Skip to content

Commit d5b8372

Browse files
andcltandclt
committed
feat: add support for OCM role creation
1 parent 3f6ef66 commit d5b8372

17 files changed

Lines changed: 3583 additions & 2 deletions

‎config/crd/bases/infrastructure.cluster.x-k8s.io_rosaocmroleconfigs.yaml‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.19.0
7+
name: rosaocmroleconfigs.infrastructure.cluster.x-k8s.io
8+
spec:
9+
group: infrastructure.cluster.x-k8s.io
10+
names:
11+
categories:
12+
- cluster-api
13+
kind: ROSAOCMRoleConfig
14+
listKind: ROSAOCMRoleConfigList
15+
plural: rosaocmroleconfigs
16+
shortNames:
17+
- rosaocmrole
18+
singular: rosaocmroleconfig
19+
scope: Cluster
20+
versions:
21+
- name: v1beta2
22+
schema:
23+
openAPIV3Schema:
24+
description: ROSAOCMRoleConfig is the Schema for the rosaocmroleconfigs API
25+
properties:
26+
apiVersion:
27+
description: |-
28+
APIVersion defines the versioned schema of this representation of an object.
29+
Servers should convert recognized schemas to the latest internal value, and
30+
may reject unrecognized values.
31+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
32+
type: string
33+
kind:
34+
description: |-
35+
Kind is a string value representing the REST resource this object represents.
36+
Servers may infer this from the endpoint the client submits requests to.
37+
Cannot be updated.
38+
In CamelCase.
39+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
40+
type: string
41+
metadata:
42+
type: object
43+
spec:
44+
description: ROSAOCMRoleConfigSpec defines the desired state of ROSAOCMRoleConfig
45+
properties:
46+
credentialsSecretRef:
47+
description: CredentialsSecretRef references a secret with necessary
48+
credentials to connect to the OCM API.
49+
properties:
50+
name:
51+
description: name is unique within a namespace to reference a
52+
secret resource.
53+
type: string
54+
namespace:
55+
description: namespace defines the space within which the secret
56+
name must be unique.
57+
type: string
58+
type: object
59+
x-kubernetes-map-type: atomic
60+
deletionPolicy:
61+
default: Delete
62+
description: |-
63+
DeletionPolicy determines what happens to the OCM role when this CR is deleted.
64+
Delete will unlink and delete the OCM role.
65+
Retain will keep the OCM role intact.
66+
This is useful when reprovisioning management clusters to avoid disrupting users in the same organization.
67+
enum:
68+
- Delete
69+
- Retain
70+
type: string
71+
identityRef:
72+
description: |-
73+
IdentityRef is a reference to an identity to be used when reconciling the OCM Role Config.
74+
If no identity is specified, the default identity for this controller will be used.
75+
properties:
76+
kind:
77+
description: Kind of the identity.
78+
enum:
79+
- AWSClusterControllerIdentity
80+
- AWSClusterRoleIdentity
81+
- AWSClusterStaticIdentity
82+
type: string
83+
name:
84+
description: Name of the identity.
85+
minLength: 1
86+
type: string
87+
required:
88+
- kind
89+
- name
90+
type: object
91+
path:
92+
description: Path is the IAM path for the OCM role.
93+
pattern: ^\/.*\/$
94+
type: string
95+
permissionsBoundaryARN:
96+
description: PermissionsBoundaryARN is the ARN of the policy that
97+
is used to set the permissions boundary for the OCM role.
98+
type: string
99+
profile:
100+
default: Standard
101+
description: Profile defines the permission level for the OCM role.
102+
enum:
103+
- Standard
104+
- Admin
105+
- NoConsole
106+
type: string
107+
x-kubernetes-validations:
108+
- message: profile is immutable
109+
rule: self == oldSelf
110+
rolePrefix:
111+
description: |-
112+
RolePrefix is the user-defined prefix for the OCM role name.
113+
The final role name will be: {RolePrefix}-OCM-Role-{ExternalID}
114+
where ExternalID is the organization's external identifier from OCM.
115+
maxLength: 12
116+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
117+
type: string
118+
x-kubernetes-validations:
119+
- message: rolePrefix is immutable
120+
rule: self == oldSelf
121+
required:
122+
- profile
123+
- rolePrefix
124+
type: object
125+
status:
126+
description: ROSAOCMRoleConfigStatus defines the observed state of ROSAOCMRoleConfig
127+
properties:
128+
conditions:
129+
description: Conditions specifies the ROSAOCMRoleConfig conditions
130+
items:
131+
description: Condition defines an observation of a Cluster API resource
132+
operational state.
133+
properties:
134+
lastTransitionTime:
135+
description: |-
136+
lastTransitionTime is the last time the condition transitioned from one status to another.
137+
This should be when the underlying condition changed. If that is not known, then using the time when
138+
the API field changed is acceptable.
139+
format: date-time
140+
type: string
141+
message:
142+
description: |-
143+
message is a human readable message indicating details about the transition.
144+
This field may be empty.
145+
maxLength: 10240
146+
minLength: 1
147+
type: string
148+
reason:
149+
description: |-
150+
reason is the reason for the condition's last transition in CamelCase.
151+
The specific API may choose whether or not this field is considered a guaranteed API.
152+
This field may be empty.
153+
maxLength: 256
154+
minLength: 1
155+
type: string
156+
severity:
157+
description: |-
158+
severity provides an explicit classification of Reason code, so the users or machines can immediately
159+
understand the current situation and act accordingly.
160+
The Severity field MUST be set only when Status=False.
161+
maxLength: 32
162+
type: string
163+
status:
164+
description: status of the condition, one of True, False, Unknown.
165+
type: string
166+
type:
167+
description: |-
168+
type of condition in CamelCase or in foo.example.com/CamelCase.
169+
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
170+
can be useful (see .node.status.conditions), the ability to deconflict is important.
171+
maxLength: 256
172+
minLength: 1
173+
type: string
174+
required:
175+
- lastTransitionTime
176+
- status
177+
- type
178+
type: object
179+
type: array
180+
organizationID:
181+
description: OrganizationID is the OCM organization ID that this role
182+
is linked to.
183+
type: string
184+
roleARN:
185+
description: RoleARN is the ARN of the created OCM role.
186+
type: string
187+
type: object
188+
type: object
189+
served: true
190+
storage: true
191+
subresources:
192+
status: {}

‎config/rbac/role.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,7 @@ rules:
200200
- awsmachinetemplates/status
201201
- rosaclusters/status
202202
- rosanetworks/status
203+
- rosaocmroleconfigs/status
203204
- rosaroleconfigs/status
204205
verbs:
205206
- get
@@ -231,6 +232,7 @@ rules:
231232
- awsmachines
232233
- rosamachinepools
233234
- rosanetworks
235+
- rosaocmroleconfigs
234236
- rosaroleconfigs
235237
verbs:
236238
- create
@@ -245,6 +247,7 @@ rules:
245247
resources:
246248
- rosamachinepools/finalizers
247249
- rosanetworks/finalizers
250+
- rosaocmroleconfigs/finalizers
248251
- rosaroleconfigs/finalizers
249252
verbs:
250253
- update

0 commit comments

Comments
 (0)