--- # Source: eks-chart/crds/eks.services.k8s.aws_accessentries.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: accessentries.eks.services.k8s.aws spec: group: eks.services.k8s.aws names: kind: AccessEntry listKind: AccessEntryList plural: accessentries singular: accessentry scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.clusterName name: CLUSTER type: string - jsonPath: .spec.type name: TYPE type: string - jsonPath: .spec.username name: USERNAME type: string - jsonPath: .spec.principalARN name: PRINCIPALARN priority: 1 type: string - jsonPath: .status.conditions[?(@.type=="ACK.ResourceSynced")].status name: Synced type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: AccessEntry is the Schema for the AccessEntries API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- AccessEntrySpec defines the desired state of AccessEntry. An access entry allows an IAM principal (user or role) to access your cluster. Access entries can replace the need to maintain the aws-auth ConfigMap for authentication. For more information about access entries, see Access entries (https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html) in the Amazon EKS User Guide. properties: accessPolicies: items: properties: accessScope: description: The scope of an AccessPolicy that's associated to an AccessEntry. properties: namespaces: items: type: string type: array type: type: string type: object policyARN: type: string type: object type: array clusterName: description: The name of your cluster. type: string clusterRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object kubernetesGroups: description: |- The value for name that you've specified for kind: Group as a subject in a Kubernetes RoleBinding or ClusterRoleBinding object. Amazon EKS doesn't confirm that the value for name exists in any bindings on your cluster. You can specify one or more names. Kubernetes authorizes the principalArn of the access entry to access any cluster objects that you've specified in a Kubernetes Role or ClusterRole object that is also specified in a binding's roleRef. For more information about creating Kubernetes RoleBinding, ClusterRoleBinding, Role, or ClusterRole objects, see Using RBAC Authorization in the Kubernetes documentation (https://kubernetes.io/docs/reference/access-authn-authz/rbac/). If you want Amazon EKS to authorize the principalArn (instead of, or in addition to Kubernetes authorizing the principalArn), you can associate one or more access policies to the access entry using AssociateAccessPolicy. If you associate any access policies, the principalARN has all permissions assigned in the associated access policies and all permissions in any Kubernetes Role or ClusterRole objects that the group names are bound to. items: type: string type: array principalARN: description: |- The ARN of the IAM principal for the AccessEntry. You can specify one ARN for each access entry. You can't specify the same ARN in more than one access entry. This value can't be changed after access entry creation. The valid principals differ depending on the type of the access entry in the type field. For STANDARD access entries, you can use every IAM principal type. For nodes (EC2 (for EKS Auto Mode), EC2_LINUX, EC2_WINDOWS, FARGATE_LINUX, and HYBRID_LINUX), the only valid ARN is IAM roles. You can't use the STS session principal type with access entries because this is a temporary principal for each session and not a permanent identity that can be assigned permissions. IAM best practices (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-users-federation-idp) recommend using IAM roles with temporary credentials, rather than IAM users with long-term credentials. type: string tags: additionalProperties: type: string description: |- Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources. type: object type: description: |- The type of the new access entry. Valid values are STANDARD, FARGATE_LINUX, EC2_LINUX, EC2_WINDOWS, EC2 (for EKS Auto Mode), HYBRID_LINUX, and HYPERPOD_LINUX. If the principalArn is for an IAM role that's used for self-managed Amazon EC2 nodes, specify EC2_LINUX or EC2_WINDOWS. Amazon EKS grants the necessary permissions to the node for you. If the principalArn is for any other purpose, specify STANDARD. If you don't specify a value, Amazon EKS sets the value to STANDARD. If you have the access mode of the cluster set to API_AND_CONFIG_MAP, it's unnecessary to create access entries for IAM roles used with Fargate profiles or managed Amazon EC2 nodes, because Amazon EKS creates entries in the aws-auth ConfigMap for the roles. You can't change this value once you've created the access entry. If you set the value to EC2_LINUX or EC2_WINDOWS, you can't specify values for kubernetesGroups, or associate an AccessPolicy to the access entry. type: string username: description: |- The username to authenticate to Kubernetes with. We recommend not specifying a username and letting Amazon EKS specify it for you. For more information about the value Amazon EKS specifies for you, or constraints before specifying your own username, see Creating access entries (https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html#creating-access-entries) in the Amazon EKS User Guide. type: string required: - principalARN type: object status: description: AccessEntryStatus defines the observed state of AccessEntry properties: ackResourceMetadata: description: |- All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource properties: arn: description: |- ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an "adopted" resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR's Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270 type: string ownerAccountID: description: |- OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource. type: string partition: description: Partition is the AWS partition in which the resource exists or will exist type: string region: description: Region is the AWS region in which the resource exists or will exist. type: string required: - ownerAccountID - region type: object conditions: description: |- All CRs managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array createdAt: description: The Unix epoch timestamp at object creation. format: date-time type: string modifiedAt: description: The Unix epoch timestamp for the last modification to the object. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/eks.services.k8s.aws_addons.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: addons.eks.services.k8s.aws spec: group: eks.services.k8s.aws names: kind: Addon listKind: AddonList plural: addons singular: addon scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.clusterName name: CLUSTER type: string - jsonPath: .spec.addonVersion name: ADDONVERSION type: string - jsonPath: .spec.resolveConflicts name: RESOLVECONFLICTS type: string - jsonPath: .status.status name: STATUS priority: 1 type: string - jsonPath: .spec.serviceAccountRoleARN name: SERVICEACCOUNTROLEARN priority: 1 type: string - jsonPath: .status.conditions[?(@.type=="ACK.ResourceSynced")].status name: Synced type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: Addon is the Schema for the Addons API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- AddonSpec defines the desired state of Addon. An Amazon EKS add-on. For more information, see Amazon EKS add-ons (https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html) in the Amazon EKS User Guide. properties: addonVersion: description: |- The version of the add-on. The version must match one of the versions returned by DescribeAddonVersions (https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddonVersions.html). type: string clientRequestToken: description: |- A unique, case-sensitive identifier that you provide to ensurethe idempotency of the request. type: string clusterName: description: |- The name of your cluster. Regex Pattern: `^[0-9A-Za-z][A-Za-z0-9\-_]*$` type: string clusterRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object configurationValues: description: |- The set of configuration values for the add-on that's created. The values that you provide are validated against the schema returned by DescribeAddonConfiguration. type: string name: description: |- The name of the add-on. The name must match one of the names returned by DescribeAddonVersions. type: string podIdentityAssociations: description: |- An array of EKS Pod Identity associations to be created. Each association maps a Kubernetes service account to an IAM role. For more information, see Attach an IAM Role to an Amazon EKS add-on using EKS Pod Identity (https://docs.aws.amazon.com/eks/latest/userguide/add-ons-iam.html) in the Amazon EKS User Guide. items: description: |- A type of EKS Pod Identity association owned by an Amazon EKS add-on. Each association maps a role to a service account in a namespace in the cluster. For more information, see Attach an IAM Role to an Amazon EKS add-on using EKS Pod Identity (https://docs.aws.amazon.com/eks/latest/userguide/add-ons-iam.html) in the Amazon EKS User Guide. properties: roleARN: type: string roleRef: description: Reference field for RoleARN properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object serviceAccount: type: string type: object type: array resolveConflicts: description: |- How to resolve field value conflicts for an Amazon EKS add-on. Conflicts are handled based on the value you choose: - None – If the self-managed version of the add-on is installed on your cluster, Amazon EKS doesn't change the value. Creation of the add-on might fail. - Overwrite – If the self-managed version of the add-on is installed on your cluster and the Amazon EKS default value is different than the existing value, Amazon EKS changes the value to the Amazon EKS default value. - Preserve – This is similar to the NONE option. If the self-managed version of the add-on is installed on your cluster Amazon EKS doesn't change the add-on resource properties. Creation of the add-on might fail if conflicts are detected. This option works differently during the update operation. For more information, see UpdateAddon (https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html). If you don't currently have the self-managed version of the add-on installed on your cluster, the Amazon EKS add-on is installed. Amazon EKS sets all values to default values, regardless of the option that you specify. type: string serviceAccountRoleARN: description: |- The Amazon Resource Name (ARN) of an existing IAM role to bind to the add-on's service account. The role must be assigned the IAM permissions required by the add-on. If you don't specify an existing IAM role, then the add-on uses the permissions assigned to the node IAM role. For more information, see Amazon EKS node IAM role (https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html) in the Amazon EKS User Guide. To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC) provider created for your cluster. For more information, see Enabling IAM roles for service accounts on your cluster (https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) in the Amazon EKS User Guide. type: string serviceAccountRoleRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object tags: additionalProperties: type: string description: |- Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources. type: object required: - name type: object status: description: AddonStatus defines the observed state of Addon properties: ackResourceMetadata: description: |- All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource properties: arn: description: |- ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an "adopted" resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR's Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270 type: string ownerAccountID: description: |- OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource. type: string partition: description: Partition is the AWS partition in which the resource exists or will exist type: string region: description: Region is the AWS region in which the resource exists or will exist. type: string required: - ownerAccountID - region type: object conditions: description: |- All CRs managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array createdAt: description: The Unix epoch timestamp at object creation. format: date-time type: string health: description: An object that represents the health of the add-on. properties: issues: items: description: An issue related to an add-on. properties: code: type: string message: type: string resourceIDs: items: type: string type: array type: object type: array type: object marketplaceInformation: description: Information about an Amazon EKS add-on from the Amazon Web Services Marketplace. properties: productID: type: string productURL: type: string type: object modifiedAt: description: The Unix epoch timestamp for the last modification to the object. format: date-time type: string owner: description: The owner of the add-on. type: string publisher: description: The publisher of the add-on. type: string status: description: The status of the add-on. type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/eks.services.k8s.aws_capabilities.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: capabilities.eks.services.k8s.aws spec: group: eks.services.k8s.aws names: kind: Capability listKind: CapabilityList plural: capabilities singular: capability scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: Capability is the Schema for the Capabilities API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- CapabilitySpec defines the desired state of Capability. An object representing a managed capability in an Amazon EKS cluster. This includes all configuration, status, and health information for the capability. properties: clusterName: description: The name of the Amazon EKS cluster where you want to create the capability. type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf configuration: description: |- The configuration settings for the capability. The structure of this object varies depending on the capability type. For Argo CD capabilities, you can configure IAM Identity CenterIAM; Identity Center integration, RBAC role mappings, and network access settings. properties: argoCD: description: |- Configuration settings for an Argo CD capability. This includes the Kubernetes namespace, IAM Identity CenterIAM; Identity Center integration, RBAC role mappings, and network access configuration. properties: awsIDC: description: |- Configuration for integrating Argo CD with IAM Identity CenterIAM; Identity Center. This allows you to use your organization's identity provider for authentication to Argo CD. properties: idcInstanceARN: type: string idcRegion: type: string type: object namespace: type: string networkAccess: description: |- Configuration for network access to the Argo CD capability's managed API server endpoint. When VPC endpoint IDs are specified, public access is blocked and the Argo CD server is only accessible through the specified VPC endpoints. properties: vpceIDs: items: type: string type: array type: object rbacRoleMappings: items: description: |- A mapping between an Argo CD role and IAM Identity CenterIAM; Identity Center identities. This defines which users or groups have specific permissions in Argo CD. properties: identities: items: description: |- An IAM Identity CenterIAM; Identity Center identity (user or group) that can be assigned permissions in a capability. properties: id: type: string type: type: string type: object type: array role: type: string type: object type: array type: object type: object deletePropagationPolicy: description: |- Specifies how Kubernetes resources managed by the capability should be handled when the capability is deleted. Currently, the only supported value is RETAIN which retains all Kubernetes resources managed by the capability when the capability is deleted. Because resources are retained, all Kubernetes resources created by the capability should be deleted from the cluster before deleting the capability itself. After the capability is deleted, these resources become difficult to manage because the controller is no longer available. type: string name: description: |- A unique name for the capability. The name must be unique within your cluster and can contain alphanumeric characters, hyphens, and underscores. type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf roleARN: description: |- The Amazon Resource Name (ARN) of the IAM role that the capability uses to interact with Amazon Web Services services. This role must have a trust policy that allows the EKS service principal to assume it, and it must have the necessary permissions for the capability type you're creating. For ACK capabilities, the role needs permissions to manage the resources you want to control through Kubernetes. For Argo CD capabilities, the role needs permissions to access Git repositories and Secrets Manager. For KRO capabilities, the role needs permissions based on the resources you'll be orchestrating. type: string roleRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object tags: additionalProperties: type: string type: object type: description: |- The type of capability to create. Valid values are: - ACK – Amazon Web Services Controllers for Kubernetes (ACK), which lets you manage resources directly from Kubernetes. - ARGOCD – Argo CD for GitOps-based continuous delivery. - KRO – Kube Resource Orchestrator (KRO) for composing and managing custom Kubernetes resources. type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf required: - clusterName - deletePropagationPolicy - name - type type: object status: description: CapabilityStatus defines the observed state of Capability properties: ackResourceMetadata: description: |- All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource properties: arn: description: |- ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an "adopted" resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR's Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270 type: string ownerAccountID: description: |- OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource. type: string partition: description: Partition is the AWS partition in which the resource exists or will exist type: string region: description: Region is the AWS region in which the resource exists or will exist. type: string required: - ownerAccountID - region type: object conditions: description: |- All CRs managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array createdAt: description: The Unix epoch timestamp in seconds for when the capability was created. format: date-time type: string health: description: |- Health information for the capability, including any issues that may be affecting its operation. properties: issues: items: description: An issue affecting a capability's health or operation. properties: code: type: string message: type: string type: object type: array type: object modifiedAt: description: The Unix epoch timestamp in seconds for when the capability was last modified. format: date-time type: string status: description: |- The current status of the capability. Valid values include: * CREATING – The capability is being created. * ACTIVE – The capability is running and available. * UPDATING – The capability is being updated. * DELETING – The capability is being deleted. * CREATE_FAILED – The capability creation failed. * UPDATE_FAILED – The capability update failed. * DELETE_FAILED – The capability deletion failed. type: string version: description: The version of the capability software that is currently running. type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/eks.services.k8s.aws_clusters.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: clusters.eks.services.k8s.aws spec: group: eks.services.k8s.aws names: kind: Cluster listKind: ClusterList plural: clusters singular: cluster scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.version name: VERSION type: string - jsonPath: .status.status name: STATUS type: string - jsonPath: .status.platformVersion name: PLATFORMVERSION priority: 1 type: string - jsonPath: .status.endpoint name: ENDPOINT priority: 1 type: string - jsonPath: .status.conditions[?(@.type=="ACK.ResourceSynced")].status name: Synced type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: Cluster is the Schema for the Clusters API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- ClusterSpec defines the desired state of Cluster. An object representing an Amazon EKS cluster. properties: accessConfig: description: The access configuration for the cluster. properties: authenticationMode: type: string bootstrapClusterCreatorAdminPermissions: type: boolean type: object bootstrapSelfManagedAddons: description: |- If you set this value to False when creating a cluster, the default networking add-ons will not be installed. The default networking add-ons include vpc-cni, coredns, and kube-proxy. Use this option when you plan to install third-party alternative add-ons or self-manage the default networking add-ons. type: boolean clientRequestToken: description: |- A unique, case-sensitive identifier that you provide to ensurethe idempotency of the request. type: string computeConfig: description: |- Enable or disable the compute capability of EKS Auto Mode when creating your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account properties: enabled: type: boolean nodePools: items: type: string type: array nodeRoleARN: type: string type: object encryptionConfig: description: The encryption configuration for the cluster. items: description: The encryption configuration for the cluster. properties: provider: description: Identifies the Key Management Service (KMS) key used to encrypt the secrets. properties: keyARN: type: string keyRef: description: Reference field for KeyARN properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object type: object resources: items: type: string type: array type: object type: array kubernetesNetworkConfig: description: The Kubernetes network configuration for the cluster. properties: elasticLoadBalancing: description: |- Indicates the current configuration of the load balancing capability on your EKS Auto Mode cluster. For example, if the capability is enabled or disabled. For more information, see EKS Auto Mode load balancing capability in the Amazon EKS User Guide. properties: enabled: type: boolean type: object ipFamily: type: string serviceIPv4CIDR: type: string type: object logging: description: |- Enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs . By default, cluster control plane logs aren't exported to CloudWatch Logs . For more information, see Amazon EKS Cluster control plane logs (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) in the Amazon EKS User Guide . CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see CloudWatch Pricing (http://aws.amazon.com/cloudwatch/pricing/). properties: clusterLogging: items: description: |- An object representing the enabled or disabled Kubernetes control plane logs for your cluster. properties: enabled: type: boolean types: items: type: string type: array type: object type: array type: object name: description: |- The unique name to give to your cluster. The name can contain only alphanumeric characters (case-sensitive),hyphens, and underscores. It must start with an alphanumeric character and can't be longer than100 characters. The name must be unique within the Amazon Web Services Region and Amazon Web Services account that you're creating the cluster in. Regex Pattern: `^[0-9A-Za-z][A-Za-z0-9\-_]*$` type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf outpostConfig: description: |- An object representing the configuration of your local Amazon EKS cluster on an Amazon Web Services Outpost. Before creating a local cluster on an Outpost, review Local clusters for Amazon EKS on Amazon Web Services Outposts (https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-local-cluster-overview.html) in the Amazon EKS User Guide. This object isn't available for creating Amazon EKS clusters on the Amazon Web Services cloud. properties: controlPlaneInstanceType: type: string controlPlanePlacement: description: |- The placement configuration for all the control plane instances of your local Amazon EKS cluster on an Amazon Web Services Outpost. For more information, see Capacity considerations (https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-capacity-considerations.html) in the Amazon EKS User Guide. properties: groupName: type: string type: object outpostARNs: items: type: string type: array type: object remoteNetworkConfig: description: |- The configuration in the cluster for EKS Hybrid Nodes. You can add, change, or remove this configuration after the cluster is created. properties: remoteNodeNetworks: items: description: |- A network CIDR that can contain hybrid nodes. These CIDR blocks define the expected IP address range of the hybrid nodes that join the cluster. These blocks are typically determined by your network administrator. Enter one or more IPv4 CIDR blocks in decimal dotted-quad notation (for example, 10.2.0.0/16). It must satisfy the following requirements: - Each block must be within an IPv4 RFC-1918 network range. Minimum allowed size is /32, maximum allowed size is /8. Publicly-routable addresses aren't supported. - Each block cannot overlap with the range of the VPC CIDR blocks for your EKS resources, or the block of the Kubernetes service IP range. - Each block must have a route to the VPC that uses the VPC CIDR blocks, not public IPs or Elastic IPs. There are many options including Transit Gateway, Site-to-Site VPN, or Direct Connect. - Each host must allow outbound connection to the EKS cluster control plane on TCP ports 443 and 10250. - Each host must allow inbound connection from the EKS cluster control plane on TCP port 10250 for logs, exec and port-forward operations. - Each host must allow TCP and UDP network connectivity to and from other hosts that are running CoreDNS on UDP port 53 for service and pod DNS names. properties: cidrs: items: type: string type: array type: object type: array remotePodNetworks: items: description: |- A network CIDR that can contain pods that run Kubernetes webhooks on hybrid nodes. These CIDR blocks are determined by configuring your Container Network Interface (CNI) plugin. We recommend the Calico CNI or Cilium CNI. Note that the Amazon VPC CNI plugin for Kubernetes isn't available for on-premises and edge locations. Enter one or more IPv4 CIDR blocks in decimal dotted-quad notation (for example, 10.2.0.0/16). It must satisfy the following requirements: - Each block must be within an IPv4 RFC-1918 network range. Minimum allowed size is /32, maximum allowed size is /8. Publicly-routable addresses aren't supported. - Each block cannot overlap with the range of the VPC CIDR blocks for your EKS resources, or the block of the Kubernetes service IP range. properties: cidrs: items: type: string type: array type: object type: array type: object resourcesVPCConfig: description: |- The VPC configuration that's used by the cluster control plane. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see Cluster VPC Considerations (https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html) and Cluster Security Group Considerations (https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html) in the Amazon EKS User Guide. You must specify at least two subnets. You can specify up to five security groups. However, we recommend that you use a dedicated security group for your cluster control plane. properties: endpointPrivateAccess: type: boolean endpointPublicAccess: type: boolean publicAccessCIDRs: items: type: string type: array securityGroupIDs: items: type: string type: array securityGroupRefs: description: Reference field for SecurityGroupIDs items: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object type: array subnetIDs: items: type: string type: array subnetRefs: description: Reference field for SubnetIDs items: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object type: array type: object roleARN: description: |- The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to Amazon Web Services API operations on your behalf. For more information, see Amazon EKS Service IAM Role (https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html) in the Amazon EKS User Guide . type: string roleRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object storageConfig: description: |- Enable or disable the block storage capability of EKS Auto Mode when creating your EKS Auto Mode cluster. If the block storage capability is enabled, EKS Auto Mode will create and delete EBS volumes in your Amazon Web Services account. properties: blockStorage: description: |- Indicates the current configuration of the block storage capability on your EKS Auto Mode cluster. For example, if the capability is enabled or disabled. If the block storage capability is enabled, EKS Auto Mode will create and delete EBS volumes in your Amazon Web Services account. For more information, see EKS Auto Mode block storage capability in the Amazon EKS User Guide. properties: enabled: type: boolean type: object type: object tags: additionalProperties: type: string description: |- Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources. type: object upgradePolicy: description: |- New clusters, by default, have extended support enabled. You can disable extended support when creating a cluster by setting this value to STANDARD. properties: supportType: type: string type: object version: description: |- The desired Kubernetes version for your cluster. If you don't specify a value here, the default version available in Amazon EKS is used. The default version might not be the latest version available. type: string zonalShiftConfig: description: |- Enable or disable ARC zonal shift for the cluster. If zonal shift is enabled, Amazon Web Services configures zonal autoshift for the cluster. Zonal shift is a feature of Amazon Application Recovery Controller (ARC). ARC zonal shift is designed to be a temporary measure that allows you to move traffic for a resource away from an impaired AZ until the zonal shift expires or you cancel it. You can extend the zonal shift if necessary. You can start a zonal shift for an Amazon EKS cluster, or you can allow Amazon Web Services to do it for you by enabling zonal autoshift. This shift updates the flow of east-to-west network traffic in your cluster to only consider network endpoints for Pods running on worker nodes in healthy AZs. Additionally, any ALB or NLB handling ingress traffic for applications in your Amazon EKS cluster will automatically route traffic to targets in the healthy AZs. For more information about zonal shift in EKS, see Learn about Amazon Application Recovery Controller (ARC) Zonal Shift in Amazon EKS (https://docs.aws.amazon.com/eks/latest/userguide/zone-shift.html) in the Amazon EKS User Guide . properties: enabled: type: boolean type: object required: - name - resourcesVPCConfig type: object status: description: ClusterStatus defines the observed state of Cluster properties: ackResourceMetadata: description: |- All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource properties: arn: description: |- ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an "adopted" resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR's Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270 type: string ownerAccountID: description: |- OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource. type: string partition: description: Partition is the AWS partition in which the resource exists or will exist type: string region: description: Region is the AWS region in which the resource exists or will exist. type: string required: - ownerAccountID - region type: object certificateAuthority: description: The certificate-authority-data for your cluster. properties: data: type: string type: object clusterSecurityGroupID: description: |- The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. type: string conditions: description: |- All CRs managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array connectorConfig: description: The configuration used to connect to a cluster for registration. properties: activationCode: type: string activationExpiry: format: date-time type: string activationID: type: string provider: type: string roleARN: type: string type: object createdAt: description: The Unix epoch timestamp at object creation. format: date-time type: string endpoint: description: The endpoint for your Kubernetes API server. type: string health: description: An object representing the health of your Amazon EKS cluster. properties: issues: items: description: An issue with your Amazon EKS cluster. properties: code: type: string message: type: string resourceIDs: items: type: string type: array type: object type: array type: object id: description: |- The ID of your local Amazon EKS cluster on an Amazon Web Services Outpost. This property isn't available for an Amazon EKS cluster on the Amazon Web Services cloud. type: string identity: description: The identity provider information for the cluster. properties: oidc: description: |- An object representing the OpenID Connect (https://openid.net/connect/) (OIDC) identity provider information for the cluster. properties: issuer: type: string type: object type: object platformVersion: description: |- The platform version of your Amazon EKS cluster. For more information about clusters deployed on the Amazon Web Services Cloud, see Platform versions (https://docs.aws.amazon.com/eks/latest/userguide/platform-versions.html) in the Amazon EKS User Guide . For more information about local clusters deployed on an Outpost, see Amazon EKS local cluster platform versions (https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts-platform-versions.html) in the Amazon EKS User Guide . type: string status: description: The current status of the cluster. type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/eks.services.k8s.aws_fargateprofiles.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: fargateprofiles.eks.services.k8s.aws spec: group: eks.services.k8s.aws names: kind: FargateProfile listKind: FargateProfileList plural: fargateprofiles singular: fargateprofile scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.clusterName name: CLUSTER type: string - jsonPath: .status.status name: STATUS type: string - jsonPath: .spec.podExecutionRoleARN name: PODEXECUTIONROLEARN priority: 1 type: string - jsonPath: .status.conditions[?(@.type=="ACK.ResourceSynced")].status name: Synced type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: FargateProfile is the Schema for the FargateProfiles API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- FargateProfileSpec defines the desired state of FargateProfile. An object representing an Fargate profile. properties: clientRequestToken: description: |- A unique, case-sensitive identifier that you provide to ensurethe idempotency of the request. type: string clusterName: description: The name of your cluster. type: string clusterRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object name: description: The name of the Fargate profile. type: string podExecutionRoleARN: description: |- The Amazon Resource Name (ARN) of the Pod execution role to use for a Pod that matches the selectors in the Fargate profile. The Pod execution role allows Fargate infrastructure to register with your cluster as a node, and it provides read access to Amazon ECR image repositories. For more information, see Pod execution role (https://docs.aws.amazon.com/eks/latest/userguide/pod-execution-role.html) in the Amazon EKS User Guide. type: string podExecutionRoleRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object selectors: description: |- The selectors to match for a Pod to use this Fargate profile. Each selector must have an associated Kubernetes namespace. Optionally, you can also specify labels for a namespace. You may specify up to five selectors in a Fargate profile. items: description: An object representing an Fargate profile selector. properties: labels: additionalProperties: type: string type: object namespace: type: string type: object type: array subnetRefs: items: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object type: array subnets: description: |- The IDs of subnets to launch a Pod into. A Pod running on Fargate isn't assigned a public IP address, so only private subnets (with no direct route to an Internet Gateway) are accepted for this parameter. items: type: string type: array tags: additionalProperties: type: string description: |- Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources. type: object required: - name type: object status: description: FargateProfileStatus defines the observed state of FargateProfile properties: ackResourceMetadata: description: |- All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource properties: arn: description: |- ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an "adopted" resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR's Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270 type: string ownerAccountID: description: |- OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource. type: string partition: description: Partition is the AWS partition in which the resource exists or will exist type: string region: description: Region is the AWS region in which the resource exists or will exist. type: string required: - ownerAccountID - region type: object conditions: description: |- All CRs managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array createdAt: description: The Unix epoch timestamp at object creation. format: date-time type: string health: description: |- The health status of the Fargate profile. If there are issues with your Fargate profile's health, they are listed here. properties: issues: items: description: An issue that is associated with the Fargate profile. properties: code: type: string message: type: string resourceIDs: items: type: string type: array type: object type: array type: object status: description: The current status of the Fargate profile. type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/eks.services.k8s.aws_identityproviderconfigs.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: identityproviderconfigs.eks.services.k8s.aws spec: group: eks.services.k8s.aws names: kind: IdentityProviderConfig listKind: IdentityProviderConfigList plural: identityproviderconfigs singular: identityproviderconfig scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: IdentityProviderConfig is the Schema for the IdentityProviderConfigs API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- IdentityProviderConfigSpec defines the desired state of IdentityProviderConfig. An object representing an identity provider configuration. properties: clusterName: description: The name of your cluster. type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf clusterRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object oidc: description: An object representing an OpenID Connect (OIDC) identity provider configuration. properties: clientID: type: string groupsClaim: type: string groupsPrefix: type: string identityProviderConfigName: type: string issuerURL: type: string requiredClaims: additionalProperties: type: string type: object usernameClaim: type: string usernamePrefix: type: string type: object x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf tags: additionalProperties: type: string description: |- Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources. type: object x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf required: - oidc type: object status: description: IdentityProviderConfigStatus defines the observed state of IdentityProviderConfig properties: ackResourceMetadata: description: |- All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource properties: arn: description: |- ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an "adopted" resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR's Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270 type: string ownerAccountID: description: |- OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource. type: string partition: description: Partition is the AWS partition in which the resource exists or will exist type: string region: description: Region is the AWS region in which the resource exists or will exist. type: string required: - ownerAccountID - region type: object conditions: description: |- All CRs managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array status: description: The status of the OIDC identity provider. type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/eks.services.k8s.aws_nodegroups.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: nodegroups.eks.services.k8s.aws spec: group: eks.services.k8s.aws names: kind: Nodegroup listKind: NodegroupList plural: nodegroups singular: nodegroup scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.clusterName name: CLUSTER type: string - jsonPath: .spec.version name: VERSION type: string - jsonPath: .status.status name: STATUS type: string - jsonPath: .spec.releaseVersion name: RELEASEVERSION priority: 1 type: string - jsonPath: .status.desiredSize name: DESIREDSIZE type: integer - jsonPath: .spec.scalingConfig.minSize name: MINSIZE type: integer - jsonPath: .spec.scalingConfig.maxSize name: MAXSIZE type: integer - jsonPath: .spec.diskSize name: DISKSIZE priority: 1 type: integer - jsonPath: .status.conditions[?(@.type=="ACK.ResourceSynced")].status name: Synced type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: Nodegroup is the Schema for the Nodegroups API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- NodegroupSpec defines the desired state of Nodegroup. An object representing an Amazon EKS managed node group. properties: amiType: description: |- The AMI type for your node group. If you specify launchTemplate, and your launch template uses a custom AMI, then don't specify amiType, or the node group deployment will fail. If your launch template uses a Windows custom AMI, then add eks:kube-proxy-windows to your Windows nodes rolearn in the aws-auth ConfigMap. For more information about using launch templates with Amazon EKS, see Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf capacityType: description: The capacity type for your node group. type: string clientRequestToken: description: |- A unique, case-sensitive identifier that you provide to ensurethe idempotency of the request. type: string clusterName: description: The name of your cluster. type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf clusterRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object diskSize: description: |- The root device disk size (in GiB) for your node group instances. The default disk size is 20 GiB for Linux and Bottlerocket. The default disk size is 50 GiB for Windows. If you specify launchTemplate, then don't specify diskSize, or the node group deployment will fail. For more information about using launch templates with Amazon EKS, see Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. format: int64 type: integer x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf instanceTypes: description: |- Specify the instance types for a node group. If you specify a GPU instance type, make sure to also specify an applicable GPU AMI type with the amiType parameter. If you specify launchTemplate, then you can specify zero or one instance type in your launch template or you can specify 0-20 instance types for instanceTypes. If however, you specify an instance type in your launch template and specify any instanceTypes, the node group deployment will fail. If you don't specify an instance type in a launch template or for instanceTypes, then t3.medium is used, by default. If you specify Spot for capacityType, then we recommend specifying multiple values for instanceTypes. For more information, see Managed node group capacity types (https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html#managed-node-group-capacity-types) and Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. items: type: string type: array x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf labels: additionalProperties: type: string description: |- The Kubernetes labels to apply to the nodes in the node group when they are created. type: object launchTemplate: description: |- An object representing a node group's launch template specification. When using this object, don't directly specify instanceTypes, diskSize, or remoteAccess. You cannot later specify a different launch template ID or name than what was used to create the node group. Make sure that the launch template meets the requirements in launchTemplateSpecification. Also refer to Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. properties: id: type: string name: type: string version: type: string type: object name: description: The unique name to give your node group. type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf nodeRole: description: |- The Amazon Resource Name (ARN) of the IAM role to associate with your node group. The Amazon EKS worker node kubelet daemon makes calls to Amazon Web Services APIs on your behalf. Nodes receive permissions for these API calls through an IAM instance profile and associated policies. Before you can launch nodes and register them into a cluster, you must create an IAM role for those nodes to use when they are launched. For more information, see Amazon EKS node IAM role (https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html) in the Amazon EKS User Guide . If you specify launchTemplate, then don't specify IamInstanceProfile (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IamInstanceProfile.html) in your launch template, or the node group deployment will fail. For more information about using launch templates with Amazon EKS, see Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf nodeRoleRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object releaseVersion: description: |- The AMI version of the Amazon EKS optimized AMI to use with your node group. By default, the latest available AMI version for the node group's current Kubernetes version is used. For information about Linux versions, see Amazon EKS optimized Amazon Linux AMI versions (https://docs.aws.amazon.com/eks/latest/userguide/eks-linux-ami-versions.html) in the Amazon EKS User Guide. Amazon EKS managed node groups support the November 2022 and later releases of the Windows AMIs. For information about Windows versions, see Amazon EKS optimized Windows AMI versions (https://docs.aws.amazon.com/eks/latest/userguide/eks-ami-versions-windows.html) in the Amazon EKS User Guide. If you specify launchTemplate, and your launch template uses a custom AMI, then don't specify releaseVersion, or the node group deployment will fail. For more information about using launch templates with Amazon EKS, see Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. type: string remoteAccess: description: |- The remote access configuration to use with your node group. For Linux, the protocol is SSH. For Windows, the protocol is RDP. If you specify launchTemplate, then don't specify remoteAccess, or the node group deployment will fail. For more information about using launch templates with Amazon EKS, see Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. properties: ec2SshKey: type: string sourceSecurityGroupRefs: description: Reference field for SourceSecurityGroups items: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object type: array sourceSecurityGroups: items: type: string type: array type: object x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf scalingConfig: description: |- The scaling configuration details for the Auto Scaling group that is created for your node group. properties: desiredSize: format: int64 type: integer maxSize: format: int64 type: integer minSize: format: int64 type: integer type: object subnetRefs: items: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object type: array subnets: description: |- The subnets to use for the Auto Scaling group that is created for your node group. If you specify launchTemplate, then don't specify SubnetId (https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInterface.html) in your launch template, or the node group deployment will fail. For more information about using launch templates with Amazon EKS, see Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. items: type: string type: array x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf tags: additionalProperties: type: string description: |- Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources. type: object taints: description: |- The Kubernetes taints to be applied to the nodes in the node group. For more information, see Node taints on managed node groups (https://docs.aws.amazon.com/eks/latest/userguide/node-taints-managed-node-groups.html). items: description: |- A property that allows a node to repel a Pod. For more information, see Node taints on managed node groups (https://docs.aws.amazon.com/eks/latest/userguide/node-taints-managed-node-groups.html) in the Amazon EKS User Guide. properties: effect: type: string key: type: string value: type: string type: object type: array updateConfig: description: The node group update configuration. properties: maxUnavailable: format: int64 type: integer maxUnavailablePercentage: format: int64 type: integer type: object version: description: |- The Kubernetes version to use for your managed nodes. By default, the Kubernetes version of the cluster is used, and this is the only accepted specified value. If you specify launchTemplate, and your launch template uses a custom AMI, then don't specify version, or the node group deployment will fail. For more information about using launch templates with Amazon EKS, see Customizing managed nodes with launch templates (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) in the Amazon EKS User Guide. type: string required: - name type: object status: description: NodegroupStatus defines the observed state of Nodegroup properties: ackResourceMetadata: description: |- All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource properties: arn: description: |- ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an "adopted" resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR's Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270 type: string ownerAccountID: description: |- OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource. type: string partition: description: Partition is the AWS partition in which the resource exists or will exist type: string region: description: Region is the AWS region in which the resource exists or will exist. type: string required: - ownerAccountID - region type: object conditions: description: |- All CRs managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array createdAt: description: The Unix epoch timestamp at object creation. format: date-time type: string desiredSize: format: int64 type: integer health: description: |- The health status of the node group. If there are issues with your node group's health, they are listed here. properties: issues: items: description: An object representing an issue with an Amazon EKS resource. properties: code: type: string message: type: string resourceIDs: items: type: string type: array type: object type: array type: object modifiedAt: description: The Unix epoch timestamp for the last modification to the object. format: date-time type: string resources: description: |- The resources associated with the node group, such as Auto Scaling groups and security groups for remote access. properties: autoScalingGroups: items: description: |- An Auto Scaling group that is associated with an Amazon EKS managed node group. properties: name: type: string type: object type: array remoteAccessSecurityGroup: type: string type: object status: description: The current status of the managed node group. type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/eks.services.k8s.aws_podidentityassociations.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: podidentityassociations.eks.services.k8s.aws spec: group: eks.services.k8s.aws names: kind: PodIdentityAssociation listKind: PodIdentityAssociationList plural: podidentityassociations singular: podidentityassociation scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.clusterName name: CLUSTER type: string - jsonPath: .spec.namespace name: NAMESPACE type: string - jsonPath: .spec.serviceAccount name: SERVICEACCOUNT type: string - jsonPath: .spec.roleARN name: ROLEARN priority: 1 type: string - jsonPath: .status.associationID name: ASSOCIATIONID priority: 1 type: string - jsonPath: .status.conditions[?(@.type=="ACK.ResourceSynced")].status name: Synced type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: PodIdentityAssociation is the Schema for the PodIdentityAssociations API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- PodIdentityAssociationSpec defines the desired state of PodIdentityAssociation. Amazon EKS Pod Identity associations provide the ability to manage credentials for your applications, similar to the way that Amazon EC2 instance profiles provide credentials to Amazon EC2 instances. properties: clientRequestToken: description: |- A unique, case-sensitive identifier that you provide to ensurethe idempotency of the request. type: string clusterName: description: The name of the cluster to create the EKS Pod Identity association in. type: string clusterRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object disableSessionTags: description: |- Disable the automatic sessions tags that are appended by EKS Pod Identity. EKS Pod Identity adds a pre-defined set of session tags when it assumes the role. You can use these tags to author a single role that can work across resources by allowing access to Amazon Web Services resources based on matching tags. By default, EKS Pod Identity attaches six tags, including tags for cluster name, namespace, and service account name. For the list of tags added by EKS Pod Identity, see List of session tags added by EKS Pod Identity (https://docs.aws.amazon.com/eks/latest/userguide/pod-id-abac.html#pod-id-abac-tags) in the Amazon EKS User Guide. Amazon Web Services compresses inline session policies, managed policy ARNs, and session tags into a packed binary format that has a separate limit. If you receive a PackedPolicyTooLarge error indicating the packed binary format has exceeded the size limit, you can attempt to reduce the size by disabling the session tags added by EKS Pod Identity. type: boolean namespace: description: |- The name of the Kubernetes namespace inside the cluster to create the EKS Pod Identity association in. The service account and the Pods that use the service account must be in this namespace. type: string policy: description: |- An optional IAM policy in JSON format (as an escaped string) that applies additional restrictions to this pod identity association beyond the IAM policies attached to the IAM role. This policy is applied as the intersection of the role's policies and this policy, allowing you to reduce the permissions that applications in the pods can use. Use this policy to enforce least privilege access while still leveraging a shared IAM role across multiple applications. Important considerations - Session tags: When using this policy, disableSessionTags must be set to true. - Target role permissions: If you specify both a TargetRoleArn and a policy, the policy restrictions apply only to the target role's permissions, not to the initial role used for assuming the target role. type: string roleARN: description: |- The Amazon Resource Name (ARN) of the IAM role to associate with the service account. The EKS Pod Identity agent manages credentials to assume this role for applications in the containers in the Pods that use this service account. type: string roleRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object serviceAccount: description: |- The name of the Kubernetes service account inside the cluster to associate the IAM credentials with. type: string tags: additionalProperties: type: string description: |- Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources. The following basic restrictions apply to tags: - Maximum number of tags per resource – 50 - For each resource, each tag key must be unique, and each tag key can have only one value. - Maximum key length – 128 Unicode characters in UTF-8 - Maximum value length – 256 Unicode characters in UTF-8 - If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @. - Tag keys and values are case-sensitive. - Do not use aws:, AWS:, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for Amazon Web Services use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit. type: object targetRoleARN: description: |- The Amazon Resource Name (ARN) of the target IAM role to associate with the service account. This role is assumed by using the EKS Pod Identity association role, then the credentials for this role are injected into the Pod. When you run applications on Amazon EKS, your application might need to access Amazon Web Services resources from a different role that exists in the same or different Amazon Web Services account. For example, your application running in “Account A” might need to access resources, such as Amazon S3 buckets in “Account B” or within “Account A” itself. You can create a association to access Amazon Web Services resources in “Account B” by creating two IAM roles: a role in “Account A” and a role in “Account B” (which can be the same or different account), each with the necessary trust and permission policies. After you provide these roles in the IAM role and Target IAM role fields, EKS will perform role chaining to ensure your application gets the required permissions. This means Role A will assume Role B, allowing your Pods to securely access resources like S3 buckets in the target account. type: string targetRoleRef: description: "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t \ name: my-api" properties: from: description: |- AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name) properties: name: type: string namespace: type: string type: object type: object required: - namespace - serviceAccount type: object status: description: PodIdentityAssociationStatus defines the observed state of PodIdentityAssociation properties: ackResourceMetadata: description: |- All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource properties: arn: description: |- ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an "adopted" resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR's Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270 type: string ownerAccountID: description: |- OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource. type: string partition: description: Partition is the AWS partition in which the resource exists or will exist type: string region: description: Region is the AWS region in which the resource exists or will exist. type: string required: - ownerAccountID - region type: object associationARN: description: The Amazon Resource Name (ARN) of the association. type: string associationID: description: The ID of the association. type: string conditions: description: |- All CRs managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array createdAt: description: The timestamp that the association was created at. format: date-time type: string externalID: description: |- The unique identifier for this EKS Pod Identity association for a target IAM role. You put this value in the trust policy of the target role, in a Condition to match the sts.ExternalId. This ensures that the target role can only be assumed by this association. This prevents the confused deputy problem. For more information about the confused deputy problem, see The confused deputy problem (https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) in the IAM User Guide. If you want to use the same target role with multiple associations or other roles, use independent statements in the trust policy to allow sts:AssumeRole access from each role. type: string modifiedAt: description: The most recent timestamp that the association was modified at. format: date-time type: string ownerARN: description: If defined, the EKS Pod Identity association is owned by an Amazon EKS add-on. type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/services.k8s.aws_fieldexports.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: fieldexports.services.k8s.aws spec: group: services.k8s.aws names: kind: FieldExport listKind: FieldExportList plural: fieldexports singular: fieldexport scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: FieldExport is the schema for the FieldExport API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: FieldExportSpec defines the desired state of the FieldExport. properties: from: description: |- ResourceFieldSelector provides the values necessary to identify an individual field on an individual K8s resource. properties: path: type: string resource: description: |- NamespacedResource provides all the values necessary to identify an ACK resource of a given type (within the same namespace as the custom resource containing this type). properties: group: type: string kind: type: string name: type: string required: - group - kind - name type: object required: - path - resource type: object to: description: |- FieldExportTarget provides the values necessary to identify the output path for a field export. properties: key: description: Key overrides the default value (`.`) for the FieldExport target type: string kind: description: |- FieldExportOutputType represents all types that can be produced by a field export operation enum: - configmap - secret type: string name: type: string namespace: description: Namespace is marked as optional, so we cannot compose `NamespacedName` type: string required: - kind - name type: object required: - from - to type: object status: description: FieldExportStatus defines the observed status of the FieldExport. properties: conditions: description: |- A collection of `ackv1alpha1.Condition` objects that describe the various recoverable states of the field CR items: description: |- Condition is the common struct used by all CRDs managed by ACK service controllers to indicate terminal states of the CR and its backend AWS service API resource properties: lastTransitionTime: description: Last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type is the type of the Condition type: string required: - status - type type: object type: array required: - conditions type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/crds/services.k8s.aws_iamroleselectors.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 name: iamroleselectors.services.k8s.aws spec: group: services.k8s.aws names: kind: IAMRoleSelector listKind: IAMRoleSelectorList plural: iamroleselectors singular: iamroleselector scope: Cluster versions: - name: v1alpha1 schema: openAPIV3Schema: description: IAMRoleSelector is the schema for the IAMRoleSelector API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: properties: arn: type: string x-kubernetes-validations: - message: Value is immutable once set rule: self == oldSelf namespaceSelector: description: IAMRoleSelectorSpec defines the desired state of IAMRoleSelector properties: labelSelector: description: LabelSelector is a label query over a set of resources. properties: matchLabels: additionalProperties: type: string type: object required: - matchLabels type: object names: items: type: string type: array required: - names type: object resourceLabelSelector: description: LabelSelector is a label query over a set of resources. properties: matchLabels: additionalProperties: type: string type: object required: - matchLabels type: object resourceTypeSelector: items: properties: group: type: string kind: type: string version: type: string required: - group - kind - version type: object type: array required: - arn type: object status: type: object type: object served: true storage: true subresources: status: {} --- # Source: eks-chart/templates/service-account.yaml apiVersion: v1 kind: ServiceAccount metadata: labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 name: ack-eks-controller namespace: ack-system annotations: --- # Source: eks-chart/templates/caches-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ack-eks-eks-chart-namespaces-cache labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 rules: - apiGroups: - "" resources: - namespaces verbs: - get - list - watch --- # Source: eks-chart/templates/cluster-role-controller.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ack-eks-eks-chart labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 rules: - apiGroups: - "" resources: - configmaps - secrets verbs: - get - list - patch - watch - apiGroups: - "" resources: - namespaces verbs: - get - list - watch - apiGroups: - ec2.services.k8s.aws resources: - securitygroups - securitygroups/status - subnets - subnets/status verbs: - get - list - apiGroups: - eks.services.k8s.aws resources: - accessentries - addons - capabilities - clusters - fargateprofiles - identityproviderconfigs - nodegroups - podidentityassociations verbs: - create - delete - get - list - patch - update - watch - apiGroups: - eks.services.k8s.aws resources: - accessentries/status - addons/status - capabilities/status - clusters/status - fargateprofiles/status - identityproviderconfigs/status - nodegroups/status - podidentityassociations/status verbs: - get - patch - update - apiGroups: - iam.services.k8s.aws resources: - roles - roles/status verbs: - get - list - apiGroups: - kms.services.k8s.aws resources: - keys - keys/status verbs: - get - list - apiGroups: - services.k8s.aws resources: - fieldexports - iamroleselectors verbs: - create - delete - get - list - patch - update - watch - apiGroups: - services.k8s.aws resources: - fieldexports/status - iamroleselectors/status verbs: - get - patch - update --- # Source: eks-chart/templates/caches-role-binding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: ack-eks-eks-chart-namespaces-cache labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 roleRef: kind: ClusterRole apiGroup: rbac.authorization.k8s.io name: ack-eks-eks-chart-namespaces-cache subjects: - kind: ServiceAccount name: ack-eks-controller namespace: ack-system --- # Source: eks-chart/templates/cluster-role-binding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: ack-eks-eks-chart-rolebinding labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 roleRef: kind: ClusterRole apiGroup: rbac.authorization.k8s.io name: ack-eks-eks-chart subjects: - kind: ServiceAccount name: ack-eks-controller namespace: ack-system --- # Source: eks-chart/templates/caches-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: ack-eks-eks-chart-configmaps-cache namespace: ack-system labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 rules: - apiGroups: - "" resources: - configmaps verbs: - get - list - watch --- # Source: eks-chart/templates/role-reader.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: creationTimestamp: null name: ack-eks-eks-chart-reader namespace: ack-system labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 rules: - apiGroups: - eks.services.k8s.aws resources: - accessentries - addons - capabilities - clusters - fargateprofiles - identityproviderconfigs - nodegroups - podidentityassociations verbs: - get - list - watch --- # Source: eks-chart/templates/role-writer.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: creationTimestamp: null name: ack-eks-eks-chart-writer namespace: ack-system labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 rules: - apiGroups: - eks.services.k8s.aws resources: - accessentries - addons - capabilities - clusters - fargateprofiles - identityproviderconfigs - nodegroups - podidentityassociations verbs: - create - delete - get - list - patch - update - watch - apiGroups: - eks.services.k8s.aws resources: - accessentries - addons - capabilities - clusters - fargateprofiles - identityproviderconfigs - nodegroups - podidentityassociations verbs: - get - patch - update --- # Source: eks-chart/templates/caches-role-binding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: ack-eks-eks-chart-configmaps-cache namespace: ack-system labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 roleRef: kind: Role apiGroup: rbac.authorization.k8s.io name: ack-eks-eks-chart-configmaps-cache subjects: - kind: ServiceAccount name: ack-eks-controller namespace: ack-system --- # Source: eks-chart/templates/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: ack-eks-eks-chart namespace: ack-system labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "1.16.3" k8s-app: eks-chart helm.sh/chart: eks-chart-1.16.3 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks template: metadata: labels: app.kubernetes.io/name: eks-chart app.kubernetes.io/instance: ack-eks app.kubernetes.io/managed-by: Helm k8s-app: eks-chart spec: serviceAccountName: ack-eks-controller containers: - command: - ./bin/controller args: - --aws-region - "$(AWS_REGION)" - --aws-endpoint-url - "$(AWS_ENDPOINT_URL)" - --log-level - "$(ACK_LOG_LEVEL)" - --resource-tags - "$(ACK_RESOURCE_TAGS)" - --watch-namespace - "$(ACK_WATCH_NAMESPACE)" - --watch-selectors - "$(ACK_WATCH_SELECTORS)" - --reconcile-resources - "$(RECONCILE_RESOURCES)" - --deletion-policy - "$(DELETION_POLICY)" - --reconcile-default-resync-seconds - "$(RECONCILE_DEFAULT_RESYNC_SECONDS)" - --reconcile-default-max-concurrent-syncs - "$(RECONCILE_DEFAULT_MAX_CONCURRENT_SYNCS)" - --feature-gates - "$(FEATURE_GATES)" - --enable-carm=true - --enable-cross-namespace=true image: public.ecr.aws/aws-controllers-k8s/eks-controller:1.16.3 imagePullPolicy: IfNotPresent name: controller ports: - name: http containerPort: 8080 resources: limits: cpu: 100m memory: 128Mi requests: cpu: 50m memory: 64Mi env: - name: ACK_SYSTEM_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: AWS_REGION value: confighubplaceholder - name: AWS_ENDPOINT_URL value: "" - name: AWS_IDENTITY_ENDPOINT_URL value: "" - name: ACK_WATCH_NAMESPACE value: - name: ACK_WATCH_SELECTORS value: - name: RECONCILE_RESOURCES value: "AccessEntry,Addon,Capability,Cluster,FargateProfile,IdentityProviderConfig,Nodegroup,PodIdentityAssociation" - name: DELETION_POLICY value: retain - name: LEADER_ELECTION_NAMESPACE value: "" - name: ACK_LOG_LEVEL value: "info" - name: ACK_RESOURCE_TAGS value: "services.k8s.aws/controller-version=%CONTROLLER_SERVICE%-%CONTROLLER_VERSION%,services.k8s.aws/namespace=%K8S_NAMESPACE%,app.kubernetes.io/managed-by=%MANAGED_BY%,kro.run/kro-version=%KRO_VERSION%" - name: RECONCILE_DEFAULT_RESYNC_SECONDS value: "36000" - name: RECONCILE_DEFAULT_MAX_CONCURRENT_SYNCS value: "1" - name: FEATURE_GATES value: IAMRoleSelector=false,ReadOnlyResources=true,ResourceAdoption=true,ServiceLevelCARM=false,TeamLevelCARM=false - name: AWS_SHARED_CREDENTIALS_FILE value: /var/run/secrets/aws/credentials - name: AWS_PROFILE value: default volumeMounts: - name: aws-creds mountPath: /var/run/secrets/aws readOnly: true securityContext: allowPrivilegeEscalation: false privileged: false readOnlyRootFilesystem: true runAsNonRoot: true capabilities: drop: - ALL livenessProbe: httpGet: path: /healthz port: 8081 initialDelaySeconds: 15 periodSeconds: 20 readinessProbe: httpGet: path: /readyz port: 8081 initialDelaySeconds: 5 periodSeconds: 10 securityContext: seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 10 nodeSelector: kubernetes.io/os: linux hostIPC: false hostPID: false hostNetwork: false dnsPolicy: ClusterFirst volumes: - name: aws-creds secret: secretName: aws-creds