---
apiVersion: v1
kind: Service
metadata:
  annotations: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-metrics-service
  namespace: capa-system
spec:
  ports:
    - port: 8080
      protocol: TCP
      targetPort: metrics
  selector:
    cluster.x-k8s.io/provider: infrastructure-aws
  type: ClusterIP

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-manager-role
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create
  - apiGroups:
      - bootstrap.cluster.x-k8s.io
    resources:
      - eksconfigs
    verbs:
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - bootstrap.cluster.x-k8s.io
    resources:
      - eksconfigs/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - clusters
      - clusters/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - clusters
      - machinepools
      - machines
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinedeployments
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinepools
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machinepools
      - machinepools/status
    verbs:
      - get
      - list
      - patch
      - watch
  - apiGroups:
      - cluster.x-k8s.io
    resources:
      - machines
      - machines/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - controlplane.cluster.x-k8s.io
    resources:
      - "*"
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - controlplane.cluster.x-k8s.io
    resources:
      - awsmanagedcontrolplanes
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - controlplane.cluster.x-k8s.io
    resources:
      - awsmanagedcontrolplanes
      - awsmanagedcontrolplanes/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - controlplane.cluster.x-k8s.io
    resources:
      - awsmanagedcontrolplanes/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - controlplane.cluster.x-k8s.io
    resources:
      - rosacontrolplanes
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - controlplane.cluster.x-k8s.io
    resources:
      - rosacontrolplanes
      - rosacontrolplanes/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - controlplane.cluster.x-k8s.io
    resources:
      - rosacontrolplanes/finalizers
    verbs:
      - update
  - apiGroups:
      - controlplane.cluster.x-k8s.io
    resources:
      - rosacontrolplanes/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - get
      - list
      - patch
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsclustercontrolleridentities
    verbs:
      - create
      - get
      - list
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsclustercontrolleridentities
      - awsclusterroleidentities
      - awsclusterstaticidentities
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsclusterroleidentities
      - awsclusterstaticidentities
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsclusters
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsclusters/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsfargateprofiles
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsfargateprofiles/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmachinepools
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmachinepools
      - awsmachinepools/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmachinepools/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmachines
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmachines
      - awsmachines/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmachines/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmachinetemplates
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmanagedclusters
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmanagedclusters
      - awsmanagedclusters/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmanagedclusters/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmanagedmachinepools
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmanagedmachinepools
      - awsmanagedmachinepools/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - awsmanagedmachinepools/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - rosaclusters
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - rosaclusters/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - rosamachinepools
    verbs:
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - rosamachinepools/finalizers
    verbs:
      - update
  - apiGroups:
      - infrastructure.cluster.x-k8s.io
    resources:
      - rosamachinepools/status
    verbs:
      - get
      - patch
      - update

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: capa-manager-role
subjects:
  - kind: ServiceAccount
    name: capa-controller-manager
    namespace: capa-system

---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
    control-plane: controller-manager
  name: capa-controller-manager
  namespace: capa-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-leader-elect-role
  namespace: capa-system
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - configmaps/status
    verbs:
      - get
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-leader-elect-rolebinding
  namespace: capa-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: capa-leader-elect-role
subjects:
  - kind: ServiceAccount
    name: capa-controller-manager
    namespace: capa-system

---
apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
    control-plane: capa-controller-manager
  name: capa-controller-manager
  namespace: capa-system
spec:
  replicas: 1
  selector:
    matchLabels:
      cluster.x-k8s.io/provider: infrastructure-aws
      control-plane: capa-controller-manager
  strategy: {}
  template:
    metadata:
      annotations:
        iam.amazonaws.com/role: ""
      labels:
        cluster.x-k8s.io/provider: infrastructure-aws
        control-plane: capa-controller-manager
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - preference:
                matchExpressions:
                  - key: node-role.kubernetes.io/control-plane
                    operator: Exists
              weight: 10
            - preference:
                matchExpressions:
                  - key: node-role.kubernetes.io/master
                    operator: Exists
              weight: 10
      containers:
        - args:
            - --leader-elect
            - --feature-gates=EKS=true,MachinePool=true,ROSA=true
            - --v=0
            - --diagnostics-address=:8443
            - --insecure-diagnostics=false
          env:
            - name: AWS_SHARED_CREDENTIALS_FILE
              value: /home/.aws/credentials
          image: registry.k8s.io/cluster-api-aws/cluster-api-aws-controller:v2.7.1
          imagePullPolicy: Always
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: healthz
            periodSeconds: 10
          name: manager
          ports:
            - containerPort: 9443
              name: webhook-server
              protocol: TCP
            - containerPort: 9440
              name: healthz
              protocol: TCP
            - containerPort: 8443
              name: metrics
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /readyz
              port: healthz
          resources:
            requests:
              cpu: 10m
              memory: 50Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsGroup: 65532
            runAsUser: 65532
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
            - mountPath: /tmp/k8s-webhook-server/serving-certs
              name: cert
              readOnly: true
            - mountPath: /home/.aws
              name: credentials
      priorityClassName: system-cluster-critical
      securityContext:
        fsGroup: 1000
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: capa-controller-manager
      terminationGracePeriodSeconds: 10
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
        - effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
      volumes:
        - name: cert
          secret:
            defaultMode: 420
            secretName: capa-webhook-service-cert
        - name: credentials
          secret:
            secretName: capa-manager-bootstrap-credentials
status: {}

---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-mutating-webhook-configuration
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-awsmachine
    failurePolicy: Fail
    name: mutation.awsmachine.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmachines
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-awsfargateprofile
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.awsfargateprofile.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsfargateprofiles
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-awsmachinepool
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.awsmachinepool.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmachinepools
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-awsmanagedmachinepool
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.awsmanagedmachinepool.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmanagedmachinepools
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-infrastructure-cluster-x-k8s-io-v1beta2-rosamachinepool
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.rosamachinepool.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - rosamachinepools
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-bootstrap-cluster-x-k8s-io-v1beta2-eksconfig
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.eksconfigs.bootstrap.cluster.x-k8s.io
    rules:
      - apiGroups:
          - bootstrap.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - eksconfig
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-bootstrap-cluster-x-k8s-io-v1beta2-eksconfigtemplate
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.eksconfigtemplates.bootstrap.cluster.x-k8s.io
    rules:
      - apiGroups:
          - bootstrap.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - eksconfigtemplate
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-controlplane-cluster-x-k8s-io-v1beta2-awsmanagedcontrolplane
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io
    rules:
      - apiGroups:
          - controlplane.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmanagedcontrolplanes
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /mutate-controlplane-cluster-x-k8s-io-v1beta2-rosacontrolplane
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: default.rosacontrolplanes.controlplane.cluster.x-k8s.io
    rules:
      - apiGroups:
          - controlplane.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - rosacontrolplanes
    sideEffects: None

---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    service.beta.openshift.io/inject-cabundle: "true"
  creationTimestamp: null
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-validating-webhook-configuration
webhooks:
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-infrastructure-cluster-x-k8s-io-v1beta2-awsmachine
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.awsmachine.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmachines
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-infrastructure-cluster-x-k8s-io-v1beta2-awsmachinetemplate
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.awsmachinetemplate.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmachinetemplates
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-infrastructure-cluster-x-k8s-io-v1beta2-awsfargateprofile
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.awsfargateprofile.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsfargateprofiles
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-infrastructure-cluster-x-k8s-io-v1beta2-awsmachinepool
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.awsmachinepool.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmachinepools
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-infrastructure-cluster-x-k8s-io-v1beta2-awsmanagedmachinepool
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.awsmanagedmachinepool.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmanagedmachinepools
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-infrastructure-cluster-x-k8s-io-v1beta2-rosamachinepool
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.rosamachinepool.infrastructure.cluster.x-k8s.io
    rules:
      - apiGroups:
          - infrastructure.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - rosamachinepools
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-bootstrap-cluster-x-k8s-io-v1beta2-eksconfig
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.eksconfigs.bootstrap.cluster.x-k8s.io
    rules:
      - apiGroups:
          - bootstrap.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - eksconfig
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-bootstrap-cluster-x-k8s-io-v1beta2-eksconfigtemplate
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.eksconfigtemplates.bootstrap.cluster.x-k8s.io
    rules:
      - apiGroups:
          - bootstrap.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - eksconfigtemplate
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-controlplane-cluster-x-k8s-io-v1beta2-awsmanagedcontrolplane
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.awsmanagedcontrolplanes.controlplane.cluster.x-k8s.io
    rules:
      - apiGroups:
          - controlplane.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - awsmanagedcontrolplanes
    sideEffects: None
  - admissionReviewVersions:
      - v1
      - v1beta1
    clientConfig:
      service:
        name: capa-webhook-service
        namespace: capa-system
        path: /validate-controlplane-cluster-x-k8s-io-v1beta2-rosacontrolplane
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validation.rosacontrolplanes.controlplane.cluster.x-k8s.io
    rules:
      - apiGroups:
          - controlplane.cluster.x-k8s.io
        apiVersions:
          - v1beta2
        operations:
          - CREATE
          - UPDATE
        resources:
          - rosacontrolplanes
    sideEffects: None

---
apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.openshift.io/serving-cert-secret-name: capa-webhook-service-cert
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-webhook-service
  namespace: capa-system
spec:
  ports:
    - port: 443
      targetPort: webhook-server
  selector:
    cluster.x-k8s.io/provider: infrastructure-aws

---
apiVersion: v1
data:
  credentials: ""
kind: Secret
metadata:
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-manager-bootstrap-credentials
  namespace: capa-system
type: Opaque
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    cluster.x-k8s.io/provider: infrastructure-aws
    clusterctl.cluster.x-k8s.io: ""
  name: capa-admin-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: capa-controller-manager
  namespace: capa-system
#---
#apiVersion: admissionregistration.k8s.io/v1beta1
#kind: ValidatingAdmissionPolicy
#metadata:
#  name: capa-system-protect-awscluster
#spec:
#  failurePolicy: Fail
#  matchConstraints:
#    resourceRules:
#      - apiGroups:
#          - infrastructure.cluster.x-k8s.io
#        apiVersions:
#          - "*"
#        operations:
#          - DELETE
#        resources:
#          - awsclusters
#  paramKind:
#    apiVersion: config.openshift.io/v1
#    kind: Infrastructure
#  validations:
#    - expression: "!(oldObject.metadata.name == params.status.infrastructureName)"
#      message: InfraCluster resources with metadata.name corresponding to the cluster
#        infrastructureName cannot be deleted.

#---
#apiVersion: admissionregistration.k8s.io/v1beta1
#kind: ValidatingAdmissionPolicyBinding
#metadata:
#  name: capa-system-protect-awscluster
#spec:
#  matchResources:
#    namespaceSelector:
#      matchLabels:
#        kubernetes.io/metadata.name: capa-system
#  paramRef:
#    name: cluster
#    parameterNotFoundAction: Deny
#  policyName: capa-system-protect-awscluster
#  validationActions:
#    - Deny

