@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33kind : CustomResourceDefinition
44metadata :
55 annotations :
6- controller-gen.kubebuilder.io/version : v0.14.0
6+ controller-gen.kubebuilder.io/version : v0.16.5
77 name : rosacontrolplanes.controlplane.cluster.x-k8s.io
88spec :
99 group : controlplane.cluster.x-k8s.io
@@ -180,9 +180,7 @@ spec:
180180 This field is effectively required, but due to backwards compatibility is
181181 allowed to be empty. Instances of this type with an empty value here are
182182 almost certainly wrong.
183- TODO: Add other useful fields. apiVersion, kind, uid?
184183 More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
185- TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
186184 type : string
187185 type : object
188186 x-kubernetes-map-type : atomic
@@ -194,7 +192,6 @@ spec:
194192 As these machinepool not created using ROSAMachinePool CR, they will not be visible/managed by ROSA CAPI provider.
195193 `rosa list machinepools -c <rosaClusterName>` can be used to view those machinepools.
196194
197-
198195 This field will be removed in the future once the current limitation is resolved.
199196 properties :
200197 autoscaling :
@@ -253,7 +250,6 @@ spec:
253250 ExternalAuthProviders are external OIDC identity providers that can issue tokens for this cluster.
254251 Can only be set if "enableExternalAuthProviders" is set to "True".
255252
256-
257253 At most one provider can be configured.
258254 items :
259255 description : ExternalAuthProvider is an external OIDC identity provider
@@ -279,10 +275,8 @@ spec:
279275 Prefix is a string to prefix the value from the token in the result of the
280276 claim mapping.
281277
282-
283278 By default, no prefixing occurs.
284279
285-
286280 Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
287281 an array of strings "a", "b" and "c", the mapping will result in an
288282 array of string "myoidc:a", "myoidc:b" and "myoidc:c".
@@ -295,7 +289,6 @@ spec:
295289 Username is a name of the claim that should be used to construct
296290 usernames for the cluster identity.
297291
298-
299292 Default value: "sub"
300293 properties :
301294 claim :
@@ -311,14 +304,11 @@ spec:
311304 description : |-
312305 PrefixPolicy specifies how a prefix should apply.
313306
314-
315307 By default, claims other than `email` will be prefixed with the issuer URL to
316308 prevent naming clashes with other plugins.
317309
318-
319310 Set to "NoPrefix" to disable prefixing.
320311
321-
322312 Example:
323313 (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
324314 If the JWT claim `username` contains value `userA`, the resulting
@@ -574,8 +564,8 @@ spec:
574564 properties :
575565 controlPlaneOperatorARN :
576566 description : " ControlPlaneOperatorARN is an ARN value referencing
577- a role appropriate for the Control Plane Operator.\n\n\ n The
578- following is an example of a valid policy document:\n \n\n {\n\t\" Version\" :
567+ a role appropriate for the Control Plane Operator.\n\n The following
568+ is an example of a valid policy document:\n\n {\n\t\" Version\" :
579569 \" 2012-10-17\" ,\n\t\" Statement\" : [\n\t\t {\n\t\t\t\" Effect\" :
580570 \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" ec2:CreateVpcEndpoint\" ,\n\t\t\t\t\" ec2:DescribeVpcEndpoints\" ,\n\t\t\t\t\" ec2:ModifyVpcEndpoint\" ,\n\t\t\t\t\" ec2:DeleteVpcEndpoints\" ,\n\t\t\t\t\" ec2:CreateTags\" ,\n\t\t\t\t\" route53:ListHostedZones\" ,\n\t\t\t\t\" ec2:CreateSecurityGroup\" ,\n\t\t\t\t\" ec2:AuthorizeSecurityGroupIngress\" ,\n\t\t\t\t\" ec2:AuthorizeSecurityGroupEgress\" ,\n\t\t\t\t\" ec2:DeleteSecurityGroup\" ,\n\t\t\t\t\" ec2:RevokeSecurityGroupIngress\" ,\n\t\t\t\t\" ec2:RevokeSecurityGroupEgress\" ,\n\t\t\t\t\" ec2:DescribeSecurityGroups\" ,\n\t\t\t\t\" ec2:DescribeVpcs\" ,\n\t\t\t ],\n\t\t\t\" Resource\" :
581571 \" *\"\n\t\t },\n\t\t {\n\t\t\t\" Effect\" : \" Allow\" ,\n\t\t\t\" Action\" :
@@ -584,8 +574,8 @@ spec:
584574 type : string
585575 imageRegistryARN :
586576 description : " ImageRegistryARN is an ARN value referencing a role
587- appropriate for the Image Registry Operator.\n\n\ n The following
588- is an example of a valid policy document:\n\n\n {\n\t\" Version\" :
577+ appropriate for the Image Registry Operator.\n\n The following
578+ is an example of a valid policy document:\n\n {\n\t\" Version\" :
589579 \" 2012-10-17\" ,\n\t\" Statement\" : [\n\t\t {\n\t\t\t\" Effect\" :
590580 \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" s3:CreateBucket\" ,\n\t\t\t\t\" s3:DeleteBucket\" ,\n\t\t\t\t\" s3:PutBucketTagging\" ,\n\t\t\t\t\" s3:GetBucketTagging\" ,\n\t\t\t\t\" s3:PutBucketPublicAccessBlock\" ,\n\t\t\t\t\" s3:GetBucketPublicAccessBlock\" ,\n\t\t\t\t\" s3:PutEncryptionConfiguration\" ,\n\t\t\t\t\" s3:GetEncryptionConfiguration\" ,\n\t\t\t\t\" s3:PutLifecycleConfiguration\" ,\n\t\t\t\t\" s3:GetLifecycleConfiguration\" ,\n\t\t\t\t\" s3:GetBucketLocation\" ,\n\t\t\t\t\" s3:ListBucket\" ,\n\t\t\t\t\" s3:GetObject\" ,\n\t\t\t\t\" s3:PutObject\" ,\n\t\t\t\t\" s3:DeleteObject\" ,\n\t\t\t\t\" s3:ListBucketMultipartUploads\" ,\n\t\t\t\t\" s3:AbortMultipartUpload\" ,\n\t\t\t\t\" s3:ListMultipartUploadParts\"\n\t\t\t ],\n\t\t\t\" Resource\" :
591581 \" *\"\n\t\t }\n\t ]\n }"
@@ -597,11 +587,11 @@ spec:
597587 \" Allow\" ,\n\t\t\t\t\" Principal\" : {\n\t\t\t\t\t\" Federated\" :
598588 \" {{ .ProviderARN }}\"\n\t\t\t\t },\n\t\t\t\t\t\" Action\" : \" sts:AssumeRoleWithWebIdentity\" ,\n\t\t\t\t\" Condition\" :
599589 {\n\t\t\t\t\t\" StringEquals\" : {\n\t\t\t\t\t\t\" {{ .ProviderName
600- }}:sub\" : {{ .ServiceAccounts }}\n\t\t\t\t\t }\n\t\t\t\t }\n\t\t\t }\n\t\t ]\n\t }\n\n\ n IngressARN
590+ }}:sub\" : {{ .ServiceAccounts }}\n\t\t\t\t\t }\n\t\t\t\t }\n\t\t\t }\n\t\t ]\n\t }\n\n IngressARN
601591 is an ARN value referencing a role appropriate for the Ingress
602- Operator.\n\n\ n The following is an example of a valid policy
603- document: \n\n\n { \n\ t\"Version \" : \" 2012-10-17 \" , \ n\t\" Statement \" :
604- [ \n\t\t { \n\t\t\t\" Effect \" : \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" elasticloadbalancing:DescribeLoadBalancers\" ,\n\t\t\t\t\" tag:GetResources\" ,\n\t\t\t\t\" route53:ListHostedZones\"\n\t\t\t ],\n\t\t\t\" Resource\" :
592+ Operator.\n\n The following is an example of a valid policy document: \n\n { \n\t\" Version \" :
593+ \" 2012-10-17 \" , \n\ t\"Statement \" : [ \n\t\t { \ n\t\t\t\" Effect \" :
594+ \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" elasticloadbalancing:DescribeLoadBalancers\" ,\n\t\t\t\t\" tag:GetResources\" ,\n\t\t\t\t\" route53:ListHostedZones\"\n\t\t\t ],\n\t\t\t\" Resource\" :
605595 \" *\"\n\t\t },\n\t\t {\n\t\t\t\" Effect\" : \" Allow\" ,\n\t\t\t\" Action\" :
606596 [\n\t\t\t\t\" route53:ChangeResourceRecordSets\"\n\t\t\t ],\n\t\t\t\" Resource\" :
607597 [\n\t\t\t\t\" arn:aws:route53:::PUBLIC_ZONE_ID\" ,\n\t\t\t\t\" arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t ]\n\t\t }\n\t ]\n }"
@@ -613,10 +603,8 @@ spec:
613603 KubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
614604 Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
615605
616-
617606 The following is an example of a valid policy document:
618607
619-
620608 {
621609 "Version": "2012-10-17",
622610 "Statement": [
@@ -690,8 +678,8 @@ spec:
690678 type : string
691679 networkARN :
692680 description : " NetworkARN is an ARN value referencing a role appropriate
693- for the Network Operator.\n\n\ n The following is an example of
694- a valid policy document:\n\n\n {\n\t\" Version\" : \" 2012-10-17\" ,\n\t\" Statement\" :
681+ for the Network Operator.\n\n The following is an example of
682+ a valid policy document:\n\n {\n\t\" Version\" : \" 2012-10-17\" ,\n\t\" Statement\" :
695683 [\n\t\t {\n\t\t\t\" Effect\" : \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" ec2:DescribeInstances\" ,\n
696684 \ \" ec2:DescribeInstanceStatus\" ,\n \" ec2:DescribeInstanceTypes\" ,\n
697685 \ \" ec2:UnassignPrivateIpAddresses\" ,\n \" ec2:AssignPrivateIpAddresses\" ,\n
@@ -701,8 +689,8 @@ spec:
701689 type : string
702690 nodePoolManagementARN :
703691 description : " NodePoolManagementARN is an ARN value referencing
704- a role appropriate for the CAPI Controller.\n\n\ n The following
705- is an example of a valid policy document:\n\n\n {\n \" Version\" :
692+ a role appropriate for the CAPI Controller.\n\n The following
693+ is an example of a valid policy document:\n\n {\n \" Version\" :
706694 \" 2012-10-17\" ,\n \" Statement\" : [\n {\n \" Action\" : [\n
707695 \ \" ec2:AssociateRouteTable\" ,\n \" ec2:AttachInternetGateway\" ,\n
708696 \ \" ec2:AuthorizeSecurityGroupIngress\" ,\n \" ec2:CreateInternetGateway\" ,\n
@@ -746,8 +734,8 @@ spec:
746734 type : string
747735 storageARN :
748736 description : " StorageARN is an ARN value referencing a role appropriate
749- for the Storage Operator.\n\n\ n The following is an example of
750- a valid policy document:\n\n\n {\n\t\" Version\" : \" 2012-10-17\" ,\n\t\" Statement\" :
737+ for the Storage Operator.\n\n The following is an example of
738+ a valid policy document:\n\n {\n\t\" Version\" : \" 2012-10-17\" ,\n\t\" Statement\" :
751739 [\n\t\t {\n\t\t\t\" Effect\" : \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" ec2:AttachVolume\" ,\n\t\t\t\t\" ec2:CreateSnapshot\" ,\n\t\t\t\t\" ec2:CreateTags\" ,\n\t\t\t\t\" ec2:CreateVolume\" ,\n\t\t\t\t\" ec2:DeleteSnapshot\" ,\n\t\t\t\t\" ec2:DeleteTags\" ,\n\t\t\t\t\" ec2:DeleteVolume\" ,\n\t\t\t\t\" ec2:DescribeInstances\" ,\n\t\t\t\t\" ec2:DescribeSnapshots\" ,\n\t\t\t\t\" ec2:DescribeTags\" ,\n\t\t\t\t\" ec2:DescribeVolumes\" ,\n\t\t\t\t\" ec2:DescribeVolumesModifications\" ,\n\t\t\t\t\" ec2:DetachVolume\" ,\n\t\t\t\t\" ec2:ModifyVolume\"\n\t\t\t ],\n\t\t\t\" Resource\" :
752740 \" *\"\n\t\t }\n\t ]\n }"
753741 type : string
@@ -885,7 +873,6 @@ spec:
885873 FailureMessage will be set in the event that there is a terminal problem
886874 reconciling the state and will be set to a descriptive error message.
887875
888-
889876 This field should not be set for transitive errors that a controller
890877 faces that are expected to be fixed automatically over
891878 time (like service outages), but instead indicate that something is
0 commit comments