v1

type BlockDevice struct {
	// deleteOnTermination indicates whether the EBS volume is deleted on instance termination.
	// +optional
	DeleteOnTermination DeleteOnTerminationPolicy `json:"deleteOnTermination,omitempty"`

	// encrypted indicates whether the EBS volume is encrypted. Encrypted volumes can only
	// be attached to instances that support Amazon EBS encryption. If you are creating
	// a volume from a snapshot, you can't specify an encryption value.
	// +optional
	Encrypted EncryptionState `json:"encrypted,omitempty"`

	// iops is the number of I/O operations per second (IOPS). For gp3, io1, and io2 volumes,
	// this represents the number of IOPS that are provisioned for the volume. For
	// gp2 volumes, this represents the baseline performance of the volume and the
	// rate at which the volume accumulates I/O credits for bursting.
	//
	// The following are the supported values for each volume type:
	//
	//    * gp3: 3,000-16,000 IOPS
	//
	//    * io1: 100-64,000 IOPS
	//
	//    * io2: 100-64,000 IOPS
	//
	// For io1 and io2 volumes, we guarantee 64,000 IOPS only for Instances built
	// on the Nitro System (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances).
	// Other instance families guarantee performance up to 32,000 IOPS.
	//
	// This parameter is supported for io1, io2, and gp3 volumes only. This parameter
	// is not supported for gp2, st1, sc1, or standard volumes.
	// +optional
	IOPS *int64 `json:"iops,omitempty"`

	// kmsKeyID is the ARN of the symmetric Key Management Service (KMS) CMK used for encryption.
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=2048
	KMSKeyID string `json:"kmsKeyID,omitempty"`

	// snapshotID is the ID of an EBS snapshot.
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	SnapshotID string `json:"snapshotID,omitempty"`

	// throughput to provision for a gp3 volume, with a maximum of 1,000 MiB/s.
	// Valid Range: Minimum value of 125. Maximum value of 1000.
	// +optional
	Throughput *int64 `json:"throughput,omitempty"`

	// volumeSizeGiB is the size of the volume in GiB. You must specify either a snapshot ID or
	// a volume size. The following are the supported volume sizes for each volume type:
	//
	//    * gp2 and gp3: 1-16,384
	//
	//    * io1 and io2: 4-16,384
	//
	//    * st1 and sc1: 125-16,384
	//
	//    * standard: 1-1,024
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65536
	// +optional
	VolumeSizeGiB int64 `json:"volumeSizeGiB,omitempty"`

	// volumeType is the type of the block device.
	// For more information, see Amazon EBS volume types (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html)
	// in the Amazon Elastic Compute Cloud User Guide.
	// +optional
	VolumeType VolumeType `json:"volumeType,omitempty"`
}

type BlockDeviceMapping struct {
	// deviceName is the device name (for example, /dev/sdh or xvdh).
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	DeviceName string `json:"deviceName,omitempty"`

	// ebs contains parameters used to automatically set up EBS volumes when an instance is launched.
	// +kubebuilder:validation:XValidation:message="snapshotID or volumeSizeGiB must be defined",rule="has(self.snapshotID) || has(self.volumeSizeGiB)"
	// +optional
	EBS BlockDevice `json:"ebs,omitempty,omitzero"`

	// rootVolume indicates whether this device is mounted as kubelet root dir. You can
	// configure at most one root volume in BlockDeviceMappings.
	// +optional
	RootVolume RootVolumeDesignation `json:"rootVolume,omitempty"`
}

type CapacityReservation struct {
	// availabilityZone is the availability zone the capacity reservation is available in.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=64
	AvailabilityZone string `json:"availabilityZone,omitempty"`
	// endTime is the time at which the capacity reservation expires. Once expired, the reserved capacity is released and Karpenter
	// will no longer be able to launch instances into that reservation.
	// +optional
	EndTime metav1.Time `json:"endTime,omitempty,omitzero"`
	// id is the id for the capacity reservation.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	ID string `json:"id,omitempty"`
	// instanceMatchCriteria indicates the type of instance launches the capacity reservation accepts.
	// +required
	InstanceMatchCriteria InstanceMatchCriteria `json:"instanceMatchCriteria,omitempty"`
	// instanceType is the instance type for the capacity reservation.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	InstanceType string `json:"instanceType,omitempty"`
	// ownerID is the ID of the AWS account that owns the capacity reservation.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=12
	OwnerID string `json:"ownerID,omitempty"`
	// reservationType is the type of capacity reservation.
	// +optional
	ReservationType CapacityReservationType `json:"reservationType,omitempty"`
	// state is the state of the capacity reservation.
	// +optional
	State CapacityReservationState `json:"state,omitempty"`
}

type CapacityReservationSelectorTerm struct {
	// tags is a map of key/value tags used to select capacity reservations.
	// Specifying '*' for a value selects all values for a given tag key.
	// +kubebuilder:validation:XValidation:message="empty tag keys or values aren't supported",rule="self.all(k, k != ” && self[k] != ”)"
	// +kubebuilder:validation:MaxProperties:=20
	// +kubebuilder:validation:MinProperties=1
	// +optional
	Tags map[string]string `json:"tags,omitempty"`

	// id is the capacity reservation id in EC2.
	// +kubebuilder:validation:XValidation:rule="self.matches('^cr-[0-9a-z]+$')",message="id must match the pattern cr-[0-9a-z]+"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	// +optional
	ID string `json:"id,omitempty"`

	// ownerID is the owner account id for the capacity reservation.
	// +kubebuilder:validation:XValidation:rule="self.matches('^[0-9]{12}$')",message="ownerID must be a 12-digit AWS account ID"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=12
	// +optional
	OwnerID string `json:"ownerID,omitempty"`

	// instanceMatchCriteria filters capacity reservations by how they match instances.
	// When set to "Open", only selects reservations that any instance with matching
	// attributes (instance type, platform, Availability Zone) can use automatically.
	// When set to "Targeted", only selects reservations that require instances to
	// explicitly target them by ID.
	// When omitted, selects both Open and Targeted reservations (no filtering on this attribute).
	// +optional
	InstanceMatchCriteria InstanceMatchCriteria `json:"instanceMatchCriteria,omitempty"`
}

type CapacityReservationState string

type CapacityReservationType string

type DeleteOnTerminationPolicy string

type EncryptionState string

type EvictionThreshold string

type IPAddressAssociation string

type InstanceMatchCriteria string

type InstanceStorePolicy string

type KubeletConfiguration struct {
	// maxPods is the maximum number of pods that can run on a node.
	// The value must be between 1 and 2500, inclusive.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=2500
	// +optional
	MaxPods int32 `json:"maxPods,omitempty"`
	// podsPerCore is the maximum number of pods per core. The value must be between 1 and 2500,
	// inclusive, and cannot exceed maxPods when both are set.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=2500
	// +optional
	PodsPerCore int32 `json:"podsPerCore,omitempty"`
	// systemReserved is a set of ResourceName=ResourceQuantity pairs that describe
	// resources reserved for non-kubernetes components.
	// Currently only cpu, memory, ephemeral-storage, and pid are supported.
	// +kubebuilder:validation:XValidation:message="valid keys for systemReserved are ['cpu','memory','ephemeral-storage','pid']",rule="self.all(x, x=='cpu' || x=='memory' || x=='ephemeral-storage' || x=='pid')"
	// +kubebuilder:validation:XValidation:message="systemReserved value cannot be a negative resource quantity",rule="self.all(x, !self[x].startsWith('-'))"
	// +kubebuilder:validation:XValidation:message="systemReserved values must not be empty",rule="self.all(x, self[x].size() > 0)"
	// +kubebuilder:validation:MinProperties=1
	// +kubebuilder:validation:MaxProperties=20
	// +optional
	SystemReserved map[string]string `json:"systemReserved,omitempty"`
	// kubeReserved is a set of ResourceName=ResourceQuantity pairs that describe
	// resources reserved for kubernetes system components.
	// Currently only cpu, memory, ephemeral-storage, and pid are supported.
	// +kubebuilder:validation:XValidation:message="valid keys for kubeReserved are ['cpu','memory','ephemeral-storage','pid']",rule="self.all(x, x=='cpu' || x=='memory' || x=='ephemeral-storage' || x=='pid')"
	// +kubebuilder:validation:XValidation:message="kubeReserved value cannot be a negative resource quantity",rule="self.all(x, !self[x].startsWith('-'))"
	// +kubebuilder:validation:XValidation:message="kubeReserved values must not be empty",rule="self.all(x, self[x].size() > 0)"
	// +kubebuilder:validation:MinProperties=1
	// +kubebuilder:validation:MaxProperties=20
	// +optional
	KubeReserved map[string]string `json:"kubeReserved,omitempty"`
	// evictionHard is a map of signal names to quantities that defines hard eviction thresholds.
	// +kubebuilder:validation:XValidation:message="valid keys for evictionHard are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']",rule="self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'])"
	// +kubebuilder:validation:XValidation:message="evictionHard values must not be empty",rule="self.all(x, self[x].size() > 0)"
	// +kubebuilder:validation:MinProperties=1
	// +kubebuilder:validation:MaxProperties=20
	// +optional
	EvictionHard map[string]EvictionThreshold `json:"evictionHard,omitempty"`
	// evictionSoft is a map of signal names to quantities that defines soft eviction thresholds.
	// +kubebuilder:validation:XValidation:message="valid keys for evictionSoft are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']",rule="self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'])"
	// +kubebuilder:validation:XValidation:message="evictionSoft values must not be empty",rule="self.all(x, self[x].size() > 0)"
	// +kubebuilder:validation:MinProperties=1
	// +kubebuilder:validation:MaxProperties=20
	// +optional
	EvictionSoft map[string]EvictionThreshold `json:"evictionSoft,omitempty"`
	// evictionSoftGracePeriod is a map of signal names to quantities that defines grace periods
	// for each soft eviction signal.
	// +kubebuilder:validation:XValidation:message="valid keys for evictionSoftGracePeriod are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']",rule="self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'])"
	// +kubebuilder:validation:MinProperties=1
	// +kubebuilder:validation:MaxProperties=20
	// +optional
	EvictionSoftGracePeriod map[string]string `json:"evictionSoftGracePeriod,omitempty"`
	// evictionMaxPodGracePeriod is the maximum allowed grace period (in seconds) to use
	// when terminating pods in response to soft eviction thresholds.
	// +optional
	EvictionMaxPodGracePeriod *int32 `json:"evictionMaxPodGracePeriod,omitempty"`
	// imageGCHighThresholdPercent is the percent of disk usage which triggers image garbage collection.
	// The value must be between 0 and 100, inclusive, and must be greater than imageGCLowThresholdPercent when both are set.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=100
	// +optional
	ImageGCHighThresholdPercent *int32 `json:"imageGCHighThresholdPercent,omitempty"`
	// imageGCLowThresholdPercent is the percent of disk usage to which image garbage collection attempts to free.
	// The value must be between 0 and 100, inclusive, and must be less than imageGCHighThresholdPercent when both are set.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=100
	// +optional
	ImageGCLowThresholdPercent *int32 `json:"imageGCLowThresholdPercent,omitempty"`
	// cpuCFSQuota enables CPU CFS quota enforcement for containers that specify CPU limits.
	// +optional
	CPUCFSQuota *bool `json:"cpuCFSQuota,omitempty"`

	// Overflow holds additional kubelet configuration fields not explicitly defined above.
	// These fields are preserved during serialization and deserialization, allowing arbitrary
	// kubelet configuration to pass through to the node's ignition/MachineConfig.
	Overflow runtime.RawExtension `json:"-"`
}

type MetadataAccess string

type MetadataHTTPProtocol string

type MetadataHTTPTokensState string

type MetadataOptions struct {
	// access specifies how the instance metadata endpoint is accessed on
	// provisioned nodes. Valid values are "HTTPEndpoint" and "None".
	// When set to "HTTPEndpoint", the instance metadata service is accessible
	// via the HTTP endpoint. When set to "None", instance metadata is not
	// accessible on the node.
	// When omitted, the platform defaults to HTTP endpoint access.
	// +optional
	Access MetadataAccess `json:"access,omitempty"`
	// httpIPProtocol specifies the IP protocol version for the instance metadata
	// service endpoint on provisioned nodes. Valid values are "IPv4" and "IPv6".
	// When set to "IPv4", the metadata endpoint uses the IPv4 protocol.
	// When set to "IPv6", the metadata endpoint uses the IPv6 protocol.
	// When omitted, the platform defaults to IPv4.
	// +optional
	HTTPIPProtocol MetadataHTTPProtocol `json:"httpIPProtocol,omitempty"`
	// httpPutResponseHopLimit is the desired HTTP PUT response hop limit for
	// instance metadata requests. Possible values are integers from 1 to 64.
	// A value of 1 restricts IMDS access to the EC2 instance only, preventing
	// pods from reaching it. A value of 2 allows pods to access IMDS through
	// the container network bridge. Values above 2 are for advanced networking
	// scenarios such as nested virtualization.
	// When omitted, the platform defaults to a hop limit of 1.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=64
	// +optional
	HTTPPutResponseHopLimit int64 `json:"httpPutResponseHopLimit,omitempty"`
	// httpTokens determines the state of token usage for instance metadata
	// requests. Valid values are "Required" and "Optional".
	// When set to "Required", a signed token header (IMDSv2) must be used for
	// all metadata requests. When set to "Optional", metadata can be retrieved
	// with or without a token (IMDSv1/v2).
	// When omitted, the platform defaults to requiring tokens (IMDSv2).
	// +optional
	HTTPTokens MetadataHTTPTokensState `json:"httpTokens,omitempty"`
}

type MonitoringState string

type OpenshiftEC2NodeClass struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is the standard object metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// spec defines the desired state of the OpenshiftEC2NodeClass.
	// +required
	Spec OpenshiftEC2NodeClassSpec `json:"spec,omitzero"`

	// status defines the observed state of the OpenshiftEC2NodeClass.
	// +optional
	Status OpenshiftEC2NodeClassStatus `json:"status,omitempty,omitzero"`
}

type OpenshiftEC2NodeClassList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []OpenshiftEC2NodeClass `json:"items"`
}

type OpenshiftEC2NodeClassSpec struct {
	// subnetSelectorTerms is a list of or subnet selector terms. The terms are ORed.
	// +kubebuilder:validation:XValidation:message="subnetSelectorTerms cannot be empty",rule="self.size() != 0"
	// +kubebuilder:validation:XValidation:message="expected at least one, got none, ['tags', 'id']",rule="self.all(x, has(x.tags) || has(x.id))"
	// +kubebuilder:validation:XValidation:message="'id' is mutually exclusive, cannot be set with a combination of other fields in subnetSelectorTerms",rule="!self.all(x, has(x.id) && has(x.tags))"
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems:=30
	// +listType=atomic
	// +optional
	SubnetSelectorTerms []SubnetSelectorTerm `json:"subnetSelectorTerms,omitempty"`

	// securityGroupSelectorTerms is a list of or security group selector terms. The terms are ORed.
	// +kubebuilder:validation:XValidation:message="securityGroupSelectorTerms cannot be empty",rule="self.size() != 0"
	// +kubebuilder:validation:XValidation:message="expected at least one, got none, ['tags', 'id', 'name']",rule="self.all(x, has(x.tags) || has(x.id) || has(x.name))"
	// +kubebuilder:validation:XValidation:message="'id' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms",rule="!self.all(x, has(x.id) && (has(x.tags) || has(x.name)))"
	// +kubebuilder:validation:XValidation:message="'name' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms",rule="!self.all(x, has(x.name) && (has(x.tags) || has(x.id)))"
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems:=30
	// +listType=atomic
	// +optional
	SecurityGroupSelectorTerms []SecurityGroupSelectorTerm `json:"securityGroupSelectorTerms,omitempty"`

	// capacityReservationSelectorTerms is a list of capacity reservation selector terms. The terms are ORed.
	// Each term must specify at least one of: tags, id, ownerID, or instanceMatchCriteria.
	// The id field is mutually exclusive and cannot be combined with tags, ownerID, or instanceMatchCriteria
	// within the same term.
	// +kubebuilder:validation:XValidation:message="expected at least one, got none, ['tags', 'id', 'ownerID', 'instanceMatchCriteria']",rule="self.all(x, has(x.tags) || has(x.id) || has(x.ownerID) || has(x.instanceMatchCriteria))"
	// +kubebuilder:validation:XValidation:message="'id' is mutually exclusive, cannot be set along with other fields in a capacity reservation selector term",rule="!self.all(x, has(x.id) && (has(x.tags) || has(x.ownerID) || has(x.instanceMatchCriteria)))"
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems:=30
	// +listType=atomic
	// +optional
	CapacityReservationSelectorTerms []CapacityReservationSelectorTerm `json:"capacityReservationSelectorTerms,omitempty"`

	// ipAddressAssociation controls the IP address assignment for instances launched with the nodeclass.
	// Valid values are:
	// - "Public": assigns public IP addresses to instances, allowing direct internet access.
	// - "SubnetDefault": defers IP address assignment to the subnet configuration.
	// When unset, the cloud provider's subnet default behavior is used.
	// +optional
	IPAddressAssociation IPAddressAssociation `json:"ipAddressAssociation,omitempty"`

	// tags to be applied on ec2 resources like instances and launch templates.
	// +kubebuilder:validation:XValidation:message="empty tag keys aren't supported",rule="self.all(k, k != ”)"
	// +kubebuilder:validation:XValidation:message="tag contains a restricted tag matching eks:eks-cluster-name",rule="self.all(k, k !='eks:eks-cluster-name')"
	// +kubebuilder:validation:XValidation:message="tag contains a restricted tag matching kubernetes.io/cluster/",rule="self.all(k, !k.startsWith('kubernetes.io/cluster') )"
	// +kubebuilder:validation:XValidation:message="tag contains a restricted tag matching karpenter.sh/nodepool",rule="self.all(k, k != 'karpenter.sh/nodepool')"
	// +kubebuilder:validation:XValidation:message="tag contains a restricted tag matching karpenter.sh/nodeclaim",rule="self.all(k, k !='karpenter.sh/nodeclaim')"
	// +kubebuilder:validation:XValidation:message="tag contains a restricted tag matching karpenter.k8s.aws/ec2nodeclass",rule="self.all(k, k !='karpenter.k8s.aws/ec2nodeclass')"
	// +kubebuilder:validation:MinProperties=1
	// +optional
	Tags map[string]string `json:"tags,omitempty"`

	// blockDeviceMappings to be applied to provisioned nodes.
	// For OpenShift nodes, a default root volume size of 120Gi and type gp3 is set if no blockDeviceMapping overrides are specified.
	// +kubebuilder:validation:XValidation:message="must have only one blockDeviceMappings with rootVolume",rule="self.filter(x, has(x.rootVolume)?x.rootVolume=='RootVolume':false).size() <= 1"
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems:=50
	// +listType=atomic
	// +optional
	BlockDeviceMappings []BlockDeviceMapping `json:"blockDeviceMappings,omitempty"`

	// instanceStorePolicy specifies how to handle instance-store disks.
	// +optional
	InstanceStorePolicy InstanceStorePolicy `json:"instanceStorePolicy,omitempty"`

	// monitoring controls the monitoring level for instances that are launched.
	// For more information, see Basic monitoring and detailed monitoring
	// (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-metrics-basic-detailed.html).
	// Valid values are:
	// - "Detailed": enables detailed monitoring.
	// - "Basic": enables basic monitoring.
	// When unset, the cloud provider's default basic monitoring behavior is used.
	// +optional
	Monitoring MonitoringState `json:"monitoring,omitempty"`

	// metadataOptions contains parameters for specifying the exposure of the
	// Instance Metadata Service to provisioned EC2 nodes.
	// When omitted, the platform preserves control over default behaviour
	// which is subject to change over time. Currently defaults to access
	// HTTPEndpoint, httpIPProtocol IPv4, httpPutResponseHopLimit of 1,
	// and httpTokens Required (IMDSv2).
	// +optional
	MetadataOptions MetadataOptions `json:"metadataOptions,omitzero"`

	// version is an OpenShift version (e.g., "4.20.1") specifying the release version
	// for nodes managed by this NodeClass. When set, the controller resolves this to a
	// release image via the Cincinnati graph API. When not set, nodes use the control plane's
	// release image.
	// +kubebuilder:validation:XValidation:rule="self.matches('^(0|[1-9]\\\\d*)\\\\.(0|[1-9]\\\\d*)\\\\.(0|[1-9]\\\\d*)(?:-((?:0|[1-9]\\\\d*|\\\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\\\.(?:0|[1-9]\\\\d*|\\\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\\\+([0-9a-zA-Z-]+(?:\\\\.[0-9a-zA-Z-]+)*))?$')",message="version must be a valid semantic version (e.g., 4.20.1)"
	// +kubebuilder:validation:MinLength=5
	// +kubebuilder:validation:MaxLength=64
	// +optional
	Version string `json:"version,omitempty"`

	// kubelet configures kubelet settings for nodes provisioned by this NodeClass.
	// These settings are injected into the node's ignition configuration via MachineConfig.
	// +optional
	Kubelet KubeletConfiguration `json:"kubelet,omitzero"`
}

type OpenshiftEC2NodeClassStatus struct {
	// conditions contains signals for health and readiness.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// subnets contains the current Subnet values that are available to the
	// cluster under the subnet selectors.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	Subnets []Subnet `json:"subnets,omitempty"`

	// securityGroups contains the current Security Groups values that are available to the
	// cluster under the SecurityGroups selectors.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	SecurityGroups []SecurityGroup `json:"securityGroups,omitempty"`

	// releaseImage is the fully qualified release image resolved either from spec.version, or inherited from
	// the HostedControlPlane's spec.ReleaseImage.
	// Of the format "quay.io/openshift-release-dev/ocp-release@sha256:<digest>".
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=512
	ReleaseImage string `json:"releaseImage,omitempty"`

	// version is the resolved OpenShift version corresponding to the status.releaseImage.
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=64
	Version string `json:"version,omitempty"`

	// capacityReservations contains the current Capacity Reservation values that are available to the
	// cluster under the capacityReservationSelectorTerms.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=100
	CapacityReservations []CapacityReservation `json:"capacityReservations,omitempty"`
}

type RootVolumeDesignation string

type SecurityGroup struct {
	// id is the ID of the security group.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	ID string `json:"id,omitempty"`
	// name is the name of the security group.
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	Name string `json:"name,omitempty"`
}

type SecurityGroupSelectorTerm struct {
	// tags is a map of key/value tags used to select security groups.
	// Specifying '*' for a value selects all values for a given tag key.
	// The expected format is {"key1": "value1", "key2": "*"}.
	// +kubebuilder:validation:XValidation:message="empty tag keys or values aren't supported",rule="self.all(k, k != ” && self[k] != ”)"
	// +kubebuilder:validation:MaxProperties:=20
	// +kubebuilder:validation:MinProperties=1
	// +optional
	Tags map[string]string `json:"tags,omitempty"`

	// id is the security group id in EC2.
	// The expected format is "sg-" followed by alphanumeric characters, e.g. "sg-0a1b2c3d4e5f".
	// +kubebuilder:validation:XValidation:rule="self.matches('^sg-[0-9a-z]+$')",message="id must match the pattern sg-[0-9a-z]+"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	// +optional
	ID string `json:"id,omitempty"`

	// name is the security group name in EC2.
	// This value is the name field, which is different from the name tag.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	// +optional
	Name string `json:"name,omitempty"`
}

type Subnet struct {
	// id is the ID of the subnet.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	ID string `json:"id,omitempty"`
	// zone is the associated availability zone.
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	Zone string `json:"zone,omitempty"`
	// zoneID is the associated availability zone ID.
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	ZoneID string `json:"zoneID,omitempty"`
}

type SubnetSelectorTerm struct {
	// tags is a map of key/value tags used to select subnets.
	// Specifying '*' for a value selects all values for a given tag key.
	// The expected format is {"key1": "value1", "key2": "*"}.
	// +kubebuilder:validation:XValidation:message="empty tag keys or values aren't supported",rule="self.all(k, k != ” && self[k] != ”)"
	// +kubebuilder:validation:MaxProperties:=20
	// +kubebuilder:validation:MinProperties=1
	// +optional
	Tags map[string]string `json:"tags,omitempty"`

	// id is the subnet id in EC2.
	// The expected format is "subnet-" followed by alphanumeric characters, e.g. "subnet-0a1b2c3d4e5f".
	// +kubebuilder:validation:XValidation:rule="self.matches('^subnet-[0-9a-z]+$')",message="id must match the pattern subnet-[0-9a-z]+"
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=256
	// +optional
	ID string `json:"id,omitempty"`
}

type VolumeType string