Add RosaRoleConfig API and CRD.

Author: PanSpagetka

PROJECT

@@ -58,3 +58,6 @@ resources:
 - group: infrastructure
   version: v1beta2
   kind: AWSManagedCluster
+- group: infrastructure
+  kind: ROSARoleConfig
+  version: v1beta2

config/crd/bases/infrastructure.cluster.x-k8s.io_rosaroleconfigs.yaml

@@ -24,6 +24,7 @@ resources:
 - bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml
 - bases/infrastructure.cluster.x-k8s.io_rosaclusters.yaml
 - bases/infrastructure.cluster.x-k8s.io_rosamachinepools.yaml
+- bases/infrastructure.cluster.x-k8s.io_rosaroleconfigs.yaml
 # +kubebuilder:scaffold:crdkustomizeresource
 
 patchesStrategicMerge:
@@ -38,6 +39,7 @@ patchesStrategicMerge:
 - patches/webhook_in_awsmanagedcontrolplanes.yaml
 - patches/webhook_in_eksconfigs.yaml
 - patches/webhook_in_eksconfigtemplates.yaml
+- patches/webhook_in_rosaroleconfigs.yaml
   # +kubebuilder:scaffold:crdkustomizewebhookpatch
 
 # [CERTMANAGER] To enable webhook, uncomment all the sections with [CERTMANAGER] prefix.
@@ -52,6 +54,7 @@ patchesStrategicMerge:
 - patches/cainjection_in_awsmanagedclusters.yaml
 - patches/cainjection_in_eksconfigs.yaml
 - patches/cainjection_in_eksconfigtemplates.yaml
+- patches/cainjection_in_rosaroleconfigs.yaml
 # +kubebuilder:scaffold:crdkustomizecainjectionpatch
 
 # [LABEL] To enable label, uncomment all the sections with [LABEL] prefix.

config/crd/kustomization.yaml

@@ -0,0 +1,8 @@
+# The following patch adds a directive for certmanager to inject CA into the CRD
+# CRD conversion requires k8s 1.13 or later.
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+  name: rosaroleconfigs.infrastructure.cluster.x-k8s.io

config/crd/patches/cainjection_in_rosaroleconfigs.yaml

@@ -0,0 +1,14 @@
+# The following patch enables conversion webhook for CRD
+# CRD conversion requires k8s 1.13 or later.
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: rosaroleconfigs.infrastructure.cluster.x-k8s.io
+spec:
+  conversion:
+    strategy: Webhook
+    webhookClientConfig:
+      service:
+        namespace: system
+        name: webhook-service
+        path: /convert

config/crd/patches/webhook_in_rosaroleconfigs.yaml

@@ -176,6 +176,7 @@ rules:
   - awsfargateprofiles/status
   - rosaclusters/status
   - rosamachinepools/status
+  - rosaroleconfigs/status
   verbs:
   - get
   - patch
@@ -197,6 +198,7 @@ rules:
   - infrastructure.cluster.x-k8s.io
   resources:
   - awsmachines
+  - rosaroleconfigs
   verbs:
   - create
   - delete
@@ -209,5 +211,6 @@ rules:
   - infrastructure.cluster.x-k8s.io
   resources:
   - rosamachinepools/finalizers
+  - rosaroleconfigs/finalizers
   verbs:
   - update

config/rbac/role.yaml

@@ -223,6 +223,28 @@ webhooks:
     resources:
     - rosamachinepools
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  - v1beta1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-rosaroleconfig
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: default.rosaroleconfig.infrastructure.cluster.x-k8s.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta2
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - rosaroleconfigs
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   - v1beta1
@@ -559,6 +581,28 @@ webhooks:
     resources:
     - rosamachinepools
   sideEffects: None
+- admissionReviewVersions:
+  - v1
+  - v1beta1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-infrastructure-cluster-x-k8s-io-v1beta2-rosaroleconfig
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: validation.rosaroleconfig.infrastructure.cluster.x-k8s.io
+  rules:
+  - apiGroups:
+    - infrastructure.cluster.x-k8s.io
+    apiVersions:
+    - v1beta2
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - rosaroleconfigs
+  sideEffects: None
 - admissionReviewVersions:
   - v1
   - v1beta1

config/webhook/manifests.yaml

@@ -21,7 +21,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
-	expinfrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/exp/api/v1beta2"
 	clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
 )
 
@@ -327,7 +326,7 @@ type DefaultMachinePoolSpec struct {
 	// Autoscaling specifies auto scaling behaviour for the default MachinePool. Autoscaling min/max value
 	// must be equal or multiple of the availability zones count.
 	// +optional
-	Autoscaling *expinfrav1.RosaMachinePoolAutoScaling `json:"autoscaling,omitempty"`
+	Autoscaling *AutoScaling `json:"autoscaling,omitempty"`
 
 	// VolumeSize set the disk volume size for the default workers machine pool in Gib. The default is 300 GiB.
 	// +kubebuilder:validation:Minimum=75
@@ -337,6 +336,14 @@ type DefaultMachinePoolSpec struct {
 	VolumeSize int `json:"volumeSize,omitempty"`
 }
 
+// AutoScaling specifies scaling options.
+type AutoScaling struct {
+	// +kubebuilder:validation:Minimum=1
+	MinReplicas int `json:"minReplicas,omitempty"`
+	// +kubebuilder:validation:Minimum=1
+	MaxReplicas int `json:"maxReplicas,omitempty"`
+}
+
 // AWSRolesRef contains references to various AWS IAM roles required for operators to make calls against the AWS API.
 type AWSRolesRef struct {
 	// The referenced role must have a trust relationship that allows it to be assumed via web identity.

controlplane/rosa/api/v1beta2/rosacontrolplane_types.go

@@ -28,4 +28,7 @@ const (
 
 	// RosaMachinePoolFinalizer allows the controller to clean up resources on delete.
 	RosaMachinePoolFinalizer = "rosamachinepools.infrastructure.cluster.x-k8s.io"
+
+	// RosaRoleConfigFinalizer allows the controller to clean up resources on delete.
+	RosaRoleConfigFinalizer = "rosaroleconfigs.infrastructure.cluster.x-k8s.io"
 )