apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: (devel)
  name: hiveconfigs.hive.openshift.io
spec:
  group: hive.openshift.io
  names:
    kind: HiveConfig
    listKind: HiveConfigList
    plural: hiveconfigs
    singular: hiveconfig
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: HiveConfig is the Schema for the hives API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: HiveConfigSpec defines the desired state of Hive
            properties:
              additionalCertificateAuthoritiesSecretRef:
                description: AdditionalCertificateAuthoritiesSecretRef is a list of
                  references to secrets in the TargetNamespace that contain an additional
                  Certificate Authority to use when communicating with target clusters.
                  These certificate authorities will be used in addition to any self-signed
                  CA generated by each cluster on installation.
                items:
                  description: LocalObjectReference contains enough information to
                    let you locate the referenced object inside the same namespace.
                  properties:
                    name:
                      description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                        TODO: Add other useful fields. apiVersion, kind, uid?'
                      type: string
                  type: object
                type: array
              argoCDConfig:
                description: ArgoCD specifies configuration for ArgoCD integration.
                  If enabled, Hive will automatically add provisioned clusters to
                  ArgoCD, and remove them when they are deprovisioned.
                properties:
                  enabled:
                    description: Enabled dictates if ArgoCD gitops integration is
                      enabled. If not specified, the default is disabled.
                    type: boolean
                  namespace:
                    description: Namespace specifies the namespace where ArgoCD is
                      installed. Used for the location of cluster secrets. Defaults
                      to "argocd"
                    type: string
                required:
                - enabled
                type: object
              awsPrivateLink:
                description: AWSPrivateLink defines the configuration for the aws-private-link
                  controller. It provides 3 major pieces of information required by
                  the controller, 1. The Credentials that should be used to create
                  AWS PrivateLink resources other than     what exist in the customer's
                  account. 2. A list of VPCs that can be used by the controller to
                  choose one to create AWS VPC Endpoints     for the AWS VPC Endpoint
                  Services created for ClusterDeployments in their     corresponding
                  regions. 3. A list of VPCs that should be able to resolve the DNS
                  addresses setup for Private Link.
                properties:
                  associatedVPCs:
                    description: "AssociatedVPCs is the list of VPCs that should be
                      able to resolve the DNS addresses setup for Private Link. This
                      allows clients in VPC to resolve the AWS PrivateLink address
                      using AWS's default DNS resolver for Private Route53 Hosted
                      Zones. \n This list should at minimum include the VPC where
                      the current Hive controller is running."
                    items:
                      description: AWSAssociatedVPC defines a VPC that should be able
                        to resolve the DNS addresses setup for Private Link.
                      properties:
                        credentialsSecretRef:
                          description: CredentialsSecretRef references a secret in
                            the TargetNamespace that will be used to authenticate
                            with AWS for associating the VPC with the Private HostedZone
                            created for PrivateLink. When not provided, the common
                            credentials for the controller should be used.
                          properties:
                            name:
                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                TODO: Add other useful fields. apiVersion, kind, uid?'
                              type: string
                          type: object
                        region:
                          type: string
                        vpcID:
                          type: string
                      required:
                      - region
                      - vpcID
                      type: object
                    type: array
                  credentialsSecretRef:
                    description: CredentialsSecretRef references a secret in the TargetNamespace
                      that will be used to authenticate with AWS for creating the
                      resources for AWS PrivateLink.
                    properties:
                      name:
                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                          TODO: Add other useful fields. apiVersion, kind, uid?'
                        type: string
                    type: object
                  endpointVPCInventory:
                    description: EndpointVPCInventory is a list of VPCs and the corresponding
                      subnets in various AWS regions. The controller uses this list
                      to choose a VPC for creating AWS VPC Endpoints. Since the VPC
                      Endpoints must be in the same region as the ClusterDeployment,
                      we must have VPCs in that region to be able to setup Private
                      Link.
                    items:
                      description: AWSPrivateLinkInventory is a VPC and its corresponding
                        subnets in an AWS region. This VPC will be used to create
                        an AWS VPC Endpoint whenever there is a VPC Endpoint Service
                        created for a ClusterDeployment.
                      properties:
                        region:
                          type: string
                        subnets:
                          items:
                            description: AWSPrivateLinkSubnet defines a subnet in
                              the an AWS VPC.
                            properties:
                              availabilityZone:
                                type: string
                              subnetID:
                                type: string
                            required:
                            - availabilityZone
                            - subnetID
                            type: object
                          type: array
                        vpcID:
                          type: string
                      required:
                      - region
                      - subnets
                      - vpcID
                      type: object
                    type: array
                required:
                - credentialsSecretRef
                type: object
              backup:
                description: Backup specifies configuration for backup integration.
                  If absent, backup integration will be disabled.
                properties:
                  minBackupPeriodSeconds:
                    description: MinBackupPeriodSeconds specifies that a minimum of
                      MinBackupPeriodSeconds will occur in between each backup. This
                      is used to rate limit backups. This potentially batches together
                      multiple changes into 1 backup. No backups will be lost as changes
                      that happen during this interval are queued up and will result
                      in a backup happening once the interval has been completed.
                    type: integer
                  velero:
                    description: Velero specifies configuration for the Velero backup
                      integration.
                    properties:
                      enabled:
                        description: Enabled dictates if Velero backup integration
                          is enabled. If not specified, the default is disabled.
                        type: boolean
                      namespace:
                        description: Namespace specifies in which namespace velero
                          backup objects should be created. If not specified, the
                          default is a namespace named "velero".
                        type: string
                    type: object
                type: object
              controllersConfig:
                description: ControllersConfig is used to configure different hive
                  controllers
                properties:
                  controllers:
                    description: Controllers contains a list of configurations for
                      different controllers
                    items:
                      description: SpecificControllerConfig contains the configuration
                        for a specific controller
                      properties:
                        config:
                          description: ControllerConfig contains the configuration
                            for the controller specified by Name field
                          properties:
                            clientBurst:
                              description: ClientBurst specifies client rate limiter
                                burst for a controller
                              format: int32
                              type: integer
                            clientQPS:
                              description: ClientQPS specifies client rate limiter
                                QPS for a controller
                              format: int32
                              type: integer
                            concurrentReconciles:
                              description: ConcurrentReconciles specifies number of
                                concurrent reconciles for a controller
                              format: int32
                              type: integer
                            queueBurst:
                              description: QueueBurst specifies workqueue rate limiter
                                burst for a controller
                              format: int32
                              type: integer
                            queueQPS:
                              description: QueueQPS specifies workqueue rate limiter
                                QPS for a controller
                              format: int32
                              type: integer
                            replicas:
                              description: Replicas specifies the number of replicas
                                the specific controller pod should use. This is ONLY
                                for controllers that have been split out into their
                                own pods. This is ignored for all others.
                              format: int32
                              type: integer
                          type: object
                        name:
                          description: Name specifies the name of the controller
                          enum:
                          - clusterDeployment
                          - clusterrelocate
                          - clusterstate
                          - clusterversion
                          - controlPlaneCerts
                          - dnsendpoint
                          - dnszone
                          - remoteingress
                          - remotemachineset
                          - syncidentityprovider
                          - unreachable
                          - velerobackup
                          - clusterprovision
                          - clusterDeprovision
                          - clusterpool
                          - clusterpoolnamespace
                          - hibernation
                          - clusterclaim
                          - metrics
                          - clustersync
                          type: string
                      required:
                      - config
                      - name
                      type: object
                    type: array
                  default:
                    description: Default specifies default configuration for all the
                      controllers, can be used to override following coded defaults
                      default for concurrent reconciles is 5 default for client qps
                      is 5 default for client burst is 10 default for queue qps is
                      10 default for queue burst is 100
                    properties:
                      clientBurst:
                        description: ClientBurst specifies client rate limiter burst
                          for a controller
                        format: int32
                        type: integer
                      clientQPS:
                        description: ClientQPS specifies client rate limiter QPS for
                          a controller
                        format: int32
                        type: integer
                      concurrentReconciles:
                        description: ConcurrentReconciles specifies number of concurrent
                          reconciles for a controller
                        format: int32
                        type: integer
                      queueBurst:
                        description: QueueBurst specifies workqueue rate limiter burst
                          for a controller
                        format: int32
                        type: integer
                      queueQPS:
                        description: QueueQPS specifies workqueue rate limiter QPS
                          for a controller
                        format: int32
                        type: integer
                      replicas:
                        description: Replicas specifies the number of replicas the
                          specific controller pod should use. This is ONLY for controllers
                          that have been split out into their own pods. This is ignored
                          for all others.
                        format: int32
                        type: integer
                    type: object
                type: object
              deleteProtection:
                description: DeleteProtection can be set to "enabled" to turn on automatic
                  delete protection for ClusterDeployments. When enabled, Hive will
                  add the "hive.openshift.io/protected-delete" annotation to new ClusterDeployments.
                  Once a ClusterDeployment has been installed, a user must remove
                  the annotation from a ClusterDeployment prior to deleting it.
                enum:
                - enabled
                type: string
              deprovisionsDisabled:
                description: DeprovisionsDisabled can be set to true to block deprovision
                  jobs from running.
                type: boolean
              disabledControllers:
                description: DisabledControllers allows selectively disabling Hive
                  controllers by name. The name of an individual controller matches
                  the name of the controller as seen in the Hive logging output.
                items:
                  type: string
                type: array
              failedProvisionConfig:
                description: FailedProvisionConfig is used to configure settings related
                  to handling provision failures.
                properties:
                  aws:
                    description: FailedProvisionAWSConfig contains AWS-specific info
                      to upload log files.
                    properties:
                      bucket:
                        description: Bucket is the S3 bucket to store the logs in.
                        type: string
                      credentialsSecretRef:
                        description: 'CredentialsSecretRef references a secret in
                          the TargetNamespace that will be used to authenticate with
                          AWS S3. It will need permission to upload logs to S3. Secret
                          should have keys named aws_access_key_id and aws_secret_access_key
                          that contain the AWS credentials. Example Secret:   data:     aws_access_key_id:
                          minio     aws_secret_access_key: minio123'
                        properties:
                          name:
                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                              TODO: Add other useful fields. apiVersion, kind, uid?'
                            type: string
                        type: object
                      region:
                        description: Region is the AWS region to use for S3 operations.
                          This defaults to us-east-1. For AWS China, use cn-northwest-1.
                        type: string
                      serviceEndpoint:
                        description: ServiceEndpoint is the url to connect to an S3
                          compatible provider.
                        type: string
                    required:
                    - credentialsSecretRef
                    type: object
                  skipGatherLogs:
                    description: 'DEPRECATED: This flag is no longer respected and
                      will be removed in the future.'
                    type: boolean
                type: object
              featureGates:
                description: FeatureGateSelection allows selecting feature gates for
                  the controller.
                properties:
                  custom:
                    description: custom allows the enabling or disabling of any feature.
                      Because of its nature, this setting cannot be validated.  If
                      you have any typos or accidentally apply invalid combinations
                      might cause unknown behavior. featureSet must equal "Custom"
                      must be set to use this field.
                    nullable: true
                    properties:
                      enabled:
                        description: enabled is a list of all feature gates that you
                          want to force on
                        items:
                          type: string
                        type: array
                    type: object
                  featureSet:
                    description: featureSet changes the list of features in the cluster.  The
                      default is empty.  Be very careful adjusting this setting.
                    enum:
                    - ""
                    - Custom
                    type: string
                type: object
              globalPullSecretRef:
                description: GlobalPullSecretRef is used to specify a pull secret
                  that will be used globally by all of the cluster deployments. For
                  each cluster deployment, the contents of GlobalPullSecret will be
                  merged with the specific pull secret for a cluster deployment(if
                  specified), with precedence given to the contents of the pull secret
                  for the cluster deployment. The global pull secret is assumed to
                  be in the TargetNamespace.
                properties:
                  name:
                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                      TODO: Add other useful fields. apiVersion, kind, uid?'
                    type: string
                type: object
              logLevel:
                description: LogLevel is the level of logging to use for the Hive
                  controllers. Acceptable levels, from coarsest to finest, are panic,
                  fatal, error, warn, info, debug, and trace. The default level is
                  info.
                type: string
              maintenanceMode:
                description: MaintenanceMode can be set to true to disable the hive
                  controllers in situations where we need to ensure nothing is running
                  that will add or act upon finalizers on Hive types. This should
                  rarely be needed. Sets replicas to 0 for the hive-controllers deployment
                  to accomplish this.
                type: boolean
              managedDomains:
                description: 'ManagedDomains is the list of DNS domains that are managed
                  by the Hive cluster When specifying ''manageDNS: true'' in a ClusterDeployment,
                  the ClusterDeployment''s baseDomain should be a direct child of
                  one of these domains, otherwise the ClusterDeployment creation will
                  result in a validation error.'
                items:
                  description: ManageDNSConfig contains the domain being managed,
                    and the cloud-specific details for accessing/managing the domain.
                  properties:
                    aws:
                      description: AWS contains AWS-specific settings for external
                        DNS
                      properties:
                        credentialsSecretRef:
                          description: CredentialsSecretRef references a secret in
                            the TargetNamespace that will be used to authenticate
                            with AWS Route53. It will need permission to manage entries
                            for the domain listed in the parent ManageDNSConfig object.
                            Secret should have AWS keys named 'aws_access_key_id'
                            and 'aws_secret_access_key'.
                          properties:
                            name:
                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                TODO: Add other useful fields. apiVersion, kind, uid?'
                              type: string
                          type: object
                        region:
                          description: Region is the AWS region to use for route53
                            operations. This defaults to us-east-1. For AWS China,
                            use cn-northwest-1.
                          type: string
                      required:
                      - credentialsSecretRef
                      type: object
                    azure:
                      description: Azure contains Azure-specific settings for external
                        DNS
                      properties:
                        credentialsSecretRef:
                          description: CredentialsSecretRef references a secret in
                            the TargetNamespace that will be used to authenticate
                            with Azure DNS. It wil need permission to manage entries
                            in each of the managed domains listed in the parent ManageDNSConfig
                            object. Secret should have a key named 'osServicePrincipal.json'
                          properties:
                            name:
                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                TODO: Add other useful fields. apiVersion, kind, uid?'
                              type: string
                          type: object
                        resourceGroupName:
                          description: ResourceGroupName specifies the Azure resource
                            group containing the DNS zones for the domains being managed.
                          type: string
                      required:
                      - credentialsSecretRef
                      - resourceGroupName
                      type: object
                    domains:
                      description: Domains is the list of domains that hive will be
                        managing entries for with the provided credentials.
                      items:
                        type: string
                      type: array
                    gcp:
                      description: GCP contains GCP-specific settings for external
                        DNS
                      properties:
                        credentialsSecretRef:
                          description: CredentialsSecretRef references a secret in
                            the TargetNamespace that will be used to authenticate
                            with GCP DNS. It will need permission to manage entries
                            in each of the managed domains for this cluster. listed
                            in the parent ManageDNSConfig object. Secret should have
                            a key named 'osServiceAccount.json'. The credentials must
                            specify the project to use.
                          properties:
                            name:
                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                                TODO: Add other useful fields. apiVersion, kind, uid?'
                              type: string
                          type: object
                      required:
                      - credentialsSecretRef
                      type: object
                  required:
                  - domains
                  type: object
                type: array
              releaseImageVerificationConfigMapRef:
                description: "ReleaseImageVerificationConfigMapRef is a reference
                  to the ConfigMap that will be used to verify release images. \n
                  The config map structure is exactly the same as the config map used
                  for verification of release images for OpenShift 4 during upgrades.
                  Therefore you can usually set this to the config map shipped as
                  part of OpenShift (openshift-config-managed/release-verification).
                  \n See https://github.com/openshift/cluster-update-keys for more
                  details. The keys within the config map in the data field define
                  how verification is performed: \n verifier-public-key-*: One or
                  more GPG public keys in ASCII form that must have signed the                        release
                  image by digest. \n store-*: A URL (scheme file://, http://, or
                  https://) location that contains signatures. These          signatures
                  are in the atomic container signature format. The URL will have
                  the digest          of the image appended to it as \"<STORE>/<ALGO>=<DIGEST>/signature-<NUMBER>\"
                  as described          in the container image signing format. The
                  docker-image-manifest section of the          signature must match
                  the release image digest. Signatures are searched starting at          NUMBER
                  1 and incrementing if the signature exists but is not valid. The
                  signature is a          GPG signed and encrypted JSON message. The
                  file store is provided for testing only at          the current
                  time, although future versions of the CVO might allow host mounting
                  of          signatures. \n See https://github.com/containers/image/blob/ab49b0a48428c623a8f03b41b9083d48966b34a9/docs/signature-protocols.md
                  for a description of the signature store \n The returned verifier
                  will require that any new release image will only be considered
                  verified if each provided public key has signed the release image
                  digest. The signature may be in any store and the lookup order is
                  internally defined. \n If not set, no verification will be performed."
                properties:
                  name:
                    description: Name of the ConfigMap
                    type: string
                  namespace:
                    description: Namespace of the ConfigMap
                    type: string
                required:
                - name
                - namespace
                type: object
              serviceProviderCredentialsConfig:
                description: ServiceProviderCredentialsConfig is used to configure
                  credentials related to being a service provider on various cloud
                  platforms.
                properties:
                  aws:
                    description: AWS is used to configure credentials related to being
                      a service provider on AWS.
                    properties:
                      credentialsSecretRef:
                        description: CredentialsSecretRef references a secret in the
                          TargetNamespace that will be used to authenticate with AWS
                          to become the Service Provider. Being a Service Provider
                          allows the controllers to assume the role in customer AWS
                          accounts to manager clusters.
                        properties:
                          name:
                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
                              TODO: Add other useful fields. apiVersion, kind, uid?'
                            type: string
                        type: object
                    type: object
                type: object
              syncSetReapplyInterval:
                description: SyncSetReapplyInterval is a string duration indicating
                  how much time must pass before SyncSet resources will be reapplied.
                  The default reapply interval is two hours.
                type: string
              targetNamespace:
                description: TargetNamespace is the namespace where the core Hive
                  components should be run. Defaults to "hive". Will be created if
                  it does not already exist. All resource references in HiveConfig
                  can be assumed to be in the TargetNamespace.
                type: string
            type: object
          status:
            description: HiveConfigStatus defines the observed state of Hive
            properties:
              aggregatorClientCAHash:
                description: AggregatorClientCAHash keeps an md5 hash of the aggregator
                  client CA configmap data from the openshift-config-managed namespace.
                  When the configmap changes, admission is redeployed.
                type: string
              conditions:
                description: Conditions includes more detailed status for the HiveConfig
                items:
                  description: HiveConfigCondition contains details for the current
                    condition of a HiveConfig
                  properties:
                    lastProbeTime:
                      description: LastProbeTime is the last time we probed the condition.
                      format: date-time
                      type: string
                    lastTransitionTime:
                      description: LastTransitionTime is the last time the condition
                        transitioned from one status to another.
                      format: date-time
                      type: string
                    message:
                      description: Message is a human-readable message indicating
                        details about last transition.
                      type: string
                    reason:
                      description: Reason is a unique, one-word, CamelCase reason
                        for the condition's last transition.
                      type: string
                    status:
                      description: Status is the status of the condition.
                      type: string
                    type:
                      description: Type is the type of the condition.
                      type: string
                  required:
                  - status
                  - type
                  type: object
                type: array
              configApplied:
                description: ConfigApplied will be set by the hive operator to indicate
                  whether or not the LastGenerationObserved was successfully reconciled.
                type: boolean
              observedGeneration:
                description: ObservedGeneration will record the most recently processed
                  HiveConfig object's generation.
                format: int64
                type: integer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []