Skip to content

Commit 64d6554

Browse files
andcltandclt
committed
feat: add support for OCM role creation
1 parent 3f6ef66 commit 64d6554

20 files changed

Lines changed: 3916 additions & 5 deletions

‎config/crd/bases/infrastructure.cluster.x-k8s.io_rosaocmroleconfigs.yaml‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.19.0
7+
name: rosaocmroleconfigs.infrastructure.cluster.x-k8s.io
8+
spec:
9+
group: infrastructure.cluster.x-k8s.io
10+
names:
11+
categories:
12+
- cluster-api
13+
kind: ROSAOCMRoleConfig
14+
listKind: ROSAOCMRoleConfigList
15+
plural: rosaocmroleconfigs
16+
shortNames:
17+
- rosaocmrole
18+
singular: rosaocmroleconfig
19+
scope: Cluster
20+
versions:
21+
- name: v1beta2
22+
schema:
23+
openAPIV3Schema:
24+
description: ROSAOCMRoleConfig is the Schema for the rosaocmroleconfigs API
25+
properties:
26+
apiVersion:
27+
description: |-
28+
APIVersion defines the versioned schema of this representation of an object.
29+
Servers should convert recognized schemas to the latest internal value, and
30+
may reject unrecognized values.
31+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
32+
type: string
33+
kind:
34+
description: |-
35+
Kind is a string value representing the REST resource this object represents.
36+
Servers may infer this from the endpoint the client submits requests to.
37+
Cannot be updated.
38+
In CamelCase.
39+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
40+
type: string
41+
metadata:
42+
type: object
43+
spec:
44+
description: ROSAOCMRoleConfigSpec defines the desired state of ROSAOCMRoleConfig
45+
properties:
46+
credentialsSecretRef:
47+
description: CredentialsSecretRef references a secret with necessary
48+
credentials to connect to the OCM API.
49+
properties:
50+
name:
51+
description: name is unique within a namespace to reference a
52+
secret resource.
53+
type: string
54+
namespace:
55+
description: namespace defines the space within which the secret
56+
name must be unique.
57+
type: string
58+
type: object
59+
x-kubernetes-map-type: atomic
60+
deletionPolicy:
61+
default: Delete
62+
description: |-
63+
DeletionPolicy determines what happens to the OCM role when this CR is deleted.
64+
Delete will unlink and delete the OCM role.
65+
Retain will keep the OCM role intact.
66+
This is useful when reprovisioning management clusters to avoid disrupting users in the same organization.
67+
enum:
68+
- Delete
69+
- Retain
70+
type: string
71+
identityNamespace:
72+
description: |-
73+
IdentityNamespace specifies which namespace to check against the identity's allowedNamespaces
74+
for permission validation. This field should be set when using an identity that has
75+
allowedNamespaces configured with specific namespace restrictions.
76+
If the identity allows all namespaces (allowedNamespaces is empty or nil), this field is optional.
77+
If not set and the identity has namespace restrictions, reconciliation will fail.
78+
type: string
79+
identityRef:
80+
description: |-
81+
IdentityRef is a reference to an identity to be used when reconciling the OCM Role Config.
82+
If no identity is specified, the default identity for this controller will be used.
83+
properties:
84+
kind:
85+
description: Kind of the identity.
86+
enum:
87+
- AWSClusterControllerIdentity
88+
- AWSClusterRoleIdentity
89+
- AWSClusterStaticIdentity
90+
type: string
91+
name:
92+
description: Name of the identity.
93+
minLength: 1
94+
type: string
95+
required:
96+
- kind
97+
- name
98+
type: object
99+
path:
100+
description: Path is the IAM path for the OCM role.
101+
pattern: ^\/.*\/$
102+
type: string
103+
permissionsBoundaryARN:
104+
description: PermissionsBoundaryARN is the ARN of the policy that
105+
is used to set the permissions boundary for the OCM role.
106+
type: string
107+
profile:
108+
default: Standard
109+
description: Profile defines the permission level for the OCM role.
110+
enum:
111+
- Standard
112+
- Admin
113+
- NoConsole
114+
type: string
115+
x-kubernetes-validations:
116+
- message: profile is immutable
117+
rule: self == oldSelf
118+
rolePrefix:
119+
description: |-
120+
RolePrefix is the user-defined prefix for the OCM role name.
121+
The final role name will be: {RolePrefix}-OCM-Role-{ExternalID}
122+
where ExternalID is the organization's external identifier from OCM.
123+
maxLength: 12
124+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
125+
type: string
126+
x-kubernetes-validations:
127+
- message: rolePrefix is immutable
128+
rule: self == oldSelf
129+
required:
130+
- profile
131+
- rolePrefix
132+
type: object
133+
status:
134+
description: ROSAOCMRoleConfigStatus defines the observed state of ROSAOCMRoleConfig
135+
properties:
136+
conditions:
137+
description: Conditions specifies the ROSAOCMRoleConfig conditions
138+
items:
139+
description: Condition defines an observation of a Cluster API resource
140+
operational state.
141+
properties:
142+
lastTransitionTime:
143+
description: |-
144+
lastTransitionTime is the last time the condition transitioned from one status to another.
145+
This should be when the underlying condition changed. If that is not known, then using the time when
146+
the API field changed is acceptable.
147+
format: date-time
148+
type: string
149+
message:
150+
description: |-
151+
message is a human readable message indicating details about the transition.
152+
This field may be empty.
153+
maxLength: 10240
154+
minLength: 1
155+
type: string
156+
reason:
157+
description: |-
158+
reason is the reason for the condition's last transition in CamelCase.
159+
The specific API may choose whether or not this field is considered a guaranteed API.
160+
This field may be empty.
161+
maxLength: 256
162+
minLength: 1
163+
type: string
164+
severity:
165+
description: |-
166+
severity provides an explicit classification of Reason code, so the users or machines can immediately
167+
understand the current situation and act accordingly.
168+
The Severity field MUST be set only when Status=False.
169+
maxLength: 32
170+
type: string
171+
status:
172+
description: status of the condition, one of True, False, Unknown.
173+
type: string
174+
type:
175+
description: |-
176+
type of condition in CamelCase or in foo.example.com/CamelCase.
177+
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
178+
can be useful (see .node.status.conditions), the ability to deconflict is important.
179+
maxLength: 256
180+
minLength: 1
181+
type: string
182+
required:
183+
- lastTransitionTime
184+
- status
185+
- type
186+
type: object
187+
type: array
188+
organizationID:
189+
description: OrganizationID is the OCM organization ID that this role
190+
is linked to.
191+
type: string
192+
roleARN:
193+
description: RoleARN is the ARN of the created OCM role.
194+
type: string
195+
type: object
196+
type: object
197+
served: true
198+
storage: true
199+
subresources:
200+
status: {}

‎config/rbac/role.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,7 @@ rules:
200200
- awsmachinetemplates/status
201201
- rosaclusters/status
202202
- rosanetworks/status
203+
- rosaocmroleconfigs/status
203204
- rosaroleconfigs/status
204205
verbs:
205206
- get
@@ -231,6 +232,7 @@ rules:
231232
- awsmachines
232233
- rosamachinepools
233234
- rosanetworks
235+
- rosaocmroleconfigs
234236
- rosaroleconfigs
235237
verbs:
236238
- create
@@ -245,6 +247,7 @@ rules:
245247
resources:
246248
- rosamachinepools/finalizers
247249
- rosanetworks/finalizers
250+
- rosaocmroleconfigs/finalizers
248251
- rosaroleconfigs/finalizers
249252
verbs:
250253
- update

0 commit comments

Comments
 (0)