{ "apiVersion": "v1", "kind": "List", "metadata": {}, "items": [ { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "providerconfigs.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-family-aws-c70924eb1bb8", "uid": "0771d303-3152-40d0-97d7-b527194b9104" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-family-aws", "uid": "9e638a8c-32a2-4528-a0ef-573d7982543a" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQyVENDQXNHZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTJNalF3TWpNeE1qVmFGdzB6Ck5UQTJNalF3TWpNeE1qVmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDdGVTRzFnYWlCCkRjL2ZoSE5ySGNUYktvb2RMYUFVenNUTVU2K1B2NGN5Zi9rQ0NINnNyYWk1c3NEazZ2WkZFcUxBK0NnUGxHZmIKVXdhVCtRSVgyRlNIc0QzZy9kT21KYlRZeUpCSlZNb09wK2VtWHhpQmZWT2ptd2ZUaFM5MTg1SG81MUNlUUpjSgpXS0dOLzFHYzZIZytsUE4wZE1IUlZUVE5CY3Nra2VmdlZNQWpLWEN5cHdNQWoxL1BJVmkvSEY4Q1MwVUhxL3FLCnlzZ2c5TU9BcGlUOWhaQ3JSWDBFZXpSMWNYWElTM0xzY0tRU25HcWJPeDk5Nklld3lCb291eERjb2UrVTZGdUIKYnhDQUhJQ3VxNUE2cDNIM25qa2hSSy9QdGk5MlM0ZnR4VEl0VkQxZ3JhQ05wWHdvRUFOQUswd2pMdWxlNy96aApWQmJBeEdnMCtRcnJBZ01CQUFHamdhZ3dnYVV3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3Y0FZRFZSMFJCR2t3WjRJVGNISnZkbWxrWlhJdFptRnQKYVd4NUxXRjNjNElsY0hKdmRtbGtaWEl0Wm1GdGFXeDVMV0YzY3k1amNtOXpjM0JzWVc1bExYTjVjM1JsYllJcApjSEp2ZG1sa1pYSXRabUZ0YVd4NUxXRjNjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJCmh2Y05BUUVMQlFBRGdnRUJBQmVkZ0RCYzlNZnZiTDRrS0gxcGhLdnd6RmJTeWozRUtkM1BzMVZqbnM2WnpqQzYKQ3Y3VWtQaWE0QlpsRzRwL3luV2xVVGxScDRGYkw4ckY2VFVlSytDM01aYjhzdVYza1Z6L3ZwaWE0Ui94S3M1SQpBTnJhV0xtUXdscmxlcWJSRlIzdExyUzNBcGVDLzNhaTJmbjJ3VGU4OTQzdUJpV3V3NzR1NkYwUzhTbUduTjhZCjRBZXY1TDlHWGFtbUNpNDJlME1ZSVovRk81RjJVS3cvY2pKZlJvMmpYTFErNVdaZ1NmckpvVWdKdVJtcUErUGkKK25POFB6S0RlL3I0Y1g0a1ZRTUNDR1Uya25iNm5ZaUFHSktPMUx2bzBKK1BqYURkLzhUR2FieXk5MCthV0k4ZwpaMDZxcGtab3hzSS9ab01WR01zMXJtQTRFaDZJaldvY1dRWmYyTUE9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-family-aws", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "aws.upbound.io", "names": { "categories": [ "crossplane", "providerconfig", "aws" ], "kind": "ProviderConfig", "listKind": "ProviderConfigList", "plural": "providerconfigs", "singular": "providerconfig" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" }, { "jsonPath": ".spec.source", "name": "SOURCE", "priority": 1, "type": "string" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "A ProviderConfig configures the AWS provider.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "A ProviderConfigSpec defines the desired state of a ProviderConfig.", "properties": { "assumeRoleChain": { "description": "AssumeRoleChain defines the options for assuming an IAM role", "items": { "description": "AssumeRoleOptions define the options for assuming an IAM Role\nFields are similar to the STS AssumeRoleOptions in the AWS SDK", "properties": { "externalID": { "description": "ExternalID is the external ID used when assuming role.", "type": "string" }, "roleARN": { "description": "AssumeRoleARN to assume with provider credentials", "type": "string" }, "tags": { "description": "Tags is list of session tags that you want to pass. Each session tag consists of a key\nname and an associated value. For more information about session tags, see\nTagging STS Sessions\n(https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html).", "items": { "description": "Tag is session tag that can be used to assume an IAM Role", "properties": { "key": { "description": "Name of the tag.\nKey is a required field", "type": "string" }, "value": { "description": "Value of the tag.\nValue is a required field", "type": "string" } }, "required": [ "key", "value" ], "type": "object" }, "type": "array" }, "transitiveTagKeys": { "description": "TransitiveTagKeys is a list of keys for session tags that you want to set as transitive. If you set a\ntag key as transitive, the corresponding key and value passes to subsequent\nsessions in a role chain. For more information, see Chaining Roles with Session Tags\n(https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining).", "items": { "type": "string" }, "type": "array" } }, "type": "object" }, "type": "array" }, "credentials": { "description": "Credentials required to authenticate to this provider.", "properties": { "env": { "description": "Env is a reference to an environment variable that contains credentials\nthat must be used to connect to the provider.", "properties": { "name": { "description": "Name is the name of an environment variable.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "fs": { "description": "Fs is a reference to a filesystem location that contains credentials that\nmust be used to connect to the provider.", "properties": { "path": { "description": "Path is a filesystem path.", "type": "string" } }, "required": [ "path" ], "type": "object" }, "secretRef": { "description": "A SecretRef is a reference to a secret key that contains the credentials\nthat must be used to connect to the provider.", "properties": { "key": { "description": "The key to select.", "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "key", "name", "namespace" ], "type": "object" }, "source": { "description": "Source of the provider credentials.", "enum": [ "None", "Secret", "IRSA", "WebIdentity", "PodIdentity", "Upbound" ], "type": "string" }, "upbound": { "description": "Upbound defines the options for authenticating using Upbound as an identity provider.", "properties": { "webIdentity": { "description": "WebIdentity defines the options for assuming an IAM role with a Web\nIdentity.", "properties": { "roleARN": { "description": "AssumeRoleARN to assume with provider credentials", "type": "string" }, "roleSessionName": { "description": "RoleSessionName is the session name, if you wish to uniquely identify this session.", "type": "string" }, "tokenConfig": { "description": "TokenConfig is the Web Identity Token config to assume the role.", "properties": { "fs": { "description": "Fs is a reference to a filesystem location that contains credentials that\nmust be used to obtain the web identity token.", "properties": { "path": { "description": "Path is a filesystem path.", "type": "string" } }, "required": [ "path" ], "type": "object" }, "secretRef": { "description": "A SecretRef is a reference to a secret key that contains the credentials\nthat must be used to obtain the web identity token.", "properties": { "key": { "description": "The key to select.", "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "key", "name", "namespace" ], "type": "object" }, "source": { "description": "Source is the source of the web identity token.", "enum": [ "Secret", "Filesystem" ], "type": "string" } }, "required": [ "source" ], "type": "object" } }, "type": "object" } }, "type": "object" }, "webIdentity": { "description": "WebIdentity defines the options for assuming an IAM role with a Web Identity.", "properties": { "roleARN": { "description": "AssumeRoleARN to assume with provider credentials", "type": "string" }, "roleSessionName": { "description": "RoleSessionName is the session name, if you wish to uniquely identify this session.", "type": "string" }, "tokenConfig": { "description": "TokenConfig is the Web Identity Token config to assume the role.", "properties": { "fs": { "description": "Fs is a reference to a filesystem location that contains credentials that\nmust be used to obtain the web identity token.", "properties": { "path": { "description": "Path is a filesystem path.", "type": "string" } }, "required": [ "path" ], "type": "object" }, "secretRef": { "description": "A SecretRef is a reference to a secret key that contains the credentials\nthat must be used to obtain the web identity token.", "properties": { "key": { "description": "The key to select.", "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "key", "name", "namespace" ], "type": "object" }, "source": { "description": "Source is the source of the web identity token.", "enum": [ "Secret", "Filesystem" ], "type": "string" } }, "required": [ "source" ], "type": "object" } }, "type": "object" } }, "required": [ "source" ], "type": "object" }, "endpoint": { "description": "Endpoint is where you can override the default endpoint configuration\nof AWS calls made by the provider.", "properties": { "hostnameImmutable": { "description": "Specifies if the endpoint's hostname can be modified by the SDK's API\nclient.\n\n\nIf the hostname is mutable the SDK API clients may modify any part of\nthe hostname based on the requirements of the API, (e.g. adding, or\nremoving content in the hostname). Such as, Amazon S3 API client\nprefixing \"bucketname\" to the hostname, or changing the\nhostname service name component from \"s3.\" to \"s3-accesspoint.dualstack.\"\nfor the dualstack endpoint of an S3 Accesspoint resource.\n\n\nCare should be taken when providing a custom endpoint for an API. If the\nendpoint hostname is mutable, and the client cannot modify the endpoint\ncorrectly, the operation call will most likely fail, or have undefined\nbehavior.\n\n\nIf hostname is immutable, the SDK API clients will not modify the\nhostname of the URL. This may cause the API client not to function\ncorrectly if the API requires the operation specific hostname values\nto be used by the client.\n\n\nThis flag does not modify the API client's behavior if this endpoint\nwill be used instead of Endpoint Discovery, or if the endpoint will be\nused to perform Endpoint Discovery. That behavior is configured via the\nAPI Client's Options.\nNote that this is effective only for resources that use AWS SDK v2.", "type": "boolean" }, "partitionId": { "description": "The AWS partition the endpoint belongs to.", "type": "string" }, "services": { "description": "Specifies the list of services you want endpoint to be used for", "items": { "type": "string" }, "type": "array" }, "signingMethod": { "description": "The signing method that should be used for signing the requests to the\nendpoint.", "type": "string" }, "signingName": { "description": "The service name that should be used for signing the requests to the\nendpoint.", "type": "string" }, "signingRegion": { "description": "The region that should be used for signing the request to the endpoint.\nFor IAM, which doesn't have any region, us-east-1 is used to sign the\nrequests, which is the only signing region of IAM.", "type": "string" }, "source": { "description": "The source of the Endpoint. By default, this will be ServiceMetadata.\nWhen providing a custom endpoint, you should set the source as Custom.\nIf source is not provided when providing a custom endpoint, the SDK may not\nperform required host mutations correctly. Source should be used along with\nHostnameImmutable property as per the usage requirement.\nNote that this is effective only for resources that use AWS SDK v2.", "enum": [ "ServiceMetadata", "Custom" ], "type": "string" }, "url": { "description": "URL lets you configure the endpoint URL to be used in SDK calls.", "properties": { "dynamic": { "description": "Dynamic lets you configure the behavior of endpoint URL resolver.", "properties": { "host": { "description": "Host is the address of the main host that the resolver will use to\nprepend protocol, service and region configurations.\nFor example, the final URL for EC2 in us-east-1 looks like https://ec2.us-east-1.amazonaws.com\nYou would need to use \"amazonaws.com\" as Host and \"https\" as protocol\nto have the resolver construct it.", "type": "string" }, "protocol": { "description": "Protocol is the HTTP protocol that will be used in the URL. Currently,\nonly http and https are supported.", "enum": [ "http", "https" ], "type": "string" } }, "required": [ "host", "protocol" ], "type": "object" }, "static": { "description": "Static is the full URL you'd like the AWS SDK to use.\nRecommended for using tools like localstack where a single host is exposed\nfor all services and regions.", "type": "string" }, "type": { "description": "You can provide a static URL that will be used regardless of the service\nand region by choosing Static type. Alternatively, you can provide\nconfiguration for dynamically resolving the URL with the config you provide\nonce you set the type as Dynamic.", "enum": [ "Static", "Dynamic", "Auto" ], "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "url" ], "type": "object" }, "s3_use_path_style": { "description": "Whether to enable the request to use path-style addressing, i.e., https://s3.amazonaws.com/BUCKET/KEY.", "type": "boolean" }, "skip_credentials_validation": { "description": "Whether to skip credentials validation via the STS API.\nThis can be useful for testing and for AWS API implementations that do not have STS available.", "type": "boolean" }, "skip_metadata_api_check": { "description": "Whether to skip the AWS Metadata API check\nUseful for AWS API implementations that do not have a metadata API endpoint.", "type": "boolean" }, "skip_region_validation": { "description": "Whether to skip validation of provided region name.\nUseful for AWS-like implementations that use their own region names or to bypass the validation for\nregions that aren't publicly available yet.", "type": "boolean" }, "skip_requesting_account_id": { "description": "Whether to skip requesting the account ID.\nUseful for AWS API implementations that do not have the IAM, STS API, or metadata API", "type": "boolean" } }, "required": [ "credentials" ], "type": "object" }, "status": { "description": "A ProviderConfigStatus reflects the observed state of a ProviderConfig.", "properties": { "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "users": { "description": "Users of this provider configuration.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "providerconfigusages.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-family-aws-c70924eb1bb8", "uid": "0771d303-3152-40d0-97d7-b527194b9104" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-family-aws", "uid": "9e638a8c-32a2-4528-a0ef-573d7982543a" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQyVENDQXNHZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTJNalF3TWpNeE1qVmFGdzB6Ck5UQTJNalF3TWpNeE1qVmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDdGVTRzFnYWlCCkRjL2ZoSE5ySGNUYktvb2RMYUFVenNUTVU2K1B2NGN5Zi9rQ0NINnNyYWk1c3NEazZ2WkZFcUxBK0NnUGxHZmIKVXdhVCtRSVgyRlNIc0QzZy9kT21KYlRZeUpCSlZNb09wK2VtWHhpQmZWT2ptd2ZUaFM5MTg1SG81MUNlUUpjSgpXS0dOLzFHYzZIZytsUE4wZE1IUlZUVE5CY3Nra2VmdlZNQWpLWEN5cHdNQWoxL1BJVmkvSEY4Q1MwVUhxL3FLCnlzZ2c5TU9BcGlUOWhaQ3JSWDBFZXpSMWNYWElTM0xzY0tRU25HcWJPeDk5Nklld3lCb291eERjb2UrVTZGdUIKYnhDQUhJQ3VxNUE2cDNIM25qa2hSSy9QdGk5MlM0ZnR4VEl0VkQxZ3JhQ05wWHdvRUFOQUswd2pMdWxlNy96aApWQmJBeEdnMCtRcnJBZ01CQUFHamdhZ3dnYVV3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3Y0FZRFZSMFJCR2t3WjRJVGNISnZkbWxrWlhJdFptRnQKYVd4NUxXRjNjNElsY0hKdmRtbGtaWEl0Wm1GdGFXeDVMV0YzY3k1amNtOXpjM0JzWVc1bExYTjVjM1JsYllJcApjSEp2ZG1sa1pYSXRabUZ0YVd4NUxXRjNjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJCmh2Y05BUUVMQlFBRGdnRUJBQmVkZ0RCYzlNZnZiTDRrS0gxcGhLdnd6RmJTeWozRUtkM1BzMVZqbnM2WnpqQzYKQ3Y3VWtQaWE0QlpsRzRwL3luV2xVVGxScDRGYkw4ckY2VFVlSytDM01aYjhzdVYza1Z6L3ZwaWE0Ui94S3M1SQpBTnJhV0xtUXdscmxlcWJSRlIzdExyUzNBcGVDLzNhaTJmbjJ3VGU4OTQzdUJpV3V3NzR1NkYwUzhTbUduTjhZCjRBZXY1TDlHWGFtbUNpNDJlME1ZSVovRk81RjJVS3cvY2pKZlJvMmpYTFErNVdaZ1NmckpvVWdKdVJtcUErUGkKK25POFB6S0RlL3I0Y1g0a1ZRTUNDR1Uya25iNm5ZaUFHSktPMUx2bzBKK1BqYURkLzhUR2FieXk5MCthV0k4ZwpaMDZxcGtab3hzSS9ab01WR01zMXJtQTRFaDZJaldvY1dRWmYyTUE9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-family-aws", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "aws.upbound.io", "names": { "categories": [ "crossplane", "providerconfig", "aws" ], "kind": "ProviderConfigUsage", "listKind": "ProviderConfigUsageList", "plural": "providerconfigusages", "singular": "providerconfigusage" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" }, { "jsonPath": ".providerConfigRef.name", "name": "CONFIG-NAME", "type": "string" }, { "jsonPath": ".resourceRef.kind", "name": "RESOURCE-KIND", "type": "string" }, { "jsonPath": ".resourceRef.name", "name": "RESOURCE-NAME", "type": "string" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "A ProviderConfigUsage indicates that a resource is using a ProviderConfig.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "providerConfigRef": { "description": "ProviderConfigReference to the provider config being used.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "resourceRef": { "description": "ResourceReference to the managed resource using the provider config.", "properties": { "apiVersion": { "description": "APIVersion of the referenced object.", "type": "string" }, "kind": { "description": "Kind of the referenced object.", "type": "string" }, "name": { "description": "Name of the referenced object.", "type": "string" }, "uid": { "description": "UID of the referenced object.", "type": "string" } }, "required": [ "apiVersion", "kind", "name" ], "type": "object" } }, "required": [ "providerConfigRef", "resourceRef" ], "type": "object" } }, "served": true, "storage": true, "subresources": {} } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "accessentries.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "AccessEntry", "listKind": "AccessEntryList", "plural": "accessentries", "singular": "accessentry" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "AccessEntry is the Schema for the AccessEntrys API. Access Entry Configurations for an EKS Cluster.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "AccessEntrySpec defines the desired state of AccessEntry", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "kubernetesGroups": { "description": "– List of string which can optionally specify the Kubernetes groups the user would belong to when creating an access entry.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "principalArn": { "description": "– The IAM Principal ARN which requires Authentication access to the EKS cluster.", "type": "string" }, "principalArnFromRoleRef": { "description": "Reference to a Role in iam to populate principalArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "principalArnFromRoleSelector": { "description": "Selector for a Role in iam to populate principalArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "type": { "description": "Defaults to STANDARD which provides the standard workflow. EC2_LINUX, EC2_WINDOWS, FARGATE_LINUX types disallow users to input a username or groups, and prevent associations.", "type": "string" }, "userName": { "description": "Defaults to principal ARN if user is principal else defaults to assume-role/session-name is role is used.", "type": "string" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "kubernetesGroups": { "description": "– List of string which can optionally specify the Kubernetes groups the user would belong to when creating an access entry.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "type": { "description": "Defaults to STANDARD which provides the standard workflow. EC2_LINUX, EC2_WINDOWS, FARGATE_LINUX types disallow users to input a username or groups, and prevent associations.", "type": "string" }, "userName": { "description": "Defaults to principal ARN if user is principal else defaults to assume-role/session-name is role is used.", "type": "string" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object" }, "status": { "description": "AccessEntryStatus defines the observed state of AccessEntry.", "properties": { "atProvider": { "properties": { "accessEntryArn": { "description": "Amazon Resource Name (ARN) of the Access Entry.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "createdAt": { "description": "Date and time in RFC3339 format that the EKS add-on was created.", "type": "string" }, "id": { "type": "string" }, "kubernetesGroups": { "description": "– List of string which can optionally specify the Kubernetes groups the user would belong to when creating an access entry.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "modifiedAt": { "description": "Date and time in RFC3339 format that the EKS add-on was updated.", "type": "string" }, "principalArn": { "description": "– The IAM Principal ARN which requires Authentication access to the EKS cluster.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" }, "type": { "description": "Defaults to STANDARD which provides the standard workflow. EC2_LINUX, EC2_WINDOWS, FARGATE_LINUX types disallow users to input a username or groups, and prevent associations.", "type": "string" }, "userName": { "description": "Defaults to principal ARN if user is principal else defaults to assume-role/session-name is role is used.", "type": "string" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "accesspolicyassociations.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "AccessPolicyAssociation", "listKind": "AccessPolicyAssociationList", "plural": "accesspolicyassociations", "singular": "accesspolicyassociation" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "AccessPolicyAssociation is the Schema for the AccessPolicyAssociations API. ", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "AccessPolicyAssociationSpec defines the desired state of AccessPolicyAssociation", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "accessScope": { "properties": { "namespaces": { "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "type": { "type": "string" } }, "type": "object" }, "clusterName": { "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "policyArn": { "type": "string" }, "principalArn": { "type": "string" }, "principalArnRef": { "description": "Reference to a AccessEntry in eks to populate principalArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "principalArnSelector": { "description": "Selector for a AccessEntry in eks to populate principalArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" } }, "required": [ "policyArn", "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "accessScope": { "properties": { "namespaces": { "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "type": { "type": "string" } }, "type": "object" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.accessScope is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.accessScope) || (has(self.initProvider) && has(self.initProvider.accessScope))" } ] }, "status": { "description": "AccessPolicyAssociationStatus defines the observed state of AccessPolicyAssociation.", "properties": { "atProvider": { "properties": { "accessScope": { "properties": { "namespaces": { "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "type": { "type": "string" } }, "type": "object" }, "associatedAt": { "type": "string" }, "clusterName": { "type": "string" }, "id": { "type": "string" }, "modifiedAt": { "type": "string" }, "policyArn": { "type": "string" }, "principalArn": { "type": "string" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "addons.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "Addon", "listKind": "AddonList", "plural": "addons", "singular": "addon" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "Addon is the Schema for the Addons API. Manages an EKS add-on", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "AddonSpec defines the desired state of Addon", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "addonName": { "description": "on. The name must match one of\nthe names returned by describe-addon-versions.", "type": "string" }, "addonVersion": { "description": "on. The version must\nmatch one of the versions returned by describe-addon-versions.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "configurationValues": { "description": "custom configuration values for addons with single JSON string. This JSON string value must match the JSON schema derived from describe-addon-configuration.", "type": "string" }, "podIdentityAssociation": { "description": "Configuration block with EKS Pod Identity association settings. See pod_identity_association below for details.", "items": { "properties": { "roleArn": { "description": "The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity agent manages credentials to assume this role for applications in the containers in the pods that use this service account.", "type": "string" }, "serviceAccount": { "description": "The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.", "type": "string" } }, "type": "object" }, "type": "array" }, "preserve": { "description": "Indicates if you want to preserve the created resources when deleting the EKS add-on.", "type": "boolean" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "resolveConflicts": { "description": "(Deprecated use the resolve_conflicts_on_create and resolve_conflicts_on_update attributes instead) Define how to resolve parameter value conflicts when migrating an existing add-on to an Amazon EKS add-on or when applying version updates to the add-on. Valid values are NONE, OVERWRITE and PRESERVE. Note that PRESERVE is only valid on addon update, not for initial addon creation. If you need to set this to PRESERVE, use the resolve_conflicts_on_create and resolve_conflicts_on_update attributes instead. For more details check UpdateAddon API Docs.", "type": "string" }, "resolveConflictsOnCreate": { "description": "How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.", "type": "string" }, "resolveConflictsOnUpdate": { "description": "How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.", "type": "string" }, "serviceAccountRoleArn": { "description": "The Amazon Resource Name (ARN) of an\nexisting IAM role to bind to the add-on's service account. The role must be\nassigned the IAM permissions required by the add-on. If you don't specify\nan existing IAM role, then the add-on uses the permissions assigned to the node\nIAM role. For more information, see Amazon EKS node IAM role\nin the Amazon EKS User Guide.", "type": "string" }, "serviceAccountRoleArnRef": { "description": "Reference to a Role in iam to populate serviceAccountRoleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "serviceAccountRoleArnSelector": { "description": "Selector for a Role in iam to populate serviceAccountRoleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "addonName": { "description": "on. The name must match one of\nthe names returned by describe-addon-versions.", "type": "string" }, "addonVersion": { "description": "on. The version must\nmatch one of the versions returned by describe-addon-versions.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "configurationValues": { "description": "custom configuration values for addons with single JSON string. This JSON string value must match the JSON schema derived from describe-addon-configuration.", "type": "string" }, "podIdentityAssociation": { "description": "Configuration block with EKS Pod Identity association settings. See pod_identity_association below for details.", "items": { "properties": { "roleArn": { "description": "The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity agent manages credentials to assume this role for applications in the containers in the pods that use this service account.", "type": "string" }, "serviceAccount": { "description": "The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.", "type": "string" } }, "type": "object" }, "type": "array" }, "preserve": { "description": "Indicates if you want to preserve the created resources when deleting the EKS add-on.", "type": "boolean" }, "resolveConflicts": { "description": "(Deprecated use the resolve_conflicts_on_create and resolve_conflicts_on_update attributes instead) Define how to resolve parameter value conflicts when migrating an existing add-on to an Amazon EKS add-on or when applying version updates to the add-on. Valid values are NONE, OVERWRITE and PRESERVE. Note that PRESERVE is only valid on addon update, not for initial addon creation. If you need to set this to PRESERVE, use the resolve_conflicts_on_create and resolve_conflicts_on_update attributes instead. For more details check UpdateAddon API Docs.", "type": "string" }, "resolveConflictsOnCreate": { "description": "How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.", "type": "string" }, "resolveConflictsOnUpdate": { "description": "How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.", "type": "string" }, "serviceAccountRoleArn": { "description": "The Amazon Resource Name (ARN) of an\nexisting IAM role to bind to the add-on's service account. The role must be\nassigned the IAM permissions required by the add-on. If you don't specify\nan existing IAM role, then the add-on uses the permissions assigned to the node\nIAM role. For more information, see Amazon EKS node IAM role\nin the Amazon EKS User Guide.", "type": "string" }, "serviceAccountRoleArnRef": { "description": "Reference to a Role in iam to populate serviceAccountRoleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "serviceAccountRoleArnSelector": { "description": "Selector for a Role in iam to populate serviceAccountRoleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.addonName is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.addonName) || (has(self.initProvider) && has(self.initProvider.addonName))" } ] }, "status": { "description": "AddonStatus defines the observed state of Addon.", "properties": { "atProvider": { "properties": { "addonName": { "description": "on. The name must match one of\nthe names returned by describe-addon-versions.", "type": "string" }, "addonVersion": { "description": "on. The version must\nmatch one of the versions returned by describe-addon-versions.", "type": "string" }, "arn": { "description": "Amazon Resource Name (ARN) of the EKS add-on.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "configurationValues": { "description": "custom configuration values for addons with single JSON string. This JSON string value must match the JSON schema derived from describe-addon-configuration.", "type": "string" }, "createdAt": { "description": "Date and time in RFC3339 format that the EKS add-on was created.", "type": "string" }, "id": { "description": "EKS Cluster name and EKS Addon name separated by a colon (:).", "type": "string" }, "modifiedAt": { "description": "Date and time in RFC3339 format that the EKS add-on was updated.", "type": "string" }, "podIdentityAssociation": { "description": "Configuration block with EKS Pod Identity association settings. See pod_identity_association below for details.", "items": { "properties": { "roleArn": { "description": "The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity agent manages credentials to assume this role for applications in the containers in the pods that use this service account.", "type": "string" }, "serviceAccount": { "description": "The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.", "type": "string" } }, "type": "object" }, "type": "array" }, "preserve": { "description": "Indicates if you want to preserve the created resources when deleting the EKS add-on.", "type": "boolean" }, "resolveConflicts": { "description": "(Deprecated use the resolve_conflicts_on_create and resolve_conflicts_on_update attributes instead) Define how to resolve parameter value conflicts when migrating an existing add-on to an Amazon EKS add-on or when applying version updates to the add-on. Valid values are NONE, OVERWRITE and PRESERVE. Note that PRESERVE is only valid on addon update, not for initial addon creation. If you need to set this to PRESERVE, use the resolve_conflicts_on_create and resolve_conflicts_on_update attributes instead. For more details check UpdateAddon API Docs.", "type": "string" }, "resolveConflictsOnCreate": { "description": "How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are NONE and OVERWRITE. For more details see the CreateAddon API Docs.", "type": "string" }, "resolveConflictsOnUpdate": { "description": "How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are NONE, OVERWRITE, and PRESERVE. For more details see the UpdateAddon API Docs.", "type": "string" }, "serviceAccountRoleArn": { "description": "The Amazon Resource Name (ARN) of an\nexisting IAM role to bind to the add-on's service account. The role must be\nassigned the IAM permissions required by the add-on. If you don't specify\nan existing IAM role, then the add-on uses the permissions assigned to the node\nIAM role. For more information, see Amazon EKS node IAM role\nin the Amazon EKS User Guide.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "clusterauths.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "ClusterAuth", "listKind": "ClusterAuthList", "plural": "clusterauths", "singular": "clusterauth" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "ClusterAuth is used to retrieve Kubeconfig of given EKS cluster.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "ClusterAuthSpec defines the desired state of ClusterAuth", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "clusterName": { "description": "ClusterName is the name of the cluster you'd like to fetch Kubeconfig of.\nEither ClusterName, ClusterNameRef or ClusterNameSelector has to be given.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster to populate clusterName.\nEither ClusterName, ClusterNameRef or ClusterNameSelector has to be given.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster to populate clusterName.\nEither ClusterName, ClusterNameRef or ClusterNameSelector has to be given.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "refreshPeriod": { "default": "10m0s", "description": "RefreshPeriod is how frequently you'd like the token in the published\nKubeconfig to be refreshed. The maximum is 10m0s.\nThe default is 10m0s.", "type": "string" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" } }, "required": [ "region" ], "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object" }, "status": { "description": "ClusterAuthStatus defines the observed state of ClusterAuth.", "properties": { "atProvider": { "properties": { "lastRefreshTime": { "description": "LastRefreshTime is the time when the token was refreshed.", "format": "date-time", "type": "string" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "clusters.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "Cluster", "listKind": "ClusterList", "plural": "clusters", "singular": "cluster" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "Cluster is the Schema for the Clusters API. Manages an EKS Cluster", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "ClusterSpec defines the desired state of Cluster", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "accessConfig": { "description": "Configuration block for the access config associated with your cluster, see Amazon EKS Access Entries.", "items": { "properties": { "authenticationMode": { "description": "The authentication mode for the cluster. Valid values are CONFIG_MAP, API or API_AND_CONFIG_MAP", "type": "string" }, "bootstrapClusterCreatorAdminPermissions": { "description": "Whether or not to bootstrap the access config values to the cluster. Default is true.", "type": "boolean" } }, "type": "object" }, "type": "array" }, "bootstrapSelfManagedAddons": { "description": "Install default unmanaged add-ons, such as aws-cni, kube-proxy, and CoreDNS during cluster creation. If false, you must manually install desired add-ons. Changing this value will force a new cluster to be created. Defaults to true.", "type": "boolean" }, "computeConfig": { "description": "Configuration block with compute configuration for EKS Auto Mode. Detailed below.", "items": { "properties": { "enabled": { "description": "Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.", "type": "boolean" }, "nodePools": { "description": "Configuration for node pools that defines the compute resources for your EKS Auto Mode cluster. Valid options are general-purpose and system.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "nodeRoleArn": { "description": "The ARN of the IAM Role EKS will assign to EC2 Managed Instances in your EKS Auto Mode cluster. This value cannot be changed after the compute capability of EKS Auto Mode is enabled..", "type": "string" } }, "type": "object" }, "type": "array" }, "enabledClusterLogTypes": { "description": "List of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "encryptionConfig": { "description": "Configuration block with encryption configuration for the cluster. Only available on Kubernetes 1.13 and above clusters created after March 6, 2020. Detailed below.", "items": { "properties": { "provider": { "description": "Configuration block with provider for encryption. Detailed below.", "items": { "properties": { "keyArn": { "description": "ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide.", "type": "string" } }, "type": "object" }, "type": "array" }, "resources": { "description": "List of strings with resources to be encrypted. Valid values: secrets.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "kubernetesNetworkConfig": { "description": "Configuration block with kubernetes network configuration for the cluster. Detailed below.", "items": { "properties": { "elasticLoadBalancing": { "description": "Configuration block with elastic load balancing configuration for the cluster. Detailed below.", "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" }, "ipFamily": { "description": "The IP family used to assign Kubernetes pod and service addresses. Valid values are ipv4 (default) and ipv6. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.", "type": "string" }, "serviceIpv4Cidr": { "description": "The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:", "type": "string" } }, "type": "object" }, "type": "array" }, "outpostConfig": { "description": "Configuration block representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This block isn't available for creating Amazon EKS clusters on the AWS cloud.", "items": { "properties": { "controlPlaneInstanceType": { "description": "The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:", "type": "string" }, "controlPlanePlacement": { "description": "An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.\nThe control_plane_placement configuration block supports the following arguments:", "items": { "properties": { "groupName": { "description": "The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.", "type": "string" } }, "type": "object" }, "type": "array" }, "outpostArns": { "description": "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "remoteNetworkConfig": { "description": "Configuration block with remote network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "remoteNodeNetworks": { "description": "Configuration block with remote node network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "cidrs": { "description": "List of network CIDRs that can contain hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "remotePodNetworks": { "description": "Configuration block with remote pod network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "cidrs": { "description": "List of network CIDRs that can contain pods that run Kubernetes webhooks on hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "type": "array" }, "roleArn": { "description": "ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Ensure the resource configuration includes explicit dependencies on the IAM Role permissions by adding depends_on if using the aws_iam_role_policy resource or aws_iam_role_policy_attachment resource, otherwise EKS cannot delete EKS managed EC2 infrastructure such as Security Groups on EKS Cluster deletion.", "type": "string" }, "roleArnRef": { "description": "Reference to a Role in iam to populate roleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "roleArnSelector": { "description": "Selector for a Role in iam to populate roleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "storageConfig": { "description": "Configuration block with storage configuration for EKS Auto Mode. Detailed below.", "items": { "properties": { "blockStorage": { "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "type": "array" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "upgradePolicy": { "description": "Configuration block for the support policy to use for the cluster. See upgrade_policy for details.", "items": { "properties": { "supportType": { "description": "Support type to use for the cluster. If the cluster is set to EXTENDED, it will enter extended support at the end of standard support. If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support. Valid values are EXTENDED, STANDARD", "type": "string" } }, "type": "object" }, "type": "array" }, "version": { "description": "– Desired Kubernetes master version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except those automatically triggered by EKS. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by EKS.", "type": "string" }, "vpcConfig": { "description": "Configuration block for the VPC associated with your cluster. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. Detailed below. Also contains attributes detailed in the Attributes section.", "items": { "properties": { "endpointPrivateAccess": { "description": "Whether the Amazon EKS private API server endpoint is enabled. Default is false.", "type": "boolean" }, "endpointPublicAccess": { "description": "Whether the Amazon EKS public API server endpoint is enabled. Default is true.", "type": "boolean" }, "index": { "default": "0", "description": "This is an injected field with a default value for being able to merge items of the parent object list.", "type": "string" }, "publicAccessCidrs": { "description": "List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "securityGroupIdRefs": { "description": "References to SecurityGroup in ec2 to populate securityGroupIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "securityGroupIdSelector": { "description": "Selector for a list of SecurityGroup in ec2 to populate securityGroupIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "securityGroupIds": { "description": "account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "account elastic network interfaces in these subnets to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "index" ], "x-kubernetes-list-type": "map" }, "zonalShiftConfig": { "description": "Configuration block with zonal shift configuration for the cluster. Detailed below.", "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "accessConfig": { "description": "Configuration block for the access config associated with your cluster, see Amazon EKS Access Entries.", "items": { "properties": { "authenticationMode": { "description": "The authentication mode for the cluster. Valid values are CONFIG_MAP, API or API_AND_CONFIG_MAP", "type": "string" }, "bootstrapClusterCreatorAdminPermissions": { "description": "Whether or not to bootstrap the access config values to the cluster. Default is true.", "type": "boolean" } }, "type": "object" }, "type": "array" }, "bootstrapSelfManagedAddons": { "description": "Install default unmanaged add-ons, such as aws-cni, kube-proxy, and CoreDNS during cluster creation. If false, you must manually install desired add-ons. Changing this value will force a new cluster to be created. Defaults to true.", "type": "boolean" }, "computeConfig": { "description": "Configuration block with compute configuration for EKS Auto Mode. Detailed below.", "items": { "properties": { "enabled": { "description": "Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.", "type": "boolean" }, "nodePools": { "description": "Configuration for node pools that defines the compute resources for your EKS Auto Mode cluster. Valid options are general-purpose and system.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "nodeRoleArn": { "description": "The ARN of the IAM Role EKS will assign to EC2 Managed Instances in your EKS Auto Mode cluster. This value cannot be changed after the compute capability of EKS Auto Mode is enabled..", "type": "string" } }, "type": "object" }, "type": "array" }, "enabledClusterLogTypes": { "description": "List of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "encryptionConfig": { "description": "Configuration block with encryption configuration for the cluster. Only available on Kubernetes 1.13 and above clusters created after March 6, 2020. Detailed below.", "items": { "properties": { "provider": { "description": "Configuration block with provider for encryption. Detailed below.", "items": { "properties": { "keyArn": { "description": "ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide.", "type": "string" } }, "type": "object" }, "type": "array" }, "resources": { "description": "List of strings with resources to be encrypted. Valid values: secrets.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "kubernetesNetworkConfig": { "description": "Configuration block with kubernetes network configuration for the cluster. Detailed below.", "items": { "properties": { "elasticLoadBalancing": { "description": "Configuration block with elastic load balancing configuration for the cluster. Detailed below.", "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" }, "ipFamily": { "description": "The IP family used to assign Kubernetes pod and service addresses. Valid values are ipv4 (default) and ipv6. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.", "type": "string" }, "serviceIpv4Cidr": { "description": "The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:", "type": "string" } }, "type": "object" }, "type": "array" }, "outpostConfig": { "description": "Configuration block representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This block isn't available for creating Amazon EKS clusters on the AWS cloud.", "items": { "properties": { "controlPlaneInstanceType": { "description": "The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:", "type": "string" }, "controlPlanePlacement": { "description": "An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.\nThe control_plane_placement configuration block supports the following arguments:", "items": { "properties": { "groupName": { "description": "The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.", "type": "string" } }, "type": "object" }, "type": "array" }, "outpostArns": { "description": "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "remoteNetworkConfig": { "description": "Configuration block with remote network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "remoteNodeNetworks": { "description": "Configuration block with remote node network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "cidrs": { "description": "List of network CIDRs that can contain hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "remotePodNetworks": { "description": "Configuration block with remote pod network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "cidrs": { "description": "List of network CIDRs that can contain pods that run Kubernetes webhooks on hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "type": "array" }, "roleArn": { "description": "ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Ensure the resource configuration includes explicit dependencies on the IAM Role permissions by adding depends_on if using the aws_iam_role_policy resource or aws_iam_role_policy_attachment resource, otherwise EKS cannot delete EKS managed EC2 infrastructure such as Security Groups on EKS Cluster deletion.", "type": "string" }, "roleArnRef": { "description": "Reference to a Role in iam to populate roleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "roleArnSelector": { "description": "Selector for a Role in iam to populate roleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "storageConfig": { "description": "Configuration block with storage configuration for EKS Auto Mode. Detailed below.", "items": { "properties": { "blockStorage": { "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "type": "array" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "upgradePolicy": { "description": "Configuration block for the support policy to use for the cluster. See upgrade_policy for details.", "items": { "properties": { "supportType": { "description": "Support type to use for the cluster. If the cluster is set to EXTENDED, it will enter extended support at the end of standard support. If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support. Valid values are EXTENDED, STANDARD", "type": "string" } }, "type": "object" }, "type": "array" }, "version": { "description": "– Desired Kubernetes master version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except those automatically triggered by EKS. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by EKS.", "type": "string" }, "vpcConfig": { "description": "Configuration block for the VPC associated with your cluster. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. Detailed below. Also contains attributes detailed in the Attributes section.", "items": { "properties": { "endpointPrivateAccess": { "description": "Whether the Amazon EKS private API server endpoint is enabled. Default is false.", "type": "boolean" }, "endpointPublicAccess": { "description": "Whether the Amazon EKS public API server endpoint is enabled. Default is true.", "type": "boolean" }, "index": { "default": "0", "description": "This is an injected field with a default value for being able to merge items of the parent object list.", "type": "string" }, "publicAccessCidrs": { "description": "List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "securityGroupIdRefs": { "description": "References to SecurityGroup in ec2 to populate securityGroupIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "securityGroupIdSelector": { "description": "Selector for a list of SecurityGroup in ec2 to populate securityGroupIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "securityGroupIds": { "description": "account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "account elastic network interfaces in these subnets to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "index" ], "x-kubernetes-list-type": "map" }, "zonalShiftConfig": { "description": "Configuration block with zonal shift configuration for the cluster. Detailed below.", "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.vpcConfig is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.vpcConfig) || (has(self.initProvider) && has(self.initProvider.vpcConfig))" } ] }, "status": { "description": "ClusterStatus defines the observed state of Cluster.", "properties": { "atProvider": { "properties": { "accessConfig": { "description": "Configuration block for the access config associated with your cluster, see Amazon EKS Access Entries.", "items": { "properties": { "authenticationMode": { "description": "The authentication mode for the cluster. Valid values are CONFIG_MAP, API or API_AND_CONFIG_MAP", "type": "string" }, "bootstrapClusterCreatorAdminPermissions": { "description": "Whether or not to bootstrap the access config values to the cluster. Default is true.", "type": "boolean" } }, "type": "object" }, "type": "array" }, "arn": { "description": "ARN of the cluster.", "type": "string" }, "bootstrapSelfManagedAddons": { "description": "Install default unmanaged add-ons, such as aws-cni, kube-proxy, and CoreDNS during cluster creation. If false, you must manually install desired add-ons. Changing this value will force a new cluster to be created. Defaults to true.", "type": "boolean" }, "certificateAuthority": { "description": "Attribute block containing certificate-authority-data for your cluster. Detailed below.", "items": { "properties": { "data": { "description": "Base64 encoded certificate data required to communicate with your cluster. Add this to the certificate-authority-data section of the kubeconfig file for your cluster.", "type": "string" } }, "type": "object" }, "type": "array" }, "clusterId": { "description": "The ID of your local Amazon EKS cluster on the AWS Outpost. This attribute isn't available for an AWS EKS cluster on AWS cloud.", "type": "string" }, "computeConfig": { "description": "Configuration block with compute configuration for EKS Auto Mode. Detailed below.", "items": { "properties": { "enabled": { "description": "Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.", "type": "boolean" }, "nodePools": { "description": "Configuration for node pools that defines the compute resources for your EKS Auto Mode cluster. Valid options are general-purpose and system.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "nodeRoleArn": { "description": "The ARN of the IAM Role EKS will assign to EC2 Managed Instances in your EKS Auto Mode cluster. This value cannot be changed after the compute capability of EKS Auto Mode is enabled..", "type": "string" } }, "type": "object" }, "type": "array" }, "createdAt": { "description": "Unix epoch timestamp in seconds for when the cluster was created.", "type": "string" }, "enabledClusterLogTypes": { "description": "List of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "encryptionConfig": { "description": "Configuration block with encryption configuration for the cluster. Only available on Kubernetes 1.13 and above clusters created after March 6, 2020. Detailed below.", "items": { "properties": { "provider": { "description": "Configuration block with provider for encryption. Detailed below.", "items": { "properties": { "keyArn": { "description": "ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide.", "type": "string" } }, "type": "object" }, "type": "array" }, "resources": { "description": "List of strings with resources to be encrypted. Valid values: secrets.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "endpoint": { "description": "Endpoint for your Kubernetes API server.", "type": "string" }, "id": { "description": "Name of the cluster.", "type": "string" }, "identity": { "description": "Attribute block containing identity provider information for your cluster. Only available on Kubernetes version 1.13 and 1.14 clusters created or upgraded on or after September 3, 2019. Detailed below.", "items": { "properties": { "oidc": { "description": "Nested block containing OpenID Connect identity provider information for the cluster. Detailed below.", "items": { "properties": { "issuer": { "description": "Issuer URL for the OpenID Connect identity provider.", "type": "string" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "type": "array" }, "kubernetesNetworkConfig": { "description": "Configuration block with kubernetes network configuration for the cluster. Detailed below.", "items": { "properties": { "elasticLoadBalancing": { "description": "Configuration block with elastic load balancing configuration for the cluster. Detailed below.", "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" }, "ipFamily": { "description": "The IP family used to assign Kubernetes pod and service addresses. Valid values are ipv4 (default) and ipv6. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.", "type": "string" }, "serviceIpv4Cidr": { "description": "The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:", "type": "string" }, "serviceIpv6Cidr": { "description": "The CIDR block that Kubernetes pod and service IP addresses are assigned from if you specified ipv6 for ipFamily when you created the cluster. Kubernetes assigns service addresses from the unique local address range (fc00::/7) because you can't specify a custom IPv6 CIDR block when you create the cluster.", "type": "string" } }, "type": "object" }, "type": "array" }, "outpostConfig": { "description": "Configuration block representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This block isn't available for creating Amazon EKS clusters on the AWS cloud.", "items": { "properties": { "controlPlaneInstanceType": { "description": "The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:", "type": "string" }, "controlPlanePlacement": { "description": "An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.\nThe control_plane_placement configuration block supports the following arguments:", "items": { "properties": { "groupName": { "description": "The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.", "type": "string" } }, "type": "object" }, "type": "array" }, "outpostArns": { "description": "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "platformVersion": { "description": "Platform version for the cluster.", "type": "string" }, "remoteNetworkConfig": { "description": "Configuration block with remote network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "remoteNodeNetworks": { "description": "Configuration block with remote node network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "cidrs": { "description": "List of network CIDRs that can contain hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "remotePodNetworks": { "description": "Configuration block with remote pod network configuration for EKS Hybrid Nodes. Detailed below.", "items": { "properties": { "cidrs": { "description": "List of network CIDRs that can contain pods that run Kubernetes webhooks on hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "type": "array" }, "roleArn": { "description": "ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Ensure the resource configuration includes explicit dependencies on the IAM Role permissions by adding depends_on if using the aws_iam_role_policy resource or aws_iam_role_policy_attachment resource, otherwise EKS cannot delete EKS managed EC2 infrastructure such as Security Groups on EKS Cluster deletion.", "type": "string" }, "status": { "description": "Status of the EKS cluster. One of CREATING, ACTIVE, DELETING, FAILED.", "type": "string" }, "storageConfig": { "description": "Configuration block with storage configuration for EKS Auto Mode. Detailed below.", "items": { "properties": { "blockStorage": { "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "type": "array" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" }, "upgradePolicy": { "description": "Configuration block for the support policy to use for the cluster. See upgrade_policy for details.", "items": { "properties": { "supportType": { "description": "Support type to use for the cluster. If the cluster is set to EXTENDED, it will enter extended support at the end of standard support. If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support. Valid values are EXTENDED, STANDARD", "type": "string" } }, "type": "object" }, "type": "array" }, "version": { "description": "– Desired Kubernetes master version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except those automatically triggered by EKS. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by EKS.", "type": "string" }, "vpcConfig": { "description": "Configuration block for the VPC associated with your cluster. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. Detailed below. Also contains attributes detailed in the Attributes section.", "items": { "properties": { "clusterSecurityGroupId": { "description": "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication.", "type": "string" }, "endpointPrivateAccess": { "description": "Whether the Amazon EKS private API server endpoint is enabled. Default is false.", "type": "boolean" }, "endpointPublicAccess": { "description": "Whether the Amazon EKS public API server endpoint is enabled. Default is true.", "type": "boolean" }, "index": { "default": "0", "description": "This is an injected field with a default value for being able to merge items of the parent object list.", "type": "string" }, "publicAccessCidrs": { "description": "List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "securityGroupIds": { "description": "account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "subnetIds": { "description": "account elastic network interfaces in these subnets to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "vpcId": { "description": "ID of the VPC associated with your cluster.", "type": "string" } }, "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "index" ], "x-kubernetes-list-type": "map" }, "zonalShiftConfig": { "description": "Configuration block with zonal shift configuration for the cluster. Detailed below.", "items": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } }, { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta2", "schema": { "openAPIV3Schema": { "description": "Cluster is the Schema for the Clusters API. Manages an EKS Cluster", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "ClusterSpec defines the desired state of Cluster", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "accessConfig": { "description": "Configuration block for the access config associated with your cluster, see Amazon EKS Access Entries.", "properties": { "authenticationMode": { "description": "The authentication mode for the cluster. Valid values are CONFIG_MAP, API or API_AND_CONFIG_MAP", "type": "string" }, "bootstrapClusterCreatorAdminPermissions": { "description": "Whether or not to bootstrap the access config values to the cluster. Default is false.", "type": "boolean" } }, "type": "object" }, "bootstrapSelfManagedAddons": { "description": "Install default unmanaged add-ons, such as aws-cni, kube-proxy, and CoreDNS during cluster creation. If false, you must manually install desired add-ons. Changing this value will force a new cluster to be created. Defaults to true.", "type": "boolean" }, "computeConfig": { "description": "Configuration block with compute configuration for EKS Auto Mode. Detailed below.", "properties": { "enabled": { "description": "Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.", "type": "boolean" }, "nodePools": { "description": "Configuration for node pools that defines the compute resources for your EKS Auto Mode cluster. Valid options are general-purpose and system.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "nodeRoleArn": { "description": "The ARN of the IAM Role EKS will assign to EC2 Managed Instances in your EKS Auto Mode cluster. This value cannot be changed after the compute capability of EKS Auto Mode is enabled..", "type": "string" } }, "type": "object" }, "enabledClusterLogTypes": { "description": "List of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "encryptionConfig": { "description": "Configuration block with encryption configuration for the cluster. Detailed below.", "properties": { "provider": { "description": "Configuration block with provider for encryption. Detailed below.", "properties": { "keyArn": { "description": "ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide.", "type": "string" } }, "type": "object" }, "resources": { "description": "List of strings with resources to be encrypted. Valid values: secrets.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "kubernetesNetworkConfig": { "description": "Configuration block with kubernetes network configuration for the cluster. Detailed below.", "properties": { "elasticLoadBalancing": { "description": "Configuration block with elastic load balancing configuration for the cluster. Detailed below.", "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "ipFamily": { "description": "The IP family used to assign Kubernetes pod and service addresses. Valid values are ipv4 (default) and ipv6. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.", "type": "string" }, "serviceIpv4Cidr": { "description": "The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:", "type": "string" } }, "type": "object" }, "outpostConfig": { "description": "Configuration block representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This block isn't available for creating Amazon EKS clusters on the AWS cloud.", "properties": { "controlPlaneInstanceType": { "description": "The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:", "type": "string" }, "controlPlanePlacement": { "description": "An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.\nThe control_plane_placement configuration block supports the following arguments:", "properties": { "groupName": { "description": "The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.", "type": "string" } }, "type": "object" }, "outpostArns": { "description": "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "remoteNetworkConfig": { "description": "Configuration block with remote network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "remoteNodeNetworks": { "description": "Configuration block with remote node network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "cidrs": { "description": "List of network CIDRs that can contain hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "remotePodNetworks": { "description": "Configuration block with remote pod network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "cidrs": { "description": "List of network CIDRs that can contain pods that run Kubernetes webhooks on hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" } }, "type": "object" }, "roleArn": { "description": "ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Ensure the resource configuration includes explicit dependencies on the IAM Role permissions by adding depends_on if using the aws_iam_role_policy resource or aws_iam_role_policy_attachment resource, otherwise EKS cannot delete EKS managed EC2 infrastructure such as Security Groups on EKS Cluster deletion.", "type": "string" }, "roleArnRef": { "description": "Reference to a Role in iam to populate roleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "roleArnSelector": { "description": "Selector for a Role in iam to populate roleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "storageConfig": { "description": "Configuration block with storage configuration for EKS Auto Mode. Detailed below.", "properties": { "blockStorage": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" } }, "type": "object" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "upgradePolicy": { "description": "Configuration block for the support policy to use for the cluster. See upgrade_policy for details.", "properties": { "supportType": { "description": "Support type to use for the cluster. If the cluster is set to EXTENDED, it will enter extended support at the end of standard support. If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support. Valid values are EXTENDED, STANDARD", "type": "string" } }, "type": "object" }, "version": { "description": "– Desired Kubernetes master version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except those automatically triggered by EKS. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by EKS.", "type": "string" }, "vpcConfig": { "description": "Configuration block for the VPC associated with your cluster. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. Detailed below. Also contains attributes detailed in the Attributes section.", "properties": { "endpointPrivateAccess": { "description": "Whether the Amazon EKS private API server endpoint is enabled. Default is false.", "type": "boolean" }, "endpointPublicAccess": { "description": "Whether the Amazon EKS public API server endpoint is enabled. Default is true.", "type": "boolean" }, "publicAccessCidrs": { "description": "List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "securityGroupIdRefs": { "description": "References to SecurityGroup in ec2 to populate securityGroupIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "securityGroupIdSelector": { "description": "Selector for a list of SecurityGroup in ec2 to populate securityGroupIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "securityGroupIds": { "description": "account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "account elastic network interfaces in these subnets to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "zonalShiftConfig": { "description": "Configuration block with zonal shift configuration for the cluster. Detailed below.", "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "accessConfig": { "description": "Configuration block for the access config associated with your cluster, see Amazon EKS Access Entries.", "properties": { "authenticationMode": { "description": "The authentication mode for the cluster. Valid values are CONFIG_MAP, API or API_AND_CONFIG_MAP", "type": "string" }, "bootstrapClusterCreatorAdminPermissions": { "description": "Whether or not to bootstrap the access config values to the cluster. Default is false.", "type": "boolean" } }, "type": "object" }, "bootstrapSelfManagedAddons": { "description": "Install default unmanaged add-ons, such as aws-cni, kube-proxy, and CoreDNS during cluster creation. If false, you must manually install desired add-ons. Changing this value will force a new cluster to be created. Defaults to true.", "type": "boolean" }, "computeConfig": { "description": "Configuration block with compute configuration for EKS Auto Mode. Detailed below.", "properties": { "enabled": { "description": "Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.", "type": "boolean" }, "nodePools": { "description": "Configuration for node pools that defines the compute resources for your EKS Auto Mode cluster. Valid options are general-purpose and system.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "nodeRoleArn": { "description": "The ARN of the IAM Role EKS will assign to EC2 Managed Instances in your EKS Auto Mode cluster. This value cannot be changed after the compute capability of EKS Auto Mode is enabled..", "type": "string" } }, "type": "object" }, "enabledClusterLogTypes": { "description": "List of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "encryptionConfig": { "description": "Configuration block with encryption configuration for the cluster. Detailed below.", "properties": { "provider": { "description": "Configuration block with provider for encryption. Detailed below.", "properties": { "keyArn": { "description": "ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide.", "type": "string" } }, "type": "object" }, "resources": { "description": "List of strings with resources to be encrypted. Valid values: secrets.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "kubernetesNetworkConfig": { "description": "Configuration block with kubernetes network configuration for the cluster. Detailed below.", "properties": { "elasticLoadBalancing": { "description": "Configuration block with elastic load balancing configuration for the cluster. Detailed below.", "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "ipFamily": { "description": "The IP family used to assign Kubernetes pod and service addresses. Valid values are ipv4 (default) and ipv6. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.", "type": "string" }, "serviceIpv4Cidr": { "description": "The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:", "type": "string" } }, "type": "object" }, "outpostConfig": { "description": "Configuration block representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This block isn't available for creating Amazon EKS clusters on the AWS cloud.", "properties": { "controlPlaneInstanceType": { "description": "The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:", "type": "string" }, "controlPlanePlacement": { "description": "An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.\nThe control_plane_placement configuration block supports the following arguments:", "properties": { "groupName": { "description": "The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.", "type": "string" } }, "type": "object" }, "outpostArns": { "description": "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "remoteNetworkConfig": { "description": "Configuration block with remote network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "remoteNodeNetworks": { "description": "Configuration block with remote node network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "cidrs": { "description": "List of network CIDRs that can contain hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "remotePodNetworks": { "description": "Configuration block with remote pod network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "cidrs": { "description": "List of network CIDRs that can contain pods that run Kubernetes webhooks on hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" } }, "type": "object" }, "roleArn": { "description": "ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Ensure the resource configuration includes explicit dependencies on the IAM Role permissions by adding depends_on if using the aws_iam_role_policy resource or aws_iam_role_policy_attachment resource, otherwise EKS cannot delete EKS managed EC2 infrastructure such as Security Groups on EKS Cluster deletion.", "type": "string" }, "roleArnRef": { "description": "Reference to a Role in iam to populate roleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "roleArnSelector": { "description": "Selector for a Role in iam to populate roleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "storageConfig": { "description": "Configuration block with storage configuration for EKS Auto Mode. Detailed below.", "properties": { "blockStorage": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" } }, "type": "object" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "upgradePolicy": { "description": "Configuration block for the support policy to use for the cluster. See upgrade_policy for details.", "properties": { "supportType": { "description": "Support type to use for the cluster. If the cluster is set to EXTENDED, it will enter extended support at the end of standard support. If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support. Valid values are EXTENDED, STANDARD", "type": "string" } }, "type": "object" }, "version": { "description": "– Desired Kubernetes master version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except those automatically triggered by EKS. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by EKS.", "type": "string" }, "vpcConfig": { "description": "Configuration block for the VPC associated with your cluster. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. Detailed below. Also contains attributes detailed in the Attributes section.", "properties": { "endpointPrivateAccess": { "description": "Whether the Amazon EKS private API server endpoint is enabled. Default is false.", "type": "boolean" }, "endpointPublicAccess": { "description": "Whether the Amazon EKS public API server endpoint is enabled. Default is true.", "type": "boolean" }, "publicAccessCidrs": { "description": "List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "securityGroupIdRefs": { "description": "References to SecurityGroup in ec2 to populate securityGroupIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "securityGroupIdSelector": { "description": "Selector for a list of SecurityGroup in ec2 to populate securityGroupIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "securityGroupIds": { "description": "account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "account elastic network interfaces in these subnets to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "zonalShiftConfig": { "description": "Configuration block with zonal shift configuration for the cluster. Detailed below.", "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.vpcConfig is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.vpcConfig) || (has(self.initProvider) && has(self.initProvider.vpcConfig))" } ] }, "status": { "description": "ClusterStatus defines the observed state of Cluster.", "properties": { "atProvider": { "properties": { "accessConfig": { "description": "Configuration block for the access config associated with your cluster, see Amazon EKS Access Entries.", "properties": { "authenticationMode": { "description": "The authentication mode for the cluster. Valid values are CONFIG_MAP, API or API_AND_CONFIG_MAP", "type": "string" }, "bootstrapClusterCreatorAdminPermissions": { "description": "Whether or not to bootstrap the access config values to the cluster. Default is false.", "type": "boolean" } }, "type": "object" }, "arn": { "description": "ARN of the cluster.", "type": "string" }, "bootstrapSelfManagedAddons": { "description": "Install default unmanaged add-ons, such as aws-cni, kube-proxy, and CoreDNS during cluster creation. If false, you must manually install desired add-ons. Changing this value will force a new cluster to be created. Defaults to true.", "type": "boolean" }, "certificateAuthority": { "description": "Attribute block containing certificate-authority-data for your cluster. Detailed below.", "items": { "properties": { "data": { "description": "Base64 encoded certificate data required to communicate with your cluster. Add this to the certificate-authority-data section of the kubeconfig file for your cluster.", "type": "string" } }, "type": "object" }, "type": "array" }, "clusterId": { "description": "The ID of your local Amazon EKS cluster on the AWS Outpost. This attribute isn't available for an AWS EKS cluster on AWS cloud.", "type": "string" }, "computeConfig": { "description": "Configuration block with compute configuration for EKS Auto Mode. Detailed below.", "properties": { "enabled": { "description": "Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.", "type": "boolean" }, "nodePools": { "description": "Configuration for node pools that defines the compute resources for your EKS Auto Mode cluster. Valid options are general-purpose and system.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "nodeRoleArn": { "description": "The ARN of the IAM Role EKS will assign to EC2 Managed Instances in your EKS Auto Mode cluster. This value cannot be changed after the compute capability of EKS Auto Mode is enabled..", "type": "string" } }, "type": "object" }, "createdAt": { "description": "Unix epoch timestamp in seconds for when the cluster was created.", "type": "string" }, "enabledClusterLogTypes": { "description": "List of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "encryptionConfig": { "description": "Configuration block with encryption configuration for the cluster. Detailed below.", "properties": { "provider": { "description": "Configuration block with provider for encryption. Detailed below.", "properties": { "keyArn": { "description": "ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide.", "type": "string" } }, "type": "object" }, "resources": { "description": "List of strings with resources to be encrypted. Valid values: secrets.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "endpoint": { "description": "Endpoint for your Kubernetes API server.", "type": "string" }, "id": { "description": "Name of the cluster.", "type": "string" }, "identity": { "description": "Attribute block containing identity provider information for your cluster. Only available on Kubernetes version 1.13 and 1.14 clusters created or upgraded on or after September 3, 2019. Detailed below.", "items": { "properties": { "oidc": { "description": "Nested block containing OpenID Connect identity provider information for the cluster. Detailed below.", "items": { "properties": { "issuer": { "description": "Issuer URL for the OpenID Connect identity provider.", "type": "string" } }, "type": "object" }, "type": "array" } }, "type": "object" }, "type": "array" }, "kubernetesNetworkConfig": { "description": "Configuration block with kubernetes network configuration for the cluster. Detailed below.", "properties": { "elasticLoadBalancing": { "description": "Configuration block with elastic load balancing configuration for the cluster. Detailed below.", "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" }, "ipFamily": { "description": "The IP family used to assign Kubernetes pod and service addresses. Valid values are ipv4 (default) and ipv6. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.", "type": "string" }, "serviceIpv4Cidr": { "description": "The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:", "type": "string" }, "serviceIpv6Cidr": { "description": "The CIDR block that Kubernetes pod and service IP addresses are assigned from if you specified ipv6 for ip_family when you created the cluster. Kubernetes assigns service addresses from the unique local address range (fc00::/7) because you can't specify a custom IPv6 CIDR block when you create the cluster.", "type": "string" } }, "type": "object" }, "outpostConfig": { "description": "Configuration block representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This block isn't available for creating Amazon EKS clusters on the AWS cloud.", "properties": { "controlPlaneInstanceType": { "description": "The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:", "type": "string" }, "controlPlanePlacement": { "description": "An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.\nThe control_plane_placement configuration block supports the following arguments:", "properties": { "groupName": { "description": "The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.", "type": "string" } }, "type": "object" }, "outpostArns": { "description": "The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "platformVersion": { "description": "Platform version for the cluster.", "type": "string" }, "remoteNetworkConfig": { "description": "Configuration block with remote network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "remoteNodeNetworks": { "description": "Configuration block with remote node network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "cidrs": { "description": "List of network CIDRs that can contain hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "remotePodNetworks": { "description": "Configuration block with remote pod network configuration for EKS Hybrid Nodes. Detailed below.", "properties": { "cidrs": { "description": "List of network CIDRs that can contain pods that run Kubernetes webhooks on hybrid nodes.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" } }, "type": "object" }, "roleArn": { "description": "ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Ensure the resource configuration includes explicit dependencies on the IAM Role permissions by adding depends_on if using the aws_iam_role_policy resource or aws_iam_role_policy_attachment resource, otherwise EKS cannot delete EKS managed EC2 infrastructure such as Security Groups on EKS Cluster deletion.", "type": "string" }, "status": { "description": "Status of the EKS cluster. One of CREATING, ACTIVE, DELETING, FAILED.", "type": "string" }, "storageConfig": { "description": "Configuration block with storage configuration for EKS Auto Mode. Detailed below.", "properties": { "blockStorage": { "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" } }, "type": "object" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "Map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" }, "upgradePolicy": { "description": "Configuration block for the support policy to use for the cluster. See upgrade_policy for details.", "properties": { "supportType": { "description": "Support type to use for the cluster. If the cluster is set to EXTENDED, it will enter extended support at the end of standard support. If the cluster is set to STANDARD, it will be automatically upgraded at the end of standard support. Valid values are EXTENDED, STANDARD", "type": "string" } }, "type": "object" }, "version": { "description": "– Desired Kubernetes master version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except those automatically triggered by EKS. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by EKS.", "type": "string" }, "vpcConfig": { "description": "Configuration block for the VPC associated with your cluster. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations and Cluster Security Group Considerations in the Amazon EKS User Guide. Detailed below. Also contains attributes detailed in the Attributes section.", "properties": { "clusterSecurityGroupId": { "description": "Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication.", "type": "string" }, "endpointPrivateAccess": { "description": "Whether the Amazon EKS private API server endpoint is enabled. Default is false.", "type": "boolean" }, "endpointPublicAccess": { "description": "Whether the Amazon EKS public API server endpoint is enabled. Default is true.", "type": "boolean" }, "publicAccessCidrs": { "description": "List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "securityGroupIds": { "description": "account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "subnetIds": { "description": "account elastic network interfaces in these subnets to allow communication between your worker nodes and the Kubernetes control plane.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "vpcId": { "description": "ID of the VPC associated with your cluster.", "type": "string" } }, "type": "object" }, "zonalShiftConfig": { "description": "Configuration block with zonal shift configuration for the cluster. Detailed below.", "properties": { "enabled": { "description": "Whether zonal shift is enabled for the cluster.", "type": "boolean" } }, "type": "object" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": false, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "fargateprofiles.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "FargateProfile", "listKind": "FargateProfileList", "plural": "fargateprofiles", "singular": "fargateprofile" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "FargateProfile is the Schema for the FargateProfiles API. Manages an EKS Fargate Profile", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "FargateProfileSpec defines the desired state of FargateProfile", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "podExecutionRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Fargate Profile.", "type": "string" }, "podExecutionRoleArnRef": { "description": "Reference to a Role in iam to populate podExecutionRoleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "podExecutionRoleArnSelector": { "description": "Selector for a Role in iam to populate podExecutionRoleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "selector": { "description": "Configuration block(s) for selecting Kubernetes Pods to execute with this EKS Fargate Profile. Detailed below.", "items": { "properties": { "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels for selection.", "type": "object", "x-kubernetes-map-type": "granular" }, "namespace": { "description": "Kubernetes namespace for selection.", "type": "string" } }, "type": "object" }, "type": "array" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "– Identifiers of private EC2 Subnets to associate with the EKS Fargate Profile. These subnets must have the following resource tag: kubernetes.io/cluster/CLUSTER_NAME (where CLUSTER_NAME is replaced with the name of the EKS Cluster).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "podExecutionRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Fargate Profile.", "type": "string" }, "podExecutionRoleArnRef": { "description": "Reference to a Role in iam to populate podExecutionRoleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "podExecutionRoleArnSelector": { "description": "Selector for a Role in iam to populate podExecutionRoleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "selector": { "description": "Configuration block(s) for selecting Kubernetes Pods to execute with this EKS Fargate Profile. Detailed below.", "items": { "properties": { "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels for selection.", "type": "object", "x-kubernetes-map-type": "granular" }, "namespace": { "description": "Kubernetes namespace for selection.", "type": "string" } }, "type": "object" }, "type": "array" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "– Identifiers of private EC2 Subnets to associate with the EKS Fargate Profile. These subnets must have the following resource tag: kubernetes.io/cluster/CLUSTER_NAME (where CLUSTER_NAME is replaced with the name of the EKS Cluster).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.selector is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.selector) || (has(self.initProvider) && has(self.initProvider.selector))" } ] }, "status": { "description": "FargateProfileStatus defines the observed state of FargateProfile.", "properties": { "atProvider": { "properties": { "arn": { "description": "Amazon Resource Name (ARN) of the EKS Fargate Profile.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "id": { "description": "EKS Cluster name and EKS Fargate Profile name separated by a colon (:).", "type": "string" }, "podExecutionRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Fargate Profile.", "type": "string" }, "selector": { "description": "Configuration block(s) for selecting Kubernetes Pods to execute with this EKS Fargate Profile. Detailed below.", "items": { "properties": { "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels for selection.", "type": "object", "x-kubernetes-map-type": "granular" }, "namespace": { "description": "Kubernetes namespace for selection.", "type": "string" } }, "type": "object" }, "type": "array" }, "status": { "description": "Status of the EKS Fargate Profile.", "type": "string" }, "subnetIds": { "description": "– Identifiers of private EC2 Subnets to associate with the EKS Fargate Profile. These subnets must have the following resource tag: kubernetes.io/cluster/CLUSTER_NAME (where CLUSTER_NAME is replaced with the name of the EKS Cluster).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "identityproviderconfigs.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "IdentityProviderConfig", "listKind": "IdentityProviderConfigList", "plural": "identityproviderconfigs", "singular": "identityproviderconfig" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "IdentityProviderConfig is the Schema for the IdentityProviderConfigs API. Manages an EKS Identity Provider Configuration.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "IdentityProviderConfigSpec defines the desired state of IdentityProviderConfig", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "oidc": { "description": "Nested attribute containing OpenID Connect identity provider information for the cluster. Detailed below.", "items": { "properties": { "clientId": { "description": "– Client ID for the OpenID Connect identity provider.", "type": "string" }, "groupsClaim": { "description": "The JWT claim that the provider will use to return groups.", "type": "string" }, "groupsPrefix": { "description": "A prefix that is prepended to group claims e.g., oidc:.", "type": "string" }, "issuerUrl": { "description": "Issuer URL for the OpenID Connect identity provider.", "type": "string" }, "requiredClaims": { "additionalProperties": { "type": "string" }, "description": "The key value pairs that describe required claims in the identity token.", "type": "object", "x-kubernetes-map-type": "granular" }, "usernameClaim": { "description": "The JWT claim that the provider will use as the username.", "type": "string" }, "usernamePrefix": { "description": "A prefix that is prepended to username claims.", "type": "string" } }, "type": "object" }, "type": "array" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "oidc": { "description": "Nested attribute containing OpenID Connect identity provider information for the cluster. Detailed below.", "items": { "properties": { "clientId": { "description": "– Client ID for the OpenID Connect identity provider.", "type": "string" }, "groupsClaim": { "description": "The JWT claim that the provider will use to return groups.", "type": "string" }, "groupsPrefix": { "description": "A prefix that is prepended to group claims e.g., oidc:.", "type": "string" }, "issuerUrl": { "description": "Issuer URL for the OpenID Connect identity provider.", "type": "string" }, "requiredClaims": { "additionalProperties": { "type": "string" }, "description": "The key value pairs that describe required claims in the identity token.", "type": "object", "x-kubernetes-map-type": "granular" }, "usernameClaim": { "description": "The JWT claim that the provider will use as the username.", "type": "string" }, "usernamePrefix": { "description": "A prefix that is prepended to username claims.", "type": "string" } }, "type": "object" }, "type": "array" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.oidc is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.oidc) || (has(self.initProvider) && has(self.initProvider.oidc))" } ] }, "status": { "description": "IdentityProviderConfigStatus defines the observed state of IdentityProviderConfig.", "properties": { "atProvider": { "properties": { "arn": { "description": "Amazon Resource Name (ARN) of the EKS Identity Provider Configuration.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "id": { "description": "EKS Cluster name and EKS Identity Provider Configuration name separated by a colon (:).", "type": "string" }, "oidc": { "description": "Nested attribute containing OpenID Connect identity provider information for the cluster. Detailed below.", "items": { "properties": { "clientId": { "description": "– Client ID for the OpenID Connect identity provider.", "type": "string" }, "groupsClaim": { "description": "The JWT claim that the provider will use to return groups.", "type": "string" }, "groupsPrefix": { "description": "A prefix that is prepended to group claims e.g., oidc:.", "type": "string" }, "issuerUrl": { "description": "Issuer URL for the OpenID Connect identity provider.", "type": "string" }, "requiredClaims": { "additionalProperties": { "type": "string" }, "description": "The key value pairs that describe required claims in the identity token.", "type": "object", "x-kubernetes-map-type": "granular" }, "usernameClaim": { "description": "The JWT claim that the provider will use as the username.", "type": "string" }, "usernamePrefix": { "description": "A prefix that is prepended to username claims.", "type": "string" } }, "type": "object" }, "type": "array" }, "status": { "description": "Status of the EKS Identity Provider Configuration.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } }, { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta2", "schema": { "openAPIV3Schema": { "description": "IdentityProviderConfig is the Schema for the IdentityProviderConfigs API. Manages an EKS Identity Provider Configuration.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "IdentityProviderConfigSpec defines the desired state of IdentityProviderConfig", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "oidc": { "description": "Nested attribute containing OpenID Connect identity provider information for the cluster. Detailed below.", "properties": { "clientId": { "description": "– Client ID for the OpenID Connect identity provider.", "type": "string" }, "groupsClaim": { "description": "The JWT claim that the provider will use to return groups.", "type": "string" }, "groupsPrefix": { "description": "A prefix that is prepended to group claims e.g., oidc:.", "type": "string" }, "issuerUrl": { "description": "Issuer URL for the OpenID Connect identity provider.", "type": "string" }, "requiredClaims": { "additionalProperties": { "type": "string" }, "description": "The key value pairs that describe required claims in the identity token.", "type": "object", "x-kubernetes-map-type": "granular" }, "usernameClaim": { "description": "The JWT claim that the provider will use as the username.", "type": "string" }, "usernamePrefix": { "description": "A prefix that is prepended to username claims.", "type": "string" } }, "type": "object" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "oidc": { "description": "Nested attribute containing OpenID Connect identity provider information for the cluster. Detailed below.", "properties": { "clientId": { "description": "– Client ID for the OpenID Connect identity provider.", "type": "string" }, "groupsClaim": { "description": "The JWT claim that the provider will use to return groups.", "type": "string" }, "groupsPrefix": { "description": "A prefix that is prepended to group claims e.g., oidc:.", "type": "string" }, "issuerUrl": { "description": "Issuer URL for the OpenID Connect identity provider.", "type": "string" }, "requiredClaims": { "additionalProperties": { "type": "string" }, "description": "The key value pairs that describe required claims in the identity token.", "type": "object", "x-kubernetes-map-type": "granular" }, "usernameClaim": { "description": "The JWT claim that the provider will use as the username.", "type": "string" }, "usernamePrefix": { "description": "A prefix that is prepended to username claims.", "type": "string" } }, "type": "object" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.oidc is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.oidc) || (has(self.initProvider) && has(self.initProvider.oidc))" } ] }, "status": { "description": "IdentityProviderConfigStatus defines the observed state of IdentityProviderConfig.", "properties": { "atProvider": { "properties": { "arn": { "description": "Amazon Resource Name (ARN) of the EKS Identity Provider Configuration.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "id": { "description": "EKS Cluster name and EKS Identity Provider Configuration name separated by a colon (:).", "type": "string" }, "oidc": { "description": "Nested attribute containing OpenID Connect identity provider information for the cluster. Detailed below.", "properties": { "clientId": { "description": "– Client ID for the OpenID Connect identity provider.", "type": "string" }, "groupsClaim": { "description": "The JWT claim that the provider will use to return groups.", "type": "string" }, "groupsPrefix": { "description": "A prefix that is prepended to group claims e.g., oidc:.", "type": "string" }, "issuerUrl": { "description": "Issuer URL for the OpenID Connect identity provider.", "type": "string" }, "requiredClaims": { "additionalProperties": { "type": "string" }, "description": "The key value pairs that describe required claims in the identity token.", "type": "object", "x-kubernetes-map-type": "granular" }, "usernameClaim": { "description": "The JWT claim that the provider will use as the username.", "type": "string" }, "usernamePrefix": { "description": "A prefix that is prepended to username claims.", "type": "string" } }, "type": "object" }, "status": { "description": "Status of the EKS Identity Provider Configuration.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": false, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "nodegroups.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "NodeGroup", "listKind": "NodeGroupList", "plural": "nodegroups", "singular": "nodegroup" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "NodeGroup is the Schema for the NodeGroups API. Manages an EKS Node Group", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "NodeGroupSpec defines the desired state of NodeGroup", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "amiType": { "description": "Type of Amazon Machine Image (AMI) associated with the EKS Node Group. See the AWS documentation for valid values.", "type": "string" }, "capacityType": { "description": "Type of capacity associated with the EKS Node Group. Valid values: ON_DEMAND, SPOT.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "diskSize": { "description": "Disk size in GiB for worker nodes. Defaults to 50 for Windows, 20 all other node groups.", "type": "number" }, "forceUpdateVersion": { "description": "Force version update if existing pods are unable to be drained due to a pod disruption budget issue.", "type": "boolean" }, "instanceTypes": { "description": "List of instance types associated with the EKS Node Group. Defaults to [\"t3.medium\"].", "items": { "type": "string" }, "type": "array" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.", "type": "object", "x-kubernetes-map-type": "granular" }, "launchTemplate": { "description": "Configuration block with Launch Template settings. See launch_template below for details. Conflicts with remote_access.", "items": { "properties": { "id": { "description": "Identifier of the EC2 Launch Template. Conflicts with name.", "type": "string" }, "name": { "description": "Name of the EC2 Launch Template. Conflicts with id.", "type": "string" }, "version": { "description": "EC2 Launch Template version number. While the API accepts values like $Default and $Latest, the API will convert the value to the associated version number (e.g., 1). Using the default_version or latest_version attribute of the aws_launch_template resource or data source is recommended for this argument.", "type": "string" } }, "type": "object" }, "type": "array" }, "nodeRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Node Group.", "type": "string" }, "nodeRoleArnRef": { "description": "Reference to a Role in iam to populate nodeRoleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "nodeRoleArnSelector": { "description": "Selector for a Role in iam to populate nodeRoleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "releaseVersion": { "description": "– AMI version of the EKS Node Group. Defaults to latest version for Kubernetes version.", "type": "string" }, "remoteAccess": { "description": "Configuration block with remote access settings. See remote_access below for details. Conflicts with launch_template.", "items": { "properties": { "ec2SshKey": { "description": "EC2 Key Pair name that provides access for remote communication with the worker nodes in the EKS Node Group. If you specify this configuration, but do not specify source_security_group_ids when you create an EKS Node Group, either port 3389 for Windows, or port 22 for all other operating systems is opened on the worker nodes to the Internet (0.0.0.0/0). For Windows nodes, this will allow you to use RDP, for all others this allows you to SSH into the worker nodes.", "type": "string" }, "sourceSecurityGroupIdRefs": { "description": "References to SecurityGroup in ec2 to populate sourceSecurityGroupIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "sourceSecurityGroupIdSelector": { "description": "Selector for a list of SecurityGroup in ec2 to populate sourceSecurityGroupIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "sourceSecurityGroupIds": { "description": "Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes. If you specify ec2_ssh_key, but do not specify this configuration when you create an EKS Node Group, port 22 on the worker nodes is opened to the Internet (0.0.0.0/0).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "scalingConfig": { "description": "Configuration block with scaling settings. See scaling_config below for details.", "items": { "properties": { "desiredSize": { "description": "Desired number of worker nodes.", "type": "number" }, "maxSize": { "description": "Maximum number of worker nodes.", "type": "number" }, "minSize": { "description": "Minimum number of worker nodes.", "type": "number" } }, "type": "object" }, "type": "array" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "Identifiers of EC2 Subnets to associate with the EKS Node Group. Amazon EKS managed node groups can be launched in both public and private subnets. If you plan to deploy load balancers to a subnet, the private subnet must have tag kubernetes.io/role/internal-elb, the public subnet must have tag kubernetes.io/role/elb.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "taint": { "description": "The Kubernetes taints to be applied to the nodes in the node group. Maximum of 50 taints per node group. See taint below for details.", "items": { "properties": { "effect": { "description": "The effect of the taint. Valid values: NO_SCHEDULE, NO_EXECUTE, PREFER_NO_SCHEDULE.", "type": "string" }, "key": { "description": "The key of the taint. Maximum length of 63.", "type": "string" }, "value": { "description": "The value of the taint. Maximum length of 63.", "type": "string" } }, "type": "object" }, "type": "array" }, "updateConfig": { "description": "Configuration block with update settings. See update_config below for details.", "items": { "properties": { "maxUnavailable": { "description": "Desired max number of unavailable worker nodes during node group update.", "type": "number" }, "maxUnavailablePercentage": { "description": "Desired max percentage of unavailable worker nodes during node group update.", "type": "number" } }, "type": "object" }, "type": "array" }, "version": { "description": "– Kubernetes version. Defaults to EKS Cluster Kubernetes version.", "type": "string" }, "versionRef": { "description": "Reference to a Cluster in eks to populate version.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "versionSelector": { "description": "Selector for a Cluster in eks to populate version.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "amiType": { "description": "Type of Amazon Machine Image (AMI) associated with the EKS Node Group. See the AWS documentation for valid values.", "type": "string" }, "capacityType": { "description": "Type of capacity associated with the EKS Node Group. Valid values: ON_DEMAND, SPOT.", "type": "string" }, "diskSize": { "description": "Disk size in GiB for worker nodes. Defaults to 50 for Windows, 20 all other node groups.", "type": "number" }, "forceUpdateVersion": { "description": "Force version update if existing pods are unable to be drained due to a pod disruption budget issue.", "type": "boolean" }, "instanceTypes": { "description": "List of instance types associated with the EKS Node Group. Defaults to [\"t3.medium\"].", "items": { "type": "string" }, "type": "array" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.", "type": "object", "x-kubernetes-map-type": "granular" }, "launchTemplate": { "description": "Configuration block with Launch Template settings. See launch_template below for details. Conflicts with remote_access.", "items": { "properties": { "id": { "description": "Identifier of the EC2 Launch Template. Conflicts with name.", "type": "string" }, "name": { "description": "Name of the EC2 Launch Template. Conflicts with id.", "type": "string" }, "version": { "description": "EC2 Launch Template version number. While the API accepts values like $Default and $Latest, the API will convert the value to the associated version number (e.g., 1). Using the default_version or latest_version attribute of the aws_launch_template resource or data source is recommended for this argument.", "type": "string" } }, "type": "object" }, "type": "array" }, "nodeRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Node Group.", "type": "string" }, "nodeRoleArnRef": { "description": "Reference to a Role in iam to populate nodeRoleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "nodeRoleArnSelector": { "description": "Selector for a Role in iam to populate nodeRoleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "releaseVersion": { "description": "– AMI version of the EKS Node Group. Defaults to latest version for Kubernetes version.", "type": "string" }, "remoteAccess": { "description": "Configuration block with remote access settings. See remote_access below for details. Conflicts with launch_template.", "items": { "properties": { "ec2SshKey": { "description": "EC2 Key Pair name that provides access for remote communication with the worker nodes in the EKS Node Group. If you specify this configuration, but do not specify source_security_group_ids when you create an EKS Node Group, either port 3389 for Windows, or port 22 for all other operating systems is opened on the worker nodes to the Internet (0.0.0.0/0). For Windows nodes, this will allow you to use RDP, for all others this allows you to SSH into the worker nodes.", "type": "string" }, "sourceSecurityGroupIdRefs": { "description": "References to SecurityGroup in ec2 to populate sourceSecurityGroupIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "sourceSecurityGroupIdSelector": { "description": "Selector for a list of SecurityGroup in ec2 to populate sourceSecurityGroupIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "sourceSecurityGroupIds": { "description": "Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes. If you specify ec2_ssh_key, but do not specify this configuration when you create an EKS Node Group, port 22 on the worker nodes is opened to the Internet (0.0.0.0/0).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "scalingConfig": { "description": "Configuration block with scaling settings. See scaling_config below for details.", "items": { "properties": { "desiredSize": { "description": "Desired number of worker nodes.", "type": "number" }, "maxSize": { "description": "Maximum number of worker nodes.", "type": "number" }, "minSize": { "description": "Minimum number of worker nodes.", "type": "number" } }, "type": "object" }, "type": "array" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "Identifiers of EC2 Subnets to associate with the EKS Node Group. Amazon EKS managed node groups can be launched in both public and private subnets. If you plan to deploy load balancers to a subnet, the private subnet must have tag kubernetes.io/role/internal-elb, the public subnet must have tag kubernetes.io/role/elb.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "taint": { "description": "The Kubernetes taints to be applied to the nodes in the node group. Maximum of 50 taints per node group. See taint below for details.", "items": { "properties": { "effect": { "description": "The effect of the taint. Valid values: NO_SCHEDULE, NO_EXECUTE, PREFER_NO_SCHEDULE.", "type": "string" }, "key": { "description": "The key of the taint. Maximum length of 63.", "type": "string" }, "value": { "description": "The value of the taint. Maximum length of 63.", "type": "string" } }, "type": "object" }, "type": "array" }, "updateConfig": { "description": "Configuration block with update settings. See update_config below for details.", "items": { "properties": { "maxUnavailable": { "description": "Desired max number of unavailable worker nodes during node group update.", "type": "number" }, "maxUnavailablePercentage": { "description": "Desired max percentage of unavailable worker nodes during node group update.", "type": "number" } }, "type": "object" }, "type": "array" }, "version": { "description": "– Kubernetes version. Defaults to EKS Cluster Kubernetes version.", "type": "string" }, "versionRef": { "description": "Reference to a Cluster in eks to populate version.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "versionSelector": { "description": "Selector for a Cluster in eks to populate version.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.scalingConfig is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.scalingConfig) || (has(self.initProvider) && has(self.initProvider.scalingConfig))" } ] }, "status": { "description": "NodeGroupStatus defines the observed state of NodeGroup.", "properties": { "atProvider": { "properties": { "amiType": { "description": "Type of Amazon Machine Image (AMI) associated with the EKS Node Group. See the AWS documentation for valid values.", "type": "string" }, "arn": { "description": "Amazon Resource Name (ARN) of the EKS Node Group.", "type": "string" }, "capacityType": { "description": "Type of capacity associated with the EKS Node Group. Valid values: ON_DEMAND, SPOT.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "diskSize": { "description": "Disk size in GiB for worker nodes. Defaults to 50 for Windows, 20 all other node groups.", "type": "number" }, "forceUpdateVersion": { "description": "Force version update if existing pods are unable to be drained due to a pod disruption budget issue.", "type": "boolean" }, "id": { "description": "EKS Cluster name and EKS Node Group name separated by a colon (:).", "type": "string" }, "instanceTypes": { "description": "List of instance types associated with the EKS Node Group. Defaults to [\"t3.medium\"].", "items": { "type": "string" }, "type": "array" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.", "type": "object", "x-kubernetes-map-type": "granular" }, "launchTemplate": { "description": "Configuration block with Launch Template settings. See launch_template below for details. Conflicts with remote_access.", "items": { "properties": { "id": { "description": "Identifier of the EC2 Launch Template. Conflicts with name.", "type": "string" }, "name": { "description": "Name of the EC2 Launch Template. Conflicts with id.", "type": "string" }, "version": { "description": "EC2 Launch Template version number. While the API accepts values like $Default and $Latest, the API will convert the value to the associated version number (e.g., 1). Using the default_version or latest_version attribute of the aws_launch_template resource or data source is recommended for this argument.", "type": "string" } }, "type": "object" }, "type": "array" }, "nodeRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Node Group.", "type": "string" }, "releaseVersion": { "description": "– AMI version of the EKS Node Group. Defaults to latest version for Kubernetes version.", "type": "string" }, "remoteAccess": { "description": "Configuration block with remote access settings. See remote_access below for details. Conflicts with launch_template.", "items": { "properties": { "ec2SshKey": { "description": "EC2 Key Pair name that provides access for remote communication with the worker nodes in the EKS Node Group. If you specify this configuration, but do not specify source_security_group_ids when you create an EKS Node Group, either port 3389 for Windows, or port 22 for all other operating systems is opened on the worker nodes to the Internet (0.0.0.0/0). For Windows nodes, this will allow you to use RDP, for all others this allows you to SSH into the worker nodes.", "type": "string" }, "sourceSecurityGroupIds": { "description": "Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes. If you specify ec2_ssh_key, but do not specify this configuration when you create an EKS Node Group, port 22 on the worker nodes is opened to the Internet (0.0.0.0/0).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": "array" }, "resources": { "description": "List of objects containing information about underlying resources.", "items": { "properties": { "autoscalingGroups": { "description": "List of objects containing information about AutoScaling Groups.", "items": { "properties": { "name": { "description": "Name of the AutoScaling Group.", "type": "string" } }, "type": "object" }, "type": "array" }, "remoteAccessSecurityGroupId": { "description": "Identifier of the remote access EC2 Security Group.", "type": "string" } }, "type": "object" }, "type": "array" }, "scalingConfig": { "description": "Configuration block with scaling settings. See scaling_config below for details.", "items": { "properties": { "desiredSize": { "description": "Desired number of worker nodes.", "type": "number" }, "maxSize": { "description": "Maximum number of worker nodes.", "type": "number" }, "minSize": { "description": "Minimum number of worker nodes.", "type": "number" } }, "type": "object" }, "type": "array" }, "status": { "description": "Status of the EKS Node Group.", "type": "string" }, "subnetIds": { "description": "Identifiers of EC2 Subnets to associate with the EKS Node Group. Amazon EKS managed node groups can be launched in both public and private subnets. If you plan to deploy load balancers to a subnet, the private subnet must have tag kubernetes.io/role/internal-elb, the public subnet must have tag kubernetes.io/role/elb.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" }, "taint": { "description": "The Kubernetes taints to be applied to the nodes in the node group. Maximum of 50 taints per node group. See taint below for details.", "items": { "properties": { "effect": { "description": "The effect of the taint. Valid values: NO_SCHEDULE, NO_EXECUTE, PREFER_NO_SCHEDULE.", "type": "string" }, "key": { "description": "The key of the taint. Maximum length of 63.", "type": "string" }, "value": { "description": "The value of the taint. Maximum length of 63.", "type": "string" } }, "type": "object" }, "type": "array" }, "updateConfig": { "description": "Configuration block with update settings. See update_config below for details.", "items": { "properties": { "maxUnavailable": { "description": "Desired max number of unavailable worker nodes during node group update.", "type": "number" }, "maxUnavailablePercentage": { "description": "Desired max percentage of unavailable worker nodes during node group update.", "type": "number" } }, "type": "object" }, "type": "array" }, "version": { "description": "– Kubernetes version. Defaults to EKS Cluster Kubernetes version.", "type": "string" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } }, { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta2", "schema": { "openAPIV3Schema": { "description": "NodeGroup is the Schema for the NodeGroups API. Manages an EKS Node Group", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "NodeGroupSpec defines the desired state of NodeGroup", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "amiType": { "description": "Type of Amazon Machine Image (AMI) associated with the EKS Node Group. See the AWS documentation for valid values.", "type": "string" }, "capacityType": { "description": "Type of capacity associated with the EKS Node Group. Valid values: ON_DEMAND, SPOT.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "diskSize": { "description": "Disk size in GiB for worker nodes. Defaults to 50 for Windows, 20 all other node groups.", "type": "number" }, "forceUpdateVersion": { "description": "Force version update if existing pods are unable to be drained due to a pod disruption budget issue.", "type": "boolean" }, "instanceTypes": { "description": "List of instance types associated with the EKS Node Group. Defaults to [\"t3.medium\"].", "items": { "type": "string" }, "type": "array" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.", "type": "object", "x-kubernetes-map-type": "granular" }, "launchTemplate": { "description": "Configuration block with Launch Template settings. See launch_template below for details. Conflicts with remote_access.", "properties": { "id": { "description": "Identifier of the EC2 Launch Template. Conflicts with name.", "type": "string" }, "name": { "description": "Name of the EC2 Launch Template. Conflicts with id.", "type": "string" }, "version": { "description": "EC2 Launch Template version number.", "type": "string" } }, "type": "object" }, "nodeRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Node Group.", "type": "string" }, "nodeRoleArnRef": { "description": "Reference to a Role in iam to populate nodeRoleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "nodeRoleArnSelector": { "description": "Selector for a Role in iam to populate nodeRoleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "releaseVersion": { "description": "– AMI version of the EKS Node Group. Defaults to latest version for Kubernetes version.", "type": "string" }, "remoteAccess": { "description": "Configuration block with remote access settings. See remote_access below for details. Conflicts with launch_template.", "properties": { "ec2SshKey": { "description": "EC2 Key Pair name that provides access for remote communication with the worker nodes in the EKS Node Group. If you specify this configuration, but do not specify source_security_group_ids when you create an EKS Node Group, either port 3389 for Windows, or port 22 for all other operating systems is opened on the worker nodes to the Internet (0.0.0.0/0). For Windows nodes, this will allow you to use RDP, for all others this allows you to SSH into the worker nodes.", "type": "string" }, "sourceSecurityGroupIdRefs": { "description": "References to SecurityGroup in ec2 to populate sourceSecurityGroupIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "sourceSecurityGroupIdSelector": { "description": "Selector for a list of SecurityGroup in ec2 to populate sourceSecurityGroupIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "sourceSecurityGroupIds": { "description": "Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes. If you specify ec2_ssh_key, but do not specify this configuration when you create an EKS Node Group, port 22 on the worker nodes is opened to the Internet (0.0.0.0/0).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "scalingConfig": { "description": "Configuration block with scaling settings. See scaling_config below for details.", "properties": { "desiredSize": { "description": "Desired number of worker nodes.", "type": "number" }, "maxSize": { "description": "Maximum number of worker nodes.", "type": "number" }, "minSize": { "description": "Minimum number of worker nodes.", "type": "number" } }, "type": "object" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "Identifiers of EC2 Subnets to associate with the EKS Node Group. Amazon EKS managed node groups can be launched in both public and private subnets. If you plan to deploy load balancers to a subnet, the private subnet must have tag kubernetes.io/role/internal-elb, the public subnet must have tag kubernetes.io/role/elb.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "taint": { "description": "The Kubernetes taints to be applied to the nodes in the node group. Maximum of 50 taints per node group. See taint below for details.", "items": { "properties": { "effect": { "description": "The effect of the taint. Valid values: NO_SCHEDULE, NO_EXECUTE, PREFER_NO_SCHEDULE.", "type": "string" }, "key": { "description": "The key of the taint. Maximum length of 63.", "type": "string" }, "value": { "description": "The value of the taint. Maximum length of 63.", "type": "string" } }, "type": "object" }, "type": "array" }, "updateConfig": { "description": "Configuration block with update settings. See update_config below for details.", "properties": { "maxUnavailable": { "description": "Desired max number of unavailable worker nodes during node group update.", "type": "number" }, "maxUnavailablePercentage": { "description": "Desired max percentage of unavailable worker nodes during node group update.", "type": "number" } }, "type": "object" }, "version": { "description": "– Kubernetes version. Defaults to EKS Cluster Kubernetes version.", "type": "string" }, "versionRef": { "description": "Reference to a Cluster in eks to populate version.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "versionSelector": { "description": "Selector for a Cluster in eks to populate version.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "amiType": { "description": "Type of Amazon Machine Image (AMI) associated with the EKS Node Group. See the AWS documentation for valid values.", "type": "string" }, "capacityType": { "description": "Type of capacity associated with the EKS Node Group. Valid values: ON_DEMAND, SPOT.", "type": "string" }, "diskSize": { "description": "Disk size in GiB for worker nodes. Defaults to 50 for Windows, 20 all other node groups.", "type": "number" }, "forceUpdateVersion": { "description": "Force version update if existing pods are unable to be drained due to a pod disruption budget issue.", "type": "boolean" }, "instanceTypes": { "description": "List of instance types associated with the EKS Node Group. Defaults to [\"t3.medium\"].", "items": { "type": "string" }, "type": "array" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.", "type": "object", "x-kubernetes-map-type": "granular" }, "launchTemplate": { "description": "Configuration block with Launch Template settings. See launch_template below for details. Conflicts with remote_access.", "properties": { "id": { "description": "Identifier of the EC2 Launch Template. Conflicts with name.", "type": "string" }, "name": { "description": "Name of the EC2 Launch Template. Conflicts with id.", "type": "string" }, "version": { "description": "EC2 Launch Template version number.", "type": "string" } }, "type": "object" }, "nodeRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Node Group.", "type": "string" }, "nodeRoleArnRef": { "description": "Reference to a Role in iam to populate nodeRoleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "nodeRoleArnSelector": { "description": "Selector for a Role in iam to populate nodeRoleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "releaseVersion": { "description": "– AMI version of the EKS Node Group. Defaults to latest version for Kubernetes version.", "type": "string" }, "remoteAccess": { "description": "Configuration block with remote access settings. See remote_access below for details. Conflicts with launch_template.", "properties": { "ec2SshKey": { "description": "EC2 Key Pair name that provides access for remote communication with the worker nodes in the EKS Node Group. If you specify this configuration, but do not specify source_security_group_ids when you create an EKS Node Group, either port 3389 for Windows, or port 22 for all other operating systems is opened on the worker nodes to the Internet (0.0.0.0/0). For Windows nodes, this will allow you to use RDP, for all others this allows you to SSH into the worker nodes.", "type": "string" }, "sourceSecurityGroupIdRefs": { "description": "References to SecurityGroup in ec2 to populate sourceSecurityGroupIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "sourceSecurityGroupIdSelector": { "description": "Selector for a list of SecurityGroup in ec2 to populate sourceSecurityGroupIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "sourceSecurityGroupIds": { "description": "Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes. If you specify ec2_ssh_key, but do not specify this configuration when you create an EKS Node Group, port 22 on the worker nodes is opened to the Internet (0.0.0.0/0).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "scalingConfig": { "description": "Configuration block with scaling settings. See scaling_config below for details.", "properties": { "desiredSize": { "description": "Desired number of worker nodes.", "type": "number" }, "maxSize": { "description": "Maximum number of worker nodes.", "type": "number" }, "minSize": { "description": "Minimum number of worker nodes.", "type": "number" } }, "type": "object" }, "subnetIdRefs": { "description": "References to Subnet in ec2 to populate subnetIds.", "items": { "description": "A Reference to a named object.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "subnetIdSelector": { "description": "Selector for a list of Subnet in ec2 to populate subnetIds.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "subnetIds": { "description": "Identifiers of EC2 Subnets to associate with the EKS Node Group. Amazon EKS managed node groups can be launched in both public and private subnets. If you plan to deploy load balancers to a subnet, the private subnet must have tag kubernetes.io/role/internal-elb, the public subnet must have tag kubernetes.io/role/elb.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "taint": { "description": "The Kubernetes taints to be applied to the nodes in the node group. Maximum of 50 taints per node group. See taint below for details.", "items": { "properties": { "effect": { "description": "The effect of the taint. Valid values: NO_SCHEDULE, NO_EXECUTE, PREFER_NO_SCHEDULE.", "type": "string" }, "key": { "description": "The key of the taint. Maximum length of 63.", "type": "string" }, "value": { "description": "The value of the taint. Maximum length of 63.", "type": "string" } }, "type": "object" }, "type": "array" }, "updateConfig": { "description": "Configuration block with update settings. See update_config below for details.", "properties": { "maxUnavailable": { "description": "Desired max number of unavailable worker nodes during node group update.", "type": "number" }, "maxUnavailablePercentage": { "description": "Desired max percentage of unavailable worker nodes during node group update.", "type": "number" } }, "type": "object" }, "version": { "description": "– Kubernetes version. Defaults to EKS Cluster Kubernetes version.", "type": "string" }, "versionRef": { "description": "Reference to a Cluster in eks to populate version.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "versionSelector": { "description": "Selector for a Cluster in eks to populate version.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.scalingConfig is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.scalingConfig) || (has(self.initProvider) && has(self.initProvider.scalingConfig))" } ] }, "status": { "description": "NodeGroupStatus defines the observed state of NodeGroup.", "properties": { "atProvider": { "properties": { "amiType": { "description": "Type of Amazon Machine Image (AMI) associated with the EKS Node Group. See the AWS documentation for valid values.", "type": "string" }, "arn": { "description": "Amazon Resource Name (ARN) of the EKS Node Group.", "type": "string" }, "capacityType": { "description": "Type of capacity associated with the EKS Node Group. Valid values: ON_DEMAND, SPOT.", "type": "string" }, "clusterName": { "description": "– Name of the EKS Cluster.", "type": "string" }, "diskSize": { "description": "Disk size in GiB for worker nodes. Defaults to 50 for Windows, 20 all other node groups.", "type": "number" }, "forceUpdateVersion": { "description": "Force version update if existing pods are unable to be drained due to a pod disruption budget issue.", "type": "boolean" }, "id": { "description": "EKS Cluster name and EKS Node Group name separated by a colon (:).", "type": "string" }, "instanceTypes": { "description": "List of instance types associated with the EKS Node Group. Defaults to [\"t3.medium\"].", "items": { "type": "string" }, "type": "array" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.", "type": "object", "x-kubernetes-map-type": "granular" }, "launchTemplate": { "description": "Configuration block with Launch Template settings. See launch_template below for details. Conflicts with remote_access.", "properties": { "id": { "description": "Identifier of the EC2 Launch Template. Conflicts with name.", "type": "string" }, "name": { "description": "Name of the EC2 Launch Template. Conflicts with id.", "type": "string" }, "version": { "description": "EC2 Launch Template version number.", "type": "string" } }, "type": "object" }, "nodeRoleArn": { "description": "– Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Node Group.", "type": "string" }, "releaseVersion": { "description": "– AMI version of the EKS Node Group. Defaults to latest version for Kubernetes version.", "type": "string" }, "remoteAccess": { "description": "Configuration block with remote access settings. See remote_access below for details. Conflicts with launch_template.", "properties": { "ec2SshKey": { "description": "EC2 Key Pair name that provides access for remote communication with the worker nodes in the EKS Node Group. If you specify this configuration, but do not specify source_security_group_ids when you create an EKS Node Group, either port 3389 for Windows, or port 22 for all other operating systems is opened on the worker nodes to the Internet (0.0.0.0/0). For Windows nodes, this will allow you to use RDP, for all others this allows you to SSH into the worker nodes.", "type": "string" }, "sourceSecurityGroupIds": { "description": "Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes. If you specify ec2_ssh_key, but do not specify this configuration when you create an EKS Node Group, port 22 on the worker nodes is opened to the Internet (0.0.0.0/0).", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" } }, "type": "object" }, "resources": { "description": "List of objects containing information about underlying resources.", "items": { "properties": { "autoscalingGroups": { "description": "List of objects containing information about AutoScaling Groups.", "items": { "properties": { "name": { "description": "Name of the AutoScaling Group.", "type": "string" } }, "type": "object" }, "type": "array" }, "remoteAccessSecurityGroupId": { "description": "Identifier of the remote access EC2 Security Group.", "type": "string" } }, "type": "object" }, "type": "array" }, "scalingConfig": { "description": "Configuration block with scaling settings. See scaling_config below for details.", "properties": { "desiredSize": { "description": "Desired number of worker nodes.", "type": "number" }, "maxSize": { "description": "Maximum number of worker nodes.", "type": "number" }, "minSize": { "description": "Minimum number of worker nodes.", "type": "number" } }, "type": "object" }, "status": { "description": "Status of the EKS Node Group.", "type": "string" }, "subnetIds": { "description": "Identifiers of EC2 Subnets to associate with the EKS Node Group. Amazon EKS managed node groups can be launched in both public and private subnets. If you plan to deploy load balancers to a subnet, the private subnet must have tag kubernetes.io/role/internal-elb, the public subnet must have tag kubernetes.io/role/elb.", "items": { "type": "string" }, "type": "array", "x-kubernetes-list-type": "set" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" }, "taint": { "description": "The Kubernetes taints to be applied to the nodes in the node group. Maximum of 50 taints per node group. See taint below for details.", "items": { "properties": { "effect": { "description": "The effect of the taint. Valid values: NO_SCHEDULE, NO_EXECUTE, PREFER_NO_SCHEDULE.", "type": "string" }, "key": { "description": "The key of the taint. Maximum length of 63.", "type": "string" }, "value": { "description": "The value of the taint. Maximum length of 63.", "type": "string" } }, "type": "object" }, "type": "array" }, "updateConfig": { "description": "Configuration block with update settings. See update_config below for details.", "properties": { "maxUnavailable": { "description": "Desired max number of unavailable worker nodes during node group update.", "type": "number" }, "maxUnavailablePercentage": { "description": "Desired max percentage of unavailable worker nodes during node group update.", "type": "number" } }, "type": "object" }, "version": { "description": "– Kubernetes version. Defaults to EKS Cluster Kubernetes version.", "type": "string" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": false, "subresources": { "status": {} } } ] } }, { "apiVersion": "apiextensions.k8s.io/v1", "kind": "CustomResourceDefinition", "metadata": { "name": "podidentityassociations.eks.aws.upbound.io", "ownerReferences": [ { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": true, "kind": "ProviderRevision", "name": "provider-aws-eks-77e1075e12b1", "uid": "c2196417-a550-4481-9c07-5424dc872ec6" }, { "apiVersion": "pkg.crossplane.io/v1", "blockOwnerDeletion": true, "controller": false, "kind": "Provider", "name": "provider-aws-eks", "uid": "85a0fc2b-35c7-4677-a21f-4098e74e82fd" } ] }, "spec": { "conversion": { "strategy": "Webhook", "webhook": { "clientConfig": { "caBundle": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQwRENDQXJpZ0F3SUJBZ0lDQitZd0RRWUpLb1pJaHZjTkFRRUxCUUF3V2pFT01Bd0dBMVVFQmhNRlJXRnkKZEdneERqQU1CZ05WQkFnVEJVVmhjblJvTVE0d0RBWURWUVFIRXdWRllYSjBhREVUTUJFR0ExVUVDaE1LUTNKdgpjM053YkdGdVpURVRNQkVHQTFVRUF4TUtRM0p2YzNOd2JHRnVaVEFlRncweU5UQTBNalF3TWpJMU5EUmFGdzB6Ck5UQTBNalF3TWpJMU5EUmFNRm94RGpBTUJnTlZCQVlUQlVWaGNuUm9NUTR3REFZRFZRUUlFd1ZGWVhKMGFERU8KTUF3R0ExVUVCeE1GUldGeWRHZ3hFekFSQmdOVkJBb1RDa055YjNOemNHeGhibVV4RXpBUkJnTlZCQU1UQ2tOeQpiM056Y0d4aGJtVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDODN0NExUOHJYCmswQVArcGY3dXFTZXJsQ20vMjArQk4vcjM2Wm9wZSs5WjlYRzhEY3NmZVZEQ1NMcFNDa2xUTzVQOFFZcUZ1NGcKTzR0TkJiYkxCb1NIeXZxYUZ0OENQUDlSWVIvQU9Sc1EwMHNYb25CbWNDZXI3QlI2a1RmamJudm83YUF5OWhKdApHRXRxdlVpM2VpMlBKWkdKSnF2dDZoNmpNNmt4T0o4eVl3OE9ZYUszZ21sVWk3NzVwOFI0UWVyZXB1QlZaVVJRCnFoaHJxa3VFTkVOd3UreVZhRCt4ckpySjg5QzJjbUxLOThtNDhybHlDYThkY1Q5ZXhtSFRHQXAwVWlUU3pLMEcKYmdpMlVJb0RoMm9hb044cGhUVU9PYUEreTl0YjgzN2hXUXJMNXQvY2tvQ01wcUJiakxZMFFENGhibzJoclpraQowRjB1cllmdXY1T2RBZ01CQUFHamdaOHdnWnd3RGdZRFZSMFBBUUgvQkFRREFnU3dNQk1HQTFVZEpRUU1NQW9HCkNDc0dBUVVGQndNQk1Bd0dBMVVkRXdFQi93UUNNQUF3WndZRFZSMFJCR0F3WG9JUWNISnZkbWxrWlhJdFlYZHoKTFdWcmM0SWljSEp2ZG1sa1pYSXRZWGR6TFdWcmN5NWpjbTl6YzNCc1lXNWxMWE41YzNSbGJZSW1jSEp2ZG1sawpaWEl0WVhkekxXVnJjeTVqY205emMzQnNZVzVsTFhONWMzUmxiUzV6ZG1Nd0RRWUpLb1pJaHZjTkFRRUxCUUFECmdnRUJBQnJBUnVhZ2VETDVRSm90MGZIS01KMUxVWVNIUmxCbEM0bnpHM1J1M2E1U25WUGs4QUdrS2xUdUxzamcKLzEwd0szckFtVFRvWXZZQUJQQUZ1SU1CajVGK2IxZmhNbmtMRW05MVpGQXpvbnJjZGhVNkFSNUFyVm9EUVRjWgpVZUxTZ0g3RWVyNnA3a0ZlMitpdGw5MWh6YThRcXJlSmptSHVqaDZ1VmFVTlI1L2Yrb1k3NUV0UXJmTitvZ2U1Cm5vVVFERlN5Sk0ydHhvNEtKb01xK1hzMFJvREM5eFR6dXdMQzFSUDBMWkVwTjRtdDFiWjlCM05ETUpuMlZYbU0KNXlDMHdDS0pzcE1XSy9uSUdsMUlqZTFzcnNZbnI1VGEwVHVvc09qRDAva3kreXhHT0drazdyeHdnWWs3S3NZaQpLWnl0WlM1YWtIZFZEbEFmb1hZZjNUYmxPMXM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "service": { "name": "provider-aws-eks", "namespace": "crossplane-system", "path": "/convert", "port": 9443 } }, "conversionReviewVersions": [ "v1" ] } }, "group": "eks.aws.upbound.io", "names": { "categories": [ "crossplane", "managed", "aws" ], "kind": "PodIdentityAssociation", "listKind": "PodIdentityAssociationList", "plural": "podidentityassociations", "singular": "podidentityassociation" }, "scope": "Cluster", "versions": [ { "additionalPrinterColumns": [ { "jsonPath": ".status.conditions[?(@.type=='Synced')].status", "name": "SYNCED", "type": "string" }, { "jsonPath": ".status.conditions[?(@.type=='Ready')].status", "name": "READY", "type": "string" }, { "jsonPath": ".metadata.annotations.crossplane\\.io/external-name", "name": "EXTERNAL-NAME", "type": "string" }, { "jsonPath": ".metadata.creationTimestamp", "name": "AGE", "type": "date" } ], "name": "v1beta1", "schema": { "openAPIV3Schema": { "description": "PodIdentityAssociation is the Schema for the PodIdentityAssociations API.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "PodIdentityAssociationSpec defines the desired state of PodIdentityAssociation", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": "string" }, "forProvider": { "properties": { "clusterName": { "description": "The name of the cluster to create the association in.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "namespace": { "description": "The name of the Kubernetes namespace inside the cluster to create the association in. The service account and the pods that use the service account must be in this namespace.", "type": "string" }, "region": { "description": "Region is the region you'd like your resource to be created in.", "type": "string" }, "roleArn": { "description": "The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity agent manages credentials to assume this role for applications in the containers in the pods that use this service account.", "type": "string" }, "roleArnRef": { "description": "Reference to a Role in iam to populate roleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "roleArnSelector": { "description": "Selector for a Role in iam to populate roleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "serviceAccount": { "description": "The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "required": [ "region" ], "type": "object" }, "initProvider": { "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "clusterName": { "description": "The name of the cluster to create the association in.", "type": "string" }, "clusterNameRef": { "description": "Reference to a Cluster in eks to populate clusterName.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "clusterNameSelector": { "description": "Selector for a Cluster in eks to populate clusterName.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "namespace": { "description": "The name of the Kubernetes namespace inside the cluster to create the association in. The service account and the pods that use the service account must be in this namespace.", "type": "string" }, "roleArn": { "description": "The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity agent manages credentials to assume this role for applications in the containers in the pods that use this service account.", "type": "string" }, "roleArnRef": { "description": "Reference to a Role in iam to populate roleArn.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "roleArnSelector": { "description": "Selector for a Role in iam to populate roleArn.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": "boolean" }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": "object" }, "policy": { "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "type": "object" }, "serviceAccount": { "description": "The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": "array" }, "providerConfigRef": { "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "publishConnectionDetailsTo": { "description": "PublishConnectionDetailsTo specifies the connection secret config which\ncontains a name, metadata and a reference to secret store config to\nwhich any connection details for this managed resource should be written.\nConnection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "configRef": { "default": { "name": "default" }, "description": "SecretStoreConfigRef specifies which secret store config should be used\nfor this ConnectionSecret.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": "string" }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": "string" } }, "type": "object" } }, "required": [ "name" ], "type": "object" }, "metadata": { "description": "Metadata is the metadata for connection secret.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations are the annotations to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.annotations\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels are the labels/tags to be added to connection secret.\n- For Kubernetes secrets, this will be used as \"metadata.labels\".\n- It is up to Secret Store implementation for others store types.", "type": "object" }, "type": { "description": "Type is the SecretType for the connection secret.\n- Only valid for Kubernetes Secret Stores.", "type": "string" } }, "type": "object" }, "name": { "description": "Name is the name of the connection secret.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "writeConnectionSecretToRef": { "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.\nThis field is planned to be replaced in a future release in favor of\nPublishConnectionDetailsTo. Currently, both could be set independently\nand connection details would be published to both without affecting\neach other.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": "object" } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.namespace is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.__namespace__) || (has(self.initProvider) && has(self.initProvider.__namespace__))" }, { "message": "spec.forProvider.serviceAccount is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.serviceAccount) || (has(self.initProvider) && has(self.initProvider.serviceAccount))" } ] }, "status": { "description": "PodIdentityAssociationStatus defines the observed state of PodIdentityAssociation.", "properties": { "atProvider": { "properties": { "associationArn": { "description": "The Amazon Resource Name (ARN) of the association.", "type": "string" }, "associationId": { "description": "The ID of the association.", "type": "string" }, "clusterName": { "description": "The name of the cluster to create the association in.", "type": "string" }, "id": { "type": "string" }, "namespace": { "description": "The name of the Kubernetes namespace inside the cluster to create the association in. The service account and the pods that use the service account must be in this namespace.", "type": "string" }, "roleArn": { "description": "The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity agent manages credentials to assume this role for applications in the containers in the pods that use this service account.", "type": "string" }, "serviceAccount": { "description": "The name of the Kubernetes service account inside the cluster to associate the IAM credentials with.", "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Key-value map of resource tags.", "type": "object", "x-kubernetes-map-type": "granular" }, "tagsAll": { "additionalProperties": { "type": "string" }, "description": "A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.", "type": "object", "x-kubernetes-map-type": "granular" } }, "type": "object" }, "conditions": { "description": "Conditions of the resource.", "items": { "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": "integer" }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": "array", "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": "integer" } }, "type": "object" } }, "required": [ "spec" ], "type": "object" } }, "served": true, "storage": true, "subresources": { "status": {} } } ] } } ] }