apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsmachines.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSMachine
    listKind: AWSMachineList
    plural: awsmachines
    shortNames:
    - awsm
    singular: awsmachine
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Cluster to which this AWSMachine belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: EC2 instance state
      jsonPath: .status.instanceState
      name: State
      type: string
    - description: Machine ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: EC2 instance ID
      jsonPath: .spec.providerID
      name: InstanceID
      type: string
    - description: Machine object which owns with this AWSMachine
      jsonPath: .metadata.ownerReferences[?(@.kind=="Machine")].name
      name: Machine
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: AWSMachine is the schema for Amazon EC2 machines.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSMachineSpec defines the desired state of an Amazon EC2
              instance.
            properties:
              additionalSecurityGroups:
                description: |-
                  AdditionalSecurityGroups is an array of references to security groups that should be applied to the
                  instance. These security groups would be set in addition to any security groups defined
                  at the cluster level or in the actuator. It is possible to specify either IDs of Filters. Using Filters
                  will cause additional requests to AWS API and if tags change the attached security groups might change too.
                items:
                  description: |-
                    AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                    Only one of ID or Filters may be specified. Specifying more than one will result in
                    a validation error.
                  properties:
                    arn:
                      description: |-
                        ARN of resource.
                        Deprecated: This field has no function and is going to be removed in the next release.
                      type: string
                    filters:
                      description: |-
                        Filters is a set of key/value pairs used to identify a resource
                        They are applied according to the rules defined by the AWS API:
                        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                      items:
                        description: Filter is a filter used to identify an AWS resource.
                        properties:
                          name:
                            description: Name of the filter. Filter names are case-sensitive.
                            type: string
                          values:
                            description: Values includes one or more filter values.
                              Filter values are case-sensitive.
                            items:
                              type: string
                            type: array
                        required:
                        - name
                        - values
                        type: object
                      type: array
                    id:
                      description: ID of resource
                      type: string
                  type: object
                type: array
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to an instance, in addition to the ones added by default by the
                  AWS provider. If both the AWSCluster and the AWSMachine specify the same tag name with different values, the
                  AWSMachine's value takes precedence.
                type: object
              ami:
                description: AMI is the reference to the AMI from which to create
                  the machine instance.
                properties:
                  eksLookupType:
                    description: EKSOptimizedLookupType If specified, will look up
                      an EKS Optimized image in SSM Parameter store
                    enum:
                    - AmazonLinux
                    - AmazonLinuxGPU
                    type: string
                  id:
                    description: ID of resource
                    type: string
                type: object
              cloudInit:
                description: |-
                  CloudInit defines options related to the bootstrapping systems where
                  CloudInit is used.
                properties:
                  insecureSkipSecretsManager:
                    description: |-
                      InsecureSkipSecretsManager, when set to true will not use AWS Secrets Manager
                      or AWS Systems Manager Parameter Store to ensure privacy of userdata.
                      By default, a cloud-init boothook shell script is prepended to download
                      the userdata from Secrets Manager and additionally delete the secret.
                    type: boolean
                  secretCount:
                    description: SecretCount is the number of secrets used to form
                      the complete secret
                    format: int32
                    type: integer
                  secretPrefix:
                    description: |-
                      SecretPrefix is the prefix for the secret name. This is stored
                      temporarily, and deleted when the machine registers as a node against
                      the workload cluster.
                    type: string
                  secureSecretsBackend:
                    description: |-
                      SecureSecretsBackend, when set to parameter-store will utilize the AWS Systems Manager
                      Parameter Storage to distribute secrets. By default or with the value of secrets-manager,
                      will use AWS Secrets Manager instead.
                    enum:
                    - secrets-manager
                    - ssm-parameter-store
                    type: string
                type: object
              failureDomain:
                description: |-
                  FailureDomain is the failure domain unique identifier this Machine should be attached to, as defined in Cluster API.
                  For this infrastructure provider, the ID is equivalent to an AWS Availability Zone.
                  If multiple subnets are matched for the availability zone, the first one returned is picked.
                type: string
              iamInstanceProfile:
                description: IAMInstanceProfile is a name of an IAM instance profile
                  to assign to the instance
                type: string
              ignition:
                description: Ignition defined options related to the bootstrapping
                  systems where Ignition is used.
                properties:
                  version:
                    default: "2.3"
                    description: Version defines which version of Ignition will be
                      used to generate bootstrap data.
                    enum:
                    - "2.3"
                    type: string
                type: object
              imageLookupBaseOS:
                description: |-
                  ImageLookupBaseOS is the name of the base operating system to use for
                  image lookup the AMI is not set.
                type: string
              imageLookupFormat:
                description: |-
                  ImageLookupFormat is the AMI naming format to look up the image for this
                  machine It will be ignored if an explicit AMI is set. Supports
                  substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and
                  kubernetes version, respectively. The BaseOS will be the value in
                  ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                  defined by the packages produced by kubernetes/release without v as a
                  prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                  image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                  searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                  Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                  also: https://golang.org/pkg/text/template/
                type: string
              imageLookupOrg:
                description: ImageLookupOrg is the AWS Organization ID to use for
                  image lookup if AMI is not set.
                type: string
              instanceID:
                description: InstanceID is the EC2 instance ID for this machine.
                type: string
              instanceType:
                description: 'InstanceType is the type of instance to create. Example:
                  m4.xlarge'
                minLength: 2
                type: string
              networkInterfaces:
                description: |-
                  NetworkInterfaces is a list of ENIs to associate with the instance.
                  A maximum of 2 may be specified.
                items:
                  type: string
                maxItems: 2
                type: array
              nonRootVolumes:
                description: Configuration options for the non root storage volumes.
                items:
                  description: Volume encapsulates the configuration options for the
                    storage device.
                  properties:
                    deviceName:
                      description: Device name
                      type: string
                    encrypted:
                      description: Encrypted is whether the volume should be encrypted
                        or not.
                      type: boolean
                    encryptionKey:
                      description: |-
                        EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                        If Encrypted is set and this is omitted, the default AWS key will be used.
                        The key must already exist and be accessible by the controller.
                      type: string
                    iops:
                      description: IOPS is the number of IOPS requested for the disk.
                        Not applicable to all types.
                      format: int64
                      type: integer
                    size:
                      description: |-
                        Size specifies size (in Gi) of the storage device.
                        Must be greater than the image snapshot size or 8 (whichever is greater).
                      format: int64
                      minimum: 8
                      type: integer
                    throughput:
                      description: Throughput to provision in MiB/s supported for
                        the volume type. Not applicable to all types.
                      format: int64
                      type: integer
                    type:
                      description: Type is the type of the volume (e.g. gp2, io1,
                        etc...).
                      type: string
                  required:
                  - size
                  type: object
                type: array
              providerID:
                description: ProviderID is the unique identifier as specified by the
                  cloud provider.
                type: string
              publicIP:
                description: |-
                  PublicIP specifies whether the instance should get a public IP.
                  Precedence for this setting is as follows:
                  1. This field if set
                  2. Cluster/flavor setting
                  3. Subnet default
                type: boolean
              rootVolume:
                description: RootVolume encapsulates the configuration options for
                  the root volume
                properties:
                  deviceName:
                    description: Device name
                    type: string
                  encrypted:
                    description: Encrypted is whether the volume should be encrypted
                      or not.
                    type: boolean
                  encryptionKey:
                    description: |-
                      EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                      If Encrypted is set and this is omitted, the default AWS key will be used.
                      The key must already exist and be accessible by the controller.
                    type: string
                  iops:
                    description: IOPS is the number of IOPS requested for the disk.
                      Not applicable to all types.
                    format: int64
                    type: integer
                  size:
                    description: |-
                      Size specifies size (in Gi) of the storage device.
                      Must be greater than the image snapshot size or 8 (whichever is greater).
                    format: int64
                    minimum: 8
                    type: integer
                  throughput:
                    description: Throughput to provision in MiB/s supported for the
                      volume type. Not applicable to all types.
                    format: int64
                    type: integer
                  type:
                    description: Type is the type of the volume (e.g. gp2, io1, etc...).
                    type: string
                required:
                - size
                type: object
              spotMarketOptions:
                description: SpotMarketOptions allows users to configure instances
                  to be run using AWS Spot instances.
                properties:
                  maxPrice:
                    description: MaxPrice defines the maximum price the user is willing
                      to pay for Spot VM instances
                    type: string
                type: object
              sshKeyName:
                description: SSHKeyName is the name of the ssh key to attach to the
                  instance. Valid values are empty string (do not use SSH keys), a
                  valid SSH key name, or omitted (use the default SSH key name)
                type: string
              subnet:
                description: |-
                  Subnet is a reference to the subnet to use for this instance. If not specified,
                  the cluster subnet will be used.
                properties:
                  arn:
                    description: |-
                      ARN of resource.
                      Deprecated: This field has no function and is going to be removed in the next release.
                    type: string
                  filters:
                    description: |-
                      Filters is a set of key/value pairs used to identify a resource
                      They are applied according to the rules defined by the AWS API:
                      https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                    items:
                      description: Filter is a filter used to identify an AWS resource.
                      properties:
                        name:
                          description: Name of the filter. Filter names are case-sensitive.
                          type: string
                        values:
                          description: Values includes one or more filter values.
                            Filter values are case-sensitive.
                          items:
                            type: string
                          type: array
                      required:
                      - name
                      - values
                      type: object
                    type: array
                  id:
                    description: ID of resource
                    type: string
                type: object
              tenancy:
                description: Tenancy indicates if instance should run on shared or
                  single-tenant hardware.
                enum:
                - default
                - dedicated
                - host
                type: string
              uncompressedUserData:
                description: |-
                  UncompressedUserData specify whether the user data is gzip-compressed before it is sent to ec2 instance.
                  cloud-init has built-in support for gzip-compressed user data
                  user data stored in aws secret manager is always gzip-compressed.
                type: boolean
            required:
            - instanceType
            type: object
          status:
            description: AWSMachineStatus defines the observed state of AWSMachine.
            properties:
              addresses:
                description: Addresses contains the AWS instance associated addresses.
                items:
                  description: MachineAddress contains information for the node's
                    address.
                  properties:
                    address:
                      description: The machine address.
                      type: string
                    type:
                      description: Machine address type, one of Hostname, ExternalIP,
                        InternalIP, ExternalDNS or InternalDNS.
                      type: string
                  required:
                  - address
                  - type
                  type: object
                type: array
              conditions:
                description: Conditions defines current service state of the AWSMachine.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the Machine and will contain a more verbose string suitable
                  for logging and human consumption.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of Machines
                  can be added as events to the Machine object and/or logged in the
                  controller's output.
                type: string
              failureReason:
                description: |-
                  FailureReason will be set in the event that there is a terminal problem
                  reconciling the Machine and will contain a succinct value suitable
                  for machine interpretation.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of Machines
                  can be added as events to the Machine object and/or logged in the
                  controller's output.
                type: string
              instanceState:
                description: InstanceState is the state of the AWS instance for this
                  machine.
                type: string
              interruptible:
                description: |-
                  Interruptible reports that this machine is using spot instances and can therefore be interrupted by CAPI when it receives a notice that the spot instance is to be terminated by AWS.
                  This will be set to true when SpotMarketOptions is not nil (i.e. this machine is using a spot instance).
                type: boolean
              ready:
                description: Ready is true when the provider resource is ready.
                type: boolean
            type: object
        type: object
    served: false
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - description: Cluster to which this AWSMachine belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: EC2 instance state
      jsonPath: .status.instanceState
      name: State
      type: string
    - description: Machine ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: EC2 instance ID
      jsonPath: .spec.providerID
      name: InstanceID
      type: string
    - description: Machine object which owns with this AWSMachine
      jsonPath: .metadata.ownerReferences[?(@.kind=="Machine")].name
      name: Machine
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSMachine is the schema for Amazon EC2 machines.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSMachineSpec defines the desired state of an Amazon EC2
              instance.
            properties:
              additionalSecurityGroups:
                description: |-
                  AdditionalSecurityGroups is an array of references to security groups that should be applied to the
                  instance. These security groups would be set in addition to any security groups defined
                  at the cluster level or in the actuator. It is possible to specify either IDs of Filters. Using Filters
                  will cause additional requests to AWS API and if tags change the attached security groups might change too.
                items:
                  description: |-
                    AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                    Only one of ID or Filters may be specified. Specifying more than one will result in
                    a validation error.
                  properties:
                    filters:
                      description: |-
                        Filters is a set of key/value pairs used to identify a resource
                        They are applied according to the rules defined by the AWS API:
                        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                      items:
                        description: Filter is a filter used to identify an AWS resource.
                        properties:
                          name:
                            description: Name of the filter. Filter names are case-sensitive.
                            type: string
                          values:
                            description: Values includes one or more filter values.
                              Filter values are case-sensitive.
                            items:
                              type: string
                            type: array
                        required:
                        - name
                        - values
                        type: object
                      type: array
                    id:
                      description: ID of resource
                      type: string
                  type: object
                type: array
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to an instance, in addition to the ones added by default by the
                  AWS provider. If both the AWSCluster and the AWSMachine specify the same tag name with different values, the
                  AWSMachine's value takes precedence.
                type: object
              ami:
                description: AMI is the reference to the AMI from which to create
                  the machine instance.
                properties:
                  eksLookupType:
                    description: EKSOptimizedLookupType If specified, will look up
                      an EKS Optimized image in SSM Parameter store
                    enum:
                    - AmazonLinux
                    - AmazonLinuxGPU
                    type: string
                  id:
                    description: ID of resource
                    type: string
                type: object
              capacityReservationId:
                description: CapacityReservationID specifies the target Capacity Reservation
                  into which the instance should be launched.
                type: string
              cloudInit:
                description: |-
                  CloudInit defines options related to the bootstrapping systems where
                  CloudInit is used.
                properties:
                  insecureSkipSecretsManager:
                    description: |-
                      InsecureSkipSecretsManager, when set to true will not use AWS Secrets Manager
                      or AWS Systems Manager Parameter Store to ensure privacy of userdata.
                      By default, a cloud-init boothook shell script is prepended to download
                      the userdata from Secrets Manager and additionally delete the secret.
                    type: boolean
                  secretCount:
                    description: SecretCount is the number of secrets used to form
                      the complete secret
                    format: int32
                    type: integer
                  secretPrefix:
                    description: |-
                      SecretPrefix is the prefix for the secret name. This is stored
                      temporarily, and deleted when the machine registers as a node against
                      the workload cluster.
                    type: string
                  secureSecretsBackend:
                    description: |-
                      SecureSecretsBackend, when set to parameter-store will utilize the AWS Systems Manager
                      Parameter Storage to distribute secrets. By default or with the value of secrets-manager,
                      will use AWS Secrets Manager instead.
                    enum:
                    - secrets-manager
                    - ssm-parameter-store
                    type: string
                type: object
              elasticIpPool:
                description: ElasticIPPool is the configuration to allocate Public
                  IPv4 address (Elastic IP/EIP) from user-defined pool.
                properties:
                  publicIpv4Pool:
                    description: |-
                      PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources
                      created in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom
                      Public IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool
                      resource ID starts with 'ipv4pool-ec2'.
                    maxLength: 30
                    type: string
                  publicIpv4PoolFallbackOrder:
                    description: |-
                      PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,
                      no more IPv4 address available in the pool.


                      When set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the
                      IPv4 limit, the address will be claimed from Amazon-pool (default).


                      When set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.
                    enum:
                    - amazon-pool
                    - none
                    type: string
                    x-kubernetes-validations:
                    - message: allowed values are 'none' and 'amazon-pool'
                      rule: self in ['none','amazon-pool']
                type: object
              iamInstanceProfile:
                description: IAMInstanceProfile is a name of an IAM instance profile
                  to assign to the instance
                type: string
              ignition:
                description: Ignition defined options related to the bootstrapping
                  systems where Ignition is used.
                properties:
                  proxy:
                    description: |-
                      Proxy defines proxy settings for Ignition.
                      Only valid for Ignition versions 3.1 and above.
                    properties:
                      httpProxy:
                        description: |-
                          HTTPProxy is the HTTP proxy to use for Ignition.
                          A single URL that specifies the proxy server to use for HTTP and HTTPS requests,
                          unless overridden by the HTTPSProxy or NoProxy options.
                        type: string
                      httpsProxy:
                        description: |-
                          HTTPSProxy is the HTTPS proxy to use for Ignition.
                          A single URL that specifies the proxy server to use for HTTPS requests,
                          unless overridden by the NoProxy option.
                        type: string
                      noProxy:
                        description: |-
                          NoProxy is the list of domains to not proxy for Ignition.
                          Specifies a list of strings to hosts that should be excluded from proxying.


                          Each value is represented by:
                          - An IP address prefix (1.2.3.4)
                          - An IP address prefix in CIDR notation (1.2.3.4/8)
                          - A domain name
                            - A domain name matches that name and all subdomains
                            - A domain name with a leading . matches subdomains only
                          - A special DNS label (*), indicates that no proxying should be done


                          An IP address prefix and domain name can also include a literal port number (1.2.3.4:80).
                        items:
                          description: IgnitionNoProxy defines the list of domains
                            to not proxy for Ignition.
                          maxLength: 2048
                          type: string
                        maxItems: 64
                        type: array
                    type: object
                  storageType:
                    default: ClusterObjectStore
                    description: |-
                      StorageType defines how to store the boostrap user data for Ignition.
                      This can be used to instruct Ignition from where to fetch the user data to bootstrap an instance.


                      When omitted, the storage option will default to ClusterObjectStore.


                      When set to "ClusterObjectStore", if the capability is available and a Cluster ObjectStore configuration
                      is correctly provided in the Cluster object (under .spec.s3Bucket),
                      an object store will be used to store bootstrap user data.


                      When set to "UnencryptedUserData", EC2 Instance User Data will be used to store the machine bootstrap user data, unencrypted.
                      This option is considered less secure than others as user data may contain sensitive informations (keys, certificates, etc.)
                      and users with ec2:DescribeInstances permission or users running pods
                      that can access the ec2 metadata service have access to this sensitive information.
                      So this is only to be used at ones own risk, and only when other more secure options are not viable.
                    enum:
                    - ClusterObjectStore
                    - UnencryptedUserData
                    type: string
                  tls:
                    description: |-
                      TLS defines TLS settings for Ignition.
                      Only valid for Ignition versions 3.1 and above.
                    properties:
                      certificateAuthorities:
                        description: |-
                          CASources defines the list of certificate authorities to use for Ignition.
                          The value is the certificate bundle (in PEM format). The bundle can contain multiple concatenated certificates.
                          Supported schemes are http, https, tftp, s3, arn, gs, and `data` (RFC 2397) URL scheme.
                        items:
                          description: IgnitionCASource defines the source of the
                            certificate authority to use for Ignition.
                          maxLength: 65536
                          type: string
                        maxItems: 64
                        type: array
                    type: object
                  version:
                    default: "2.3"
                    description: Version defines which version of Ignition will be
                      used to generate bootstrap data.
                    enum:
                    - "2.3"
                    - "3.0"
                    - "3.1"
                    - "3.2"
                    - "3.3"
                    - "3.4"
                    type: string
                type: object
              imageLookupBaseOS:
                description: |-
                  ImageLookupBaseOS is the name of the base operating system to use for
                  image lookup the AMI is not set.
                type: string
              imageLookupFormat:
                description: |-
                  ImageLookupFormat is the AMI naming format to look up the image for this
                  machine It will be ignored if an explicit AMI is set. Supports
                  substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and
                  kubernetes version, respectively. The BaseOS will be the value in
                  ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                  defined by the packages produced by kubernetes/release without v as a
                  prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                  image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                  searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                  Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                  also: https://golang.org/pkg/text/template/
                type: string
              imageLookupOrg:
                description: ImageLookupOrg is the AWS Organization ID to use for
                  image lookup if AMI is not set.
                type: string
              instanceID:
                description: InstanceID is the EC2 instance ID for this machine.
                type: string
              instanceMetadataOptions:
                description: InstanceMetadataOptions is the metadata options for the
                  EC2 instance.
                properties:
                  httpEndpoint:
                    default: enabled
                    description: |-
                      Enables or disables the HTTP metadata endpoint on your instances.


                      If you specify a value of disabled, you cannot access your instance metadata.


                      Default: enabled
                    enum:
                    - enabled
                    - disabled
                    type: string
                  httpPutResponseHopLimit:
                    default: 1
                    description: |-
                      The desired HTTP PUT response hop limit for instance metadata requests. The
                      larger the number, the further instance metadata requests can travel.


                      Default: 1
                    format: int64
                    maximum: 64
                    minimum: 1
                    type: integer
                  httpTokens:
                    default: optional
                    description: |-
                      The state of token usage for your instance metadata requests.


                      If the state is optional, you can choose to retrieve instance metadata with
                      or without a session token on your request. If you retrieve the IAM role
                      credentials without a token, the version 1.0 role credentials are returned.
                      If you retrieve the IAM role credentials using a valid session token, the
                      version 2.0 role credentials are returned.


                      If the state is required, you must send a session token with any instance
                      metadata retrieval requests. In this state, retrieving the IAM role credentials
                      always returns the version 2.0 credentials; the version 1.0 credentials are
                      not available.


                      Default: optional
                    enum:
                    - optional
                    - required
                    type: string
                  instanceMetadataTags:
                    default: disabled
                    description: |-
                      Set to enabled to allow access to instance tags from the instance metadata.
                      Set to disabled to turn off access to instance tags from the instance metadata.
                      For more information, see Work with instance tags using the instance metadata
                      (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS).


                      Default: disabled
                    enum:
                    - enabled
                    - disabled
                    type: string
                type: object
              instanceType:
                description: 'InstanceType is the type of instance to create. Example:
                  m4.xlarge'
                minLength: 2
                type: string
              networkInterfaces:
                description: |-
                  NetworkInterfaces is a list of ENIs to associate with the instance.
                  A maximum of 2 may be specified.
                items:
                  type: string
                maxItems: 2
                type: array
              nonRootVolumes:
                description: Configuration options for the non root storage volumes.
                items:
                  description: Volume encapsulates the configuration options for the
                    storage device.
                  properties:
                    deviceName:
                      description: Device name
                      type: string
                    encrypted:
                      description: Encrypted is whether the volume should be encrypted
                        or not.
                      type: boolean
                    encryptionKey:
                      description: |-
                        EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                        If Encrypted is set and this is omitted, the default AWS key will be used.
                        The key must already exist and be accessible by the controller.
                      type: string
                    iops:
                      description: IOPS is the number of IOPS requested for the disk.
                        Not applicable to all types.
                      format: int64
                      type: integer
                    size:
                      description: |-
                        Size specifies size (in Gi) of the storage device.
                        Must be greater than the image snapshot size or 8 (whichever is greater).
                      format: int64
                      minimum: 8
                      type: integer
                    throughput:
                      description: Throughput to provision in MiB/s supported for
                        the volume type. Not applicable to all types.
                      format: int64
                      type: integer
                    type:
                      description: Type is the type of the volume (e.g. gp2, io1,
                        etc...).
                      type: string
                  required:
                  - size
                  type: object
                type: array
              placementGroupName:
                description: PlacementGroupName specifies the name of the placement
                  group in which to launch the instance.
                type: string
              placementGroupPartition:
                description: |-
                  PlacementGroupPartition is the partition number within the placement group in which to launch the instance.
                  This value is only valid if the placement group, referred in `PlacementGroupName`, was created with
                  strategy set to partition.
                format: int64
                maximum: 7
                minimum: 1
                type: integer
              privateDnsName:
                description: PrivateDNSName is the options for the instance hostname.
                properties:
                  enableResourceNameDnsAAAARecord:
                    description: EnableResourceNameDNSAAAARecord indicates whether
                      to respond to DNS queries for instance hostnames with DNS AAAA
                      records.
                    type: boolean
                  enableResourceNameDnsARecord:
                    description: EnableResourceNameDNSARecord indicates whether to
                      respond to DNS queries for instance hostnames with DNS A records.
                    type: boolean
                  hostnameType:
                    description: The type of hostname to assign to an instance.
                    enum:
                    - ip-name
                    - resource-name
                    type: string
                type: object
              providerID:
                description: ProviderID is the unique identifier as specified by the
                  cloud provider.
                type: string
              publicIP:
                description: |-
                  PublicIP specifies whether the instance should get a public IP.
                  Precedence for this setting is as follows:
                  1. This field if set
                  2. Cluster/flavor setting
                  3. Subnet default
                type: boolean
              rootVolume:
                description: RootVolume encapsulates the configuration options for
                  the root volume
                properties:
                  deviceName:
                    description: Device name
                    type: string
                  encrypted:
                    description: Encrypted is whether the volume should be encrypted
                      or not.
                    type: boolean
                  encryptionKey:
                    description: |-
                      EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                      If Encrypted is set and this is omitted, the default AWS key will be used.
                      The key must already exist and be accessible by the controller.
                    type: string
                  iops:
                    description: IOPS is the number of IOPS requested for the disk.
                      Not applicable to all types.
                    format: int64
                    type: integer
                  size:
                    description: |-
                      Size specifies size (in Gi) of the storage device.
                      Must be greater than the image snapshot size or 8 (whichever is greater).
                    format: int64
                    minimum: 8
                    type: integer
                  throughput:
                    description: Throughput to provision in MiB/s supported for the
                      volume type. Not applicable to all types.
                    format: int64
                    type: integer
                  type:
                    description: Type is the type of the volume (e.g. gp2, io1, etc...).
                    type: string
                required:
                - size
                type: object
              securityGroupOverrides:
                additionalProperties:
                  type: string
                description: |-
                  SecurityGroupOverrides is an optional set of security groups to use for the node.
                  This is optional - if not provided security groups from the cluster will be used.
                type: object
              spotMarketOptions:
                description: SpotMarketOptions allows users to configure instances
                  to be run using AWS Spot instances.
                properties:
                  maxPrice:
                    description: MaxPrice defines the maximum price the user is willing
                      to pay for Spot VM instances
                    type: string
                type: object
              sshKeyName:
                description: SSHKeyName is the name of the ssh key to attach to the
                  instance. Valid values are empty string (do not use SSH keys), a
                  valid SSH key name, or omitted (use the default SSH key name)
                type: string
              subnet:
                description: |-
                  Subnet is a reference to the subnet to use for this instance. If not specified,
                  the cluster subnet will be used.
                properties:
                  filters:
                    description: |-
                      Filters is a set of key/value pairs used to identify a resource
                      They are applied according to the rules defined by the AWS API:
                      https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                    items:
                      description: Filter is a filter used to identify an AWS resource.
                      properties:
                        name:
                          description: Name of the filter. Filter names are case-sensitive.
                          type: string
                        values:
                          description: Values includes one or more filter values.
                            Filter values are case-sensitive.
                          items:
                            type: string
                          type: array
                      required:
                      - name
                      - values
                      type: object
                    type: array
                  id:
                    description: ID of resource
                    type: string
                type: object
              tenancy:
                description: Tenancy indicates if instance should run on shared or
                  single-tenant hardware.
                enum:
                - default
                - dedicated
                - host
                type: string
              uncompressedUserData:
                description: |-
                  UncompressedUserData specify whether the user data is gzip-compressed before it is sent to ec2 instance.
                  cloud-init has built-in support for gzip-compressed user data
                  user data stored in aws secret manager is always gzip-compressed.
                type: boolean
            required:
            - instanceType
            type: object
          status:
            description: AWSMachineStatus defines the observed state of AWSMachine.
            properties:
              addresses:
                description: Addresses contains the AWS instance associated addresses.
                items:
                  description: MachineAddress contains information for the node's
                    address.
                  properties:
                    address:
                      description: The machine address.
                      type: string
                    type:
                      description: Machine address type, one of Hostname, ExternalIP,
                        InternalIP, ExternalDNS or InternalDNS.
                      type: string
                  required:
                  - address
                  - type
                  type: object
                type: array
              conditions:
                description: Conditions defines current service state of the AWSMachine.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the Machine and will contain a more verbose string suitable
                  for logging and human consumption.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of Machines
                  can be added as events to the Machine object and/or logged in the
                  controller's output.
                type: string
              failureReason:
                description: |-
                  FailureReason will be set in the event that there is a terminal problem
                  reconciling the Machine and will contain a succinct value suitable
                  for machine interpretation.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of Machines
                  can be added as events to the Machine object and/or logged in the
                  controller's output.
                type: string
              instanceState:
                description: InstanceState is the state of the AWS instance for this
                  machine.
                type: string
              interruptible:
                description: |-
                  Interruptible reports that this machine is using spot instances and can therefore be interrupted by CAPI when it receives a notice that the spot instance is to be terminated by AWS.
                  This will be set to true when SpotMarketOptions is not nil (i.e. this machine is using a spot instance).
                type: boolean
              ready:
                description: Ready is true when the provider resource is ready.
                type: boolean
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsclusters.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSCluster
    listKind: AWSClusterList
    plural: awsclusters
    shortNames:
    - awsc
    singular: awscluster
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Cluster to which this AWSCluster belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: Cluster infrastructure is ready for EC2 instances
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: AWS VPC the cluster is using
      jsonPath: .spec.network.vpc.id
      name: VPC
      type: string
    - description: API Endpoint
      jsonPath: .spec.controlPlaneEndpoint
      name: Endpoint
      priority: 1
      type: string
    - description: Bastion IP address for breakglass access
      jsonPath: .status.bastion.publicIp
      name: Bastion IP
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: AWSCluster is the schema for Amazon EC2 based Kubernetes Cluster
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSClusterSpec defines the desired state of an EC2-based
              Kubernetes cluster.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                  ones added by default.
                type: object
              bastion:
                description: Bastion contains options to configure the bastion host.
                properties:
                  allowedCIDRBlocks:
                    description: |-
                      AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
                      They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
                    items:
                      type: string
                    type: array
                  ami:
                    description: |-
                      AMI will use the specified AMI to boot the bastion. If not specified,
                      the AMI will default to one picked out in public space.
                    type: string
                  disableIngressRules:
                    description: |-
                      DisableIngressRules will ensure there are no Ingress rules in the bastion host's security group.
                      Requires AllowedCIDRBlocks to be empty.
                    type: boolean
                  enabled:
                    description: |-
                      Enabled allows this provider to create a bastion host instance
                      with a public ip to access the VPC private network.
                    type: boolean
                  instanceType:
                    description: |-
                      InstanceType will use the specified instance type for the bastion. If not specified,
                      Cluster API Provider AWS will use t3.micro for all regions except us-east-1, where t2.micro
                      will be the default.
                    type: string
                type: object
              controlPlaneEndpoint:
                description: ControlPlaneEndpoint represents the endpoint used to
                  communicate with the control plane.
                properties:
                  host:
                    description: The hostname on which the API server is serving.
                    type: string
                  port:
                    description: The port on which the API server is serving.
                    format: int32
                    type: integer
                required:
                - host
                - port
                type: object
              controlPlaneLoadBalancer:
                description: ControlPlaneLoadBalancer is optional configuration for
                  customizing control plane behavior.
                properties:
                  additionalSecurityGroups:
                    description: |-
                      AdditionalSecurityGroups sets the security groups used by the load balancer. Expected to be security group IDs
                      This is optional - if not provided new security groups will be created for the load balancer
                    items:
                      type: string
                    type: array
                  crossZoneLoadBalancing:
                    description: |-
                      CrossZoneLoadBalancing enables the classic ELB cross availability zone balancing.


                      With cross-zone load balancing, each load balancer node for your Classic Load Balancer
                      distributes requests evenly across the registered instances in all enabled Availability Zones.
                      If cross-zone load balancing is disabled, each load balancer node distributes requests evenly across
                      the registered instances in its Availability Zone only.


                      Defaults to false.
                    type: boolean
                  healthCheckProtocol:
                    description: |-
                      HealthCheckProtocol sets the protocol type for classic ELB health check target
                      default value is ClassicELBProtocolSSL
                    type: string
                  name:
                    description: |-
                      Name sets the name of the classic ELB load balancer. As per AWS, the name must be unique
                      within your set of load balancers for the region, must have a maximum of 32 characters, must
                      contain only alphanumeric characters or hyphens, and cannot begin or end with a hyphen. Once
                      set, the value cannot be changed.
                    maxLength: 32
                    pattern: ^[A-Za-z0-9]([A-Za-z0-9]{0,31}|[-A-Za-z0-9]{0,30}[A-Za-z0-9])$
                    type: string
                  scheme:
                    default: internet-facing
                    description: Scheme sets the scheme of the load balancer (defaults
                      to internet-facing)
                    enum:
                    - internet-facing
                    - internal
                    type: string
                  subnets:
                    description: Subnets sets the subnets that should be applied to
                      the control plane load balancer (defaults to discovered subnets
                      for managed VPCs or an empty set for unmanaged VPCs)
                    items:
                      type: string
                    type: array
                type: object
              identityRef:
                description: |-
                  IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
                  If no identity is specified, the default identity for this controller will be used.
                properties:
                  kind:
                    description: Kind of the identity.
                    enum:
                    - AWSClusterControllerIdentity
                    - AWSClusterRoleIdentity
                    - AWSClusterStaticIdentity
                    type: string
                  name:
                    description: Name of the identity.
                    minLength: 1
                    type: string
                required:
                - kind
                - name
                type: object
              imageLookupBaseOS:
                description: |-
                  ImageLookupBaseOS is the name of the base operating system used to look
                  up machine images when a machine does not specify an AMI. When set, this
                  will be used for all cluster machines unless a machine specifies a
                  different ImageLookupBaseOS.
                type: string
              imageLookupFormat:
                description: |-
                  ImageLookupFormat is the AMI naming format to look up machine images when
                  a machine does not specify an AMI. When set, this will be used for all
                  cluster machines unless a machine specifies a different ImageLookupOrg.
                  Supports substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base
                  OS and kubernetes version, respectively. The BaseOS will be the value in
                  ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                  defined by the packages produced by kubernetes/release without v as a
                  prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                  image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                  searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                  Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                  also: https://golang.org/pkg/text/template/
                type: string
              imageLookupOrg:
                description: |-
                  ImageLookupOrg is the AWS Organization ID to look up machine images when a
                  machine does not specify an AMI. When set, this will be used for all
                  cluster machines unless a machine specifies a different ImageLookupOrg.
                type: string
              network:
                description: NetworkSpec encapsulates all things related to AWS network.
                properties:
                  cni:
                    description: CNI configuration
                    properties:
                      cniIngressRules:
                        description: |-
                          CNIIngressRules specify rules to apply to control plane and worker node security groups.
                          The source for the rule will be set to control plane and worker security group IDs.
                        items:
                          description: CNIIngressRule defines an AWS ingress rule
                            for CNI requirements.
                          properties:
                            description:
                              type: string
                            fromPort:
                              format: int64
                              type: integer
                            protocol:
                              description: SecurityGroupProtocol defines the protocol
                                type for a security group rule.
                              type: string
                            toPort:
                              format: int64
                              type: integer
                          required:
                          - description
                          - fromPort
                          - protocol
                          - toPort
                          type: object
                        type: array
                    type: object
                  securityGroupOverrides:
                    additionalProperties:
                      type: string
                    description: |-
                      SecurityGroupOverrides is an optional set of security groups to use for cluster instances
                      This is optional - if not provided new security groups will be created for the cluster
                    type: object
                  subnets:
                    description: Subnets configuration.
                    items:
                      description: SubnetSpec configures an AWS Subnet.
                      properties:
                        availabilityZone:
                          description: AvailabilityZone defines the availability zone
                            to use for this subnet in the cluster's region.
                          type: string
                        cidrBlock:
                          description: CidrBlock is the CIDR block to be used when
                            the provider creates a managed VPC.
                          type: string
                        id:
                          description: ID defines a unique identifier to reference
                            this resource.
                          type: string
                        ipv6CidrBlock:
                          description: |-
                            IPv6CidrBlock is the IPv6 CIDR block to be used when the provider creates a managed VPC.
                            A subnet can have an IPv4 and an IPv6 address.
                            IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                          type: string
                        isIpv6:
                          description: |-
                            IsIPv6 defines the subnet as an IPv6 subnet. A subnet is IPv6 when it is associated with a VPC that has IPv6 enabled.
                            IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                          type: boolean
                        isPublic:
                          description: IsPublic defines the subnet as a public subnet.
                            A subnet is public when it is associated with a route
                            table that has a route to an internet gateway.
                          type: boolean
                        natGatewayId:
                          description: |-
                            NatGatewayID is the NAT gateway id associated with the subnet.
                            Ignored unless the subnet is managed by the provider, in which case this is set on the public subnet where the NAT gateway resides. It is then used to determine routes for private subnets in the same AZ as the public subnet.
                          type: string
                        routeTableId:
                          description: RouteTableID is the routing table id associated
                            with the subnet.
                          type: string
                        tags:
                          additionalProperties:
                            type: string
                          description: Tags is a collection of tags describing the
                            resource.
                          type: object
                      type: object
                    type: array
                  vpc:
                    description: VPC configuration.
                    properties:
                      availabilityZoneSelection:
                        default: Ordered
                        description: |-
                          AvailabilityZoneSelection specifies how AZs should be selected if there are more AZs
                          in a region than specified by AvailabilityZoneUsageLimit. There are 2 selection schemes:
                          Ordered - selects based on alphabetical order
                          Random - selects AZs randomly in a region
                          Defaults to Ordered
                        enum:
                        - Ordered
                        - Random
                        type: string
                      availabilityZoneUsageLimit:
                        default: 3
                        description: |-
                          AvailabilityZoneUsageLimit specifies the maximum number of availability zones (AZ) that
                          should be used in a region when automatically creating subnets. If a region has more
                          than this number of AZs then this number of AZs will be picked randomly when creating
                          default subnets. Defaults to 3
                        minimum: 1
                        type: integer
                      cidrBlock:
                        description: |-
                          CidrBlock is the CIDR block to be used when the provider creates a managed VPC.
                          Defaults to 10.0.0.0/16.
                        type: string
                      id:
                        description: ID is the vpc-id of the VPC this provider should
                          use to create resources.
                        type: string
                      internetGatewayId:
                        description: InternetGatewayID is the id of the internet gateway
                          associated with the VPC.
                        type: string
                      ipv6:
                        description: |-
                          IPv6 contains ipv6 specific settings for the network. Supported only in managed clusters.
                          This field cannot be set on AWSCluster object.
                        properties:
                          cidrBlock:
                            description: CidrBlock is the CIDR block provided by Amazon
                              when VPC has enabled IPv6.
                            type: string
                          egressOnlyInternetGatewayId:
                            description: EgressOnlyInternetGatewayID is the id of
                              the egress only internet gateway associated with an
                              IPv6 enabled VPC.
                            type: string
                          poolId:
                            description: PoolID is the IP pool which must be defined
                              in case of BYO IP is defined.
                            type: string
                        type: object
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a collection of tags describing the resource.
                        type: object
                    type: object
                type: object
              region:
                description: The AWS Region the cluster lives in.
                type: string
              s3Bucket:
                description: |-
                  S3Bucket contains options to configure a supporting S3 bucket for this
                  cluster - currently used for nodes requiring Ignition
                  (https://coreos.github.io/ignition/) for bootstrapping (requires
                  BootstrapFormatIgnition feature flag to be enabled).
                properties:
                  controlPlaneIAMInstanceProfile:
                    description: |-
                      ControlPlaneIAMInstanceProfile is a name of the IAMInstanceProfile, which will be allowed
                      to read control-plane node bootstrap data from S3 Bucket.
                    type: string
                  name:
                    description: Name defines name of S3 Bucket to be created.
                    maxLength: 63
                    minLength: 3
                    pattern: ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$
                    type: string
                  nodesIAMInstanceProfiles:
                    description: |-
                      NodesIAMInstanceProfiles is a list of IAM instance profiles, which will be allowed to read
                      worker nodes bootstrap data from S3 Bucket.
                    items:
                      type: string
                    type: array
                required:
                - controlPlaneIAMInstanceProfile
                - name
                - nodesIAMInstanceProfiles
                type: object
              sshKeyName:
                description: SSHKeyName is the name of the ssh key to attach to the
                  bastion host. Valid values are empty string (do not use SSH keys),
                  a valid SSH key name, or omitted (use the default SSH key name)
                type: string
            type: object
          status:
            description: AWSClusterStatus defines the observed state of AWSCluster.
            properties:
              bastion:
                description: Instance describes an AWS instance.
                properties:
                  addresses:
                    description: Addresses contains the AWS instance associated addresses.
                    items:
                      description: MachineAddress contains information for the node's
                        address.
                      properties:
                        address:
                          description: The machine address.
                          type: string
                        type:
                          description: Machine address type, one of Hostname, ExternalIP,
                            InternalIP, ExternalDNS or InternalDNS.
                          type: string
                      required:
                      - address
                      - type
                      type: object
                    type: array
                  availabilityZone:
                    description: Availability zone of instance
                    type: string
                  ebsOptimized:
                    description: Indicates whether the instance is optimized for Amazon
                      EBS I/O.
                    type: boolean
                  enaSupport:
                    description: Specifies whether enhanced networking with ENA is
                      enabled.
                    type: boolean
                  iamProfile:
                    description: The name of the IAM instance profile associated with
                      the instance, if applicable.
                    type: string
                  id:
                    type: string
                  imageId:
                    description: The ID of the AMI used to launch the instance.
                    type: string
                  instanceState:
                    description: The current state of the instance.
                    type: string
                  networkInterfaces:
                    description: Specifies ENIs attached to instance
                    items:
                      type: string
                    type: array
                  nonRootVolumes:
                    description: Configuration options for the non root storage volumes.
                    items:
                      description: Volume encapsulates the configuration options for
                        the storage device.
                      properties:
                        deviceName:
                          description: Device name
                          type: string
                        encrypted:
                          description: Encrypted is whether the volume should be encrypted
                            or not.
                          type: boolean
                        encryptionKey:
                          description: |-
                            EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                            If Encrypted is set and this is omitted, the default AWS key will be used.
                            The key must already exist and be accessible by the controller.
                          type: string
                        iops:
                          description: IOPS is the number of IOPS requested for the
                            disk. Not applicable to all types.
                          format: int64
                          type: integer
                        size:
                          description: |-
                            Size specifies size (in Gi) of the storage device.
                            Must be greater than the image snapshot size or 8 (whichever is greater).
                          format: int64
                          minimum: 8
                          type: integer
                        throughput:
                          description: Throughput to provision in MiB/s supported
                            for the volume type. Not applicable to all types.
                          format: int64
                          type: integer
                        type:
                          description: Type is the type of the volume (e.g. gp2, io1,
                            etc...).
                          type: string
                      required:
                      - size
                      type: object
                    type: array
                  privateIp:
                    description: The private IPv4 address assigned to the instance.
                    type: string
                  publicIp:
                    description: The public IPv4 address assigned to the instance,
                      if applicable.
                    type: string
                  rootVolume:
                    description: Configuration options for the root storage volume.
                    properties:
                      deviceName:
                        description: Device name
                        type: string
                      encrypted:
                        description: Encrypted is whether the volume should be encrypted
                          or not.
                        type: boolean
                      encryptionKey:
                        description: |-
                          EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                          If Encrypted is set and this is omitted, the default AWS key will be used.
                          The key must already exist and be accessible by the controller.
                        type: string
                      iops:
                        description: IOPS is the number of IOPS requested for the
                          disk. Not applicable to all types.
                        format: int64
                        type: integer
                      size:
                        description: |-
                          Size specifies size (in Gi) of the storage device.
                          Must be greater than the image snapshot size or 8 (whichever is greater).
                        format: int64
                        minimum: 8
                        type: integer
                      throughput:
                        description: Throughput to provision in MiB/s supported for
                          the volume type. Not applicable to all types.
                        format: int64
                        type: integer
                      type:
                        description: Type is the type of the volume (e.g. gp2, io1,
                          etc...).
                        type: string
                    required:
                    - size
                    type: object
                  securityGroupIds:
                    description: SecurityGroupIDs are one or more security group IDs
                      this instance belongs to.
                    items:
                      type: string
                    type: array
                  spotMarketOptions:
                    description: SpotMarketOptions option for configuring instances
                      to be run using AWS Spot instances.
                    properties:
                      maxPrice:
                        description: MaxPrice defines the maximum price the user is
                          willing to pay for Spot VM instances
                        type: string
                    type: object
                  sshKeyName:
                    description: The name of the SSH key pair.
                    type: string
                  subnetId:
                    description: The ID of the subnet of the instance.
                    type: string
                  tags:
                    additionalProperties:
                      type: string
                    description: The tags associated with the instance.
                    type: object
                  tenancy:
                    description: Tenancy indicates if instance should run on shared
                      or single-tenant hardware.
                    type: string
                  type:
                    description: The instance type.
                    type: string
                  userData:
                    description: |-
                      UserData is the raw data script passed to the instance which is run upon bootstrap.
                      This field must not be base64 encoded and should only be used when running a new instance.
                    type: string
                  volumeIDs:
                    description: IDs of the instance's volumes
                    items:
                      type: string
                    type: array
                required:
                - id
                type: object
              conditions:
                description: Conditions provide observations of the operational state
                  of a Cluster API resource.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureDomains:
                additionalProperties:
                  description: |-
                    FailureDomainSpec is the Schema for Cluster API failure domains.
                    It allows controllers to understand how many failure domains a cluster can optionally span across.
                  properties:
                    attributes:
                      additionalProperties:
                        type: string
                      description: Attributes is a free form map of attributes an
                        infrastructure provider might use or require.
                      type: object
                    controlPlane:
                      description: ControlPlane determines if this failure domain
                        is suitable for use by control plane machines.
                      type: boolean
                  type: object
                description: FailureDomains is a slice of FailureDomains.
                type: object
              networkStatus:
                description: NetworkStatus encapsulates AWS networking resources.
                properties:
                  apiServerElb:
                    description: APIServerELB is the Kubernetes api server classic
                      load balancer.
                    properties:
                      attributes:
                        description: Attributes defines extra attributes associated
                          with the load balancer.
                        properties:
                          crossZoneLoadBalancing:
                            description: CrossZoneLoadBalancing enables the classic
                              load balancer load balancing.
                            type: boolean
                          idleTimeout:
                            description: |-
                              IdleTimeout is time that the connection is allowed to be idle (no data
                              has been sent over the connection) before it is closed by the load balancer.
                            format: int64
                            type: integer
                        type: object
                      availabilityZones:
                        description: AvailabilityZones is an array of availability
                          zones in the VPC attached to the load balancer.
                        items:
                          type: string
                        type: array
                      dnsName:
                        description: DNSName is the dns name of the load balancer.
                        type: string
                      healthChecks:
                        description: HealthCheck is the classic elb health check associated
                          with the load balancer.
                        properties:
                          healthyThreshold:
                            format: int64
                            type: integer
                          interval:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          target:
                            type: string
                          timeout:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          unhealthyThreshold:
                            format: int64
                            type: integer
                        required:
                        - healthyThreshold
                        - interval
                        - target
                        - timeout
                        - unhealthyThreshold
                        type: object
                      listeners:
                        description: Listeners is an array of classic elb listeners
                          associated with the load balancer. There must be at least
                          one.
                        items:
                          description: ClassicELBListener defines an AWS classic load
                            balancer listener.
                          properties:
                            instancePort:
                              format: int64
                              type: integer
                            instanceProtocol:
                              description: ClassicELBProtocol defines listener protocols
                                for a classic load balancer.
                              type: string
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ClassicELBProtocol defines listener protocols
                                for a classic load balancer.
                              type: string
                          required:
                          - instancePort
                          - instanceProtocol
                          - port
                          - protocol
                          type: object
                        type: array
                      name:
                        description: |-
                          The name of the load balancer. It must be unique within the set of load balancers
                          defined in the region. It also serves as identifier.
                        type: string
                      scheme:
                        description: Scheme is the load balancer scheme, either internet-facing
                          or private.
                        type: string
                      securityGroupIds:
                        description: SecurityGroupIDs is an array of security groups
                          assigned to the load balancer.
                        items:
                          type: string
                        type: array
                      subnetIds:
                        description: SubnetIDs is an array of subnets in the VPC attached
                          to the load balancer.
                        items:
                          type: string
                        type: array
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a map of tags associated with the load
                          balancer.
                        type: object
                    type: object
                  securityGroups:
                    additionalProperties:
                      description: SecurityGroup defines an AWS security group.
                      properties:
                        id:
                          description: ID is a unique identifier.
                          type: string
                        ingressRule:
                          description: IngressRules is the inbound rules associated
                            with the security group.
                          items:
                            description: IngressRule defines an AWS ingress rule for
                              security groups.
                            properties:
                              cidrBlocks:
                                description: List of CIDR blocks to allow access from.
                                  Cannot be specified with SourceSecurityGroupID.
                                items:
                                  type: string
                                type: array
                              description:
                                type: string
                              fromPort:
                                format: int64
                                type: integer
                              ipv6CidrBlocks:
                                description: List of IPv6 CIDR blocks to allow access
                                  from. Cannot be specified with SourceSecurityGroupID.
                                items:
                                  type: string
                                type: array
                              protocol:
                                description: SecurityGroupProtocol defines the protocol
                                  type for a security group rule.
                                type: string
                              sourceSecurityGroupIds:
                                description: The security group id to allow access
                                  from. Cannot be specified with CidrBlocks.
                                items:
                                  type: string
                                type: array
                              toPort:
                                format: int64
                                type: integer
                            required:
                            - description
                            - fromPort
                            - protocol
                            - toPort
                            type: object
                          type: array
                        name:
                          description: Name is the security group name.
                          type: string
                        tags:
                          additionalProperties:
                            type: string
                          description: Tags is a map of tags associated with the security
                            group.
                          type: object
                      required:
                      - id
                      - name
                      type: object
                    description: SecurityGroups is a map from the role/kind of the
                      security group to its unique name, if any.
                    type: object
                type: object
              ready:
                default: false
                type: boolean
            required:
            - ready
            type: object
        type: object
    served: false
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - description: Cluster to which this AWSCluster belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: Cluster infrastructure is ready for EC2 instances
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: AWS VPC the cluster is using
      jsonPath: .spec.network.vpc.id
      name: VPC
      type: string
    - description: API Endpoint
      jsonPath: .spec.controlPlaneEndpoint
      name: Endpoint
      priority: 1
      type: string
    - description: Bastion IP address for breakglass access
      jsonPath: .status.bastion.publicIp
      name: Bastion IP
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSCluster is the schema for Amazon EC2 based Kubernetes Cluster
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSClusterSpec defines the desired state of an EC2-based
              Kubernetes cluster.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                  ones added by default.
                type: object
              bastion:
                description: Bastion contains options to configure the bastion host.
                properties:
                  allowedCIDRBlocks:
                    description: |-
                      AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
                      They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
                    items:
                      type: string
                    type: array
                  ami:
                    description: |-
                      AMI will use the specified AMI to boot the bastion. If not specified,
                      the AMI will default to one picked out in public space.
                    type: string
                  disableIngressRules:
                    description: |-
                      DisableIngressRules will ensure there are no Ingress rules in the bastion host's security group.
                      Requires AllowedCIDRBlocks to be empty.
                    type: boolean
                  enabled:
                    description: |-
                      Enabled allows this provider to create a bastion host instance
                      with a public ip to access the VPC private network.
                    type: boolean
                  instanceType:
                    description: |-
                      InstanceType will use the specified instance type for the bastion. If not specified,
                      Cluster API Provider AWS will use t3.micro for all regions except us-east-1, where t2.micro
                      will be the default.
                    type: string
                type: object
              controlPlaneEndpoint:
                description: ControlPlaneEndpoint represents the endpoint used to
                  communicate with the control plane.
                properties:
                  host:
                    description: The hostname on which the API server is serving.
                    type: string
                  port:
                    description: The port on which the API server is serving.
                    format: int32
                    type: integer
                required:
                - host
                - port
                type: object
              controlPlaneLoadBalancer:
                description: ControlPlaneLoadBalancer is optional configuration for
                  customizing control plane behavior.
                properties:
                  additionalListeners:
                    description: |-
                      AdditionalListeners sets the additional listeners for the control plane load balancer.
                      This is only applicable to Network Load Balancer (NLB) types for the time being.
                    items:
                      description: |-
                        AdditionalListenerSpec defines the desired state of an
                        additional listener on an AWS load balancer.
                      properties:
                        healthCheck:
                          description: HealthCheck sets the optional custom health
                            check configuration to the API target group.
                          properties:
                            intervalSeconds:
                              description: |-
                                The approximate amount of time, in seconds, between health checks of an individual
                                target.
                              format: int64
                              maximum: 300
                              minimum: 5
                              type: integer
                            path:
                              description: |-
                                The destination for health checks on the targets when using the protocol HTTP or HTTPS,
                                otherwise the path will be ignored.
                              type: string
                            port:
                              description: |-
                                The port the load balancer uses when performing health checks for additional target groups. When
                                not specified this value will be set for the same of listener port.
                              type: string
                            protocol:
                              description: |-
                                The protocol to use to health check connect with the target. When not specified the Protocol
                                will be the same of the listener.
                              enum:
                              - TCP
                              - HTTP
                              - HTTPS
                              type: string
                            thresholdCount:
                              description: |-
                                The number of consecutive health check successes required before considering
                                a target healthy.
                              format: int64
                              maximum: 10
                              minimum: 2
                              type: integer
                            timeoutSeconds:
                              description: |-
                                The amount of time, in seconds, during which no response from a target means
                                a failed health check.
                              format: int64
                              maximum: 120
                              minimum: 2
                              type: integer
                            unhealthyThresholdCount:
                              description: |-
                                The number of consecutive health check failures required before considering
                                a target unhealthy.
                              format: int64
                              maximum: 10
                              minimum: 2
                              type: integer
                          type: object
                        port:
                          description: Port sets the port for the additional listener.
                          format: int64
                          maximum: 65535
                          minimum: 1
                          type: integer
                        protocol:
                          default: TCP
                          description: |-
                            Protocol sets the protocol for the additional listener.
                            Currently only TCP is supported.
                          enum:
                          - TCP
                          type: string
                      required:
                      - port
                      type: object
                    type: array
                    x-kubernetes-list-map-keys:
                    - port
                    x-kubernetes-list-type: map
                  additionalSecurityGroups:
                    description: |-
                      AdditionalSecurityGroups sets the security groups used by the load balancer. Expected to be security group IDs
                      This is optional - if not provided new security groups will be created for the load balancer
                    items:
                      type: string
                    type: array
                  crossZoneLoadBalancing:
                    description: |-
                      CrossZoneLoadBalancing enables the classic ELB cross availability zone balancing.


                      With cross-zone load balancing, each load balancer node for your Classic Load Balancer
                      distributes requests evenly across the registered instances in all enabled Availability Zones.
                      If cross-zone load balancing is disabled, each load balancer node distributes requests evenly across
                      the registered instances in its Availability Zone only.


                      Defaults to false.
                    type: boolean
                  disableHostsRewrite:
                    description: |-
                      DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
                      file of each instance. This is by default, false.
                    type: boolean
                  healthCheck:
                    description: HealthCheck sets custom health check configuration
                      to the API target group.
                    properties:
                      intervalSeconds:
                        description: |-
                          The approximate amount of time, in seconds, between health checks of an individual
                          target.
                        format: int64
                        maximum: 300
                        minimum: 5
                        type: integer
                      thresholdCount:
                        description: |-
                          The number of consecutive health check successes required before considering
                          a target healthy.
                        format: int64
                        maximum: 10
                        minimum: 2
                        type: integer
                      timeoutSeconds:
                        description: |-
                          The amount of time, in seconds, during which no response from a target means
                          a failed health check.
                        format: int64
                        maximum: 120
                        minimum: 2
                        type: integer
                      unhealthyThresholdCount:
                        description: |-
                          The number of consecutive health check failures required before considering
                          a target unhealthy.
                        format: int64
                        maximum: 10
                        minimum: 2
                        type: integer
                    type: object
                  healthCheckProtocol:
                    description: |-
                      HealthCheckProtocol sets the protocol type for ELB health check target
                      default value is ELBProtocolSSL
                    enum:
                    - TCP
                    - SSL
                    - HTTP
                    - HTTPS
                    - TLS
                    - UDP
                    type: string
                  ingressRules:
                    description: IngressRules sets the ingress rules for the control
                      plane load balancer.
                    items:
                      description: IngressRule defines an AWS ingress rule for security
                        groups.
                      properties:
                        cidrBlocks:
                          description: List of CIDR blocks to allow access from. Cannot
                            be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        description:
                          description: Description provides extended information about
                            the ingress rule.
                          type: string
                        fromPort:
                          description: FromPort is the start of port range.
                          format: int64
                          type: integer
                        ipv6CidrBlocks:
                          description: List of IPv6 CIDR blocks to allow access from.
                            Cannot be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        natGatewaysIPsSource:
                          description: NatGatewaysIPsSource use the NAT gateways IPs
                            as the source for the ingress rule.
                          type: boolean
                        protocol:
                          description: Protocol is the protocol for the ingress rule.
                            Accepted values are "-1" (all), "4" (IP in IP),"tcp",
                            "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                          enum:
                          - "-1"
                          - "4"
                          - tcp
                          - udp
                          - icmp
                          - "58"
                          - "50"
                          type: string
                        sourceSecurityGroupIds:
                          description: The security group id to allow access from.
                            Cannot be specified with CidrBlocks.
                          items:
                            type: string
                          type: array
                        sourceSecurityGroupRoles:
                          description: |-
                            The security group role to allow access from. Cannot be specified with CidrBlocks.
                            The field will be combined with source security group IDs if specified.
                          items:
                            description: SecurityGroupRole defines the unique role
                              of a security group.
                            enum:
                            - bastion
                            - node
                            - controlplane
                            - apiserver-lb
                            - lb
                            - node-eks-additional
                            type: string
                          type: array
                        toPort:
                          description: ToPort is the end of port range.
                          format: int64
                          type: integer
                      required:
                      - description
                      - fromPort
                      - protocol
                      - toPort
                      type: object
                    type: array
                  loadBalancerType:
                    default: classic
                    description: LoadBalancerType sets the type for a load balancer.
                      The default type is classic.
                    enum:
                    - classic
                    - elb
                    - alb
                    - nlb
                    - disabled
                    type: string
                  name:
                    description: |-
                      Name sets the name of the classic ELB load balancer. As per AWS, the name must be unique
                      within your set of load balancers for the region, must have a maximum of 32 characters, must
                      contain only alphanumeric characters or hyphens, and cannot begin or end with a hyphen. Once
                      set, the value cannot be changed.
                    maxLength: 32
                    pattern: ^[A-Za-z0-9]([A-Za-z0-9]{0,31}|[-A-Za-z0-9]{0,30}[A-Za-z0-9])$
                    type: string
                  preserveClientIP:
                    description: |-
                      PreserveClientIP lets the user control if preservation of client ips must be retained or not.
                      If this is enabled 6443 will be opened to 0.0.0.0/0.
                    type: boolean
                  scheme:
                    default: internet-facing
                    description: Scheme sets the scheme of the load balancer (defaults
                      to internet-facing)
                    enum:
                    - internet-facing
                    - internal
                    type: string
                  subnets:
                    description: Subnets sets the subnets that should be applied to
                      the control plane load balancer (defaults to discovered subnets
                      for managed VPCs or an empty set for unmanaged VPCs)
                    items:
                      type: string
                    type: array
                type: object
              identityRef:
                description: |-
                  IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
                  If no identity is specified, the default identity for this controller will be used.
                properties:
                  kind:
                    description: Kind of the identity.
                    enum:
                    - AWSClusterControllerIdentity
                    - AWSClusterRoleIdentity
                    - AWSClusterStaticIdentity
                    type: string
                  name:
                    description: Name of the identity.
                    minLength: 1
                    type: string
                required:
                - kind
                - name
                type: object
              imageLookupBaseOS:
                description: |-
                  ImageLookupBaseOS is the name of the base operating system used to look
                  up machine images when a machine does not specify an AMI. When set, this
                  will be used for all cluster machines unless a machine specifies a
                  different ImageLookupBaseOS.
                type: string
              imageLookupFormat:
                description: |-
                  ImageLookupFormat is the AMI naming format to look up machine images when
                  a machine does not specify an AMI. When set, this will be used for all
                  cluster machines unless a machine specifies a different ImageLookupOrg.
                  Supports substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base
                  OS and kubernetes version, respectively. The BaseOS will be the value in
                  ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                  defined by the packages produced by kubernetes/release without v as a
                  prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                  image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                  searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                  Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                  also: https://golang.org/pkg/text/template/
                type: string
              imageLookupOrg:
                description: |-
                  ImageLookupOrg is the AWS Organization ID to look up machine images when a
                  machine does not specify an AMI. When set, this will be used for all
                  cluster machines unless a machine specifies a different ImageLookupOrg.
                type: string
              network:
                description: NetworkSpec encapsulates all things related to AWS network.
                properties:
                  additionalControlPlaneIngressRules:
                    description: AdditionalControlPlaneIngressRules is an optional
                      set of ingress rules to add to the control plane
                    items:
                      description: IngressRule defines an AWS ingress rule for security
                        groups.
                      properties:
                        cidrBlocks:
                          description: List of CIDR blocks to allow access from. Cannot
                            be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        description:
                          description: Description provides extended information about
                            the ingress rule.
                          type: string
                        fromPort:
                          description: FromPort is the start of port range.
                          format: int64
                          type: integer
                        ipv6CidrBlocks:
                          description: List of IPv6 CIDR blocks to allow access from.
                            Cannot be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        natGatewaysIPsSource:
                          description: NatGatewaysIPsSource use the NAT gateways IPs
                            as the source for the ingress rule.
                          type: boolean
                        protocol:
                          description: Protocol is the protocol for the ingress rule.
                            Accepted values are "-1" (all), "4" (IP in IP),"tcp",
                            "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                          enum:
                          - "-1"
                          - "4"
                          - tcp
                          - udp
                          - icmp
                          - "58"
                          - "50"
                          type: string
                        sourceSecurityGroupIds:
                          description: The security group id to allow access from.
                            Cannot be specified with CidrBlocks.
                          items:
                            type: string
                          type: array
                        sourceSecurityGroupRoles:
                          description: |-
                            The security group role to allow access from. Cannot be specified with CidrBlocks.
                            The field will be combined with source security group IDs if specified.
                          items:
                            description: SecurityGroupRole defines the unique role
                              of a security group.
                            enum:
                            - bastion
                            - node
                            - controlplane
                            - apiserver-lb
                            - lb
                            - node-eks-additional
                            type: string
                          type: array
                        toPort:
                          description: ToPort is the end of port range.
                          format: int64
                          type: integer
                      required:
                      - description
                      - fromPort
                      - protocol
                      - toPort
                      type: object
                    type: array
                  cni:
                    description: CNI configuration
                    properties:
                      cniIngressRules:
                        description: |-
                          CNIIngressRules specify rules to apply to control plane and worker node security groups.
                          The source for the rule will be set to control plane and worker security group IDs.
                        items:
                          description: CNIIngressRule defines an AWS ingress rule
                            for CNI requirements.
                          properties:
                            description:
                              type: string
                            fromPort:
                              format: int64
                              type: integer
                            protocol:
                              description: SecurityGroupProtocol defines the protocol
                                type for a security group rule.
                              type: string
                            toPort:
                              format: int64
                              type: integer
                          required:
                          - description
                          - fromPort
                          - protocol
                          - toPort
                          type: object
                        type: array
                    type: object
                  nodePortIngressRuleCidrBlocks:
                    description: |-
                      NodePortIngressRuleCidrBlocks is an optional set of CIDR blocks to allow traffic to nodes' NodePort services.
                      If none are specified here, all IPs are allowed to connect.
                    items:
                      type: string
                    type: array
                  securityGroupOverrides:
                    additionalProperties:
                      type: string
                    description: |-
                      SecurityGroupOverrides is an optional set of security groups to use for cluster instances
                      This is optional - if not provided new security groups will be created for the cluster
                    type: object
                  subnets:
                    description: Subnets configuration.
                    items:
                      description: SubnetSpec configures an AWS Subnet.
                      properties:
                        availabilityZone:
                          description: AvailabilityZone defines the availability zone
                            to use for this subnet in the cluster's region.
                          type: string
                        cidrBlock:
                          description: CidrBlock is the CIDR block to be used when
                            the provider creates a managed VPC.
                          type: string
                        id:
                          description: |-
                            ID defines a unique identifier to reference this resource.
                            If you're bringing your subnet, set the AWS subnet-id here, it must start with `subnet-`.


                            When the VPC is managed by CAPA, and you'd like the provider to create a subnet for you,
                            the id can be set to any placeholder value that does not start with `subnet-`;
                            upon creation, the subnet AWS identifier will be populated in the `ResourceID` field and
                            the `id` field is going to be used as the subnet name. If you specify a tag
                            called `Name`, it takes precedence.
                          type: string
                        ipv6CidrBlock:
                          description: |-
                            IPv6CidrBlock is the IPv6 CIDR block to be used when the provider creates a managed VPC.
                            A subnet can have an IPv4 and an IPv6 address.
                            IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                          type: string
                        isIpv6:
                          description: |-
                            IsIPv6 defines the subnet as an IPv6 subnet. A subnet is IPv6 when it is associated with a VPC that has IPv6 enabled.
                            IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                          type: boolean
                        isPublic:
                          description: IsPublic defines the subnet as a public subnet.
                            A subnet is public when it is associated with a route
                            table that has a route to an internet gateway.
                          type: boolean
                        natGatewayId:
                          description: |-
                            NatGatewayID is the NAT gateway id associated with the subnet.
                            Ignored unless the subnet is managed by the provider, in which case this is set on the public subnet where the NAT gateway resides. It is then used to determine routes for private subnets in the same AZ as the public subnet.
                          type: string
                        parentZoneName:
                          description: |-
                            ParentZoneName is the zone name where the current subnet's zone is tied when
                            the zone is a Local Zone.


                            The subnets in Local Zone or Wavelength Zone locations consume the ParentZoneName
                            to select the correct private route table to egress traffic to the internet.
                          type: string
                        resourceID:
                          description: |-
                            ResourceID is the subnet identifier from AWS, READ ONLY.
                            This field is populated when the provider manages the subnet.
                          type: string
                        routeTableId:
                          description: RouteTableID is the routing table id associated
                            with the subnet.
                          type: string
                        tags:
                          additionalProperties:
                            type: string
                          description: Tags is a collection of tags describing the
                            resource.
                          type: object
                        zoneType:
                          description: |-
                            ZoneType defines the type of the zone where the subnet is created.


                            The valid values are availability-zone, local-zone, and wavelength-zone.


                            Subnet with zone type availability-zone (regular) is always selected to create cluster
                            resources, like Load Balancers, NAT Gateways, Contol Plane nodes, etc.


                            Subnet with zone type local-zone or wavelength-zone is not eligible to automatically create
                            regular cluster resources.


                            The public subnet in availability-zone or local-zone is associated with regular public
                            route table with default route entry to a Internet Gateway.


                            The public subnet in wavelength-zone is associated with a carrier public
                            route table with default route entry to a Carrier Gateway.


                            The private subnet in the availability-zone is associated with a private route table with
                            the default route entry to a NAT Gateway created in that zone.


                            The private subnet in the local-zone or wavelength-zone is associated with a private route table with
                            the default route entry re-using the NAT Gateway in the Region (preferred from the
                            parent zone, the zone type availability-zone in the region, or first table available).
                          enum:
                          - availability-zone
                          - local-zone
                          - wavelength-zone
                          type: string
                      required:
                      - id
                      type: object
                    type: array
                    x-kubernetes-list-map-keys:
                    - id
                    x-kubernetes-list-type: map
                  vpc:
                    description: VPC configuration.
                    properties:
                      availabilityZoneSelection:
                        default: Ordered
                        description: |-
                          AvailabilityZoneSelection specifies how AZs should be selected if there are more AZs
                          in a region than specified by AvailabilityZoneUsageLimit. There are 2 selection schemes:
                          Ordered - selects based on alphabetical order
                          Random - selects AZs randomly in a region
                          Defaults to Ordered
                        enum:
                        - Ordered
                        - Random
                        type: string
                      availabilityZoneUsageLimit:
                        default: 3
                        description: |-
                          AvailabilityZoneUsageLimit specifies the maximum number of availability zones (AZ) that
                          should be used in a region when automatically creating subnets. If a region has more
                          than this number of AZs then this number of AZs will be picked randomly when creating
                          default subnets. Defaults to 3
                        minimum: 1
                        type: integer
                      carrierGatewayId:
                        description: |-
                          CarrierGatewayID is the id of the internet gateway associated with the VPC,
                          for carrier network (Wavelength Zones).
                        type: string
                        x-kubernetes-validations:
                        - message: Carrier Gateway ID must start with 'cagw-'
                          rule: self.startsWith('cagw-')
                      cidrBlock:
                        description: |-
                          CidrBlock is the CIDR block to be used when the provider creates a managed VPC.
                          Defaults to 10.0.0.0/16.
                          Mutually exclusive with IPAMPool.
                        type: string
                      elasticIpPool:
                        description: |-
                          ElasticIPPool contains specific configuration to allocate Public IPv4 address (Elastic IP) from user-defined pool
                          brought to AWS for core infrastructure resources, like NAT Gateways and Public Network Load Balancers for
                          the API Server.
                        properties:
                          publicIpv4Pool:
                            description: |-
                              PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources
                              created in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom
                              Public IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool
                              resource ID starts with 'ipv4pool-ec2'.
                            maxLength: 30
                            type: string
                          publicIpv4PoolFallbackOrder:
                            description: |-
                              PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,
                              no more IPv4 address available in the pool.


                              When set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the
                              IPv4 limit, the address will be claimed from Amazon-pool (default).


                              When set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.
                            enum:
                            - amazon-pool
                            - none
                            type: string
                            x-kubernetes-validations:
                            - message: allowed values are 'none' and 'amazon-pool'
                              rule: self in ['none','amazon-pool']
                        type: object
                      emptyRoutesDefaultVPCSecurityGroup:
                        description: |-
                          EmptyRoutesDefaultVPCSecurityGroup specifies whether the default VPC security group ingress
                          and egress rules should be removed.


                          By default, when creating a VPC, AWS creates a security group called `default` with ingress and egress
                          rules that allow traffic from anywhere. The group could be used as a potential surface attack and
                          it's generally suggested that the group rules are removed or modified appropriately.


                          NOTE: This only applies when the VPC is managed by the Cluster API AWS controller.
                        type: boolean
                      id:
                        description: ID is the vpc-id of the VPC this provider should
                          use to create resources.
                        type: string
                      internetGatewayId:
                        description: InternetGatewayID is the id of the internet gateway
                          associated with the VPC.
                        type: string
                      ipamPool:
                        description: |-
                          IPAMPool defines the IPAMv4 pool to be used for VPC.
                          Mutually exclusive with CidrBlock.
                        properties:
                          id:
                            description: ID is the ID of the IPAM pool this provider
                              should use to create VPC.
                            type: string
                          name:
                            description: Name is the name of the IPAM pool this provider
                              should use to create VPC.
                            type: string
                          netmaskLength:
                            description: |-
                              The netmask length of the IPv4 CIDR you want to allocate to VPC from
                              an Amazon VPC IP Address Manager (IPAM) pool.
                              Defaults to /16 for IPv4 if not specified.
                            format: int64
                            type: integer
                        type: object
                      ipv6:
                        description: |-
                          IPv6 contains ipv6 specific settings for the network. Supported only in managed clusters.
                          This field cannot be set on AWSCluster object.
                        properties:
                          cidrBlock:
                            description: |-
                              CidrBlock is the CIDR block provided by Amazon when VPC has enabled IPv6.
                              Mutually exclusive with IPAMPool.
                            type: string
                          egressOnlyInternetGatewayId:
                            description: EgressOnlyInternetGatewayID is the id of
                              the egress only internet gateway associated with an
                              IPv6 enabled VPC.
                            type: string
                          ipamPool:
                            description: |-
                              IPAMPool defines the IPAMv6 pool to be used for VPC.
                              Mutually exclusive with CidrBlock.
                            properties:
                              id:
                                description: ID is the ID of the IPAM pool this provider
                                  should use to create VPC.
                                type: string
                              name:
                                description: Name is the name of the IPAM pool this
                                  provider should use to create VPC.
                                type: string
                              netmaskLength:
                                description: |-
                                  The netmask length of the IPv4 CIDR you want to allocate to VPC from
                                  an Amazon VPC IP Address Manager (IPAM) pool.
                                  Defaults to /16 for IPv4 if not specified.
                                format: int64
                                type: integer
                            type: object
                          poolId:
                            description: |-
                              PoolID is the IP pool which must be defined in case of BYO IP is defined.
                              Must be specified if CidrBlock is set.
                              Mutually exclusive with IPAMPool.
                            type: string
                        type: object
                      privateDnsHostnameTypeOnLaunch:
                        description: |-
                          PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.
                          For IPv4-only and dual-stack (IPv4 and IPv6) subnets, an instance DNS name can be based on the instance IPv4 address (ip-name)
                          or the instance ID (resource-name). For IPv6 only subnets, an instance DNS name must be based on the instance ID (resource-name).
                        enum:
                        - ip-name
                        - resource-name
                        type: string
                      secondaryCidrBlocks:
                        description: |-
                          SecondaryCidrBlocks are additional CIDR blocks to be associated when the provider creates a managed VPC.
                          Defaults to none. Mutually exclusive with IPAMPool. This makes sense to use if, for example, you want to use
                          a separate IP range for pods (e.g. Cilium ENI mode).
                        items:
                          description: VpcCidrBlock defines the CIDR block and settings
                            to associate with the managed VPC. Currently, only IPv4
                            is supported.
                          properties:
                            ipv4CidrBlock:
                              description: IPv4CidrBlock is the IPv4 CIDR block to
                                associate with the managed VPC.
                              minLength: 1
                              type: string
                          required:
                          - ipv4CidrBlock
                          type: object
                        type: array
                      subnetSchema:
                        default: PreferPrivate
                        description: |-
                          SubnetSchema specifies how CidrBlock should be divided on subnets in the VPC depending on the number of AZs.
                          PreferPrivate - one private subnet for each AZ plus one other subnet that will be further sub-divided for the public subnets.
                          PreferPublic - have the reverse logic of PreferPrivate, one public subnet for each AZ plus one other subnet
                          that will be further sub-divided for the private subnets.
                          Defaults to PreferPrivate
                        enum:
                        - PreferPrivate
                        - PreferPublic
                        type: string
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a collection of tags describing the resource.
                        type: object
                    type: object
                type: object
              partition:
                description: Partition is the AWS security partition being used. Defaults
                  to "aws"
                type: string
              region:
                description: The AWS Region the cluster lives in.
                type: string
              s3Bucket:
                description: |-
                  S3Bucket contains options to configure a supporting S3 bucket for this
                  cluster - currently used for nodes requiring Ignition
                  (https://coreos.github.io/ignition/) for bootstrapping (requires
                  BootstrapFormatIgnition feature flag to be enabled).
                properties:
                  bestEffortDeleteObjects:
                    description: BestEffortDeleteObjects defines whether access/permission
                      errors during object deletion should be ignored.
                    type: boolean
                  controlPlaneIAMInstanceProfile:
                    description: |-
                      ControlPlaneIAMInstanceProfile is a name of the IAMInstanceProfile, which will be allowed
                      to read control-plane node bootstrap data from S3 Bucket.
                    type: string
                  name:
                    description: Name defines name of S3 Bucket to be created.
                    maxLength: 63
                    minLength: 3
                    pattern: ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$
                    type: string
                  nodesIAMInstanceProfiles:
                    description: |-
                      NodesIAMInstanceProfiles is a list of IAM instance profiles, which will be allowed to read
                      worker nodes bootstrap data from S3 Bucket.
                    items:
                      type: string
                    type: array
                  presignedURLDuration:
                    description: |-
                      PresignedURLDuration defines the duration for which presigned URLs are valid.


                      This is used to generate presigned URLs for S3 Bucket objects, which are used by
                      control-plane and worker nodes to fetch bootstrap data.


                      When enabled, the IAM instance profiles specified are not used.
                    type: string
                required:
                - name
                type: object
              secondaryControlPlaneLoadBalancer:
                description: |-
                  SecondaryControlPlaneLoadBalancer is an additional load balancer that can be used for the control plane.


                  An example use case is to have a separate internal load balancer for internal traffic,
                  and a separate external load balancer for external traffic.
                properties:
                  additionalListeners:
                    description: |-
                      AdditionalListeners sets the additional listeners for the control plane load balancer.
                      This is only applicable to Network Load Balancer (NLB) types for the time being.
                    items:
                      description: |-
                        AdditionalListenerSpec defines the desired state of an
                        additional listener on an AWS load balancer.
                      properties:
                        healthCheck:
                          description: HealthCheck sets the optional custom health
                            check configuration to the API target group.
                          properties:
                            intervalSeconds:
                              description: |-
                                The approximate amount of time, in seconds, between health checks of an individual
                                target.
                              format: int64
                              maximum: 300
                              minimum: 5
                              type: integer
                            path:
                              description: |-
                                The destination for health checks on the targets when using the protocol HTTP or HTTPS,
                                otherwise the path will be ignored.
                              type: string
                            port:
                              description: |-
                                The port the load balancer uses when performing health checks for additional target groups. When
                                not specified this value will be set for the same of listener port.
                              type: string
                            protocol:
                              description: |-
                                The protocol to use to health check connect with the target. When not specified the Protocol
                                will be the same of the listener.
                              enum:
                              - TCP
                              - HTTP
                              - HTTPS
                              type: string
                            thresholdCount:
                              description: |-
                                The number of consecutive health check successes required before considering
                                a target healthy.
                              format: int64
                              maximum: 10
                              minimum: 2
                              type: integer
                            timeoutSeconds:
                              description: |-
                                The amount of time, in seconds, during which no response from a target means
                                a failed health check.
                              format: int64
                              maximum: 120
                              minimum: 2
                              type: integer
                            unhealthyThresholdCount:
                              description: |-
                                The number of consecutive health check failures required before considering
                                a target unhealthy.
                              format: int64
                              maximum: 10
                              minimum: 2
                              type: integer
                          type: object
                        port:
                          description: Port sets the port for the additional listener.
                          format: int64
                          maximum: 65535
                          minimum: 1
                          type: integer
                        protocol:
                          default: TCP
                          description: |-
                            Protocol sets the protocol for the additional listener.
                            Currently only TCP is supported.
                          enum:
                          - TCP
                          type: string
                      required:
                      - port
                      type: object
                    type: array
                    x-kubernetes-list-map-keys:
                    - port
                    x-kubernetes-list-type: map
                  additionalSecurityGroups:
                    description: |-
                      AdditionalSecurityGroups sets the security groups used by the load balancer. Expected to be security group IDs
                      This is optional - if not provided new security groups will be created for the load balancer
                    items:
                      type: string
                    type: array
                  crossZoneLoadBalancing:
                    description: |-
                      CrossZoneLoadBalancing enables the classic ELB cross availability zone balancing.


                      With cross-zone load balancing, each load balancer node for your Classic Load Balancer
                      distributes requests evenly across the registered instances in all enabled Availability Zones.
                      If cross-zone load balancing is disabled, each load balancer node distributes requests evenly across
                      the registered instances in its Availability Zone only.


                      Defaults to false.
                    type: boolean
                  disableHostsRewrite:
                    description: |-
                      DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
                      file of each instance. This is by default, false.
                    type: boolean
                  healthCheck:
                    description: HealthCheck sets custom health check configuration
                      to the API target group.
                    properties:
                      intervalSeconds:
                        description: |-
                          The approximate amount of time, in seconds, between health checks of an individual
                          target.
                        format: int64
                        maximum: 300
                        minimum: 5
                        type: integer
                      thresholdCount:
                        description: |-
                          The number of consecutive health check successes required before considering
                          a target healthy.
                        format: int64
                        maximum: 10
                        minimum: 2
                        type: integer
                      timeoutSeconds:
                        description: |-
                          The amount of time, in seconds, during which no response from a target means
                          a failed health check.
                        format: int64
                        maximum: 120
                        minimum: 2
                        type: integer
                      unhealthyThresholdCount:
                        description: |-
                          The number of consecutive health check failures required before considering
                          a target unhealthy.
                        format: int64
                        maximum: 10
                        minimum: 2
                        type: integer
                    type: object
                  healthCheckProtocol:
                    description: |-
                      HealthCheckProtocol sets the protocol type for ELB health check target
                      default value is ELBProtocolSSL
                    enum:
                    - TCP
                    - SSL
                    - HTTP
                    - HTTPS
                    - TLS
                    - UDP
                    type: string
                  ingressRules:
                    description: IngressRules sets the ingress rules for the control
                      plane load balancer.
                    items:
                      description: IngressRule defines an AWS ingress rule for security
                        groups.
                      properties:
                        cidrBlocks:
                          description: List of CIDR blocks to allow access from. Cannot
                            be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        description:
                          description: Description provides extended information about
                            the ingress rule.
                          type: string
                        fromPort:
                          description: FromPort is the start of port range.
                          format: int64
                          type: integer
                        ipv6CidrBlocks:
                          description: List of IPv6 CIDR blocks to allow access from.
                            Cannot be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        natGatewaysIPsSource:
                          description: NatGatewaysIPsSource use the NAT gateways IPs
                            as the source for the ingress rule.
                          type: boolean
                        protocol:
                          description: Protocol is the protocol for the ingress rule.
                            Accepted values are "-1" (all), "4" (IP in IP),"tcp",
                            "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                          enum:
                          - "-1"
                          - "4"
                          - tcp
                          - udp
                          - icmp
                          - "58"
                          - "50"
                          type: string
                        sourceSecurityGroupIds:
                          description: The security group id to allow access from.
                            Cannot be specified with CidrBlocks.
                          items:
                            type: string
                          type: array
                        sourceSecurityGroupRoles:
                          description: |-
                            The security group role to allow access from. Cannot be specified with CidrBlocks.
                            The field will be combined with source security group IDs if specified.
                          items:
                            description: SecurityGroupRole defines the unique role
                              of a security group.
                            enum:
                            - bastion
                            - node
                            - controlplane
                            - apiserver-lb
                            - lb
                            - node-eks-additional
                            type: string
                          type: array
                        toPort:
                          description: ToPort is the end of port range.
                          format: int64
                          type: integer
                      required:
                      - description
                      - fromPort
                      - protocol
                      - toPort
                      type: object
                    type: array
                  loadBalancerType:
                    default: classic
                    description: LoadBalancerType sets the type for a load balancer.
                      The default type is classic.
                    enum:
                    - classic
                    - elb
                    - alb
                    - nlb
                    - disabled
                    type: string
                  name:
                    description: |-
                      Name sets the name of the classic ELB load balancer. As per AWS, the name must be unique
                      within your set of load balancers for the region, must have a maximum of 32 characters, must
                      contain only alphanumeric characters or hyphens, and cannot begin or end with a hyphen. Once
                      set, the value cannot be changed.
                    maxLength: 32
                    pattern: ^[A-Za-z0-9]([A-Za-z0-9]{0,31}|[-A-Za-z0-9]{0,30}[A-Za-z0-9])$
                    type: string
                  preserveClientIP:
                    description: |-
                      PreserveClientIP lets the user control if preservation of client ips must be retained or not.
                      If this is enabled 6443 will be opened to 0.0.0.0/0.
                    type: boolean
                  scheme:
                    default: internet-facing
                    description: Scheme sets the scheme of the load balancer (defaults
                      to internet-facing)
                    enum:
                    - internet-facing
                    - internal
                    type: string
                  subnets:
                    description: Subnets sets the subnets that should be applied to
                      the control plane load balancer (defaults to discovered subnets
                      for managed VPCs or an empty set for unmanaged VPCs)
                    items:
                      type: string
                    type: array
                type: object
              sshKeyName:
                description: SSHKeyName is the name of the ssh key to attach to the
                  bastion host. Valid values are empty string (do not use SSH keys),
                  a valid SSH key name, or omitted (use the default SSH key name)
                type: string
            type: object
          status:
            description: AWSClusterStatus defines the observed state of AWSCluster.
            properties:
              bastion:
                description: Instance describes an AWS instance.
                properties:
                  addresses:
                    description: Addresses contains the AWS instance associated addresses.
                    items:
                      description: MachineAddress contains information for the node's
                        address.
                      properties:
                        address:
                          description: The machine address.
                          type: string
                        type:
                          description: Machine address type, one of Hostname, ExternalIP,
                            InternalIP, ExternalDNS or InternalDNS.
                          type: string
                      required:
                      - address
                      - type
                      type: object
                    type: array
                  availabilityZone:
                    description: Availability zone of instance
                    type: string
                  capacityReservationId:
                    description: CapacityReservationID specifies the target Capacity
                      Reservation into which the instance should be launched.
                    type: string
                  ebsOptimized:
                    description: Indicates whether the instance is optimized for Amazon
                      EBS I/O.
                    type: boolean
                  enaSupport:
                    description: Specifies whether enhanced networking with ENA is
                      enabled.
                    type: boolean
                  iamProfile:
                    description: The name of the IAM instance profile associated with
                      the instance, if applicable.
                    type: string
                  id:
                    type: string
                  imageId:
                    description: The ID of the AMI used to launch the instance.
                    type: string
                  instanceMetadataOptions:
                    description: InstanceMetadataOptions is the metadata options for
                      the EC2 instance.
                    properties:
                      httpEndpoint:
                        default: enabled
                        description: |-
                          Enables or disables the HTTP metadata endpoint on your instances.


                          If you specify a value of disabled, you cannot access your instance metadata.


                          Default: enabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                      httpPutResponseHopLimit:
                        default: 1
                        description: |-
                          The desired HTTP PUT response hop limit for instance metadata requests. The
                          larger the number, the further instance metadata requests can travel.


                          Default: 1
                        format: int64
                        maximum: 64
                        minimum: 1
                        type: integer
                      httpTokens:
                        default: optional
                        description: |-
                          The state of token usage for your instance metadata requests.


                          If the state is optional, you can choose to retrieve instance metadata with
                          or without a session token on your request. If you retrieve the IAM role
                          credentials without a token, the version 1.0 role credentials are returned.
                          If you retrieve the IAM role credentials using a valid session token, the
                          version 2.0 role credentials are returned.


                          If the state is required, you must send a session token with any instance
                          metadata retrieval requests. In this state, retrieving the IAM role credentials
                          always returns the version 2.0 credentials; the version 1.0 credentials are
                          not available.


                          Default: optional
                        enum:
                        - optional
                        - required
                        type: string
                      instanceMetadataTags:
                        default: disabled
                        description: |-
                          Set to enabled to allow access to instance tags from the instance metadata.
                          Set to disabled to turn off access to instance tags from the instance metadata.
                          For more information, see Work with instance tags using the instance metadata
                          (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS).


                          Default: disabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                    type: object
                  instanceState:
                    description: The current state of the instance.
                    type: string
                  networkInterfaces:
                    description: Specifies ENIs attached to instance
                    items:
                      type: string
                    type: array
                  nonRootVolumes:
                    description: Configuration options for the non root storage volumes.
                    items:
                      description: Volume encapsulates the configuration options for
                        the storage device.
                      properties:
                        deviceName:
                          description: Device name
                          type: string
                        encrypted:
                          description: Encrypted is whether the volume should be encrypted
                            or not.
                          type: boolean
                        encryptionKey:
                          description: |-
                            EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                            If Encrypted is set and this is omitted, the default AWS key will be used.
                            The key must already exist and be accessible by the controller.
                          type: string
                        iops:
                          description: IOPS is the number of IOPS requested for the
                            disk. Not applicable to all types.
                          format: int64
                          type: integer
                        size:
                          description: |-
                            Size specifies size (in Gi) of the storage device.
                            Must be greater than the image snapshot size or 8 (whichever is greater).
                          format: int64
                          minimum: 8
                          type: integer
                        throughput:
                          description: Throughput to provision in MiB/s supported
                            for the volume type. Not applicable to all types.
                          format: int64
                          type: integer
                        type:
                          description: Type is the type of the volume (e.g. gp2, io1,
                            etc...).
                          type: string
                      required:
                      - size
                      type: object
                    type: array
                  placementGroupName:
                    description: PlacementGroupName specifies the name of the placement
                      group in which to launch the instance.
                    type: string
                  placementGroupPartition:
                    description: |-
                      PlacementGroupPartition is the partition number within the placement group in which to launch the instance.
                      This value is only valid if the placement group, referred in `PlacementGroupName`, was created with
                      strategy set to partition.
                    format: int64
                    maximum: 7
                    minimum: 1
                    type: integer
                  privateDnsName:
                    description: PrivateDNSName is the options for the instance hostname.
                    properties:
                      enableResourceNameDnsAAAARecord:
                        description: EnableResourceNameDNSAAAARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          AAAA records.
                        type: boolean
                      enableResourceNameDnsARecord:
                        description: EnableResourceNameDNSARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          A records.
                        type: boolean
                      hostnameType:
                        description: The type of hostname to assign to an instance.
                        enum:
                        - ip-name
                        - resource-name
                        type: string
                    type: object
                  privateIp:
                    description: The private IPv4 address assigned to the instance.
                    type: string
                  publicIPOnLaunch:
                    description: PublicIPOnLaunch is the option to associate a public
                      IP on instance launch
                    type: boolean
                  publicIp:
                    description: The public IPv4 address assigned to the instance,
                      if applicable.
                    type: string
                  rootVolume:
                    description: Configuration options for the root storage volume.
                    properties:
                      deviceName:
                        description: Device name
                        type: string
                      encrypted:
                        description: Encrypted is whether the volume should be encrypted
                          or not.
                        type: boolean
                      encryptionKey:
                        description: |-
                          EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                          If Encrypted is set and this is omitted, the default AWS key will be used.
                          The key must already exist and be accessible by the controller.
                        type: string
                      iops:
                        description: IOPS is the number of IOPS requested for the
                          disk. Not applicable to all types.
                        format: int64
                        type: integer
                      size:
                        description: |-
                          Size specifies size (in Gi) of the storage device.
                          Must be greater than the image snapshot size or 8 (whichever is greater).
                        format: int64
                        minimum: 8
                        type: integer
                      throughput:
                        description: Throughput to provision in MiB/s supported for
                          the volume type. Not applicable to all types.
                        format: int64
                        type: integer
                      type:
                        description: Type is the type of the volume (e.g. gp2, io1,
                          etc...).
                        type: string
                    required:
                    - size
                    type: object
                  securityGroupIds:
                    description: SecurityGroupIDs are one or more security group IDs
                      this instance belongs to.
                    items:
                      type: string
                    type: array
                  spotMarketOptions:
                    description: SpotMarketOptions option for configuring instances
                      to be run using AWS Spot instances.
                    properties:
                      maxPrice:
                        description: MaxPrice defines the maximum price the user is
                          willing to pay for Spot VM instances
                        type: string
                    type: object
                  sshKeyName:
                    description: The name of the SSH key pair.
                    type: string
                  subnetId:
                    description: The ID of the subnet of the instance.
                    type: string
                  tags:
                    additionalProperties:
                      type: string
                    description: The tags associated with the instance.
                    type: object
                  tenancy:
                    description: Tenancy indicates if instance should run on shared
                      or single-tenant hardware.
                    type: string
                  type:
                    description: The instance type.
                    type: string
                  userData:
                    description: |-
                      UserData is the raw data script passed to the instance which is run upon bootstrap.
                      This field must not be base64 encoded and should only be used when running a new instance.
                    type: string
                  volumeIDs:
                    description: IDs of the instance's volumes
                    items:
                      type: string
                    type: array
                required:
                - id
                type: object
              conditions:
                description: Conditions provide observations of the operational state
                  of a Cluster API resource.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureDomains:
                additionalProperties:
                  description: |-
                    FailureDomainSpec is the Schema for Cluster API failure domains.
                    It allows controllers to understand how many failure domains a cluster can optionally span across.
                  properties:
                    attributes:
                      additionalProperties:
                        type: string
                      description: Attributes is a free form map of attributes an
                        infrastructure provider might use or require.
                      type: object
                    controlPlane:
                      description: ControlPlane determines if this failure domain
                        is suitable for use by control plane machines.
                      type: boolean
                  type: object
                description: FailureDomains is a slice of FailureDomains.
                type: object
              networkStatus:
                description: NetworkStatus encapsulates AWS networking resources.
                properties:
                  apiServerElb:
                    description: APIServerELB is the Kubernetes api server load balancer.
                    properties:
                      arn:
                        description: |-
                          ARN of the load balancer. Unlike the ClassicLB, ARN is used mostly
                          to define and get it.
                        type: string
                      attributes:
                        description: ClassicElbAttributes defines extra attributes
                          associated with the load balancer.
                        properties:
                          crossZoneLoadBalancing:
                            description: CrossZoneLoadBalancing enables the classic
                              load balancer load balancing.
                            type: boolean
                          idleTimeout:
                            description: |-
                              IdleTimeout is time that the connection is allowed to be idle (no data
                              has been sent over the connection) before it is closed by the load balancer.
                            format: int64
                            type: integer
                        type: object
                      availabilityZones:
                        description: AvailabilityZones is an array of availability
                          zones in the VPC attached to the load balancer.
                        items:
                          type: string
                        type: array
                      dnsName:
                        description: DNSName is the dns name of the load balancer.
                        type: string
                      elbAttributes:
                        additionalProperties:
                          type: string
                        description: ELBAttributes defines extra attributes associated
                          with v2 load balancers.
                        type: object
                      elbListeners:
                        description: ELBListeners is an array of listeners associated
                          with the load balancer. There must be at least one.
                        items:
                          description: Listener defines an AWS network load balancer
                            listener.
                          properties:
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            targetGroup:
                              description: |-
                                TargetGroupSpec specifies target group settings for a given listener.
                                This is created first, and the ARN is then passed to the listener.
                              properties:
                                name:
                                  description: Name of the TargetGroup. Must be unique
                                    over the same group of listeners.
                                  maxLength: 32
                                  type: string
                                port:
                                  description: Port is the exposed port
                                  format: int64
                                  type: integer
                                protocol:
                                  description: ELBProtocol defines listener protocols
                                    for a load balancer.
                                  enum:
                                  - tcp
                                  - tls
                                  - udp
                                  - TCP
                                  - TLS
                                  - UDP
                                  type: string
                                targetGroupHealthCheck:
                                  description: HealthCheck is the elb health check
                                    associated with the load balancer.
                                  properties:
                                    intervalSeconds:
                                      format: int64
                                      type: integer
                                    path:
                                      type: string
                                    port:
                                      type: string
                                    protocol:
                                      type: string
                                    thresholdCount:
                                      format: int64
                                      type: integer
                                    timeoutSeconds:
                                      format: int64
                                      type: integer
                                    unhealthyThresholdCount:
                                      format: int64
                                      type: integer
                                  type: object
                                vpcId:
                                  type: string
                              required:
                              - name
                              - port
                              - protocol
                              - vpcId
                              type: object
                          required:
                          - port
                          - protocol
                          - targetGroup
                          type: object
                        type: array
                      healthChecks:
                        description: HealthCheck is the classic elb health check associated
                          with the load balancer.
                        properties:
                          healthyThreshold:
                            format: int64
                            type: integer
                          interval:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          target:
                            type: string
                          timeout:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          unhealthyThreshold:
                            format: int64
                            type: integer
                        required:
                        - healthyThreshold
                        - interval
                        - target
                        - timeout
                        - unhealthyThreshold
                        type: object
                      listeners:
                        description: ClassicELBListeners is an array of classic elb
                          listeners associated with the load balancer. There must
                          be at least one.
                        items:
                          description: ClassicELBListener defines an AWS classic load
                            balancer listener.
                          properties:
                            instancePort:
                              format: int64
                              type: integer
                            instanceProtocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                          required:
                          - instancePort
                          - instanceProtocol
                          - port
                          - protocol
                          type: object
                        type: array
                      loadBalancerType:
                        description: LoadBalancerType sets the type for a load balancer.
                          The default type is classic.
                        enum:
                        - classic
                        - elb
                        - alb
                        - nlb
                        type: string
                      name:
                        description: |-
                          The name of the load balancer. It must be unique within the set of load balancers
                          defined in the region. It also serves as identifier.
                        type: string
                      scheme:
                        description: Scheme is the load balancer scheme, either internet-facing
                          or private.
                        type: string
                      securityGroupIds:
                        description: SecurityGroupIDs is an array of security groups
                          assigned to the load balancer.
                        items:
                          type: string
                        type: array
                      subnetIds:
                        description: SubnetIDs is an array of subnets in the VPC attached
                          to the load balancer.
                        items:
                          type: string
                        type: array
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a map of tags associated with the load
                          balancer.
                        type: object
                    type: object
                  natGatewaysIPs:
                    description: NatGatewaysIPs contains the public IPs of the NAT
                      Gateways
                    items:
                      type: string
                    type: array
                  secondaryAPIServerELB:
                    description: SecondaryAPIServerELB is the secondary Kubernetes
                      api server load balancer.
                    properties:
                      arn:
                        description: |-
                          ARN of the load balancer. Unlike the ClassicLB, ARN is used mostly
                          to define and get it.
                        type: string
                      attributes:
                        description: ClassicElbAttributes defines extra attributes
                          associated with the load balancer.
                        properties:
                          crossZoneLoadBalancing:
                            description: CrossZoneLoadBalancing enables the classic
                              load balancer load balancing.
                            type: boolean
                          idleTimeout:
                            description: |-
                              IdleTimeout is time that the connection is allowed to be idle (no data
                              has been sent over the connection) before it is closed by the load balancer.
                            format: int64
                            type: integer
                        type: object
                      availabilityZones:
                        description: AvailabilityZones is an array of availability
                          zones in the VPC attached to the load balancer.
                        items:
                          type: string
                        type: array
                      dnsName:
                        description: DNSName is the dns name of the load balancer.
                        type: string
                      elbAttributes:
                        additionalProperties:
                          type: string
                        description: ELBAttributes defines extra attributes associated
                          with v2 load balancers.
                        type: object
                      elbListeners:
                        description: ELBListeners is an array of listeners associated
                          with the load balancer. There must be at least one.
                        items:
                          description: Listener defines an AWS network load balancer
                            listener.
                          properties:
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            targetGroup:
                              description: |-
                                TargetGroupSpec specifies target group settings for a given listener.
                                This is created first, and the ARN is then passed to the listener.
                              properties:
                                name:
                                  description: Name of the TargetGroup. Must be unique
                                    over the same group of listeners.
                                  maxLength: 32
                                  type: string
                                port:
                                  description: Port is the exposed port
                                  format: int64
                                  type: integer
                                protocol:
                                  description: ELBProtocol defines listener protocols
                                    for a load balancer.
                                  enum:
                                  - tcp
                                  - tls
                                  - udp
                                  - TCP
                                  - TLS
                                  - UDP
                                  type: string
                                targetGroupHealthCheck:
                                  description: HealthCheck is the elb health check
                                    associated with the load balancer.
                                  properties:
                                    intervalSeconds:
                                      format: int64
                                      type: integer
                                    path:
                                      type: string
                                    port:
                                      type: string
                                    protocol:
                                      type: string
                                    thresholdCount:
                                      format: int64
                                      type: integer
                                    timeoutSeconds:
                                      format: int64
                                      type: integer
                                    unhealthyThresholdCount:
                                      format: int64
                                      type: integer
                                  type: object
                                vpcId:
                                  type: string
                              required:
                              - name
                              - port
                              - protocol
                              - vpcId
                              type: object
                          required:
                          - port
                          - protocol
                          - targetGroup
                          type: object
                        type: array
                      healthChecks:
                        description: HealthCheck is the classic elb health check associated
                          with the load balancer.
                        properties:
                          healthyThreshold:
                            format: int64
                            type: integer
                          interval:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          target:
                            type: string
                          timeout:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          unhealthyThreshold:
                            format: int64
                            type: integer
                        required:
                        - healthyThreshold
                        - interval
                        - target
                        - timeout
                        - unhealthyThreshold
                        type: object
                      listeners:
                        description: ClassicELBListeners is an array of classic elb
                          listeners associated with the load balancer. There must
                          be at least one.
                        items:
                          description: ClassicELBListener defines an AWS classic load
                            balancer listener.
                          properties:
                            instancePort:
                              format: int64
                              type: integer
                            instanceProtocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                          required:
                          - instancePort
                          - instanceProtocol
                          - port
                          - protocol
                          type: object
                        type: array
                      loadBalancerType:
                        description: LoadBalancerType sets the type for a load balancer.
                          The default type is classic.
                        enum:
                        - classic
                        - elb
                        - alb
                        - nlb
                        type: string
                      name:
                        description: |-
                          The name of the load balancer. It must be unique within the set of load balancers
                          defined in the region. It also serves as identifier.
                        type: string
                      scheme:
                        description: Scheme is the load balancer scheme, either internet-facing
                          or private.
                        type: string
                      securityGroupIds:
                        description: SecurityGroupIDs is an array of security groups
                          assigned to the load balancer.
                        items:
                          type: string
                        type: array
                      subnetIds:
                        description: SubnetIDs is an array of subnets in the VPC attached
                          to the load balancer.
                        items:
                          type: string
                        type: array
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a map of tags associated with the load
                          balancer.
                        type: object
                    type: object
                  securityGroups:
                    additionalProperties:
                      description: SecurityGroup defines an AWS security group.
                      properties:
                        id:
                          description: ID is a unique identifier.
                          type: string
                        ingressRule:
                          description: IngressRules is the inbound rules associated
                            with the security group.
                          items:
                            description: IngressRule defines an AWS ingress rule for
                              security groups.
                            properties:
                              cidrBlocks:
                                description: List of CIDR blocks to allow access from.
                                  Cannot be specified with SourceSecurityGroupID.
                                items:
                                  type: string
                                type: array
                              description:
                                description: Description provides extended information
                                  about the ingress rule.
                                type: string
                              fromPort:
                                description: FromPort is the start of port range.
                                format: int64
                                type: integer
                              ipv6CidrBlocks:
                                description: List of IPv6 CIDR blocks to allow access
                                  from. Cannot be specified with SourceSecurityGroupID.
                                items:
                                  type: string
                                type: array
                              natGatewaysIPsSource:
                                description: NatGatewaysIPsSource use the NAT gateways
                                  IPs as the source for the ingress rule.
                                type: boolean
                              protocol:
                                description: Protocol is the protocol for the ingress
                                  rule. Accepted values are "-1" (all), "4" (IP in
                                  IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
                                  (ESP).
                                enum:
                                - "-1"
                                - "4"
                                - tcp
                                - udp
                                - icmp
                                - "58"
                                - "50"
                                type: string
                              sourceSecurityGroupIds:
                                description: The security group id to allow access
                                  from. Cannot be specified with CidrBlocks.
                                items:
                                  type: string
                                type: array
                              sourceSecurityGroupRoles:
                                description: |-
                                  The security group role to allow access from. Cannot be specified with CidrBlocks.
                                  The field will be combined with source security group IDs if specified.
                                items:
                                  description: SecurityGroupRole defines the unique
                                    role of a security group.
                                  enum:
                                  - bastion
                                  - node
                                  - controlplane
                                  - apiserver-lb
                                  - lb
                                  - node-eks-additional
                                  type: string
                                type: array
                              toPort:
                                description: ToPort is the end of port range.
                                format: int64
                                type: integer
                            required:
                            - description
                            - fromPort
                            - protocol
                            - toPort
                            type: object
                          type: array
                        name:
                          description: Name is the security group name.
                          type: string
                        tags:
                          additionalProperties:
                            type: string
                          description: Tags is a map of tags associated with the security
                            group.
                          type: object
                      required:
                      - id
                      - name
                      type: object
                    description: SecurityGroups is a map from the role/kind of the
                      security group to its unique name, if any.
                    type: object
                type: object
              ready:
                default: false
                type: boolean
            required:
            - ready
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsfargateprofiles.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSFargateProfile
    listKind: AWSFargateProfileList
    plural: awsfargateprofiles
    shortNames:
    - awsfp
    singular: awsfargateprofile
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: AWSFargateProfile ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: EKS Fargate profile name
      jsonPath: .spec.profileName
      name: ProfileName
      type: string
    - description: Failure reason
      jsonPath: .status.failureReason
      name: FailureReason
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: AWSFargateProfile is the Schema for the awsfargateprofiles API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: FargateProfileSpec defines the desired state of FargateProfile.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                  ones added by default.
                type: object
              clusterName:
                description: ClusterName is the name of the Cluster this object belongs
                  to.
                minLength: 1
                type: string
              profileName:
                description: ProfileName specifies the profile name.
                type: string
              roleName:
                description: |-
                  RoleName specifies the name of IAM role for this fargate pool
                  If the role is pre-existing we will treat it as unmanaged
                  and not delete it on deletion. If the EKSEnableIAM feature
                  flag is true and no name is supplied then a role is created.
                type: string
              selectors:
                description: Selectors specify fargate pod selectors.
                items:
                  description: FargateSelector specifies a selector for pods that
                    should run on this fargate pool.
                  properties:
                    labels:
                      additionalProperties:
                        type: string
                      description: Labels specifies which pod labels this selector
                        should match.
                      type: object
                    namespace:
                      description: Namespace specifies which namespace this selector
                        should match.
                      type: string
                  type: object
                type: array
              subnetIDs:
                description: |-
                  SubnetIDs specifies which subnets are used for the
                  auto scaling group of this nodegroup.
                items:
                  type: string
                type: array
            required:
            - clusterName
            type: object
          status:
            description: FargateProfileStatus defines the observed state of FargateProfile.
            properties:
              conditions:
                description: Conditions defines current state of the Fargate profile.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the FargateProfile and will contain a more verbose string suitable
                  for logging and human consumption.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the FargateProfile's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of
                  FargateProfiles can be added as events to the FargateProfile
                  object and/or logged in the controller's output.
                type: string
              failureReason:
                description: |-
                  FailureReason will be set in the event that there is a terminal problem
                  reconciling the FargateProfile and will contain a succinct value suitable
                  for machine interpretation.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the FargateProfile's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of
                  FargateProfiles can be added as events to the FargateProfile object
                  and/or logged in the controller's output.
                type: string
              ready:
                default: false
                description: Ready denotes that the FargateProfile is available.
                type: boolean
            required:
            - ready
            type: object
        type: object
    served: false
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - description: AWSFargateProfile ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: EKS Fargate profile name
      jsonPath: .spec.profileName
      name: ProfileName
      type: string
    - description: Failure reason
      jsonPath: .status.failureReason
      name: FailureReason
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSFargateProfile is the Schema for the awsfargateprofiles API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: FargateProfileSpec defines the desired state of FargateProfile.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                  ones added by default.
                type: object
              clusterName:
                description: ClusterName is the name of the Cluster this object belongs
                  to.
                minLength: 1
                type: string
              profileName:
                description: ProfileName specifies the profile name.
                type: string
              roleName:
                description: |-
                  RoleName specifies the name of IAM role for this fargate pool
                  If the role is pre-existing we will treat it as unmanaged
                  and not delete it on deletion. If the EKSEnableIAM feature
                  flag is true and no name is supplied then a role is created.
                type: string
              selectors:
                description: Selectors specify fargate pod selectors.
                items:
                  description: FargateSelector specifies a selector for pods that
                    should run on this fargate pool.
                  properties:
                    labels:
                      additionalProperties:
                        type: string
                      description: Labels specifies which pod labels this selector
                        should match.
                      type: object
                    namespace:
                      description: Namespace specifies which namespace this selector
                        should match.
                      type: string
                  type: object
                type: array
              subnetIDs:
                description: |-
                  SubnetIDs specifies which subnets are used for the
                  auto scaling group of this nodegroup.
                items:
                  type: string
                type: array
            required:
            - clusterName
            type: object
          status:
            description: FargateProfileStatus defines the observed state of FargateProfile.
            properties:
              conditions:
                description: Conditions defines current state of the Fargate profile.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the FargateProfile and will contain a more verbose string suitable
                  for logging and human consumption.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the FargateProfile's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of
                  FargateProfiles can be added as events to the FargateProfile
                  object and/or logged in the controller's output.
                type: string
              failureReason:
                description: |-
                  FailureReason will be set in the event that there is a terminal problem
                  reconciling the FargateProfile and will contain a succinct value suitable
                  for machine interpretation.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the FargateProfile's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of
                  FargateProfiles can be added as events to the FargateProfile object
                  and/or logged in the controller's output.
                type: string
              ready:
                default: false
                description: Ready denotes that the FargateProfile is available.
                type: boolean
            required:
            - ready
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsmachinetemplates.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSMachineTemplate
    listKind: AWSMachineTemplateList
    plural: awsmachinetemplates
    shortNames:
    - awsmt
    singular: awsmachinetemplate
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: AWSMachineTemplate is the schema for the Amazon EC2 Machine Templates
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSMachineTemplateSpec defines the desired state of AWSMachineTemplate.
            properties:
              template:
                description: AWSMachineTemplateResource describes the data needed
                  to create am AWSMachine from a template.
                properties:
                  metadata:
                    description: |-
                      Standard object's metadata.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        description: |-
                          Annotations is an unstructured key value map stored with a resource that may be
                          set by external tools to store and retrieve arbitrary metadata. They are not
                          queryable and should be preserved when modifying objects.
                          More info: http://kubernetes.io/docs/user-guide/annotations
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        description: |-
                          Map of string keys and values that can be used to organize and categorize
                          (scope and select) objects. May match selectors of replication controllers
                          and services.
                          More info: http://kubernetes.io/docs/user-guide/labels
                        type: object
                    type: object
                  spec:
                    description: Spec is the specification of the desired behavior
                      of the machine.
                    properties:
                      additionalSecurityGroups:
                        description: |-
                          AdditionalSecurityGroups is an array of references to security groups that should be applied to the
                          instance. These security groups would be set in addition to any security groups defined
                          at the cluster level or in the actuator. It is possible to specify either IDs of Filters. Using Filters
                          will cause additional requests to AWS API and if tags change the attached security groups might change too.
                        items:
                          description: |-
                            AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                            Only one of ID or Filters may be specified. Specifying more than one will result in
                            a validation error.
                          properties:
                            arn:
                              description: |-
                                ARN of resource.
                                Deprecated: This field has no function and is going to be removed in the next release.
                              type: string
                            filters:
                              description: |-
                                Filters is a set of key/value pairs used to identify a resource
                                They are applied according to the rules defined by the AWS API:
                                https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                              items:
                                description: Filter is a filter used to identify an
                                  AWS resource.
                                properties:
                                  name:
                                    description: Name of the filter. Filter names
                                      are case-sensitive.
                                    type: string
                                  values:
                                    description: Values includes one or more filter
                                      values. Filter values are case-sensitive.
                                    items:
                                      type: string
                                    type: array
                                required:
                                - name
                                - values
                                type: object
                              type: array
                            id:
                              description: ID of resource
                              type: string
                          type: object
                        type: array
                      additionalTags:
                        additionalProperties:
                          type: string
                        description: |-
                          AdditionalTags is an optional set of tags to add to an instance, in addition to the ones added by default by the
                          AWS provider. If both the AWSCluster and the AWSMachine specify the same tag name with different values, the
                          AWSMachine's value takes precedence.
                        type: object
                      ami:
                        description: AMI is the reference to the AMI from which to
                          create the machine instance.
                        properties:
                          eksLookupType:
                            description: EKSOptimizedLookupType If specified, will
                              look up an EKS Optimized image in SSM Parameter store
                            enum:
                            - AmazonLinux
                            - AmazonLinuxGPU
                            type: string
                          id:
                            description: ID of resource
                            type: string
                        type: object
                      cloudInit:
                        description: |-
                          CloudInit defines options related to the bootstrapping systems where
                          CloudInit is used.
                        properties:
                          insecureSkipSecretsManager:
                            description: |-
                              InsecureSkipSecretsManager, when set to true will not use AWS Secrets Manager
                              or AWS Systems Manager Parameter Store to ensure privacy of userdata.
                              By default, a cloud-init boothook shell script is prepended to download
                              the userdata from Secrets Manager and additionally delete the secret.
                            type: boolean
                          secretCount:
                            description: SecretCount is the number of secrets used
                              to form the complete secret
                            format: int32
                            type: integer
                          secretPrefix:
                            description: |-
                              SecretPrefix is the prefix for the secret name. This is stored
                              temporarily, and deleted when the machine registers as a node against
                              the workload cluster.
                            type: string
                          secureSecretsBackend:
                            description: |-
                              SecureSecretsBackend, when set to parameter-store will utilize the AWS Systems Manager
                              Parameter Storage to distribute secrets. By default or with the value of secrets-manager,
                              will use AWS Secrets Manager instead.
                            enum:
                            - secrets-manager
                            - ssm-parameter-store
                            type: string
                        type: object
                      failureDomain:
                        description: |-
                          FailureDomain is the failure domain unique identifier this Machine should be attached to, as defined in Cluster API.
                          For this infrastructure provider, the ID is equivalent to an AWS Availability Zone.
                          If multiple subnets are matched for the availability zone, the first one returned is picked.
                        type: string
                      iamInstanceProfile:
                        description: IAMInstanceProfile is a name of an IAM instance
                          profile to assign to the instance
                        type: string
                      ignition:
                        description: Ignition defined options related to the bootstrapping
                          systems where Ignition is used.
                        properties:
                          version:
                            default: "2.3"
                            description: Version defines which version of Ignition
                              will be used to generate bootstrap data.
                            enum:
                            - "2.3"
                            type: string
                        type: object
                      imageLookupBaseOS:
                        description: |-
                          ImageLookupBaseOS is the name of the base operating system to use for
                          image lookup the AMI is not set.
                        type: string
                      imageLookupFormat:
                        description: |-
                          ImageLookupFormat is the AMI naming format to look up the image for this
                          machine It will be ignored if an explicit AMI is set. Supports
                          substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and
                          kubernetes version, respectively. The BaseOS will be the value in
                          ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                          defined by the packages produced by kubernetes/release without v as a
                          prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                          image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                          searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                          Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                          also: https://golang.org/pkg/text/template/
                        type: string
                      imageLookupOrg:
                        description: ImageLookupOrg is the AWS Organization ID to
                          use for image lookup if AMI is not set.
                        type: string
                      instanceID:
                        description: InstanceID is the EC2 instance ID for this machine.
                        type: string
                      instanceType:
                        description: 'InstanceType is the type of instance to create.
                          Example: m4.xlarge'
                        minLength: 2
                        type: string
                      networkInterfaces:
                        description: |-
                          NetworkInterfaces is a list of ENIs to associate with the instance.
                          A maximum of 2 may be specified.
                        items:
                          type: string
                        maxItems: 2
                        type: array
                      nonRootVolumes:
                        description: Configuration options for the non root storage
                          volumes.
                        items:
                          description: Volume encapsulates the configuration options
                            for the storage device.
                          properties:
                            deviceName:
                              description: Device name
                              type: string
                            encrypted:
                              description: Encrypted is whether the volume should
                                be encrypted or not.
                              type: boolean
                            encryptionKey:
                              description: |-
                                EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                                If Encrypted is set and this is omitted, the default AWS key will be used.
                                The key must already exist and be accessible by the controller.
                              type: string
                            iops:
                              description: IOPS is the number of IOPS requested for
                                the disk. Not applicable to all types.
                              format: int64
                              type: integer
                            size:
                              description: |-
                                Size specifies size (in Gi) of the storage device.
                                Must be greater than the image snapshot size or 8 (whichever is greater).
                              format: int64
                              minimum: 8
                              type: integer
                            throughput:
                              description: Throughput to provision in MiB/s supported
                                for the volume type. Not applicable to all types.
                              format: int64
                              type: integer
                            type:
                              description: Type is the type of the volume (e.g. gp2,
                                io1, etc...).
                              type: string
                          required:
                          - size
                          type: object
                        type: array
                      providerID:
                        description: ProviderID is the unique identifier as specified
                          by the cloud provider.
                        type: string
                      publicIP:
                        description: |-
                          PublicIP specifies whether the instance should get a public IP.
                          Precedence for this setting is as follows:
                          1. This field if set
                          2. Cluster/flavor setting
                          3. Subnet default
                        type: boolean
                      rootVolume:
                        description: RootVolume encapsulates the configuration options
                          for the root volume
                        properties:
                          deviceName:
                            description: Device name
                            type: string
                          encrypted:
                            description: Encrypted is whether the volume should be
                              encrypted or not.
                            type: boolean
                          encryptionKey:
                            description: |-
                              EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                              If Encrypted is set and this is omitted, the default AWS key will be used.
                              The key must already exist and be accessible by the controller.
                            type: string
                          iops:
                            description: IOPS is the number of IOPS requested for
                              the disk. Not applicable to all types.
                            format: int64
                            type: integer
                          size:
                            description: |-
                              Size specifies size (in Gi) of the storage device.
                              Must be greater than the image snapshot size or 8 (whichever is greater).
                            format: int64
                            minimum: 8
                            type: integer
                          throughput:
                            description: Throughput to provision in MiB/s supported
                              for the volume type. Not applicable to all types.
                            format: int64
                            type: integer
                          type:
                            description: Type is the type of the volume (e.g. gp2,
                              io1, etc...).
                            type: string
                        required:
                        - size
                        type: object
                      spotMarketOptions:
                        description: SpotMarketOptions allows users to configure instances
                          to be run using AWS Spot instances.
                        properties:
                          maxPrice:
                            description: MaxPrice defines the maximum price the user
                              is willing to pay for Spot VM instances
                            type: string
                        type: object
                      sshKeyName:
                        description: SSHKeyName is the name of the ssh key to attach
                          to the instance. Valid values are empty string (do not use
                          SSH keys), a valid SSH key name, or omitted (use the default
                          SSH key name)
                        type: string
                      subnet:
                        description: |-
                          Subnet is a reference to the subnet to use for this instance. If not specified,
                          the cluster subnet will be used.
                        properties:
                          arn:
                            description: |-
                              ARN of resource.
                              Deprecated: This field has no function and is going to be removed in the next release.
                            type: string
                          filters:
                            description: |-
                              Filters is a set of key/value pairs used to identify a resource
                              They are applied according to the rules defined by the AWS API:
                              https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                            items:
                              description: Filter is a filter used to identify an
                                AWS resource.
                              properties:
                                name:
                                  description: Name of the filter. Filter names are
                                    case-sensitive.
                                  type: string
                                values:
                                  description: Values includes one or more filter
                                    values. Filter values are case-sensitive.
                                  items:
                                    type: string
                                  type: array
                              required:
                              - name
                              - values
                              type: object
                            type: array
                          id:
                            description: ID of resource
                            type: string
                        type: object
                      tenancy:
                        description: Tenancy indicates if instance should run on shared
                          or single-tenant hardware.
                        enum:
                        - default
                        - dedicated
                        - host
                        type: string
                      uncompressedUserData:
                        description: |-
                          UncompressedUserData specify whether the user data is gzip-compressed before it is sent to ec2 instance.
                          cloud-init has built-in support for gzip-compressed user data
                          user data stored in aws secret manager is always gzip-compressed.
                        type: boolean
                    required:
                    - instanceType
                    type: object
                required:
                - spec
                type: object
            required:
            - template
            type: object
          status:
            description: AWSMachineTemplateStatus defines a status for an AWSMachineTemplate.
            properties:
              capacity:
                additionalProperties:
                  anyOf:
                  - type: integer
                  - type: string
                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                  x-kubernetes-int-or-string: true
                description: |-
                  Capacity defines the resource capacity for this machine.
                  This value is used for autoscaling from zero operations as defined in:
                  https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/proposals/20210310-opt-in-autoscaling-from-zero.md
                type: object
            type: object
        type: object
    served: false
    storage: false
  - name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSMachineTemplate is the schema for the Amazon EC2 Machine Templates
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSMachineTemplateSpec defines the desired state of AWSMachineTemplate.
            properties:
              template:
                description: AWSMachineTemplateResource describes the data needed
                  to create am AWSMachine from a template.
                properties:
                  metadata:
                    description: |-
                      Standard object's metadata.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        description: |-
                          Annotations is an unstructured key value map stored with a resource that may be
                          set by external tools to store and retrieve arbitrary metadata. They are not
                          queryable and should be preserved when modifying objects.
                          More info: http://kubernetes.io/docs/user-guide/annotations
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        description: |-
                          Map of string keys and values that can be used to organize and categorize
                          (scope and select) objects. May match selectors of replication controllers
                          and services.
                          More info: http://kubernetes.io/docs/user-guide/labels
                        type: object
                    type: object
                  spec:
                    description: Spec is the specification of the desired behavior
                      of the machine.
                    properties:
                      additionalSecurityGroups:
                        description: |-
                          AdditionalSecurityGroups is an array of references to security groups that should be applied to the
                          instance. These security groups would be set in addition to any security groups defined
                          at the cluster level or in the actuator. It is possible to specify either IDs of Filters. Using Filters
                          will cause additional requests to AWS API and if tags change the attached security groups might change too.
                        items:
                          description: |-
                            AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                            Only one of ID or Filters may be specified. Specifying more than one will result in
                            a validation error.
                          properties:
                            filters:
                              description: |-
                                Filters is a set of key/value pairs used to identify a resource
                                They are applied according to the rules defined by the AWS API:
                                https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                              items:
                                description: Filter is a filter used to identify an
                                  AWS resource.
                                properties:
                                  name:
                                    description: Name of the filter. Filter names
                                      are case-sensitive.
                                    type: string
                                  values:
                                    description: Values includes one or more filter
                                      values. Filter values are case-sensitive.
                                    items:
                                      type: string
                                    type: array
                                required:
                                - name
                                - values
                                type: object
                              type: array
                            id:
                              description: ID of resource
                              type: string
                          type: object
                        type: array
                      additionalTags:
                        additionalProperties:
                          type: string
                        description: |-
                          AdditionalTags is an optional set of tags to add to an instance, in addition to the ones added by default by the
                          AWS provider. If both the AWSCluster and the AWSMachine specify the same tag name with different values, the
                          AWSMachine's value takes precedence.
                        type: object
                      ami:
                        description: AMI is the reference to the AMI from which to
                          create the machine instance.
                        properties:
                          eksLookupType:
                            description: EKSOptimizedLookupType If specified, will
                              look up an EKS Optimized image in SSM Parameter store
                            enum:
                            - AmazonLinux
                            - AmazonLinuxGPU
                            type: string
                          id:
                            description: ID of resource
                            type: string
                        type: object
                      capacityReservationId:
                        description: CapacityReservationID specifies the target Capacity
                          Reservation into which the instance should be launched.
                        type: string
                      cloudInit:
                        description: |-
                          CloudInit defines options related to the bootstrapping systems where
                          CloudInit is used.
                        properties:
                          insecureSkipSecretsManager:
                            description: |-
                              InsecureSkipSecretsManager, when set to true will not use AWS Secrets Manager
                              or AWS Systems Manager Parameter Store to ensure privacy of userdata.
                              By default, a cloud-init boothook shell script is prepended to download
                              the userdata from Secrets Manager and additionally delete the secret.
                            type: boolean
                          secretCount:
                            description: SecretCount is the number of secrets used
                              to form the complete secret
                            format: int32
                            type: integer
                          secretPrefix:
                            description: |-
                              SecretPrefix is the prefix for the secret name. This is stored
                              temporarily, and deleted when the machine registers as a node against
                              the workload cluster.
                            type: string
                          secureSecretsBackend:
                            description: |-
                              SecureSecretsBackend, when set to parameter-store will utilize the AWS Systems Manager
                              Parameter Storage to distribute secrets. By default or with the value of secrets-manager,
                              will use AWS Secrets Manager instead.
                            enum:
                            - secrets-manager
                            - ssm-parameter-store
                            type: string
                        type: object
                      elasticIpPool:
                        description: ElasticIPPool is the configuration to allocate
                          Public IPv4 address (Elastic IP/EIP) from user-defined pool.
                        properties:
                          publicIpv4Pool:
                            description: |-
                              PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources
                              created in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom
                              Public IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool
                              resource ID starts with 'ipv4pool-ec2'.
                            maxLength: 30
                            type: string
                          publicIpv4PoolFallbackOrder:
                            description: |-
                              PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,
                              no more IPv4 address available in the pool.


                              When set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the
                              IPv4 limit, the address will be claimed from Amazon-pool (default).


                              When set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.
                            enum:
                            - amazon-pool
                            - none
                            type: string
                            x-kubernetes-validations:
                            - message: allowed values are 'none' and 'amazon-pool'
                              rule: self in ['none','amazon-pool']
                        type: object
                      iamInstanceProfile:
                        description: IAMInstanceProfile is a name of an IAM instance
                          profile to assign to the instance
                        type: string
                      ignition:
                        description: Ignition defined options related to the bootstrapping
                          systems where Ignition is used.
                        properties:
                          proxy:
                            description: |-
                              Proxy defines proxy settings for Ignition.
                              Only valid for Ignition versions 3.1 and above.
                            properties:
                              httpProxy:
                                description: |-
                                  HTTPProxy is the HTTP proxy to use for Ignition.
                                  A single URL that specifies the proxy server to use for HTTP and HTTPS requests,
                                  unless overridden by the HTTPSProxy or NoProxy options.
                                type: string
                              httpsProxy:
                                description: |-
                                  HTTPSProxy is the HTTPS proxy to use for Ignition.
                                  A single URL that specifies the proxy server to use for HTTPS requests,
                                  unless overridden by the NoProxy option.
                                type: string
                              noProxy:
                                description: |-
                                  NoProxy is the list of domains to not proxy for Ignition.
                                  Specifies a list of strings to hosts that should be excluded from proxying.


                                  Each value is represented by:
                                  - An IP address prefix (1.2.3.4)
                                  - An IP address prefix in CIDR notation (1.2.3.4/8)
                                  - A domain name
                                    - A domain name matches that name and all subdomains
                                    - A domain name with a leading . matches subdomains only
                                  - A special DNS label (*), indicates that no proxying should be done


                                  An IP address prefix and domain name can also include a literal port number (1.2.3.4:80).
                                items:
                                  description: IgnitionNoProxy defines the list of
                                    domains to not proxy for Ignition.
                                  maxLength: 2048
                                  type: string
                                maxItems: 64
                                type: array
                            type: object
                          storageType:
                            default: ClusterObjectStore
                            description: |-
                              StorageType defines how to store the boostrap user data for Ignition.
                              This can be used to instruct Ignition from where to fetch the user data to bootstrap an instance.


                              When omitted, the storage option will default to ClusterObjectStore.


                              When set to "ClusterObjectStore", if the capability is available and a Cluster ObjectStore configuration
                              is correctly provided in the Cluster object (under .spec.s3Bucket),
                              an object store will be used to store bootstrap user data.


                              When set to "UnencryptedUserData", EC2 Instance User Data will be used to store the machine bootstrap user data, unencrypted.
                              This option is considered less secure than others as user data may contain sensitive informations (keys, certificates, etc.)
                              and users with ec2:DescribeInstances permission or users running pods
                              that can access the ec2 metadata service have access to this sensitive information.
                              So this is only to be used at ones own risk, and only when other more secure options are not viable.
                            enum:
                            - ClusterObjectStore
                            - UnencryptedUserData
                            type: string
                          tls:
                            description: |-
                              TLS defines TLS settings for Ignition.
                              Only valid for Ignition versions 3.1 and above.
                            properties:
                              certificateAuthorities:
                                description: |-
                                  CASources defines the list of certificate authorities to use for Ignition.
                                  The value is the certificate bundle (in PEM format). The bundle can contain multiple concatenated certificates.
                                  Supported schemes are http, https, tftp, s3, arn, gs, and `data` (RFC 2397) URL scheme.
                                items:
                                  description: IgnitionCASource defines the source
                                    of the certificate authority to use for Ignition.
                                  maxLength: 65536
                                  type: string
                                maxItems: 64
                                type: array
                            type: object
                          version:
                            default: "2.3"
                            description: Version defines which version of Ignition
                              will be used to generate bootstrap data.
                            enum:
                            - "2.3"
                            - "3.0"
                            - "3.1"
                            - "3.2"
                            - "3.3"
                            - "3.4"
                            type: string
                        type: object
                      imageLookupBaseOS:
                        description: |-
                          ImageLookupBaseOS is the name of the base operating system to use for
                          image lookup the AMI is not set.
                        type: string
                      imageLookupFormat:
                        description: |-
                          ImageLookupFormat is the AMI naming format to look up the image for this
                          machine It will be ignored if an explicit AMI is set. Supports
                          substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and
                          kubernetes version, respectively. The BaseOS will be the value in
                          ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                          defined by the packages produced by kubernetes/release without v as a
                          prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                          image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                          searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                          Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                          also: https://golang.org/pkg/text/template/
                        type: string
                      imageLookupOrg:
                        description: ImageLookupOrg is the AWS Organization ID to
                          use for image lookup if AMI is not set.
                        type: string
                      instanceID:
                        description: InstanceID is the EC2 instance ID for this machine.
                        type: string
                      instanceMetadataOptions:
                        description: InstanceMetadataOptions is the metadata options
                          for the EC2 instance.
                        properties:
                          httpEndpoint:
                            default: enabled
                            description: |-
                              Enables or disables the HTTP metadata endpoint on your instances.


                              If you specify a value of disabled, you cannot access your instance metadata.


                              Default: enabled
                            enum:
                            - enabled
                            - disabled
                            type: string
                          httpPutResponseHopLimit:
                            default: 1
                            description: |-
                              The desired HTTP PUT response hop limit for instance metadata requests. The
                              larger the number, the further instance metadata requests can travel.


                              Default: 1
                            format: int64
                            maximum: 64
                            minimum: 1
                            type: integer
                          httpTokens:
                            default: optional
                            description: |-
                              The state of token usage for your instance metadata requests.


                              If the state is optional, you can choose to retrieve instance metadata with
                              or without a session token on your request. If you retrieve the IAM role
                              credentials without a token, the version 1.0 role credentials are returned.
                              If you retrieve the IAM role credentials using a valid session token, the
                              version 2.0 role credentials are returned.


                              If the state is required, you must send a session token with any instance
                              metadata retrieval requests. In this state, retrieving the IAM role credentials
                              always returns the version 2.0 credentials; the version 1.0 credentials are
                              not available.


                              Default: optional
                            enum:
                            - optional
                            - required
                            type: string
                          instanceMetadataTags:
                            default: disabled
                            description: |-
                              Set to enabled to allow access to instance tags from the instance metadata.
                              Set to disabled to turn off access to instance tags from the instance metadata.
                              For more information, see Work with instance tags using the instance metadata
                              (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS).


                              Default: disabled
                            enum:
                            - enabled
                            - disabled
                            type: string
                        type: object
                      instanceType:
                        description: 'InstanceType is the type of instance to create.
                          Example: m4.xlarge'
                        minLength: 2
                        type: string
                      networkInterfaces:
                        description: |-
                          NetworkInterfaces is a list of ENIs to associate with the instance.
                          A maximum of 2 may be specified.
                        items:
                          type: string
                        maxItems: 2
                        type: array
                      nonRootVolumes:
                        description: Configuration options for the non root storage
                          volumes.
                        items:
                          description: Volume encapsulates the configuration options
                            for the storage device.
                          properties:
                            deviceName:
                              description: Device name
                              type: string
                            encrypted:
                              description: Encrypted is whether the volume should
                                be encrypted or not.
                              type: boolean
                            encryptionKey:
                              description: |-
                                EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                                If Encrypted is set and this is omitted, the default AWS key will be used.
                                The key must already exist and be accessible by the controller.
                              type: string
                            iops:
                              description: IOPS is the number of IOPS requested for
                                the disk. Not applicable to all types.
                              format: int64
                              type: integer
                            size:
                              description: |-
                                Size specifies size (in Gi) of the storage device.
                                Must be greater than the image snapshot size or 8 (whichever is greater).
                              format: int64
                              minimum: 8
                              type: integer
                            throughput:
                              description: Throughput to provision in MiB/s supported
                                for the volume type. Not applicable to all types.
                              format: int64
                              type: integer
                            type:
                              description: Type is the type of the volume (e.g. gp2,
                                io1, etc...).
                              type: string
                          required:
                          - size
                          type: object
                        type: array
                      placementGroupName:
                        description: PlacementGroupName specifies the name of the
                          placement group in which to launch the instance.
                        type: string
                      placementGroupPartition:
                        description: |-
                          PlacementGroupPartition is the partition number within the placement group in which to launch the instance.
                          This value is only valid if the placement group, referred in `PlacementGroupName`, was created with
                          strategy set to partition.
                        format: int64
                        maximum: 7
                        minimum: 1
                        type: integer
                      privateDnsName:
                        description: PrivateDNSName is the options for the instance
                          hostname.
                        properties:
                          enableResourceNameDnsAAAARecord:
                            description: EnableResourceNameDNSAAAARecord indicates
                              whether to respond to DNS queries for instance hostnames
                              with DNS AAAA records.
                            type: boolean
                          enableResourceNameDnsARecord:
                            description: EnableResourceNameDNSARecord indicates whether
                              to respond to DNS queries for instance hostnames with
                              DNS A records.
                            type: boolean
                          hostnameType:
                            description: The type of hostname to assign to an instance.
                            enum:
                            - ip-name
                            - resource-name
                            type: string
                        type: object
                      providerID:
                        description: ProviderID is the unique identifier as specified
                          by the cloud provider.
                        type: string
                      publicIP:
                        description: |-
                          PublicIP specifies whether the instance should get a public IP.
                          Precedence for this setting is as follows:
                          1. This field if set
                          2. Cluster/flavor setting
                          3. Subnet default
                        type: boolean
                      rootVolume:
                        description: RootVolume encapsulates the configuration options
                          for the root volume
                        properties:
                          deviceName:
                            description: Device name
                            type: string
                          encrypted:
                            description: Encrypted is whether the volume should be
                              encrypted or not.
                            type: boolean
                          encryptionKey:
                            description: |-
                              EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                              If Encrypted is set and this is omitted, the default AWS key will be used.
                              The key must already exist and be accessible by the controller.
                            type: string
                          iops:
                            description: IOPS is the number of IOPS requested for
                              the disk. Not applicable to all types.
                            format: int64
                            type: integer
                          size:
                            description: |-
                              Size specifies size (in Gi) of the storage device.
                              Must be greater than the image snapshot size or 8 (whichever is greater).
                            format: int64
                            minimum: 8
                            type: integer
                          throughput:
                            description: Throughput to provision in MiB/s supported
                              for the volume type. Not applicable to all types.
                            format: int64
                            type: integer
                          type:
                            description: Type is the type of the volume (e.g. gp2,
                              io1, etc...).
                            type: string
                        required:
                        - size
                        type: object
                      securityGroupOverrides:
                        additionalProperties:
                          type: string
                        description: |-
                          SecurityGroupOverrides is an optional set of security groups to use for the node.
                          This is optional - if not provided security groups from the cluster will be used.
                        type: object
                      spotMarketOptions:
                        description: SpotMarketOptions allows users to configure instances
                          to be run using AWS Spot instances.
                        properties:
                          maxPrice:
                            description: MaxPrice defines the maximum price the user
                              is willing to pay for Spot VM instances
                            type: string
                        type: object
                      sshKeyName:
                        description: SSHKeyName is the name of the ssh key to attach
                          to the instance. Valid values are empty string (do not use
                          SSH keys), a valid SSH key name, or omitted (use the default
                          SSH key name)
                        type: string
                      subnet:
                        description: |-
                          Subnet is a reference to the subnet to use for this instance. If not specified,
                          the cluster subnet will be used.
                        properties:
                          filters:
                            description: |-
                              Filters is a set of key/value pairs used to identify a resource
                              They are applied according to the rules defined by the AWS API:
                              https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                            items:
                              description: Filter is a filter used to identify an
                                AWS resource.
                              properties:
                                name:
                                  description: Name of the filter. Filter names are
                                    case-sensitive.
                                  type: string
                                values:
                                  description: Values includes one or more filter
                                    values. Filter values are case-sensitive.
                                  items:
                                    type: string
                                  type: array
                              required:
                              - name
                              - values
                              type: object
                            type: array
                          id:
                            description: ID of resource
                            type: string
                        type: object
                      tenancy:
                        description: Tenancy indicates if instance should run on shared
                          or single-tenant hardware.
                        enum:
                        - default
                        - dedicated
                        - host
                        type: string
                      uncompressedUserData:
                        description: |-
                          UncompressedUserData specify whether the user data is gzip-compressed before it is sent to ec2 instance.
                          cloud-init has built-in support for gzip-compressed user data
                          user data stored in aws secret manager is always gzip-compressed.
                        type: boolean
                    required:
                    - instanceType
                    type: object
                required:
                - spec
                type: object
            required:
            - template
            type: object
          status:
            description: AWSMachineTemplateStatus defines a status for an AWSMachineTemplate.
            properties:
              capacity:
                additionalProperties:
                  anyOf:
                  - type: integer
                  - type: string
                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                  x-kubernetes-int-or-string: true
                description: |-
                  Capacity defines the resource capacity for this machine.
                  This value is used for autoscaling from zero operations as defined in:
                  https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/proposals/20210310-opt-in-autoscaling-from-zero.md
                type: object
            type: object
        type: object
    served: true
    storage: true
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsmachinepools.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSMachinePool
    listKind: AWSMachinePoolList
    plural: awsmachinepools
    shortNames:
    - awsmp
    singular: awsmachinepool
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Machine ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: Machine ready status
      jsonPath: .status.replicas
      name: Replicas
      type: integer
    - description: Minimum instanes in ASG
      jsonPath: .spec.minSize
      name: MinSize
      type: integer
    - description: Maximum instanes in ASG
      jsonPath: .spec.maxSize
      name: MaxSize
      type: integer
    - description: Launch Template ID
      jsonPath: .status.launchTemplateID
      name: LaunchTemplate ID
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: AWSMachinePool is the Schema for the awsmachinepools API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSMachinePoolSpec defines the desired state of AWSMachinePool.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to an instance, in addition to the ones added by default by the
                  AWS provider.
                type: object
              availabilityZones:
                description: AvailabilityZones is an array of availability zones instances
                  can run in
                items:
                  type: string
                type: array
              awsLaunchTemplate:
                description: AWSLaunchTemplate specifies the launch template and version
                  to use when an instance is launched.
                properties:
                  additionalSecurityGroups:
                    description: |-
                      AdditionalSecurityGroups is an array of references to security groups that should be applied to the
                      instances. These security groups would be set in addition to any security groups defined
                      at the cluster level or in the actuator.
                    items:
                      description: |-
                        AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                        Only one of ID or Filters may be specified. Specifying more than one will result in
                        a validation error.
                      properties:
                        filters:
                          description: |-
                            Filters is a set of key/value pairs used to identify a resource
                            They are applied according to the rules defined by the AWS API:
                            https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                          items:
                            description: Filter is a filter used to identify an AWS
                              resource.
                            properties:
                              name:
                                description: Name of the filter. Filter names are
                                  case-sensitive.
                                type: string
                              values:
                                description: Values includes one or more filter values.
                                  Filter values are case-sensitive.
                                items:
                                  type: string
                                type: array
                            required:
                            - name
                            - values
                            type: object
                          type: array
                        id:
                          description: ID of resource
                          type: string
                      type: object
                    type: array
                  ami:
                    description: AMI is the reference to the AMI from which to create
                      the machine instance.
                    properties:
                      eksLookupType:
                        description: EKSOptimizedLookupType If specified, will look
                          up an EKS Optimized image in SSM Parameter store
                        enum:
                        - AmazonLinux
                        - AmazonLinuxGPU
                        type: string
                      id:
                        description: ID of resource
                        type: string
                    type: object
                  iamInstanceProfile:
                    description: |-
                      The name or the Amazon Resource Name (ARN) of the instance profile associated
                      with the IAM role for the instance. The instance profile contains the IAM
                      role.
                    type: string
                  imageLookupBaseOS:
                    description: |-
                      ImageLookupBaseOS is the name of the base operating system to use for
                      image lookup the AMI is not set.
                    type: string
                  imageLookupFormat:
                    description: |-
                      ImageLookupFormat is the AMI naming format to look up the image for this
                      machine It will be ignored if an explicit AMI is set. Supports
                      substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and
                      kubernetes version, respectively. The BaseOS will be the value in
                      ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                      defined by the packages produced by kubernetes/release without v as a
                      prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                      image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                      searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                      Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                      also: https://golang.org/pkg/text/template/
                    type: string
                  imageLookupOrg:
                    description: ImageLookupOrg is the AWS Organization ID to use
                      for image lookup if AMI is not set.
                    type: string
                  instanceType:
                    description: 'InstanceType is the type of instance to create.
                      Example: m4.xlarge'
                    type: string
                  name:
                    description: The name of the launch template.
                    type: string
                  rootVolume:
                    description: RootVolume encapsulates the configuration options
                      for the root volume
                    properties:
                      deviceName:
                        description: Device name
                        type: string
                      encrypted:
                        description: Encrypted is whether the volume should be encrypted
                          or not.
                        type: boolean
                      encryptionKey:
                        description: |-
                          EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                          If Encrypted is set and this is omitted, the default AWS key will be used.
                          The key must already exist and be accessible by the controller.
                        type: string
                      iops:
                        description: IOPS is the number of IOPS requested for the
                          disk. Not applicable to all types.
                        format: int64
                        type: integer
                      size:
                        description: |-
                          Size specifies size (in Gi) of the storage device.
                          Must be greater than the image snapshot size or 8 (whichever is greater).
                        format: int64
                        minimum: 8
                        type: integer
                      throughput:
                        description: Throughput to provision in MiB/s supported for
                          the volume type. Not applicable to all types.
                        format: int64
                        type: integer
                      type:
                        description: Type is the type of the volume (e.g. gp2, io1,
                          etc...).
                        type: string
                    required:
                    - size
                    type: object
                  spotMarketOptions:
                    description: SpotMarketOptions are options for configuring AWSMachinePool
                      instances to be run using AWS Spot instances.
                    properties:
                      maxPrice:
                        description: MaxPrice defines the maximum price the user is
                          willing to pay for Spot VM instances
                        type: string
                    type: object
                  sshKeyName:
                    description: |-
                      SSHKeyName is the name of the ssh key to attach to the instance. Valid values are empty string
                      (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)
                    type: string
                  versionNumber:
                    description: |-
                      VersionNumber is the version of the launch template that is applied.
                      Typically a new version is created when at least one of the following happens:
                      1) A new launch template spec is applied.
                      2) One or more parameters in an existing template is changed.
                      3) A new AMI is discovered.
                    format: int64
                    type: integer
                type: object
              capacityRebalance:
                description: Enable or disable the capacity rebalance autoscaling
                  group feature
                type: boolean
              defaultCoolDown:
                description: |-
                  The amount of time, in seconds, after a scaling activity completes before another scaling activity can start.
                  If no value is supplied by user a default value of 300 seconds is set
                type: string
              maxSize:
                default: 1
                description: MaxSize defines the maximum size of the group.
                format: int32
                minimum: 1
                type: integer
              minSize:
                default: 1
                description: MinSize defines the minimum size of the group.
                format: int32
                minimum: 0
                type: integer
              mixedInstancesPolicy:
                description: MixedInstancesPolicy describes how multiple instance
                  types will be used by the ASG.
                properties:
                  instancesDistribution:
                    description: InstancesDistribution to configure distribution of
                      On-Demand Instances and Spot Instances.
                    properties:
                      onDemandAllocationStrategy:
                        default: prioritized
                        description: OnDemandAllocationStrategy indicates how to allocate
                          instance types to fulfill On-Demand capacity.
                        enum:
                        - prioritized
                        type: string
                      onDemandBaseCapacity:
                        default: 0
                        format: int64
                        type: integer
                      onDemandPercentageAboveBaseCapacity:
                        default: 100
                        format: int64
                        type: integer
                      spotAllocationStrategy:
                        default: lowest-price
                        description: SpotAllocationStrategy indicates how to allocate
                          instances across Spot Instance pools.
                        enum:
                        - lowest-price
                        - capacity-optimized
                        type: string
                    type: object
                  overrides:
                    items:
                      description: |-
                        Overrides are used to override the instance type specified by the launch template with multiple
                        instance types that can be used to launch On-Demand Instances and Spot Instances.
                      properties:
                        instanceType:
                          type: string
                      required:
                      - instanceType
                      type: object
                    type: array
                type: object
              providerID:
                description: ProviderID is the ARN of the associated ASG
                type: string
              providerIDList:
                description: |-
                  ProviderIDList are the identification IDs of machine instances provided by the provider.
                  This field must match the provider IDs as seen on the node objects corresponding to a machine pool's machine instances.
                items:
                  type: string
                type: array
              refreshPreferences:
                description: RefreshPreferences describes set of preferences associated
                  with the instance refresh request.
                properties:
                  instanceWarmup:
                    description: |-
                      The number of seconds until a newly launched instance is configured and ready
                      to use. During this time, the next replacement will not be initiated.
                      The default is to use the value for the health check grace period defined for the group.
                    format: int64
                    type: integer
                  minHealthyPercentage:
                    description: |-
                      The amount of capacity as a percentage in ASG that must remain healthy
                      during an instance refresh. The default is 90.
                    format: int64
                    type: integer
                  strategy:
                    description: |-
                      The strategy to use for the instance refresh. The only valid value is Rolling.
                      A rolling update is an update that is applied to all instances in an Auto
                      Scaling group until all instances have been updated.
                    type: string
                type: object
              subnets:
                description: Subnets is an array of subnet configurations
                items:
                  description: |-
                    AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                    Only one of ID or Filters may be specified. Specifying more than one will result in
                    a validation error.
                  properties:
                    filters:
                      description: |-
                        Filters is a set of key/value pairs used to identify a resource
                        They are applied according to the rules defined by the AWS API:
                        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                      items:
                        description: Filter is a filter used to identify an AWS resource.
                        properties:
                          name:
                            description: Name of the filter. Filter names are case-sensitive.
                            type: string
                          values:
                            description: Values includes one or more filter values.
                              Filter values are case-sensitive.
                            items:
                              type: string
                            type: array
                        required:
                        - name
                        - values
                        type: object
                      type: array
                    id:
                      description: ID of resource
                      type: string
                  type: object
                type: array
            required:
            - awsLaunchTemplate
            - maxSize
            - minSize
            type: object
          status:
            description: AWSMachinePoolStatus defines the observed state of AWSMachinePool.
            properties:
              asgStatus:
                description: ASGStatus is a status string returned by the autoscaling
                  API.
                type: string
              conditions:
                description: Conditions defines current service state of the AWSMachinePool.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the Machine and will contain a more verbose string suitable
                  for logging and human consumption.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of Machines
                  can be added as events to the Machine object and/or logged in the
                  controller's output.
                type: string
              failureReason:
                description: |-
                  FailureReason will be set in the event that there is a terminal problem
                  reconciling the Machine and will contain a succinct value suitable
                  for machine interpretation.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of Machines
                  can be added as events to the Machine object and/or logged in the
                  controller's output.
                type: string
              instances:
                description: Instances contains the status for each instance in the
                  pool
                items:
                  description: AWSMachinePoolInstanceStatus defines the status of
                    the AWSMachinePoolInstance.
                  properties:
                    instanceID:
                      description: InstanceID is the identification of the Machine
                        Instance within ASG
                      type: string
                    version:
                      description: Version defines the Kubernetes version for the
                        Machine Instance
                      type: string
                  type: object
                type: array
              launchTemplateID:
                description: The ID of the launch template
                type: string
              launchTemplateVersion:
                description: The version of the launch template
                type: string
              ready:
                description: Ready is true when the provider resource is ready.
                type: boolean
              replicas:
                description: Replicas is the most recently observed number of replicas
                format: int32
                type: integer
            type: object
        type: object
    served: false
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - description: Machine ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: Machine ready status
      jsonPath: .status.replicas
      name: Replicas
      type: integer
    - description: Minimum instanes in ASG
      jsonPath: .spec.minSize
      name: MinSize
      type: integer
    - description: Maximum instanes in ASG
      jsonPath: .spec.maxSize
      name: MaxSize
      type: integer
    - description: Launch Template ID
      jsonPath: .status.launchTemplateID
      name: LaunchTemplate ID
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSMachinePool is the Schema for the awsmachinepools API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSMachinePoolSpec defines the desired state of AWSMachinePool.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to an instance, in addition to the ones added by default by the
                  AWS provider.
                type: object
              availabilityZoneSubnetType:
                description: AvailabilityZoneSubnetType specifies which type of subnets
                  to use when an availability zone is specified.
                enum:
                - public
                - private
                - all
                type: string
              availabilityZones:
                description: AvailabilityZones is an array of availability zones instances
                  can run in
                items:
                  type: string
                type: array
              awsLaunchTemplate:
                description: AWSLaunchTemplate specifies the launch template and version
                  to use when an instance is launched.
                properties:
                  additionalSecurityGroups:
                    description: |-
                      AdditionalSecurityGroups is an array of references to security groups that should be applied to the
                      instances. These security groups would be set in addition to any security groups defined
                      at the cluster level or in the actuator.
                    items:
                      description: |-
                        AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                        Only one of ID or Filters may be specified. Specifying more than one will result in
                        a validation error.
                      properties:
                        filters:
                          description: |-
                            Filters is a set of key/value pairs used to identify a resource
                            They are applied according to the rules defined by the AWS API:
                            https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                          items:
                            description: Filter is a filter used to identify an AWS
                              resource.
                            properties:
                              name:
                                description: Name of the filter. Filter names are
                                  case-sensitive.
                                type: string
                              values:
                                description: Values includes one or more filter values.
                                  Filter values are case-sensitive.
                                items:
                                  type: string
                                type: array
                            required:
                            - name
                            - values
                            type: object
                          type: array
                        id:
                          description: ID of resource
                          type: string
                      type: object
                    type: array
                  ami:
                    description: AMI is the reference to the AMI from which to create
                      the machine instance.
                    properties:
                      eksLookupType:
                        description: EKSOptimizedLookupType If specified, will look
                          up an EKS Optimized image in SSM Parameter store
                        enum:
                        - AmazonLinux
                        - AmazonLinuxGPU
                        type: string
                      id:
                        description: ID of resource
                        type: string
                    type: object
                  iamInstanceProfile:
                    description: |-
                      The name or the Amazon Resource Name (ARN) of the instance profile associated
                      with the IAM role for the instance. The instance profile contains the IAM
                      role.
                    type: string
                  imageLookupBaseOS:
                    description: |-
                      ImageLookupBaseOS is the name of the base operating system to use for
                      image lookup the AMI is not set.
                    type: string
                  imageLookupFormat:
                    description: |-
                      ImageLookupFormat is the AMI naming format to look up the image for this
                      machine It will be ignored if an explicit AMI is set. Supports
                      substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and
                      kubernetes version, respectively. The BaseOS will be the value in
                      ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                      defined by the packages produced by kubernetes/release without v as a
                      prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                      image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                      searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                      Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                      also: https://golang.org/pkg/text/template/
                    type: string
                  imageLookupOrg:
                    description: ImageLookupOrg is the AWS Organization ID to use
                      for image lookup if AMI is not set.
                    type: string
                  instanceMetadataOptions:
                    description: InstanceMetadataOptions defines the behavior for
                      applying metadata to instances.
                    properties:
                      httpEndpoint:
                        default: enabled
                        description: |-
                          Enables or disables the HTTP metadata endpoint on your instances.


                          If you specify a value of disabled, you cannot access your instance metadata.


                          Default: enabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                      httpPutResponseHopLimit:
                        default: 1
                        description: |-
                          The desired HTTP PUT response hop limit for instance metadata requests. The
                          larger the number, the further instance metadata requests can travel.


                          Default: 1
                        format: int64
                        maximum: 64
                        minimum: 1
                        type: integer
                      httpTokens:
                        default: optional
                        description: |-
                          The state of token usage for your instance metadata requests.


                          If the state is optional, you can choose to retrieve instance metadata with
                          or without a session token on your request. If you retrieve the IAM role
                          credentials without a token, the version 1.0 role credentials are returned.
                          If you retrieve the IAM role credentials using a valid session token, the
                          version 2.0 role credentials are returned.


                          If the state is required, you must send a session token with any instance
                          metadata retrieval requests. In this state, retrieving the IAM role credentials
                          always returns the version 2.0 credentials; the version 1.0 credentials are
                          not available.


                          Default: optional
                        enum:
                        - optional
                        - required
                        type: string
                      instanceMetadataTags:
                        default: disabled
                        description: |-
                          Set to enabled to allow access to instance tags from the instance metadata.
                          Set to disabled to turn off access to instance tags from the instance metadata.
                          For more information, see Work with instance tags using the instance metadata
                          (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS).


                          Default: disabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                    type: object
                  instanceType:
                    description: 'InstanceType is the type of instance to create.
                      Example: m4.xlarge'
                    type: string
                  name:
                    description: The name of the launch template.
                    type: string
                  nonRootVolumes:
                    description: Configuration options for the non root storage volumes.
                    items:
                      description: Volume encapsulates the configuration options for
                        the storage device.
                      properties:
                        deviceName:
                          description: Device name
                          type: string
                        encrypted:
                          description: Encrypted is whether the volume should be encrypted
                            or not.
                          type: boolean
                        encryptionKey:
                          description: |-
                            EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                            If Encrypted is set and this is omitted, the default AWS key will be used.
                            The key must already exist and be accessible by the controller.
                          type: string
                        iops:
                          description: IOPS is the number of IOPS requested for the
                            disk. Not applicable to all types.
                          format: int64
                          type: integer
                        size:
                          description: |-
                            Size specifies size (in Gi) of the storage device.
                            Must be greater than the image snapshot size or 8 (whichever is greater).
                          format: int64
                          minimum: 8
                          type: integer
                        throughput:
                          description: Throughput to provision in MiB/s supported
                            for the volume type. Not applicable to all types.
                          format: int64
                          type: integer
                        type:
                          description: Type is the type of the volume (e.g. gp2, io1,
                            etc...).
                          type: string
                      required:
                      - size
                      type: object
                    type: array
                  privateDnsName:
                    description: PrivateDNSName is the options for the instance hostname.
                    properties:
                      enableResourceNameDnsAAAARecord:
                        description: EnableResourceNameDNSAAAARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          AAAA records.
                        type: boolean
                      enableResourceNameDnsARecord:
                        description: EnableResourceNameDNSARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          A records.
                        type: boolean
                      hostnameType:
                        description: The type of hostname to assign to an instance.
                        enum:
                        - ip-name
                        - resource-name
                        type: string
                    type: object
                  rootVolume:
                    description: RootVolume encapsulates the configuration options
                      for the root volume
                    properties:
                      deviceName:
                        description: Device name
                        type: string
                      encrypted:
                        description: Encrypted is whether the volume should be encrypted
                          or not.
                        type: boolean
                      encryptionKey:
                        description: |-
                          EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                          If Encrypted is set and this is omitted, the default AWS key will be used.
                          The key must already exist and be accessible by the controller.
                        type: string
                      iops:
                        description: IOPS is the number of IOPS requested for the
                          disk. Not applicable to all types.
                        format: int64
                        type: integer
                      size:
                        description: |-
                          Size specifies size (in Gi) of the storage device.
                          Must be greater than the image snapshot size or 8 (whichever is greater).
                        format: int64
                        minimum: 8
                        type: integer
                      throughput:
                        description: Throughput to provision in MiB/s supported for
                          the volume type. Not applicable to all types.
                        format: int64
                        type: integer
                      type:
                        description: Type is the type of the volume (e.g. gp2, io1,
                          etc...).
                        type: string
                    required:
                    - size
                    type: object
                  spotMarketOptions:
                    description: SpotMarketOptions are options for configuring AWSMachinePool
                      instances to be run using AWS Spot instances.
                    properties:
                      maxPrice:
                        description: MaxPrice defines the maximum price the user is
                          willing to pay for Spot VM instances
                        type: string
                    type: object
                  sshKeyName:
                    description: |-
                      SSHKeyName is the name of the ssh key to attach to the instance. Valid values are empty string
                      (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)
                    type: string
                  versionNumber:
                    description: |-
                      VersionNumber is the version of the launch template that is applied.
                      Typically a new version is created when at least one of the following happens:
                      1) A new launch template spec is applied.
                      2) One or more parameters in an existing template is changed.
                      3) A new AMI is discovered.
                    format: int64
                    type: integer
                type: object
              capacityRebalance:
                description: Enable or disable the capacity rebalance autoscaling
                  group feature
                type: boolean
              defaultCoolDown:
                description: |-
                  The amount of time, in seconds, after a scaling activity completes before another scaling activity can start.
                  If no value is supplied by user a default value of 300 seconds is set
                type: string
              defaultInstanceWarmup:
                description: |-
                  The amount of time, in seconds, until a new instance is considered to
                  have finished initializing and resource consumption to become stable
                  after it enters the InService state.
                  If no value is supplied by user a default value of 300 seconds is set
                type: string
              maxSize:
                default: 1
                description: MaxSize defines the maximum size of the group.
                format: int32
                minimum: 1
                type: integer
              minSize:
                default: 1
                description: MinSize defines the minimum size of the group.
                format: int32
                minimum: 0
                type: integer
              mixedInstancesPolicy:
                description: MixedInstancesPolicy describes how multiple instance
                  types will be used by the ASG.
                properties:
                  instancesDistribution:
                    description: InstancesDistribution to configure distribution of
                      On-Demand Instances and Spot Instances.
                    properties:
                      onDemandAllocationStrategy:
                        default: prioritized
                        description: OnDemandAllocationStrategy indicates how to allocate
                          instance types to fulfill On-Demand capacity.
                        enum:
                        - prioritized
                        - lowest-price
                        type: string
                      onDemandBaseCapacity:
                        default: 0
                        format: int64
                        type: integer
                      onDemandPercentageAboveBaseCapacity:
                        default: 100
                        format: int64
                        type: integer
                      spotAllocationStrategy:
                        default: lowest-price
                        description: SpotAllocationStrategy indicates how to allocate
                          instances across Spot Instance pools.
                        enum:
                        - lowest-price
                        - capacity-optimized
                        - capacity-optimized-prioritized
                        - price-capacity-optimized
                        type: string
                    type: object
                  overrides:
                    items:
                      description: |-
                        Overrides are used to override the instance type specified by the launch template with multiple
                        instance types that can be used to launch On-Demand Instances and Spot Instances.
                      properties:
                        instanceType:
                          type: string
                      required:
                      - instanceType
                      type: object
                    type: array
                type: object
              providerID:
                description: ProviderID is the ARN of the associated ASG
                type: string
              providerIDList:
                description: |-
                  ProviderIDList are the identification IDs of machine instances provided by the provider.
                  This field must match the provider IDs as seen on the node objects corresponding to a machine pool's machine instances.
                items:
                  type: string
                type: array
              refreshPreferences:
                description: RefreshPreferences describes set of preferences associated
                  with the instance refresh request.
                properties:
                  disable:
                    description: |-
                      Disable, if true, disables instance refresh from triggering when new launch templates are detected.
                      This is useful in scenarios where ASG nodes are externally managed.
                    type: boolean
                  instanceWarmup:
                    description: |-
                      The number of seconds until a newly launched instance is configured and ready
                      to use. During this time, the next replacement will not be initiated.
                      The default is to use the value for the health check grace period defined for the group.
                    format: int64
                    type: integer
                  maxHealthyPercentage:
                    description: |-
                      The amount of capacity as a percentage in ASG that can be in service and healthy, or pending,
                      to support your workload when replacing instances.
                      The value is expressed as a percentage of the desired capacity of the ASG. Value range is 100 to 200.
                      If you specify MaxHealthyPercentage , you must also specify MinHealthyPercentage , and the difference between
                      them cannot be greater than 100.
                      A larger range increases the number of instances that can be replaced at the same time.
                    format: int64
                    maximum: 200
                    minimum: 100
                    type: integer
                  minHealthyPercentage:
                    description: |-
                      The amount of capacity as a percentage in ASG that must remain healthy
                      during an instance refresh. The default is 90.
                    format: int64
                    type: integer
                  strategy:
                    description: |-
                      The strategy to use for the instance refresh. The only valid value is Rolling.
                      A rolling update is an update that is applied to all instances in an Auto
                      Scaling group until all instances have been updated.
                    type: string
                type: object
              subnets:
                description: Subnets is an array of subnet configurations
                items:
                  description: |-
                    AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                    Only one of ID or Filters may be specified. Specifying more than one will result in
                    a validation error.
                  properties:
                    filters:
                      description: |-
                        Filters is a set of key/value pairs used to identify a resource
                        They are applied according to the rules defined by the AWS API:
                        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                      items:
                        description: Filter is a filter used to identify an AWS resource.
                        properties:
                          name:
                            description: Name of the filter. Filter names are case-sensitive.
                            type: string
                          values:
                            description: Values includes one or more filter values.
                              Filter values are case-sensitive.
                            items:
                              type: string
                            type: array
                        required:
                        - name
                        - values
                        type: object
                      type: array
                    id:
                      description: ID of resource
                      type: string
                  type: object
                type: array
              suspendProcesses:
                description: |-
                  SuspendProcesses defines a list of processes to suspend for the given ASG. This is constantly reconciled.
                  If a process is removed from this list it will automatically be resumed.
                properties:
                  all:
                    type: boolean
                  processes:
                    description: Processes defines the processes which can be enabled
                      or disabled individually.
                    properties:
                      addToLoadBalancer:
                        type: boolean
                      alarmNotification:
                        type: boolean
                      azRebalance:
                        type: boolean
                      healthCheck:
                        type: boolean
                      instanceRefresh:
                        type: boolean
                      launch:
                        type: boolean
                      replaceUnhealthy:
                        type: boolean
                      scheduledActions:
                        type: boolean
                      terminate:
                        type: boolean
                    type: object
                type: object
            required:
            - awsLaunchTemplate
            - maxSize
            - minSize
            type: object
          status:
            description: AWSMachinePoolStatus defines the observed state of AWSMachinePool.
            properties:
              asgStatus:
                description: ASGStatus is a status string returned by the autoscaling
                  API.
                type: string
              conditions:
                description: Conditions defines current service state of the AWSMachinePool.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the Machine and will contain a more verbose string suitable
                  for logging and human consumption.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of Machines
                  can be added as events to the Machine object and/or logged in the
                  controller's output.
                type: string
              failureReason:
                description: |-
                  FailureReason will be set in the event that there is a terminal problem
                  reconciling the Machine and will contain a succinct value suitable
                  for machine interpretation.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of Machines
                  can be added as events to the Machine object and/or logged in the
                  controller's output.
                type: string
              instances:
                description: Instances contains the status for each instance in the
                  pool
                items:
                  description: AWSMachinePoolInstanceStatus defines the status of
                    the AWSMachinePoolInstance.
                  properties:
                    instanceID:
                      description: InstanceID is the identification of the Machine
                        Instance within ASG
                      type: string
                    version:
                      description: Version defines the Kubernetes version for the
                        Machine Instance
                      type: string
                  type: object
                type: array
              launchTemplateID:
                description: The ID of the launch template
                type: string
              launchTemplateVersion:
                description: The version of the launch template
                type: string
              ready:
                description: Ready is true when the provider resource is ready.
                type: boolean
              replicas:
                description: Replicas is the most recently observed number of replicas
                format: int32
                type: integer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsmanagedmachinepools.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSManagedMachinePool
    listKind: AWSManagedMachinePoolList
    plural: awsmanagedmachinepools
    shortNames:
    - awsmmp
    singular: awsmanagedmachinepool
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: MachinePool ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: Number of replicas
      jsonPath: .status.replicas
      name: Replicas
      type: integer
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: AWSManagedMachinePool is the Schema for the awsmanagedmachinepools
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSManagedMachinePoolSpec defines the desired state of AWSManagedMachinePool.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                  ones added by default.
                type: object
              amiType:
                default: AL2_x86_64
                description: AMIType defines the AMI type
                enum:
                - AL2_x86_64
                - AL2_x86_64_GPU
                - AL2_ARM_64
                - AL2023_x86_64_STANDARD
                - AL2023_ARM_64_STANDARD
                - CUSTOM
                type: string
              amiVersion:
                description: |-
                  AMIVersion defines the desired AMI release version. If no version number
                  is supplied then the latest version for the Kubernetes version
                  will be used
                minLength: 2
                type: string
              availabilityZones:
                description: AvailabilityZones is an array of availability zones instances
                  can run in
                items:
                  type: string
                type: array
              awsLaunchTemplate:
                description: |-
                  AWSLaunchTemplate specifies the launch template to use to create the managed node group.
                  If AWSLaunchTemplate is specified, certain node group configuraions outside of launch template
                  are prohibited (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html).
                properties:
                  additionalSecurityGroups:
                    description: |-
                      AdditionalSecurityGroups is an array of references to security groups that should be applied to the
                      instances. These security groups would be set in addition to any security groups defined
                      at the cluster level or in the actuator.
                    items:
                      description: |-
                        AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                        Only one of ID or Filters may be specified. Specifying more than one will result in
                        a validation error.
                      properties:
                        filters:
                          description: |-
                            Filters is a set of key/value pairs used to identify a resource
                            They are applied according to the rules defined by the AWS API:
                            https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                          items:
                            description: Filter is a filter used to identify an AWS
                              resource.
                            properties:
                              name:
                                description: Name of the filter. Filter names are
                                  case-sensitive.
                                type: string
                              values:
                                description: Values includes one or more filter values.
                                  Filter values are case-sensitive.
                                items:
                                  type: string
                                type: array
                            required:
                            - name
                            - values
                            type: object
                          type: array
                        id:
                          description: ID of resource
                          type: string
                      type: object
                    type: array
                  ami:
                    description: AMI is the reference to the AMI from which to create
                      the machine instance.
                    properties:
                      eksLookupType:
                        description: EKSOptimizedLookupType If specified, will look
                          up an EKS Optimized image in SSM Parameter store
                        enum:
                        - AmazonLinux
                        - AmazonLinuxGPU
                        type: string
                      id:
                        description: ID of resource
                        type: string
                    type: object
                  iamInstanceProfile:
                    description: |-
                      The name or the Amazon Resource Name (ARN) of the instance profile associated
                      with the IAM role for the instance. The instance profile contains the IAM
                      role.
                    type: string
                  imageLookupBaseOS:
                    description: |-
                      ImageLookupBaseOS is the name of the base operating system to use for
                      image lookup the AMI is not set.
                    type: string
                  imageLookupFormat:
                    description: |-
                      ImageLookupFormat is the AMI naming format to look up the image for this
                      machine It will be ignored if an explicit AMI is set. Supports
                      substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and
                      kubernetes version, respectively. The BaseOS will be the value in
                      ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                      defined by the packages produced by kubernetes/release without v as a
                      prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                      image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                      searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                      Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                      also: https://golang.org/pkg/text/template/
                    type: string
                  imageLookupOrg:
                    description: ImageLookupOrg is the AWS Organization ID to use
                      for image lookup if AMI is not set.
                    type: string
                  instanceType:
                    description: 'InstanceType is the type of instance to create.
                      Example: m4.xlarge'
                    type: string
                  name:
                    description: The name of the launch template.
                    type: string
                  rootVolume:
                    description: RootVolume encapsulates the configuration options
                      for the root volume
                    properties:
                      deviceName:
                        description: Device name
                        type: string
                      encrypted:
                        description: Encrypted is whether the volume should be encrypted
                          or not.
                        type: boolean
                      encryptionKey:
                        description: |-
                          EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                          If Encrypted is set and this is omitted, the default AWS key will be used.
                          The key must already exist and be accessible by the controller.
                        type: string
                      iops:
                        description: IOPS is the number of IOPS requested for the
                          disk. Not applicable to all types.
                        format: int64
                        type: integer
                      size:
                        description: |-
                          Size specifies size (in Gi) of the storage device.
                          Must be greater than the image snapshot size or 8 (whichever is greater).
                        format: int64
                        minimum: 8
                        type: integer
                      throughput:
                        description: Throughput to provision in MiB/s supported for
                          the volume type. Not applicable to all types.
                        format: int64
                        type: integer
                      type:
                        description: Type is the type of the volume (e.g. gp2, io1,
                          etc...).
                        type: string
                    required:
                    - size
                    type: object
                  spotMarketOptions:
                    description: SpotMarketOptions are options for configuring AWSMachinePool
                      instances to be run using AWS Spot instances.
                    properties:
                      maxPrice:
                        description: MaxPrice defines the maximum price the user is
                          willing to pay for Spot VM instances
                        type: string
                    type: object
                  sshKeyName:
                    description: |-
                      SSHKeyName is the name of the ssh key to attach to the instance. Valid values are empty string
                      (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)
                    type: string
                  versionNumber:
                    description: |-
                      VersionNumber is the version of the launch template that is applied.
                      Typically a new version is created when at least one of the following happens:
                      1) A new launch template spec is applied.
                      2) One or more parameters in an existing template is changed.
                      3) A new AMI is discovered.
                    format: int64
                    type: integer
                type: object
              capacityType:
                default: onDemand
                description: CapacityType specifies the capacity type for the ASG
                  behind this pool
                enum:
                - onDemand
                - spot
                type: string
              diskSize:
                description: DiskSize specifies the root disk size
                format: int32
                type: integer
              eksNodegroupName:
                description: |-
                  EKSNodegroupName specifies the name of the nodegroup in AWS
                  corresponding to this MachinePool. If you don't specify a name
                  then a default name will be created based on the namespace and
                  name of the managed machine pool.
                type: string
              instanceType:
                description: InstanceType specifies the AWS instance type
                type: string
              labels:
                additionalProperties:
                  type: string
                description: Labels specifies labels for the Kubernetes node objects
                type: object
              providerIDList:
                description: |-
                  ProviderIDList are the provider IDs of instances in the
                  autoscaling group corresponding to the nodegroup represented by this
                  machine pool
                items:
                  type: string
                type: array
              remoteAccess:
                description: RemoteAccess specifies how machines can be accessed remotely
                properties:
                  public:
                    description: Public specifies whether to open port 22 to the public
                      internet
                    type: boolean
                  sourceSecurityGroups:
                    description: SourceSecurityGroups specifies which security groups
                      are allowed access
                    items:
                      type: string
                    type: array
                  sshKeyName:
                    description: |-
                      SSHKeyName specifies which EC2 SSH key can be used to access machines.
                      If left empty, the key from the control plane is used.
                    type: string
                type: object
              roleAdditionalPolicies:
                description: |-
                  RoleAdditionalPolicies allows you to attach additional polices to
                  the node group role. You must enable the EKSAllowAddRoles
                  feature flag to incorporate these into the created role.
                items:
                  type: string
                type: array
              roleName:
                description: |-
                  RoleName specifies the name of IAM role for the node group.
                  If the role is pre-existing we will treat it as unmanaged
                  and not delete it on deletion. If the EKSEnableIAM feature
                  flag is true and no name is supplied then a role is created.
                type: string
              scaling:
                description: Scaling specifies scaling for the ASG behind this pool
                properties:
                  maxSize:
                    format: int32
                    type: integer
                  minSize:
                    format: int32
                    type: integer
                type: object
              subnetIDs:
                description: |-
                  SubnetIDs specifies which subnets are used for the
                  auto scaling group of this nodegroup
                items:
                  type: string
                type: array
              taints:
                description: Taints specifies the taints to apply to the nodes of
                  the machine pool
                items:
                  description: Taint defines the specs for a Kubernetes taint.
                  properties:
                    effect:
                      description: Effect specifies the effect for the taint
                      enum:
                      - no-schedule
                      - no-execute
                      - prefer-no-schedule
                      type: string
                    key:
                      description: Key is the key of the taint
                      type: string
                    value:
                      description: Value is the value of the taint
                      type: string
                  required:
                  - effect
                  - key
                  - value
                  type: object
                type: array
              updateConfig:
                description: |-
                  UpdateConfig holds the optional config to control the behaviour of the update
                  to the nodegroup.
                properties:
                  maxUnavailable:
                    description: |-
                      MaxUnavailable is the maximum number of nodes unavailable at once during a version update.
                      Nodes will be updated in parallel. The maximum number is 100.
                    maximum: 100
                    minimum: 1
                    type: integer
                  maxUnavailablePrecentage:
                    description: |-
                      MaxUnavailablePercentage is the maximum percentage of nodes unavailable during a version update. This
                      percentage of nodes will be updated in parallel, up to 100 nodes at once.
                    maximum: 100
                    minimum: 1
                    type: integer
                type: object
            type: object
          status:
            description: AWSManagedMachinePoolStatus defines the observed state of
              AWSManagedMachinePool.
            properties:
              conditions:
                description: Conditions defines current service state of the managed
                  machine pool
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the MachinePool and will contain a more verbose string suitable
                  for logging and human consumption.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the MachinePool's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of MachinePools
                  can be added as events to the MachinePool object and/or logged in the
                  controller's output.
                type: string
              failureReason:
                description: |-
                  FailureReason will be set in the event that there is a terminal problem
                  reconciling the MachinePool and will contain a succinct value suitable
                  for machine interpretation.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of MachinePools
                  can be added as events to the MachinePool object and/or logged in the
                  controller's output.
                type: string
              launchTemplateID:
                description: The ID of the launch template
                type: string
              launchTemplateVersion:
                description: The version of the launch template
                type: string
              ready:
                default: false
                description: |-
                  Ready denotes that the AWSManagedMachinePool nodegroup has joined
                  the cluster
                type: boolean
              replicas:
                description: Replicas is the most recently observed number of replicas.
                format: int32
                type: integer
            required:
            - ready
            type: object
        type: object
    served: false
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - description: MachinePool ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: Number of replicas
      jsonPath: .status.replicas
      name: Replicas
      type: integer
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSManagedMachinePool is the Schema for the awsmanagedmachinepools
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSManagedMachinePoolSpec defines the desired state of AWSManagedMachinePool.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                  ones added by default.
                type: object
              amiType:
                default: AL2_x86_64
                description: AMIType defines the AMI type
                enum:
                - AL2_x86_64
                - AL2_x86_64_GPU
                - AL2_ARM_64
                - AL2023_x86_64_STANDARD
                - AL2023_ARM_64_STANDARD
                - CUSTOM
                type: string
              amiVersion:
                description: |-
                  AMIVersion defines the desired AMI release version. If no version number
                  is supplied then the latest version for the Kubernetes version
                  will be used
                minLength: 2
                type: string
              availabilityZoneSubnetType:
                description: AvailabilityZoneSubnetType specifies which type of subnets
                  to use when an availability zone is specified.
                enum:
                - public
                - private
                - all
                type: string
              availabilityZones:
                description: AvailabilityZones is an array of availability zones instances
                  can run in
                items:
                  type: string
                type: array
              awsLaunchTemplate:
                description: |-
                  AWSLaunchTemplate specifies the launch template to use to create the managed node group.
                  If AWSLaunchTemplate is specified, certain node group configuraions outside of launch template
                  are prohibited (https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html).
                properties:
                  additionalSecurityGroups:
                    description: |-
                      AdditionalSecurityGroups is an array of references to security groups that should be applied to the
                      instances. These security groups would be set in addition to any security groups defined
                      at the cluster level or in the actuator.
                    items:
                      description: |-
                        AWSResourceReference is a reference to a specific AWS resource by ID or filters.
                        Only one of ID or Filters may be specified. Specifying more than one will result in
                        a validation error.
                      properties:
                        filters:
                          description: |-
                            Filters is a set of key/value pairs used to identify a resource
                            They are applied according to the rules defined by the AWS API:
                            https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html
                          items:
                            description: Filter is a filter used to identify an AWS
                              resource.
                            properties:
                              name:
                                description: Name of the filter. Filter names are
                                  case-sensitive.
                                type: string
                              values:
                                description: Values includes one or more filter values.
                                  Filter values are case-sensitive.
                                items:
                                  type: string
                                type: array
                            required:
                            - name
                            - values
                            type: object
                          type: array
                        id:
                          description: ID of resource
                          type: string
                      type: object
                    type: array
                  ami:
                    description: AMI is the reference to the AMI from which to create
                      the machine instance.
                    properties:
                      eksLookupType:
                        description: EKSOptimizedLookupType If specified, will look
                          up an EKS Optimized image in SSM Parameter store
                        enum:
                        - AmazonLinux
                        - AmazonLinuxGPU
                        type: string
                      id:
                        description: ID of resource
                        type: string
                    type: object
                  iamInstanceProfile:
                    description: |-
                      The name or the Amazon Resource Name (ARN) of the instance profile associated
                      with the IAM role for the instance. The instance profile contains the IAM
                      role.
                    type: string
                  imageLookupBaseOS:
                    description: |-
                      ImageLookupBaseOS is the name of the base operating system to use for
                      image lookup the AMI is not set.
                    type: string
                  imageLookupFormat:
                    description: |-
                      ImageLookupFormat is the AMI naming format to look up the image for this
                      machine It will be ignored if an explicit AMI is set. Supports
                      substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and
                      kubernetes version, respectively. The BaseOS will be the value in
                      ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                      defined by the packages produced by kubernetes/release without v as a
                      prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                      image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                      searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                      Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                      also: https://golang.org/pkg/text/template/
                    type: string
                  imageLookupOrg:
                    description: ImageLookupOrg is the AWS Organization ID to use
                      for image lookup if AMI is not set.
                    type: string
                  instanceMetadataOptions:
                    description: InstanceMetadataOptions defines the behavior for
                      applying metadata to instances.
                    properties:
                      httpEndpoint:
                        default: enabled
                        description: |-
                          Enables or disables the HTTP metadata endpoint on your instances.


                          If you specify a value of disabled, you cannot access your instance metadata.


                          Default: enabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                      httpPutResponseHopLimit:
                        default: 1
                        description: |-
                          The desired HTTP PUT response hop limit for instance metadata requests. The
                          larger the number, the further instance metadata requests can travel.


                          Default: 1
                        format: int64
                        maximum: 64
                        minimum: 1
                        type: integer
                      httpTokens:
                        default: optional
                        description: |-
                          The state of token usage for your instance metadata requests.


                          If the state is optional, you can choose to retrieve instance metadata with
                          or without a session token on your request. If you retrieve the IAM role
                          credentials without a token, the version 1.0 role credentials are returned.
                          If you retrieve the IAM role credentials using a valid session token, the
                          version 2.0 role credentials are returned.


                          If the state is required, you must send a session token with any instance
                          metadata retrieval requests. In this state, retrieving the IAM role credentials
                          always returns the version 2.0 credentials; the version 1.0 credentials are
                          not available.


                          Default: optional
                        enum:
                        - optional
                        - required
                        type: string
                      instanceMetadataTags:
                        default: disabled
                        description: |-
                          Set to enabled to allow access to instance tags from the instance metadata.
                          Set to disabled to turn off access to instance tags from the instance metadata.
                          For more information, see Work with instance tags using the instance metadata
                          (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS).


                          Default: disabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                    type: object
                  instanceType:
                    description: 'InstanceType is the type of instance to create.
                      Example: m4.xlarge'
                    type: string
                  name:
                    description: The name of the launch template.
                    type: string
                  nonRootVolumes:
                    description: Configuration options for the non root storage volumes.
                    items:
                      description: Volume encapsulates the configuration options for
                        the storage device.
                      properties:
                        deviceName:
                          description: Device name
                          type: string
                        encrypted:
                          description: Encrypted is whether the volume should be encrypted
                            or not.
                          type: boolean
                        encryptionKey:
                          description: |-
                            EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                            If Encrypted is set and this is omitted, the default AWS key will be used.
                            The key must already exist and be accessible by the controller.
                          type: string
                        iops:
                          description: IOPS is the number of IOPS requested for the
                            disk. Not applicable to all types.
                          format: int64
                          type: integer
                        size:
                          description: |-
                            Size specifies size (in Gi) of the storage device.
                            Must be greater than the image snapshot size or 8 (whichever is greater).
                          format: int64
                          minimum: 8
                          type: integer
                        throughput:
                          description: Throughput to provision in MiB/s supported
                            for the volume type. Not applicable to all types.
                          format: int64
                          type: integer
                        type:
                          description: Type is the type of the volume (e.g. gp2, io1,
                            etc...).
                          type: string
                      required:
                      - size
                      type: object
                    type: array
                  privateDnsName:
                    description: PrivateDNSName is the options for the instance hostname.
                    properties:
                      enableResourceNameDnsAAAARecord:
                        description: EnableResourceNameDNSAAAARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          AAAA records.
                        type: boolean
                      enableResourceNameDnsARecord:
                        description: EnableResourceNameDNSARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          A records.
                        type: boolean
                      hostnameType:
                        description: The type of hostname to assign to an instance.
                        enum:
                        - ip-name
                        - resource-name
                        type: string
                    type: object
                  rootVolume:
                    description: RootVolume encapsulates the configuration options
                      for the root volume
                    properties:
                      deviceName:
                        description: Device name
                        type: string
                      encrypted:
                        description: Encrypted is whether the volume should be encrypted
                          or not.
                        type: boolean
                      encryptionKey:
                        description: |-
                          EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                          If Encrypted is set and this is omitted, the default AWS key will be used.
                          The key must already exist and be accessible by the controller.
                        type: string
                      iops:
                        description: IOPS is the number of IOPS requested for the
                          disk. Not applicable to all types.
                        format: int64
                        type: integer
                      size:
                        description: |-
                          Size specifies size (in Gi) of the storage device.
                          Must be greater than the image snapshot size or 8 (whichever is greater).
                        format: int64
                        minimum: 8
                        type: integer
                      throughput:
                        description: Throughput to provision in MiB/s supported for
                          the volume type. Not applicable to all types.
                        format: int64
                        type: integer
                      type:
                        description: Type is the type of the volume (e.g. gp2, io1,
                          etc...).
                        type: string
                    required:
                    - size
                    type: object
                  spotMarketOptions:
                    description: SpotMarketOptions are options for configuring AWSMachinePool
                      instances to be run using AWS Spot instances.
                    properties:
                      maxPrice:
                        description: MaxPrice defines the maximum price the user is
                          willing to pay for Spot VM instances
                        type: string
                    type: object
                  sshKeyName:
                    description: |-
                      SSHKeyName is the name of the ssh key to attach to the instance. Valid values are empty string
                      (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)
                    type: string
                  versionNumber:
                    description: |-
                      VersionNumber is the version of the launch template that is applied.
                      Typically a new version is created when at least one of the following happens:
                      1) A new launch template spec is applied.
                      2) One or more parameters in an existing template is changed.
                      3) A new AMI is discovered.
                    format: int64
                    type: integer
                type: object
              capacityType:
                default: onDemand
                description: CapacityType specifies the capacity type for the ASG
                  behind this pool
                enum:
                - onDemand
                - spot
                type: string
              diskSize:
                description: DiskSize specifies the root disk size
                format: int32
                type: integer
              eksNodegroupName:
                description: |-
                  EKSNodegroupName specifies the name of the nodegroup in AWS
                  corresponding to this MachinePool. If you don't specify a name
                  then a default name will be created based on the namespace and
                  name of the managed machine pool.
                type: string
              instanceType:
                description: InstanceType specifies the AWS instance type
                type: string
              labels:
                additionalProperties:
                  type: string
                description: Labels specifies labels for the Kubernetes node objects
                type: object
              providerIDList:
                description: |-
                  ProviderIDList are the provider IDs of instances in the
                  autoscaling group corresponding to the nodegroup represented by this
                  machine pool
                items:
                  type: string
                type: array
              remoteAccess:
                description: RemoteAccess specifies how machines can be accessed remotely
                properties:
                  public:
                    description: Public specifies whether to open port 22 to the public
                      internet
                    type: boolean
                  sourceSecurityGroups:
                    description: SourceSecurityGroups specifies which security groups
                      are allowed access
                    items:
                      type: string
                    type: array
                  sshKeyName:
                    description: |-
                      SSHKeyName specifies which EC2 SSH key can be used to access machines.
                      If left empty, the key from the control plane is used.
                    type: string
                type: object
              roleAdditionalPolicies:
                description: |-
                  RoleAdditionalPolicies allows you to attach additional polices to
                  the node group role. You must enable the EKSAllowAddRoles
                  feature flag to incorporate these into the created role.
                items:
                  type: string
                type: array
              roleName:
                description: |-
                  RoleName specifies the name of IAM role for the node group.
                  If the role is pre-existing we will treat it as unmanaged
                  and not delete it on deletion. If the EKSEnableIAM feature
                  flag is true and no name is supplied then a role is created.
                type: string
              scaling:
                description: Scaling specifies scaling for the ASG behind this pool
                properties:
                  maxSize:
                    format: int32
                    type: integer
                  minSize:
                    format: int32
                    type: integer
                type: object
              subnetIDs:
                description: |-
                  SubnetIDs specifies which subnets are used for the
                  auto scaling group of this nodegroup
                items:
                  type: string
                type: array
              taints:
                description: Taints specifies the taints to apply to the nodes of
                  the machine pool
                items:
                  description: Taint defines the specs for a Kubernetes taint.
                  properties:
                    effect:
                      description: Effect specifies the effect for the taint
                      enum:
                      - no-schedule
                      - no-execute
                      - prefer-no-schedule
                      type: string
                    key:
                      description: Key is the key of the taint
                      type: string
                    value:
                      description: Value is the value of the taint
                      type: string
                  required:
                  - effect
                  - key
                  - value
                  type: object
                type: array
              updateConfig:
                description: |-
                  UpdateConfig holds the optional config to control the behaviour of the update
                  to the nodegroup.
                properties:
                  maxUnavailable:
                    description: |-
                      MaxUnavailable is the maximum number of nodes unavailable at once during a version update.
                      Nodes will be updated in parallel. The maximum number is 100.
                    maximum: 100
                    minimum: 1
                    type: integer
                  maxUnavailablePercentage:
                    description: |-
                      MaxUnavailablePercentage is the maximum percentage of nodes unavailable during a version update. This
                      percentage of nodes will be updated in parallel, up to 100 nodes at once.
                    maximum: 100
                    minimum: 1
                    type: integer
                type: object
            type: object
          status:
            description: AWSManagedMachinePoolStatus defines the observed state of
              AWSManagedMachinePool.
            properties:
              conditions:
                description: Conditions defines current service state of the managed
                  machine pool
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the MachinePool and will contain a more verbose string suitable
                  for logging and human consumption.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the MachinePool's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of MachinePools
                  can be added as events to the MachinePool object and/or logged in the
                  controller's output.
                type: string
              failureReason:
                description: |-
                  FailureReason will be set in the event that there is a terminal problem
                  reconciling the MachinePool and will contain a succinct value suitable
                  for machine interpretation.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the Machine's spec or the configuration of
                  the controller, and that manual intervention is required. Examples
                  of terminal errors would be invalid combinations of settings in the
                  spec, values that are unsupported by the controller, or the
                  responsible controller itself being critically misconfigured.


                  Any transient errors that occur during the reconciliation of MachinePools
                  can be added as events to the MachinePool object and/or logged in the
                  controller's output.
                type: string
              launchTemplateID:
                description: The ID of the launch template
                type: string
              launchTemplateVersion:
                description: The version of the launch template
                type: string
              ready:
                default: false
                description: |-
                  Ready denotes that the AWSManagedMachinePool nodegroup has joined
                  the cluster
                type: boolean
              replicas:
                description: Replicas is the most recently observed number of replicas.
                format: int32
                type: integer
            required:
            - ready
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
    clusterctl.cluster.x-k8s.io/move-hierarchy: ""
  name: awsclusterroleidentities.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSClusterRoleIdentity
    listKind: AWSClusterRoleIdentityList
    plural: awsclusterroleidentities
    shortNames:
    - awsri
    singular: awsclusterroleidentity
  scope: Cluster
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          AWSClusterRoleIdentity is the Schema for the awsclusterroleidentities API
          It is used to assume a role using the provided sourceRef.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec for this AWSClusterRoleIdentity.
            properties:
              allowedNamespaces:
                description: |-
                  AllowedNamespaces is used to identify which namespaces are allowed to use the identity from.
                  Namespaces can be selected either using an array of namespaces or with label selector.
                  An empty allowedNamespaces object indicates that AWSClusters can use this identity from any namespace.
                  If this object is nil, no namespaces will be allowed (default behaviour, if this field is not provided)
                  A namespace should be either in the NamespaceList or match with Selector to use the identity.
                nullable: true
                properties:
                  list:
                    description: An nil or empty list indicates that AWSClusters cannot
                      use the identity from any namespace.
                    items:
                      type: string
                    nullable: true
                    type: array
                  selector:
                    description: |-
                      An empty selector indicates that AWSClusters cannot use this
                      AWSClusterIdentity from any namespace.
                    properties:
                      matchExpressions:
                        description: matchExpressions is a list of label selector
                          requirements. The requirements are ANDed.
                        items:
                          description: |-
                            A label selector requirement is a selector that contains values, a key, and an operator that
                            relates the key and values.
                          properties:
                            key:
                              description: key is the label key that the selector
                                applies to.
                              type: string
                            operator:
                              description: |-
                                operator represents a key's relationship to a set of values.
                                Valid operators are In, NotIn, Exists and DoesNotExist.
                              type: string
                            values:
                              description: |-
                                values is an array of string values. If the operator is In or NotIn,
                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                the values array must be empty. This array is replaced during a strategic
                                merge patch.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                          required:
                          - key
                          - operator
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                        type: object
                    type: object
                    x-kubernetes-map-type: atomic
                type: object
              durationSeconds:
                description: The duration, in seconds, of the role session before
                  it is renewed.
                format: int32
                maximum: 43200
                minimum: 900
                type: integer
              externalID:
                description: |-
                  A unique identifier that might be required when you assume a role in another account.
                  If the administrator of the account to which the role belongs provided you with an
                  external ID, then provide that value in the ExternalId parameter. This value can be
                  any string, such as a passphrase or account number. A cross-account role is usually
                  set up to trust everyone in an account. Therefore, the administrator of the trusting
                  account might send an external ID to the administrator of the trusted account. That
                  way, only someone with the ID can assume the role, rather than everyone in the
                  account. For more information about the external ID, see How to Use an External ID
                  When Granting Access to Your AWS Resources to a Third Party in the IAM User Guide.
                type: string
              inlinePolicy:
                description: An IAM policy as a JSON-encoded string that you want
                  to use as an inline session policy.
                type: string
              policyARNs:
                description: |-
                  The Amazon Resource Names (ARNs) of the IAM managed policies that you want
                  to use as managed session policies.
                  The policies must exist in the same account as the role.
                items:
                  type: string
                type: array
              roleARN:
                description: The Amazon Resource Name (ARN) of the role to assume.
                type: string
              sessionName:
                description: An identifier for the assumed role session
                type: string
              sourceIdentityRef:
                description: |-
                  SourceIdentityRef is a reference to another identity which will be chained to do
                  role assumption. All identity types are accepted.
                properties:
                  kind:
                    description: Kind of the identity.
                    enum:
                    - AWSClusterControllerIdentity
                    - AWSClusterRoleIdentity
                    - AWSClusterStaticIdentity
                    type: string
                  name:
                    description: Name of the identity.
                    minLength: 1
                    type: string
                required:
                - kind
                - name
                type: object
            required:
            - roleARN
            type: object
        type: object
    served: false
    storage: false
  - name: v1beta2
    schema:
      openAPIV3Schema:
        description: |-
          AWSClusterRoleIdentity is the Schema for the awsclusterroleidentities API
          It is used to assume a role using the provided sourceRef.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec for this AWSClusterRoleIdentity.
            properties:
              allowedNamespaces:
                description: |-
                  AllowedNamespaces is used to identify which namespaces are allowed to use the identity from.
                  Namespaces can be selected either using an array of namespaces or with label selector.
                  An empty allowedNamespaces object indicates that AWSClusters can use this identity from any namespace.
                  If this object is nil, no namespaces will be allowed (default behaviour, if this field is not provided)
                  A namespace should be either in the NamespaceList or match with Selector to use the identity.
                nullable: true
                properties:
                  list:
                    description: An nil or empty list indicates that AWSClusters cannot
                      use the identity from any namespace.
                    items:
                      type: string
                    nullable: true
                    type: array
                  selector:
                    description: |-
                      An empty selector indicates that AWSClusters cannot use this
                      AWSClusterIdentity from any namespace.
                    properties:
                      matchExpressions:
                        description: matchExpressions is a list of label selector
                          requirements. The requirements are ANDed.
                        items:
                          description: |-
                            A label selector requirement is a selector that contains values, a key, and an operator that
                            relates the key and values.
                          properties:
                            key:
                              description: key is the label key that the selector
                                applies to.
                              type: string
                            operator:
                              description: |-
                                operator represents a key's relationship to a set of values.
                                Valid operators are In, NotIn, Exists and DoesNotExist.
                              type: string
                            values:
                              description: |-
                                values is an array of string values. If the operator is In or NotIn,
                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                the values array must be empty. This array is replaced during a strategic
                                merge patch.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                          required:
                          - key
                          - operator
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                        type: object
                    type: object
                    x-kubernetes-map-type: atomic
                type: object
              durationSeconds:
                description: The duration, in seconds, of the role session before
                  it is renewed.
                format: int32
                maximum: 43200
                minimum: 900
                type: integer
              externalID:
                description: |-
                  A unique identifier that might be required when you assume a role in another account.
                  If the administrator of the account to which the role belongs provided you with an
                  external ID, then provide that value in the ExternalId parameter. This value can be
                  any string, such as a passphrase or account number. A cross-account role is usually
                  set up to trust everyone in an account. Therefore, the administrator of the trusting
                  account might send an external ID to the administrator of the trusted account. That
                  way, only someone with the ID can assume the role, rather than everyone in the
                  account. For more information about the external ID, see How to Use an External ID
                  When Granting Access to Your AWS Resources to a Third Party in the IAM User Guide.
                type: string
              inlinePolicy:
                description: An IAM policy as a JSON-encoded string that you want
                  to use as an inline session policy.
                type: string
              policyARNs:
                description: |-
                  The Amazon Resource Names (ARNs) of the IAM managed policies that you want
                  to use as managed session policies.
                  The policies must exist in the same account as the role.
                items:
                  type: string
                type: array
              roleARN:
                description: The Amazon Resource Name (ARN) of the role to assume.
                type: string
              sessionName:
                description: An identifier for the assumed role session
                type: string
              sourceIdentityRef:
                description: |-
                  SourceIdentityRef is a reference to another identity which will be chained to do
                  role assumption. All identity types are accepted.
                properties:
                  kind:
                    description: Kind of the identity.
                    enum:
                    - AWSClusterControllerIdentity
                    - AWSClusterRoleIdentity
                    - AWSClusterStaticIdentity
                    type: string
                  name:
                    description: Name of the identity.
                    minLength: 1
                    type: string
                required:
                - kind
                - name
                type: object
            required:
            - roleARN
            type: object
        type: object
    served: true
    storage: true
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
    clusterctl.cluster.x-k8s.io/move-hierarchy: ""
  name: awsclusterstaticidentities.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSClusterStaticIdentity
    listKind: AWSClusterStaticIdentityList
    plural: awsclusterstaticidentities
    shortNames:
    - awssi
    singular: awsclusterstaticidentity
  scope: Cluster
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          AWSClusterStaticIdentity is the Schema for the awsclusterstaticidentities API
          It represents a reference to an AWS access key ID and secret access key, stored in a secret.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec for this AWSClusterStaticIdentity
            properties:
              allowedNamespaces:
                description: |-
                  AllowedNamespaces is used to identify which namespaces are allowed to use the identity from.
                  Namespaces can be selected either using an array of namespaces or with label selector.
                  An empty allowedNamespaces object indicates that AWSClusters can use this identity from any namespace.
                  If this object is nil, no namespaces will be allowed (default behaviour, if this field is not provided)
                  A namespace should be either in the NamespaceList or match with Selector to use the identity.
                nullable: true
                properties:
                  list:
                    description: An nil or empty list indicates that AWSClusters cannot
                      use the identity from any namespace.
                    items:
                      type: string
                    nullable: true
                    type: array
                  selector:
                    description: |-
                      An empty selector indicates that AWSClusters cannot use this
                      AWSClusterIdentity from any namespace.
                    properties:
                      matchExpressions:
                        description: matchExpressions is a list of label selector
                          requirements. The requirements are ANDed.
                        items:
                          description: |-
                            A label selector requirement is a selector that contains values, a key, and an operator that
                            relates the key and values.
                          properties:
                            key:
                              description: key is the label key that the selector
                                applies to.
                              type: string
                            operator:
                              description: |-
                                operator represents a key's relationship to a set of values.
                                Valid operators are In, NotIn, Exists and DoesNotExist.
                              type: string
                            values:
                              description: |-
                                values is an array of string values. If the operator is In or NotIn,
                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                the values array must be empty. This array is replaced during a strategic
                                merge patch.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                          required:
                          - key
                          - operator
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                        type: object
                    type: object
                    x-kubernetes-map-type: atomic
                type: object
              secretRef:
                description: |-
                  Reference to a secret containing the credentials. The secret should
                  contain the following data keys:
                   AccessKeyID: AKIAIOSFODNN7EXAMPLE
                   SecretAccessKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
                   SessionToken: Optional
                type: string
            required:
            - secretRef
            type: object
        type: object
    served: false
    storage: false
  - name: v1beta2
    schema:
      openAPIV3Schema:
        description: |-
          AWSClusterStaticIdentity is the Schema for the awsclusterstaticidentities API
          It represents a reference to an AWS access key ID and secret access key, stored in a secret.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec for this AWSClusterStaticIdentity
            properties:
              allowedNamespaces:
                description: |-
                  AllowedNamespaces is used to identify which namespaces are allowed to use the identity from.
                  Namespaces can be selected either using an array of namespaces or with label selector.
                  An empty allowedNamespaces object indicates that AWSClusters can use this identity from any namespace.
                  If this object is nil, no namespaces will be allowed (default behaviour, if this field is not provided)
                  A namespace should be either in the NamespaceList or match with Selector to use the identity.
                nullable: true
                properties:
                  list:
                    description: An nil or empty list indicates that AWSClusters cannot
                      use the identity from any namespace.
                    items:
                      type: string
                    nullable: true
                    type: array
                  selector:
                    description: |-
                      An empty selector indicates that AWSClusters cannot use this
                      AWSClusterIdentity from any namespace.
                    properties:
                      matchExpressions:
                        description: matchExpressions is a list of label selector
                          requirements. The requirements are ANDed.
                        items:
                          description: |-
                            A label selector requirement is a selector that contains values, a key, and an operator that
                            relates the key and values.
                          properties:
                            key:
                              description: key is the label key that the selector
                                applies to.
                              type: string
                            operator:
                              description: |-
                                operator represents a key's relationship to a set of values.
                                Valid operators are In, NotIn, Exists and DoesNotExist.
                              type: string
                            values:
                              description: |-
                                values is an array of string values. If the operator is In or NotIn,
                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                the values array must be empty. This array is replaced during a strategic
                                merge patch.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                          required:
                          - key
                          - operator
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                        type: object
                    type: object
                    x-kubernetes-map-type: atomic
                type: object
              secretRef:
                description: |-
                  Reference to a secret containing the credentials. The secret should
                  contain the following data keys:
                   AccessKeyID: AKIAIOSFODNN7EXAMPLE
                   SecretAccessKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
                   SessionToken: Optional
                type: string
            required:
            - secretRef
            type: object
        type: object
    served: true
    storage: true
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
    clusterctl.cluster.x-k8s.io/move-hierarchy: ""
  name: awsclustercontrolleridentities.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSClusterControllerIdentity
    listKind: AWSClusterControllerIdentityList
    plural: awsclustercontrolleridentities
    shortNames:
    - awsci
    singular: awsclustercontrolleridentity
  scope: Cluster
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: |-
          AWSClusterControllerIdentity is the Schema for the awsclustercontrolleridentities API
          It is used to grant access to use Cluster API Provider AWS Controller credentials.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec for this AWSClusterControllerIdentity.
            properties:
              allowedNamespaces:
                description: |-
                  AllowedNamespaces is used to identify which namespaces are allowed to use the identity from.
                  Namespaces can be selected either using an array of namespaces or with label selector.
                  An empty allowedNamespaces object indicates that AWSClusters can use this identity from any namespace.
                  If this object is nil, no namespaces will be allowed (default behaviour, if this field is not provided)
                  A namespace should be either in the NamespaceList or match with Selector to use the identity.
                nullable: true
                properties:
                  list:
                    description: An nil or empty list indicates that AWSClusters cannot
                      use the identity from any namespace.
                    items:
                      type: string
                    nullable: true
                    type: array
                  selector:
                    description: |-
                      An empty selector indicates that AWSClusters cannot use this
                      AWSClusterIdentity from any namespace.
                    properties:
                      matchExpressions:
                        description: matchExpressions is a list of label selector
                          requirements. The requirements are ANDed.
                        items:
                          description: |-
                            A label selector requirement is a selector that contains values, a key, and an operator that
                            relates the key and values.
                          properties:
                            key:
                              description: key is the label key that the selector
                                applies to.
                              type: string
                            operator:
                              description: |-
                                operator represents a key's relationship to a set of values.
                                Valid operators are In, NotIn, Exists and DoesNotExist.
                              type: string
                            values:
                              description: |-
                                values is an array of string values. If the operator is In or NotIn,
                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                the values array must be empty. This array is replaced during a strategic
                                merge patch.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                          required:
                          - key
                          - operator
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                        type: object
                    type: object
                    x-kubernetes-map-type: atomic
                type: object
            type: object
        type: object
    served: false
    storage: false
  - name: v1beta2
    schema:
      openAPIV3Schema:
        description: |-
          AWSClusterControllerIdentity is the Schema for the awsclustercontrolleridentities API
          It is used to grant access to use Cluster API Provider AWS Controller credentials.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec for this AWSClusterControllerIdentity.
            properties:
              allowedNamespaces:
                description: |-
                  AllowedNamespaces is used to identify which namespaces are allowed to use the identity from.
                  Namespaces can be selected either using an array of namespaces or with label selector.
                  An empty allowedNamespaces object indicates that AWSClusters can use this identity from any namespace.
                  If this object is nil, no namespaces will be allowed (default behaviour, if this field is not provided)
                  A namespace should be either in the NamespaceList or match with Selector to use the identity.
                nullable: true
                properties:
                  list:
                    description: An nil or empty list indicates that AWSClusters cannot
                      use the identity from any namespace.
                    items:
                      type: string
                    nullable: true
                    type: array
                  selector:
                    description: |-
                      An empty selector indicates that AWSClusters cannot use this
                      AWSClusterIdentity from any namespace.
                    properties:
                      matchExpressions:
                        description: matchExpressions is a list of label selector
                          requirements. The requirements are ANDed.
                        items:
                          description: |-
                            A label selector requirement is a selector that contains values, a key, and an operator that
                            relates the key and values.
                          properties:
                            key:
                              description: key is the label key that the selector
                                applies to.
                              type: string
                            operator:
                              description: |-
                                operator represents a key's relationship to a set of values.
                                Valid operators are In, NotIn, Exists and DoesNotExist.
                              type: string
                            values:
                              description: |-
                                values is an array of string values. If the operator is In or NotIn,
                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                the values array must be empty. This array is replaced during a strategic
                                merge patch.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                          required:
                          - key
                          - operator
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                        type: object
                    type: object
                    x-kubernetes-map-type: atomic
                type: object
            type: object
        type: object
    served: true
    storage: true
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsclustertemplates.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSClusterTemplate
    listKind: AWSClusterTemplateList
    plural: awsclustertemplates
    shortNames:
    - awsct
    singular: awsclustertemplate
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Time duration since creation of AWSClusterTemplate
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: AWSClusterTemplate is the schema for Amazon EC2 based Kubernetes
          Cluster Templates.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSClusterTemplateSpec defines the desired state of AWSClusterTemplate.
            properties:
              template:
                description: AWSClusterTemplateResource defines the desired state
                  of AWSClusterTemplate.
                properties:
                  metadata:
                    description: |-
                      Standard object's metadata.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        description: |-
                          Annotations is an unstructured key value map stored with a resource that may be
                          set by external tools to store and retrieve arbitrary metadata. They are not
                          queryable and should be preserved when modifying objects.
                          More info: http://kubernetes.io/docs/user-guide/annotations
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        description: |-
                          Map of string keys and values that can be used to organize and categorize
                          (scope and select) objects. May match selectors of replication controllers
                          and services.
                          More info: http://kubernetes.io/docs/user-guide/labels
                        type: object
                    type: object
                  spec:
                    description: AWSClusterSpec defines the desired state of an EC2-based
                      Kubernetes cluster.
                    properties:
                      additionalTags:
                        additionalProperties:
                          type: string
                        description: |-
                          AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                          ones added by default.
                        type: object
                      bastion:
                        description: Bastion contains options to configure the bastion
                          host.
                        properties:
                          allowedCIDRBlocks:
                            description: |-
                              AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
                              They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
                            items:
                              type: string
                            type: array
                          ami:
                            description: |-
                              AMI will use the specified AMI to boot the bastion. If not specified,
                              the AMI will default to one picked out in public space.
                            type: string
                          disableIngressRules:
                            description: |-
                              DisableIngressRules will ensure there are no Ingress rules in the bastion host's security group.
                              Requires AllowedCIDRBlocks to be empty.
                            type: boolean
                          enabled:
                            description: |-
                              Enabled allows this provider to create a bastion host instance
                              with a public ip to access the VPC private network.
                            type: boolean
                          instanceType:
                            description: |-
                              InstanceType will use the specified instance type for the bastion. If not specified,
                              Cluster API Provider AWS will use t3.micro for all regions except us-east-1, where t2.micro
                              will be the default.
                            type: string
                        type: object
                      controlPlaneEndpoint:
                        description: ControlPlaneEndpoint represents the endpoint
                          used to communicate with the control plane.
                        properties:
                          host:
                            description: The hostname on which the API server is serving.
                            type: string
                          port:
                            description: The port on which the API server is serving.
                            format: int32
                            type: integer
                        required:
                        - host
                        - port
                        type: object
                      controlPlaneLoadBalancer:
                        description: ControlPlaneLoadBalancer is optional configuration
                          for customizing control plane behavior.
                        properties:
                          additionalSecurityGroups:
                            description: |-
                              AdditionalSecurityGroups sets the security groups used by the load balancer. Expected to be security group IDs
                              This is optional - if not provided new security groups will be created for the load balancer
                            items:
                              type: string
                            type: array
                          crossZoneLoadBalancing:
                            description: |-
                              CrossZoneLoadBalancing enables the classic ELB cross availability zone balancing.


                              With cross-zone load balancing, each load balancer node for your Classic Load Balancer
                              distributes requests evenly across the registered instances in all enabled Availability Zones.
                              If cross-zone load balancing is disabled, each load balancer node distributes requests evenly across
                              the registered instances in its Availability Zone only.


                              Defaults to false.
                            type: boolean
                          healthCheckProtocol:
                            description: |-
                              HealthCheckProtocol sets the protocol type for classic ELB health check target
                              default value is ClassicELBProtocolSSL
                            type: string
                          name:
                            description: |-
                              Name sets the name of the classic ELB load balancer. As per AWS, the name must be unique
                              within your set of load balancers for the region, must have a maximum of 32 characters, must
                              contain only alphanumeric characters or hyphens, and cannot begin or end with a hyphen. Once
                              set, the value cannot be changed.
                            maxLength: 32
                            pattern: ^[A-Za-z0-9]([A-Za-z0-9]{0,31}|[-A-Za-z0-9]{0,30}[A-Za-z0-9])$
                            type: string
                          scheme:
                            default: internet-facing
                            description: Scheme sets the scheme of the load balancer
                              (defaults to internet-facing)
                            enum:
                            - internet-facing
                            - internal
                            type: string
                          subnets:
                            description: Subnets sets the subnets that should be applied
                              to the control plane load balancer (defaults to discovered
                              subnets for managed VPCs or an empty set for unmanaged
                              VPCs)
                            items:
                              type: string
                            type: array
                        type: object
                      identityRef:
                        description: |-
                          IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
                          If no identity is specified, the default identity for this controller will be used.
                        properties:
                          kind:
                            description: Kind of the identity.
                            enum:
                            - AWSClusterControllerIdentity
                            - AWSClusterRoleIdentity
                            - AWSClusterStaticIdentity
                            type: string
                          name:
                            description: Name of the identity.
                            minLength: 1
                            type: string
                        required:
                        - kind
                        - name
                        type: object
                      imageLookupBaseOS:
                        description: |-
                          ImageLookupBaseOS is the name of the base operating system used to look
                          up machine images when a machine does not specify an AMI. When set, this
                          will be used for all cluster machines unless a machine specifies a
                          different ImageLookupBaseOS.
                        type: string
                      imageLookupFormat:
                        description: |-
                          ImageLookupFormat is the AMI naming format to look up machine images when
                          a machine does not specify an AMI. When set, this will be used for all
                          cluster machines unless a machine specifies a different ImageLookupOrg.
                          Supports substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base
                          OS and kubernetes version, respectively. The BaseOS will be the value in
                          ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                          defined by the packages produced by kubernetes/release without v as a
                          prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                          image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                          searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                          Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                          also: https://golang.org/pkg/text/template/
                        type: string
                      imageLookupOrg:
                        description: |-
                          ImageLookupOrg is the AWS Organization ID to look up machine images when a
                          machine does not specify an AMI. When set, this will be used for all
                          cluster machines unless a machine specifies a different ImageLookupOrg.
                        type: string
                      network:
                        description: NetworkSpec encapsulates all things related to
                          AWS network.
                        properties:
                          cni:
                            description: CNI configuration
                            properties:
                              cniIngressRules:
                                description: |-
                                  CNIIngressRules specify rules to apply to control plane and worker node security groups.
                                  The source for the rule will be set to control plane and worker security group IDs.
                                items:
                                  description: CNIIngressRule defines an AWS ingress
                                    rule for CNI requirements.
                                  properties:
                                    description:
                                      type: string
                                    fromPort:
                                      format: int64
                                      type: integer
                                    protocol:
                                      description: SecurityGroupProtocol defines the
                                        protocol type for a security group rule.
                                      type: string
                                    toPort:
                                      format: int64
                                      type: integer
                                  required:
                                  - description
                                  - fromPort
                                  - protocol
                                  - toPort
                                  type: object
                                type: array
                            type: object
                          securityGroupOverrides:
                            additionalProperties:
                              type: string
                            description: |-
                              SecurityGroupOverrides is an optional set of security groups to use for cluster instances
                              This is optional - if not provided new security groups will be created for the cluster
                            type: object
                          subnets:
                            description: Subnets configuration.
                            items:
                              description: SubnetSpec configures an AWS Subnet.
                              properties:
                                availabilityZone:
                                  description: AvailabilityZone defines the availability
                                    zone to use for this subnet in the cluster's region.
                                  type: string
                                cidrBlock:
                                  description: CidrBlock is the CIDR block to be used
                                    when the provider creates a managed VPC.
                                  type: string
                                id:
                                  description: ID defines a unique identifier to reference
                                    this resource.
                                  type: string
                                ipv6CidrBlock:
                                  description: |-
                                    IPv6CidrBlock is the IPv6 CIDR block to be used when the provider creates a managed VPC.
                                    A subnet can have an IPv4 and an IPv6 address.
                                    IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                                  type: string
                                isIpv6:
                                  description: |-
                                    IsIPv6 defines the subnet as an IPv6 subnet. A subnet is IPv6 when it is associated with a VPC that has IPv6 enabled.
                                    IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                                  type: boolean
                                isPublic:
                                  description: IsPublic defines the subnet as a public
                                    subnet. A subnet is public when it is associated
                                    with a route table that has a route to an internet
                                    gateway.
                                  type: boolean
                                natGatewayId:
                                  description: |-
                                    NatGatewayID is the NAT gateway id associated with the subnet.
                                    Ignored unless the subnet is managed by the provider, in which case this is set on the public subnet where the NAT gateway resides. It is then used to determine routes for private subnets in the same AZ as the public subnet.
                                  type: string
                                routeTableId:
                                  description: RouteTableID is the routing table id
                                    associated with the subnet.
                                  type: string
                                tags:
                                  additionalProperties:
                                    type: string
                                  description: Tags is a collection of tags describing
                                    the resource.
                                  type: object
                              type: object
                            type: array
                          vpc:
                            description: VPC configuration.
                            properties:
                              availabilityZoneSelection:
                                default: Ordered
                                description: |-
                                  AvailabilityZoneSelection specifies how AZs should be selected if there are more AZs
                                  in a region than specified by AvailabilityZoneUsageLimit. There are 2 selection schemes:
                                  Ordered - selects based on alphabetical order
                                  Random - selects AZs randomly in a region
                                  Defaults to Ordered
                                enum:
                                - Ordered
                                - Random
                                type: string
                              availabilityZoneUsageLimit:
                                default: 3
                                description: |-
                                  AvailabilityZoneUsageLimit specifies the maximum number of availability zones (AZ) that
                                  should be used in a region when automatically creating subnets. If a region has more
                                  than this number of AZs then this number of AZs will be picked randomly when creating
                                  default subnets. Defaults to 3
                                minimum: 1
                                type: integer
                              cidrBlock:
                                description: |-
                                  CidrBlock is the CIDR block to be used when the provider creates a managed VPC.
                                  Defaults to 10.0.0.0/16.
                                type: string
                              id:
                                description: ID is the vpc-id of the VPC this provider
                                  should use to create resources.
                                type: string
                              internetGatewayId:
                                description: InternetGatewayID is the id of the internet
                                  gateway associated with the VPC.
                                type: string
                              ipv6:
                                description: |-
                                  IPv6 contains ipv6 specific settings for the network. Supported only in managed clusters.
                                  This field cannot be set on AWSCluster object.
                                properties:
                                  cidrBlock:
                                    description: CidrBlock is the CIDR block provided
                                      by Amazon when VPC has enabled IPv6.
                                    type: string
                                  egressOnlyInternetGatewayId:
                                    description: EgressOnlyInternetGatewayID is the
                                      id of the egress only internet gateway associated
                                      with an IPv6 enabled VPC.
                                    type: string
                                  poolId:
                                    description: PoolID is the IP pool which must
                                      be defined in case of BYO IP is defined.
                                    type: string
                                type: object
                              tags:
                                additionalProperties:
                                  type: string
                                description: Tags is a collection of tags describing
                                  the resource.
                                type: object
                            type: object
                        type: object
                      region:
                        description: The AWS Region the cluster lives in.
                        type: string
                      s3Bucket:
                        description: |-
                          S3Bucket contains options to configure a supporting S3 bucket for this
                          cluster - currently used for nodes requiring Ignition
                          (https://coreos.github.io/ignition/) for bootstrapping (requires
                          BootstrapFormatIgnition feature flag to be enabled).
                        properties:
                          controlPlaneIAMInstanceProfile:
                            description: |-
                              ControlPlaneIAMInstanceProfile is a name of the IAMInstanceProfile, which will be allowed
                              to read control-plane node bootstrap data from S3 Bucket.
                            type: string
                          name:
                            description: Name defines name of S3 Bucket to be created.
                            maxLength: 63
                            minLength: 3
                            pattern: ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$
                            type: string
                          nodesIAMInstanceProfiles:
                            description: |-
                              NodesIAMInstanceProfiles is a list of IAM instance profiles, which will be allowed to read
                              worker nodes bootstrap data from S3 Bucket.
                            items:
                              type: string
                            type: array
                        required:
                        - controlPlaneIAMInstanceProfile
                        - name
                        - nodesIAMInstanceProfiles
                        type: object
                      sshKeyName:
                        description: SSHKeyName is the name of the ssh key to attach
                          to the bastion host. Valid values are empty string (do not
                          use SSH keys), a valid SSH key name, or omitted (use the
                          default SSH key name)
                        type: string
                    type: object
                required:
                - spec
                type: object
            required:
            - template
            type: object
        type: object
    served: false
    storage: false
    subresources: {}
  - additionalPrinterColumns:
    - description: Time duration since creation of AWSClusterTemplate
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSClusterTemplate is the schema for Amazon EC2 based Kubernetes
          Cluster Templates.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSClusterTemplateSpec defines the desired state of AWSClusterTemplate.
            properties:
              template:
                description: AWSClusterTemplateResource defines the desired state
                  of AWSClusterTemplateResource.
                properties:
                  metadata:
                    description: |-
                      Standard object's metadata.
                      More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        description: |-
                          Annotations is an unstructured key value map stored with a resource that may be
                          set by external tools to store and retrieve arbitrary metadata. They are not
                          queryable and should be preserved when modifying objects.
                          More info: http://kubernetes.io/docs/user-guide/annotations
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        description: |-
                          Map of string keys and values that can be used to organize and categorize
                          (scope and select) objects. May match selectors of replication controllers
                          and services.
                          More info: http://kubernetes.io/docs/user-guide/labels
                        type: object
                    type: object
                  spec:
                    description: AWSClusterSpec defines the desired state of an EC2-based
                      Kubernetes cluster.
                    properties:
                      additionalTags:
                        additionalProperties:
                          type: string
                        description: |-
                          AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                          ones added by default.
                        type: object
                      bastion:
                        description: Bastion contains options to configure the bastion
                          host.
                        properties:
                          allowedCIDRBlocks:
                            description: |-
                              AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
                              They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
                            items:
                              type: string
                            type: array
                          ami:
                            description: |-
                              AMI will use the specified AMI to boot the bastion. If not specified,
                              the AMI will default to one picked out in public space.
                            type: string
                          disableIngressRules:
                            description: |-
                              DisableIngressRules will ensure there are no Ingress rules in the bastion host's security group.
                              Requires AllowedCIDRBlocks to be empty.
                            type: boolean
                          enabled:
                            description: |-
                              Enabled allows this provider to create a bastion host instance
                              with a public ip to access the VPC private network.
                            type: boolean
                          instanceType:
                            description: |-
                              InstanceType will use the specified instance type for the bastion. If not specified,
                              Cluster API Provider AWS will use t3.micro for all regions except us-east-1, where t2.micro
                              will be the default.
                            type: string
                        type: object
                      controlPlaneEndpoint:
                        description: ControlPlaneEndpoint represents the endpoint
                          used to communicate with the control plane.
                        properties:
                          host:
                            description: The hostname on which the API server is serving.
                            type: string
                          port:
                            description: The port on which the API server is serving.
                            format: int32
                            type: integer
                        required:
                        - host
                        - port
                        type: object
                      controlPlaneLoadBalancer:
                        description: ControlPlaneLoadBalancer is optional configuration
                          for customizing control plane behavior.
                        properties:
                          additionalListeners:
                            description: |-
                              AdditionalListeners sets the additional listeners for the control plane load balancer.
                              This is only applicable to Network Load Balancer (NLB) types for the time being.
                            items:
                              description: |-
                                AdditionalListenerSpec defines the desired state of an
                                additional listener on an AWS load balancer.
                              properties:
                                healthCheck:
                                  description: HealthCheck sets the optional custom
                                    health check configuration to the API target group.
                                  properties:
                                    intervalSeconds:
                                      description: |-
                                        The approximate amount of time, in seconds, between health checks of an individual
                                        target.
                                      format: int64
                                      maximum: 300
                                      minimum: 5
                                      type: integer
                                    path:
                                      description: |-
                                        The destination for health checks on the targets when using the protocol HTTP or HTTPS,
                                        otherwise the path will be ignored.
                                      type: string
                                    port:
                                      description: |-
                                        The port the load balancer uses when performing health checks for additional target groups. When
                                        not specified this value will be set for the same of listener port.
                                      type: string
                                    protocol:
                                      description: |-
                                        The protocol to use to health check connect with the target. When not specified the Protocol
                                        will be the same of the listener.
                                      enum:
                                      - TCP
                                      - HTTP
                                      - HTTPS
                                      type: string
                                    thresholdCount:
                                      description: |-
                                        The number of consecutive health check successes required before considering
                                        a target healthy.
                                      format: int64
                                      maximum: 10
                                      minimum: 2
                                      type: integer
                                    timeoutSeconds:
                                      description: |-
                                        The amount of time, in seconds, during which no response from a target means
                                        a failed health check.
                                      format: int64
                                      maximum: 120
                                      minimum: 2
                                      type: integer
                                    unhealthyThresholdCount:
                                      description: |-
                                        The number of consecutive health check failures required before considering
                                        a target unhealthy.
                                      format: int64
                                      maximum: 10
                                      minimum: 2
                                      type: integer
                                  type: object
                                port:
                                  description: Port sets the port for the additional
                                    listener.
                                  format: int64
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                                protocol:
                                  default: TCP
                                  description: |-
                                    Protocol sets the protocol for the additional listener.
                                    Currently only TCP is supported.
                                  enum:
                                  - TCP
                                  type: string
                              required:
                              - port
                              type: object
                            type: array
                            x-kubernetes-list-map-keys:
                            - port
                            x-kubernetes-list-type: map
                          additionalSecurityGroups:
                            description: |-
                              AdditionalSecurityGroups sets the security groups used by the load balancer. Expected to be security group IDs
                              This is optional - if not provided new security groups will be created for the load balancer
                            items:
                              type: string
                            type: array
                          crossZoneLoadBalancing:
                            description: |-
                              CrossZoneLoadBalancing enables the classic ELB cross availability zone balancing.


                              With cross-zone load balancing, each load balancer node for your Classic Load Balancer
                              distributes requests evenly across the registered instances in all enabled Availability Zones.
                              If cross-zone load balancing is disabled, each load balancer node distributes requests evenly across
                              the registered instances in its Availability Zone only.


                              Defaults to false.
                            type: boolean
                          disableHostsRewrite:
                            description: |-
                              DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
                              file of each instance. This is by default, false.
                            type: boolean
                          healthCheck:
                            description: HealthCheck sets custom health check configuration
                              to the API target group.
                            properties:
                              intervalSeconds:
                                description: |-
                                  The approximate amount of time, in seconds, between health checks of an individual
                                  target.
                                format: int64
                                maximum: 300
                                minimum: 5
                                type: integer
                              thresholdCount:
                                description: |-
                                  The number of consecutive health check successes required before considering
                                  a target healthy.
                                format: int64
                                maximum: 10
                                minimum: 2
                                type: integer
                              timeoutSeconds:
                                description: |-
                                  The amount of time, in seconds, during which no response from a target means
                                  a failed health check.
                                format: int64
                                maximum: 120
                                minimum: 2
                                type: integer
                              unhealthyThresholdCount:
                                description: |-
                                  The number of consecutive health check failures required before considering
                                  a target unhealthy.
                                format: int64
                                maximum: 10
                                minimum: 2
                                type: integer
                            type: object
                          healthCheckProtocol:
                            description: |-
                              HealthCheckProtocol sets the protocol type for ELB health check target
                              default value is ELBProtocolSSL
                            enum:
                            - TCP
                            - SSL
                            - HTTP
                            - HTTPS
                            - TLS
                            - UDP
                            type: string
                          ingressRules:
                            description: IngressRules sets the ingress rules for the
                              control plane load balancer.
                            items:
                              description: IngressRule defines an AWS ingress rule
                                for security groups.
                              properties:
                                cidrBlocks:
                                  description: List of CIDR blocks to allow access
                                    from. Cannot be specified with SourceSecurityGroupID.
                                  items:
                                    type: string
                                  type: array
                                description:
                                  description: Description provides extended information
                                    about the ingress rule.
                                  type: string
                                fromPort:
                                  description: FromPort is the start of port range.
                                  format: int64
                                  type: integer
                                ipv6CidrBlocks:
                                  description: List of IPv6 CIDR blocks to allow access
                                    from. Cannot be specified with SourceSecurityGroupID.
                                  items:
                                    type: string
                                  type: array
                                natGatewaysIPsSource:
                                  description: NatGatewaysIPsSource use the NAT gateways
                                    IPs as the source for the ingress rule.
                                  type: boolean
                                protocol:
                                  description: Protocol is the protocol for the ingress
                                    rule. Accepted values are "-1" (all), "4" (IP
                                    in IP),"tcp", "udp", "icmp", and "58" (ICMPv6),
                                    "50" (ESP).
                                  enum:
                                  - "-1"
                                  - "4"
                                  - tcp
                                  - udp
                                  - icmp
                                  - "58"
                                  - "50"
                                  type: string
                                sourceSecurityGroupIds:
                                  description: The security group id to allow access
                                    from. Cannot be specified with CidrBlocks.
                                  items:
                                    type: string
                                  type: array
                                sourceSecurityGroupRoles:
                                  description: |-
                                    The security group role to allow access from. Cannot be specified with CidrBlocks.
                                    The field will be combined with source security group IDs if specified.
                                  items:
                                    description: SecurityGroupRole defines the unique
                                      role of a security group.
                                    enum:
                                    - bastion
                                    - node
                                    - controlplane
                                    - apiserver-lb
                                    - lb
                                    - node-eks-additional
                                    type: string
                                  type: array
                                toPort:
                                  description: ToPort is the end of port range.
                                  format: int64
                                  type: integer
                              required:
                              - description
                              - fromPort
                              - protocol
                              - toPort
                              type: object
                            type: array
                          loadBalancerType:
                            default: classic
                            description: LoadBalancerType sets the type for a load
                              balancer. The default type is classic.
                            enum:
                            - classic
                            - elb
                            - alb
                            - nlb
                            - disabled
                            type: string
                          name:
                            description: |-
                              Name sets the name of the classic ELB load balancer. As per AWS, the name must be unique
                              within your set of load balancers for the region, must have a maximum of 32 characters, must
                              contain only alphanumeric characters or hyphens, and cannot begin or end with a hyphen. Once
                              set, the value cannot be changed.
                            maxLength: 32
                            pattern: ^[A-Za-z0-9]([A-Za-z0-9]{0,31}|[-A-Za-z0-9]{0,30}[A-Za-z0-9])$
                            type: string
                          preserveClientIP:
                            description: |-
                              PreserveClientIP lets the user control if preservation of client ips must be retained or not.
                              If this is enabled 6443 will be opened to 0.0.0.0/0.
                            type: boolean
                          scheme:
                            default: internet-facing
                            description: Scheme sets the scheme of the load balancer
                              (defaults to internet-facing)
                            enum:
                            - internet-facing
                            - internal
                            type: string
                          subnets:
                            description: Subnets sets the subnets that should be applied
                              to the control plane load balancer (defaults to discovered
                              subnets for managed VPCs or an empty set for unmanaged
                              VPCs)
                            items:
                              type: string
                            type: array
                        type: object
                      identityRef:
                        description: |-
                          IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
                          If no identity is specified, the default identity for this controller will be used.
                        properties:
                          kind:
                            description: Kind of the identity.
                            enum:
                            - AWSClusterControllerIdentity
                            - AWSClusterRoleIdentity
                            - AWSClusterStaticIdentity
                            type: string
                          name:
                            description: Name of the identity.
                            minLength: 1
                            type: string
                        required:
                        - kind
                        - name
                        type: object
                      imageLookupBaseOS:
                        description: |-
                          ImageLookupBaseOS is the name of the base operating system used to look
                          up machine images when a machine does not specify an AMI. When set, this
                          will be used for all cluster machines unless a machine specifies a
                          different ImageLookupBaseOS.
                        type: string
                      imageLookupFormat:
                        description: |-
                          ImageLookupFormat is the AMI naming format to look up machine images when
                          a machine does not specify an AMI. When set, this will be used for all
                          cluster machines unless a machine specifies a different ImageLookupOrg.
                          Supports substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base
                          OS and kubernetes version, respectively. The BaseOS will be the value in
                          ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                          defined by the packages produced by kubernetes/release without v as a
                          prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                          image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                          searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                          Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                          also: https://golang.org/pkg/text/template/
                        type: string
                      imageLookupOrg:
                        description: |-
                          ImageLookupOrg is the AWS Organization ID to look up machine images when a
                          machine does not specify an AMI. When set, this will be used for all
                          cluster machines unless a machine specifies a different ImageLookupOrg.
                        type: string
                      network:
                        description: NetworkSpec encapsulates all things related to
                          AWS network.
                        properties:
                          additionalControlPlaneIngressRules:
                            description: AdditionalControlPlaneIngressRules is an
                              optional set of ingress rules to add to the control
                              plane
                            items:
                              description: IngressRule defines an AWS ingress rule
                                for security groups.
                              properties:
                                cidrBlocks:
                                  description: List of CIDR blocks to allow access
                                    from. Cannot be specified with SourceSecurityGroupID.
                                  items:
                                    type: string
                                  type: array
                                description:
                                  description: Description provides extended information
                                    about the ingress rule.
                                  type: string
                                fromPort:
                                  description: FromPort is the start of port range.
                                  format: int64
                                  type: integer
                                ipv6CidrBlocks:
                                  description: List of IPv6 CIDR blocks to allow access
                                    from. Cannot be specified with SourceSecurityGroupID.
                                  items:
                                    type: string
                                  type: array
                                natGatewaysIPsSource:
                                  description: NatGatewaysIPsSource use the NAT gateways
                                    IPs as the source for the ingress rule.
                                  type: boolean
                                protocol:
                                  description: Protocol is the protocol for the ingress
                                    rule. Accepted values are "-1" (all), "4" (IP
                                    in IP),"tcp", "udp", "icmp", and "58" (ICMPv6),
                                    "50" (ESP).
                                  enum:
                                  - "-1"
                                  - "4"
                                  - tcp
                                  - udp
                                  - icmp
                                  - "58"
                                  - "50"
                                  type: string
                                sourceSecurityGroupIds:
                                  description: The security group id to allow access
                                    from. Cannot be specified with CidrBlocks.
                                  items:
                                    type: string
                                  type: array
                                sourceSecurityGroupRoles:
                                  description: |-
                                    The security group role to allow access from. Cannot be specified with CidrBlocks.
                                    The field will be combined with source security group IDs if specified.
                                  items:
                                    description: SecurityGroupRole defines the unique
                                      role of a security group.
                                    enum:
                                    - bastion
                                    - node
                                    - controlplane
                                    - apiserver-lb
                                    - lb
                                    - node-eks-additional
                                    type: string
                                  type: array
                                toPort:
                                  description: ToPort is the end of port range.
                                  format: int64
                                  type: integer
                              required:
                              - description
                              - fromPort
                              - protocol
                              - toPort
                              type: object
                            type: array
                          cni:
                            description: CNI configuration
                            properties:
                              cniIngressRules:
                                description: |-
                                  CNIIngressRules specify rules to apply to control plane and worker node security groups.
                                  The source for the rule will be set to control plane and worker security group IDs.
                                items:
                                  description: CNIIngressRule defines an AWS ingress
                                    rule for CNI requirements.
                                  properties:
                                    description:
                                      type: string
                                    fromPort:
                                      format: int64
                                      type: integer
                                    protocol:
                                      description: SecurityGroupProtocol defines the
                                        protocol type for a security group rule.
                                      type: string
                                    toPort:
                                      format: int64
                                      type: integer
                                  required:
                                  - description
                                  - fromPort
                                  - protocol
                                  - toPort
                                  type: object
                                type: array
                            type: object
                          nodePortIngressRuleCidrBlocks:
                            description: |-
                              NodePortIngressRuleCidrBlocks is an optional set of CIDR blocks to allow traffic to nodes' NodePort services.
                              If none are specified here, all IPs are allowed to connect.
                            items:
                              type: string
                            type: array
                          securityGroupOverrides:
                            additionalProperties:
                              type: string
                            description: |-
                              SecurityGroupOverrides is an optional set of security groups to use for cluster instances
                              This is optional - if not provided new security groups will be created for the cluster
                            type: object
                          subnets:
                            description: Subnets configuration.
                            items:
                              description: SubnetSpec configures an AWS Subnet.
                              properties:
                                availabilityZone:
                                  description: AvailabilityZone defines the availability
                                    zone to use for this subnet in the cluster's region.
                                  type: string
                                cidrBlock:
                                  description: CidrBlock is the CIDR block to be used
                                    when the provider creates a managed VPC.
                                  type: string
                                id:
                                  description: |-
                                    ID defines a unique identifier to reference this resource.
                                    If you're bringing your subnet, set the AWS subnet-id here, it must start with `subnet-`.


                                    When the VPC is managed by CAPA, and you'd like the provider to create a subnet for you,
                                    the id can be set to any placeholder value that does not start with `subnet-`;
                                    upon creation, the subnet AWS identifier will be populated in the `ResourceID` field and
                                    the `id` field is going to be used as the subnet name. If you specify a tag
                                    called `Name`, it takes precedence.
                                  type: string
                                ipv6CidrBlock:
                                  description: |-
                                    IPv6CidrBlock is the IPv6 CIDR block to be used when the provider creates a managed VPC.
                                    A subnet can have an IPv4 and an IPv6 address.
                                    IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                                  type: string
                                isIpv6:
                                  description: |-
                                    IsIPv6 defines the subnet as an IPv6 subnet. A subnet is IPv6 when it is associated with a VPC that has IPv6 enabled.
                                    IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                                  type: boolean
                                isPublic:
                                  description: IsPublic defines the subnet as a public
                                    subnet. A subnet is public when it is associated
                                    with a route table that has a route to an internet
                                    gateway.
                                  type: boolean
                                natGatewayId:
                                  description: |-
                                    NatGatewayID is the NAT gateway id associated with the subnet.
                                    Ignored unless the subnet is managed by the provider, in which case this is set on the public subnet where the NAT gateway resides. It is then used to determine routes for private subnets in the same AZ as the public subnet.
                                  type: string
                                parentZoneName:
                                  description: |-
                                    ParentZoneName is the zone name where the current subnet's zone is tied when
                                    the zone is a Local Zone.


                                    The subnets in Local Zone or Wavelength Zone locations consume the ParentZoneName
                                    to select the correct private route table to egress traffic to the internet.
                                  type: string
                                resourceID:
                                  description: |-
                                    ResourceID is the subnet identifier from AWS, READ ONLY.
                                    This field is populated when the provider manages the subnet.
                                  type: string
                                routeTableId:
                                  description: RouteTableID is the routing table id
                                    associated with the subnet.
                                  type: string
                                tags:
                                  additionalProperties:
                                    type: string
                                  description: Tags is a collection of tags describing
                                    the resource.
                                  type: object
                                zoneType:
                                  description: |-
                                    ZoneType defines the type of the zone where the subnet is created.


                                    The valid values are availability-zone, local-zone, and wavelength-zone.


                                    Subnet with zone type availability-zone (regular) is always selected to create cluster
                                    resources, like Load Balancers, NAT Gateways, Contol Plane nodes, etc.


                                    Subnet with zone type local-zone or wavelength-zone is not eligible to automatically create
                                    regular cluster resources.


                                    The public subnet in availability-zone or local-zone is associated with regular public
                                    route table with default route entry to a Internet Gateway.


                                    The public subnet in wavelength-zone is associated with a carrier public
                                    route table with default route entry to a Carrier Gateway.


                                    The private subnet in the availability-zone is associated with a private route table with
                                    the default route entry to a NAT Gateway created in that zone.


                                    The private subnet in the local-zone or wavelength-zone is associated with a private route table with
                                    the default route entry re-using the NAT Gateway in the Region (preferred from the
                                    parent zone, the zone type availability-zone in the region, or first table available).
                                  enum:
                                  - availability-zone
                                  - local-zone
                                  - wavelength-zone
                                  type: string
                              required:
                              - id
                              type: object
                            type: array
                            x-kubernetes-list-map-keys:
                            - id
                            x-kubernetes-list-type: map
                          vpc:
                            description: VPC configuration.
                            properties:
                              availabilityZoneSelection:
                                default: Ordered
                                description: |-
                                  AvailabilityZoneSelection specifies how AZs should be selected if there are more AZs
                                  in a region than specified by AvailabilityZoneUsageLimit. There are 2 selection schemes:
                                  Ordered - selects based on alphabetical order
                                  Random - selects AZs randomly in a region
                                  Defaults to Ordered
                                enum:
                                - Ordered
                                - Random
                                type: string
                              availabilityZoneUsageLimit:
                                default: 3
                                description: |-
                                  AvailabilityZoneUsageLimit specifies the maximum number of availability zones (AZ) that
                                  should be used in a region when automatically creating subnets. If a region has more
                                  than this number of AZs then this number of AZs will be picked randomly when creating
                                  default subnets. Defaults to 3
                                minimum: 1
                                type: integer
                              carrierGatewayId:
                                description: |-
                                  CarrierGatewayID is the id of the internet gateway associated with the VPC,
                                  for carrier network (Wavelength Zones).
                                type: string
                                x-kubernetes-validations:
                                - message: Carrier Gateway ID must start with 'cagw-'
                                  rule: self.startsWith('cagw-')
                              cidrBlock:
                                description: |-
                                  CidrBlock is the CIDR block to be used when the provider creates a managed VPC.
                                  Defaults to 10.0.0.0/16.
                                  Mutually exclusive with IPAMPool.
                                type: string
                              elasticIpPool:
                                description: |-
                                  ElasticIPPool contains specific configuration to allocate Public IPv4 address (Elastic IP) from user-defined pool
                                  brought to AWS for core infrastructure resources, like NAT Gateways and Public Network Load Balancers for
                                  the API Server.
                                properties:
                                  publicIpv4Pool:
                                    description: |-
                                      PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources
                                      created in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom
                                      Public IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool
                                      resource ID starts with 'ipv4pool-ec2'.
                                    maxLength: 30
                                    type: string
                                  publicIpv4PoolFallbackOrder:
                                    description: |-
                                      PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,
                                      no more IPv4 address available in the pool.


                                      When set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the
                                      IPv4 limit, the address will be claimed from Amazon-pool (default).


                                      When set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.
                                    enum:
                                    - amazon-pool
                                    - none
                                    type: string
                                    x-kubernetes-validations:
                                    - message: allowed values are 'none' and 'amazon-pool'
                                      rule: self in ['none','amazon-pool']
                                type: object
                              emptyRoutesDefaultVPCSecurityGroup:
                                description: |-
                                  EmptyRoutesDefaultVPCSecurityGroup specifies whether the default VPC security group ingress
                                  and egress rules should be removed.


                                  By default, when creating a VPC, AWS creates a security group called `default` with ingress and egress
                                  rules that allow traffic from anywhere. The group could be used as a potential surface attack and
                                  it's generally suggested that the group rules are removed or modified appropriately.


                                  NOTE: This only applies when the VPC is managed by the Cluster API AWS controller.
                                type: boolean
                              id:
                                description: ID is the vpc-id of the VPC this provider
                                  should use to create resources.
                                type: string
                              internetGatewayId:
                                description: InternetGatewayID is the id of the internet
                                  gateway associated with the VPC.
                                type: string
                              ipamPool:
                                description: |-
                                  IPAMPool defines the IPAMv4 pool to be used for VPC.
                                  Mutually exclusive with CidrBlock.
                                properties:
                                  id:
                                    description: ID is the ID of the IPAM pool this
                                      provider should use to create VPC.
                                    type: string
                                  name:
                                    description: Name is the name of the IPAM pool
                                      this provider should use to create VPC.
                                    type: string
                                  netmaskLength:
                                    description: |-
                                      The netmask length of the IPv4 CIDR you want to allocate to VPC from
                                      an Amazon VPC IP Address Manager (IPAM) pool.
                                      Defaults to /16 for IPv4 if not specified.
                                    format: int64
                                    type: integer
                                type: object
                              ipv6:
                                description: |-
                                  IPv6 contains ipv6 specific settings for the network. Supported only in managed clusters.
                                  This field cannot be set on AWSCluster object.
                                properties:
                                  cidrBlock:
                                    description: |-
                                      CidrBlock is the CIDR block provided by Amazon when VPC has enabled IPv6.
                                      Mutually exclusive with IPAMPool.
                                    type: string
                                  egressOnlyInternetGatewayId:
                                    description: EgressOnlyInternetGatewayID is the
                                      id of the egress only internet gateway associated
                                      with an IPv6 enabled VPC.
                                    type: string
                                  ipamPool:
                                    description: |-
                                      IPAMPool defines the IPAMv6 pool to be used for VPC.
                                      Mutually exclusive with CidrBlock.
                                    properties:
                                      id:
                                        description: ID is the ID of the IPAM pool
                                          this provider should use to create VPC.
                                        type: string
                                      name:
                                        description: Name is the name of the IPAM
                                          pool this provider should use to create
                                          VPC.
                                        type: string
                                      netmaskLength:
                                        description: |-
                                          The netmask length of the IPv4 CIDR you want to allocate to VPC from
                                          an Amazon VPC IP Address Manager (IPAM) pool.
                                          Defaults to /16 for IPv4 if not specified.
                                        format: int64
                                        type: integer
                                    type: object
                                  poolId:
                                    description: |-
                                      PoolID is the IP pool which must be defined in case of BYO IP is defined.
                                      Must be specified if CidrBlock is set.
                                      Mutually exclusive with IPAMPool.
                                    type: string
                                type: object
                              privateDnsHostnameTypeOnLaunch:
                                description: |-
                                  PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.
                                  For IPv4-only and dual-stack (IPv4 and IPv6) subnets, an instance DNS name can be based on the instance IPv4 address (ip-name)
                                  or the instance ID (resource-name). For IPv6 only subnets, an instance DNS name must be based on the instance ID (resource-name).
                                enum:
                                - ip-name
                                - resource-name
                                type: string
                              secondaryCidrBlocks:
                                description: |-
                                  SecondaryCidrBlocks are additional CIDR blocks to be associated when the provider creates a managed VPC.
                                  Defaults to none. Mutually exclusive with IPAMPool. This makes sense to use if, for example, you want to use
                                  a separate IP range for pods (e.g. Cilium ENI mode).
                                items:
                                  description: VpcCidrBlock defines the CIDR block
                                    and settings to associate with the managed VPC.
                                    Currently, only IPv4 is supported.
                                  properties:
                                    ipv4CidrBlock:
                                      description: IPv4CidrBlock is the IPv4 CIDR
                                        block to associate with the managed VPC.
                                      minLength: 1
                                      type: string
                                  required:
                                  - ipv4CidrBlock
                                  type: object
                                type: array
                              subnetSchema:
                                default: PreferPrivate
                                description: |-
                                  SubnetSchema specifies how CidrBlock should be divided on subnets in the VPC depending on the number of AZs.
                                  PreferPrivate - one private subnet for each AZ plus one other subnet that will be further sub-divided for the public subnets.
                                  PreferPublic - have the reverse logic of PreferPrivate, one public subnet for each AZ plus one other subnet
                                  that will be further sub-divided for the private subnets.
                                  Defaults to PreferPrivate
                                enum:
                                - PreferPrivate
                                - PreferPublic
                                type: string
                              tags:
                                additionalProperties:
                                  type: string
                                description: Tags is a collection of tags describing
                                  the resource.
                                type: object
                            type: object
                        type: object
                      partition:
                        description: Partition is the AWS security partition being
                          used. Defaults to "aws"
                        type: string
                      region:
                        description: The AWS Region the cluster lives in.
                        type: string
                      s3Bucket:
                        description: |-
                          S3Bucket contains options to configure a supporting S3 bucket for this
                          cluster - currently used for nodes requiring Ignition
                          (https://coreos.github.io/ignition/) for bootstrapping (requires
                          BootstrapFormatIgnition feature flag to be enabled).
                        properties:
                          bestEffortDeleteObjects:
                            description: BestEffortDeleteObjects defines whether access/permission
                              errors during object deletion should be ignored.
                            type: boolean
                          controlPlaneIAMInstanceProfile:
                            description: |-
                              ControlPlaneIAMInstanceProfile is a name of the IAMInstanceProfile, which will be allowed
                              to read control-plane node bootstrap data from S3 Bucket.
                            type: string
                          name:
                            description: Name defines name of S3 Bucket to be created.
                            maxLength: 63
                            minLength: 3
                            pattern: ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$
                            type: string
                          nodesIAMInstanceProfiles:
                            description: |-
                              NodesIAMInstanceProfiles is a list of IAM instance profiles, which will be allowed to read
                              worker nodes bootstrap data from S3 Bucket.
                            items:
                              type: string
                            type: array
                          presignedURLDuration:
                            description: |-
                              PresignedURLDuration defines the duration for which presigned URLs are valid.


                              This is used to generate presigned URLs for S3 Bucket objects, which are used by
                              control-plane and worker nodes to fetch bootstrap data.


                              When enabled, the IAM instance profiles specified are not used.
                            type: string
                        required:
                        - name
                        type: object
                      secondaryControlPlaneLoadBalancer:
                        description: |-
                          SecondaryControlPlaneLoadBalancer is an additional load balancer that can be used for the control plane.


                          An example use case is to have a separate internal load balancer for internal traffic,
                          and a separate external load balancer for external traffic.
                        properties:
                          additionalListeners:
                            description: |-
                              AdditionalListeners sets the additional listeners for the control plane load balancer.
                              This is only applicable to Network Load Balancer (NLB) types for the time being.
                            items:
                              description: |-
                                AdditionalListenerSpec defines the desired state of an
                                additional listener on an AWS load balancer.
                              properties:
                                healthCheck:
                                  description: HealthCheck sets the optional custom
                                    health check configuration to the API target group.
                                  properties:
                                    intervalSeconds:
                                      description: |-
                                        The approximate amount of time, in seconds, between health checks of an individual
                                        target.
                                      format: int64
                                      maximum: 300
                                      minimum: 5
                                      type: integer
                                    path:
                                      description: |-
                                        The destination for health checks on the targets when using the protocol HTTP or HTTPS,
                                        otherwise the path will be ignored.
                                      type: string
                                    port:
                                      description: |-
                                        The port the load balancer uses when performing health checks for additional target groups. When
                                        not specified this value will be set for the same of listener port.
                                      type: string
                                    protocol:
                                      description: |-
                                        The protocol to use to health check connect with the target. When not specified the Protocol
                                        will be the same of the listener.
                                      enum:
                                      - TCP
                                      - HTTP
                                      - HTTPS
                                      type: string
                                    thresholdCount:
                                      description: |-
                                        The number of consecutive health check successes required before considering
                                        a target healthy.
                                      format: int64
                                      maximum: 10
                                      minimum: 2
                                      type: integer
                                    timeoutSeconds:
                                      description: |-
                                        The amount of time, in seconds, during which no response from a target means
                                        a failed health check.
                                      format: int64
                                      maximum: 120
                                      minimum: 2
                                      type: integer
                                    unhealthyThresholdCount:
                                      description: |-
                                        The number of consecutive health check failures required before considering
                                        a target unhealthy.
                                      format: int64
                                      maximum: 10
                                      minimum: 2
                                      type: integer
                                  type: object
                                port:
                                  description: Port sets the port for the additional
                                    listener.
                                  format: int64
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                                protocol:
                                  default: TCP
                                  description: |-
                                    Protocol sets the protocol for the additional listener.
                                    Currently only TCP is supported.
                                  enum:
                                  - TCP
                                  type: string
                              required:
                              - port
                              type: object
                            type: array
                            x-kubernetes-list-map-keys:
                            - port
                            x-kubernetes-list-type: map
                          additionalSecurityGroups:
                            description: |-
                              AdditionalSecurityGroups sets the security groups used by the load balancer. Expected to be security group IDs
                              This is optional - if not provided new security groups will be created for the load balancer
                            items:
                              type: string
                            type: array
                          crossZoneLoadBalancing:
                            description: |-
                              CrossZoneLoadBalancing enables the classic ELB cross availability zone balancing.


                              With cross-zone load balancing, each load balancer node for your Classic Load Balancer
                              distributes requests evenly across the registered instances in all enabled Availability Zones.
                              If cross-zone load balancing is disabled, each load balancer node distributes requests evenly across
                              the registered instances in its Availability Zone only.


                              Defaults to false.
                            type: boolean
                          disableHostsRewrite:
                            description: |-
                              DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts
                              file of each instance. This is by default, false.
                            type: boolean
                          healthCheck:
                            description: HealthCheck sets custom health check configuration
                              to the API target group.
                            properties:
                              intervalSeconds:
                                description: |-
                                  The approximate amount of time, in seconds, between health checks of an individual
                                  target.
                                format: int64
                                maximum: 300
                                minimum: 5
                                type: integer
                              thresholdCount:
                                description: |-
                                  The number of consecutive health check successes required before considering
                                  a target healthy.
                                format: int64
                                maximum: 10
                                minimum: 2
                                type: integer
                              timeoutSeconds:
                                description: |-
                                  The amount of time, in seconds, during which no response from a target means
                                  a failed health check.
                                format: int64
                                maximum: 120
                                minimum: 2
                                type: integer
                              unhealthyThresholdCount:
                                description: |-
                                  The number of consecutive health check failures required before considering
                                  a target unhealthy.
                                format: int64
                                maximum: 10
                                minimum: 2
                                type: integer
                            type: object
                          healthCheckProtocol:
                            description: |-
                              HealthCheckProtocol sets the protocol type for ELB health check target
                              default value is ELBProtocolSSL
                            enum:
                            - TCP
                            - SSL
                            - HTTP
                            - HTTPS
                            - TLS
                            - UDP
                            type: string
                          ingressRules:
                            description: IngressRules sets the ingress rules for the
                              control plane load balancer.
                            items:
                              description: IngressRule defines an AWS ingress rule
                                for security groups.
                              properties:
                                cidrBlocks:
                                  description: List of CIDR blocks to allow access
                                    from. Cannot be specified with SourceSecurityGroupID.
                                  items:
                                    type: string
                                  type: array
                                description:
                                  description: Description provides extended information
                                    about the ingress rule.
                                  type: string
                                fromPort:
                                  description: FromPort is the start of port range.
                                  format: int64
                                  type: integer
                                ipv6CidrBlocks:
                                  description: List of IPv6 CIDR blocks to allow access
                                    from. Cannot be specified with SourceSecurityGroupID.
                                  items:
                                    type: string
                                  type: array
                                natGatewaysIPsSource:
                                  description: NatGatewaysIPsSource use the NAT gateways
                                    IPs as the source for the ingress rule.
                                  type: boolean
                                protocol:
                                  description: Protocol is the protocol for the ingress
                                    rule. Accepted values are "-1" (all), "4" (IP
                                    in IP),"tcp", "udp", "icmp", and "58" (ICMPv6),
                                    "50" (ESP).
                                  enum:
                                  - "-1"
                                  - "4"
                                  - tcp
                                  - udp
                                  - icmp
                                  - "58"
                                  - "50"
                                  type: string
                                sourceSecurityGroupIds:
                                  description: The security group id to allow access
                                    from. Cannot be specified with CidrBlocks.
                                  items:
                                    type: string
                                  type: array
                                sourceSecurityGroupRoles:
                                  description: |-
                                    The security group role to allow access from. Cannot be specified with CidrBlocks.
                                    The field will be combined with source security group IDs if specified.
                                  items:
                                    description: SecurityGroupRole defines the unique
                                      role of a security group.
                                    enum:
                                    - bastion
                                    - node
                                    - controlplane
                                    - apiserver-lb
                                    - lb
                                    - node-eks-additional
                                    type: string
                                  type: array
                                toPort:
                                  description: ToPort is the end of port range.
                                  format: int64
                                  type: integer
                              required:
                              - description
                              - fromPort
                              - protocol
                              - toPort
                              type: object
                            type: array
                          loadBalancerType:
                            default: classic
                            description: LoadBalancerType sets the type for a load
                              balancer. The default type is classic.
                            enum:
                            - classic
                            - elb
                            - alb
                            - nlb
                            - disabled
                            type: string
                          name:
                            description: |-
                              Name sets the name of the classic ELB load balancer. As per AWS, the name must be unique
                              within your set of load balancers for the region, must have a maximum of 32 characters, must
                              contain only alphanumeric characters or hyphens, and cannot begin or end with a hyphen. Once
                              set, the value cannot be changed.
                            maxLength: 32
                            pattern: ^[A-Za-z0-9]([A-Za-z0-9]{0,31}|[-A-Za-z0-9]{0,30}[A-Za-z0-9])$
                            type: string
                          preserveClientIP:
                            description: |-
                              PreserveClientIP lets the user control if preservation of client ips must be retained or not.
                              If this is enabled 6443 will be opened to 0.0.0.0/0.
                            type: boolean
                          scheme:
                            default: internet-facing
                            description: Scheme sets the scheme of the load balancer
                              (defaults to internet-facing)
                            enum:
                            - internet-facing
                            - internal
                            type: string
                          subnets:
                            description: Subnets sets the subnets that should be applied
                              to the control plane load balancer (defaults to discovered
                              subnets for managed VPCs or an empty set for unmanaged
                              VPCs)
                            items:
                              type: string
                            type: array
                        type: object
                      sshKeyName:
                        description: SSHKeyName is the name of the ssh key to attach
                          to the bastion host. Valid values are empty string (do not
                          use SSH keys), a valid SSH key name, or omitted (use the
                          default SSH key name)
                        type: string
                    type: object
                required:
                - spec
                type: object
            required:
            - template
            type: object
        type: object
    served: true
    storage: true
    subresources: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io
spec:
  group: controlplane.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSManagedControlPlane
    listKind: AWSManagedControlPlaneList
    plural: awsmanagedcontrolplanes
    shortNames:
    - awsmcp
    singular: awsmanagedcontrolplane
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Cluster to which this AWSManagedControl belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: Control plane infrastructure is ready for worker nodes
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: AWS VPC the control plane is using
      jsonPath: .spec.network.vpc.id
      name: VPC
      type: string
    - description: API Endpoint
      jsonPath: .spec.controlPlaneEndpoint.host
      name: Endpoint
      priority: 1
      type: string
    - description: Bastion IP address for breakglass access
      jsonPath: .status.bastion.publicIp
      name: Bastion IP
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: AWSManagedControlPlane is the schema for the Amazon EKS Managed
          Control Plane API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSManagedControlPlaneSpec defines the desired state of an
              Amazon EKS Cluster.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                  ones added by default.
                type: object
              addons:
                description: Addons defines the EKS addons to enable with the EKS
                  cluster.
                items:
                  description: Addon represents a EKS addon.
                  properties:
                    configuration:
                      description: Configuration of the EKS addon
                      type: string
                    conflictResolution:
                      default: none
                      description: |-
                        ConflictResolution is used to declare what should happen if there
                        are parameter conflicts. Defaults to none
                      enum:
                      - overwrite
                      - none
                      type: string
                    name:
                      description: Name is the name of the addon
                      minLength: 2
                      type: string
                    serviceAccountRoleARN:
                      description: ServiceAccountRoleArn is the ARN of an IAM role
                        to bind to the addons service account
                      type: string
                    version:
                      description: Version is the version of the addon to use
                      type: string
                  required:
                  - name
                  - version
                  type: object
                type: array
              associateOIDCProvider:
                default: false
                description: |-
                  AssociateOIDCProvider can be enabled to automatically create an identity
                  provider for the controller for use with IAM roles for service accounts
                type: boolean
              bastion:
                description: Bastion contains options to configure the bastion host.
                properties:
                  allowedCIDRBlocks:
                    description: |-
                      AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
                      They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
                    items:
                      type: string
                    type: array
                  ami:
                    description: |-
                      AMI will use the specified AMI to boot the bastion. If not specified,
                      the AMI will default to one picked out in public space.
                    type: string
                  disableIngressRules:
                    description: |-
                      DisableIngressRules will ensure there are no Ingress rules in the bastion host's security group.
                      Requires AllowedCIDRBlocks to be empty.
                    type: boolean
                  enabled:
                    description: |-
                      Enabled allows this provider to create a bastion host instance
                      with a public ip to access the VPC private network.
                    type: boolean
                  instanceType:
                    description: |-
                      InstanceType will use the specified instance type for the bastion. If not specified,
                      Cluster API Provider AWS will use t3.micro for all regions except us-east-1, where t2.micro
                      will be the default.
                    type: string
                type: object
              controlPlaneEndpoint:
                description: ControlPlaneEndpoint represents the endpoint used to
                  communicate with the control plane.
                properties:
                  host:
                    description: The hostname on which the API server is serving.
                    type: string
                  port:
                    description: The port on which the API server is serving.
                    format: int32
                    type: integer
                required:
                - host
                - port
                type: object
              disableVPCCNI:
                default: false
                description: |-
                  DisableVPCCNI indicates that the Amazon VPC CNI should be disabled. With EKS clusters the
                  Amazon VPC CNI is automatically installed into the cluster. For clusters where you want
                  to use an alternate CNI this option provides a way to specify that the Amazon VPC CNI
                  should be deleted. You cannot set this to true if you are using the
                  Amazon VPC CNI addon.
                type: boolean
              eksClusterName:
                description: |-
                  EKSClusterName allows you to specify the name of the EKS cluster in
                  AWS. If you don't specify a name then a default name will be created
                  based on the namespace and name of the managed control plane.
                type: string
              encryptionConfig:
                description: EncryptionConfig specifies the encryption configuration
                  for the cluster
                properties:
                  provider:
                    description: Provider specifies the ARN or alias of the CMK (in
                      AWS KMS)
                    type: string
                  resources:
                    description: Resources specifies the resources to be encrypted
                    items:
                      type: string
                    type: array
                type: object
              endpointAccess:
                description: Endpoints specifies access to this cluster's control
                  plane endpoints
                properties:
                  private:
                    description: Private points VPC-internal control plane access
                      to the private endpoint
                    type: boolean
                  public:
                    description: Public controls whether control plane endpoints are
                      publicly accessible
                    type: boolean
                  publicCIDRs:
                    description: PublicCIDRs specifies which blocks can access the
                      public endpoint
                    items:
                      type: string
                    type: array
                type: object
              iamAuthenticatorConfig:
                description: |-
                  IAMAuthenticatorConfig allows the specification of any additional user or role mappings
                  for use when generating the aws-iam-authenticator configuration. If this is nil the
                  default configuration is still generated for the cluster.
                properties:
                  mapRoles:
                    description: RoleMappings is a list of role mappings
                    items:
                      description: RoleMapping represents a mapping from a IAM role
                        to Kubernetes users and groups.
                      properties:
                        groups:
                          description: Groups is a list of kubernetes RBAC groups
                          items:
                            type: string
                          type: array
                        rolearn:
                          description: RoleARN is the AWS ARN for the role to map
                          minLength: 31
                          type: string
                        username:
                          description: UserName is a kubernetes RBAC user subject
                          type: string
                      required:
                      - groups
                      - rolearn
                      - username
                      type: object
                    type: array
                  mapUsers:
                    description: UserMappings is a list of user mappings
                    items:
                      description: UserMapping represents a mapping from an IAM user
                        to Kubernetes users and groups.
                      properties:
                        groups:
                          description: Groups is a list of kubernetes RBAC groups
                          items:
                            type: string
                          type: array
                        userarn:
                          description: UserARN is the AWS ARN for the user to map
                          minLength: 31
                          type: string
                        username:
                          description: UserName is a kubernetes RBAC user subject
                          type: string
                      required:
                      - groups
                      - userarn
                      - username
                      type: object
                    type: array
                type: object
              identityRef:
                description: |-
                  IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
                  If no identity is specified, the default identity for this controller will be used.
                properties:
                  kind:
                    description: Kind of the identity.
                    enum:
                    - AWSClusterControllerIdentity
                    - AWSClusterRoleIdentity
                    - AWSClusterStaticIdentity
                    type: string
                  name:
                    description: Name of the identity.
                    minLength: 1
                    type: string
                required:
                - kind
                - name
                type: object
              imageLookupBaseOS:
                description: |-
                  ImageLookupBaseOS is the name of the base operating system used to look
                  up machine images when a machine does not specify an AMI. When set, this
                  will be used for all cluster machines unless a machine specifies a
                  different ImageLookupBaseOS.
                type: string
              imageLookupFormat:
                description: |-
                  ImageLookupFormat is the AMI naming format to look up machine images when
                  a machine does not specify an AMI. When set, this will be used for all
                  cluster machines unless a machine specifies a different ImageLookupOrg.
                  Supports substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base
                  OS and kubernetes version, respectively. The BaseOS will be the value in
                  ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                  defined by the packages produced by kubernetes/release without v as a
                  prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                  image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                  searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                  Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                  also: https://golang.org/pkg/text/template/
                type: string
              imageLookupOrg:
                description: |-
                  ImageLookupOrg is the AWS Organization ID to look up machine images when a
                  machine does not specify an AMI. When set, this will be used for all
                  cluster machines unless a machine specifies a different ImageLookupOrg.
                type: string
              kubeProxy:
                description: KubeProxy defines managed attributes of the kube-proxy
                  daemonset
                properties:
                  disable:
                    default: false
                    description: |-
                      Disable set to true indicates that kube-proxy should be disabled. With EKS clusters
                      kube-proxy is automatically installed into the cluster. For clusters where you want
                      to use kube-proxy functionality that is provided with an alternate CNI, this option
                      provides a way to specify that the kube-proxy daemonset should be deleted. You cannot
                      set this to true if you are using the Amazon kube-proxy addon.
                    type: boolean
                type: object
              logging:
                description: |-
                  Logging specifies which EKS Cluster logs should be enabled. Entries for
                  each of the enabled logs will be sent to CloudWatch
                properties:
                  apiServer:
                    default: false
                    description: APIServer indicates if the Kubernetes API Server
                      log (kube-apiserver) shoulkd be enabled
                    type: boolean
                  audit:
                    default: false
                    description: Audit indicates if the Kubernetes API audit log should
                      be enabled
                    type: boolean
                  authenticator:
                    default: false
                    description: Authenticator indicates if the iam authenticator
                      log should be enabled
                    type: boolean
                  controllerManager:
                    default: false
                    description: ControllerManager indicates if the controller manager
                      (kube-controller-manager) log should be enabled
                    type: boolean
                  scheduler:
                    default: false
                    description: Scheduler indicates if the Kubernetes scheduler (kube-scheduler)
                      log should be enabled
                    type: boolean
                required:
                - apiServer
                - audit
                - authenticator
                - controllerManager
                - scheduler
                type: object
              network:
                description: NetworkSpec encapsulates all things related to AWS network.
                properties:
                  additionalControlPlaneIngressRules:
                    description: AdditionalControlPlaneIngressRules is an optional
                      set of ingress rules to add to the control plane
                    items:
                      description: IngressRule defines an AWS ingress rule for security
                        groups.
                      properties:
                        cidrBlocks:
                          description: List of CIDR blocks to allow access from. Cannot
                            be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        description:
                          description: Description provides extended information about
                            the ingress rule.
                          type: string
                        fromPort:
                          description: FromPort is the start of port range.
                          format: int64
                          type: integer
                        ipv6CidrBlocks:
                          description: List of IPv6 CIDR blocks to allow access from.
                            Cannot be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        natGatewaysIPsSource:
                          description: NatGatewaysIPsSource use the NAT gateways IPs
                            as the source for the ingress rule.
                          type: boolean
                        protocol:
                          description: Protocol is the protocol for the ingress rule.
                            Accepted values are "-1" (all), "4" (IP in IP),"tcp",
                            "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                          enum:
                          - "-1"
                          - "4"
                          - tcp
                          - udp
                          - icmp
                          - "58"
                          - "50"
                          type: string
                        sourceSecurityGroupIds:
                          description: The security group id to allow access from.
                            Cannot be specified with CidrBlocks.
                          items:
                            type: string
                          type: array
                        sourceSecurityGroupRoles:
                          description: |-
                            The security group role to allow access from. Cannot be specified with CidrBlocks.
                            The field will be combined with source security group IDs if specified.
                          items:
                            description: SecurityGroupRole defines the unique role
                              of a security group.
                            enum:
                            - bastion
                            - node
                            - controlplane
                            - apiserver-lb
                            - lb
                            - node-eks-additional
                            type: string
                          type: array
                        toPort:
                          description: ToPort is the end of port range.
                          format: int64
                          type: integer
                      required:
                      - description
                      - fromPort
                      - protocol
                      - toPort
                      type: object
                    type: array
                  cni:
                    description: CNI configuration
                    properties:
                      cniIngressRules:
                        description: |-
                          CNIIngressRules specify rules to apply to control plane and worker node security groups.
                          The source for the rule will be set to control plane and worker security group IDs.
                        items:
                          description: CNIIngressRule defines an AWS ingress rule
                            for CNI requirements.
                          properties:
                            description:
                              type: string
                            fromPort:
                              format: int64
                              type: integer
                            protocol:
                              description: SecurityGroupProtocol defines the protocol
                                type for a security group rule.
                              type: string
                            toPort:
                              format: int64
                              type: integer
                          required:
                          - description
                          - fromPort
                          - protocol
                          - toPort
                          type: object
                        type: array
                    type: object
                  nodePortIngressRuleCidrBlocks:
                    description: |-
                      NodePortIngressRuleCidrBlocks is an optional set of CIDR blocks to allow traffic to nodes' NodePort services.
                      If none are specified here, all IPs are allowed to connect.
                    items:
                      type: string
                    type: array
                  securityGroupOverrides:
                    additionalProperties:
                      type: string
                    description: |-
                      SecurityGroupOverrides is an optional set of security groups to use for cluster instances
                      This is optional - if not provided new security groups will be created for the cluster
                    type: object
                  subnets:
                    description: Subnets configuration.
                    items:
                      description: SubnetSpec configures an AWS Subnet.
                      properties:
                        availabilityZone:
                          description: AvailabilityZone defines the availability zone
                            to use for this subnet in the cluster's region.
                          type: string
                        cidrBlock:
                          description: CidrBlock is the CIDR block to be used when
                            the provider creates a managed VPC.
                          type: string
                        id:
                          description: |-
                            ID defines a unique identifier to reference this resource.
                            If you're bringing your subnet, set the AWS subnet-id here, it must start with `subnet-`.


                            When the VPC is managed by CAPA, and you'd like the provider to create a subnet for you,
                            the id can be set to any placeholder value that does not start with `subnet-`;
                            upon creation, the subnet AWS identifier will be populated in the `ResourceID` field and
                            the `id` field is going to be used as the subnet name. If you specify a tag
                            called `Name`, it takes precedence.
                          type: string
                        ipv6CidrBlock:
                          description: |-
                            IPv6CidrBlock is the IPv6 CIDR block to be used when the provider creates a managed VPC.
                            A subnet can have an IPv4 and an IPv6 address.
                            IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                          type: string
                        isIpv6:
                          description: |-
                            IsIPv6 defines the subnet as an IPv6 subnet. A subnet is IPv6 when it is associated with a VPC that has IPv6 enabled.
                            IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                          type: boolean
                        isPublic:
                          description: IsPublic defines the subnet as a public subnet.
                            A subnet is public when it is associated with a route
                            table that has a route to an internet gateway.
                          type: boolean
                        natGatewayId:
                          description: |-
                            NatGatewayID is the NAT gateway id associated with the subnet.
                            Ignored unless the subnet is managed by the provider, in which case this is set on the public subnet where the NAT gateway resides. It is then used to determine routes for private subnets in the same AZ as the public subnet.
                          type: string
                        parentZoneName:
                          description: |-
                            ParentZoneName is the zone name where the current subnet's zone is tied when
                            the zone is a Local Zone.


                            The subnets in Local Zone or Wavelength Zone locations consume the ParentZoneName
                            to select the correct private route table to egress traffic to the internet.
                          type: string
                        resourceID:
                          description: |-
                            ResourceID is the subnet identifier from AWS, READ ONLY.
                            This field is populated when the provider manages the subnet.
                          type: string
                        routeTableId:
                          description: RouteTableID is the routing table id associated
                            with the subnet.
                          type: string
                        tags:
                          additionalProperties:
                            type: string
                          description: Tags is a collection of tags describing the
                            resource.
                          type: object
                        zoneType:
                          description: |-
                            ZoneType defines the type of the zone where the subnet is created.


                            The valid values are availability-zone, local-zone, and wavelength-zone.


                            Subnet with zone type availability-zone (regular) is always selected to create cluster
                            resources, like Load Balancers, NAT Gateways, Contol Plane nodes, etc.


                            Subnet with zone type local-zone or wavelength-zone is not eligible to automatically create
                            regular cluster resources.


                            The public subnet in availability-zone or local-zone is associated with regular public
                            route table with default route entry to a Internet Gateway.


                            The public subnet in wavelength-zone is associated with a carrier public
                            route table with default route entry to a Carrier Gateway.


                            The private subnet in the availability-zone is associated with a private route table with
                            the default route entry to a NAT Gateway created in that zone.


                            The private subnet in the local-zone or wavelength-zone is associated with a private route table with
                            the default route entry re-using the NAT Gateway in the Region (preferred from the
                            parent zone, the zone type availability-zone in the region, or first table available).
                          enum:
                          - availability-zone
                          - local-zone
                          - wavelength-zone
                          type: string
                      required:
                      - id
                      type: object
                    type: array
                    x-kubernetes-list-map-keys:
                    - id
                    x-kubernetes-list-type: map
                  vpc:
                    description: VPC configuration.
                    properties:
                      availabilityZoneSelection:
                        default: Ordered
                        description: |-
                          AvailabilityZoneSelection specifies how AZs should be selected if there are more AZs
                          in a region than specified by AvailabilityZoneUsageLimit. There are 2 selection schemes:
                          Ordered - selects based on alphabetical order
                          Random - selects AZs randomly in a region
                          Defaults to Ordered
                        enum:
                        - Ordered
                        - Random
                        type: string
                      availabilityZoneUsageLimit:
                        default: 3
                        description: |-
                          AvailabilityZoneUsageLimit specifies the maximum number of availability zones (AZ) that
                          should be used in a region when automatically creating subnets. If a region has more
                          than this number of AZs then this number of AZs will be picked randomly when creating
                          default subnets. Defaults to 3
                        minimum: 1
                        type: integer
                      carrierGatewayId:
                        description: |-
                          CarrierGatewayID is the id of the internet gateway associated with the VPC,
                          for carrier network (Wavelength Zones).
                        type: string
                        x-kubernetes-validations:
                        - message: Carrier Gateway ID must start with 'cagw-'
                          rule: self.startsWith('cagw-')
                      cidrBlock:
                        description: |-
                          CidrBlock is the CIDR block to be used when the provider creates a managed VPC.
                          Defaults to 10.0.0.0/16.
                          Mutually exclusive with IPAMPool.
                        type: string
                      elasticIpPool:
                        description: |-
                          ElasticIPPool contains specific configuration to allocate Public IPv4 address (Elastic IP) from user-defined pool
                          brought to AWS for core infrastructure resources, like NAT Gateways and Public Network Load Balancers for
                          the API Server.
                        properties:
                          publicIpv4Pool:
                            description: |-
                              PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources
                              created in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom
                              Public IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool
                              resource ID starts with 'ipv4pool-ec2'.
                            maxLength: 30
                            type: string
                          publicIpv4PoolFallbackOrder:
                            description: |-
                              PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,
                              no more IPv4 address available in the pool.


                              When set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the
                              IPv4 limit, the address will be claimed from Amazon-pool (default).


                              When set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.
                            enum:
                            - amazon-pool
                            - none
                            type: string
                            x-kubernetes-validations:
                            - message: allowed values are 'none' and 'amazon-pool'
                              rule: self in ['none','amazon-pool']
                        type: object
                      emptyRoutesDefaultVPCSecurityGroup:
                        description: |-
                          EmptyRoutesDefaultVPCSecurityGroup specifies whether the default VPC security group ingress
                          and egress rules should be removed.


                          By default, when creating a VPC, AWS creates a security group called `default` with ingress and egress
                          rules that allow traffic from anywhere. The group could be used as a potential surface attack and
                          it's generally suggested that the group rules are removed or modified appropriately.


                          NOTE: This only applies when the VPC is managed by the Cluster API AWS controller.
                        type: boolean
                      id:
                        description: ID is the vpc-id of the VPC this provider should
                          use to create resources.
                        type: string
                      internetGatewayId:
                        description: InternetGatewayID is the id of the internet gateway
                          associated with the VPC.
                        type: string
                      ipamPool:
                        description: |-
                          IPAMPool defines the IPAMv4 pool to be used for VPC.
                          Mutually exclusive with CidrBlock.
                        properties:
                          id:
                            description: ID is the ID of the IPAM pool this provider
                              should use to create VPC.
                            type: string
                          name:
                            description: Name is the name of the IPAM pool this provider
                              should use to create VPC.
                            type: string
                          netmaskLength:
                            description: |-
                              The netmask length of the IPv4 CIDR you want to allocate to VPC from
                              an Amazon VPC IP Address Manager (IPAM) pool.
                              Defaults to /16 for IPv4 if not specified.
                            format: int64
                            type: integer
                        type: object
                      ipv6:
                        description: |-
                          IPv6 contains ipv6 specific settings for the network. Supported only in managed clusters.
                          This field cannot be set on AWSCluster object.
                        properties:
                          cidrBlock:
                            description: |-
                              CidrBlock is the CIDR block provided by Amazon when VPC has enabled IPv6.
                              Mutually exclusive with IPAMPool.
                            type: string
                          egressOnlyInternetGatewayId:
                            description: EgressOnlyInternetGatewayID is the id of
                              the egress only internet gateway associated with an
                              IPv6 enabled VPC.
                            type: string
                          ipamPool:
                            description: |-
                              IPAMPool defines the IPAMv6 pool to be used for VPC.
                              Mutually exclusive with CidrBlock.
                            properties:
                              id:
                                description: ID is the ID of the IPAM pool this provider
                                  should use to create VPC.
                                type: string
                              name:
                                description: Name is the name of the IPAM pool this
                                  provider should use to create VPC.
                                type: string
                              netmaskLength:
                                description: |-
                                  The netmask length of the IPv4 CIDR you want to allocate to VPC from
                                  an Amazon VPC IP Address Manager (IPAM) pool.
                                  Defaults to /16 for IPv4 if not specified.
                                format: int64
                                type: integer
                            type: object
                          poolId:
                            description: |-
                              PoolID is the IP pool which must be defined in case of BYO IP is defined.
                              Must be specified if CidrBlock is set.
                              Mutually exclusive with IPAMPool.
                            type: string
                        type: object
                      privateDnsHostnameTypeOnLaunch:
                        description: |-
                          PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.
                          For IPv4-only and dual-stack (IPv4 and IPv6) subnets, an instance DNS name can be based on the instance IPv4 address (ip-name)
                          or the instance ID (resource-name). For IPv6 only subnets, an instance DNS name must be based on the instance ID (resource-name).
                        enum:
                        - ip-name
                        - resource-name
                        type: string
                      secondaryCidrBlocks:
                        description: |-
                          SecondaryCidrBlocks are additional CIDR blocks to be associated when the provider creates a managed VPC.
                          Defaults to none. Mutually exclusive with IPAMPool. This makes sense to use if, for example, you want to use
                          a separate IP range for pods (e.g. Cilium ENI mode).
                        items:
                          description: VpcCidrBlock defines the CIDR block and settings
                            to associate with the managed VPC. Currently, only IPv4
                            is supported.
                          properties:
                            ipv4CidrBlock:
                              description: IPv4CidrBlock is the IPv4 CIDR block to
                                associate with the managed VPC.
                              minLength: 1
                              type: string
                          required:
                          - ipv4CidrBlock
                          type: object
                        type: array
                      subnetSchema:
                        default: PreferPrivate
                        description: |-
                          SubnetSchema specifies how CidrBlock should be divided on subnets in the VPC depending on the number of AZs.
                          PreferPrivate - one private subnet for each AZ plus one other subnet that will be further sub-divided for the public subnets.
                          PreferPublic - have the reverse logic of PreferPrivate, one public subnet for each AZ plus one other subnet
                          that will be further sub-divided for the private subnets.
                          Defaults to PreferPrivate
                        enum:
                        - PreferPrivate
                        - PreferPublic
                        type: string
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a collection of tags describing the resource.
                        type: object
                    type: object
                type: object
              oidcIdentityProviderConfig:
                description: |-
                  IdentityProviderconfig is used to specify the oidc provider config
                  to be attached with this eks cluster
                properties:
                  clientId:
                    description: |-
                      This is also known as audience. The ID for the client application that makes
                      authentication requests to the OpenID identity provider.
                    type: string
                  groupsClaim:
                    description: The JWT claim that the provider uses to return your
                      groups.
                    type: string
                  groupsPrefix:
                    description: |-
                      The prefix that is prepended to group claims to prevent clashes with existing
                      names (such as system: groups). For example, the valueoidc: will create group
                      names like oidc:engineering and oidc:infra.
                    type: string
                  identityProviderConfigName:
                    description: |-
                      The name of the OIDC provider configuration.


                      IdentityProviderConfigName is a required field
                    type: string
                  issuerUrl:
                    description: |-
                      The URL of the OpenID identity provider that allows the API server to discover
                      public signing keys for verifying tokens. The URL must begin with https://
                      and should correspond to the iss claim in the provider's OIDC ID tokens.
                      Per the OIDC standard, path components are allowed but query parameters are
                      not. Typically the URL consists of only a hostname, like https://server.example.org
                      or https://example.com. This URL should point to the level below .well-known/openid-configuration
                      and must be publicly accessible over the internet.
                    type: string
                  requiredClaims:
                    additionalProperties:
                      type: string
                    description: |-
                      The key value pairs that describe required claims in the identity token.
                      If set, each claim is verified to be present in the token with a matching
                      value. For the maximum number of claims that you can require, see Amazon
                      EKS service quotas (https://docs.aws.amazon.com/eks/latest/userguide/service-quotas.html)
                      in the Amazon EKS User Guide.
                    type: object
                  tags:
                    additionalProperties:
                      type: string
                    description: tags to apply to oidc identity provider association
                    type: object
                  usernameClaim:
                    description: |-
                      The JSON Web Token (JWT) claim to use as the username. The default is sub,
                      which is expected to be a unique identifier of the end user. You can choose
                      other claims, such as email or name, depending on the OpenID identity provider.
                      Claims other than email are prefixed with the issuer URL to prevent naming
                      clashes with other plug-ins.
                    type: string
                  usernamePrefix:
                    description: |-
                      The prefix that is prepended to username claims to prevent clashes with existing
                      names. If you do not provide this field, and username is a value other than
                      email, the prefix defaults to issuerurl#. You can use the value - to disable
                      all prefixing.
                    type: string
                type: object
              region:
                description: The AWS Region the cluster lives in.
                type: string
              roleAdditionalPolicies:
                description: |-
                  RoleAdditionalPolicies allows you to attach additional polices to
                  the control plane role. You must enable the EKSAllowAddRoles
                  feature flag to incorporate these into the created role.
                items:
                  type: string
                type: array
              roleName:
                description: |-
                  RoleName specifies the name of IAM role that gives EKS
                  permission to make API calls. If the role is pre-existing
                  we will treat it as unmanaged and not delete it on
                  deletion. If the EKSEnableIAM feature flag is true
                  and no name is supplied then a role is created.
                minLength: 2
                type: string
              secondaryCidrBlock:
                description: |-
                  SecondaryCidrBlock is the additional CIDR range to use for pod IPs.
                  Must be within the 100.64.0.0/10 or 198.19.0.0/16 range.
                type: string
              sshKeyName:
                description: SSHKeyName is the name of the ssh key to attach to the
                  bastion host. Valid values are empty string (do not use SSH keys),
                  a valid SSH key name, or omitted (use the default SSH key name)
                type: string
              tokenMethod:
                default: iam-authenticator
                description: |-
                  TokenMethod is used to specify the method for obtaining a client token for communicating with EKS
                  iam-authenticator - obtains a client token using iam-authentictor
                  aws-cli - obtains a client token using the AWS CLI
                  Defaults to iam-authenticator
                enum:
                - iam-authenticator
                - aws-cli
                type: string
              version:
                description: |-
                  Version defines the desired Kubernetes version. If no version number
                  is supplied then the latest version of Kubernetes that EKS supports
                  will be used.
                minLength: 2
                pattern: ^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.?(\.0|[1-9][0-9]*)?$
                type: string
              vpcCni:
                description: VpcCni is used to set configuration options for the VPC
                  CNI plugin
                properties:
                  env:
                    description: Env defines a list of environment variables to apply
                      to the `aws-node` DaemonSet
                    items:
                      description: EnvVar represents an environment variable present
                        in a Container.
                      properties:
                        name:
                          description: Name of the environment variable. Must be a
                            C_IDENTIFIER.
                          type: string
                        value:
                          description: |-
                            Variable references $(VAR_NAME) are expanded
                            using the previously defined environment variables in the container and
                            any service environment variables. If a variable cannot be resolved,
                            the reference in the input string will be unchanged. Double $$ are reduced
                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
                            Escaped references will never be expanded, regardless of whether the variable
                            exists or not.
                            Defaults to "".
                          type: string
                        valueFrom:
                          description: Source for the environment variable's value.
                            Cannot be used if value is not empty.
                          properties:
                            configMapKeyRef:
                              description: Selects a key of a ConfigMap.
                              properties:
                                key:
                                  description: The key to select.
                                  type: string
                                name:
                                  default: ""
                                  description: |-
                                    Name of the referent.
                                    This field is effectively required, but due to backwards compatibility is
                                    allowed to be empty. Instances of this type with an empty value here are
                                    almost certainly wrong.
                                    TODO: Add other useful fields. apiVersion, kind, uid?
                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                                  type: string
                                optional:
                                  description: Specify whether the ConfigMap or its
                                    key must be defined
                                  type: boolean
                              required:
                              - key
                              type: object
                              x-kubernetes-map-type: atomic
                            fieldRef:
                              description: |-
                                Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
                                spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
                              properties:
                                apiVersion:
                                  description: Version of the schema the FieldPath
                                    is written in terms of, defaults to "v1".
                                  type: string
                                fieldPath:
                                  description: Path of the field to select in the
                                    specified API version.
                                  type: string
                              required:
                              - fieldPath
                              type: object
                              x-kubernetes-map-type: atomic
                            resourceFieldRef:
                              description: |-
                                Selects a resource of the container: only resources limits and requests
                                (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
                              properties:
                                containerName:
                                  description: 'Container name: required for volumes,
                                    optional for env vars'
                                  type: string
                                divisor:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  description: Specifies the output format of the
                                    exposed resources, defaults to "1"
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                resource:
                                  description: 'Required: resource to select'
                                  type: string
                              required:
                              - resource
                              type: object
                              x-kubernetes-map-type: atomic
                            secretKeyRef:
                              description: Selects a key of a secret in the pod's
                                namespace
                              properties:
                                key:
                                  description: The key of the secret to select from.  Must
                                    be a valid secret key.
                                  type: string
                                name:
                                  default: ""
                                  description: |-
                                    Name of the referent.
                                    This field is effectively required, but due to backwards compatibility is
                                    allowed to be empty. Instances of this type with an empty value here are
                                    almost certainly wrong.
                                    TODO: Add other useful fields. apiVersion, kind, uid?
                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                                  type: string
                                optional:
                                  description: Specify whether the Secret or its key
                                    must be defined
                                  type: boolean
                              required:
                              - key
                              type: object
                              x-kubernetes-map-type: atomic
                          type: object
                      required:
                      - name
                      type: object
                    type: array
                type: object
            type: object
          status:
            description: AWSManagedControlPlaneStatus defines the observed state of
              an Amazon EKS Cluster.
            properties:
              addons:
                description: Addons holds the current status of the EKS addons
                items:
                  description: AddonState represents the state of an addon.
                  properties:
                    arn:
                      description: ARN is the AWS ARN of the addon
                      type: string
                    createdAt:
                      description: CreatedAt is the date and time the addon was created
                        at
                      format: date-time
                      type: string
                    issues:
                      description: Issues is a list of issue associated with the addon
                      items:
                        description: AddonIssue represents an issue with an addon.
                        properties:
                          code:
                            description: Code is the issue code
                            type: string
                          message:
                            description: Message is the textual description of the
                              issue
                            type: string
                          resourceIds:
                            description: ResourceIDs is a list of resource ids for
                              the issue
                            items:
                              type: string
                            type: array
                        type: object
                      type: array
                    modifiedAt:
                      description: ModifiedAt is the date and time the addon was last
                        modified
                      format: date-time
                      type: string
                    name:
                      description: Name is the name of the addon
                      type: string
                    serviceAccountRoleARN:
                      description: ServiceAccountRoleArn is the ARN of the IAM role
                        used for the service account
                      type: string
                    status:
                      description: Status is the status of the addon
                      type: string
                    version:
                      description: Version is the version of the addon to use
                      type: string
                  required:
                  - arn
                  - name
                  - version
                  type: object
                type: array
              bastion:
                description: Bastion holds details of the instance that is used as
                  a bastion jump box
                properties:
                  addresses:
                    description: Addresses contains the AWS instance associated addresses.
                    items:
                      description: MachineAddress contains information for the node's
                        address.
                      properties:
                        address:
                          description: The machine address.
                          type: string
                        type:
                          description: Machine address type, one of Hostname, ExternalIP,
                            InternalIP, ExternalDNS or InternalDNS.
                          type: string
                      required:
                      - address
                      - type
                      type: object
                    type: array
                  availabilityZone:
                    description: Availability zone of instance
                    type: string
                  capacityReservationId:
                    description: CapacityReservationID specifies the target Capacity
                      Reservation into which the instance should be launched.
                    type: string
                  ebsOptimized:
                    description: Indicates whether the instance is optimized for Amazon
                      EBS I/O.
                    type: boolean
                  enaSupport:
                    description: Specifies whether enhanced networking with ENA is
                      enabled.
                    type: boolean
                  iamProfile:
                    description: The name of the IAM instance profile associated with
                      the instance, if applicable.
                    type: string
                  id:
                    type: string
                  imageId:
                    description: The ID of the AMI used to launch the instance.
                    type: string
                  instanceMetadataOptions:
                    description: InstanceMetadataOptions is the metadata options for
                      the EC2 instance.
                    properties:
                      httpEndpoint:
                        default: enabled
                        description: |-
                          Enables or disables the HTTP metadata endpoint on your instances.


                          If you specify a value of disabled, you cannot access your instance metadata.


                          Default: enabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                      httpPutResponseHopLimit:
                        default: 1
                        description: |-
                          The desired HTTP PUT response hop limit for instance metadata requests. The
                          larger the number, the further instance metadata requests can travel.


                          Default: 1
                        format: int64
                        maximum: 64
                        minimum: 1
                        type: integer
                      httpTokens:
                        default: optional
                        description: |-
                          The state of token usage for your instance metadata requests.


                          If the state is optional, you can choose to retrieve instance metadata with
                          or without a session token on your request. If you retrieve the IAM role
                          credentials without a token, the version 1.0 role credentials are returned.
                          If you retrieve the IAM role credentials using a valid session token, the
                          version 2.0 role credentials are returned.


                          If the state is required, you must send a session token with any instance
                          metadata retrieval requests. In this state, retrieving the IAM role credentials
                          always returns the version 2.0 credentials; the version 1.0 credentials are
                          not available.


                          Default: optional
                        enum:
                        - optional
                        - required
                        type: string
                      instanceMetadataTags:
                        default: disabled
                        description: |-
                          Set to enabled to allow access to instance tags from the instance metadata.
                          Set to disabled to turn off access to instance tags from the instance metadata.
                          For more information, see Work with instance tags using the instance metadata
                          (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS).


                          Default: disabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                    type: object
                  instanceState:
                    description: The current state of the instance.
                    type: string
                  networkInterfaces:
                    description: Specifies ENIs attached to instance
                    items:
                      type: string
                    type: array
                  nonRootVolumes:
                    description: Configuration options for the non root storage volumes.
                    items:
                      description: Volume encapsulates the configuration options for
                        the storage device.
                      properties:
                        deviceName:
                          description: Device name
                          type: string
                        encrypted:
                          description: Encrypted is whether the volume should be encrypted
                            or not.
                          type: boolean
                        encryptionKey:
                          description: |-
                            EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                            If Encrypted is set and this is omitted, the default AWS key will be used.
                            The key must already exist and be accessible by the controller.
                          type: string
                        iops:
                          description: IOPS is the number of IOPS requested for the
                            disk. Not applicable to all types.
                          format: int64
                          type: integer
                        size:
                          description: |-
                            Size specifies size (in Gi) of the storage device.
                            Must be greater than the image snapshot size or 8 (whichever is greater).
                          format: int64
                          minimum: 8
                          type: integer
                        throughput:
                          description: Throughput to provision in MiB/s supported
                            for the volume type. Not applicable to all types.
                          format: int64
                          type: integer
                        type:
                          description: Type is the type of the volume (e.g. gp2, io1,
                            etc...).
                          type: string
                      required:
                      - size
                      type: object
                    type: array
                  placementGroupName:
                    description: PlacementGroupName specifies the name of the placement
                      group in which to launch the instance.
                    type: string
                  placementGroupPartition:
                    description: |-
                      PlacementGroupPartition is the partition number within the placement group in which to launch the instance.
                      This value is only valid if the placement group, referred in `PlacementGroupName`, was created with
                      strategy set to partition.
                    format: int64
                    maximum: 7
                    minimum: 1
                    type: integer
                  privateDnsName:
                    description: PrivateDNSName is the options for the instance hostname.
                    properties:
                      enableResourceNameDnsAAAARecord:
                        description: EnableResourceNameDNSAAAARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          AAAA records.
                        type: boolean
                      enableResourceNameDnsARecord:
                        description: EnableResourceNameDNSARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          A records.
                        type: boolean
                      hostnameType:
                        description: The type of hostname to assign to an instance.
                        enum:
                        - ip-name
                        - resource-name
                        type: string
                    type: object
                  privateIp:
                    description: The private IPv4 address assigned to the instance.
                    type: string
                  publicIPOnLaunch:
                    description: PublicIPOnLaunch is the option to associate a public
                      IP on instance launch
                    type: boolean
                  publicIp:
                    description: The public IPv4 address assigned to the instance,
                      if applicable.
                    type: string
                  rootVolume:
                    description: Configuration options for the root storage volume.
                    properties:
                      deviceName:
                        description: Device name
                        type: string
                      encrypted:
                        description: Encrypted is whether the volume should be encrypted
                          or not.
                        type: boolean
                      encryptionKey:
                        description: |-
                          EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                          If Encrypted is set and this is omitted, the default AWS key will be used.
                          The key must already exist and be accessible by the controller.
                        type: string
                      iops:
                        description: IOPS is the number of IOPS requested for the
                          disk. Not applicable to all types.
                        format: int64
                        type: integer
                      size:
                        description: |-
                          Size specifies size (in Gi) of the storage device.
                          Must be greater than the image snapshot size or 8 (whichever is greater).
                        format: int64
                        minimum: 8
                        type: integer
                      throughput:
                        description: Throughput to provision in MiB/s supported for
                          the volume type. Not applicable to all types.
                        format: int64
                        type: integer
                      type:
                        description: Type is the type of the volume (e.g. gp2, io1,
                          etc...).
                        type: string
                    required:
                    - size
                    type: object
                  securityGroupIds:
                    description: SecurityGroupIDs are one or more security group IDs
                      this instance belongs to.
                    items:
                      type: string
                    type: array
                  spotMarketOptions:
                    description: SpotMarketOptions option for configuring instances
                      to be run using AWS Spot instances.
                    properties:
                      maxPrice:
                        description: MaxPrice defines the maximum price the user is
                          willing to pay for Spot VM instances
                        type: string
                    type: object
                  sshKeyName:
                    description: The name of the SSH key pair.
                    type: string
                  subnetId:
                    description: The ID of the subnet of the instance.
                    type: string
                  tags:
                    additionalProperties:
                      type: string
                    description: The tags associated with the instance.
                    type: object
                  tenancy:
                    description: Tenancy indicates if instance should run on shared
                      or single-tenant hardware.
                    type: string
                  type:
                    description: The instance type.
                    type: string
                  userData:
                    description: |-
                      UserData is the raw data script passed to the instance which is run upon bootstrap.
                      This field must not be base64 encoded and should only be used when running a new instance.
                    type: string
                  volumeIDs:
                    description: IDs of the instance's volumes
                    items:
                      type: string
                    type: array
                required:
                - id
                type: object
              conditions:
                description: Conditions specifies the cpnditions for the managed control
                  plane
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              externalManagedControlPlane:
                default: true
                description: |-
                  ExternalManagedControlPlane indicates to cluster-api that the control plane
                  is managed by an external service such as AKS, EKS, GKE, etc.
                type: boolean
              failureDomains:
                additionalProperties:
                  description: |-
                    FailureDomainSpec is the Schema for Cluster API failure domains.
                    It allows controllers to understand how many failure domains a cluster can optionally span across.
                  properties:
                    attributes:
                      additionalProperties:
                        type: string
                      description: Attributes is a free form map of attributes an
                        infrastructure provider might use or require.
                      type: object
                    controlPlane:
                      description: ControlPlane determines if this failure domain
                        is suitable for use by control plane machines.
                      type: boolean
                  type: object
                description: FailureDomains specifies a list fo available availability
                  zones that can be used
                type: object
              failureMessage:
                description: |-
                  ErrorMessage indicates that there is a terminal problem reconciling the
                  state, and will be set to a descriptive error message.
                type: string
              identityProviderStatus:
                description: |-
                  IdentityProviderStatus holds the status for
                  associated identity provider
                properties:
                  arn:
                    description: ARN holds the ARN of associated identity provider
                    type: string
                  status:
                    description: Status holds current status of associated identity
                      provider
                    type: string
                type: object
              initialized:
                description: |-
                  Initialized denotes whether or not the control plane has the
                  uploaded kubernetes config-map.
                type: boolean
              networkStatus:
                description: Networks holds details about the AWS networking resources
                  used by the control plane
                properties:
                  apiServerElb:
                    description: APIServerELB is the Kubernetes api server load balancer.
                    properties:
                      arn:
                        description: |-
                          ARN of the load balancer. Unlike the ClassicLB, ARN is used mostly
                          to define and get it.
                        type: string
                      attributes:
                        description: ClassicElbAttributes defines extra attributes
                          associated with the load balancer.
                        properties:
                          crossZoneLoadBalancing:
                            description: CrossZoneLoadBalancing enables the classic
                              load balancer load balancing.
                            type: boolean
                          idleTimeout:
                            description: |-
                              IdleTimeout is time that the connection is allowed to be idle (no data
                              has been sent over the connection) before it is closed by the load balancer.
                            format: int64
                            type: integer
                        type: object
                      availabilityZones:
                        description: AvailabilityZones is an array of availability
                          zones in the VPC attached to the load balancer.
                        items:
                          type: string
                        type: array
                      dnsName:
                        description: DNSName is the dns name of the load balancer.
                        type: string
                      elbAttributes:
                        additionalProperties:
                          type: string
                        description: ELBAttributes defines extra attributes associated
                          with v2 load balancers.
                        type: object
                      elbListeners:
                        description: ELBListeners is an array of listeners associated
                          with the load balancer. There must be at least one.
                        items:
                          description: Listener defines an AWS network load balancer
                            listener.
                          properties:
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            targetGroup:
                              description: |-
                                TargetGroupSpec specifies target group settings for a given listener.
                                This is created first, and the ARN is then passed to the listener.
                              properties:
                                name:
                                  description: Name of the TargetGroup. Must be unique
                                    over the same group of listeners.
                                  maxLength: 32
                                  type: string
                                port:
                                  description: Port is the exposed port
                                  format: int64
                                  type: integer
                                protocol:
                                  description: ELBProtocol defines listener protocols
                                    for a load balancer.
                                  enum:
                                  - tcp
                                  - tls
                                  - udp
                                  - TCP
                                  - TLS
                                  - UDP
                                  type: string
                                targetGroupHealthCheck:
                                  description: HealthCheck is the elb health check
                                    associated with the load balancer.
                                  properties:
                                    intervalSeconds:
                                      format: int64
                                      type: integer
                                    path:
                                      type: string
                                    port:
                                      type: string
                                    protocol:
                                      type: string
                                    thresholdCount:
                                      format: int64
                                      type: integer
                                    timeoutSeconds:
                                      format: int64
                                      type: integer
                                    unhealthyThresholdCount:
                                      format: int64
                                      type: integer
                                  type: object
                                vpcId:
                                  type: string
                              required:
                              - name
                              - port
                              - protocol
                              - vpcId
                              type: object
                          required:
                          - port
                          - protocol
                          - targetGroup
                          type: object
                        type: array
                      healthChecks:
                        description: HealthCheck is the classic elb health check associated
                          with the load balancer.
                        properties:
                          healthyThreshold:
                            format: int64
                            type: integer
                          interval:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          target:
                            type: string
                          timeout:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          unhealthyThreshold:
                            format: int64
                            type: integer
                        required:
                        - healthyThreshold
                        - interval
                        - target
                        - timeout
                        - unhealthyThreshold
                        type: object
                      listeners:
                        description: ClassicELBListeners is an array of classic elb
                          listeners associated with the load balancer. There must
                          be at least one.
                        items:
                          description: ClassicELBListener defines an AWS classic load
                            balancer listener.
                          properties:
                            instancePort:
                              format: int64
                              type: integer
                            instanceProtocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                          required:
                          - instancePort
                          - instanceProtocol
                          - port
                          - protocol
                          type: object
                        type: array
                      loadBalancerType:
                        description: LoadBalancerType sets the type for a load balancer.
                          The default type is classic.
                        enum:
                        - classic
                        - elb
                        - alb
                        - nlb
                        type: string
                      name:
                        description: |-
                          The name of the load balancer. It must be unique within the set of load balancers
                          defined in the region. It also serves as identifier.
                        type: string
                      scheme:
                        description: Scheme is the load balancer scheme, either internet-facing
                          or private.
                        type: string
                      securityGroupIds:
                        description: SecurityGroupIDs is an array of security groups
                          assigned to the load balancer.
                        items:
                          type: string
                        type: array
                      subnetIds:
                        description: SubnetIDs is an array of subnets in the VPC attached
                          to the load balancer.
                        items:
                          type: string
                        type: array
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a map of tags associated with the load
                          balancer.
                        type: object
                    type: object
                  natGatewaysIPs:
                    description: NatGatewaysIPs contains the public IPs of the NAT
                      Gateways
                    items:
                      type: string
                    type: array
                  secondaryAPIServerELB:
                    description: SecondaryAPIServerELB is the secondary Kubernetes
                      api server load balancer.
                    properties:
                      arn:
                        description: |-
                          ARN of the load balancer. Unlike the ClassicLB, ARN is used mostly
                          to define and get it.
                        type: string
                      attributes:
                        description: ClassicElbAttributes defines extra attributes
                          associated with the load balancer.
                        properties:
                          crossZoneLoadBalancing:
                            description: CrossZoneLoadBalancing enables the classic
                              load balancer load balancing.
                            type: boolean
                          idleTimeout:
                            description: |-
                              IdleTimeout is time that the connection is allowed to be idle (no data
                              has been sent over the connection) before it is closed by the load balancer.
                            format: int64
                            type: integer
                        type: object
                      availabilityZones:
                        description: AvailabilityZones is an array of availability
                          zones in the VPC attached to the load balancer.
                        items:
                          type: string
                        type: array
                      dnsName:
                        description: DNSName is the dns name of the load balancer.
                        type: string
                      elbAttributes:
                        additionalProperties:
                          type: string
                        description: ELBAttributes defines extra attributes associated
                          with v2 load balancers.
                        type: object
                      elbListeners:
                        description: ELBListeners is an array of listeners associated
                          with the load balancer. There must be at least one.
                        items:
                          description: Listener defines an AWS network load balancer
                            listener.
                          properties:
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            targetGroup:
                              description: |-
                                TargetGroupSpec specifies target group settings for a given listener.
                                This is created first, and the ARN is then passed to the listener.
                              properties:
                                name:
                                  description: Name of the TargetGroup. Must be unique
                                    over the same group of listeners.
                                  maxLength: 32
                                  type: string
                                port:
                                  description: Port is the exposed port
                                  format: int64
                                  type: integer
                                protocol:
                                  description: ELBProtocol defines listener protocols
                                    for a load balancer.
                                  enum:
                                  - tcp
                                  - tls
                                  - udp
                                  - TCP
                                  - TLS
                                  - UDP
                                  type: string
                                targetGroupHealthCheck:
                                  description: HealthCheck is the elb health check
                                    associated with the load balancer.
                                  properties:
                                    intervalSeconds:
                                      format: int64
                                      type: integer
                                    path:
                                      type: string
                                    port:
                                      type: string
                                    protocol:
                                      type: string
                                    thresholdCount:
                                      format: int64
                                      type: integer
                                    timeoutSeconds:
                                      format: int64
                                      type: integer
                                    unhealthyThresholdCount:
                                      format: int64
                                      type: integer
                                  type: object
                                vpcId:
                                  type: string
                              required:
                              - name
                              - port
                              - protocol
                              - vpcId
                              type: object
                          required:
                          - port
                          - protocol
                          - targetGroup
                          type: object
                        type: array
                      healthChecks:
                        description: HealthCheck is the classic elb health check associated
                          with the load balancer.
                        properties:
                          healthyThreshold:
                            format: int64
                            type: integer
                          interval:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          target:
                            type: string
                          timeout:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          unhealthyThreshold:
                            format: int64
                            type: integer
                        required:
                        - healthyThreshold
                        - interval
                        - target
                        - timeout
                        - unhealthyThreshold
                        type: object
                      listeners:
                        description: ClassicELBListeners is an array of classic elb
                          listeners associated with the load balancer. There must
                          be at least one.
                        items:
                          description: ClassicELBListener defines an AWS classic load
                            balancer listener.
                          properties:
                            instancePort:
                              format: int64
                              type: integer
                            instanceProtocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                          required:
                          - instancePort
                          - instanceProtocol
                          - port
                          - protocol
                          type: object
                        type: array
                      loadBalancerType:
                        description: LoadBalancerType sets the type for a load balancer.
                          The default type is classic.
                        enum:
                        - classic
                        - elb
                        - alb
                        - nlb
                        type: string
                      name:
                        description: |-
                          The name of the load balancer. It must be unique within the set of load balancers
                          defined in the region. It also serves as identifier.
                        type: string
                      scheme:
                        description: Scheme is the load balancer scheme, either internet-facing
                          or private.
                        type: string
                      securityGroupIds:
                        description: SecurityGroupIDs is an array of security groups
                          assigned to the load balancer.
                        items:
                          type: string
                        type: array
                      subnetIds:
                        description: SubnetIDs is an array of subnets in the VPC attached
                          to the load balancer.
                        items:
                          type: string
                        type: array
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a map of tags associated with the load
                          balancer.
                        type: object
                    type: object
                  securityGroups:
                    additionalProperties:
                      description: SecurityGroup defines an AWS security group.
                      properties:
                        id:
                          description: ID is a unique identifier.
                          type: string
                        ingressRule:
                          description: IngressRules is the inbound rules associated
                            with the security group.
                          items:
                            description: IngressRule defines an AWS ingress rule for
                              security groups.
                            properties:
                              cidrBlocks:
                                description: List of CIDR blocks to allow access from.
                                  Cannot be specified with SourceSecurityGroupID.
                                items:
                                  type: string
                                type: array
                              description:
                                description: Description provides extended information
                                  about the ingress rule.
                                type: string
                              fromPort:
                                description: FromPort is the start of port range.
                                format: int64
                                type: integer
                              ipv6CidrBlocks:
                                description: List of IPv6 CIDR blocks to allow access
                                  from. Cannot be specified with SourceSecurityGroupID.
                                items:
                                  type: string
                                type: array
                              natGatewaysIPsSource:
                                description: NatGatewaysIPsSource use the NAT gateways
                                  IPs as the source for the ingress rule.
                                type: boolean
                              protocol:
                                description: Protocol is the protocol for the ingress
                                  rule. Accepted values are "-1" (all), "4" (IP in
                                  IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
                                  (ESP).
                                enum:
                                - "-1"
                                - "4"
                                - tcp
                                - udp
                                - icmp
                                - "58"
                                - "50"
                                type: string
                              sourceSecurityGroupIds:
                                description: The security group id to allow access
                                  from. Cannot be specified with CidrBlocks.
                                items:
                                  type: string
                                type: array
                              sourceSecurityGroupRoles:
                                description: |-
                                  The security group role to allow access from. Cannot be specified with CidrBlocks.
                                  The field will be combined with source security group IDs if specified.
                                items:
                                  description: SecurityGroupRole defines the unique
                                    role of a security group.
                                  enum:
                                  - bastion
                                  - node
                                  - controlplane
                                  - apiserver-lb
                                  - lb
                                  - node-eks-additional
                                  type: string
                                type: array
                              toPort:
                                description: ToPort is the end of port range.
                                format: int64
                                type: integer
                            required:
                            - description
                            - fromPort
                            - protocol
                            - toPort
                            type: object
                          type: array
                        name:
                          description: Name is the security group name.
                          type: string
                        tags:
                          additionalProperties:
                            type: string
                          description: Tags is a map of tags associated with the security
                            group.
                          type: object
                      required:
                      - id
                      - name
                      type: object
                    description: SecurityGroups is a map from the role/kind of the
                      security group to its unique name, if any.
                    type: object
                type: object
              oidcProvider:
                description: OIDCProvider holds the status of the identity provider
                  for this cluster
                properties:
                  arn:
                    description: ARN holds the ARN of the provider
                    type: string
                  trustPolicy:
                    description: TrustPolicy contains the boilerplate IAM trust policy
                      to use for IRSA
                    type: string
                type: object
              ready:
                default: false
                description: |-
                  Ready denotes that the AWSManagedControlPlane API Server is ready to
                  receive requests and that the VPC infra is ready.
                type: boolean
            required:
            - ready
            type: object
        type: object
    served: false
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - description: Cluster to which this AWSManagedControl belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: Control plane infrastructure is ready for worker nodes
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: AWS VPC the control plane is using
      jsonPath: .spec.network.vpc.id
      name: VPC
      type: string
    - description: API Endpoint
      jsonPath: .spec.controlPlaneEndpoint.host
      name: Endpoint
      priority: 1
      type: string
    - description: Bastion IP address for breakglass access
      jsonPath: .status.bastion.publicIp
      name: Bastion IP
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSManagedControlPlane is the schema for the Amazon EKS Managed
          Control Plane API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSManagedControlPlaneSpec defines the desired state of an
              Amazon EKS Cluster.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: |-
                  AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the
                  ones added by default.
                type: object
              addons:
                description: Addons defines the EKS addons to enable with the EKS
                  cluster.
                items:
                  description: Addon represents a EKS addon.
                  properties:
                    configuration:
                      description: Configuration of the EKS addon
                      type: string
                    conflictResolution:
                      default: overwrite
                      description: |-
                        ConflictResolution is used to declare what should happen if there
                        are parameter conflicts. Defaults to none
                      enum:
                      - overwrite
                      - none
                      type: string
                    name:
                      description: Name is the name of the addon
                      minLength: 2
                      type: string
                    serviceAccountRoleARN:
                      description: ServiceAccountRoleArn is the ARN of an IAM role
                        to bind to the addons service account
                      type: string
                    version:
                      description: Version is the version of the addon to use
                      type: string
                  required:
                  - name
                  - version
                  type: object
                type: array
              associateOIDCProvider:
                default: false
                description: |-
                  AssociateOIDCProvider can be enabled to automatically create an identity
                  provider for the controller for use with IAM roles for service accounts
                type: boolean
              bastion:
                description: Bastion contains options to configure the bastion host.
                properties:
                  allowedCIDRBlocks:
                    description: |-
                      AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.
                      They are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).
                    items:
                      type: string
                    type: array
                  ami:
                    description: |-
                      AMI will use the specified AMI to boot the bastion. If not specified,
                      the AMI will default to one picked out in public space.
                    type: string
                  disableIngressRules:
                    description: |-
                      DisableIngressRules will ensure there are no Ingress rules in the bastion host's security group.
                      Requires AllowedCIDRBlocks to be empty.
                    type: boolean
                  enabled:
                    description: |-
                      Enabled allows this provider to create a bastion host instance
                      with a public ip to access the VPC private network.
                    type: boolean
                  instanceType:
                    description: |-
                      InstanceType will use the specified instance type for the bastion. If not specified,
                      Cluster API Provider AWS will use t3.micro for all regions except us-east-1, where t2.micro
                      will be the default.
                    type: string
                type: object
              controlPlaneEndpoint:
                description: ControlPlaneEndpoint represents the endpoint used to
                  communicate with the control plane.
                properties:
                  host:
                    description: The hostname on which the API server is serving.
                    type: string
                  port:
                    description: The port on which the API server is serving.
                    format: int32
                    type: integer
                required:
                - host
                - port
                type: object
              eksClusterName:
                description: |-
                  EKSClusterName allows you to specify the name of the EKS cluster in
                  AWS. If you don't specify a name then a default name will be created
                  based on the namespace and name of the managed control plane.
                type: string
              encryptionConfig:
                description: EncryptionConfig specifies the encryption configuration
                  for the cluster
                properties:
                  provider:
                    description: Provider specifies the ARN or alias of the CMK (in
                      AWS KMS)
                    type: string
                  resources:
                    description: Resources specifies the resources to be encrypted
                    items:
                      type: string
                    type: array
                type: object
              endpointAccess:
                description: Endpoints specifies access to this cluster's control
                  plane endpoints
                properties:
                  private:
                    description: Private points VPC-internal control plane access
                      to the private endpoint
                    type: boolean
                  public:
                    description: Public controls whether control plane endpoints are
                      publicly accessible
                    type: boolean
                  publicCIDRs:
                    description: PublicCIDRs specifies which blocks can access the
                      public endpoint
                    items:
                      type: string
                    type: array
                type: object
              iamAuthenticatorConfig:
                description: |-
                  IAMAuthenticatorConfig allows the specification of any additional user or role mappings
                  for use when generating the aws-iam-authenticator configuration. If this is nil the
                  default configuration is still generated for the cluster.
                properties:
                  mapRoles:
                    description: RoleMappings is a list of role mappings
                    items:
                      description: RoleMapping represents a mapping from a IAM role
                        to Kubernetes users and groups.
                      properties:
                        groups:
                          description: Groups is a list of kubernetes RBAC groups
                          items:
                            type: string
                          type: array
                        rolearn:
                          description: RoleARN is the AWS ARN for the role to map
                          minLength: 31
                          type: string
                        username:
                          description: UserName is a kubernetes RBAC user subject
                          type: string
                      required:
                      - groups
                      - rolearn
                      - username
                      type: object
                    type: array
                  mapUsers:
                    description: UserMappings is a list of user mappings
                    items:
                      description: UserMapping represents a mapping from an IAM user
                        to Kubernetes users and groups.
                      properties:
                        groups:
                          description: Groups is a list of kubernetes RBAC groups
                          items:
                            type: string
                          type: array
                        userarn:
                          description: UserARN is the AWS ARN for the user to map
                          minLength: 31
                          type: string
                        username:
                          description: UserName is a kubernetes RBAC user subject
                          type: string
                      required:
                      - groups
                      - userarn
                      - username
                      type: object
                    type: array
                type: object
              identityRef:
                description: |-
                  IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
                  If no identity is specified, the default identity for this controller will be used.
                properties:
                  kind:
                    description: Kind of the identity.
                    enum:
                    - AWSClusterControllerIdentity
                    - AWSClusterRoleIdentity
                    - AWSClusterStaticIdentity
                    type: string
                  name:
                    description: Name of the identity.
                    minLength: 1
                    type: string
                required:
                - kind
                - name
                type: object
              imageLookupBaseOS:
                description: |-
                  ImageLookupBaseOS is the name of the base operating system used to look
                  up machine images when a machine does not specify an AMI. When set, this
                  will be used for all cluster machines unless a machine specifies a
                  different ImageLookupBaseOS.
                type: string
              imageLookupFormat:
                description: |-
                  ImageLookupFormat is the AMI naming format to look up machine images when
                  a machine does not specify an AMI. When set, this will be used for all
                  cluster machines unless a machine specifies a different ImageLookupOrg.
                  Supports substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base
                  OS and kubernetes version, respectively. The BaseOS will be the value in
                  ImageLookupBaseOS or ubuntu (the default), and the kubernetes version as
                  defined by the packages produced by kubernetes/release without v as a
                  prefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default
                  image format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up
                  searching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a
                  Machine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See
                  also: https://golang.org/pkg/text/template/
                type: string
              imageLookupOrg:
                description: |-
                  ImageLookupOrg is the AWS Organization ID to look up machine images when a
                  machine does not specify an AMI. When set, this will be used for all
                  cluster machines unless a machine specifies a different ImageLookupOrg.
                type: string
              kubeProxy:
                description: KubeProxy defines managed attributes of the kube-proxy
                  daemonset
                properties:
                  disable:
                    default: false
                    description: |-
                      Disable set to true indicates that kube-proxy should be disabled. With EKS clusters
                      kube-proxy is automatically installed into the cluster. For clusters where you want
                      to use kube-proxy functionality that is provided with an alternate CNI, this option
                      provides a way to specify that the kube-proxy daemonset should be deleted. You cannot
                      set this to true if you are using the Amazon kube-proxy addon.
                    type: boolean
                type: object
              logging:
                description: |-
                  Logging specifies which EKS Cluster logs should be enabled. Entries for
                  each of the enabled logs will be sent to CloudWatch
                properties:
                  apiServer:
                    default: false
                    description: APIServer indicates if the Kubernetes API Server
                      log (kube-apiserver) shoulkd be enabled
                    type: boolean
                  audit:
                    default: false
                    description: Audit indicates if the Kubernetes API audit log should
                      be enabled
                    type: boolean
                  authenticator:
                    default: false
                    description: Authenticator indicates if the iam authenticator
                      log should be enabled
                    type: boolean
                  controllerManager:
                    default: false
                    description: ControllerManager indicates if the controller manager
                      (kube-controller-manager) log should be enabled
                    type: boolean
                  scheduler:
                    default: false
                    description: Scheduler indicates if the Kubernetes scheduler (kube-scheduler)
                      log should be enabled
                    type: boolean
                required:
                - apiServer
                - audit
                - authenticator
                - controllerManager
                - scheduler
                type: object
              network:
                description: NetworkSpec encapsulates all things related to AWS network.
                properties:
                  additionalControlPlaneIngressRules:
                    description: AdditionalControlPlaneIngressRules is an optional
                      set of ingress rules to add to the control plane
                    items:
                      description: IngressRule defines an AWS ingress rule for security
                        groups.
                      properties:
                        cidrBlocks:
                          description: List of CIDR blocks to allow access from. Cannot
                            be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        description:
                          description: Description provides extended information about
                            the ingress rule.
                          type: string
                        fromPort:
                          description: FromPort is the start of port range.
                          format: int64
                          type: integer
                        ipv6CidrBlocks:
                          description: List of IPv6 CIDR blocks to allow access from.
                            Cannot be specified with SourceSecurityGroupID.
                          items:
                            type: string
                          type: array
                        natGatewaysIPsSource:
                          description: NatGatewaysIPsSource use the NAT gateways IPs
                            as the source for the ingress rule.
                          type: boolean
                        protocol:
                          description: Protocol is the protocol for the ingress rule.
                            Accepted values are "-1" (all), "4" (IP in IP),"tcp",
                            "udp", "icmp", and "58" (ICMPv6), "50" (ESP).
                          enum:
                          - "-1"
                          - "4"
                          - tcp
                          - udp
                          - icmp
                          - "58"
                          - "50"
                          type: string
                        sourceSecurityGroupIds:
                          description: The security group id to allow access from.
                            Cannot be specified with CidrBlocks.
                          items:
                            type: string
                          type: array
                        sourceSecurityGroupRoles:
                          description: |-
                            The security group role to allow access from. Cannot be specified with CidrBlocks.
                            The field will be combined with source security group IDs if specified.
                          items:
                            description: SecurityGroupRole defines the unique role
                              of a security group.
                            enum:
                            - bastion
                            - node
                            - controlplane
                            - apiserver-lb
                            - lb
                            - node-eks-additional
                            type: string
                          type: array
                        toPort:
                          description: ToPort is the end of port range.
                          format: int64
                          type: integer
                      required:
                      - description
                      - fromPort
                      - protocol
                      - toPort
                      type: object
                    type: array
                  cni:
                    description: CNI configuration
                    properties:
                      cniIngressRules:
                        description: |-
                          CNIIngressRules specify rules to apply to control plane and worker node security groups.
                          The source for the rule will be set to control plane and worker security group IDs.
                        items:
                          description: CNIIngressRule defines an AWS ingress rule
                            for CNI requirements.
                          properties:
                            description:
                              type: string
                            fromPort:
                              format: int64
                              type: integer
                            protocol:
                              description: SecurityGroupProtocol defines the protocol
                                type for a security group rule.
                              type: string
                            toPort:
                              format: int64
                              type: integer
                          required:
                          - description
                          - fromPort
                          - protocol
                          - toPort
                          type: object
                        type: array
                    type: object
                  nodePortIngressRuleCidrBlocks:
                    description: |-
                      NodePortIngressRuleCidrBlocks is an optional set of CIDR blocks to allow traffic to nodes' NodePort services.
                      If none are specified here, all IPs are allowed to connect.
                    items:
                      type: string
                    type: array
                  securityGroupOverrides:
                    additionalProperties:
                      type: string
                    description: |-
                      SecurityGroupOverrides is an optional set of security groups to use for cluster instances
                      This is optional - if not provided new security groups will be created for the cluster
                    type: object
                  subnets:
                    description: Subnets configuration.
                    items:
                      description: SubnetSpec configures an AWS Subnet.
                      properties:
                        availabilityZone:
                          description: AvailabilityZone defines the availability zone
                            to use for this subnet in the cluster's region.
                          type: string
                        cidrBlock:
                          description: CidrBlock is the CIDR block to be used when
                            the provider creates a managed VPC.
                          type: string
                        id:
                          description: |-
                            ID defines a unique identifier to reference this resource.
                            If you're bringing your subnet, set the AWS subnet-id here, it must start with `subnet-`.


                            When the VPC is managed by CAPA, and you'd like the provider to create a subnet for you,
                            the id can be set to any placeholder value that does not start with `subnet-`;
                            upon creation, the subnet AWS identifier will be populated in the `ResourceID` field and
                            the `id` field is going to be used as the subnet name. If you specify a tag
                            called `Name`, it takes precedence.
                          type: string
                        ipv6CidrBlock:
                          description: |-
                            IPv6CidrBlock is the IPv6 CIDR block to be used when the provider creates a managed VPC.
                            A subnet can have an IPv4 and an IPv6 address.
                            IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                          type: string
                        isIpv6:
                          description: |-
                            IsIPv6 defines the subnet as an IPv6 subnet. A subnet is IPv6 when it is associated with a VPC that has IPv6 enabled.
                            IPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.
                          type: boolean
                        isPublic:
                          description: IsPublic defines the subnet as a public subnet.
                            A subnet is public when it is associated with a route
                            table that has a route to an internet gateway.
                          type: boolean
                        natGatewayId:
                          description: |-
                            NatGatewayID is the NAT gateway id associated with the subnet.
                            Ignored unless the subnet is managed by the provider, in which case this is set on the public subnet where the NAT gateway resides. It is then used to determine routes for private subnets in the same AZ as the public subnet.
                          type: string
                        parentZoneName:
                          description: |-
                            ParentZoneName is the zone name where the current subnet's zone is tied when
                            the zone is a Local Zone.


                            The subnets in Local Zone or Wavelength Zone locations consume the ParentZoneName
                            to select the correct private route table to egress traffic to the internet.
                          type: string
                        resourceID:
                          description: |-
                            ResourceID is the subnet identifier from AWS, READ ONLY.
                            This field is populated when the provider manages the subnet.
                          type: string
                        routeTableId:
                          description: RouteTableID is the routing table id associated
                            with the subnet.
                          type: string
                        tags:
                          additionalProperties:
                            type: string
                          description: Tags is a collection of tags describing the
                            resource.
                          type: object
                        zoneType:
                          description: |-
                            ZoneType defines the type of the zone where the subnet is created.


                            The valid values are availability-zone, local-zone, and wavelength-zone.


                            Subnet with zone type availability-zone (regular) is always selected to create cluster
                            resources, like Load Balancers, NAT Gateways, Contol Plane nodes, etc.


                            Subnet with zone type local-zone or wavelength-zone is not eligible to automatically create
                            regular cluster resources.


                            The public subnet in availability-zone or local-zone is associated with regular public
                            route table with default route entry to a Internet Gateway.


                            The public subnet in wavelength-zone is associated with a carrier public
                            route table with default route entry to a Carrier Gateway.


                            The private subnet in the availability-zone is associated with a private route table with
                            the default route entry to a NAT Gateway created in that zone.


                            The private subnet in the local-zone or wavelength-zone is associated with a private route table with
                            the default route entry re-using the NAT Gateway in the Region (preferred from the
                            parent zone, the zone type availability-zone in the region, or first table available).
                          enum:
                          - availability-zone
                          - local-zone
                          - wavelength-zone
                          type: string
                      required:
                      - id
                      type: object
                    type: array
                    x-kubernetes-list-map-keys:
                    - id
                    x-kubernetes-list-type: map
                  vpc:
                    description: VPC configuration.
                    properties:
                      availabilityZoneSelection:
                        default: Ordered
                        description: |-
                          AvailabilityZoneSelection specifies how AZs should be selected if there are more AZs
                          in a region than specified by AvailabilityZoneUsageLimit. There are 2 selection schemes:
                          Ordered - selects based on alphabetical order
                          Random - selects AZs randomly in a region
                          Defaults to Ordered
                        enum:
                        - Ordered
                        - Random
                        type: string
                      availabilityZoneUsageLimit:
                        default: 3
                        description: |-
                          AvailabilityZoneUsageLimit specifies the maximum number of availability zones (AZ) that
                          should be used in a region when automatically creating subnets. If a region has more
                          than this number of AZs then this number of AZs will be picked randomly when creating
                          default subnets. Defaults to 3
                        minimum: 1
                        type: integer
                      carrierGatewayId:
                        description: |-
                          CarrierGatewayID is the id of the internet gateway associated with the VPC,
                          for carrier network (Wavelength Zones).
                        type: string
                        x-kubernetes-validations:
                        - message: Carrier Gateway ID must start with 'cagw-'
                          rule: self.startsWith('cagw-')
                      cidrBlock:
                        description: |-
                          CidrBlock is the CIDR block to be used when the provider creates a managed VPC.
                          Defaults to 10.0.0.0/16.
                          Mutually exclusive with IPAMPool.
                        type: string
                      elasticIpPool:
                        description: |-
                          ElasticIPPool contains specific configuration to allocate Public IPv4 address (Elastic IP) from user-defined pool
                          brought to AWS for core infrastructure resources, like NAT Gateways and Public Network Load Balancers for
                          the API Server.
                        properties:
                          publicIpv4Pool:
                            description: |-
                              PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources
                              created in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom
                              Public IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool
                              resource ID starts with 'ipv4pool-ec2'.
                            maxLength: 30
                            type: string
                          publicIpv4PoolFallbackOrder:
                            description: |-
                              PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,
                              no more IPv4 address available in the pool.


                              When set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the
                              IPv4 limit, the address will be claimed from Amazon-pool (default).


                              When set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.
                            enum:
                            - amazon-pool
                            - none
                            type: string
                            x-kubernetes-validations:
                            - message: allowed values are 'none' and 'amazon-pool'
                              rule: self in ['none','amazon-pool']
                        type: object
                      emptyRoutesDefaultVPCSecurityGroup:
                        description: |-
                          EmptyRoutesDefaultVPCSecurityGroup specifies whether the default VPC security group ingress
                          and egress rules should be removed.


                          By default, when creating a VPC, AWS creates a security group called `default` with ingress and egress
                          rules that allow traffic from anywhere. The group could be used as a potential surface attack and
                          it's generally suggested that the group rules are removed or modified appropriately.


                          NOTE: This only applies when the VPC is managed by the Cluster API AWS controller.
                        type: boolean
                      id:
                        description: ID is the vpc-id of the VPC this provider should
                          use to create resources.
                        type: string
                      internetGatewayId:
                        description: InternetGatewayID is the id of the internet gateway
                          associated with the VPC.
                        type: string
                      ipamPool:
                        description: |-
                          IPAMPool defines the IPAMv4 pool to be used for VPC.
                          Mutually exclusive with CidrBlock.
                        properties:
                          id:
                            description: ID is the ID of the IPAM pool this provider
                              should use to create VPC.
                            type: string
                          name:
                            description: Name is the name of the IPAM pool this provider
                              should use to create VPC.
                            type: string
                          netmaskLength:
                            description: |-
                              The netmask length of the IPv4 CIDR you want to allocate to VPC from
                              an Amazon VPC IP Address Manager (IPAM) pool.
                              Defaults to /16 for IPv4 if not specified.
                            format: int64
                            type: integer
                        type: object
                      ipv6:
                        description: |-
                          IPv6 contains ipv6 specific settings for the network. Supported only in managed clusters.
                          This field cannot be set on AWSCluster object.
                        properties:
                          cidrBlock:
                            description: |-
                              CidrBlock is the CIDR block provided by Amazon when VPC has enabled IPv6.
                              Mutually exclusive with IPAMPool.
                            type: string
                          egressOnlyInternetGatewayId:
                            description: EgressOnlyInternetGatewayID is the id of
                              the egress only internet gateway associated with an
                              IPv6 enabled VPC.
                            type: string
                          ipamPool:
                            description: |-
                              IPAMPool defines the IPAMv6 pool to be used for VPC.
                              Mutually exclusive with CidrBlock.
                            properties:
                              id:
                                description: ID is the ID of the IPAM pool this provider
                                  should use to create VPC.
                                type: string
                              name:
                                description: Name is the name of the IPAM pool this
                                  provider should use to create VPC.
                                type: string
                              netmaskLength:
                                description: |-
                                  The netmask length of the IPv4 CIDR you want to allocate to VPC from
                                  an Amazon VPC IP Address Manager (IPAM) pool.
                                  Defaults to /16 for IPv4 if not specified.
                                format: int64
                                type: integer
                            type: object
                          poolId:
                            description: |-
                              PoolID is the IP pool which must be defined in case of BYO IP is defined.
                              Must be specified if CidrBlock is set.
                              Mutually exclusive with IPAMPool.
                            type: string
                        type: object
                      privateDnsHostnameTypeOnLaunch:
                        description: |-
                          PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.
                          For IPv4-only and dual-stack (IPv4 and IPv6) subnets, an instance DNS name can be based on the instance IPv4 address (ip-name)
                          or the instance ID (resource-name). For IPv6 only subnets, an instance DNS name must be based on the instance ID (resource-name).
                        enum:
                        - ip-name
                        - resource-name
                        type: string
                      secondaryCidrBlocks:
                        description: |-
                          SecondaryCidrBlocks are additional CIDR blocks to be associated when the provider creates a managed VPC.
                          Defaults to none. Mutually exclusive with IPAMPool. This makes sense to use if, for example, you want to use
                          a separate IP range for pods (e.g. Cilium ENI mode).
                        items:
                          description: VpcCidrBlock defines the CIDR block and settings
                            to associate with the managed VPC. Currently, only IPv4
                            is supported.
                          properties:
                            ipv4CidrBlock:
                              description: IPv4CidrBlock is the IPv4 CIDR block to
                                associate with the managed VPC.
                              minLength: 1
                              type: string
                          required:
                          - ipv4CidrBlock
                          type: object
                        type: array
                      subnetSchema:
                        default: PreferPrivate
                        description: |-
                          SubnetSchema specifies how CidrBlock should be divided on subnets in the VPC depending on the number of AZs.
                          PreferPrivate - one private subnet for each AZ plus one other subnet that will be further sub-divided for the public subnets.
                          PreferPublic - have the reverse logic of PreferPrivate, one public subnet for each AZ plus one other subnet
                          that will be further sub-divided for the private subnets.
                          Defaults to PreferPrivate
                        enum:
                        - PreferPrivate
                        - PreferPublic
                        type: string
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a collection of tags describing the resource.
                        type: object
                    type: object
                type: object
              oidcIdentityProviderConfig:
                description: |-
                  IdentityProviderconfig is used to specify the oidc provider config
                  to be attached with this eks cluster
                properties:
                  clientId:
                    description: |-
                      This is also known as audience. The ID for the client application that makes
                      authentication requests to the OpenID identity provider.
                    type: string
                  groupsClaim:
                    description: The JWT claim that the provider uses to return your
                      groups.
                    type: string
                  groupsPrefix:
                    description: |-
                      The prefix that is prepended to group claims to prevent clashes with existing
                      names (such as system: groups). For example, the valueoidc: will create group
                      names like oidc:engineering and oidc:infra.
                    type: string
                  identityProviderConfigName:
                    description: |-
                      The name of the OIDC provider configuration.


                      IdentityProviderConfigName is a required field
                    type: string
                  issuerUrl:
                    description: |-
                      The URL of the OpenID identity provider that allows the API server to discover
                      public signing keys for verifying tokens. The URL must begin with https://
                      and should correspond to the iss claim in the provider's OIDC ID tokens.
                      Per the OIDC standard, path components are allowed but query parameters are
                      not. Typically the URL consists of only a hostname, like https://server.example.org
                      or https://example.com. This URL should point to the level below .well-known/openid-configuration
                      and must be publicly accessible over the internet.
                    type: string
                  requiredClaims:
                    additionalProperties:
                      type: string
                    description: |-
                      The key value pairs that describe required claims in the identity token.
                      If set, each claim is verified to be present in the token with a matching
                      value. For the maximum number of claims that you can require, see Amazon
                      EKS service quotas (https://docs.aws.amazon.com/eks/latest/userguide/service-quotas.html)
                      in the Amazon EKS User Guide.
                    type: object
                  tags:
                    additionalProperties:
                      type: string
                    description: tags to apply to oidc identity provider association
                    type: object
                  usernameClaim:
                    description: |-
                      The JSON Web Token (JWT) claim to use as the username. The default is sub,
                      which is expected to be a unique identifier of the end user. You can choose
                      other claims, such as email or name, depending on the OpenID identity provider.
                      Claims other than email are prefixed with the issuer URL to prevent naming
                      clashes with other plug-ins.
                    type: string
                  usernamePrefix:
                    description: |-
                      The prefix that is prepended to username claims to prevent clashes with existing
                      names. If you do not provide this field, and username is a value other than
                      email, the prefix defaults to issuerurl#. You can use the value - to disable
                      all prefixing.
                    type: string
                type: object
              partition:
                description: Partition is the AWS security partition being used. Defaults
                  to "aws"
                type: string
              region:
                description: The AWS Region the cluster lives in.
                type: string
              restrictPrivateSubnets:
                default: false
                description: RestrictPrivateSubnets indicates that the EKS control
                  plane should only use private subnets.
                type: boolean
              roleAdditionalPolicies:
                description: |-
                  RoleAdditionalPolicies allows you to attach additional polices to
                  the control plane role. You must enable the EKSAllowAddRoles
                  feature flag to incorporate these into the created role.
                items:
                  type: string
                type: array
              roleName:
                description: |-
                  RoleName specifies the name of IAM role that gives EKS
                  permission to make API calls. If the role is pre-existing
                  we will treat it as unmanaged and not delete it on
                  deletion. If the EKSEnableIAM feature flag is true
                  and no name is supplied then a role is created.
                minLength: 2
                type: string
              secondaryCidrBlock:
                description: |-
                  SecondaryCidrBlock is the additional CIDR range to use for pod IPs.
                  Must be within the 100.64.0.0/10 or 198.19.0.0/16 range.
                type: string
              sshKeyName:
                description: SSHKeyName is the name of the ssh key to attach to the
                  bastion host. Valid values are empty string (do not use SSH keys),
                  a valid SSH key name, or omitted (use the default SSH key name)
                type: string
              tokenMethod:
                default: iam-authenticator
                description: |-
                  TokenMethod is used to specify the method for obtaining a client token for communicating with EKS
                  iam-authenticator - obtains a client token using iam-authentictor
                  aws-cli - obtains a client token using the AWS CLI
                  Defaults to iam-authenticator
                enum:
                - iam-authenticator
                - aws-cli
                type: string
              version:
                description: |-
                  Version defines the desired Kubernetes version. If no version number
                  is supplied then the latest version of Kubernetes that EKS supports
                  will be used.
                minLength: 2
                pattern: ^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.?(\.0|[1-9][0-9]*)?$
                type: string
              vpcCni:
                description: VpcCni is used to set configuration options for the VPC
                  CNI plugin
                properties:
                  disable:
                    default: false
                    description: |-
                      Disable indicates that the Amazon VPC CNI should be disabled. With EKS clusters the
                      Amazon VPC CNI is automatically installed into the cluster. For clusters where you want
                      to use an alternate CNI this option provides a way to specify that the Amazon VPC CNI
                      should be deleted. You cannot set this to true if you are using the
                      Amazon VPC CNI addon.
                    type: boolean
                  env:
                    description: Env defines a list of environment variables to apply
                      to the `aws-node` DaemonSet
                    items:
                      description: EnvVar represents an environment variable present
                        in a Container.
                      properties:
                        name:
                          description: Name of the environment variable. Must be a
                            C_IDENTIFIER.
                          type: string
                        value:
                          description: |-
                            Variable references $(VAR_NAME) are expanded
                            using the previously defined environment variables in the container and
                            any service environment variables. If a variable cannot be resolved,
                            the reference in the input string will be unchanged. Double $$ are reduced
                            to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
                            "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
                            Escaped references will never be expanded, regardless of whether the variable
                            exists or not.
                            Defaults to "".
                          type: string
                        valueFrom:
                          description: Source for the environment variable's value.
                            Cannot be used if value is not empty.
                          properties:
                            configMapKeyRef:
                              description: Selects a key of a ConfigMap.
                              properties:
                                key:
                                  description: The key to select.
                                  type: string
                                name:
                                  default: ""
                                  description: |-
                                    Name of the referent.
                                    This field is effectively required, but due to backwards compatibility is
                                    allowed to be empty. Instances of this type with an empty value here are
                                    almost certainly wrong.
                                    TODO: Add other useful fields. apiVersion, kind, uid?
                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                                  type: string
                                optional:
                                  description: Specify whether the ConfigMap or its
                                    key must be defined
                                  type: boolean
                              required:
                              - key
                              type: object
                              x-kubernetes-map-type: atomic
                            fieldRef:
                              description: |-
                                Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
                                spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
                              properties:
                                apiVersion:
                                  description: Version of the schema the FieldPath
                                    is written in terms of, defaults to "v1".
                                  type: string
                                fieldPath:
                                  description: Path of the field to select in the
                                    specified API version.
                                  type: string
                              required:
                              - fieldPath
                              type: object
                              x-kubernetes-map-type: atomic
                            resourceFieldRef:
                              description: |-
                                Selects a resource of the container: only resources limits and requests
                                (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
                              properties:
                                containerName:
                                  description: 'Container name: required for volumes,
                                    optional for env vars'
                                  type: string
                                divisor:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  description: Specifies the output format of the
                                    exposed resources, defaults to "1"
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                resource:
                                  description: 'Required: resource to select'
                                  type: string
                              required:
                              - resource
                              type: object
                              x-kubernetes-map-type: atomic
                            secretKeyRef:
                              description: Selects a key of a secret in the pod's
                                namespace
                              properties:
                                key:
                                  description: The key of the secret to select from.  Must
                                    be a valid secret key.
                                  type: string
                                name:
                                  default: ""
                                  description: |-
                                    Name of the referent.
                                    This field is effectively required, but due to backwards compatibility is
                                    allowed to be empty. Instances of this type with an empty value here are
                                    almost certainly wrong.
                                    TODO: Add other useful fields. apiVersion, kind, uid?
                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                    TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                                  type: string
                                optional:
                                  description: Specify whether the Secret or its key
                                    must be defined
                                  type: boolean
                              required:
                              - key
                              type: object
                              x-kubernetes-map-type: atomic
                          type: object
                      required:
                      - name
                      type: object
                    type: array
                type: object
            type: object
          status:
            description: AWSManagedControlPlaneStatus defines the observed state of
              an Amazon EKS Cluster.
            properties:
              addons:
                description: Addons holds the current status of the EKS addons
                items:
                  description: AddonState represents the state of an addon.
                  properties:
                    arn:
                      description: ARN is the AWS ARN of the addon
                      type: string
                    createdAt:
                      description: CreatedAt is the date and time the addon was created
                        at
                      format: date-time
                      type: string
                    issues:
                      description: Issues is a list of issue associated with the addon
                      items:
                        description: AddonIssue represents an issue with an addon.
                        properties:
                          code:
                            description: Code is the issue code
                            type: string
                          message:
                            description: Message is the textual description of the
                              issue
                            type: string
                          resourceIds:
                            description: ResourceIDs is a list of resource ids for
                              the issue
                            items:
                              type: string
                            type: array
                        type: object
                      type: array
                    modifiedAt:
                      description: ModifiedAt is the date and time the addon was last
                        modified
                      format: date-time
                      type: string
                    name:
                      description: Name is the name of the addon
                      type: string
                    serviceAccountRoleARN:
                      description: ServiceAccountRoleArn is the ARN of the IAM role
                        used for the service account
                      type: string
                    status:
                      description: Status is the status of the addon
                      type: string
                    version:
                      description: Version is the version of the addon to use
                      type: string
                  required:
                  - arn
                  - name
                  - version
                  type: object
                type: array
              bastion:
                description: Bastion holds details of the instance that is used as
                  a bastion jump box
                properties:
                  addresses:
                    description: Addresses contains the AWS instance associated addresses.
                    items:
                      description: MachineAddress contains information for the node's
                        address.
                      properties:
                        address:
                          description: The machine address.
                          type: string
                        type:
                          description: Machine address type, one of Hostname, ExternalIP,
                            InternalIP, ExternalDNS or InternalDNS.
                          type: string
                      required:
                      - address
                      - type
                      type: object
                    type: array
                  availabilityZone:
                    description: Availability zone of instance
                    type: string
                  capacityReservationId:
                    description: CapacityReservationID specifies the target Capacity
                      Reservation into which the instance should be launched.
                    type: string
                  ebsOptimized:
                    description: Indicates whether the instance is optimized for Amazon
                      EBS I/O.
                    type: boolean
                  enaSupport:
                    description: Specifies whether enhanced networking with ENA is
                      enabled.
                    type: boolean
                  iamProfile:
                    description: The name of the IAM instance profile associated with
                      the instance, if applicable.
                    type: string
                  id:
                    type: string
                  imageId:
                    description: The ID of the AMI used to launch the instance.
                    type: string
                  instanceMetadataOptions:
                    description: InstanceMetadataOptions is the metadata options for
                      the EC2 instance.
                    properties:
                      httpEndpoint:
                        default: enabled
                        description: |-
                          Enables or disables the HTTP metadata endpoint on your instances.


                          If you specify a value of disabled, you cannot access your instance metadata.


                          Default: enabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                      httpPutResponseHopLimit:
                        default: 1
                        description: |-
                          The desired HTTP PUT response hop limit for instance metadata requests. The
                          larger the number, the further instance metadata requests can travel.


                          Default: 1
                        format: int64
                        maximum: 64
                        minimum: 1
                        type: integer
                      httpTokens:
                        default: optional
                        description: |-
                          The state of token usage for your instance metadata requests.


                          If the state is optional, you can choose to retrieve instance metadata with
                          or without a session token on your request. If you retrieve the IAM role
                          credentials without a token, the version 1.0 role credentials are returned.
                          If you retrieve the IAM role credentials using a valid session token, the
                          version 2.0 role credentials are returned.


                          If the state is required, you must send a session token with any instance
                          metadata retrieval requests. In this state, retrieving the IAM role credentials
                          always returns the version 2.0 credentials; the version 1.0 credentials are
                          not available.


                          Default: optional
                        enum:
                        - optional
                        - required
                        type: string
                      instanceMetadataTags:
                        default: disabled
                        description: |-
                          Set to enabled to allow access to instance tags from the instance metadata.
                          Set to disabled to turn off access to instance tags from the instance metadata.
                          For more information, see Work with instance tags using the instance metadata
                          (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS).


                          Default: disabled
                        enum:
                        - enabled
                        - disabled
                        type: string
                    type: object
                  instanceState:
                    description: The current state of the instance.
                    type: string
                  networkInterfaces:
                    description: Specifies ENIs attached to instance
                    items:
                      type: string
                    type: array
                  nonRootVolumes:
                    description: Configuration options for the non root storage volumes.
                    items:
                      description: Volume encapsulates the configuration options for
                        the storage device.
                      properties:
                        deviceName:
                          description: Device name
                          type: string
                        encrypted:
                          description: Encrypted is whether the volume should be encrypted
                            or not.
                          type: boolean
                        encryptionKey:
                          description: |-
                            EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                            If Encrypted is set and this is omitted, the default AWS key will be used.
                            The key must already exist and be accessible by the controller.
                          type: string
                        iops:
                          description: IOPS is the number of IOPS requested for the
                            disk. Not applicable to all types.
                          format: int64
                          type: integer
                        size:
                          description: |-
                            Size specifies size (in Gi) of the storage device.
                            Must be greater than the image snapshot size or 8 (whichever is greater).
                          format: int64
                          minimum: 8
                          type: integer
                        throughput:
                          description: Throughput to provision in MiB/s supported
                            for the volume type. Not applicable to all types.
                          format: int64
                          type: integer
                        type:
                          description: Type is the type of the volume (e.g. gp2, io1,
                            etc...).
                          type: string
                      required:
                      - size
                      type: object
                    type: array
                  placementGroupName:
                    description: PlacementGroupName specifies the name of the placement
                      group in which to launch the instance.
                    type: string
                  placementGroupPartition:
                    description: |-
                      PlacementGroupPartition is the partition number within the placement group in which to launch the instance.
                      This value is only valid if the placement group, referred in `PlacementGroupName`, was created with
                      strategy set to partition.
                    format: int64
                    maximum: 7
                    minimum: 1
                    type: integer
                  privateDnsName:
                    description: PrivateDNSName is the options for the instance hostname.
                    properties:
                      enableResourceNameDnsAAAARecord:
                        description: EnableResourceNameDNSAAAARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          AAAA records.
                        type: boolean
                      enableResourceNameDnsARecord:
                        description: EnableResourceNameDNSARecord indicates whether
                          to respond to DNS queries for instance hostnames with DNS
                          A records.
                        type: boolean
                      hostnameType:
                        description: The type of hostname to assign to an instance.
                        enum:
                        - ip-name
                        - resource-name
                        type: string
                    type: object
                  privateIp:
                    description: The private IPv4 address assigned to the instance.
                    type: string
                  publicIPOnLaunch:
                    description: PublicIPOnLaunch is the option to associate a public
                      IP on instance launch
                    type: boolean
                  publicIp:
                    description: The public IPv4 address assigned to the instance,
                      if applicable.
                    type: string
                  rootVolume:
                    description: Configuration options for the root storage volume.
                    properties:
                      deviceName:
                        description: Device name
                        type: string
                      encrypted:
                        description: Encrypted is whether the volume should be encrypted
                          or not.
                        type: boolean
                      encryptionKey:
                        description: |-
                          EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.
                          If Encrypted is set and this is omitted, the default AWS key will be used.
                          The key must already exist and be accessible by the controller.
                        type: string
                      iops:
                        description: IOPS is the number of IOPS requested for the
                          disk. Not applicable to all types.
                        format: int64
                        type: integer
                      size:
                        description: |-
                          Size specifies size (in Gi) of the storage device.
                          Must be greater than the image snapshot size or 8 (whichever is greater).
                        format: int64
                        minimum: 8
                        type: integer
                      throughput:
                        description: Throughput to provision in MiB/s supported for
                          the volume type. Not applicable to all types.
                        format: int64
                        type: integer
                      type:
                        description: Type is the type of the volume (e.g. gp2, io1,
                          etc...).
                        type: string
                    required:
                    - size
                    type: object
                  securityGroupIds:
                    description: SecurityGroupIDs are one or more security group IDs
                      this instance belongs to.
                    items:
                      type: string
                    type: array
                  spotMarketOptions:
                    description: SpotMarketOptions option for configuring instances
                      to be run using AWS Spot instances.
                    properties:
                      maxPrice:
                        description: MaxPrice defines the maximum price the user is
                          willing to pay for Spot VM instances
                        type: string
                    type: object
                  sshKeyName:
                    description: The name of the SSH key pair.
                    type: string
                  subnetId:
                    description: The ID of the subnet of the instance.
                    type: string
                  tags:
                    additionalProperties:
                      type: string
                    description: The tags associated with the instance.
                    type: object
                  tenancy:
                    description: Tenancy indicates if instance should run on shared
                      or single-tenant hardware.
                    type: string
                  type:
                    description: The instance type.
                    type: string
                  userData:
                    description: |-
                      UserData is the raw data script passed to the instance which is run upon bootstrap.
                      This field must not be base64 encoded and should only be used when running a new instance.
                    type: string
                  volumeIDs:
                    description: IDs of the instance's volumes
                    items:
                      type: string
                    type: array
                required:
                - id
                type: object
              conditions:
                description: Conditions specifies the cpnditions for the managed control
                  plane
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              externalManagedControlPlane:
                default: true
                description: |-
                  ExternalManagedControlPlane indicates to cluster-api that the control plane
                  is managed by an external service such as AKS, EKS, GKE, etc.
                type: boolean
              failureDomains:
                additionalProperties:
                  description: |-
                    FailureDomainSpec is the Schema for Cluster API failure domains.
                    It allows controllers to understand how many failure domains a cluster can optionally span across.
                  properties:
                    attributes:
                      additionalProperties:
                        type: string
                      description: Attributes is a free form map of attributes an
                        infrastructure provider might use or require.
                      type: object
                    controlPlane:
                      description: ControlPlane determines if this failure domain
                        is suitable for use by control plane machines.
                      type: boolean
                  type: object
                description: FailureDomains specifies a list fo available availability
                  zones that can be used
                type: object
              failureMessage:
                description: |-
                  ErrorMessage indicates that there is a terminal problem reconciling the
                  state, and will be set to a descriptive error message.
                type: string
              identityProviderStatus:
                description: |-
                  IdentityProviderStatus holds the status for
                  associated identity provider
                properties:
                  arn:
                    description: ARN holds the ARN of associated identity provider
                    type: string
                  status:
                    description: Status holds current status of associated identity
                      provider
                    type: string
                type: object
              initialized:
                description: |-
                  Initialized denotes whether or not the control plane has the
                  uploaded kubernetes config-map.
                type: boolean
              networkStatus:
                description: Networks holds details about the AWS networking resources
                  used by the control plane
                properties:
                  apiServerElb:
                    description: APIServerELB is the Kubernetes api server load balancer.
                    properties:
                      arn:
                        description: |-
                          ARN of the load balancer. Unlike the ClassicLB, ARN is used mostly
                          to define and get it.
                        type: string
                      attributes:
                        description: ClassicElbAttributes defines extra attributes
                          associated with the load balancer.
                        properties:
                          crossZoneLoadBalancing:
                            description: CrossZoneLoadBalancing enables the classic
                              load balancer load balancing.
                            type: boolean
                          idleTimeout:
                            description: |-
                              IdleTimeout is time that the connection is allowed to be idle (no data
                              has been sent over the connection) before it is closed by the load balancer.
                            format: int64
                            type: integer
                        type: object
                      availabilityZones:
                        description: AvailabilityZones is an array of availability
                          zones in the VPC attached to the load balancer.
                        items:
                          type: string
                        type: array
                      dnsName:
                        description: DNSName is the dns name of the load balancer.
                        type: string
                      elbAttributes:
                        additionalProperties:
                          type: string
                        description: ELBAttributes defines extra attributes associated
                          with v2 load balancers.
                        type: object
                      elbListeners:
                        description: ELBListeners is an array of listeners associated
                          with the load balancer. There must be at least one.
                        items:
                          description: Listener defines an AWS network load balancer
                            listener.
                          properties:
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            targetGroup:
                              description: |-
                                TargetGroupSpec specifies target group settings for a given listener.
                                This is created first, and the ARN is then passed to the listener.
                              properties:
                                name:
                                  description: Name of the TargetGroup. Must be unique
                                    over the same group of listeners.
                                  maxLength: 32
                                  type: string
                                port:
                                  description: Port is the exposed port
                                  format: int64
                                  type: integer
                                protocol:
                                  description: ELBProtocol defines listener protocols
                                    for a load balancer.
                                  enum:
                                  - tcp
                                  - tls
                                  - udp
                                  - TCP
                                  - TLS
                                  - UDP
                                  type: string
                                targetGroupHealthCheck:
                                  description: HealthCheck is the elb health check
                                    associated with the load balancer.
                                  properties:
                                    intervalSeconds:
                                      format: int64
                                      type: integer
                                    path:
                                      type: string
                                    port:
                                      type: string
                                    protocol:
                                      type: string
                                    thresholdCount:
                                      format: int64
                                      type: integer
                                    timeoutSeconds:
                                      format: int64
                                      type: integer
                                    unhealthyThresholdCount:
                                      format: int64
                                      type: integer
                                  type: object
                                vpcId:
                                  type: string
                              required:
                              - name
                              - port
                              - protocol
                              - vpcId
                              type: object
                          required:
                          - port
                          - protocol
                          - targetGroup
                          type: object
                        type: array
                      healthChecks:
                        description: HealthCheck is the classic elb health check associated
                          with the load balancer.
                        properties:
                          healthyThreshold:
                            format: int64
                            type: integer
                          interval:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          target:
                            type: string
                          timeout:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          unhealthyThreshold:
                            format: int64
                            type: integer
                        required:
                        - healthyThreshold
                        - interval
                        - target
                        - timeout
                        - unhealthyThreshold
                        type: object
                      listeners:
                        description: ClassicELBListeners is an array of classic elb
                          listeners associated with the load balancer. There must
                          be at least one.
                        items:
                          description: ClassicELBListener defines an AWS classic load
                            balancer listener.
                          properties:
                            instancePort:
                              format: int64
                              type: integer
                            instanceProtocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                          required:
                          - instancePort
                          - instanceProtocol
                          - port
                          - protocol
                          type: object
                        type: array
                      loadBalancerType:
                        description: LoadBalancerType sets the type for a load balancer.
                          The default type is classic.
                        enum:
                        - classic
                        - elb
                        - alb
                        - nlb
                        type: string
                      name:
                        description: |-
                          The name of the load balancer. It must be unique within the set of load balancers
                          defined in the region. It also serves as identifier.
                        type: string
                      scheme:
                        description: Scheme is the load balancer scheme, either internet-facing
                          or private.
                        type: string
                      securityGroupIds:
                        description: SecurityGroupIDs is an array of security groups
                          assigned to the load balancer.
                        items:
                          type: string
                        type: array
                      subnetIds:
                        description: SubnetIDs is an array of subnets in the VPC attached
                          to the load balancer.
                        items:
                          type: string
                        type: array
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a map of tags associated with the load
                          balancer.
                        type: object
                    type: object
                  natGatewaysIPs:
                    description: NatGatewaysIPs contains the public IPs of the NAT
                      Gateways
                    items:
                      type: string
                    type: array
                  secondaryAPIServerELB:
                    description: SecondaryAPIServerELB is the secondary Kubernetes
                      api server load balancer.
                    properties:
                      arn:
                        description: |-
                          ARN of the load balancer. Unlike the ClassicLB, ARN is used mostly
                          to define and get it.
                        type: string
                      attributes:
                        description: ClassicElbAttributes defines extra attributes
                          associated with the load balancer.
                        properties:
                          crossZoneLoadBalancing:
                            description: CrossZoneLoadBalancing enables the classic
                              load balancer load balancing.
                            type: boolean
                          idleTimeout:
                            description: |-
                              IdleTimeout is time that the connection is allowed to be idle (no data
                              has been sent over the connection) before it is closed by the load balancer.
                            format: int64
                            type: integer
                        type: object
                      availabilityZones:
                        description: AvailabilityZones is an array of availability
                          zones in the VPC attached to the load balancer.
                        items:
                          type: string
                        type: array
                      dnsName:
                        description: DNSName is the dns name of the load balancer.
                        type: string
                      elbAttributes:
                        additionalProperties:
                          type: string
                        description: ELBAttributes defines extra attributes associated
                          with v2 load balancers.
                        type: object
                      elbListeners:
                        description: ELBListeners is an array of listeners associated
                          with the load balancer. There must be at least one.
                        items:
                          description: Listener defines an AWS network load balancer
                            listener.
                          properties:
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            targetGroup:
                              description: |-
                                TargetGroupSpec specifies target group settings for a given listener.
                                This is created first, and the ARN is then passed to the listener.
                              properties:
                                name:
                                  description: Name of the TargetGroup. Must be unique
                                    over the same group of listeners.
                                  maxLength: 32
                                  type: string
                                port:
                                  description: Port is the exposed port
                                  format: int64
                                  type: integer
                                protocol:
                                  description: ELBProtocol defines listener protocols
                                    for a load balancer.
                                  enum:
                                  - tcp
                                  - tls
                                  - udp
                                  - TCP
                                  - TLS
                                  - UDP
                                  type: string
                                targetGroupHealthCheck:
                                  description: HealthCheck is the elb health check
                                    associated with the load balancer.
                                  properties:
                                    intervalSeconds:
                                      format: int64
                                      type: integer
                                    path:
                                      type: string
                                    port:
                                      type: string
                                    protocol:
                                      type: string
                                    thresholdCount:
                                      format: int64
                                      type: integer
                                    timeoutSeconds:
                                      format: int64
                                      type: integer
                                    unhealthyThresholdCount:
                                      format: int64
                                      type: integer
                                  type: object
                                vpcId:
                                  type: string
                              required:
                              - name
                              - port
                              - protocol
                              - vpcId
                              type: object
                          required:
                          - port
                          - protocol
                          - targetGroup
                          type: object
                        type: array
                      healthChecks:
                        description: HealthCheck is the classic elb health check associated
                          with the load balancer.
                        properties:
                          healthyThreshold:
                            format: int64
                            type: integer
                          interval:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          target:
                            type: string
                          timeout:
                            description: |-
                              A Duration represents the elapsed time between two instants
                              as an int64 nanosecond count. The representation limits the
                              largest representable duration to approximately 290 years.
                            format: int64
                            type: integer
                          unhealthyThreshold:
                            format: int64
                            type: integer
                        required:
                        - healthyThreshold
                        - interval
                        - target
                        - timeout
                        - unhealthyThreshold
                        type: object
                      listeners:
                        description: ClassicELBListeners is an array of classic elb
                          listeners associated with the load balancer. There must
                          be at least one.
                        items:
                          description: ClassicELBListener defines an AWS classic load
                            balancer listener.
                          properties:
                            instancePort:
                              format: int64
                              type: integer
                            instanceProtocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                            port:
                              format: int64
                              type: integer
                            protocol:
                              description: ELBProtocol defines listener protocols
                                for a load balancer.
                              type: string
                          required:
                          - instancePort
                          - instanceProtocol
                          - port
                          - protocol
                          type: object
                        type: array
                      loadBalancerType:
                        description: LoadBalancerType sets the type for a load balancer.
                          The default type is classic.
                        enum:
                        - classic
                        - elb
                        - alb
                        - nlb
                        type: string
                      name:
                        description: |-
                          The name of the load balancer. It must be unique within the set of load balancers
                          defined in the region. It also serves as identifier.
                        type: string
                      scheme:
                        description: Scheme is the load balancer scheme, either internet-facing
                          or private.
                        type: string
                      securityGroupIds:
                        description: SecurityGroupIDs is an array of security groups
                          assigned to the load balancer.
                        items:
                          type: string
                        type: array
                      subnetIds:
                        description: SubnetIDs is an array of subnets in the VPC attached
                          to the load balancer.
                        items:
                          type: string
                        type: array
                      tags:
                        additionalProperties:
                          type: string
                        description: Tags is a map of tags associated with the load
                          balancer.
                        type: object
                    type: object
                  securityGroups:
                    additionalProperties:
                      description: SecurityGroup defines an AWS security group.
                      properties:
                        id:
                          description: ID is a unique identifier.
                          type: string
                        ingressRule:
                          description: IngressRules is the inbound rules associated
                            with the security group.
                          items:
                            description: IngressRule defines an AWS ingress rule for
                              security groups.
                            properties:
                              cidrBlocks:
                                description: List of CIDR blocks to allow access from.
                                  Cannot be specified with SourceSecurityGroupID.
                                items:
                                  type: string
                                type: array
                              description:
                                description: Description provides extended information
                                  about the ingress rule.
                                type: string
                              fromPort:
                                description: FromPort is the start of port range.
                                format: int64
                                type: integer
                              ipv6CidrBlocks:
                                description: List of IPv6 CIDR blocks to allow access
                                  from. Cannot be specified with SourceSecurityGroupID.
                                items:
                                  type: string
                                type: array
                              natGatewaysIPsSource:
                                description: NatGatewaysIPsSource use the NAT gateways
                                  IPs as the source for the ingress rule.
                                type: boolean
                              protocol:
                                description: Protocol is the protocol for the ingress
                                  rule. Accepted values are "-1" (all), "4" (IP in
                                  IP),"tcp", "udp", "icmp", and "58" (ICMPv6), "50"
                                  (ESP).
                                enum:
                                - "-1"
                                - "4"
                                - tcp
                                - udp
                                - icmp
                                - "58"
                                - "50"
                                type: string
                              sourceSecurityGroupIds:
                                description: The security group id to allow access
                                  from. Cannot be specified with CidrBlocks.
                                items:
                                  type: string
                                type: array
                              sourceSecurityGroupRoles:
                                description: |-
                                  The security group role to allow access from. Cannot be specified with CidrBlocks.
                                  The field will be combined with source security group IDs if specified.
                                items:
                                  description: SecurityGroupRole defines the unique
                                    role of a security group.
                                  enum:
                                  - bastion
                                  - node
                                  - controlplane
                                  - apiserver-lb
                                  - lb
                                  - node-eks-additional
                                  type: string
                                type: array
                              toPort:
                                description: ToPort is the end of port range.
                                format: int64
                                type: integer
                            required:
                            - description
                            - fromPort
                            - protocol
                            - toPort
                            type: object
                          type: array
                        name:
                          description: Name is the security group name.
                          type: string
                        tags:
                          additionalProperties:
                            type: string
                          description: Tags is a map of tags associated with the security
                            group.
                          type: object
                      required:
                      - id
                      - name
                      type: object
                    description: SecurityGroups is a map from the role/kind of the
                      security group to its unique name, if any.
                    type: object
                type: object
              oidcProvider:
                description: OIDCProvider holds the status of the identity provider
                  for this cluster
                properties:
                  arn:
                    description: ARN holds the ARN of the provider
                    type: string
                  trustPolicy:
                    description: TrustPolicy contains the boilerplate IAM trust policy
                      to use for IRSA
                    type: string
                type: object
              ready:
                default: false
                description: |-
                  Ready denotes that the AWSManagedControlPlane API Server is ready to
                  receive requests and that the VPC infra is ready.
                type: boolean
            required:
            - ready
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: awsmanagedclusters.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: AWSManagedCluster
    listKind: AWSManagedClusterList
    plural: awsmanagedclusters
    shortNames:
    - awsmc
    singular: awsmanagedcluster
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Cluster to which this AWSManagedControl belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: Control plane infrastructure is ready for worker nodes
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: API Endpoint
      jsonPath: .spec.controlPlaneEndpoint.host
      name: Endpoint
      priority: 1
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: AWSManagedCluster is the Schema for the awsmanagedclusters API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: AWSManagedClusterSpec defines the desired state of AWSManagedCluster
            properties:
              controlPlaneEndpoint:
                description: ControlPlaneEndpoint represents the endpoint used to
                  communicate with the control plane.
                properties:
                  host:
                    description: The hostname on which the API server is serving.
                    type: string
                  port:
                    description: The port on which the API server is serving.
                    format: int32
                    type: integer
                required:
                - host
                - port
                type: object
            type: object
          status:
            description: AWSManagedClusterStatus defines the observed state of AWSManagedCluster
            properties:
              failureDomains:
                additionalProperties:
                  description: |-
                    FailureDomainSpec is the Schema for Cluster API failure domains.
                    It allows controllers to understand how many failure domains a cluster can optionally span across.
                  properties:
                    attributes:
                      additionalProperties:
                        type: string
                      description: Attributes is a free form map of attributes an
                        infrastructure provider might use or require.
                      type: object
                    controlPlane:
                      description: ControlPlane determines if this failure domain
                        is suitable for use by control plane machines.
                      type: boolean
                  type: object
                description: FailureDomains specifies a list fo available availability
                  zones that can be used
                type: object
              ready:
                description: Ready is when the AWSManagedControlPlane has a API server
                  URL.
                type: boolean
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: eksconfigs.bootstrap.cluster.x-k8s.io
spec:
  group: bootstrap.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: EKSConfig
    listKind: EKSConfigList
    plural: eksconfigs
    shortNames:
    - eksc
    singular: eksconfig
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Bootstrap configuration is ready
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: Name of Secret containing bootstrap data
      jsonPath: .status.dataSecretName
      name: DataSecretName
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: EKSConfig is the schema for the Amazon EKS Machine Bootstrap
          Configuration API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: EKSConfigSpec defines the desired state of Amazon EKS Bootstrap
              Configuration.
            properties:
              apiRetryAttempts:
                description: APIRetryAttempts is the number of retry attempts for
                  AWS API call.
                type: integer
              containerRuntime:
                description: ContainerRuntime specify the container runtime to use
                  when bootstrapping EKS.
                type: string
              dnsClusterIP:
                description: ' DNSClusterIP overrides the IP address to use for DNS
                  queries within the cluster.'
                type: string
              dockerConfigJson:
                description: |-
                  DockerConfigJson is used for the contents of the /etc/docker/daemon.json file. Useful if you want a custom config differing from the default one in the AMI.
                  This is expected to be a json string.
                type: string
              kubeletExtraArgs:
                additionalProperties:
                  type: string
                description: KubeletExtraArgs passes the specified kubelet args into
                  the Amazon EKS machine bootstrap script
                type: object
              pauseContainer:
                description: PauseContainer allows customization of the pause container
                  to use.
                properties:
                  accountNumber:
                    description: ' AccountNumber is the AWS account number to pull
                      the pause container from.'
                    type: string
                  version:
                    description: Version is the tag of the pause container to use.
                    type: string
                required:
                - accountNumber
                - version
                type: object
              serviceIPV6Cidr:
                description: |-
                  ServiceIPV6Cidr is the ipv6 cidr range of the cluster. If this is specified then
                  the ip family will be set to ipv6.
                type: string
              useMaxPods:
                description: UseMaxPods  sets --max-pods for the kubelet when true.
                type: boolean
            type: object
          status:
            description: EKSConfigStatus defines the observed state of the Amazon
              EKS Bootstrap Configuration.
            properties:
              conditions:
                description: Conditions defines current service state of the EKSConfig.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              dataSecretName:
                description: DataSecretName is the name of the secret that stores
                  the bootstrap data script.
                type: string
              failureMessage:
                description: FailureMessage will be set on non-retryable errors
                type: string
              failureReason:
                description: FailureReason will be set on non-retryable errors
                type: string
              observedGeneration:
                description: ObservedGeneration is the latest generation observed
                  by the controller.
                format: int64
                type: integer
              ready:
                description: Ready indicates the BootstrapData secret is ready to
                  be consumed
                type: boolean
            type: object
        type: object
    served: false
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - description: Bootstrap configuration is ready
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: Name of Secret containing bootstrap data
      jsonPath: .status.dataSecretName
      name: DataSecretName
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: EKSConfig is the schema for the Amazon EKS Machine Bootstrap
          Configuration API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: EKSConfigSpec defines the desired state of Amazon EKS Bootstrap
              Configuration.
            properties:
              apiRetryAttempts:
                description: APIRetryAttempts is the number of retry attempts for
                  AWS API call.
                type: integer
              boostrapCommandOverride:
                description: BootstrapCommandOverride allows you to override the bootstrap
                  command to use for EKS nodes.
                type: string
              containerRuntime:
                description: ContainerRuntime specify the container runtime to use
                  when bootstrapping EKS.
                type: string
              diskSetup:
                description: DiskSetup specifies options for the creation of partition
                  tables and file systems on devices.
                properties:
                  filesystems:
                    description: Filesystems specifies the list of file systems to
                      setup.
                    items:
                      description: Filesystem defines the file systems to be created.
                      properties:
                        device:
                          description: Device specifies the device name
                          type: string
                        extraOpts:
                          description: ExtraOpts defined extra options to add to the
                            command for creating the file system.
                          items:
                            type: string
                          type: array
                        filesystem:
                          description: Filesystem specifies the file system type.
                          type: string
                        label:
                          description: Label specifies the file system label to be
                            used. If set to None, no label is used.
                          type: string
                        overwrite:
                          description: |-
                            Overwrite defines whether or not to overwrite any existing filesystem.
                            If true, any pre-existing file system will be destroyed. Use with Caution.
                          type: boolean
                        partition:
                          description: 'Partition specifies the partition to use.
                            The valid options are: "auto|any", "auto", "any", "none",
                            and <NUM>, where NUM is the actual partition number.'
                          type: string
                      required:
                      - device
                      - filesystem
                      - label
                      type: object
                    type: array
                  partitions:
                    description: Partitions specifies the list of the partitions to
                      setup.
                    items:
                      description: Partition defines how to create and layout a partition.
                      properties:
                        device:
                          description: Device is the name of the device.
                          type: string
                        layout:
                          description: |-
                            Layout specifies the device layout.
                            If it is true, a single partition will be created for the entire device.
                            When layout is false, it means don't partition or ignore existing partitioning.
                          type: boolean
                        overwrite:
                          description: |-
                            Overwrite describes whether to skip checks and create the partition if a partition or filesystem is found on the device.
                            Use with caution. Default is 'false'.
                          type: boolean
                        tableType:
                          description: |-
                            TableType specifies the tupe of partition table. The following are supported:
                            'mbr': default and setups a MS-DOS partition table
                            'gpt': setups a GPT partition table
                          type: string
                      required:
                      - device
                      - layout
                      type: object
                    type: array
                type: object
              dnsClusterIP:
                description: ' DNSClusterIP overrides the IP address to use for DNS
                  queries within the cluster.'
                type: string
              dockerConfigJson:
                description: |-
                  DockerConfigJson is used for the contents of the /etc/docker/daemon.json file. Useful if you want a custom config differing from the default one in the AMI.
                  This is expected to be a json string.
                type: string
              files:
                description: Files specifies extra files to be passed to user_data
                  upon creation.
                items:
                  description: File defines the input for generating write_files in
                    cloud-init.
                  properties:
                    append:
                      description: Append specifies whether to append Content to existing
                        file if Path exists.
                      type: boolean
                    content:
                      description: Content is the actual content of the file.
                      type: string
                    contentFrom:
                      description: ContentFrom is a referenced source of content to
                        populate the file.
                      properties:
                        secret:
                          description: Secret represents a secret that should populate
                            this file.
                          properties:
                            key:
                              description: Key is the key in the secret's data map
                                for this value.
                              type: string
                            name:
                              description: Name of the secret in the KubeadmBootstrapConfig's
                                namespace to use.
                              type: string
                          required:
                          - key
                          - name
                          type: object
                      required:
                      - secret
                      type: object
                    encoding:
                      description: Encoding specifies the encoding of the file contents.
                      enum:
                      - base64
                      - gzip
                      - gzip+base64
                      type: string
                    owner:
                      description: Owner specifies the ownership of the file, e.g.
                        "root:root".
                      type: string
                    path:
                      description: Path specifies the full path on disk where to store
                        the file.
                      type: string
                    permissions:
                      description: Permissions specifies the permissions to assign
                        to the file, e.g. "0640".
                      type: string
                  required:
                  - path
                  type: object
                type: array
              kubeletExtraArgs:
                additionalProperties:
                  type: string
                description: KubeletExtraArgs passes the specified kubelet args into
                  the Amazon EKS machine bootstrap script
                type: object
              mounts:
                description: Mounts specifies a list of mount points to be setup.
                items:
                  description: MountPoints defines input for generated mounts in cloud-init.
                  items:
                    type: string
                  type: array
                type: array
              ntp:
                description: NTP specifies NTP configuration
                properties:
                  enabled:
                    description: Enabled specifies whether NTP should be enabled
                    type: boolean
                  servers:
                    description: Servers specifies which NTP servers to use
                    items:
                      type: string
                    type: array
                type: object
              pauseContainer:
                description: PauseContainer allows customization of the pause container
                  to use.
                properties:
                  accountNumber:
                    description: ' AccountNumber is the AWS account number to pull
                      the pause container from.'
                    type: string
                  version:
                    description: Version is the tag of the pause container to use.
                    type: string
                required:
                - accountNumber
                - version
                type: object
              postBootstrapCommands:
                description: PostBootstrapCommands specifies extra commands to run
                  after bootstrapping nodes to the cluster
                items:
                  type: string
                type: array
              preBootstrapCommands:
                description: PreBootstrapCommands specifies extra commands to run
                  before bootstrapping nodes to the cluster
                items:
                  type: string
                type: array
              serviceIPV6Cidr:
                description: |-
                  ServiceIPV6Cidr is the ipv6 cidr range of the cluster. If this is specified then
                  the ip family will be set to ipv6.
                type: string
              useMaxPods:
                description: UseMaxPods  sets --max-pods for the kubelet when true.
                type: boolean
              users:
                description: Users specifies extra users to add
                items:
                  description: User defines the input for a generated user in cloud-init.
                  properties:
                    gecos:
                      description: Gecos specifies the gecos to use for the user
                      type: string
                    groups:
                      description: Groups specifies the additional groups for the
                        user
                      type: string
                    homeDir:
                      description: HomeDir specifies the home directory to use for
                        the user
                      type: string
                    inactive:
                      description: Inactive specifies whether to mark the user as
                        inactive
                      type: boolean
                    lockPassword:
                      description: LockPassword specifies if password login should
                        be disabled
                      type: boolean
                    name:
                      description: Name specifies the username
                      type: string
                    passwd:
                      description: Passwd specifies a hashed password for the user
                      type: string
                    passwdFrom:
                      description: PasswdFrom is a referenced source of passwd to
                        populate the passwd.
                      properties:
                        secret:
                          description: Secret represents a secret that should populate
                            this password.
                          properties:
                            key:
                              description: Key is the key in the secret's data map
                                for this value.
                              type: string
                            name:
                              description: Name of the secret in the KubeadmBootstrapConfig's
                                namespace to use.
                              type: string
                          required:
                          - key
                          - name
                          type: object
                      required:
                      - secret
                      type: object
                    primaryGroup:
                      description: PrimaryGroup specifies the primary group for the
                        user
                      type: string
                    shell:
                      description: Shell specifies the user's shell
                      type: string
                    sshAuthorizedKeys:
                      description: SSHAuthorizedKeys specifies a list of ssh authorized
                        keys for the user
                      items:
                        type: string
                      type: array
                    sudo:
                      description: Sudo specifies a sudo role for the user
                      type: string
                  required:
                  - name
                  type: object
                type: array
            type: object
          status:
            description: EKSConfigStatus defines the observed state of the Amazon
              EKS Bootstrap Configuration.
            properties:
              conditions:
                description: Conditions defines current service state of the EKSConfig.
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              dataSecretName:
                description: DataSecretName is the name of the secret that stores
                  the bootstrap data script.
                type: string
              failureMessage:
                description: FailureMessage will be set on non-retryable errors
                type: string
              failureReason:
                description: FailureReason will be set on non-retryable errors
                type: string
              observedGeneration:
                description: ObservedGeneration is the latest generation observed
                  by the controller.
                format: int64
                type: integer
              ready:
                description: Ready indicates the BootstrapData secret is ready to
                  be consumed
                type: boolean
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: eksconfigtemplates.bootstrap.cluster.x-k8s.io
spec:
  group: bootstrap.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: EKSConfigTemplate
    listKind: EKSConfigTemplateList
    plural: eksconfigtemplates
    shortNames:
    - eksct
    singular: eksconfigtemplate
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: EKSConfigTemplate is the Amazon EKS Bootstrap Configuration Template
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: EKSConfigTemplateSpec defines the desired state of templated
              EKSConfig Amazon EKS Bootstrap Configuration resources.
            properties:
              template:
                description: EKSConfigTemplateResource defines the Template structure.
                properties:
                  spec:
                    description: EKSConfigSpec defines the desired state of Amazon
                      EKS Bootstrap Configuration.
                    properties:
                      apiRetryAttempts:
                        description: APIRetryAttempts is the number of retry attempts
                          for AWS API call.
                        type: integer
                      containerRuntime:
                        description: ContainerRuntime specify the container runtime
                          to use when bootstrapping EKS.
                        type: string
                      dnsClusterIP:
                        description: ' DNSClusterIP overrides the IP address to use
                          for DNS queries within the cluster.'
                        type: string
                      dockerConfigJson:
                        description: |-
                          DockerConfigJson is used for the contents of the /etc/docker/daemon.json file. Useful if you want a custom config differing from the default one in the AMI.
                          This is expected to be a json string.
                        type: string
                      kubeletExtraArgs:
                        additionalProperties:
                          type: string
                        description: KubeletExtraArgs passes the specified kubelet
                          args into the Amazon EKS machine bootstrap script
                        type: object
                      pauseContainer:
                        description: PauseContainer allows customization of the pause
                          container to use.
                        properties:
                          accountNumber:
                            description: ' AccountNumber is the AWS account number
                              to pull the pause container from.'
                            type: string
                          version:
                            description: Version is the tag of the pause container
                              to use.
                            type: string
                        required:
                        - accountNumber
                        - version
                        type: object
                      serviceIPV6Cidr:
                        description: |-
                          ServiceIPV6Cidr is the ipv6 cidr range of the cluster. If this is specified then
                          the ip family will be set to ipv6.
                        type: string
                      useMaxPods:
                        description: UseMaxPods  sets --max-pods for the kubelet when
                          true.
                        type: boolean
                    type: object
                type: object
            required:
            - template
            type: object
        type: object
    served: false
    storage: false
  - name: v1beta2
    schema:
      openAPIV3Schema:
        description: EKSConfigTemplate is the Amazon EKS Bootstrap Configuration Template
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: EKSConfigTemplateSpec defines the desired state of templated
              EKSConfig Amazon EKS Bootstrap Configuration resources.
            properties:
              template:
                description: EKSConfigTemplateResource defines the Template structure.
                properties:
                  spec:
                    description: EKSConfigSpec defines the desired state of Amazon
                      EKS Bootstrap Configuration.
                    properties:
                      apiRetryAttempts:
                        description: APIRetryAttempts is the number of retry attempts
                          for AWS API call.
                        type: integer
                      boostrapCommandOverride:
                        description: BootstrapCommandOverride allows you to override
                          the bootstrap command to use for EKS nodes.
                        type: string
                      containerRuntime:
                        description: ContainerRuntime specify the container runtime
                          to use when bootstrapping EKS.
                        type: string
                      diskSetup:
                        description: DiskSetup specifies options for the creation
                          of partition tables and file systems on devices.
                        properties:
                          filesystems:
                            description: Filesystems specifies the list of file systems
                              to setup.
                            items:
                              description: Filesystem defines the file systems to
                                be created.
                              properties:
                                device:
                                  description: Device specifies the device name
                                  type: string
                                extraOpts:
                                  description: ExtraOpts defined extra options to
                                    add to the command for creating the file system.
                                  items:
                                    type: string
                                  type: array
                                filesystem:
                                  description: Filesystem specifies the file system
                                    type.
                                  type: string
                                label:
                                  description: Label specifies the file system label
                                    to be used. If set to None, no label is used.
                                  type: string
                                overwrite:
                                  description: |-
                                    Overwrite defines whether or not to overwrite any existing filesystem.
                                    If true, any pre-existing file system will be destroyed. Use with Caution.
                                  type: boolean
                                partition:
                                  description: 'Partition specifies the partition
                                    to use. The valid options are: "auto|any", "auto",
                                    "any", "none", and <NUM>, where NUM is the actual
                                    partition number.'
                                  type: string
                              required:
                              - device
                              - filesystem
                              - label
                              type: object
                            type: array
                          partitions:
                            description: Partitions specifies the list of the partitions
                              to setup.
                            items:
                              description: Partition defines how to create and layout
                                a partition.
                              properties:
                                device:
                                  description: Device is the name of the device.
                                  type: string
                                layout:
                                  description: |-
                                    Layout specifies the device layout.
                                    If it is true, a single partition will be created for the entire device.
                                    When layout is false, it means don't partition or ignore existing partitioning.
                                  type: boolean
                                overwrite:
                                  description: |-
                                    Overwrite describes whether to skip checks and create the partition if a partition or filesystem is found on the device.
                                    Use with caution. Default is 'false'.
                                  type: boolean
                                tableType:
                                  description: |-
                                    TableType specifies the tupe of partition table. The following are supported:
                                    'mbr': default and setups a MS-DOS partition table
                                    'gpt': setups a GPT partition table
                                  type: string
                              required:
                              - device
                              - layout
                              type: object
                            type: array
                        type: object
                      dnsClusterIP:
                        description: ' DNSClusterIP overrides the IP address to use
                          for DNS queries within the cluster.'
                        type: string
                      dockerConfigJson:
                        description: |-
                          DockerConfigJson is used for the contents of the /etc/docker/daemon.json file. Useful if you want a custom config differing from the default one in the AMI.
                          This is expected to be a json string.
                        type: string
                      files:
                        description: Files specifies extra files to be passed to user_data
                          upon creation.
                        items:
                          description: File defines the input for generating write_files
                            in cloud-init.
                          properties:
                            append:
                              description: Append specifies whether to append Content
                                to existing file if Path exists.
                              type: boolean
                            content:
                              description: Content is the actual content of the file.
                              type: string
                            contentFrom:
                              description: ContentFrom is a referenced source of content
                                to populate the file.
                              properties:
                                secret:
                                  description: Secret represents a secret that should
                                    populate this file.
                                  properties:
                                    key:
                                      description: Key is the key in the secret's
                                        data map for this value.
                                      type: string
                                    name:
                                      description: Name of the secret in the KubeadmBootstrapConfig's
                                        namespace to use.
                                      type: string
                                  required:
                                  - key
                                  - name
                                  type: object
                              required:
                              - secret
                              type: object
                            encoding:
                              description: Encoding specifies the encoding of the
                                file contents.
                              enum:
                              - base64
                              - gzip
                              - gzip+base64
                              type: string
                            owner:
                              description: Owner specifies the ownership of the file,
                                e.g. "root:root".
                              type: string
                            path:
                              description: Path specifies the full path on disk where
                                to store the file.
                              type: string
                            permissions:
                              description: Permissions specifies the permissions to
                                assign to the file, e.g. "0640".
                              type: string
                          required:
                          - path
                          type: object
                        type: array
                      kubeletExtraArgs:
                        additionalProperties:
                          type: string
                        description: KubeletExtraArgs passes the specified kubelet
                          args into the Amazon EKS machine bootstrap script
                        type: object
                      mounts:
                        description: Mounts specifies a list of mount points to be
                          setup.
                        items:
                          description: MountPoints defines input for generated mounts
                            in cloud-init.
                          items:
                            type: string
                          type: array
                        type: array
                      ntp:
                        description: NTP specifies NTP configuration
                        properties:
                          enabled:
                            description: Enabled specifies whether NTP should be enabled
                            type: boolean
                          servers:
                            description: Servers specifies which NTP servers to use
                            items:
                              type: string
                            type: array
                        type: object
                      pauseContainer:
                        description: PauseContainer allows customization of the pause
                          container to use.
                        properties:
                          accountNumber:
                            description: ' AccountNumber is the AWS account number
                              to pull the pause container from.'
                            type: string
                          version:
                            description: Version is the tag of the pause container
                              to use.
                            type: string
                        required:
                        - accountNumber
                        - version
                        type: object
                      postBootstrapCommands:
                        description: PostBootstrapCommands specifies extra commands
                          to run after bootstrapping nodes to the cluster
                        items:
                          type: string
                        type: array
                      preBootstrapCommands:
                        description: PreBootstrapCommands specifies extra commands
                          to run before bootstrapping nodes to the cluster
                        items:
                          type: string
                        type: array
                      serviceIPV6Cidr:
                        description: |-
                          ServiceIPV6Cidr is the ipv6 cidr range of the cluster. If this is specified then
                          the ip family will be set to ipv6.
                        type: string
                      useMaxPods:
                        description: UseMaxPods  sets --max-pods for the kubelet when
                          true.
                        type: boolean
                      users:
                        description: Users specifies extra users to add
                        items:
                          description: User defines the input for a generated user
                            in cloud-init.
                          properties:
                            gecos:
                              description: Gecos specifies the gecos to use for the
                                user
                              type: string
                            groups:
                              description: Groups specifies the additional groups
                                for the user
                              type: string
                            homeDir:
                              description: HomeDir specifies the home directory to
                                use for the user
                              type: string
                            inactive:
                              description: Inactive specifies whether to mark the
                                user as inactive
                              type: boolean
                            lockPassword:
                              description: LockPassword specifies if password login
                                should be disabled
                              type: boolean
                            name:
                              description: Name specifies the username
                              type: string
                            passwd:
                              description: Passwd specifies a hashed password for
                                the user
                              type: string
                            passwdFrom:
                              description: PasswdFrom is a referenced source of passwd
                                to populate the passwd.
                              properties:
                                secret:
                                  description: Secret represents a secret that should
                                    populate this password.
                                  properties:
                                    key:
                                      description: Key is the key in the secret's
                                        data map for this value.
                                      type: string
                                    name:
                                      description: Name of the secret in the KubeadmBootstrapConfig's
                                        namespace to use.
                                      type: string
                                  required:
                                  - key
                                  - name
                                  type: object
                              required:
                              - secret
                              type: object
                            primaryGroup:
                              description: PrimaryGroup specifies the primary group
                                for the user
                              type: string
                            shell:
                              description: Shell specifies the user's shell
                              type: string
                            sshAuthorizedKeys:
                              description: SSHAuthorizedKeys specifies a list of ssh
                                authorized keys for the user
                              items:
                                type: string
                              type: array
                            sudo:
                              description: Sudo specifies a sudo role for the user
                              type: string
                          required:
                          - name
                          type: object
                        type: array
                    type: object
                type: object
            required:
            - template
            type: object
        type: object
    served: true
    storage: true
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: rosacontrolplanes.controlplane.cluster.x-k8s.io
spec:
  group: controlplane.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: ROSAControlPlane
    listKind: ROSAControlPlaneList
    plural: rosacontrolplanes
    shortNames:
    - rosacp
    singular: rosacontrolplane
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Cluster to which this RosaControl belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: Control plane infrastructure is ready for worker nodes
      jsonPath: .status.ready
      name: Ready
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: ROSAControlPlane is the Schema for the ROSAControlPlanes API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: RosaControlPlaneSpec defines the desired state of ROSAControlPlane.
            properties:
              additionalTags:
                additionalProperties:
                  type: string
                description: AdditionalTags are user-defined tags to be added on the
                  AWS resources associated with the control plane.
                type: object
              auditLogRoleARN:
                description: |-
                  AuditLogRoleARN defines the role that is used to forward audit logs to AWS CloudWatch.
                  If not set, audit log forwarding is disabled.
                type: string
              availabilityZones:
                description: |-
                  AvailabilityZones describe AWS AvailabilityZones of the worker nodes.
                  should match the AvailabilityZones of the provided Subnets.
                  a machinepool will be created for each availabilityZone.
                items:
                  type: string
                type: array
              billingAccount:
                description: |-
                  BillingAccount is an optional AWS account to use for billing the subscription fees for ROSA clusters.
                  The cost of running each ROSA cluster will be billed to the infrastructure account in which the cluster
                  is running.
                type: string
                x-kubernetes-validations:
                - message: billingAccount is immutable
                  rule: self == oldSelf
                - message: billingAccount must be a valid AWS account ID
                  rule: self.matches('^[0-9]{12}$')
              clusterRegistryConfig:
                description: ClusterRegistryConfig represents registry config used
                  with the cluster.
                properties:
                  additionalTrustedCAs:
                    additionalProperties:
                      type: string
                    description: |-
                      AdditionalTrustedCAs containing the registry hostname as the key, and the PEM-encoded certificate as the value,
                      for each additional registry CA to trust.
                    type: object
                  allowedRegistriesForImport:
                    description: |-
                      AllowedRegistriesForImport limits the container image registries that normal users may import
                      images from. Set this list to the registries that you trust to contain valid Docker
                      images and that you want applications to be able to import from.
                    items:
                      description: RegistryLocation contains a location of the registry
                        specified by the registry domain name.
                      properties:
                        domainName:
                          description: |-
                            domainName specifies a domain name for the registry. The domain name might include wildcards, like '*' or '??'.
                            In case the registry use non-standard (80 or 443) port, the port should be included in the domain name as well.
                          type: string
                        insecure:
                          default: false
                          description: insecure indicates whether the registry is
                            secure (https) or insecure (http), default is secured.
                          type: boolean
                      type: object
                    type: array
                  registrySources:
                    description: |-
                      RegistrySources contains configuration that determines how the container runtime
                      should treat individual registries when accessing images. It does not contain configuration
                      for the internal cluster registry. AllowedRegistries, BlockedRegistries are mutually exclusive.
                    properties:
                      allowedRegistries:
                        description: |-
                          AllowedRegistries are the registries for which image pull and push actions are allowed.
                          To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
                          For example, *.example.com.
                          You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
                          All other registries are blocked.
                        items:
                          type: string
                        type: array
                      blockedRegistries:
                        description: |-
                          BlockedRegistries are the registries for which image pull and push actions are denied.
                          To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
                          For example, *.example.com.
                          You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
                          All other registries are allowed.
                        items:
                          type: string
                        type: array
                      insecureRegistries:
                        description: |-
                          InsecureRegistries are registries which do not have a valid TLS certificate or only support HTTP connections.
                          To specify all subdomains, add the asterisk (*) wildcard character as a prefix to the domain name,
                          For example, *.example.com.
                          You can specify an individual repository within a registry, For example: reg1.io/myrepo/myapp:latest.
                        items:
                          type: string
                        type: array
                    type: object
                type: object
              controlPlaneEndpoint:
                description: ControlPlaneEndpoint represents the endpoint used to
                  communicate with the control plane.
                properties:
                  host:
                    description: The hostname on which the API server is serving.
                    type: string
                  port:
                    description: The port on which the API server is serving.
                    format: int32
                    type: integer
                required:
                - host
                - port
                type: object
              credentialsSecretRef:
                description: |-
                  CredentialsSecretRef references a secret with necessary credentials to connect to the OCM API.
                  The secret should contain the following data keys:
                  - ocmToken: eyJhbGciOiJIUzI1NiIsI....
                  - ocmApiUrl: Optional, defaults to 'https://api.openshift.com'
                properties:
                  name:
                    default: ""
                    description: |-
                      Name of the referent.
                      This field is effectively required, but due to backwards compatibility is
                      allowed to be empty. Instances of this type with an empty value here are
                      almost certainly wrong.
                      TODO: Add other useful fields. apiVersion, kind, uid?
                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                      TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
                    type: string
                type: object
                x-kubernetes-map-type: atomic
              defaultMachinePoolSpec:
                description: |-
                  DefaultMachinePoolSpec defines the configuration for the default machinepool(s) provisioned as part of the cluster creation.
                  One MachinePool will be created with this configuration per AvailabilityZone. Those default machinepools are required for openshift cluster operators
                  to work properly.
                  As these machinepool not created using ROSAMachinePool CR, they will not be visible/managed by ROSA CAPI provider.
                  `rosa list machinepools -c <rosaClusterName>` can be used to view those machinepools.


                  This field will be removed in the future once the current limitation is resolved.
                properties:
                  autoscaling:
                    description: |-
                      Autoscaling specifies auto scaling behaviour for the default MachinePool. Autoscaling min/max value
                      must be equal or multiple of the availability zones count.
                    properties:
                      maxReplicas:
                        minimum: 1
                        type: integer
                      minReplicas:
                        minimum: 1
                        type: integer
                    type: object
                  instanceType:
                    description: The instance type to use, for example `r5.xlarge`.
                      Instance type ref; https://aws.amazon.com/ec2/instance-types/
                    type: string
                type: object
              domainPrefix:
                description: |-
                  DomainPrefix is an optional prefix added to the cluster's domain name. It will be used
                  when generating a sub-domain for the cluster on openshiftapps domain. It must be valid DNS-1035 label
                  consisting of lower case alphanumeric characters or '-', start with an alphabetic character
                  end with an alphanumeric character and have a max length of 15 characters.
                maxLength: 15
                pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
                type: string
                x-kubernetes-validations:
                - message: domainPrefix is immutable
                  rule: self == oldSelf
              enableExternalAuthProviders:
                default: false
                description: EnableExternalAuthProviders enables external authentication
                  configuration for the cluster.
                type: boolean
                x-kubernetes-validations:
                - message: enableExternalAuthProviders is immutable
                  rule: self == oldSelf
              endpointAccess:
                default: Public
                description: |-
                  EndpointAccess specifies the publishing scope of cluster endpoints. The
                  default is Public.
                enum:
                - Public
                - Private
                type: string
              etcdEncryptionKMSARN:
                description: |-
                  EtcdEncryptionKMSARN is the ARN of the KMS key used to encrypt etcd. The key itself needs to be
                  created out-of-band by the user and tagged with `red-hat:true`.
                type: string
              externalAuthProviders:
                description: |-
                  ExternalAuthProviders are external OIDC identity providers that can issue tokens for this cluster.
                  Can only be set if "enableExternalAuthProviders" is set to "True".


                  At most one provider can be configured.
                items:
                  description: ExternalAuthProvider is an external OIDC identity provider
                    that can issue tokens for this cluster
                  properties:
                    claimMappings:
                      description: |-
                        ClaimMappings describes rules on how to transform information from an
                        ID token into a cluster identity
                      properties:
                        groups:
                          description: |-
                            Groups is a name of the claim that should be used to construct
                            groups for the cluster identity.
                            The referenced claim must use array of strings values.
                          properties:
                            claim:
                              description: Claim is a JWT token claim to be used in
                                the mapping
                              type: string
                            prefix:
                              description: |-
                                Prefix is a string to prefix the value from the token in the result of the
                                claim mapping.


                                By default, no prefixing occurs.


                                Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
                                an array of strings "a", "b" and  "c", the mapping will result in an
                                array of string "myoidc:a", "myoidc:b" and "myoidc:c".
                              type: string
                          required:
                          - claim
                          type: object
                        username:
                          description: |-
                            Username is a name of the claim that should be used to construct
                            usernames for the cluster identity.


                            Default value: "sub"
                          properties:
                            claim:
                              description: Claim is a JWT token claim to be used in
                                the mapping
                              type: string
                            prefix:
                              description: Prefix is prepended to claim to prevent
                                clashes with existing names.
                              minLength: 1
                              type: string
                            prefixPolicy:
                              description: |-
                                PrefixPolicy specifies how a prefix should apply.


                                By default, claims other than `email` will be prefixed with the issuer URL to
                                prevent naming clashes with other plugins.


                                Set to "NoPrefix" to disable prefixing.


                                Example:
                                    (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
                                        If the JWT claim `username` contains value `userA`, the resulting
                                        mapped value will be "myoidc:userA".
                                    (2) `prefix` is set to "myoidc:" and `claim` is set to "email". If the
                                        JWT `email` claim contains value "userA@myoidc.tld", the resulting
                                        mapped value will be "myoidc:userA@myoidc.tld".
                                    (3) `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
                                        the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
                                        and `claim` is set to:
                                        (a) "username": the mapped value will be "https://myoidc.tld#userA"
                                        (b) "email": the mapped value will be "userA@myoidc.tld"
                              enum:
                              - ""
                              - NoPrefix
                              - Prefix
                              type: string
                          required:
                          - claim
                          type: object
                          x-kubernetes-validations:
                          - message: prefix must be set if prefixPolicy is 'Prefix',
                              but must remain unset otherwise
                            rule: 'self.prefixPolicy == ''Prefix'' ? has(self.prefix)
                              : !has(self.prefix)'
                      type: object
                    claimValidationRules:
                      description: ClaimValidationRules are rules that are applied
                        to validate token claims to authenticate users.
                      items:
                        description: TokenClaimValidationRule validates token claims
                          to authenticate users.
                        properties:
                          requiredClaim:
                            description: RequiredClaim allows configuring a required
                              claim name and its expected value
                            properties:
                              claim:
                                description: |-
                                  Claim is a name of a required claim. Only claims with string values are
                                  supported.
                                minLength: 1
                                type: string
                              requiredValue:
                                description: RequiredValue is the required value for
                                  the claim.
                                minLength: 1
                                type: string
                            required:
                            - claim
                            - requiredValue
                            type: object
                          type:
                            default: RequiredClaim
                            description: Type sets the type of the validation rule
                            enum:
                            - RequiredClaim
                            type: string
                        required:
                        - requiredClaim
                        - type
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    issuer:
                      description: Issuer describes attributes of the OIDC token issuer
                      properties:
                        audiences:
                          description: |-
                            Audiences is an array of audiences that the token was issued for.
                            Valid tokens must include at least one of these values in their
                            "aud" claim.
                            Must be set to exactly one value.
                          items:
                            description: TokenAudience is the audience that the token
                              was issued for.
                            minLength: 1
                            type: string
                          maxItems: 10
                          minItems: 1
                          type: array
                          x-kubernetes-list-type: set
                        issuerCertificateAuthority:
                          description: |-
                            CertificateAuthority is a reference to a config map in the
                            configuration namespace. The .data of the configMap must contain
                            the "ca-bundle.crt" key.
                            If unset, system trust is used instead.
                          properties:
                            name:
                              description: Name is the metadata.name of the referenced
                                object.
                              type: string
                          required:
                          - name
                          type: object
                        issuerURL:
                          description: |-
                            URL is the serving URL of the token issuer.
                            Must use the https:// scheme.
                          pattern: ^https:\/\/[^\s]
                          type: string
                      required:
                      - audiences
                      - issuerURL
                      type: object
                    name:
                      description: Name of the OIDC provider
                      minLength: 1
                      type: string
                    oidcClients:
                      description: |-
                        OIDCClients contains configuration for the platform's clients that
                        need to request tokens from the issuer
                      items:
                        description: |-
                          OIDCClientConfig contains configuration for the platform's client that
                          need to request tokens from the issuer.
                        properties:
                          clientID:
                            description: ClientID is the identifier of the OIDC client
                              from the OIDC provider
                            minLength: 1
                            type: string
                          clientSecret:
                            description: |-
                              ClientSecret refers to a secret that
                              contains the client secret in the `clientSecret` key of the `.data` field
                            properties:
                              name:
                                description: Name is the metadata.name of the referenced
                                  object.
                                type: string
                            required:
                            - name
                            type: object
                          componentName:
                            description: |-
                              ComponentName is the name of the component that is supposed to consume this
                              client configuration
                            maxLength: 256
                            minLength: 1
                            type: string
                          componentNamespace:
                            description: |-
                              ComponentNamespace is the namespace of the component that is supposed to consume this
                              client configuration
                            maxLength: 63
                            minLength: 1
                            type: string
                          extraScopes:
                            description: ExtraScopes is an optional set of scopes
                              to request tokens with.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: set
                        required:
                        - clientID
                        - clientSecret
                        - componentName
                        - componentNamespace
                        type: object
                      maxItems: 20
                      type: array
                      x-kubernetes-list-map-keys:
                      - componentNamespace
                      - componentName
                      x-kubernetes-list-type: map
                  required:
                  - issuer
                  - name
                  type: object
                maxItems: 1
                type: array
                x-kubernetes-list-map-keys:
                - name
                x-kubernetes-list-type: map
              identityRef:
                description: |-
                  IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
                  If no identity is specified, the default identity for this controller will be used.
                properties:
                  kind:
                    description: Kind of the identity.
                    enum:
                    - AWSClusterControllerIdentity
                    - AWSClusterRoleIdentity
                    - AWSClusterStaticIdentity
                    type: string
                  name:
                    description: Name of the identity.
                    minLength: 1
                    type: string
                required:
                - kind
                - name
                type: object
              installerRoleARN:
                description: InstallerRoleARN is an AWS IAM role that OpenShift Cluster
                  Manager will assume to create the cluster..
                type: string
              network:
                description: Network config for the ROSA HCP cluster.
                properties:
                  hostPrefix:
                    default: 23
                    description: Network host prefix which is defaulted to `23` if
                      not specified.
                    type: integer
                  machineCIDR:
                    description: IP addresses block used by OpenShift while installing
                      the cluster, for example "10.0.0.0/16".
                    format: cidr
                    type: string
                  networkType:
                    default: OVNKubernetes
                    description: The CNI network type default is OVNKubernetes.
                    enum:
                    - OVNKubernetes
                    - Other
                    type: string
                  podCIDR:
                    description: IP address block from which to assign pod IP addresses,
                      for example `10.128.0.0/14`.
                    format: cidr
                    type: string
                  serviceCIDR:
                    description: IP address block from which to assign service IP
                      addresses, for example `172.30.0.0/16`.
                    format: cidr
                    type: string
                type: object
              oidcID:
                description: The ID of the internal OpenID Connect Provider.
                type: string
                x-kubernetes-validations:
                - message: oidcID is immutable
                  rule: self == oldSelf
              provisionShardID:
                description: ProvisionShardID defines the shard where rosa control
                  plane components will be hosted.
                type: string
                x-kubernetes-validations:
                - message: provisionShardID is immutable
                  rule: self == oldSelf
              region:
                description: The AWS Region the cluster lives in.
                type: string
              rolesRef:
                description: AWS IAM roles used to perform credential requests by
                  the openshift operators.
                properties:
                  controlPlaneOperatorARN:
                    description: "ControlPlaneOperatorARN  is an ARN value referencing
                      a role appropriate for the Control Plane Operator.\n\n\nThe
                      following is an example of a valid policy document:\n\n\n{\n\t\"Version\":
                      \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
                      \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:CreateVpcEndpoint\",\n\t\t\t\t\"ec2:DescribeVpcEndpoints\",\n\t\t\t\t\"ec2:ModifyVpcEndpoint\",\n\t\t\t\t\"ec2:DeleteVpcEndpoints\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"route53:ListHostedZones\",\n\t\t\t\t\"ec2:CreateSecurityGroup\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupIngress\",\n\t\t\t\t\"ec2:AuthorizeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DeleteSecurityGroup\",\n\t\t\t\t\"ec2:RevokeSecurityGroupIngress\",\n\t\t\t\t\"ec2:RevokeSecurityGroupEgress\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeVpcs\",\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
                      [\n\t\t\t\t\"route53:ChangeResourceRecordSets\",\n\t\t\t\t\"route53:ListResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"arn:aws:route53:::%s\"\n\t\t}\n\t]\n}"
                    type: string
                  imageRegistryARN:
                    description: "ImageRegistryARN is an ARN value referencing a role
                      appropriate for the Image Registry Operator.\n\n\nThe following
                      is an example of a valid policy document:\n\n\n{\n\t\"Version\":
                      \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\":
                      \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"s3:CreateBucket\",\n\t\t\t\t\"s3:DeleteBucket\",\n\t\t\t\t\"s3:PutBucketTagging\",\n\t\t\t\t\"s3:GetBucketTagging\",\n\t\t\t\t\"s3:PutBucketPublicAccessBlock\",\n\t\t\t\t\"s3:GetBucketPublicAccessBlock\",\n\t\t\t\t\"s3:PutEncryptionConfiguration\",\n\t\t\t\t\"s3:GetEncryptionConfiguration\",\n\t\t\t\t\"s3:PutLifecycleConfiguration\",\n\t\t\t\t\"s3:GetLifecycleConfiguration\",\n\t\t\t\t\"s3:GetBucketLocation\",\n\t\t\t\t\"s3:ListBucket\",\n\t\t\t\t\"s3:GetObject\",\n\t\t\t\t\"s3:PutObject\",\n\t\t\t\t\"s3:DeleteObject\",\n\t\t\t\t\"s3:ListBucketMultipartUploads\",\n\t\t\t\t\"s3:AbortMultipartUpload\",\n\t\t\t\t\"s3:ListMultipartUploadParts\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t}\n\t]\n}"
                    type: string
                  ingressARN:
                    description: "The referenced role must have a trust relationship
                      that allows it to be assumed via web identity.\nhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html.\nExample:\n{\n\t\t\"Version\":
                      \"2012-10-17\",\n\t\t\"Statement\": [\n\t\t\t{\n\t\t\t\t\"Effect\":
                      \"Allow\",\n\t\t\t\t\"Principal\": {\n\t\t\t\t\t\"Federated\":
                      \"{{ .ProviderARN }}\"\n\t\t\t\t},\n\t\t\t\t\t\"Action\": \"sts:AssumeRoleWithWebIdentity\",\n\t\t\t\t\"Condition\":
                      {\n\t\t\t\t\t\"StringEquals\": {\n\t\t\t\t\t\t\"{{ .ProviderName
                      }}:sub\": {{ .ServiceAccounts }}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t]\n\t}\n\n\nIngressARN
                      is an ARN value referencing a role appropriate for the Ingress
                      Operator.\n\n\nThe following is an example of a valid policy
                      document:\n\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
                      [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"elasticloadbalancing:DescribeLoadBalancers\",\n\t\t\t\t\"tag:GetResources\",\n\t\t\t\t\"route53:ListHostedZones\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t},\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\":
                      [\n\t\t\t\t\"route53:ChangeResourceRecordSets\"\n\t\t\t],\n\t\t\t\"Resource\":
                      [\n\t\t\t\t\"arn:aws:route53:::PUBLIC_ZONE_ID\",\n\t\t\t\t\"arn:aws:route53:::PRIVATE_ZONE_ID\"\n\t\t\t]\n\t\t}\n\t]\n}"
                    type: string
                  kmsProviderARN:
                    type: string
                  kubeCloudControllerARN:
                    description: |-
                      KubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
                      Source: https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies


                      The following is an example of a valid policy document:


                       {
                       "Version": "2012-10-17",
                       "Statement": [
                         {
                           "Action": [
                             "autoscaling:DescribeAutoScalingGroups",
                             "autoscaling:DescribeLaunchConfigurations",
                             "autoscaling:DescribeTags",
                             "ec2:DescribeAvailabilityZones",
                             "ec2:DescribeInstances",
                             "ec2:DescribeImages",
                             "ec2:DescribeRegions",
                             "ec2:DescribeRouteTables",
                             "ec2:DescribeSecurityGroups",
                             "ec2:DescribeSubnets",
                             "ec2:DescribeVolumes",
                             "ec2:CreateSecurityGroup",
                             "ec2:CreateTags",
                             "ec2:CreateVolume",
                             "ec2:ModifyInstanceAttribute",
                             "ec2:ModifyVolume",
                             "ec2:AttachVolume",
                             "ec2:AuthorizeSecurityGroupIngress",
                             "ec2:CreateRoute",
                             "ec2:DeleteRoute",
                             "ec2:DeleteSecurityGroup",
                             "ec2:DeleteVolume",
                             "ec2:DetachVolume",
                             "ec2:RevokeSecurityGroupIngress",
                             "ec2:DescribeVpcs",
                             "elasticloadbalancing:AddTags",
                             "elasticloadbalancing:AttachLoadBalancerToSubnets",
                             "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
                             "elasticloadbalancing:CreateLoadBalancer",
                             "elasticloadbalancing:CreateLoadBalancerPolicy",
                             "elasticloadbalancing:CreateLoadBalancerListeners",
                             "elasticloadbalancing:ConfigureHealthCheck",
                             "elasticloadbalancing:DeleteLoadBalancer",
                             "elasticloadbalancing:DeleteLoadBalancerListeners",
                             "elasticloadbalancing:DescribeLoadBalancers",
                             "elasticloadbalancing:DescribeLoadBalancerAttributes",
                             "elasticloadbalancing:DetachLoadBalancerFromSubnets",
                             "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                             "elasticloadbalancing:ModifyLoadBalancerAttributes",
                             "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                             "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
                             "elasticloadbalancing:AddTags",
                             "elasticloadbalancing:CreateListener",
                             "elasticloadbalancing:CreateTargetGroup",
                             "elasticloadbalancing:DeleteListener",
                             "elasticloadbalancing:DeleteTargetGroup",
                             "elasticloadbalancing:DeregisterTargets",
                             "elasticloadbalancing:DescribeListeners",
                             "elasticloadbalancing:DescribeLoadBalancerPolicies",
                             "elasticloadbalancing:DescribeTargetGroups",
                             "elasticloadbalancing:DescribeTargetHealth",
                             "elasticloadbalancing:ModifyListener",
                             "elasticloadbalancing:ModifyTargetGroup",
                             "elasticloadbalancing:RegisterTargets",
                             "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
                             "iam:CreateServiceLinkedRole",
                             "kms:DescribeKey"
                           ],
                           "Resource": [
                             "*"
                           ],
                           "Effect": "Allow"
                         }
                       ]
                      }
                    type: string
                  networkARN:
                    description: "NetworkARN is an ARN value referencing a role appropriate
                      for the Network Operator.\n\n\nThe following is an example of
                      a valid policy document:\n\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
                      [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:DescribeInstances\",\n
                      \      \"ec2:DescribeInstanceStatus\",\n       \"ec2:DescribeInstanceTypes\",\n
                      \      \"ec2:UnassignPrivateIpAddresses\",\n       \"ec2:AssignPrivateIpAddresses\",\n
                      \      \"ec2:UnassignIpv6Addresses\",\n       \"ec2:AssignIpv6Addresses\",\n
                      \      \"ec2:DescribeSubnets\",\n       \"ec2:DescribeNetworkInterfaces\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t}\n\t]\n}"
                    type: string
                  nodePoolManagementARN:
                    description: "NodePoolManagementARN is an ARN value referencing
                      a role appropriate for the CAPI Controller.\n\n\nThe following
                      is an example of a valid policy document:\n\n\n{\n  \"Version\":
                      \"2012-10-17\",\n \"Statement\": [\n   {\n     \"Action\": [\n
                      \      \"ec2:AssociateRouteTable\",\n       \"ec2:AttachInternetGateway\",\n
                      \      \"ec2:AuthorizeSecurityGroupIngress\",\n       \"ec2:CreateInternetGateway\",\n
                      \      \"ec2:CreateNatGateway\",\n       \"ec2:CreateRoute\",\n
                      \      \"ec2:CreateRouteTable\",\n       \"ec2:CreateSecurityGroup\",\n
                      \      \"ec2:CreateSubnet\",\n       \"ec2:CreateTags\",\n       \"ec2:DeleteInternetGateway\",\n
                      \      \"ec2:DeleteNatGateway\",\n       \"ec2:DeleteRouteTable\",\n
                      \      \"ec2:DeleteSecurityGroup\",\n       \"ec2:DeleteSubnet\",\n
                      \      \"ec2:DeleteTags\",\n       \"ec2:DescribeAccountAttributes\",\n
                      \      \"ec2:DescribeAddresses\",\n       \"ec2:DescribeAvailabilityZones\",\n
                      \      \"ec2:DescribeImages\",\n       \"ec2:DescribeInstances\",\n
                      \      \"ec2:DescribeInternetGateways\",\n       \"ec2:DescribeNatGateways\",\n
                      \      \"ec2:DescribeNetworkInterfaces\",\n       \"ec2:DescribeNetworkInterfaceAttribute\",\n
                      \      \"ec2:DescribeRouteTables\",\n       \"ec2:DescribeSecurityGroups\",\n
                      \      \"ec2:DescribeSubnets\",\n       \"ec2:DescribeVpcs\",\n
                      \      \"ec2:DescribeVpcAttribute\",\n       \"ec2:DescribeVolumes\",\n
                      \      \"ec2:DetachInternetGateway\",\n       \"ec2:DisassociateRouteTable\",\n
                      \      \"ec2:DisassociateAddress\",\n       \"ec2:ModifyInstanceAttribute\",\n
                      \      \"ec2:ModifyNetworkInterfaceAttribute\",\n       \"ec2:ModifySubnetAttribute\",\n
                      \      \"ec2:RevokeSecurityGroupIngress\",\n       \"ec2:RunInstances\",\n
                      \      \"ec2:TerminateInstances\",\n       \"tag:GetResources\",\n
                      \      \"ec2:CreateLaunchTemplate\",\n       \"ec2:CreateLaunchTemplateVersion\",\n
                      \      \"ec2:DescribeLaunchTemplates\",\n       \"ec2:DescribeLaunchTemplateVersions\",\n
                      \      \"ec2:DeleteLaunchTemplate\",\n       \"ec2:DeleteLaunchTemplateVersions\"\n
                      \    ],\n     \"Resource\": [\n       \"*\"\n     ],\n     \"Effect\":
                      \"Allow\"\n   },\n   {\n     \"Condition\": {\n       \"StringLike\":
                      {\n         \"iam:AWSServiceName\": \"elasticloadbalancing.amazonaws.com\"\n
                      \      }\n     },\n     \"Action\": [\n       \"iam:CreateServiceLinkedRole\"\n
                      \    ],\n     \"Resource\": [\n       \"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing\"\n
                      \    ],\n     \"Effect\": \"Allow\"\n   },\n   {\n     \"Action\":
                      [\n       \"iam:PassRole\"\n     ],\n     \"Resource\": [\n
                      \      \"arn:*:iam::*:role/*-worker-role\"\n     ],\n     \"Effect\":
                      \"Allow\"\n   },\n\t  {\n\t  \t\"Effect\": \"Allow\",\n\t  \t\"Action\":
                      [\n\t  \t\t\"kms:Decrypt\",\n\t  \t\t\"kms:ReEncrypt\",\n\t
                      \ \t\t\"kms:GenerateDataKeyWithoutPlainText\",\n\t  \t\t\"kms:DescribeKey\"\n\t
                      \ \t],\n\t  \t\"Resource\": \"*\"\n\t  },\n\t  {\n\t  \t\"Effect\":
                      \"Allow\",\n\t  \t\"Action\": [\n\t  \t\t\"kms:CreateGrant\"\n\t
                      \ \t],\n\t  \t\"Resource\": \"*\",\n\t  \t\"Condition\": {\n\t
                      \ \t\t\"Bool\": {\n\t  \t\t\t\"kms:GrantIsForAWSResource\":
                      true\n\t  \t\t}\n\t  \t}\n\t  }\n ]\n}"
                    type: string
                  storageARN:
                    description: "StorageARN is an ARN value referencing a role appropriate
                      for the Storage Operator.\n\n\nThe following is an example of
                      a valid policy document:\n\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\":
                      [\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
                      \"*\"\n\t\t}\n\t]\n}"
                    type: string
                required:
                - controlPlaneOperatorARN
                - imageRegistryARN
                - ingressARN
                - kmsProviderARN
                - kubeCloudControllerARN
                - networkARN
                - nodePoolManagementARN
                - storageARN
                type: object
              rosaClusterName:
                description: |-
                  Cluster name must be valid DNS-1035 label, so it must consist of lower case alphanumeric
                  characters or '-', start with an alphabetic character, end with an alphanumeric character
                  and have a max length of 54 characters.
                maxLength: 54
                pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
                type: string
                x-kubernetes-validations:
                - message: rosaClusterName is immutable
                  rule: self == oldSelf
              subnets:
                description: |-
                  The Subnet IDs to use when installing the cluster.
                  SubnetIDs should come in pairs; two per availability zone, one private and one public.
                items:
                  type: string
                type: array
              supportRoleARN:
                description: |-
                  SupportRoleARN is an AWS IAM role used by Red Hat SREs to enable
                  access to the cluster account in order to provide support.
                type: string
              version:
                description: OpenShift semantic version, for example "4.14.5".
                type: string
              versionGate:
                default: WaitForAcknowledge
                description: |-
                  VersionGate requires acknowledgment when upgrading ROSA-HCP y-stream versions (e.g., from 4.15 to 4.16).
                  Default is WaitForAcknowledge.
                  WaitForAcknowledge: If acknowledgment is required, the upgrade will not proceed until VersionGate is set to Acknowledge or AlwaysAcknowledge.
                  Acknowledge: If acknowledgment is required, apply it for the upgrade. After upgrade is done set the version gate to WaitForAcknowledge.
                  AlwaysAcknowledge: If acknowledgment is required, apply it and proceed with the upgrade.
                enum:
                - Acknowledge
                - WaitForAcknowledge
                - AlwaysAcknowledge
                type: string
              workerRoleARN:
                description: WorkerRoleARN is an AWS IAM role that will be attached
                  to worker instances.
                type: string
            required:
            - availabilityZones
            - installerRoleARN
            - oidcID
            - region
            - rolesRef
            - rosaClusterName
            - subnets
            - supportRoleARN
            - version
            - versionGate
            - workerRoleARN
            type: object
          status:
            description: RosaControlPlaneStatus defines the observed state of ROSAControlPlane.
            properties:
              availableUpgrades:
                description: Available upgrades for the ROSA hosted control plane.
                items:
                  type: string
                type: array
              conditions:
                description: Conditions specifies the conditions for the managed control
                  plane
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              consoleURL:
                description: ConsoleURL is the url for the openshift console.
                type: string
              externalManagedControlPlane:
                default: true
                description: |-
                  ExternalManagedControlPlane indicates to cluster-api that the control plane
                  is managed by an external service such as AKS, EKS, GKE, etc.
                type: boolean
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the state and will be set to a descriptive error message.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the spec or the configuration of
                  the controller, and that manual intervention is required.
                type: string
              id:
                description: ID is the cluster ID given by ROSA.
                type: string
              initialized:
                description: |-
                  Initialized denotes whether or not the control plane has the
                  uploaded kubernetes config-map.
                type: boolean
              oidcEndpointURL:
                description: OIDCEndpointURL is the endpoint url for the managed OIDC
                  provider.
                type: string
              ready:
                default: false
                description: Ready denotes that the ROSAControlPlane API Server is
                  ready to receive requests.
                type: boolean
            required:
            - ready
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: rosaclusters.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: ROSACluster
    listKind: ROSAClusterList
    plural: rosaclusters
    shortNames:
    - rosac
    singular: rosacluster
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Cluster to which this AWSManagedControl belongs
      jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name
      name: Cluster
      type: string
    - description: Control plane infrastructure is ready for worker nodes
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: API Endpoint
      jsonPath: .spec.controlPlaneEndpoint.host
      name: Endpoint
      priority: 1
      type: string
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: ROSACluster is the Schema for the ROSAClusters API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: ROSAClusterSpec defines the desired state of ROSACluster.
            properties:
              controlPlaneEndpoint:
                description: ControlPlaneEndpoint represents the endpoint used to
                  communicate with the control plane.
                properties:
                  host:
                    description: The hostname on which the API server is serving.
                    type: string
                  port:
                    description: The port on which the API server is serving.
                    format: int32
                    type: integer
                required:
                - host
                - port
                type: object
            type: object
          status:
            description: ROSAClusterStatus defines the observed state of ROSACluster.
            properties:
              failureDomains:
                additionalProperties:
                  description: |-
                    FailureDomainSpec is the Schema for Cluster API failure domains.
                    It allows controllers to understand how many failure domains a cluster can optionally span across.
                  properties:
                    attributes:
                      additionalProperties:
                        type: string
                      description: Attributes is a free form map of attributes an
                        infrastructure provider might use or require.
                      type: object
                    controlPlane:
                      description: ControlPlane determines if this failure domain
                        is suitable for use by control plane machines.
                      type: boolean
                  type: object
                description: FailureDomains specifies a list fo available availability
                  zones that can be used
                type: object
              ready:
                description: Ready is when the ROSAControlPlane has a API server URL.
                type: boolean
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.14.0
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    cluster.x-k8s.io/v1alpha3: v1alpha3
    cluster.x-k8s.io/v1alpha4: v1alpha4
    cluster.x-k8s.io/v1beta1: v1beta1_v1beta2
    clusterctl.cluster.x-k8s.io: ""
  name: rosamachinepools.infrastructure.cluster.x-k8s.io
spec:
  group: infrastructure.cluster.x-k8s.io
  names:
    categories:
    - cluster-api
    kind: ROSAMachinePool
    listKind: ROSAMachinePoolList
    plural: rosamachinepools
    shortNames:
    - rosamp
    singular: rosamachinepool
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: MachinePool ready status
      jsonPath: .status.ready
      name: Ready
      type: string
    - description: Number of replicas
      jsonPath: .status.replicas
      name: Replicas
      type: integer
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: ROSAMachinePool is the Schema for the rosamachinepools API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: RosaMachinePoolSpec defines the desired state of RosaMachinePool.
            properties:
              additionalSecurityGroups:
                description: |-
                  AdditionalSecurityGroups is an optional set of security groups to associate
                  with all node instances of the machine pool.
                items:
                  type: string
                type: array
              additionalTags:
                additionalProperties:
                  type: string
                description: AdditionalTags are user-defined tags to be added on the
                  underlying EC2 instances associated with this machine pool.
                type: object
              autoRepair:
                default: true
                description: |-
                  AutoRepair specifies whether health checks should be enabled for machines
                  in the NodePool. The default is true.
                type: boolean
              autoscaling:
                description: |-
                  Autoscaling specifies auto scaling behaviour for this MachinePool.
                  required if Replicas is not configured
                properties:
                  maxReplicas:
                    minimum: 1
                    type: integer
                  minReplicas:
                    minimum: 1
                    type: integer
                type: object
              availabilityZone:
                description: |-
                  AvailabilityZone is an optinal field specifying the availability zone where instances of this machine pool should run
                  For Multi-AZ clusters, you can create a machine pool in a Single-AZ of your choice.
                type: string
              instanceType:
                description: InstanceType specifies the AWS instance type
                type: string
              labels:
                additionalProperties:
                  type: string
                description: Labels specifies labels for the Kubernetes node objects
                type: object
              nodeDrainGracePeriod:
                description: |-
                  NodeDrainGracePeriod is grace period for how long Pod Disruption Budget-protected workloads will be
                  respected during upgrades. After this grace period, any workloads protected by Pod Disruption
                  Budgets that have not been successfully drained from a node will be forcibly evicted.


                  Valid values are from 0 to 1 week(10080m|168h) .
                  0 or empty value means that the MachinePool can be drained without any time limitation.
                type: string
              nodePoolName:
                description: |-
                  NodePoolName specifies the name of the nodepool in Rosa
                  must be a valid DNS-1035 label, so it must consist of lower case alphanumeric and have a max length of 15 characters.
                maxLength: 15
                pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
                type: string
                x-kubernetes-validations:
                - message: nodepoolName is immutable
                  rule: self == oldSelf
              providerIDList:
                description: ProviderIDList contain a ProviderID for each machine
                  instance that's currently managed by this machine pool.
                items:
                  type: string
                type: array
              subnet:
                type: string
                x-kubernetes-validations:
                - message: subnet is immutable
                  rule: self == oldSelf
              taints:
                description: Taints specifies the taints to apply to the nodes of
                  the machine pool
                items:
                  description: RosaTaint represents a taint to be applied to a node.
                  properties:
                    effect:
                      description: |-
                        The effect of the taint on pods that do not tolerate the taint.
                        Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
                      enum:
                      - NoSchedule
                      - PreferNoSchedule
                      - NoExecute
                      type: string
                    key:
                      description: The taint key to be applied to a node.
                      type: string
                    value:
                      description: The taint value corresponding to the taint key.
                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
                      type: string
                  required:
                  - effect
                  - key
                  type: object
                type: array
              tuningConfigs:
                description: |-
                  TuningConfigs specifies the names of the tuning configs to be applied to this MachinePool.
                  Tuning configs must already exist.
                items:
                  type: string
                type: array
              updateConfig:
                description: UpdateConfig specifies update configurations.
                properties:
                  rollingUpdate:
                    description: RollingUpdate specifies MaxUnavailable & MaxSurge
                      number of nodes during update.
                    properties:
                      maxSurge:
                        anyOf:
                        - type: integer
                        - type: string
                        default: 1
                        description: |-
                          MaxSurge is the maximum number of nodes that can be provisioned above the desired number of nodes.
                          Value can be an absolute number (ex: 5) or a percentage of desired nodes (ex: 10%).
                          Absolute number is calculated from percentage by rounding up.


                          MaxSurge can not be 0 if MaxUnavailable is 0, default is 1.
                          Both MaxSurge & MaxUnavailable must use the same units (absolute value or percentage).


                          Example: when MaxSurge is set to 30%, new nodes can be provisioned immediately
                          when the rolling update starts, such that the total number of old and new
                          nodes do not exceed 130% of desired nodes. Once old nodes have been
                          deleted, new nodes can be provisioned, ensuring that total number of nodes
                          running at any time during the update is at most 130% of desired nodes.
                        pattern: ^((100|[0-9]{1,2})%|[0-9]+)$
                        x-kubernetes-int-or-string: true
                      maxUnavailable:
                        anyOf:
                        - type: integer
                        - type: string
                        default: 0
                        description: |-
                          MaxUnavailable is the maximum number of nodes that can be unavailable during the update.
                          Value can be an absolute number (ex: 5) or a percentage of desired nodes (ex: 10%).
                          Absolute number is calculated from percentage by rounding down.


                          MaxUnavailable can not be 0 if MaxSurge is 0, default is 0.
                          Both MaxUnavailable & MaxSurge must use the same units (absolute value or percentage).


                          Example: when MaxUnavailable is set to 30%, old nodes can be deleted down to 70% of
                          desired nodes immediately when the rolling update starts. Once new nodes
                          are ready, more old nodes be deleted, followed by provisioning new nodes,
                          ensuring that the total number of nodes available at all times during the
                          update is at least 70% of desired nodes.
                        pattern: ^((100|[0-9]{1,2})%|[0-9]+)$
                        x-kubernetes-int-or-string: true
                    type: object
                type: object
              version:
                description: |-
                  Version specifies the OpenShift version of the nodes associated with this machinepool.
                  ROSAControlPlane version is used if not set.
                type: string
            required:
            - instanceType
            - nodePoolName
            type: object
          status:
            description: RosaMachinePoolStatus defines the observed state of RosaMachinePool.
            properties:
              conditions:
                description: Conditions defines current service state of the managed
                  machine pool
                items:
                  description: Condition defines an observation of a Cluster API resource
                    operational state.
                  properties:
                    lastTransitionTime:
                      description: |-
                        Last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed. If that is not known, then using the time when
                        the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        A human readable message indicating details about the transition.
                        This field may be empty.
                      type: string
                    reason:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
                        This field may not be empty.
                      type: string
                    severity:
                      description: |-
                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
                      description: Status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
                        Type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
                  required:
                  - lastTransitionTime
                  - status
                  - type
                  type: object
                type: array
              failureMessage:
                description: |-
                  FailureMessage will be set in the event that there is a terminal problem
                  reconciling the state and will be set to a descriptive error message.


                  This field should not be set for transitive errors that a controller
                  faces that are expected to be fixed automatically over
                  time (like service outages), but instead indicate that something is
                  fundamentally wrong with the spec or the configuration of
                  the controller, and that manual intervention is required.
                type: string
              id:
                description: ID is the ID given by ROSA.
                type: string
              ready:
                default: false
                description: |-
                  Ready denotes that the RosaMachinePool nodepool has joined
                  the cluster
                type: boolean
              replicas:
                description: Replicas is the most recently observed number of replicas.
                format: int32
                type: integer
            required:
            - ready
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null

