feat: add support for OCM role creation

config/crd/bases/infrastructure.cluster.x-k8s.io_rosaocmroleconfigs.yaml

@@ -0,0 +1,182 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.19.0
+  name: rosaocmroleconfigs.infrastructure.cluster.x-k8s.io
+spec:
+  group: infrastructure.cluster.x-k8s.io
+  names:
+    categories:
+    - cluster-api
+    kind: ROSAOCMRoleConfig
+    listKind: ROSAOCMRoleConfigList
+    plural: rosaocmroleconfigs
+    shortNames:
+    - rosaocmrole
+    singular: rosaocmroleconfig
+  scope: Cluster
+  versions:
+  - name: v1beta2
+    schema:
+      openAPIV3Schema:
+        description: ROSAOCMRoleConfig is the Schema for the rosaocmroleconfigs API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ROSAOCMRoleConfigSpec defines the desired state of ROSAOCMRoleConfig
+            properties:
+              credentialsSecretRef:
+                description: CredentialsSecretRef references a secret with necessary
+                  credentials to connect to the OCM API.
+                properties:
+                  name:
+                    default: ""
+                    description: |-
+                      Name of the referent.
+                      This field is effectively required, but due to backwards compatibility is
+                      allowed to be empty. Instances of this type with an empty value here are
+                      almost certainly wrong.
+                      More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                    type: string
+                type: object
+                x-kubernetes-map-type: atomic
+              identityRef:
+                description: |-
+                  IdentityRef is a reference to an identity to be used when reconciling the OCM Role Config.
+                  If no identity is specified, the default identity for this controller will be used.
+                properties:
+                  kind:
+                    description: Kind of the identity.
+                    enum:
+                    - AWSClusterControllerIdentity
+                    - AWSClusterRoleIdentity
+                    - AWSClusterStaticIdentity
+                    type: string
+                  name:
+                    description: Name of the identity.
+                    minLength: 1
+                    type: string
+                required:
+                - kind
+                - name
+                type: object
+              path:
+                description: Path is the IAM path for the OCM role.
+                pattern: ^\/.*$
+                type: string
+              permissionsBoundaryARN:
+                description: PermissionsBoundaryARN is the ARN of the policy that
+                  is used to set the permissions boundary for the OCM role.
+                type: string
+              profile:
+                default: Standard
+                description: Profile defines the permission level for the OCM role.
+                enum:
+                - Standard
+                - Admin
+                - NoConsole
+                type: string
+                x-kubernetes-validations:
+                - message: profile is immutable
+                  rule: self == oldSelf
+              rolePrefix:
+                description: |-
+                  RolePrefix is the user-defined prefix for the OCM role name.
+                  The final role name will be: {RolePrefix}-OCM-Role-{ExternalID}
+                  where ExternalID is the organization's external identifier from OCM.
+                maxLength: 4
+                pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                type: string
+                x-kubernetes-validations:
+                - message: rolePrefix is immutable
+                  rule: self == oldSelf
+            required:
+            - profile
+            - rolePrefix
+            type: object
+          status:
+            description: ROSAOCMRoleConfigStatus defines the observed state of ROSAOCMRoleConfig
+            properties:
+              conditions:
+                description: Conditions specifies the ROSAOCMRoleConfig conditions
+                items:
+                  description: Condition defines an observation of a Cluster API resource
+                    operational state.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed. If that is not known, then using the time when
+                        the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This field may be empty.
+                      maxLength: 10240
+                      minLength: 1
+                      type: string
+                    reason:
+                      description: |-
+                        reason is the reason for the condition's last transition in CamelCase.
+                        The specific API may choose whether or not this field is considered a guaranteed API.
+                        This field may be empty.
+                      maxLength: 256
+                      minLength: 1
+                      type: string
+                    severity:
+                      description: |-
+                        severity provides an explicit classification of Reason code, so the users or machines can immediately
+                        understand the current situation and act accordingly.
+                        The Severity field MUST be set only when Status=False.
+                      maxLength: 32
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      type: string
+                    type:
+                      description: |-
+                        type of condition in CamelCase or in foo.example.com/CamelCase.
+                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
+                        can be useful (see .node.status.conditions), the ability to deconflict is important.
+                      maxLength: 256
+                      minLength: 1
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - status
+                  - type
+                  type: object
+                type: array
+              organizationID:
+                description: OrganizationID is the OCM organization ID that this role
+                  is linked to.
+                type: string
+              roleARN:
+                description: RoleARN is the ARN of the created OCM role.
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

config/rbac/role.yaml

@@ -200,6 +200,7 @@ rules:
   - awsmachinetemplates/status
   - rosaclusters/status
   - rosanetworks/status
+  - rosaocmroleconfigs/status
   - rosaroleconfigs/status
   verbs:
   - get
@@ -231,6 +232,7 @@ rules:
   - awsmachines
   - rosamachinepools
   - rosanetworks
+  - rosaocmroleconfigs
   - rosaroleconfigs
   verbs:
   - create
@@ -245,6 +247,7 @@ rules:
   resources:
   - rosamachinepools/finalizers
   - rosanetworks/finalizers
+  - rosaocmroleconfigs/finalizers
   - rosaroleconfigs/finalizers
   verbs:
   - update

exp/api/v1beta2/finalizers.go

@@ -31,4 +31,7 @@ const (
 
 	// RosaRoleConfigFinalizer allows the controller to clean up resources on delete.
 	RosaRoleConfigFinalizer = "rosaroleconfigs.infrastructure.cluster.x-k8s.io"
+
+	// ROSAOCMRoleConfigFinalizer allows the controller to clean up resources on delete.
+	ROSAOCMRoleConfigFinalizer = "rosaocmroleconfigs.infrastructure.cluster.x-k8s.io"
 )

exp/api/v1beta2/rosaocmroleconfig_types.go

@@ -0,0 +1,142 @@
+/*
+Copyright 2026 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta2
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	infrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
+	clusterv1beta1 "sigs.k8s.io/cluster-api/api/core/v1beta1"
+)
+
+// ROSAOCMRoleProfile defines the permission level for the OCM role
+type ROSAOCMRoleProfile string
+
+const (
+	// ROSAOCMRoleProfileStandard provides standard OCM permissions
+	ROSAOCMRoleProfileStandard ROSAOCMRoleProfile = "Standard"
+
+	// ROSAOCMRoleProfileAdmin provides admin OCM permissions
+	ROSAOCMRoleProfileAdmin ROSAOCMRoleProfile = "Admin"
+
+	// ROSAOCMRoleProfileNoConsole provides minimal OCM permissions (cannot use console.redhat.com)
+	ROSAOCMRoleProfileNoConsole ROSAOCMRoleProfile = "NoConsole"
+)
+
+const (
+	// ROSAOCMRoleConfigReadyCondition condition reports on the successful reconciliation of ROSAOCMRoleConfig.
+	ROSAOCMRoleConfigReadyCondition = "ROSAOCMRoleConfigReady"
+
+	// ROSAOCMRoleConfigDeletionFailedReason used to report failures while deleting ROSAOCMRoleConfig.
+	ROSAOCMRoleConfigDeletionFailedReason = "DeletionFailed"
+
+	// ROSAOCMRoleConfigReconciliationFailedReason used to report reconciliation failures.
+	ROSAOCMRoleConfigReconciliationFailedReason = "ReconciliationFailed"
+
+	// ROSAOCMRoleConfigDeletionStarted used to indicate that the deletion of ROSAOCMRoleConfig has started.
+	ROSAOCMRoleConfigDeletionStarted = "DeletionStarted"
+
+	// ROSAOCMRoleConfigCreatedReason used to indicate that the ROSAOCMRoleConfig has been created.
+	ROSAOCMRoleConfigCreatedReason = "Created"
+
+	// ROSAOCMRoleConfigLinkedReason used to indicate that the OCM role has been linked to the organization.
+	ROSAOCMRoleConfigLinkedReason = "Linked"
+)
+
+// ROSAOCMRoleConfigSpec defines the desired state of ROSAOCMRoleConfig
+type ROSAOCMRoleConfigSpec struct {
+	// RolePrefix is the user-defined prefix for the OCM role name.
+	// The final role name will be: {RolePrefix}-OCM-Role-{ExternalID}
+	// where ExternalID is the organization's external identifier from OCM.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength:=4
+	// +kubebuilder:validation:Pattern:=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="rolePrefix is immutable"
+	RolePrefix string `json:"rolePrefix"`
+
+	// Profile defines the permission level for the OCM role.
+	// +kubebuilder:validation:Enum=Standard;Admin;NoConsole
+	// +kubebuilder:default=Standard
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf", message="profile is immutable"
+	Profile ROSAOCMRoleProfile `json:"profile"`
+
+	// PermissionsBoundaryARN is the ARN of the policy that is used to set the permissions boundary for the OCM role.
+	// +optional
+	PermissionsBoundaryARN string `json:"permissionsBoundaryARN,omitempty"`
+
+	// Path is the IAM path for the OCM role.
+	// +optional
+	// +kubebuilder:validation:Pattern=`^\/.*$`
+	Path string `json:"path,omitempty"`
+
+	// IdentityRef is a reference to an identity to be used when reconciling the OCM Role Config.
+	// If no identity is specified, the default identity for this controller will be used.
+	// +optional
+	IdentityRef *infrav1.AWSIdentityReference `json:"identityRef,omitempty"`
+
+	// CredentialsSecretRef references a secret with necessary credentials to connect to the OCM API.
+	// +optional
+	CredentialsSecretRef *corev1.LocalObjectReference `json:"credentialsSecretRef,omitempty"`
+}
+
+// ROSAOCMRoleConfigStatus defines the observed state of ROSAOCMRoleConfig
+type ROSAOCMRoleConfigStatus struct {
+	// RoleARN is the ARN of the created OCM role.
+	RoleARN string `json:"roleARN,omitempty"`
+
+	// OrganizationID is the OCM organization ID that this role is linked to.
+	OrganizationID string `json:"organizationID,omitempty"`
+
+	// Conditions specifies the ROSAOCMRoleConfig conditions
+	Conditions clusterv1beta1.Conditions `json:"conditions,omitempty"`
+}
+
+// ROSAOCMRoleConfig is the Schema for the rosaocmroleconfigs API
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:path=rosaocmroleconfigs,scope=Cluster,categories=cluster-api,shortName=rosaocmrole
+// +kubebuilder:storageversion
+// +kubebuilder:subresource:status
+type ROSAOCMRoleConfig struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ROSAOCMRoleConfigSpec   `json:"spec,omitempty"`
+	Status ROSAOCMRoleConfigStatus `json:"status,omitempty"`
+}
+
+// ROSAOCMRoleConfigList contains a list of ROSAOCMRoleConfig
+// +kubebuilder:object:root=true
+type ROSAOCMRoleConfigList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ROSAOCMRoleConfig `json:"items"`
+}
+
+// SetConditions sets the conditions of the ROSAOCMRoleConfig.
+func (r *ROSAOCMRoleConfig) SetConditions(conditions clusterv1beta1.Conditions) {
+	r.Status.Conditions = conditions
+}
+
+// GetConditions returns the observations of the operational state of the ROSAOCMRoleConfig resource.
+func (r *ROSAOCMRoleConfig) GetConditions() clusterv1beta1.Conditions {
+	return r.Status.Conditions
+}
+
+func init() {
+	SchemeBuilder.Register(&ROSAOCMRoleConfig{}, &ROSAOCMRoleConfigList{})
+}