condition transitioned from one status to another. format: date-time type: string message: description: |- A Message containing details about this condition's last transition from one status to another, if any. type: string observedGeneration: description: |- ObservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 type: integer reason: description: A Reason for this condition's last transition from one status to another. type: string status: description: Status of this condition; is it currently True, False, or Unknown? type: string type: description: |- Type of this condition. At most one of each condition type may apply to a resource at any point in time. type: string required: - lastTransitionTime - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map observedGeneration: description: |- ObservedGeneration is the latest metadata.generation which resulted in either a ready state, or stalled due to error it can not recover from without human intervention. format: int64 type: integer type: object required: - spec type: object served: true storage: true subresources: status: {}