controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: rosacontrolplanes.controlplane.cluster.x-k8s.io
spec:
  group: controlplane.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: ROSAControlPlane
    listKind: ROSAControlPlaneList
    plural: rosacontrolplanes
    shortNames:
    - rosacp
    singular: rosacontrolplane
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Cluster to which this RosaControl belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: Control plane infrastructure is ready for worker nodes
      jsonPath: .status.ready
      name: Ready
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: ROSAControlPlane is the Schema for the ROSAControlPlanes API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: RosaControlPlaneSpec defines the desired state of ROSAControlPlane.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: AdditionalTags are user-defined tags to be added on the
                  AWS resources associated with the control plane.
                type: object
              auditLogRoleARN:
                description: |-
                  AuditLogRoleARN defines the role that is used to forward audit logs to AWS CloudWatch.
                  If not set, audit log forwarding is disabled.
                type: string
              autoNode:
                description: autoNode set the autoNode mode and roleARN.
                properties:
                  mode:
                    default: Disabled
                    description: mode specifies the mode for the AutoNode. Setting
                      Enable/Disable mode will allows/disallow karpenter AutoNode
                      scaling.
                    enum:
                    - Enabled
                    - Disabled
                    type: string
                  roleARN:
                    description: |-
                      roleARN sets the autoNode role ARN, which includes the IAM policy and cluster-specific role that grant the necessary permissions to the Karpenter controller.
                      The role must be attached with the same OIDC-ID that is used with the ROSA-HCP cluster.
                    maxLength: 2048
                    type: string
                type: object
              availabilityZones:
                description: |-
                  AvailabilityZones describe AWS AvailabilityZones of the worker nodes.
                  should match the AvailabilityZones of the provided Subnets.
                  a machinepool will be created for each availabilityZone.
                items:
                  type: string
                type: array
              billingAccount:
                description: |-
                  BillingAccount is an optional AWS account to use for billing the subscription fees for ROSA HCP clusters.
                  The cost of running each ROSA HCP cluster will be billed to the infrastructure account in which the cluster
                  is running.
                type: string
                x-kubernetes-validations:
                - message: billingAccount is immutable
                  rule: self == oldSelf
                - message: billingAccount must be a valid AWS account ID
                  rule: self.matches('^[0-9]{12}$')
              channel:
                description: |-
                  Channel is the Y-stream OpenShift channel to use for this cluster, for example "stable-4.16" or "eus-4.16".
                  This determines which Y-stream versions are available for upgrades.
                  When not specified, OCM will determine the appropriate channel based on the cluster version.
                  If Channel is set, ChannelGroup will be ignored.
                pattern: ^(stable|eus|fast|candidate|nightly)-[0-9]+\.[0-9]+$
                type: string
              channelGroup:
                description: |-
                  OpenShift version channel group.
                  When not specified, OCM will determine the appropriate channel group based on the cluster version.
                  This field will be deprecated in a future release in favor of the Channel field.
                enum:
                - stable
                - eus
                - fast
                - candidate
                - nightly
                type: string
              cloudWatchlogForwarder:
                description: cloudWatchlogForwarder set the cloudWatch log forward
                  config for applications and groupVersions.
                properties:
                  applications:
                    description: applications list included in the groupLog Ids ex;
                      for groupLog api allowed applications as audit-webhook.
                    items:
                      type: string
                    type: array
                  cloudWatchLogGroupName:
                    description: cloudWatchLogGroupName is the name of the CloudWatch
                      log group.
                    type: string
                  cloudWatchLogRoleArn:
                    description: cloudWatchLogRoleArn is the ARN of the IAM CloudWatch
                      role for log distribution.
                    type: string
                  groupLogIDs:
                    description: groupLogIDs is list of available groupLog Ids ex;
                      api, authentication, controller manager, scheduler
                    items:
                      type: string
                    type: array
                type: object
              clusterRegistryConfig:
                description: ClusterRegistryConfig represents registry config used
                  with the cluster.
                properties:
                  additionalTrustedCAs:
                    additionalProperties:
                      type: string
                    description: |-
                      AdditionalTrustedCAs containing the registry hostname as the key, and the PEM-encoded certificate as the value,
                      for each additional registry CA to trust.
                    type: object
                  allowedRegistriesForImport:
                    description: |-
                      AllowedRegistriesForImport limits the container image registries that normal users may import
                      images from. Set this list to the registries that you trust to contain valid Docker
                      images and that you want applications to be able to import from.
                    items:
                      description: RegistryLocation contains a location of the registry
                        specified by the registry domain name.
                      properties:
                        domainName:
                          description: |-
                            domainName specifies a domain name for the registry. The domain name might include wildcards, like '*' or '??'.
                            In case the registry use non-standard (80 or 443) port, the port should be included in the domain name as well.
                          type: string
                        insecure:
                          default: false
                          description: insecure indicates whether the registry is
                            secure (https) or insecure (http), default is secured.
                          type: boolean
                      type: object
                    type: array
                  registrySources:
                    description: |-
                      RegistrySources contains configuration that determines how the container runtime
                      should treat individual registries when accessing images. It does not contain configuration
                      for the internal cluster registry. AllowedRegistries, BlockedRegistries are mutually exclusive.
                    properties:
                      allowedRegistries:
                        description: |-
                          AllowedRegistries are the registries for which image pull and push actions are allowed.
                          To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
                          For example, *.example.com.
                          You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
                          All other registries are blocked.
                        items:
                          type: string
                        type: array
                      blockedRegistries:
                        description: |-
                          BlockedRegistries are the registries for which image pull and push actions are denied.
                          To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
                          For example, *.example.com.
                          You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
                          All other registries are allowed.
                        items:
                          type: string
                        type: array
                      insecureRegistries:
                        description: |-
                          InsecureRegistries are registries which do not have a valid TLS certificate or only support HTTP connections.
                          To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
                          For example, *.example.com.
                          You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
                        items:
                          type: string
                        type: array
                    type: object
                type: object
              controlPlaneEndpoint:
                description: ControlPlaneEndpoint represents the endpoint used to
                  communicate with the control plane.
                properties:
                  host:
                    description: host is the hostname on which the API server is serving.
                    maxLength: 512
                    type: string
                  port:
                    description: port is the port on which the API server is serving.
                    format: int32
                    type: integer
                type: object
              credentialsSecretRef:
                description: |-
                  CredentialsSecretRef references a secret with necessary credentials to connect to the OCM API.
                  The secret should contain the following data keys:
                  - ocmToken: eyJhbGciOiJIUzI1NiIsI....
                  - ocmApiUrl: Optional, defaults to 'https://api.openshift.com'
                properties:
                  name:
                    default: ""
                    description: |-
                      Name of the referent.
                      This field is effectively required, but due to backwards compatibility is
                      allowed to be empty. Instances of this type with an empty value here are
                      almost certainly wrong.
                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                    type: string
                type: object
                x-kubernetes-map-type: atomic
              defaultMachinePoolSpec:
                description: |-
                  DefaultMachinePoolSpec defines the configuration for the default machinepool(s) provisioned as part of the cluster creation.
                  One MachinePool will be created with this configuration per AvailabilityZone. Those default machinepools are required for openshift cluster operators
                  to work properly.
                  As these machinepool not created using ROSAMachinePool CR, they will not be visible/managed by ROSA CAPI provider.
                  `rosa list machinepools -c <rosaClusterName>` can be used to view those machinepools.

                  This field will be removed in the future once the current limitation is resolved.
                properties:
                  autoscaling:
                    description: |-
                      Autoscaling specifies auto scaling behaviour for the default MachinePool. Autoscaling min/max value
                      must be equal or multiple of the availability zones count.
                    properties:
                      maxReplicas:
                        minimum: 1
                        type: integer
                      minReplicas:
                        minimum: 0
                        type: integer
                    type: object
                  instanceType:
                    description: The instance type to use, for example `r5.xlarge`.
                      Instance type ref; https://aws.amazon.com/ec2/instance-types/
                    type: string
                  volumeSize:
                    description: VolumeSize set the disk volume size for the default
                      workers machine pool in Gib. The default is 300 GiB.
                    maximum: 16384
                    minimum: 75
                    type: integer
                type: object
              domainPrefix:
                description: |-
                  DomainPrefix is an optional prefix added to the cluster's domain name. It will be used
                  when generating a sub-domain for the cluster on openshiftapps domain. It must be valid DNS-1035 label
                  consisting of lower case alphanumeric characters or '-', start with an alphabetic character
                  end with an alphanumeric character and have a max length of 15 characters.
                maxLength: 15
                pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
                type: string
                x-kubernetes-validations:
                - message: domainPrefix is immutable
                  rule: self == oldSelf
              enableExternalAuthProviders:
                default: false
                description: EnableExternalAuthProviders enables external authentication
                  configuration for the cluster.
                type: boolean
                x-kubernetes-validations:
                - message: enableExternalAuthProviders is immutable
                  rule: self == oldSelf
              endpointAccess:
                default: Public
                description: |-
                  EndpointAccess specifies the publishing scope of cluster endpoints. The
                  default is Public.
                enum:
                - Public
                - Private
                type: string
              etcdEncryptionKMSARN:
                description: |-
                  EtcdEncryptionKMSARN is the ARN of the KMS key used to encrypt etcd. The key itself needs to be
                  created out-of-band by the user and tagged with `red-hat:true`.
                type: string
              externalAuthProviders:
                description: |-
                  ExternalAuthProviders are external OIDC identity providers that can issue tokens for this cluster.
                  Can only be set if "enableExternalAuthProviders" is set to "True".

                  At most one provider can be configured.
                items:
                  description: ExternalAuthProvider is an external OIDC identity provider
                    that can issue tokens for this cluster
                  properties:
                    claimMappings:
                      description: |-
                        ClaimMappings describes rules on how to transform information from an
                        ID token into a cluster identity
                      properties:
                        groups:
                          description: |-
                            Groups is a name of the claim that should be used to construct
                            groups for the cluster identity.
                            The referenced claim must use array of strings values.
                          properties:
                            claim:
                              description: Claim is a JWT token claim to be used in
                                the mapping
                              type: string
                            prefix:
                              description: |-
                                Prefix is a string to prefix the value from the token in the result of the
                                claim mapping.

                                By default, no prefixing occurs.

                                Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
                                an array of strings "a", "b" and  "c", the mapping will result in an
                                array of string "myoidc:a", "myoidc:b" and "myoidc:c".
                              type: string
                          required:
                          - claim
                          type: object
                        username:
                          description: |-
                            Username is a name of the claim that should be used to construct
                            usernames for the cluster identity.

                            Default value: "sub"
                          properties:
                            claim:
                              description: Claim is a JWT token claim to be used in
                                the mapping
                              type: string
                            prefix:
                              description: Prefix is prepended to claim to prevent
                                clashes with existing names.
                              minLength: 1
                              type: string
                            prefixPolicy:
                              description: |-
                                PrefixPolicy specifies how a prefix should apply.

                                By default, claims other than `email` will be prefixed with the issuer URL to
                                prevent naming clashes with other plugins.

                                Set to "NoPrefix" to disable prefixing.

                                Example:
                                    (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
                                        If the JWT claim `username` contains value `userA`, the resulting
                                        mapped value will be "myoidc:userA".
                                    (2) `prefix` is set to "myoidc:" and `claim` is set to "email". If the
                                        JWT `email` claim contains value "userA@myoidc.tld", the resulting
                                        mapped value will be "myoidc:userA@myoidc.tld".
                                    (3) `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
                                        the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
                                        and `claim` is set to:
                                        (a) "username": the mapped value will be "https://myoidc.tld#userA"
                                        (b) "email": the mapped value will be "userA@myoidc.tld"
                              enum:
                              - ""
                              - NoPrefix
                              - Prefix
                              type: string
                          required:
                          - claim
                          type: object
                          x-kubernetes-validations:
                          - message: prefix must be set if prefixPolicy is 'Prefix',
                              but must remain unset otherwise
                            rule: 'self.prefixPolicy == ''Prefix'' ? has(self.prefix)
                              : !has(self.prefix)'
                      type: object
                    claimValidationRules:
                      description: ClaimValidationRules are rules that are applied
                        to validate token claims to authenticate users.
                      items:
                        description: TokenClaimValidationRule validates token claims
                          to authenticate users.
                        properties:
                          requiredClaim:
                            description: RequiredClaim allows configuring a required
                              claim name and its expected value
                            properties:
                              claim:
                                description: |-
                                  Claim is a name of a required claim. Only claims with string values are
                                  supported.
                                minLength: 1
                                type: string
                              requiredValue:
                                description: RequiredValue is the required value for
                                  the claim.
                                minLength: 1
                                type: string
                            required:
                            - claim
                            - requiredValue
                            type: object
                          type:
                            default: RequiredClaim
                            description: Type sets the type of the validation rule
                            enum:
                            - RequiredClaim
                            type: string
                        required:
                        - requiredClaim
                        - type
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    issuer:
                      description: Issuer describes attributes of the OIDC token issuer
                      properties:
                        audiences:
                          description: |-
                            Audiences is an array of audiences that the token was issued for.
                            Valid tokens must include at least one of these values in their
                            "aud" claim.
                            Must be set to exactly one value.
                          items:
                            description: TokenAudience is the audience that the token
                              was issued for.
                            minLength: 1
                            type: string
                          maxItems: 10
                          minItems: 1
                          type: array
                          x-kubernetes-list-type: set
                        issuerCertificateAuthority:
                          description: |-
                            CertificateAuthority is a reference to a config map in the
                            configuration namespace. The .data of the configMap must contain
                            the "ca-bundle.crt" key.
                            If unset, system trust is used instead.
                          properties:
                            name:
                              description: Name is the metadata.name of the referenced
                                object.
                              type: string
                          required:
                          - name
                          type: object
                        issuerURL:
                          description: |-
                            URL is the serving URL of the token issuer.
                            Must use the https:// scheme.
                          pattern: ^https:\/\/[^\s]
                          type: string
                      required:
                      - audiences
                      - issuerURL
                      type: object
                    name:
                      description: Name of the OIDC provider
                      minLength: 1
                      type: string
                    oidcClients:
                      description: |-
                        OIDCClients contains configuration for the platform's clients that
                        need to request tokens from the issuer
                      items:
                        description: |-
                          OIDCClientConfig contains configuration for the platform's client that
                          need to request tokens from the issuer.
                        properties:
                          clientID:
                            description: ClientID is the identifier of the OIDC client
                              from the OIDC provider
                            minLength: 1
                            type: string
                          clientSecret:
                            description: |-
                              ClientSecret refers to a secret that
                              contains the client secret in the `clientSecret` key of the `.data` field
                            properties:
                              name:
                                description: Name is the metadata.name of the referenced
                                  object.
                                type: string
                            required:
                            - name
                            type: object
                          componentName:
                            description: |-
                              ComponentName is the name of the component that is supposed to consume this
                              client configuration
                            maxLength: 256
                            minLength: 1
                            type: string
                          componentNamespace:
                            description: |-
                              ComponentNamespace is the namespace of the component that is supposed to consume this
                              client configuration
                            maxLength: 63
                            minLength: 1
                            type: string
                          extraScopes:
                            description: ExtraScopes is an optional set of scopes
                              to request tokens with.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: set
                        required:
                        - clientID
                        - clientSecret
                        - componentName
                        - componentNamespace
                        type: object
                      maxItems: 20
                      type: array
                      x-kubernetes-list-map-keys:
                      - componentNamespace
                      - componentName
                      x-kubernetes-list-type: map
                  required:
                  - issuer
                  - name
                  type: object
                maxItems: 1
                type: array
                x-kubernetes-list-map-keys:
                - name
                x-kubernetes-list-type: map
              fips:
                default: Disabled
                description: |-
                  FIPS configures FIPS-validated / Modules in Process cryptographic libraries.
                  FIPS (Federal Information Processing Standard) 140-2 is a U.S. government standard
                  that validates cryptographic modules used to protect sensitive information.

                  When set to "Enabled", the cluster will use FIPS 140-2 validated cryptographic modules.
                  This setting is immutable and cannot be changed after cluster creation.

                  IMPORTANT: When FIPS is enabled, etcdEncryptionKMSARN must be provided.
                  The KMS key must be tagged with 'red-hat:true'.
                enum:
                - Enabled
                - Disabled
                type: string
                x-kubernetes-validations:
                - message: fips is immutable
                  rule: self == oldSelf
              identityRef:
                description: |-
                  IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
                  If no identity is specified, the default identity for this controller will be used.
                properties:
                  kind:
                    description: Kind of the identity.
                    enum:
                    - AWSClusterControllerIdentity
                    - AWSClusterRoleIdentity
                    - AWSClusterStaticIdentity
                    type: string
                  name:
                    description: Name of the identity.
                    minLength: 1
                    type: string
                required:
                - kind
                - name
                type: object
              installerRoleARN:
                description: |-
                  InstallerRoleARN is an AWS IAM role that OpenShift Cluster Manager will assume to create the cluster.
                  Required if RosaRoleConfigRef is not specified.
                type: string
              network:
                description: Network config for the ROSA HCP cluster.
                properties:
                  hostPrefix:
                    default: 23
                    description: Network host prefix which is defaulted to `23` if
                      not specified.
                    type: integer
                  machineCIDR:
                    description: IP addresses block used by OpenShift while installing
                      the cluster, for example "10.0.0.0/16".
                    format: cidr
                    type: string
                  networkType:
                    default: OVNKubernetes
                    description: The CNI network type default is OVNKubernetes.
                    enum:
                    - OVNKubernetes
                    - Other
                    type: string
                  podCIDR:
                    description: IP address block from which to assign pod IP addresses,
                      for example `10.128.0.0/14`.
                    format: cidr
                    type: string
                  serviceCIDR:
                    description: IP address block from which to assign service IP
                      addresses, for example `172.30.0.0/16`.
                    format: cidr
                    type: string
                type: object
              oidcID:
                description: |-
                  The ID of the internal OpenID Connect Provider.
                  Required if RosaRoleConfigRef is not specified.
                type: string
                x-kubernetes-validations:
                - message: oidcID is immutable
                  rule: self == oldSelf
              provisionShardID:
                description: ProvisionShardID defines the shard where ROSA hosted
                  control plane components will be hosted.
                type: string
                x-kubernetes-validations:
                - message: provisionShardID is immutable
                  rule: self == oldSelf
              region:
                description: The AWS Region the cluster lives in.
                type: string
              rolesRef:
                description: |-
                  AWS IAM roles used to perform credential requests by the openshift operators.
                  Required if RosaRoleConfigRef is not specified.
                properties:
                  controlPlaneOperatorARN:
                    description: "ControlPlaneOperatorARN  is an ARN value referencing
                      a role appropriate for the Control Plane Operator.\n\nThe following
                      is an example of a valid policy document:\n\n{\n\t\"Version\":
                      \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
                      \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
                      [\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"arn:aws:route53:::%s\"\n\t\t}\n\t]\n}"
                    type: string
                  imageRegistryARN:
                    description: "ImageRegistryARN is an ARN value referencing a role
                      appropriate for the Image Registry Operator.\n\nThe following
                      is an example of a valid policy document:\n\n{\n\t\"Version\":
                      \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
                      \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"s3:CreateBucket\",\n\t\t\t\t\"s3:DeleteBucket\",\n\t\t\t\t\"s3:PutBucketTagging\",\n\t\t\t\t\"s3:GetBucketTagging\",\n\t\t\t\t\"s3:PutBucketPublicAccessBlock\",\n\t\t\t\t\"s3:GetBucketPublicAccessBlock\",\n\t\t\t\t\"s3:PutEncryptionConfiguration\",\n\t\t\t\t\"s3:GetEncryptionConfiguration\",\n\t\t\t\t\"s3:PutLifecycleConfiguration\",\n\t\t\t\t\"s3:GetLifecycleConfiguration\",\n\t\t\t\t\"s3:GetBucketLocation\",\n\t\t\t\t\"s3:ListBucket\",\n\t\t\t\t\"s3:GetObject\",\n\t\t\t\t\"s3:PutObject\",\n\t\t\t\t\"s3:DeleteObject\",\n\t\t\t\t\"s3:ListBucketMultipartUploads\",\n\t\t\t\t\"s3:AbortMultipartUpload\",\n\t\t\t\t\"s3:ListMultipartUploadParts\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t}\n\t]\n}"
                    type: string
                  ingressARN:
                    description: "The referenced role must have a trust relationship
                      that allows it to be assumed via web identity.\nhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html.\nExample:\n{\n\t\t\"Version\":
                      \"2012-10-17\",\n\t\t\"Statement\": [\n\t\t\t{\n\t\t\t\t\"Effect\":
                      \"Allow\",\n\t\t\t\t\"Principal\": {\n\t\t\t\t\t\"Federated\":
                      \"{{ .ProviderARN }}\"\n\t\t\t\t},\n\t\t\t\t\t\"Action\": \"sts:AssumeRoleWithWebIdentity\",\n\t\t\t\t\"Condition\":
                      {\n\t\t\t\t\t\"StringEquals\": {\n\t\t\t\t\t\t\"{{ .ProviderName
                      }}:sub\": {{ .ServiceAccounts }}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t]\n\t}\n\nIngressARN
                      is an ARN value referencing a role appropriate for the Ingress
                      Operator.\n\nThe following is an example of a valid policy document:\n\n{\n\t\"Version\":
                      \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
                      \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"elasticloadbalancing:DescribeLoadBalancers\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"route53:ListHostedZones\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
                      [\n\t\t\t\t\"route53:ChangeResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
                      [\n\t\t\t\t\"arn:aws:route53:::PUBLIC_ZONE_ID\",\n\t\t\t\t\"arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t]\n\t\t}\n\t]\n}"
                    type: string
                  kmsProviderARN:
                    type: string
                  kubeCloudControllerARN:
                    description: |-
                      KubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
                      Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies

                      The following is an example of a valid policy document:

                       {
                       "Version": "2012-10-17",
                       "Statement": [
                         {
                           "Action": [
                             "autoscaling:DescribeAutoScalingGroups",
                             "autoscaling:DescribeLaunchConfigurations",
                             "autoscaling:DescribeTags",
                             "ec2:DescribeAvailabilityZones",
                             "ec2:DescribeInstances",
                             "ec2:DescribeImages",
                             "ec2:DescribeRegions",
                             "ec2:DescribeRouteTables",
                             "ec2:DescribeSecurityGroups",
                             "ec2:DescribeSubnets",
                             "ec2:DescribeVolumes",
                             "ec2:CreateSecurityGroup",
                             "ec2:CreateTags",
                             "ec2:CreateVolume",
                             "ec2:ModifyInstanceAttribute",
                             "ec2:ModifyVolume",
                             "ec2:AttachVolume",
                             "ec2:AuthorizeSecurityGroupIngress",
                             "ec2:CreateRoute",
                             "ec2:DeleteRoute",
                             "ec2:DeleteSecurityGroup",
                             "ec2:DeleteVolume",
                             "ec2:DetachVolume",
                             "ec2:RevokeSecurityGroupIngress",
                             "ec2:DescribeVpcs",
                             "elasticloadbalancing:AddTags",
                             "elasticloadbalancing:AttachLoadBalancerToSubnets",
                             "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
                             "elasticloadbalancing:CreateLoadBalancer",
                             "elasticloadbalancing:CreateLoadBalancerPolicy",
                             "elasticloadbalancing:CreateLoadBalancerListeners",
                             "elasticloadbalancing:ConfigureHealthCheck",
                             "elasticloadbalancing:DeleteLoadBalancer",
                             "elasticloadbalancing:DeleteLoadBalancerListeners",
                             "elasticloadbalancing:DescribeLoadBalancers",
                             "elasticloadbalancing:DescribeLoadBalancerAttributes",
                             "elasticloadbalancing:DetachLoadBalancerFromSubnets",
                             "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                             "elasticloadbalancing:ModifyLoadBalancerAttributes",
                             "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                             "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
                             "elasticloadbalancing:AddTags",
                             "elasticloadbalancing:CreateListener",
                             "elasticloadbalancing:CreateTargetGroup",
                             "elasticloadbalancing:DeleteListener",
                             "elasticloadbalancing:DeleteTargetGroup",
                             "elasticloadbalancing:DeregisterTargets",
                             "elasticloadbalancing:DescribeListeners",
                             "elasticloadbalancing:DescribeLoadBalancerPolicies",
                             "elasticloadbalancing:DescribeTargetGroups",
                             "elasticloadbalancing:DescribeTargetHealth",
                             "elasticloadbalancing:ModifyListener",
                             "elasticloadbalancing:ModifyTargetGroup",
                             "elasticloadbalancing:RegisterTargets",
                             "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
                             "iam:CreateServiceLinkedRole",
                             "kms:DescribeKey"
                           ],
                           "Resource": [
                             "*"
                           ],
                           "Effect": "Allow"
                         }
                       ]
                      }
                    type: string
                  networkARN:
                    description: "NetworkARN is an ARN value referencing a role appropriate
                      for the Network Operator.\n\nThe following is an example of
                      a valid policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
                      [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:DescribeInstances\",\n
                      \      \"ec2:DescribeInstanceStatus\",\n       \"ec2:DescribeInstanceTypes\",\n
                      \      \"ec2:UnassignPrivateIpAddresses\",\n       \"ec2:AssignPrivateIpAddresses\",\n
                      \      \"ec2:UnassignIpv6Addresses\",\n       \"ec2:AssignIpv6Addresses\",\n
                      \      \"ec2:DescribeSubnets\",\n       \"ec2:DescribeNetworkInterfaces\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t}\n\t]\n}"
                    type: string
                  nodePoolManagementARN:
                    description: "NodePoolManagementARN is an ARN value referencing
                      a role appropriate for the CAPI Controller.\n\nThe following
                      is an example of a valid policy document:\n\n{\n  \"Version\":
                      \"2012-10-17\",\n \"Statement\": [\n   {\n     \"Action\": [\n
                      \      \"ec2:AssociateRouteTable\",\n       \"ec2:AttachInternetGateway\",\n
                      \      \"ec2:AuthorizeSecurityGroupIngress\",\n       \"ec2:CreateInternetGateway\",\n
                      \      \"ec2:CreateNatGateway\",\n       \"ec2:CreateRoute\",\n
                      \      \"ec2:CreateRouteTable\",\n       \"ec2:CreateSecurityGroup\",\n
                      \      \"ec2:CreateSubnet\",\n       \"ec2:CreateTags\",\n       \"ec2:DeleteInternetGateway\",\n
                      \      \"ec2:DeleteNatGateway\",\n       \"ec2:DeleteRouteTable\",\n
                      \      \"ec2:DeleteSecurityGroup\",\n       \"ec2:DeleteSubnet\",\n
                      \      \"ec2:DeleteTags\",\n       \"ec2:DescribeAccountAttributes\",\n
                      \      \"ec2:DescribeAddresses\",\n       \"ec2:DescribeAvailabilityZones\",\n
                      \      \"ec2:DescribeImages\",\n       \"ec2:DescribeInstances\",\n
                      \      \"ec2:DescribeInternetGateways\",\n       \"ec2:DescribeNatGateways\",\n
                      \      \"ec2:DescribeNetworkInterfaces\",\n       \"ec2:DescribeNetworkInterfaceAttribute\",\n
                      \      \"ec2:DescribeRouteTables\",\n       \"ec2:DescribeSecurityGroups\",\n
                      \      \"ec2:DescribeSubnets\",\n       \"ec2:DescribeVpcs\",\n
                      \      \"ec2:DescribeVpcAttribute\",\n       \"ec2:DescribeVolumes\",\n
                      \      \"ec2:DetachInternetGateway\",\n       \"ec2:DisassociateRouteTable\",\n
                      \      \"ec2:DisassociateAddress\",\n       \"ec2:ModifyInstanceAttribute\",\n
                      \      \"ec2:ModifyNetworkInterfaceAttribute\",\n       \"ec2:ModifySubnetAttribute\",\n
                      \      \"ec2:RevokeSecurityGroupIngress\",\n       \"ec2:RunInstances\",\n
                      \      \"ec2:TerminateInstances\",\n       \"tag:GetResources\",\n
                      \      \"ec2:CreateLaunchTemplate\",\n       \"ec2:CreateLaunchTemplateVersion\",\n
                      \      \"ec2:DescribeLaunchTemplates\",\n       \"ec2:DescribeLaunchTemplateVersions\",\n
                      \      \"ec2:DeleteLaunchTemplate\",\n       \"ec2:DeleteLaunchTemplateVersions\"\n
                      \    ],\n     \"Resource\": [\n       \"*\"\n     ],\n     \"Effect\":
                      \"Allow\"\n   },\n   {\n     \"Condition\": {\n       \"StringLike\":
                      {\n         \"iam:AWSServiceName\": \"elasticloadbalancing.amazonaws.com\"\n
                      \      }\n     },\n     \"Action\": [\n       \"iam:CreateServiceLinkedRole\"\n
                      \    ],\n     \"Resource\": [\n       \"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing\"\n
                      \    ],\n     \"Effect\": \"Allow\"\n   },\n   {\n     \"Action\":
                      [\n       \"iam:PassRole\"\n     ],\n     \"Resource\": [\n
                      \      \"arn:*:iam::*:role/*-worker-role\"\n     ],\n     \"Effect\":
                      \"Allow\"\n   },\n\t  {\n\t  \t\"Effect\": \"Allow\",\n\t  \t\"Action\":
                      [\n\t  \t\t\"kms:Decrypt\",\n\t  \t\t\"kms:ReEncrypt\",\n\t
                      \ \t\t\"kms:GenerateDataKeyWithoutPlainText\",\n\t  \t\t\"kms:DescribeKey\"\n\t
                      \ \t],\n\t  \t\"Resource\": \"*\"\n\t  },\n\t  {\n\t  \t\"Effect\":
                      \"Allow\",\n\t  \t\"Action\": [\n\t  \t\t\"kms:CreateGrant\"\n\t
                      \ \t],\n\t  \t\"Resource\": \"*\",\n\t  \t\"Condition\": {\n\t
                      \ \t\t\"Bool\": {\n\t  \t\t\t\"kms:GrantIsForAWSResource\":
                      true\n\t  \t\t}\n\t  \t}\n\t  }\n ]\n}"
                    type: string
                  storageARN:
                    description: "StorageARN is an ARN value referencing a role appropriate
                      for the Storage Operator.\n\nThe following is an example of
                      a valid policy document:\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
                      [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t}\n\t]\n}"
                    type: string
                required:
                - controlPlaneOperatorARN
                - imageRegistryARN
                - ingressARN
                - kmsProviderARN
                - kubeCloudControllerARN
                - networkARN
                - nodePoolManagementARN
                - storageARN
                type: object
              rosaClusterName:
                description: |-
                  Cluster name must be valid DNS-1035 label, so it must consist of lower case alphanumeric
                  characters or '-', start with an alphabetic character, end with an alphanumeric character
                  and have a max length of 54 characters.
                maxLength: 54
                pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
                type: string
                x-kubernetes-validations:
                - message: rosaClusterName is immutable
                  rule: self == oldSelf
              rosaNetworkRef:
                description: |-
                  ROSANetworkRef references ROSANetwork custom resource that contains the networking infrastructure
                  for the ROSA HCP cluster.
                properties:
                  name:
                    default: ""
                    description: |-
                      Name of the referent.
                      This field is effectively required, but due to backwards compatibility is
                      allowed to be empty. Instances of this type with an empty value here are
                      almost certainly wrong.
                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                    type: string
                type: object
                x-kubernetes-map-type: atomic
              rosaRoleConfigRef:
                description: |-
                  RosaRoleConfigRef is a reference to a RosaRoleConfig resource that contains account roles, operator roles and OIDC configuration.
                  RosaRoleConfigRef and role fields such as installerRoleARN, supportRoleARN, workerRoleARN, rolesRef and oidcID are mutually exclusive.
                properties:
                  name:
                    default: ""
                    description: |-
                      Name of the referent.
                      This field is effectively required, but due to backwards compatibility is
                      allowed to be empty. Instances of this type with an empty value here are
                      almost certainly wrong.
                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                    type: string
                type: object
                x-kubernetes-map-type: atomic
              s3LogForwarder:
                description: s3LogForwarder set the AWS S3 log forward config for
                  applications and groupVersions.
                properties:
                  applications:
                    description: applications list included in the groupLog Ids ex;
                      for groupLog api allowed applications as audit-webhook.
                    items:
                      type: string
                    type: array
                  groupLogIDs:
                    description: groupLogIDs is list of available groupLog Ids ex;
                      api, authentication, controller manager, scheduler
                    items:
                      type: string
                    type: array
                  s3ConfigBucketName:
                    description: s3ConfigBucketName is the name of the S3 bucket
                    type: string
                  s3ConfigBucketPrefix:
                    description: s3ConfigBucketPrefix is the prefix to use for objects
                      stored in the S3 bucket.
                    type: string
                type: object
              subnets:
                description: |-
                  The Subnet IDs to use when installing the cluster.
                  SubnetIDs should come in pairs; two per availability zone, one private and one public.
                items:
                  type: string
                type: array
              supportRoleARN:
                description: |-
                  SupportRoleARN is an AWS IAM role used by Red Hat SREs to enable
                  access to the cluster account in order to provide support.
                  Required if RosaRoleConfigRef is not specified.
                type: string
              trustPolicyExternalID:
                description: |-
                  TrustPolicyExternalID is an optional STS external ID that OCM will use when assuming
                  the installer and support account roles.
                  When using RosaRoleConfigRef, this field is ignored, the value is always read from
                  the ROSARoleConfig, which owns the trust policies.
                  When providing role ARNs directly (no RosaRoleConfigRef), the user is responsible for
                  including the sts:ExternalId condition in the roles' trust policies; this field only
                  tells OCM which external ID to present when assuming the roles.
                  Worker roles are not affected.
                  Must be 2–1224 characters matching [a-zA-Z0-9=,.@:/-]+ per AWS STS requirements.
                maxLength: 1224
                minLength: 2
                pattern: ^[a-zA-Z0-9=,.@:\/-]+$
                type: string
                x-kubernetes-validations:
                - message: trustPolicyExternalID is immutable
                  rule: self == oldSelf
              version:
                description: OpenShift semantic version, for example "4.14.5".
                type: string
              versionGate:
                default: WaitForAcknowledge
                description: |-
                  VersionGate requires acknowledgment when upgrading ROSA-HCP y-stream versions (e.g., from 4.15 to 4.16).
                  Default is WaitForAcknowledge.
                  WaitForAcknowledge: If acknowledgment is required, the upgrade will not proceed until VersionGate is set to Acknowledge or AlwaysAcknowledge.
                  Acknowledge: If acknowledgment is required, apply it for the upgrade. After upgrade is done set the version gate to WaitForAcknowledge.
                  AlwaysAcknowledge: If acknowledgment is required, apply it and proceed with the upgrade.
                enum:
                - Acknowledge
                - WaitForAcknowledge
                - AlwaysAcknowledge
                type: string
              workerRoleARN:
                description: |-
                  WorkerRoleARN is an AWS IAM role that will be attached to worker instances.
                  Required if RosaRoleConfigRef is not specified.
                type: string
            required:
            - region
            - rosaClusterName
            - version
            - versionGate
            type: object
          status:
            description: RosaControlPlaneStatus defines the observed state of ROSAControlPlane.
            properties:
              availableChannels:
                description: Available channels for the ROSA hosted control plane.
                items:
                  type: string
                type: array
              availableUpgrades:
                description: Available upgrades for the ROSA hosted control plane.
                items:
                  type: string
                type: array
              conditions:
                description: Conditions specifies the conditions for the managed control
                  plane
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This field may be empty.
                      maxLength: 10240
                      minLength: 1
                      type: string
                    reason:
                      description: |-
                        reason is the reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may be empty.
                      maxLength: 256
                      minLength: 1
                      type: string
                    severity:
                      description: |-
                        severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      maxLength: 32
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      maxLength: 256
                      minLength: 1
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              consoleURL:
                description: ConsoleURL is the url for the openshift console.
                type: string
              externalManagedControlPlane:
                default: true
                description: |-
                  ExternalManagedControlPlane indicates to cluster-api that the control plane
                  is managed by an external service such as AKS, EKS, GKE, etc.
                type: boolean
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the state and will be set to a descriptive error message.

                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the spec or the configuration of
                  the controller, and that manual intervention is required.
                type: string
              id:
                description: ID is the cluster ID given by ROSA.
                type: string
              initialized:
                description: |-
                  Initialized denotes whether or not the control plane has the
                  uploaded kubernetes config-map.
                type: boolean
              oidcEndpointURL:
                description: OIDCEndpointURL is the endpoint url for the managed OIDC
                  provider.
                type: string
              ready:
                default: false
                description: Ready denotes that the ROSAControlPlane API Server is
                  ready to receive requests.
                type: boolean
              version:
                description: OpenShift semantic version, for example "4.14.5".
                type: string
            required:
            - ready
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}