awsclustertemplate_v1beta2.json

{
  "description": "AWSClusterTemplate is the schema for Amazon EC2 based Kubernetes Cluster Templates.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "AWSClusterTemplateSpec defines the desired state of AWSClusterTemplate.",
      "properties": {
        "template": {
          "description": "AWSClusterTemplateResource defines the desired state of AWSClusterTemplateResource.",
          "properties": {
            "metadata": {
              "description": "Standard object's metadata.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
              "properties": {
                "annotations": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "description": "Annotations is an unstructured key value map stored with a resource that may be\nset by external tools to store and retrieve arbitrary metadata. They are not\nqueryable and should be preserved when modifying objects.\nMore info: http://kubernetes.io/docs/user-guide/annotations",
                  "type": "object"
                },
                "labels": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "description": "Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand services.\nMore info: http://kubernetes.io/docs/user-guide/labels",
                  "type": "object"
                }
              },
              "type": "object",
              "additionalProperties": false
            },
            "spec": {
              "description": "AWSClusterSpec defines the desired state of an EC2-based Kubernetes cluster.",
              "properties": {
                "additionalTags": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "description": "AdditionalTags is an optional set of tags to add to AWS resources managed by the AWS provider, in addition to the\nones added by default.",
                  "type": "object"
                },
                "bastion": {
                  "description": "Bastion contains options to configure the bastion host.",
                  "properties": {
                    "allowedCIDRBlocks": {
                      "description": "AllowedCIDRBlocks is a list of CIDR blocks allowed to access the bastion host.\nThey are set as ingress rules for the Bastion host's Security Group (defaults to 0.0.0.0/0).",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    },
                    "ami": {
                      "description": "AMI will use the specified AMI to boot the bastion. If not specified,\nthe AMI will default to one picked out in public space.",
                      "type": "string"
                    },
                    "disableIngressRules": {
                      "description": "DisableIngressRules will ensure there are no Ingress rules in the bastion host's security group.\nRequires AllowedCIDRBlocks to be empty.",
                      "type": "boolean"
                    },
                    "enabled": {
                      "description": "Enabled allows this provider to create a bastion host instance\nwith a public ip to access the VPC private network.",
                      "type": "boolean"
                    },
                    "instanceType": {
                      "description": "InstanceType will use the specified instance type for the bastion. If not specified,\nCluster API Provider AWS will use t3.micro for all regions except us-east-1, where t2.micro\nwill be the default.",
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                },
                "controlPlaneEndpoint": {
                  "description": "ControlPlaneEndpoint represents the endpoint used to communicate with the control plane.",
                  "properties": {
                    "host": {
                      "description": "The hostname on which the API server is serving.",
                      "type": "string"
                    },
                    "port": {
                      "description": "The port on which the API server is serving.",
                      "format": "int32",
                      "type": "integer"
                    }
                  },
                  "required": [
                    "host",
                    "port"
                  ],
                  "type": "object",
                  "additionalProperties": false
                },
                "controlPlaneLoadBalancer": {
                  "description": "ControlPlaneLoadBalancer is optional configuration for customizing control plane behavior.",
                  "properties": {
                    "additionalListeners": {
                      "description": "AdditionalListeners sets the additional listeners for the control plane load balancer.\nThis is only applicable to Network Load Balancer (NLB) types for the time being.",
                      "items": {
                        "description": "AdditionalListenerSpec defines the desired state of an\nadditional listener on an AWS load balancer.",
                        "properties": {
                          "healthCheck": {
                            "description": "HealthCheck sets the optional custom health check configuration to the API target group.",
                            "properties": {
                              "intervalSeconds": {
                                "description": "The approximate amount of time, in seconds, between health checks of an individual\ntarget.",
                                "format": "int64",
                                "maximum": 300,
                                "minimum": 5,
                                "type": "integer"
                              },
                              "path": {
                                "description": "The destination for health checks on the targets when using the protocol HTTP or HTTPS,\notherwise the path will be ignored.",
                                "type": "string"
                              },
                              "port": {
                                "description": "The port the load balancer uses when performing health checks for additional target groups. When\nnot specified this value will be set for the same of listener port.",
                                "type": "string"
                              },
                              "protocol": {
                                "description": "The protocol to use to health check connect with the target. When not specified the Protocol\nwill be the same of the listener.",
                                "enum": [
                                  "TCP",
                                  "HTTP",
                                  "HTTPS"
                                ],
                                "type": "string"
                              },
                              "thresholdCount": {
                                "description": "The number of consecutive health check successes required before considering\na target healthy.",
                                "format": "int64",
                                "maximum": 10,
                                "minimum": 2,
                                "type": "integer"
                              },
                              "timeoutSeconds": {
                                "description": "The amount of time, in seconds, during which no response from a target means\na failed health check.",
                                "format": "int64",
                                "maximum": 120,
                                "minimum": 2,
                                "type": "integer"
                              },
                              "unhealthyThresholdCount": {
                                "description": "The number of consecutive health check failures required before considering\na target unhealthy.",
                                "format": "int64",
                                "maximum": 10,
                                "minimum": 2,
                                "type": "integer"
                              }
                            },
                            "type": "object",
                            "additionalProperties": false
                          },
                          "port": {
                            "description": "Port sets the port for the additional listener.",
                            "format": "int64",
                            "maximum": 65535,
                            "minimum": 1,
                            "type": "integer"
                          },
                          "protocol": {
                            "default": "TCP",
                            "description": "Protocol sets the protocol for the additional listener.\nCurrently only TCP is supported.",
                            "enum": [
                              "TCP"
                            ],
                            "type": "string"
                          }
                        },
                        "required": [
                          "port"
                        ],
                        "type": "object",
                        "additionalProperties": false
                      },
                      "type": "array",
                      "x-kubernetes-list-map-keys": [
                        "port"
                      ],
                      "x-kubernetes-list-type": "map"
                    },
                    "additionalSecurityGroups": {
                      "description": "AdditionalSecurityGroups sets the security groups used by the load balancer. Expected to be security group IDs\nThis is optional - if not provided new security groups will be created for the load balancer",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    },
                    "crossZoneLoadBalancing": {
                      "description": "CrossZoneLoadBalancing enables the classic ELB cross availability zone balancing.\n\n\nWith cross-zone load balancing, each load balancer node for your Classic Load Balancer\ndistributes requests evenly across the registered instances in all enabled Availability Zones.\nIf cross-zone load balancing is disabled, each load balancer node distributes requests evenly across\nthe registered instances in its Availability Zone only.\n\n\nDefaults to false.",
                      "type": "boolean"
                    },
                    "disableHostsRewrite": {
                      "description": "DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts\nfile of each instance. This is by default, false.",
                      "type": "boolean"
                    },
                    "healthCheck": {
                      "description": "HealthCheck sets custom health check configuration to the API target group.",
                      "properties": {
                        "intervalSeconds": {
                          "description": "The approximate amount of time, in seconds, between health checks of an individual\ntarget.",
                          "format": "int64",
                          "maximum": 300,
                          "minimum": 5,
                          "type": "integer"
                        },
                        "thresholdCount": {
                          "description": "The number of consecutive health check successes required before considering\na target healthy.",
                          "format": "int64",
                          "maximum": 10,
                          "minimum": 2,
                          "type": "integer"
                        },
                        "timeoutSeconds": {
                          "description": "The amount of time, in seconds, during which no response from a target means\na failed health check.",
                          "format": "int64",
                          "maximum": 120,
                          "minimum": 2,
                          "type": "integer"
                        },
                        "unhealthyThresholdCount": {
                          "description": "The number of consecutive health check failures required before considering\na target unhealthy.",
                          "format": "int64",
                          "maximum": 10,
                          "minimum": 2,
                          "type": "integer"
                        }
                      },
                      "type": "object",
                      "additionalProperties": false
                    },
                    "healthCheckProtocol": {
                      "description": "HealthCheckProtocol sets the protocol type for ELB health check target\ndefault value is ELBProtocolSSL",
                      "enum": [
                        "TCP",
                        "SSL",
                        "HTTP",
                        "HTTPS",
                        "TLS",
                        "UDP"
                      ],
                      "type": "string"
                    },
                    "ingressRules": {
                      "description": "IngressRules sets the ingress rules for the control plane load balancer.",
                      "items": {
                        "description": "IngressRule defines an AWS ingress rule for security groups.",
                        "properties": {
                          "cidrBlocks": {
                            "description": "List of CIDR blocks to allow access from. Cannot be specified with SourceSecurityGroupID.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "description": {
                            "description": "Description provides extended information about the ingress rule.",
                            "type": "string"
                          },
                          "fromPort": {
                            "description": "FromPort is the start of port range.",
                            "format": "int64",
                            "type": "integer"
                          },
                          "ipv6CidrBlocks": {
                            "description": "List of IPv6 CIDR blocks to allow access from. Cannot be specified with SourceSecurityGroupID.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "natGatewaysIPsSource": {
                            "description": "NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.",
                            "type": "boolean"
                          },
                          "protocol": {
                            "description": "Protocol is the protocol for the ingress rule. Accepted values are \"-1\" (all), \"4\" (IP in IP),\"tcp\", \"udp\", \"icmp\", and \"58\" (ICMPv6), \"50\" (ESP).",
                            "enum": [
                              "-1",
                              "4",
                              "tcp",
                              "udp",
                              "icmp",
                              "58",
                              "50"
                            ],
                            "type": "string"
                          },
                          "sourceSecurityGroupIds": {
                            "description": "The security group id to allow access from. Cannot be specified with CidrBlocks.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "sourceSecurityGroupRoles": {
                            "description": "The security group role to allow access from. Cannot be specified with CidrBlocks.\nThe field will be combined with source security group IDs if specified.",
                            "items": {
                              "description": "SecurityGroupRole defines the unique role of a security group.",
                              "enum": [
                                "bastion",
                                "node",
                                "controlplane",
                                "apiserver-lb",
                                "lb",
                                "node-eks-additional"
                              ],
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "toPort": {
                            "description": "ToPort is the end of port range.",
                            "format": "int64",
                            "type": "integer"
                          }
                        },
                        "required": [
                          "description",
                          "fromPort",
                          "protocol",
                          "toPort"
                        ],
                        "type": "object",
                        "additionalProperties": false
                      },
                      "type": "array"
                    },
                    "loadBalancerType": {
                      "default": "classic",
                      "description": "LoadBalancerType sets the type for a load balancer. The default type is classic.",
                      "enum": [
                        "classic",
                        "elb",
                        "alb",
                        "nlb",
                        "disabled"
                      ],
                      "type": "string"
                    },
                    "name": {
                      "description": "Name sets the name of the classic ELB load balancer. As per AWS, the name must be unique\nwithin your set of load balancers for the region, must have a maximum of 32 characters, must\ncontain only alphanumeric characters or hyphens, and cannot begin or end with a hyphen. Once\nset, the value cannot be changed.",
                      "maxLength": 32,
                      "pattern": "^[A-Za-z0-9]([A-Za-z0-9]{0,31}|[-A-Za-z0-9]{0,30}[A-Za-z0-9])$",
                      "type": "string"
                    },
                    "preserveClientIP": {
                      "description": "PreserveClientIP lets the user control if preservation of client ips must be retained or not.\nIf this is enabled 6443 will be opened to 0.0.0.0/0.",
                      "type": "boolean"
                    },
                    "scheme": {
                      "default": "internet-facing",
                      "description": "Scheme sets the scheme of the load balancer (defaults to internet-facing)",
                      "enum": [
                        "internet-facing",
                        "internal"
                      ],
                      "type": "string"
                    },
                    "subnets": {
                      "description": "Subnets sets the subnets that should be applied to the control plane load balancer (defaults to discovered subnets for managed VPCs or an empty set for unmanaged VPCs)",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                },
                "identityRef": {
                  "description": "IdentityRef is a reference to an identity to be used when reconciling the managed control plane.\nIf no identity is specified, the default identity for this controller will be used.",
                  "properties": {
                    "kind": {
                      "description": "Kind of the identity.",
                      "enum": [
                        "AWSClusterControllerIdentity",
                        "AWSClusterRoleIdentity",
                        "AWSClusterStaticIdentity"
                      ],
                      "type": "string"
                    },
                    "name": {
                      "description": "Name of the identity.",
                      "minLength": 1,
                      "type": "string"
                    }
                  },
                  "required": [
                    "kind",
                    "name"
                  ],
                  "type": "object",
                  "additionalProperties": false
                },
                "imageLookupBaseOS": {
                  "description": "ImageLookupBaseOS is the name of the base operating system used to look\nup machine images when a machine does not specify an AMI. When set, this\nwill be used for all cluster machines unless a machine specifies a\ndifferent ImageLookupBaseOS.",
                  "type": "string"
                },
                "imageLookupFormat": {
                  "description": "ImageLookupFormat is the AMI naming format to look up machine images when\na machine does not specify an AMI. When set, this will be used for all\ncluster machines unless a machine specifies a different ImageLookupOrg.\nSupports substitutions for {{.BaseOS}} and {{.K8sVersion}} with the base\nOS and kubernetes version, respectively. The BaseOS will be the value in\nImageLookupBaseOS or ubuntu (the default), and the kubernetes version as\ndefined by the packages produced by kubernetes/release without v as a\nprefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default\nimage format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up\nsearching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a\nMachine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See\nalso: https://golang.org/pkg/text/template/",
                  "type": "string"
                },
                "imageLookupOrg": {
                  "description": "ImageLookupOrg is the AWS Organization ID to look up machine images when a\nmachine does not specify an AMI. When set, this will be used for all\ncluster machines unless a machine specifies a different ImageLookupOrg.",
                  "type": "string"
                },
                "network": {
                  "description": "NetworkSpec encapsulates all things related to AWS network.",
                  "properties": {
                    "additionalControlPlaneIngressRules": {
                      "description": "AdditionalControlPlaneIngressRules is an optional set of ingress rules to add to the control plane",
                      "items": {
                        "description": "IngressRule defines an AWS ingress rule for security groups.",
                        "properties": {
                          "cidrBlocks": {
                            "description": "List of CIDR blocks to allow access from. Cannot be specified with SourceSecurityGroupID.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "description": {
                            "description": "Description provides extended information about the ingress rule.",
                            "type": "string"
                          },
                          "fromPort": {
                            "description": "FromPort is the start of port range.",
                            "format": "int64",
                            "type": "integer"
                          },
                          "ipv6CidrBlocks": {
                            "description": "List of IPv6 CIDR blocks to allow access from. Cannot be specified with SourceSecurityGroupID.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "natGatewaysIPsSource": {
                            "description": "NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.",
                            "type": "boolean"
                          },
                          "protocol": {
                            "description": "Protocol is the protocol for the ingress rule. Accepted values are \"-1\" (all), \"4\" (IP in IP),\"tcp\", \"udp\", \"icmp\", and \"58\" (ICMPv6), \"50\" (ESP).",
                            "enum": [
                              "-1",
                              "4",
                              "tcp",
                              "udp",
                              "icmp",
                              "58",
                              "50"
                            ],
                            "type": "string"
                          },
                          "sourceSecurityGroupIds": {
                            "description": "The security group id to allow access from. Cannot be specified with CidrBlocks.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "sourceSecurityGroupRoles": {
                            "description": "The security group role to allow access from. Cannot be specified with CidrBlocks.\nThe field will be combined with source security group IDs if specified.",
                            "items": {
                              "description": "SecurityGroupRole defines the unique role of a security group.",
                              "enum": [
                                "bastion",
                                "node",
                                "controlplane",
                                "apiserver-lb",
                                "lb",
                                "node-eks-additional"
                              ],
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "toPort": {
                            "description": "ToPort is the end of port range.",
                            "format": "int64",
                            "type": "integer"
                          }
                        },
                        "required": [
                          "description",
                          "fromPort",
                          "protocol",
                          "toPort"
                        ],
                        "type": "object",
                        "additionalProperties": false
                      },
                      "type": "array"
                    },
                    "cni": {
                      "description": "CNI configuration",
                      "properties": {
                        "cniIngressRules": {
                          "description": "CNIIngressRules specify rules to apply to control plane and worker node security groups.\nThe source for the rule will be set to control plane and worker security group IDs.",
                          "items": {
                            "description": "CNIIngressRule defines an AWS ingress rule for CNI requirements.",
                            "properties": {
                              "description": {
                                "type": "string"
                              },
                              "fromPort": {
                                "format": "int64",
                                "type": "integer"
                              },
                              "protocol": {
                                "description": "SecurityGroupProtocol defines the protocol type for a security group rule.",
                                "type": "string"
                              },
                              "toPort": {
                                "format": "int64",
                                "type": "integer"
                              }
                            },
                            "required": [
                              "description",
                              "fromPort",
                              "protocol",
                              "toPort"
                            ],
                            "type": "object",
                            "additionalProperties": false
                          },
                          "type": "array"
                        }
                      },
                      "type": "object",
                      "additionalProperties": false
                    },
                    "securityGroupOverrides": {
                      "additionalProperties": {
                        "type": "string"
                      },
                      "description": "SecurityGroupOverrides is an optional set of security groups to use for cluster instances\nThis is optional - if not provided new security groups will be created for the cluster",
                      "type": "object"
                    },
                    "subnets": {
                      "description": "Subnets configuration.",
                      "items": {
                        "description": "SubnetSpec configures an AWS Subnet.",
                        "properties": {
                          "availabilityZone": {
                            "description": "AvailabilityZone defines the availability zone to use for this subnet in the cluster's region.",
                            "type": "string"
                          },
                          "cidrBlock": {
                            "description": "CidrBlock is the CIDR block to be used when the provider creates a managed VPC.",
                            "type": "string"
                          },
                          "id": {
                            "description": "ID defines a unique identifier to reference this resource.\nIf you're bringing your subnet, set the AWS subnet-id here, it must start with `subnet-`.\n\n\nWhen the VPC is managed by CAPA, and you'd like the provider to create a subnet for you,\nthe id can be set to any placeholder value that does not start with `subnet-`;\nupon creation, the subnet AWS identifier will be populated in the `ResourceID` field and\nthe `id` field is going to be used as the subnet name. If you specify a tag\ncalled `Name`, it takes precedence.",
                            "type": "string"
                          },
                          "ipv6CidrBlock": {
                            "description": "IPv6CidrBlock is the IPv6 CIDR block to be used when the provider creates a managed VPC.\nA subnet can have an IPv4 and an IPv6 address.\nIPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.",
                            "type": "string"
                          },
                          "isIpv6": {
                            "description": "IsIPv6 defines the subnet as an IPv6 subnet. A subnet is IPv6 when it is associated with a VPC that has IPv6 enabled.\nIPv6 is only supported in managed clusters, this field cannot be set on AWSCluster object.",
                            "type": "boolean"
                          },
                          "isPublic": {
                            "description": "IsPublic defines the subnet as a public subnet. A subnet is public when it is associated with a route table that has a route to an internet gateway.",
                            "type": "boolean"
                          },
                          "natGatewayId": {
                            "description": "NatGatewayID is the NAT gateway id associated with the subnet.\nIgnored unless the subnet is managed by the provider, in which case this is set on the public subnet where the NAT gateway resides. It is then used to determine routes for private subnets in the same AZ as the public subnet.",
                            "type": "string"
                          },
                          "parentZoneName": {
                            "description": "ParentZoneName is the zone name where the current subnet's zone is tied when\nthe zone is a Local Zone.\n\n\nThe subnets in Local Zone or Wavelength Zone locations consume the ParentZoneName\nto select the correct private route table to egress traffic to the internet.",
                            "type": "string"
                          },
                          "resourceID": {
                            "description": "ResourceID is the subnet identifier from AWS, READ ONLY.\nThis field is populated when the provider manages the subnet.",
                            "type": "string"
                          },
                          "routeTableId": {
                            "description": "RouteTableID is the routing table id associated with the subnet.",
                            "type": "string"
                          },
                          "tags": {
                            "additionalProperties": {
                              "type": "string"
                            },
                            "description": "Tags is a collection of tags describing the resource.",
                            "type": "object"
                          },
                          "zoneType": {
                            "description": "ZoneType defines the type of the zone where the subnet is created.\n\n\nThe valid values are availability-zone, local-zone, and wavelength-zone.\n\n\nSubnet with zone type availability-zone (regular) is always selected to create cluster\nresources, like Load Balancers, NAT Gateways, Contol Plane nodes, etc.\n\n\nSubnet with zone type local-zone or wavelength-zone is not eligible to automatically create\nregular cluster resources.\n\n\nThe public subnet in availability-zone or local-zone is associated with regular public\nroute table with default route entry to a Internet Gateway.\n\n\nThe public subnet in wavelength-zone is associated with a carrier public\nroute table with default route entry to a Carrier Gateway.\n\n\nThe private subnet in the availability-zone is associated with a private route table with\nthe default route entry to a NAT Gateway created in that zone.\n\n\nThe private subnet in the local-zone or wavelength-zone is associated with a private route table with\nthe default route entry re-using the NAT Gateway in the Region (preferred from the\nparent zone, the zone type availability-zone in the region, or first table available).",
                            "enum": [
                              "availability-zone",
                              "local-zone",
                              "wavelength-zone"
                            ],
                            "type": "string"
                          }
                        },
                        "required": [
                          "id"
                        ],
                        "type": "object",
                        "additionalProperties": false
                      },
                      "type": "array",
                      "x-kubernetes-list-map-keys": [
                        "id"
                      ],
                      "x-kubernetes-list-type": "map"
                    },
                    "vpc": {
                      "description": "VPC configuration.",
                      "properties": {
                        "availabilityZoneSelection": {
                          "default": "Ordered",
                          "description": "AvailabilityZoneSelection specifies how AZs should be selected if there are more AZs\nin a region than specified by AvailabilityZoneUsageLimit. There are 2 selection schemes:\nOrdered - selects based on alphabetical order\nRandom - selects AZs randomly in a region\nDefaults to Ordered",
                          "enum": [
                            "Ordered",
                            "Random"
                          ],
                          "type": "string"
                        },
                        "availabilityZoneUsageLimit": {
                          "default": 3,
                          "description": "AvailabilityZoneUsageLimit specifies the maximum number of availability zones (AZ) that\nshould be used in a region when automatically creating subnets. If a region has more\nthan this number of AZs then this number of AZs will be picked randomly when creating\ndefault subnets. Defaults to 3",
                          "minimum": 1,
                          "type": "integer"
                        },
                        "carrierGatewayId": {
                          "description": "CarrierGatewayID is the id of the internet gateway associated with the VPC,\nfor carrier network (Wavelength Zones).",
                          "type": "string",
                          "x-kubernetes-validations": [
                            {
                              "message": "Carrier Gateway ID must start with 'cagw-'",
                              "rule": "self.startsWith('cagw-')"
                            }
                          ]
                        },
                        "cidrBlock": {
                          "description": "CidrBlock is the CIDR block to be used when the provider creates a managed VPC.\nDefaults to 10.0.0.0/16.\nMutually exclusive with IPAMPool.",
                          "type": "string"
                        },
                        "elasticIpPool": {
                          "description": "ElasticIPPool contains specific configuration to allocate Public IPv4 address (Elastic IP) from user-defined pool\nbrought to AWS for core infrastructure resources, like NAT Gateways and Public Network Load Balancers for\nthe API Server.",
                          "properties": {
                            "publicIpv4Pool": {
                              "description": "PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources\ncreated in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom\nPublic IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool\nresource ID starts with 'ipv4pool-ec2'.",
                              "maxLength": 30,
                              "type": "string"
                            },
                            "publicIpv4PoolFallbackOrder": {
                              "description": "PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,\nno more IPv4 address available in the pool.\n\n\nWhen set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the\nIPv4 limit, the address will be claimed from Amazon-pool (default).\n\n\nWhen set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.",
                              "enum": [
                                "amazon-pool",
                                "none"
                              ],
                              "type": "string",
                              "x-kubernetes-validations": [
                                {
                                  "message": "allowed values are 'none' and 'amazon-pool'",
                                  "rule": "self in ['none','amazon-pool']"
                                }
                              ]
                            }
                          },
                          "type": "object",
                          "additionalProperties": false
                        },
                        "emptyRoutesDefaultVPCSecurityGroup": {
                          "description": "EmptyRoutesDefaultVPCSecurityGroup specifies whether the default VPC security group ingress\nand egress rules should be removed.\n\n\nBy default, when creating a VPC, AWS creates a security group called `default` with ingress and egress\nrules that allow traffic from anywhere. The group could be used as a potential surface attack and\nit's generally suggested that the group rules are removed or modified appropriately.\n\n\nNOTE: This only applies when the VPC is managed by the Cluster API AWS controller.",
                          "type": "boolean"
                        },
                        "id": {
                          "description": "ID is the vpc-id of the VPC this provider should use to create resources.",
                          "type": "string"
                        },
                        "internetGatewayId": {
                          "description": "InternetGatewayID is the id of the internet gateway associated with the VPC.",
                          "type": "string"
                        },
                        "ipamPool": {
                          "description": "IPAMPool defines the IPAMv4 pool to be used for VPC.\nMutually exclusive with CidrBlock.",
                          "properties": {
                            "id": {
                              "description": "ID is the ID of the IPAM pool this provider should use to create VPC.",
                              "type": "string"
                            },
                            "name": {
                              "description": "Name is the name of the IPAM pool this provider should use to create VPC.",
                              "type": "string"
                            },
                            "netmaskLength": {
                              "description": "The netmask length of the IPv4 CIDR you want to allocate to VPC from\nan Amazon VPC IP Address Manager (IPAM) pool.\nDefaults to /16 for IPv4 if not specified.",
                              "format": "int64",
                              "type": "integer"
                            }
                          },
                          "type": "object",
                          "additionalProperties": false
                        },
                        "ipv6": {
                          "description": "IPv6 contains ipv6 specific settings for the network. Supported only in managed clusters.\nThis field cannot be set on AWSCluster object.",
                          "properties": {
                            "cidrBlock": {
                              "description": "CidrBlock is the CIDR block provided by Amazon when VPC has enabled IPv6.\nMutually exclusive with IPAMPool.",
                              "type": "string"
                            },
                            "egressOnlyInternetGatewayId": {
                              "description": "EgressOnlyInternetGatewayID is the id of the egress only internet gateway associated with an IPv6 enabled VPC.",
                              "type": "string"
                            },
                            "ipamPool": {
                              "description": "IPAMPool defines the IPAMv6 pool to be used for VPC.\nMutually exclusive with CidrBlock.",
                              "properties": {
                                "id": {
                                  "description": "ID is the ID of the IPAM pool this provider should use to create VPC.",
                                  "type": "string"
                                },
                                "name": {
                                  "description": "Name is the name of the IPAM pool this provider should use to create VPC.",
                                  "type": "string"
                                },
                                "netmaskLength": {
                                  "description": "The netmask length of the IPv4 CIDR you want to allocate to VPC from\nan Amazon VPC IP Address Manager (IPAM) pool.\nDefaults to /16 for IPv4 if not specified.",
                                  "format": "int64",
                                  "type": "integer"
                                }
                              },
                              "type": "object",
                              "additionalProperties": false
                            },
                            "poolId": {
                              "description": "PoolID is the IP pool which must be defined in case of BYO IP is defined.\nMust be specified if CidrBlock is set.\nMutually exclusive with IPAMPool.",
                              "type": "string"
                            }
                          },
                          "type": "object",
                          "additionalProperties": false
                        },
                        "privateDnsHostnameTypeOnLaunch": {
                          "description": "PrivateDNSHostnameTypeOnLaunch is the type of hostname to assign to instances in the subnet at launch.\nFor IPv4-only and dual-stack (IPv4 and IPv6) subnets, an instance DNS name can be based on the instance IPv4 address (ip-name)\nor the instance ID (resource-name). For IPv6 only subnets, an instance DNS name must be based on the instance ID (resource-name).",
                          "enum": [
                            "ip-name",
                            "resource-name"
                          ],
                          "type": "string"
                        },
                        "subnetSchema": {
                          "default": "PreferPrivate",
                          "description": "SubnetSchema specifies how CidrBlock should be divided on subnets in the VPC depending on the number of AZs.\nPreferPrivate - one private subnet for each AZ plus one other subnet that will be further sub-divided for the public subnets.\nPreferPublic - have the reverse logic of PreferPrivate, one public subnet for each AZ plus one other subnet\nthat will be further sub-divided for the private subnets.\nDefaults to PreferPrivate",
                          "enum": [
                            "PreferPrivate",
                            "PreferPublic"
                          ],
                          "type": "string"
                        },
                        "tags": {
                          "additionalProperties": {
                            "type": "string"
                          },
                          "description": "Tags is a collection of tags describing the resource.",
                          "type": "object"
                        }
                      },
                      "type": "object",
                      "additionalProperties": false
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                },
                "partition": {
                  "description": "Partition is the AWS security partition being used. Defaults to \"aws\"",
                  "type": "string"
                },
                "region": {
                  "description": "The AWS Region the cluster lives in.",
                  "type": "string"
                },
                "s3Bucket": {
                  "description": "S3Bucket contains options to configure a supporting S3 bucket for this\ncluster - currently used for nodes requiring Ignition\n(https://coreos.github.io/ignition/) for bootstrapping (requires\nBootstrapFormatIgnition feature flag to be enabled).",
                  "properties": {
                    "bestEffortDeleteObjects": {
                      "description": "BestEffortDeleteObjects defines whether access/permission errors during object deletion should be ignored.",
                      "type": "boolean"
                    },
                    "controlPlaneIAMInstanceProfile": {
                      "description": "ControlPlaneIAMInstanceProfile is a name of the IAMInstanceProfile, which will be allowed\nto read control-plane node bootstrap data from S3 Bucket.",
                      "type": "string"
                    },
                    "name": {
                      "description": "Name defines name of S3 Bucket to be created.",
                      "maxLength": 63,
                      "minLength": 3,
                      "pattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$",
                      "type": "string"
                    },
                    "nodesIAMInstanceProfiles": {
                      "description": "NodesIAMInstanceProfiles is a list of IAM instance profiles, which will be allowed to read\nworker nodes bootstrap data from S3 Bucket.",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    },
                    "presignedURLDuration": {
                      "description": "PresignedURLDuration defines the duration for which presigned URLs are valid.\n\n\nThis is used to generate presigned URLs for S3 Bucket objects, which are used by\ncontrol-plane and worker nodes to fetch bootstrap data.\n\n\nWhen enabled, the IAM instance profiles specified are not used.",
                      "type": "string"
                    }
                  },
                  "required": [
                    "name"
                  ],
                  "type": "object",
                  "additionalProperties": false
                },
                "secondaryControlPlaneLoadBalancer": {
                  "description": "SecondaryControlPlaneLoadBalancer is an additional load balancer that can be used for the control plane.\n\n\nAn example use case is to have a separate internal load balancer for internal traffic,\nand a separate external load balancer for external traffic.",
                  "properties": {
                    "additionalListeners": {
                      "description": "AdditionalListeners sets the additional listeners for the control plane load balancer.\nThis is only applicable to Network Load Balancer (NLB) types for the time being.",
                      "items": {
                        "description": "AdditionalListenerSpec defines the desired state of an\nadditional listener on an AWS load balancer.",
                        "properties": {
                          "healthCheck": {
                            "description": "HealthCheck sets the optional custom health check configuration to the API target group.",
                            "properties": {
                              "intervalSeconds": {
                                "description": "The approximate amount of time, in seconds, between health checks of an individual\ntarget.",
                                "format": "int64",
                                "maximum": 300,
                                "minimum": 5,
                                "type": "integer"
                              },
                              "path": {
                                "description": "The destination for health checks on the targets when using the protocol HTTP or HTTPS,\notherwise the path will be ignored.",
                                "type": "string"
                              },
                              "port": {
                                "description": "The port the load balancer uses when performing health checks for additional target groups. When\nnot specified this value will be set for the same of listener port.",
                                "type": "string"
                              },
                              "protocol": {
                                "description": "The protocol to use to health check connect with the target. When not specified the Protocol\nwill be the same of the listener.",
                                "enum": [
                                  "TCP",
                                  "HTTP",
                                  "HTTPS"
                                ],
                                "type": "string"
                              },
                              "thresholdCount": {
                                "description": "The number of consecutive health check successes required before considering\na target healthy.",
                                "format": "int64",
                                "maximum": 10,
                                "minimum": 2,
                                "type": "integer"
                              },
                              "timeoutSeconds": {
                                "description": "The amount of time, in seconds, during which no response from a target means\na failed health check.",
                                "format": "int64",
                                "maximum": 120,
                                "minimum": 2,
                                "type": "integer"
                              },
                              "unhealthyThresholdCount": {
                                "description": "The number of consecutive health check failures required before considering\na target unhealthy.",
                                "format": "int64",
                                "maximum": 10,
                                "minimum": 2,
                                "type": "integer"
                              }
                            },
                            "type": "object",
                            "additionalProperties": false
                          },
                          "port": {
                            "description": "Port sets the port for the additional listener.",
                            "format": "int64",
                            "maximum": 65535,
                            "minimum": 1,
                            "type": "integer"
                          },
                          "protocol": {
                            "default": "TCP",
                            "description": "Protocol sets the protocol for the additional listener.\nCurrently only TCP is supported.",
                            "enum": [
                              "TCP"
                            ],
                            "type": "string"
                          }
                        },
                        "required": [
                          "port"
                        ],
                        "type": "object",
                        "additionalProperties": false
                      },
                      "type": "array",
                      "x-kubernetes-list-map-keys": [
                        "port"
                      ],
                      "x-kubernetes-list-type": "map"
                    },
                    "additionalSecurityGroups": {
                      "description": "AdditionalSecurityGroups sets the security groups used by the load balancer. Expected to be security group IDs\nThis is optional - if not provided new security groups will be created for the load balancer",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    },
                    "crossZoneLoadBalancing": {
                      "description": "CrossZoneLoadBalancing enables the classic ELB cross availability zone balancing.\n\n\nWith cross-zone load balancing, each load balancer node for your Classic Load Balancer\ndistributes requests evenly across the registered instances in all enabled Availability Zones.\nIf cross-zone load balancing is disabled, each load balancer node distributes requests evenly across\nthe registered instances in its Availability Zone only.\n\n\nDefaults to false.",
                      "type": "boolean"
                    },
                    "disableHostsRewrite": {
                      "description": "DisableHostsRewrite disabled the hair pinning issue solution that adds the NLB's address as 127.0.0.1 to the hosts\nfile of each instance. This is by default, false.",
                      "type": "boolean"
                    },
                    "healthCheck": {
                      "description": "HealthCheck sets custom health check configuration to the API target group.",
                      "properties": {
                        "intervalSeconds": {
                          "description": "The approximate amount of time, in seconds, between health checks of an individual\ntarget.",
                          "format": "int64",
                          "maximum": 300,
                          "minimum": 5,
                          "type": "integer"
                        },
                        "thresholdCount": {
                          "description": "The number of consecutive health check successes required before considering\na target healthy.",
                          "format": "int64",
                          "maximum": 10,
                          "minimum": 2,
                          "type": "integer"
                        },
                        "timeoutSeconds": {
                          "description": "The amount of time, in seconds, during which no response from a target means\na failed health check.",
                          "format": "int64",
                          "maximum": 120,
                          "minimum": 2,
                          "type": "integer"
                        },
                        "unhealthyThresholdCount": {
                          "description": "The number of consecutive health check failures required before considering\na target unhealthy.",
                          "format": "int64",
                          "maximum": 10,
                          "minimum": 2,
                          "type": "integer"
                        }
                      },
                      "type": "object",
                      "additionalProperties": false
                    },
                    "healthCheckProtocol": {
                      "description": "HealthCheckProtocol sets the protocol type for ELB health check target\ndefault value is ELBProtocolSSL",
                      "enum": [
                        "TCP",
                        "SSL",
                        "HTTP",
                        "HTTPS",
                        "TLS",
                        "UDP"
                      ],
                      "type": "string"
                    },
                    "ingressRules": {
                      "description": "IngressRules sets the ingress rules for the control plane load balancer.",
                      "items": {
                        "description": "IngressRule defines an AWS ingress rule for security groups.",
                        "properties": {
                          "cidrBlocks": {
                            "description": "List of CIDR blocks to allow access from. Cannot be specified with SourceSecurityGroupID.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "description": {
                            "description": "Description provides extended information about the ingress rule.",
                            "type": "string"
                          },
                          "fromPort": {
                            "description": "FromPort is the start of port range.",
                            "format": "int64",
                            "type": "integer"
                          },
                          "ipv6CidrBlocks": {
                            "description": "List of IPv6 CIDR blocks to allow access from. Cannot be specified with SourceSecurityGroupID.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "natGatewaysIPsSource": {
                            "description": "NatGatewaysIPsSource use the NAT gateways IPs as the source for the ingress rule.",
                            "type": "boolean"
                          },
                          "protocol": {
                            "description": "Protocol is the protocol for the ingress rule. Accepted values are \"-1\" (all), \"4\" (IP in IP),\"tcp\", \"udp\", \"icmp\", and \"58\" (ICMPv6), \"50\" (ESP).",
                            "enum": [
                              "-1",
                              "4",
                              "tcp",
                              "udp",
                              "icmp",
                              "58",
                              "50"
                            ],
                            "type": "string"
                          },
                          "sourceSecurityGroupIds": {
                            "description": "The security group id to allow access from. Cannot be specified with CidrBlocks.",
                            "items": {
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "sourceSecurityGroupRoles": {
                            "description": "The security group role to allow access from. Cannot be specified with CidrBlocks.\nThe field will be combined with source security group IDs if specified.",
                            "items": {
                              "description": "SecurityGroupRole defines the unique role of a security group.",
                              "enum": [
                                "bastion",
                                "node",
                                "controlplane",
                                "apiserver-lb",
                                "lb",
                                "node-eks-additional"
                              ],
                              "type": "string"
                            },
                            "type": "array"
                          },
                          "toPort": {
                            "description": "ToPort is the end of port range.",
                            "format": "int64",
                            "type": "integer"
                          }
                        },
                        "required": [
                          "description",
                          "fromPort",
                          "protocol",
                          "toPort"
                        ],
                        "type": "object",
                        "additionalProperties": false
                      },
                      "type": "array"
                    },
                    "loadBalancerType": {
                      "default": "classic",
                      "description": "LoadBalancerType sets the type for a load balancer. The default type is classic.",
                      "enum": [
                        "classic",
                        "elb",
                        "alb",
                        "nlb",
                        "disabled"
                      ],
                      "type": "string"
                    },
                    "name": {
                      "description": "Name sets the name of the classic ELB load balancer. As per AWS, the name must be unique\nwithin your set of load balancers for the region, must have a maximum of 32 characters, must\ncontain only alphanumeric characters or hyphens, and cannot begin or end with a hyphen. Once\nset, the value cannot be changed.",
                      "maxLength": 32,
                      "pattern": "^[A-Za-z0-9]([A-Za-z0-9]{0,31}|[-A-Za-z0-9]{0,30}[A-Za-z0-9])$",
                      "type": "string"
                    },
                    "preserveClientIP": {
                      "description": "PreserveClientIP lets the user control if preservation of client ips must be retained or not.\nIf this is enabled 6443 will be opened to 0.0.0.0/0.",
                      "type": "boolean"
                    },
                    "scheme": {
                      "default": "internet-facing",
                      "description": "Scheme sets the scheme of the load balancer (defaults to internet-facing)",
                      "enum": [
                        "internet-facing",
                        "internal"
                      ],
                      "type": "string"
                    },
                    "subnets": {
                      "description": "Subnets sets the subnets that should be applied to the control plane load balancer (defaults to discovered subnets for managed VPCs or an empty set for unmanaged VPCs)",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                },
                "sshKeyName": {
                  "description": "SSHKeyName is the name of the ssh key to attach to the bastion host. Valid values are empty string (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)",
                  "type": "string"
                }
              },
              "type": "object",
              "additionalProperties": false
            }
          },
          "required": [
            "spec"
          ],
          "type": "object",
          "additionalProperties": false
        }
      },
      "required": [
        "template"
      ],
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}