diff --git a/.ci-operator.yaml b/.ci-operator.yaml index 572c13b2b481..7d60bb17649f 100644 --- a/.ci-operator.yaml +++ b/.ci-operator.yaml @@ -1,4 +1,4 @@ build_root_image: name: release namespace: openshift - tag: rhel-9-release-golang-1.25-openshift-4.23 + tag: rhel-9-release-golang-1.26-openshift-4.23 diff --git a/.gitignore b/.gitignore index 8cc21619cdd4..c7d6b469122b 100644 --- a/.gitignore +++ b/.gitignore @@ -25,6 +25,7 @@ tools/bin *~ .vscode .envrc +!vendor/**/.envrc .env .DS_Store diff --git a/.golangci.yml b/.golangci.yml index 08c34396b455..775851d3066a 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -82,6 +82,18 @@ linters: - linters: - staticcheck text: 'SA1019: "github.com/aws/aws-sdk-go' + # GetEventRecorderFor is deprecated in controller-runtime v0.24 but migration to events.EventRecorder is a separate effort + - linters: + - staticcheck + text: 'SA1019: mgr.GetEventRecorderFor is deprecated' + # client.Apply is deprecated in controller-runtime v0.24 but migration to client.Client.Apply() is a separate effort + - linters: + - staticcheck + text: 'SA1019: (.*)\.Apply is deprecated' + # ibmCluster.Spec.ServiceInstanceID is deprecated but migration is a separate effort + - linters: + - staticcheck + text: 'SA1019: ibmCluster.Spec.ServiceInstanceID is deprecated' # cluster-api v1beta1 is deprecated but migration to v1beta2 is a separate effort - linters: - staticcheck diff --git a/Containerfile.cli b/Containerfile.cli index dc9915f2b026..875069a3272a 100644 --- a/Containerfile.cli +++ b/Containerfile.cli @@ -1,4 +1,4 @@ -FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25 AS builder +FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.26 AS builder ARG COMMIT_HASH WORKDIR /hypershift diff --git a/Containerfile.control-plane b/Containerfile.control-plane index d9e5cf77a4ca..6776208349f7 100644 --- a/Containerfile.control-plane +++ b/Containerfile.control-plane @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9/go-toolset:1.25.9-1778054913 AS builder +FROM registry.access.redhat.com/ubi9/go-toolset:1.26 AS builder ARG COMMIT_HASH WORKDIR /hypershift diff --git a/Containerfile.operator b/Containerfile.operator index aee4d137d227..a51c67e17158 100644 --- a/Containerfile.operator +++ b/Containerfile.operator @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9/go-toolset:1.25.9-1778054913 AS builder +FROM registry.access.redhat.com/ubi9/go-toolset:1.26 AS builder ARG COMMIT_HASH WORKDIR /hypershift diff --git a/Dockerfile b/Dockerfile index 32efb917d057..c2da56434399 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.23 AS builder +FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-4.23 AS builder ARG COMMIT_HASH WORKDIR /hypershift diff --git a/Dockerfile.control-plane b/Dockerfile.control-plane index 937bf2d6b26a..edde148c6f0e 100644 --- a/Dockerfile.control-plane +++ b/Dockerfile.control-plane @@ -1,4 +1,4 @@ -FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.23 AS builder +FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-4.23 AS builder ARG COMMIT_HASH WORKDIR /hypershift diff --git a/Dockerfile.dev b/Dockerfile.dev index e7e26903e5de..b870ddadc0dd 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -1,7 +1,7 @@ # Disclaimer: The purpose of this Dockerfile is to simplify development tasks by building a container image with all-in-one binaries. # The control-plane-operator should not be included in the Hypershift operator image because it is already part of the OpenShift payload. -FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.23 AS builder +FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-4.23 AS builder ARG COMMIT_HASH WORKDIR /hypershift diff --git a/Dockerfile.e2e b/Dockerfile.e2e index 68086ed8bae4..8c15d6ab9f35 100644 --- a/Dockerfile.e2e +++ b/Dockerfile.e2e @@ -1,4 +1,4 @@ -FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.23 AS builder +FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-4.23 AS builder ARG COMMIT_HASH WORKDIR /hypershift @@ -9,7 +9,7 @@ RUN make e2e hypershift e2ev2-create-guests e2ev2-run-tests e2ev2-destroy-guests # Reuse the same image as builder because we need go command in ci-test-e2e.sh # Multi-stage build lets us drop the source code and build cache from the final image -FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.23 +FROM registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-4.23 WORKDIR /hypershift diff --git a/Makefile b/Makefile index 6152cc655665..7b7068a43402 100644 --- a/Makefile +++ b/Makefile @@ -392,7 +392,7 @@ test: generate test-changed: @CHANGED_DIRS=$$(git diff --name-only $(PULL_BASE_SHA)...HEAD -- '*.go' | \ while IFS= read -r file; do dirname "$$file"; done | \ - sort -u | sed 's|^|./|' | grep -v '^\./vendor/' | grep -v '^\./hack/tools/'); \ + sort -u | sed 's|^|./|' | grep -v '^\./vendor/' | grep -v '^\./api/vendor/' | grep -v '^\./hack/tools/' | grep -vE '^\./test/e2e(/|$$)'); \ if [ -z "$$CHANGED_DIRS" ]; then \ echo "No Go files changed relative to $(PULL_BASE_SHA), skipping tests."; \ else \ diff --git a/api/go.mod b/api/go.mod index 5f353404b988..b3a8bf8f934b 100644 --- a/api/go.mod +++ b/api/go.mod @@ -1,12 +1,12 @@ module github.com/openshift/hypershift/api -go 1.25.7 +go 1.26.0 require ( - github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 - k8s.io/api v0.35.1 - k8s.io/apimachinery v0.35.1 - k8s.io/utils v0.0.0-20260108192941-914a6e750570 + github.com/openshift/api v0.0.0-20260715165912-72066cc9718b + k8s.io/api v0.36.2 + k8s.io/apimachinery v0.36.2 + k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 ) require ( @@ -15,15 +15,13 @@ require ( github.com/json-iterator/go v1.1.12 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect - github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect - github.com/spf13/pflag v1.0.10 // indirect github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect golang.org/x/net v0.56.0 // indirect golang.org/x/text v0.38.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect - k8s.io/klog/v2 v2.130.1 // indirect - k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e // indirect + k8s.io/klog/v2 v2.140.0 // indirect + k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect diff --git a/api/go.sum b/api/go.sum index 02fe14e9f234..4ee00a2e5f8d 100644 --- a/api/go.sum +++ b/api/go.sum @@ -17,8 +17,8 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8= github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= -github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 h1:r0S/yoZAI0iWo1JvoIijaIgWGWf/izg4WiV7Wrtz16k= -github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo= +github.com/openshift/api v0.0.0-20260715165912-72066cc9718b h1:gN3SihCYEwoIksD+f24wHhwiEgvaV0RxNjgmkDvBBeg= +github.com/openshift/api v0.0.0-20260715165912-72066cc9718b/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= @@ -40,16 +40,16 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q= -k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM= -k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU= -k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns= -k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= -k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= -k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e h1:iW9ChlU0cU16w8MpVYjXk12dqQ4BPFBEgif+ap7/hqQ= -k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= -k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY= -k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= +k8s.io/api v0.36.2 h1:TF6YDLIzKfccK7cq9YpTcGX8TJmEkHVRv78DM51fRYY= +k8s.io/api v0.36.2/go.mod h1:F4LbMO4brjZYh7yFkXWhynSvtB7YauxV4c+HHkNRGNg= +k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ= +k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4= +k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= +k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= +k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288 h1:A7Lby6ekC6nv+6oO38huCMFBRP0Os+tIeq1GkwxOQes= +k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288/go.mod h1:V/QaCUYDa+0QpcHhVVc5l99Uz56wEMEXBSj9oCDkNDY= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU= diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml index 285573398998..7537bc7ec496 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml @@ -208,15 +208,19 @@ hostedclusters.hypershift.openshift.io: - ClusterVersionOperatorConfiguration - EtcdSharding - ExternalOIDC + - ExternalOIDCExternalClaimsSourcing - ExternalOIDCWithUIDAndExtraClaimMappings - ExternalOIDCWithUpstreamParity - GCPPlatform - HCPEtcdBackup - HyperShiftOnlyDynamicResourceAllocation - ImageStreamImportMode - - KMSEncryptionProvider + - IngressComponentRouteLabels + - KMSEncryption + - NetworkObservabilityInstall - OpenStack - TLSAdherence + - TLSGroupPreferences FilenameOperatorName: "" FilenameOperatorOrdering: "" FilenameRunLevel: "" @@ -282,15 +286,19 @@ hostedcontrolplanes.hypershift.openshift.io: - ClusterVersionOperatorConfiguration - EtcdSharding - ExternalOIDC + - ExternalOIDCExternalClaimsSourcing - ExternalOIDCWithUIDAndExtraClaimMappings - ExternalOIDCWithUpstreamParity - GCPPlatform - HCPEtcdBackup - HyperShiftOnlyDynamicResourceAllocation - ImageStreamImportMode - - KMSEncryptionProvider + - IngressComponentRouteLabels + - KMSEncryption + - NetworkObservabilityInstall - OpenStack - TLSAdherence + - TLSGroupPreferences FilenameOperatorName: "" FilenameOperatorOrdering: "" FilenameRunLevel: "" diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml index 2ec4e9c8a8cf..ab3061bf20ee 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml @@ -716,8 +716,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -762,6 +765,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -780,7 +787,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -794,6 +803,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -810,11 +823,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -825,10 +841,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1077,19 +1099,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1104,11 +1152,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -1143,6 +1203,7 @@ spec: To determine the set of configurable Routes, look at namespace and name of entries in the .status.componentRoutes list, where participating operators write the status of configurable routes. + A maximum of 250 component routes may be configured. items: description: ComponentRouteSpec allows for configuration of a route's hostname and serving certificate. @@ -1190,6 +1251,7 @@ spec: - name - namespace type: object + maxItems: 250 type: array x-kubernetes-list-map-keys: - namespace @@ -3747,6 +3809,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index d4066735377c..e4a7004fe8b3 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -711,8 +711,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -757,6 +760,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -775,7 +782,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -789,6 +798,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -805,11 +818,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -820,10 +836,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1068,19 +1090,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1095,11 +1143,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -1134,6 +1194,7 @@ spec: To determine the set of configurable Routes, look at namespace and name of entries in the .status.componentRoutes list, where participating operators write the status of configurable routes. + A maximum of 250 component routes may be configured. items: description: ComponentRouteSpec allows for configuration of a route's hostname and serving certificate. @@ -1181,6 +1242,7 @@ spec: - name - namespace type: object + maxItems: 250 type: array x-kubernetes-list-map-keys: - namespace @@ -3738,6 +3800,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index 28862caf73b1..74e5fa166e31 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -711,8 +711,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -757,6 +760,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -775,7 +782,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -789,6 +798,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -805,11 +818,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -820,10 +836,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1068,19 +1090,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1095,11 +1143,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -1134,6 +1194,7 @@ spec: To determine the set of configurable Routes, look at namespace and name of entries in the .status.componentRoutes list, where participating operators write the status of configurable routes. + A maximum of 250 component routes may be configured. items: description: ComponentRouteSpec allows for configuration of a route's hostname and serving certificate. @@ -1181,6 +1242,7 @@ spec: - name - namespace type: object + maxItems: 250 type: array x-kubernetes-list-map-keys: - namespace @@ -3758,6 +3820,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/EtcdSharding.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/EtcdSharding.yaml index 414f2bfe610c..dbabaee5577f 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/EtcdSharding.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/EtcdSharding.yaml @@ -711,8 +711,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -757,6 +760,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -775,7 +782,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -789,6 +798,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -805,11 +818,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -820,10 +836,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1068,19 +1090,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1095,11 +1143,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -1134,6 +1194,7 @@ spec: To determine the set of configurable Routes, look at namespace and name of entries in the .status.componentRoutes list, where participating operators write the status of configurable routes. + A maximum of 250 component routes may be configured. items: description: ComponentRouteSpec allows for configuration of a route's hostname and serving certificate. @@ -1181,6 +1242,7 @@ spec: - name - namespace type: object + maxItems: 250 type: array x-kubernetes-list-map-keys: - namespace @@ -4209,6 +4271,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml index 8967caff7216..bc629559a028 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml @@ -711,8 +711,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -757,6 +760,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -775,7 +782,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -789,6 +798,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -805,11 +818,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -820,10 +836,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1400,19 +1422,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1427,11 +1475,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -1466,6 +1526,7 @@ spec: To determine the set of configurable Routes, look at namespace and name of entries in the .status.componentRoutes list, where participating operators write the status of configurable routes. + A maximum of 250 component routes may be configured. items: description: ComponentRouteSpec allows for configuration of a route's hostname and serving certificate. @@ -1513,6 +1574,7 @@ spec: - name - namespace type: object + maxItems: 250 type: array x-kubernetes-list-map-keys: - namespace @@ -4070,6 +4132,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml new file mode 100644 index 000000000000..af961c2f0b23 --- /dev/null +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml @@ -0,0 +1,8830 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + feature-gate.release.openshift.io/ExternalOIDCExternalClaimsSourcing: "true" + name: hostedclusters.hypershift.openshift.io +spec: + group: hypershift.openshift.io + names: + kind: HostedCluster + listKind: HostedClusterList + plural: hostedclusters + shortNames: + - hc + - hcs + singular: hostedcluster + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Version + jsonPath: .status.version.history[?(@.state=="Completed")].version + name: Version + type: string + - description: Control Plane Version + jsonPath: .status.controlPlaneVersion.history[?(@.state=="Completed")].version + name: CP Version + type: string + - description: KubeConfig Secret + jsonPath: .status.kubeconfig.name + name: KubeConfig + type: string + - description: Progress + jsonPath: .status.version.history[?(@.state!="")].state + name: Progress + type: string + - description: Available + jsonPath: .status.conditions[?(@.type=="Available")].status + name: Available + type: string + - description: Progressing + jsonPath: .status.conditions[?(@.type=="Progressing")].status + name: Progressing + type: string + - description: Message + jsonPath: .status.conditions[?(@.type=="Available")].message + name: Message + type: string + - description: Control Plane Progress + jsonPath: .status.controlPlaneVersion.history[0].state + name: CP Progress + priority: 1 + type: string + - description: Data Plane Progress + jsonPath: .status.version.history[0].state + name: DP Progress + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + HostedCluster is the primary representation of a HyperShift cluster and encapsulates + the control plane and common data plane configuration. Creating a HostedCluster + results in a fully functional OpenShift control plane with no attached nodes. + To support workloads (e.g. pods), a HostedCluster may have one or more associated + NodePool resources. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec is the desired behavior of the HostedCluster. + properties: + additionalTrustBundle: + description: |- + additionalTrustBundle is a local reference to a ConfigMap that must have a "ca-bundle.crt" key + whose content must be a PEM-encoded X.509 certificate bundle that will be added to the hosted controlplane and nodes + If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state. + This will be part of every payload generated by the controllers for any NodePool of the HostedCluster. + Changing this value will trigger a rollout for all existing NodePools in the cluster. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + auditWebhook: + description: |- + auditWebhook contains metadata for configuring an audit webhook endpoint + for a cluster to process cluster audit events. It references a secret that + contains the webhook information for the audit webhook endpoint. It is a + secret because if the endpoint has mTLS the kubeconfig will contain client + keys. The kubeconfig needs to be stored in the secret with a secret key + name that corresponds to the constant AuditWebhookKubeconfigKey. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + autoNode: + description: |- + autoNode specifies the configuration for automatic node provisioning and lifecycle management. + When set, the provisioner(e.g. Karpenter) will be used to provision nodes for targeted workloads. + properties: + provisionerConfig: + description: provisionerConfig specifies the provisioner used + for automatic node management. + properties: + karpenter: + description: karpenter specifies the configuration for the + Karpenter provisioner. + properties: + aws: + description: aws specifies the AWS-specific configuration + for Karpenter. + properties: + roleARN: + description: "roleARN specifies the ARN of the IAM + role that Karpenter assumes to provision\nand manage + EC2 instances in the hosted cluster's AWS account.\n\nThe + referenced role must have a trust relationship that + allows it to be assumed\nby the karpenter service + account in the hosted cluster via OIDC.\nExample:\n{\n\t\"Version\": + \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Principal\": {\n\t\t\t\t\"Federated\": + \"\"\n\t\t\t},\n\t\t\t\"Action\": + \"sts:AssumeRoleWithWebIdentity\",\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringEquals\": {\n\t\t\t\t\t\":sub\": + \"system:serviceaccount:kube-system:karpenter\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t]\n}\n\nThe + following is an example of the policy document for + this role.\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\": + [\n\t\t{\n\t\t\t\"Sid\": \"AllowScopedEC2InstanceAccessActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": [\n\t\t\t\t\"arn:*:ec2:*::image/*\",\n\t\t\t\t\"arn:*:ec2:*::snapshot/*\",\n\t\t\t\t\"arn:*:ec2:*:*:security-group/*\",\n\t\t\t\t\"arn:*:ec2:*:*:subnet/*\"\n\t\t\t],\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:RunInstances\",\n\t\t\t\t\"ec2:CreateFleet\"\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedEC2LaunchTemplateAccessActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:ec2:*:*:launch-template/*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:RunInstances\",\n\t\t\t\t\"ec2:CreateFleet\"\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedEC2InstanceActionsWithTags\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": [\n\t\t\t\t\"arn:*:ec2:*:*:fleet/*\",\n\t\t\t\t\"arn:*:ec2:*:*:instance/*\",\n\t\t\t\t\"arn:*:ec2:*:*:volume/*\",\n\t\t\t\t\"arn:*:ec2:*:*:network-interface/*\",\n\t\t\t\t\"arn:*:ec2:*:*:launch-template/*\",\n\t\t\t\t\"arn:*:ec2:*:*:spot-instances-request/*\"\n\t\t\t],\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:RunInstances\",\n\t\t\t\t\"ec2:CreateFleet\",\n\t\t\t\t\"ec2:CreateLaunchTemplate\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:RequestTag/karpenter.sh/nodepool\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedResourceCreationTagging\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": [\n\t\t\t\t\"arn:*:ec2:*:*:fleet/*\",\n\t\t\t\t\"arn:*:ec2:*:*:instance/*\",\n\t\t\t\t\"arn:*:ec2:*:*:volume/*\",\n\t\t\t\t\"arn:*:ec2:*:*:network-interface/*\",\n\t\t\t\t\"arn:*:ec2:*:*:launch-template/*\",\n\t\t\t\t\"arn:*:ec2:*:*:spot-instances-request/*\"\n\t\t\t],\n\t\t\t\"Action\": + \"ec2:CreateTags\",\n\t\t\t\"Condition\": {\n\t\t\t\t\"StringEquals\": + {\n\t\t\t\t\t\"ec2:CreateAction\": [\n\t\t\t\t\t\t\"RunInstances\",\n\t\t\t\t\t\t\"CreateFleet\",\n\t\t\t\t\t\t\"CreateLaunchTemplate\"\n\t\t\t\t\t]\n\t\t\t\t},\n\t\t\t\t\"StringLike\": + {\n\t\t\t\t\t\"aws:RequestTag/karpenter.sh/nodepool\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedResourceTagging\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:ec2:*:*:instance/*\",\n\t\t\t\"Action\": + \"ec2:CreateTags\",\n\t\t\t\"Condition\": {\n\t\t\t\t\"StringLike\": + {\n\t\t\t\t\t\"aws:ResourceTag/karpenter.sh/nodepool\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedDeletion\",\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Resource\": + [\n\t\t\t\t\"arn:*:ec2:*:*:instance/*\",\n\t\t\t\t\"arn:*:ec2:*:*:launch-template/*\"\n\t\t\t],\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:TerminateInstances\",\n\t\t\t\t\"ec2:DeleteLaunchTemplate\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:ResourceTag/karpenter.sh/nodepool\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowRegionalReadActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:DescribeImages\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeInstanceTypeOfferings\",\n\t\t\t\t\"ec2:DescribeInstanceTypes\",\n\t\t\t\t\"ec2:DescribeLaunchTemplates\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeSpotPriceHistory\",\n\t\t\t\t\"ec2:DescribeSubnets\"\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowSSMReadActions\",\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Resource\": + \"arn:*:ssm:*::parameter/aws/service/*\",\n\t\t\t\"Action\": + \"ssm:GetParameter\"\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowPricingReadActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"*\",\n\t\t\t\"Action\": + \"pricing:GetProducts\"\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowInterruptionQueueActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"sqs:DeleteMessage\",\n\t\t\t\t\"sqs:GetQueueUrl\",\n\t\t\t\t\"sqs:ReceiveMessage\"\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowPassingInstanceRole\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:role/*\",\n\t\t\t\"Action\": + \"iam:PassRole\",\n\t\t\t\"Condition\": {\n\t\t\t\t\"StringEquals\": + {\n\t\t\t\t\t\"iam:PassedToService\": [\n\t\t\t\t\t\t\"ec2.amazonaws.com\",\n\t\t\t\t\t\t\"ec2.amazonaws.com.cn\"\n\t\t\t\t\t]\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedInstanceProfileCreationActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:instance-profile/*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"iam:CreateInstanceProfile\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:RequestTag/karpenter.k8s.aws/ec2nodeclass\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedInstanceProfileTagActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:instance-profile/*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"iam:TagInstanceProfile\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass\": + \"*\",\n\t\t\t\t\t\"aws:RequestTag/karpenter.k8s.aws/ec2nodeclass\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedInstanceProfileActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:instance-profile/*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"iam:AddRoleToInstanceProfile\",\n\t\t\t\t\"iam:RemoveRoleFromInstanceProfile\",\n\t\t\t\t\"iam:DeleteInstanceProfile\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowInstanceProfileReadActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:instance-profile/*\",\n\t\t\t\"Action\": + \"iam:GetInstanceProfile\"\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowUnscopedInstanceProfileListAction\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"*\",\n\t\t\t\"Action\": + \"iam:ListInstanceProfiles\"\n\t\t}\n\t]\n}" + maxLength: 2048 + type: string + x-kubernetes-validations: + - message: roleARN must be a valid AWS IAM role ARN + (e.g. arn:aws:iam::123456789012:role/MyRole) + rule: self.matches('^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.+$') + required: + - roleARN + type: object + platform: + description: platform specifies the infrastructure platform + that Karpenter should provision nodes on. + enum: + - AWS + maxLength: 100 + type: string + required: + - platform + type: object + x-kubernetes-validations: + - message: aws is required when platform is AWS, and forbidden + otherwise + rule: 'self.platform == ''AWS'' ? has(self.aws) : !has(self.aws)' + name: + description: name specifies the name of the provisioner to + use for automatic node management. + enum: + - Karpenter + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: karpenter is required when name is Karpenter, and forbidden + otherwise + rule: 'self.name == ''Karpenter'' ? has(self.karpenter) : !has(self.karpenter)' + required: + - provisionerConfig + type: object + autoscaling: + description: |- + autoscaling specifies auto-scaling behavior that applies to all NodePools + associated with this HostedCluster. + properties: + balancingIgnoredLabels: + description: |- + balancingIgnoredLabels sets "--balancing-ignore-label