---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    api-approved.openshift.io: https://github.com/openshift/api/pull/2090
    api.openshift.io/merged-by-featuregates: "true"
    include.release.openshift.io/ibm-cloud-managed: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
  creationTimestamp: "2025-10-27T11:18:48Z"
  generation: 1
  labels:
    openshift.io/operator-managed: ""
  managedFields:
  - apiVersion: apiextensions.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:api-approved.openshift.io: {}
          f:api.openshift.io/merged-by-featuregates: {}
          f:include.release.openshift.io/ibm-cloud-managed: {}
          f:include.release.openshift.io/self-managed-high-availability: {}
        f:labels:
          .: {}
          f:openshift.io/operator-managed: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"d36bdf59-d268-4238-afb0-5e0b21cca1a4"}: {}
      f:spec:
        f:conversion:
          .: {}
          f:strategy: {}
        f:group: {}
        f:names:
          f:kind: {}
          f:listKind: {}
          f:plural: {}
          f:singular: {}
        f:scope: {}
        f:versions: {}
    manager: cluster-version-operator
    operation: Update
    time: "2025-10-27T11:18:48Z"
  - apiVersion: apiextensions.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:acceptedNames:
          f:kind: {}
          f:listKind: {}
          f:plural: {}
          f:singular: {}
        f:conditions:
          k:{"type":"Established"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
          k:{"type":"NamesAccepted"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
    manager: kube-apiserver
    operation: Update
    subresource: status
    time: "2025-10-27T11:18:49Z"
  name: machineosconfigs.machineconfiguration.openshift.io
  ownerReferences:
  - apiVersion: config.openshift.io/v1
    controller: true
    kind: ClusterVersion
    name: version
    uid: d36bdf59-d268-4238-afb0-5e0b21cca1a4
  resourceVersion: "2259"
  uid: 2e393342-a5a9-4dbc-b786-8c98cd5d831d
spec:
  conversion:
    strategy: None
  group: machineconfiguration.openshift.io
  names:
    kind: MachineOSConfig
    listKind: MachineOSConfigList
    plural: machineosconfigs
    singular: machineosconfig
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: |-
          MachineOSConfig describes the configuration for a build process managed by the MCO
          Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: spec describes the configuration of the machineosconfig
            properties:
              baseImagePullSecret:
                description: |-
                  baseImagePullSecret is the secret used to pull the base image.
                  Must live in the openshift-machine-config-operator namespace if provided.
                  Defaults to using the cluster-wide pull secret if not specified. This is provided during install time of the cluster, and lives in the openshift-config namespace as a secret.
                properties:
                  name:
                    description: |-
                      name is the name of the secret used to push or pull this MachineOSConfig object.
                      Must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character.
                      This secret must be in the openshift-machine-config-operator namespace.
                    maxLength: 253
                    type: string
                    x-kubernetes-validations:
                    - message: a lowercase RFC 1123 subdomain must consist of lower
                        case alphanumeric characters, '-' or '.', and must start and
                        end with an alphanumeric character.
                      rule: '!format.dns1123Subdomain().validate(self).hasValue()'
                required:
                - name
                type: object
              containerFile:
                description: |-
                  containerFile describes the custom data the user has specified to build into the image.
                  This is also commonly called a Dockerfile and you can treat it as such. The content is the content of your Dockerfile.
                  See https://github.com/containers/common/blob/main/docs/Containerfile.5.md for the spec reference.
                  This is a list indexed by architecture name (e.g. AMD64), and allows specifying one containerFile per arch, up to 4.
                items:
                  description: MachineOSContainerfile contains all custom content
                    the user wants built into the image
                  properties:
                    containerfileArch:
                      default: NoArch
                      description: |-
                        containerfileArch describes the architecture this containerfile is to be built for.
                        This arch is optional. If the user does not specify an architecture, it is assumed
                        that the content can be applied to all architectures, or in a single arch cluster: the only architecture.
                      enum:
                      - ARM64
                      - AMD64
                      - PPC64LE
                      - S390X
                      - NoArch
                      type: string
                    content:
                      description: |-
                        content is an embedded Containerfile/Dockerfile that defines the contents to be built into your image.
                        See https://github.com/containers/common/blob/main/docs/Containerfile.5.md for the spec reference.
                        for example, this would add the tree package to your hosts:
                          FROM configs AS final
                          RUN rpm-ostree install tree && \
                            ostree container commit
                        This is a required field and can have a maximum length of **4096** characters.
                      maxLength: 4096
                      type: string
                  required:
                  - content
                  type: object
                maxItems: 4
                minItems: 0
                type: array
                x-kubernetes-list-map-keys:
                - containerfileArch
                x-kubernetes-list-type: map
              imageBuilder:
                description: |-
                  imageBuilder describes which image builder will be used in each build triggered by this MachineOSConfig.
                  Currently supported type(s): Job
                properties:
                  imageBuilderType:
                    description: |-
                      imageBuilderType specifies the backend to be used to build the image.
                      Valid options are: Job
                    enum:
                    - Job
                    type: string
                required:
                - imageBuilderType
                type: object
              machineConfigPool:
                description: |-
                  machineConfigPool is the pool which the build is for.
                  The Machine Config Operator will perform the build and roll out the built image to the specified pool.
                properties:
                  name:
                    description: |-
                      name of the MachineConfigPool object.
                      This value should be at most 253 characters, and must contain only lowercase
                      alphanumeric characters, hyphens and periods, and should start and end with an alphanumeric character.
                    maxLength: 253
                    type: string
                    x-kubernetes-validations:
                    - message: a lowercase RFC 1123 subdomain must consist of lower
                        case alphanumeric characters, '-' or '.', and must start and
                        end with an alphanumeric character.
                      rule: '!format.dns1123Subdomain().validate(self).hasValue()'
                required:
                - name
                type: object
              renderedImagePushSecret:
                description: |-
                  renderedImagePushSecret is the secret used to connect to a user registry.
                  The final image push and pull secrets should be separate and assume the principal of least privilege.
                  The push secret with write privilege is only required to be present on the node hosting the MachineConfigController pod.
                  The pull secret with read only privileges is required on all nodes.
                  By separating the two secrets, the risk of write credentials becoming compromised is reduced.
                properties:
                  name:
                    description: |-
                      name is the name of the secret used to push or pull this MachineOSConfig object.
                      Must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character.
                      This secret must be in the openshift-machine-config-operator namespace.
                    maxLength: 253
                    type: string
                    x-kubernetes-validations:
                    - message: a lowercase RFC 1123 subdomain must consist of lower
                        case alphanumeric characters, '-' or '.', and must start and
                        end with an alphanumeric character.
                      rule: '!format.dns1123Subdomain().validate(self).hasValue()'
                required:
                - name
                type: object
              renderedImagePushSpec:
                description: |-
                  renderedImagePushSpec describes the location of the final image.
                  The MachineOSConfig object will use the in cluster image registry configuration.
                  If you wish to use a mirror or any other settings specific to registries.conf, please specify those in the cluster wide registries.conf via the cluster image.config, ImageContentSourcePolicies, ImageDigestMirrorSet, or ImageTagMirrorSet objects.
                  The format of the image push spec is: host[:port][/namespace]/name:<tag> or svc_name.namespace.svc[:port]/repository/name:<tag>.
                  The length of the push spec must be between 1 to 447 characters.
                maxLength: 447
                minLength: 1
                type: string
                x-kubernetes-validations:
                - message: the OCI Image name should follow the host[:port][/namespace]/name
                    format, resembling a valid URL without the scheme. Or it must
                    be a valid .svc followed by a port, repository, image name, and
                    tag.
                  rule: self.matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_]{1,61})*/[a-zA-Z0-9-_.]+:[a-zA-Z0-9._-]+$')
                    || self.matches('^[^.]+\\.[^.]+\\.svc:\\d+\\/[^\\/]+\\/[^\\/]+:[^\\/]+$')
            required:
            - imageBuilder
            - machineConfigPool
            - renderedImagePushSecret
            - renderedImagePushSpec
            type: object
          status:
            description: status describes the status of the machineosconfig
            properties:
              conditions:
                description: conditions are state related conditions for the object.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              currentImagePullSpec:
                description: |-
                  currentImagePullSpec is the fully qualified image pull spec used by the MCO to pull down the new OSImage. This includes the sha256 image digest.
                  This is generated when the Machine Config Operator's build controller successfully completes the build, and is populated from the corresponding
                  MachineOSBuild object's FinalImagePushSpec. This may change after completion in reaction to spec changes that would cause a new image build,
                  but will not be removed.
                  The format of the image pull spec is: host[:port][/namespace]/name@sha256:<digest>,
                  where the digest must be 64 characters long, and consist only of lowercase hexadecimal characters, a-f and 0-9.
                  The length of the whole spec must be between 1 to 447 characters.
                maxLength: 447
                minLength: 1
                type: string
                x-kubernetes-validations:
                - message: the OCI Image reference must end with a valid '@sha256:<digest>'
                    suffix, where '<digest>' is 64 characters long
                  rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))
                - message: the OCI Image name should follow the host[:port][/namespace]/name
                    format, resembling a valid URL without the scheme
                  rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?/([a-zA-Z0-9-_]{0,61}/)?[a-zA-Z0-9-_.]*?$'))
              machineOSBuild:
                description: machineOSBuild is a reference to the MachineOSBuild object
                  for this MachineOSConfig, which contains the status for the image
                  build.
                properties:
                  group:
                    description: |-
                      group of the referent.
                      The name must contain only lowercase alphanumeric characters, '-' or '.' and start/end with an alphanumeric character.
                      Example: "", "apps", "build.openshift.io", etc.
                    maxLength: 253
                    type: string
                    x-kubernetes-validations:
                    - message: a lowercase RFC 1123 subdomain must consist of lower
                        case alphanumeric characters, '-' or '.', and must start and
                        end with an alphanumeric character.
                      rule: '!format.dns1123Subdomain().validate(self).hasValue()'
                  name:
                    description: |-
                      name of the referent.
                      The name must contain only lowercase alphanumeric characters, '-' or '.' and start/end with an alphanumeric character.
                    maxLength: 253
                    minLength: 1
                    type: string
                    x-kubernetes-validations:
                    - message: a lowercase RFC 1123 subdomain must consist of lower
                        case alphanumeric characters, '-' or '.', and must start and
                        end with an alphanumeric character.
                      rule: '!format.dns1123Subdomain().validate(self).hasValue()'
                  namespace:
                    description: |-
                      namespace of the referent.
                      This value should consist of at most 63 characters, and of only lowercase alphanumeric characters and hyphens,
                      and should start and end with an alphanumeric character.
                    maxLength: 63
                    minLength: 1
                    type: string
                    x-kubernetes-validations:
                    - message: the value must consist of only lowercase alphanumeric
                        characters and hyphens
                      rule: '!format.dns1123Label().validate(self).hasValue()'
                  resource:
                    description: |-
                      resource of the referent.
                      This value should consist of at most 63 characters, and of only lowercase alphanumeric characters and hyphens,
                      and should start with an alphabetic character and end with an alphanumeric character.
                      Example: "deployments", "deploymentconfigs", "pods", etc.
                    maxLength: 63
                    minLength: 1
                    type: string
                    x-kubernetes-validations:
                    - message: a DNS-1035 label must consist of lower case alphanumeric
                        characters or '-', start with an alphabetic character, and
                        end with an alphanumeric character
                      rule: '!format.dns1035Label().validate(self).hasValue()'
                required:
                - group
                - name
                - resource
                type: object
              observedGeneration:
                description: observedGeneration represents the generation of the MachineOSConfig
                  object observed by the Machine Config Operator's build controller.
                format: int64
                minimum: 0
                type: integer
                x-kubernetes-validations:
                - message: observedGeneration must not move backwards
                  rule: self >= oldSelf
            type: object
        required:
        - spec
        type: object
        x-kubernetes-validations:
        - message: MachineOSConfig name must match the referenced MachineConfigPool
            name; can only have one MachineOSConfig per MachineConfigPool
          optionalOldSelf: true
          rule: self.metadata.name == self.spec.machineConfigPool.name || oldSelf.hasValue()
            && oldSelf.spec.machineConfigPool.name.value() == self.spec.machineConfigPool.name
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: MachineOSConfig
    listKind: MachineOSConfigList
    plural: machineosconfigs
    singular: machineosconfig
  conditions:
  - lastTransitionTime: "2025-10-27T11:18:49Z"
    message: no conflicts found
    reason: NoConflicts
    status: "True"
    type: NamesAccepted
  - lastTransitionTime: "2025-10-27T11:18:49Z"
    message: the initial names have been accepted
    reason: InitialNamesAccepted
    status: "True"
    type: Established
  storedVersions:
  - v1
