@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
3
3
kind : CustomResourceDefinition
4
4
metadata :
5
5
annotations :
6
- controller-gen.kubebuilder.io/version : v0.14.0
6
+ controller-gen.kubebuilder.io/version : v0.16.5
7
7
name : rosacontrolplanes.controlplane.cluster.x-k8s.io
8
8
spec :
9
9
group : controlplane.cluster.x-k8s.io
@@ -180,9 +180,7 @@ spec:
180
180
This field is effectively required, but due to backwards compatibility is
181
181
allowed to be empty. Instances of this type with an empty value here are
182
182
almost certainly wrong.
183
- TODO: Add other useful fields. apiVersion, kind, uid?
184
183
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
185
- TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
186
184
type : string
187
185
type : object
188
186
x-kubernetes-map-type : atomic
@@ -194,7 +192,6 @@ spec:
194
192
As these machinepool not created using ROSAMachinePool CR, they will not be visible/managed by ROSA CAPI provider.
195
193
`rosa list machinepools -c <rosaClusterName>` can be used to view those machinepools.
196
194
197
-
198
195
This field will be removed in the future once the current limitation is resolved.
199
196
properties :
200
197
autoscaling :
@@ -253,7 +250,6 @@ spec:
253
250
ExternalAuthProviders are external OIDC identity providers that can issue tokens for this cluster.
254
251
Can only be set if "enableExternalAuthProviders" is set to "True".
255
252
256
-
257
253
At most one provider can be configured.
258
254
items :
259
255
description : ExternalAuthProvider is an external OIDC identity provider
@@ -279,10 +275,8 @@ spec:
279
275
Prefix is a string to prefix the value from the token in the result of the
280
276
claim mapping.
281
277
282
-
283
278
By default, no prefixing occurs.
284
279
285
-
286
280
Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
287
281
an array of strings "a", "b" and "c", the mapping will result in an
288
282
array of string "myoidc:a", "myoidc:b" and "myoidc:c".
@@ -295,7 +289,6 @@ spec:
295
289
Username is a name of the claim that should be used to construct
296
290
usernames for the cluster identity.
297
291
298
-
299
292
Default value: "sub"
300
293
properties :
301
294
claim :
@@ -311,14 +304,11 @@ spec:
311
304
description : |-
312
305
PrefixPolicy specifies how a prefix should apply.
313
306
314
-
315
307
By default, claims other than `email` will be prefixed with the issuer URL to
316
308
prevent naming clashes with other plugins.
317
309
318
-
319
310
Set to "NoPrefix" to disable prefixing.
320
311
321
-
322
312
Example:
323
313
(1) `prefix` is set to "myoidc:" and `claim` is set to "username".
324
314
If the JWT claim `username` contains value `userA`, the resulting
@@ -574,8 +564,8 @@ spec:
574
564
properties :
575
565
controlPlaneOperatorARN :
576
566
description : " ControlPlaneOperatorARN is an ARN value referencing
577
- a role appropriate for the Control Plane Operator.\n\n\ n The
578
- following is an example of a valid policy document:\n \n\n {\n\t\" Version\" :
567
+ a role appropriate for the Control Plane Operator.\n\n The following
568
+ is an example of a valid policy document:\n\n {\n\t\" Version\" :
579
569
\" 2012-10-17\" ,\n\t\" Statement\" : [\n\t\t {\n\t\t\t\" Effect\" :
580
570
\" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" ec2:CreateVpcEndpoint\" ,\n\t\t\t\t\" ec2:DescribeVpcEndpoints\" ,\n\t\t\t\t\" ec2:ModifyVpcEndpoint\" ,\n\t\t\t\t\" ec2:DeleteVpcEndpoints\" ,\n\t\t\t\t\" ec2:CreateTags\" ,\n\t\t\t\t\" route53:ListHostedZones\" ,\n\t\t\t\t\" ec2:CreateSecurityGroup\" ,\n\t\t\t\t\" ec2:AuthorizeSecurityGroupIngress\" ,\n\t\t\t\t\" ec2:AuthorizeSecurityGroupEgress\" ,\n\t\t\t\t\" ec2:DeleteSecurityGroup\" ,\n\t\t\t\t\" ec2:RevokeSecurityGroupIngress\" ,\n\t\t\t\t\" ec2:RevokeSecurityGroupEgress\" ,\n\t\t\t\t\" ec2:DescribeSecurityGroups\" ,\n\t\t\t\t\" ec2:DescribeVpcs\" ,\n\t\t\t ],\n\t\t\t\" Resource\" :
581
571
\" *\"\n\t\t },\n\t\t {\n\t\t\t\" Effect\" : \" Allow\" ,\n\t\t\t\" Action\" :
@@ -584,8 +574,8 @@ spec:
584
574
type : string
585
575
imageRegistryARN :
586
576
description : " ImageRegistryARN is an ARN value referencing a role
587
- appropriate for the Image Registry Operator.\n\n\ n The following
588
- is an example of a valid policy document:\n\n\n {\n\t\" Version\" :
577
+ appropriate for the Image Registry Operator.\n\n The following
578
+ is an example of a valid policy document:\n\n {\n\t\" Version\" :
589
579
\" 2012-10-17\" ,\n\t\" Statement\" : [\n\t\t {\n\t\t\t\" Effect\" :
590
580
\" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" s3:CreateBucket\" ,\n\t\t\t\t\" s3:DeleteBucket\" ,\n\t\t\t\t\" s3:PutBucketTagging\" ,\n\t\t\t\t\" s3:GetBucketTagging\" ,\n\t\t\t\t\" s3:PutBucketPublicAccessBlock\" ,\n\t\t\t\t\" s3:GetBucketPublicAccessBlock\" ,\n\t\t\t\t\" s3:PutEncryptionConfiguration\" ,\n\t\t\t\t\" s3:GetEncryptionConfiguration\" ,\n\t\t\t\t\" s3:PutLifecycleConfiguration\" ,\n\t\t\t\t\" s3:GetLifecycleConfiguration\" ,\n\t\t\t\t\" s3:GetBucketLocation\" ,\n\t\t\t\t\" s3:ListBucket\" ,\n\t\t\t\t\" s3:GetObject\" ,\n\t\t\t\t\" s3:PutObject\" ,\n\t\t\t\t\" s3:DeleteObject\" ,\n\t\t\t\t\" s3:ListBucketMultipartUploads\" ,\n\t\t\t\t\" s3:AbortMultipartUpload\" ,\n\t\t\t\t\" s3:ListMultipartUploadParts\"\n\t\t\t ],\n\t\t\t\" Resource\" :
591
581
\" *\"\n\t\t }\n\t ]\n }"
@@ -597,11 +587,11 @@ spec:
597
587
\" Allow\" ,\n\t\t\t\t\" Principal\" : {\n\t\t\t\t\t\" Federated\" :
598
588
\" {{ .ProviderARN }}\"\n\t\t\t\t },\n\t\t\t\t\t\" Action\" : \" sts:AssumeRoleWithWebIdentity\" ,\n\t\t\t\t\" Condition\" :
599
589
{\n\t\t\t\t\t\" StringEquals\" : {\n\t\t\t\t\t\t\" {{ .ProviderName
600
- }}:sub\" : {{ .ServiceAccounts }}\n\t\t\t\t\t }\n\t\t\t\t }\n\t\t\t }\n\t\t ]\n\t }\n\n\ n IngressARN
590
+ }}:sub\" : {{ .ServiceAccounts }}\n\t\t\t\t\t }\n\t\t\t\t }\n\t\t\t }\n\t\t ]\n\t }\n\n IngressARN
601
591
is an ARN value referencing a role appropriate for the Ingress
602
- Operator.\n\n\ n The following is an example of a valid policy
603
- document: \n\n\n { \n\ t\"Version \" : \" 2012-10-17 \" , \ n\t\" Statement \" :
604
- [ \n\t\t { \n\t\t\t\" Effect \" : \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" elasticloadbalancing:DescribeLoadBalancers\" ,\n\t\t\t\t\" tag:GetResources\" ,\n\t\t\t\t\" route53:ListHostedZones\"\n\t\t\t ],\n\t\t\t\" Resource\" :
592
+ Operator.\n\n The following is an example of a valid policy document: \n\n { \n\t\" Version \" :
593
+ \" 2012-10-17 \" , \n\ t\"Statement \" : [ \n\t\t { \ n\t\t\t\" Effect \" :
594
+ \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" elasticloadbalancing:DescribeLoadBalancers\" ,\n\t\t\t\t\" tag:GetResources\" ,\n\t\t\t\t\" route53:ListHostedZones\"\n\t\t\t ],\n\t\t\t\" Resource\" :
605
595
\" *\"\n\t\t },\n\t\t {\n\t\t\t\" Effect\" : \" Allow\" ,\n\t\t\t\" Action\" :
606
596
[\n\t\t\t\t\" route53:ChangeResourceRecordSets\"\n\t\t\t ],\n\t\t\t\" Resource\" :
607
597
[\n\t\t\t\t\" arn:aws:route53:::PUBLIC_ZONE_ID\" ,\n\t\t\t\t\" arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t ]\n\t\t }\n\t ]\n }"
@@ -613,10 +603,8 @@ spec:
613
603
KubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
614
604
Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies
615
605
616
-
617
606
The following is an example of a valid policy document:
618
607
619
-
620
608
{
621
609
"Version": "2012-10-17",
622
610
"Statement": [
@@ -690,8 +678,8 @@ spec:
690
678
type : string
691
679
networkARN :
692
680
description : " NetworkARN is an ARN value referencing a role appropriate
693
- for the Network Operator.\n\n\ n The following is an example of
694
- a valid policy document:\n\n\n {\n\t\" Version\" : \" 2012-10-17\" ,\n\t\" Statement\" :
681
+ for the Network Operator.\n\n The following is an example of
682
+ a valid policy document:\n\n {\n\t\" Version\" : \" 2012-10-17\" ,\n\t\" Statement\" :
695
683
[\n\t\t {\n\t\t\t\" Effect\" : \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" ec2:DescribeInstances\" ,\n
696
684
\ \" ec2:DescribeInstanceStatus\" ,\n \" ec2:DescribeInstanceTypes\" ,\n
697
685
\ \" ec2:UnassignPrivateIpAddresses\" ,\n \" ec2:AssignPrivateIpAddresses\" ,\n
@@ -701,8 +689,8 @@ spec:
701
689
type : string
702
690
nodePoolManagementARN :
703
691
description : " NodePoolManagementARN is an ARN value referencing
704
- a role appropriate for the CAPI Controller.\n\n\ n The following
705
- is an example of a valid policy document:\n\n\n {\n \" Version\" :
692
+ a role appropriate for the CAPI Controller.\n\n The following
693
+ is an example of a valid policy document:\n\n {\n \" Version\" :
706
694
\" 2012-10-17\" ,\n \" Statement\" : [\n {\n \" Action\" : [\n
707
695
\ \" ec2:AssociateRouteTable\" ,\n \" ec2:AttachInternetGateway\" ,\n
708
696
\ \" ec2:AuthorizeSecurityGroupIngress\" ,\n \" ec2:CreateInternetGateway\" ,\n
@@ -746,8 +734,8 @@ spec:
746
734
type : string
747
735
storageARN :
748
736
description : " StorageARN is an ARN value referencing a role appropriate
749
- for the Storage Operator.\n\n\ n The following is an example of
750
- a valid policy document:\n\n\n {\n\t\" Version\" : \" 2012-10-17\" ,\n\t\" Statement\" :
737
+ for the Storage Operator.\n\n The following is an example of
738
+ a valid policy document:\n\n {\n\t\" Version\" : \" 2012-10-17\" ,\n\t\" Statement\" :
751
739
[\n\t\t {\n\t\t\t\" Effect\" : \" Allow\" ,\n\t\t\t\" Action\" : [\n\t\t\t\t\" ec2:AttachVolume\" ,\n\t\t\t\t\" ec2:CreateSnapshot\" ,\n\t\t\t\t\" ec2:CreateTags\" ,\n\t\t\t\t\" ec2:CreateVolume\" ,\n\t\t\t\t\" ec2:DeleteSnapshot\" ,\n\t\t\t\t\" ec2:DeleteTags\" ,\n\t\t\t\t\" ec2:DeleteVolume\" ,\n\t\t\t\t\" ec2:DescribeInstances\" ,\n\t\t\t\t\" ec2:DescribeSnapshots\" ,\n\t\t\t\t\" ec2:DescribeTags\" ,\n\t\t\t\t\" ec2:DescribeVolumes\" ,\n\t\t\t\t\" ec2:DescribeVolumesModifications\" ,\n\t\t\t\t\" ec2:DetachVolume\" ,\n\t\t\t\t\" ec2:ModifyVolume\"\n\t\t\t ],\n\t\t\t\" Resource\" :
752
740
\" *\"\n\t\t }\n\t ]\n }"
753
741
type : string
@@ -885,7 +873,6 @@ spec:
885
873
FailureMessage will be set in the event that there is a terminal problem
886
874
reconciling the state and will be set to a descriptive error message.
887
875
888
-
889
876
This field should not be set for transitive errors that a controller
890
877
faces that are expected to be fixed automatically over
891
878
time (like service outages), but instead indicate that something is
0 commit comments