aws

type AWSSubnetID string // nolint:revive

type CPUOptions struct {
	// ConfidentialCompute specifies whether confidential computing should be enabled for the instance,
	// and, if so, which confidential computing technology to use.
	// Valid values are: Disabled, AMDEncryptedVirtualizationNestedPaging and omitted.
	// When set to Disabled, confidential computing will be disabled for the instance.
	// When set to AMDEncryptedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
	// In this case, ensure the following conditions are met:
	// 1) The selected instance type supports AMD SEV-SNP.
	// 2) The selected AWS region supports AMD SEV-SNP.
	// 3) The selected AMI supports AMD SEV-SNP.
	// More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
	// When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
	// which is subject to change without notice. The current default is Disabled.
	// +optional
	ConfidentialCompute *ConfidentialComputePolicy `json:"confidentialCompute,omitempty"`
}

type ConfidentialComputePolicy string

type DedicatedHost struct {
	// id identifies the AWS Dedicated Host on which the instance must run.
	// The value must start with "h-" followed by 17 lowercase hexadecimal characters (0-9 and a-f).
	// Must be exactly 19 characters in length.
	// +kubebuilder:validation:XValidation:rule="self.matches('^h-[0-9a-f]{17}$')",message="hostID must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)"
	// +kubebuilder:validation:MinLength=19
	// +kubebuilder:validation:MaxLength=19
	// +required
	ID string `json:"id,omitempty"`
}

type EC2Metadata struct {
	// Authentication determines whether or not the host requires the use of authentication when interacting with the metadata service.
	// When using authentication, this enforces v2 interaction method (IMDSv2) with the metadata service.
	// When omitted, this means the user has no opinion and the value is left to the platform to choose a good
	// default, which is subject to change over time. The current default is optional.
	// At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API
	// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html
	// +kubebuilder:validation:Enum=Required;Optional
	// +optional
	Authentication string `json:"authentication,omitempty"`
}

type EC2RootVolume struct {
	// IOPS defines the amount of provisioned IOPS. (KiB/s). IOPS may only be set for
	// io1, io2, & gp3 volume types.
	//
	// +kubebuilder:validation:Minimum=0
	// +optional
	IOPS int `json:"iops"`

	// Throughput to provision in MiB/s supported for the volume type. Not applicable to all types.
	//
	// This parameter is valid only for gp3 volumes.
	// Valid Range: Minimum value of 125. Maximum value of 2000.
	//
	// When omitted, this means no opinion, and the platform is left to
	// choose a reasonable default, which is subject to change over time.
	// The current default is 125.
	//
	// +kubebuilder:validation:Minimum:=125
	// +kubebuilder:validation:Maximum:=2000
	// +optional
	Throughput *int32 `json:"throughput,omitempty"`

	// Size defines the size of the volume in gibibytes (GiB).
	//
	// +kubebuilder:validation:Minimum=0
	Size int `json:"size"`

	// Type defines the type of the volume.
	Type string `json:"type"`

	// The KMS key that will be used to encrypt the EBS volume.
	// If no key is provided the default KMS key for the account will be used.
	// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetEbsDefaultKmsKeyId.html
	// +optional
	KMSKeyARN string `json:"kmsKeyARN,omitempty"`
}

type HostAffinity string

type HostPlacement struct {
	// affinity specifies the affinity setting for the instance.
	// Allowed values are AnyAvailable and DedicatedHost.
	// When Affinity is set to DedicatedHost, an instance started onto a specific host always restarts on the same host if stopped. In this scenario, the `dedicatedHost` field must be set.
	// When Affinity is set to AnyAvailable, and you stop and restart the instance, it can be restarted on any available host.
	// +required
	// +unionDiscriminator
	Affinity *HostAffinity `json:"affinity,omitempty"`

	// dedicatedHost specifies the exact host that an instance should be restarted on if stopped.
	// dedicatedHost is required when 'affinity' is set to DedicatedHost, and forbidden otherwise.
	// +optional
	// +unionMember
	DedicatedHost []DedicatedHost `json:"dedicatedHost,omitempty"`
}

type MachinePool struct {
	// Zones is list of availability zones that can be used.
	//
	// +optional
	Zones []string `json:"zones,omitempty"`

	// InstanceType defines the ec2 instance type.
	// eg. m4-large
	//
	// +optional
	InstanceType string `json:"type"`

	// AMIID is the AMI that should be used to boot the ec2 instance.
	// If set, the AMI should belong to the same region as the cluster.
	//
	// +optional
	AMIID string `json:"amiID,omitempty"`

	// EC2RootVolume defines the root volume for EC2 instances in the machine pool.
	//
	// +optional
	EC2RootVolume `json:"rootVolume"`

	// EC2MetadataOptions defines metadata service interaction options for EC2 instances in the machine pool.
	//
	// +optional
	EC2Metadata EC2Metadata `json:"metadataService"`

	// IAMRole is the name of the IAM Role to use for the instance profile of the machine.
	// Leave unset to have the installer create the IAM Role on your behalf.
	// Cannot be specified together with iamProfile.
	// +optional
	IAMRole string `json:"iamRole,omitempty"`

	// IAMProfile is the name of the IAM instance profile to use for the machine.
	// Leave unset to have the installer create the IAM Profile on your behalf.
	// Cannot be specified together with iamRole.
	// +optional
	IAMProfile string `json:"iamProfile,omitempty"`

	// AdditionalSecurityGroupIDs contains IDs of additional security groups for machines, where each ID
	// is presented in the format sg-xxxx.
	//
	// +kubebuilder:validation:MaxItems=10
	// +optional
	AdditionalSecurityGroupIDs []string `json:"additionalSecurityGroupIDs,omitempty"`

	// CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
	// When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
	// More info:
	// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CpuOptionsRequest.html,
	// https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html
	// +optional
	CPUOptions *CPUOptions `json:"cpuOptions,omitempty,omitzero"`

	// hostPlacement configures placement on AWS Dedicated Hosts. This allows admins to assign instances to specific host
	// for a variety of needs including for regulatory compliance, to leverage existing per-socket or per-core software licenses (BYOL),
	// and to gain visibility and control over instance placement on a physical server.
	// When omitted, the instance is not constrained to a dedicated host.
	// +openshift:enable:FeatureGate=AWSDedicatedHosts
	// +optional
	HostPlacement *HostPlacement `json:"hostPlacement,omitempty"`
}

type Metadata struct {
	Region string `json:"region"`

	// ServiceEndpoints list contains custom endpoints which will override default
	// service endpoint of AWS Services.
	// There must be only one ServiceEndpoint for a service.
	// +optional
	ServiceEndpoints []ServiceEndpoint `json:"serviceEndpoints,omitempty"`

	// Identifier holds a slice of filter maps.  The maps hold the
	// key/value pairs for the tags we will be matching against.  A
	// resource matches the map if all of the key/value pairs are in its
	// tags.  A resource matches Identifier if it matches any of the maps.
	Identifier []map[string]string `json:"identifier"`

	// ClusterDomain is the domain for the cluster.
	ClusterDomain string `json:"clusterDomain"`

	// HostedZoneRole is the role to assume when performing operations
	// on a hosted zone owned by another account.
	HostedZoneRole string `json:"hostedZoneRole,omitempty"`
}

type Platform struct {
	// The field is deprecated. AMIID is the AMI that should be used to boot
	// machines for the cluster. If set, the AMI should belong to the same
	// region as the cluster.
	//
	// +optional
	AMIID string `json:"amiID,omitempty"`

	// Region specifies the AWS region where the cluster will be created.
	Region string `json:"region"`

	// Subnets specifies existing subnets (by ID) where cluster
	// resources will be created.  Leave unset to have the installer
	// create subnets in a new VPC on your behalf.
	//
	// Deprecated: use platform.aws.vpc.subnets
	//
	// +optional
	DeprecatedSubnets []string `json:"subnets,omitempty"`

	// VPC specifies the VPC configuration for the cluster.
	//
	// +optional
	VPC VPC `json:"vpc,omitempty"`

	// HostedZone is the ID of an existing hosted zone into which to add DNS
	// records for the cluster's internal API. An existing hosted zone can
	// only be used when also using existing subnets. The hosted zone must be
	// associated with the VPC containing the subnets.
	// Leave the hosted zone unset to have the installer create the hosted zone
	// on your behalf.
	// +optional
	HostedZone string `json:"hostedZone,omitempty"`

	// HostedZoneRole is the ARN of an IAM role to be assumed when performing
	// operations on the provided HostedZone. HostedZoneRole can be used
	// in a shared VPC scenario when the private hosted zone belongs to a
	// different account than the rest of the cluster resources.
	// If HostedZoneRole is set, HostedZone must also be set.
	//
	// +optional
	HostedZoneRole string `json:"hostedZoneRole,omitempty"`

	// UserTags additional keys and values that the installer will add
	// as tags to all resources that it creates. Resources created by the
	// cluster itself may not include these tags.
	// +optional
	UserTags map[string]string `json:"userTags,omitempty"`

	// ServiceEndpoints list contains custom endpoints which will override default
	// service endpoint of AWS Services.
	// There must be only one ServiceEndpoint for a service.
	// +optional
	ServiceEndpoints []ServiceEndpoint `json:"serviceEndpoints,omitempty"`

	// DefaultMachinePlatform is the default configuration used when
	// installing on AWS for machine pools which do not define their own
	// platform configuration.
	// +optional
	DefaultMachinePlatform *MachinePool `json:"defaultMachinePlatform,omitempty"`

	// PropagateUserTags is a flag that directs in-cluster operators
	// to include the specified user tags in the tags of the
	// AWS resources that the operators create.
	// +optional
	PropagateUserTag bool `json:"propagateUserTags,omitempty"`

	// LBType is an optional field to specify a load balancer type.
	// When this field is specified, all ingresscontrollers (including the
	// default ingresscontroller) will be created using the specified load-balancer
	// type by default.
	//
	// Following are the accepted values:
	//
	// * "Classic": A Classic Load Balancer that makes routing decisions at
	// either the transport layer (TCP/SSL) or the application layer
	// (HTTP/HTTPS). See the following for additional details:
	// https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb
	//
	// * "NLB": A Network Load Balancer that makes routing decisions at the
	// transport layer (TCP/SSL). See the following for additional details:
	// https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb
	//
	// If this field is not set explicitly, the default value depends on the ipFamily field:
	// * "Classic" when ipFamily is not set or set to "IPv4"
	// * "NLB" when ipFamily is set to "DualStackIPv4Primary" or "DualStackIPv6Primary"
	// This default is subject to change over time.
	//
	// +kubebuilder:validation:Enum="Classic";"NLB"
	// +optional
	LBType configv1.AWSLBType `json:"lbType,omitempty"`

	// PreserveBootstrapIgnition is deprecated. Use bestEffortDeleteIgnition instead.
	// +optional
	PreserveBootstrapIgnition bool `json:"preserveBootstrapIgnition,omitempty"`

	// BestEffortDeleteIgnition is an optional field that can be used to ignore errors from S3 deletion of ignition
	// objects during cluster bootstrap. The default behavior is to fail the installation if ignition objects cannot be
	// deleted. Enable this functionality when there are known reasons disallowing their deletion.
	// +optional
	BestEffortDeleteIgnition bool `json:"bestEffortDeleteIgnition,omitempty"`

	// PublicIpv4Pool is an optional field that can be used to tell the installation process to use
	// Public IPv4 address that you bring to your AWS account with BYOIP.
	// +optional
	PublicIpv4Pool string `json:"publicIpv4Pool,omitempty"`

	// UserProvisionedDNS indicates if the customer is providing their own DNS solution in place of the default
	// provisioned by the Installer.
	// +kubebuilder:default:="Disabled"
	// +default="Disabled"
	// +kubebuilder:validation:Enum="Enabled";"Disabled"
	UserProvisionedDNS dns.UserProvisionedDNS `json:"userProvisionedDNS,omitempty"`

	// IPFamily specifies the IP address family for the cluster network.
	// Use "IPv4" for IPv4-only networking, "DualStackIPv4Primary" for dual-stack networking
	// with IPv4 as the primary address family, or "DualStackIPv6Primary" for dual-stack
	// networking with IPv6 as the primary address family. When using dual-stack, the VPC
	// and subnets must be configured with both IPv4 and IPv6 CIDR blocks.
	//
	// +kubebuilder:default:="IPv4"
	// +default="IPv4"
	// +kubebuilder:validation:Enum="IPv4";"DualStackIPv4Primary";"DualStackIPv6Primary"
	// +optional
	IPFamily network.IPFamily `json:"ipFamily,omitempty"`
}

type ServiceEndpoint struct {
	// Name is the name of the AWS service.
	// This must be provided and cannot be empty.
	Name string `json:"name"`

	// URL is fully qualified URI with scheme https, that overrides the default generated
	// endpoint for a client.
	// This must be provided and cannot be empty.
	//
	// +kubebuilder:validation:Pattern=`^https://`
	URL string `json:"url"`
}

type Subnet struct {
	// ID specifies the subnet ID of an existing subnet.
	// The subnet ID must start with "subnet-", consist only of alphanumeric characters,
	// and must be exactly 24 characters long.
	//
	// +required
	ID AWSSubnetID `json:"id"`

	// Roles specifies the roles (aka functions) that the subnet will provide in the cluster.
	// If no roles are specified on any subnet, then the subnet roles are decided automatically.
	// Each role must be unique.
	//
	// +kubebuilder:validation:MaxItems=5
	// +optional
	Roles []SubnetRole `json:"roles,omitempty"`
}

type SubnetRole struct {
	// Type specifies the type of role (aka function) that the subnet will provide in the cluster.
	// Role types include ClusterNode, EdgeNode, BootstrapNode, IngressControllerLB, ControlPlaneExternalLB, and ControlPlaneInternalLB.
	//
	// +required
	Type SubnetRoleType `json:"type"`
}

type SubnetRoleType string

type VPC struct {
	// Subnets defines the subnets in an existing VPC and can optionally specify their intended roles.
	// If no roles are specified on any subnet, then the subnet roles are decided automatically.
	// In this case, the VPC must not contain any other non-cluster subnets without the kubernetes.io/cluster/<cluster-id> tag.
	//
	// For manually specified subnet role selection, each subnet must have at least one assigned role,
	// and the ClusterNode, BootstrapNode, IngressControllerLB, ControlPlaneExternalLB, and ControlPlaneInternalLB roles must be assigned to at least one subnet.
	// However, if the cluster scope is internal, then ControlPlaneExternalLB is not required.
	//
	// Subnets must contain unique IDs, and can include no more than 10 subnets with the IngressController role.
	//
	// Leave this field unset to have the installer create subnets in a new VPC on your behalf.
	//
	// +listType=atomic
	// +optional
	Subnets []Subnet `json:"subnets,omitempty"`
}