---
################# IMPORTANT ########################
# Document generated by `make api-docs`. DO NOT EDIT
################# IMPORTANT ########################
title: API
---
# HyperShift API Reference
<p>Packages:</p>
<ul>
<li>
<a href="#hypershift.openshift.io%2fv1beta1">hypershift.openshift.io/v1beta1</a>
</li>
</ul>
<h2 id="hypershift.openshift.io/v1beta1">hypershift.openshift.io/v1beta1</h2>
<p>
<p>Package v1beta1 contains the HyperShift API.</p>
<p>The HyperShift API enables creating and managing lightweight, flexible, heterogeneous
OpenShift clusters at scale.</p>
<p>HyperShift clusters are deployed in a topology which isolates the &ldquo;control plane&rdquo;
(e.g. etcd, the API server, controller manager, etc.) from the &ldquo;data plane&rdquo; (e.g.
worker nodes and their kubelets, and the infrastructure on which they run). This
enables &ldquo;hosted control plane as a service&rdquo; use cases.</p>
</p>
##AzurePrivateLinkService { #hypershift.openshift.io/v1beta1.AzurePrivateLinkService }
<p>
<p>AzurePrivateLinkService represents Azure Private Link Service infrastructure
for private connectivity to hosted cluster API servers.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code></br>
string</td>
<td>
<code>
hypershift.openshift.io/v1beta1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code></br>
string
</td>
<td><code>AzurePrivateLinkService</code></td>
</tr>
<tr>
<td>
<code>metadata</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metadata is the metadata for the AzurePrivateLinkService.</p>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkServiceSpec">
AzurePrivateLinkServiceSpec
</a>
</em>
</td>
<td>
<p>spec is the specification for the AzurePrivateLinkService.</p>
</td>
</tr>
<tr>
<td>
<code>status,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkServiceStatus">
AzurePrivateLinkServiceStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>status is the status of the AzurePrivateLinkService.</p>
</td>
</tr>
</tbody>
</table>
##CertificateSigningRequestApproval { #hypershift.openshift.io/v1beta1.CertificateSigningRequestApproval }
<p>
<p>CertificateSigningRequestApproval defines the desired state of CertificateSigningRequestApproval</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code></br>
string</td>
<td>
<code>
hypershift.openshift.io/v1beta1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code></br>
string
</td>
<td><code>CertificateSigningRequestApproval</code></td>
</tr>
<tr>
<td>
<code>metadata</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metadata is standard object metadata.</p>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.CertificateSigningRequestApprovalSpec">
CertificateSigningRequestApprovalSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>spec is the specification of the desired behavior of the CertificateSigningRequestApproval.</p>
<br/>
<br/>
<table>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.CertificateSigningRequestApprovalStatus">
CertificateSigningRequestApprovalStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>status is the most recently observed status of the CertificateSigningRequestApproval.</p>
</td>
</tr>
</tbody>
</table>
##GCPPrivateServiceConnect { #hypershift.openshift.io/v1beta1.GCPPrivateServiceConnect }
<p>
<p>GCPPrivateServiceConnect represents GCP Private Service Connect infrastructure.
This resource is feature-gated behind the GCPPlatform feature gate.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code></br>
string</td>
<td>
<code>
hypershift.openshift.io/v1beta1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code></br>
string
</td>
<td><code>GCPPrivateServiceConnect</code></td>
</tr>
<tr>
<td>
<code>metadata</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metadata is the metadata for the GCPPrivateServiceConnect.</p>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPPrivateServiceConnectSpec">
GCPPrivateServiceConnectSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>spec is the specification for the GCPPrivateServiceConnect.</p>
<br/>
<br/>
<table>
<tr>
<td>
<code>loadBalancerIP</code></br>
<em>
string
</em>
</td>
<td>
<p>loadBalancerIP is the IP address of the Internal Load Balancer
Populated by the observer from service status
This value must be a valid IPv4 or IPv6 address.</p>
</td>
</tr>
<tr>
<td>
<code>forwardingRuleName</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceName">
GCPResourceName
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>forwardingRuleName is the name of the Internal Load Balancer forwarding rule
Populated by the reconciler via GCP API lookup</p>
</td>
</tr>
<tr>
<td>
<code>consumerAcceptList</code></br>
<em>
[]string
</em>
</td>
<td>
<p>consumerAcceptList specifies which customer projects can connect.
Accepts both project IDs (e.g. &ldquo;my-project-123&rdquo;) and project numbers (e.g. &ldquo;123456789012&rdquo;).
A maximum of 50 entries are allowed.
See <a href="https://cloud.google.com/resource-manager/docs/creating-managing-projects">https://cloud.google.com/resource-manager/docs/creating-managing-projects</a> for project ID and number formats.</p>
</td>
</tr>
<tr>
<td>
<code>natSubnet</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceName">
GCPResourceName
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>natSubnet is the subnet used for NAT by the Service Attachment
Auto-populated by the HyperShift Operator</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPPrivateServiceConnectStatus">
GCPPrivateServiceConnectStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>status is the status of the GCPPrivateServiceConnect.</p>
</td>
</tr>
</tbody>
</table>
##HCPEtcdBackup { #hypershift.openshift.io/v1beta1.HCPEtcdBackup }
<p>
<p>HCPEtcdBackup represents a request to back up etcd for a hosted control plane.
This resource is feature-gated behind the HCPEtcdBackup feature gate.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code></br>
string</td>
<td>
<code>
hypershift.openshift.io/v1beta1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code></br>
string
</td>
<td><code>HCPEtcdBackup</code></td>
</tr>
<tr>
<td>
<code>metadata</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metadata is the metadata for the HCPEtcdBackup.</p>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupSpec">
HCPEtcdBackupSpec
</a>
</em>
</td>
<td>
<p>spec is the specification for the HCPEtcdBackup.</p>
</td>
</tr>
<tr>
<td>
<code>status,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupStatus">
HCPEtcdBackupStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>status is the status of the HCPEtcdBackup.</p>
</td>
</tr>
</tbody>
</table>
##HostedCluster { #hypershift.openshift.io/v1beta1.HostedCluster }
<p>
<p>HostedCluster is the primary representation of a HyperShift cluster and encapsulates
the control plane and common data plane configuration. Creating a HostedCluster
results in a fully functional OpenShift control plane with no attached nodes.
To support workloads (e.g. pods), a HostedCluster may have one or more associated
NodePool resources.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code></br>
string</td>
<td>
<code>
hypershift.openshift.io/v1beta1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code></br>
string
</td>
<td><code>HostedCluster</code></td>
</tr>
<tr>
<td>
<code>metadata</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metadata is the metadata for the HostedCluster.</p>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">
HostedClusterSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>spec is the desired behavior of the HostedCluster.</p>
<br/>
<br/>
<table>
<tr>
<td>
<code>release</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Release">
Release
</a>
</em>
</td>
<td>
<p>release specifies the desired OCP release payload for all the hosted cluster components.
This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc.
The maximum and minimum supported release versions are determined by the running Hypersfhit Operator.
Attempting to use an unsupported version will result in the HostedCluster being degraded and the validateReleaseImage condition being false.
Attempting to use a release with a skew against a NodePool release bigger than N-2 for the y-stream will result in leaving the NodePool in an unsupported state.
Changing this field will trigger a rollout of the control plane components.
The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneRelease</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Release">
Release
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controlPlaneRelease is like spec.release but only for the components running on the management cluster.
This excludes any operand which will land in the hosted cluster data plane.
It is useful when you need to apply patch management side like a CVE, transparently for the hosted cluster.
Version input for this field is free, no validation is performed against spec.release or maximum and minimum is performed.
If defined, it will dicate the version of the components running management side, while spec.release will dictate the version of the components landing in the hosted cluster data plane.
If not defined, spec.release is used for both.
Changing this field will trigger a rollout of the control plane.
The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.</p>
</td>
</tr>
<tr>
<td>
<code>clusterID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>clusterID uniquely identifies this cluster. This is expected to be an RFC4122 UUID value (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx in hexadecimal digits).
As with a Kubernetes metadata.uid, this ID uniquely identifies this cluster in space and time.
This value identifies the cluster in metrics pushed to telemetry and metrics produced by the control plane operators.
If a value is not specified, a random clusterID will be generated and set by the controller.
Once set, this value is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>infraID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>infraID is a globally unique identifier for the cluster.
It must consist of lowercase alphanumeric characters and hyphens (&lsquo;-&rsquo;) only, and start and end with an alphanumeric character.
It must be no more than 253 characters in length.
This identifier will be used to associate various cloud resources with the HostedCluster and its associated NodePools.
infraID is used to compute and tag created resources with &ldquo;kubernetes.io/cluster/&rdquo;+hcluster.Spec.InfraID which has contractual meaning for the cloud provider implementations.
If a value is not specified, a random infraID will be generated and set by the controller.
Once set, this value is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>updateService</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.URL
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>updateService may be used to specify the preferred upstream update service.
If omitted we will use the appropriate update service for the cluster and region.
This is used by the control plane operator to determine and signal the appropriate available upgrades in the hostedCluster.status.</p>
</td>
</tr>
<tr>
<td>
<code>channel</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>channel is an identifier for explicitly requesting that a non-default set of updates be applied to this cluster.
If omitted no particular upgrades are suggested.
TODO(alberto): Consider the backend to use the default channel by default. Default channel will contain stable updates that are appropriate for production clusters.</p>
</td>
</tr>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">
PlatformSpec
</a>
</em>
</td>
<td>
<p>platform specifies the underlying infrastructure provider for the cluster
and is used to configure platform specific behavior.</p>
</td>
</tr>
<tr>
<td>
<code>kubeAPIServerDNSName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
If it&rsquo;s set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.</p>
</td>
</tr>
<tr>
<td>
<code>controllerAvailabilityPolicy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AvailabilityPolicy">
AvailabilityPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controllerAvailabilityPolicy specifies the availability policy applied to critical control plane components like the Kube API Server.
Possible values are HighlyAvailable and SingleReplica. The default value is HighlyAvailable.
This field is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>infrastructureAvailabilityPolicy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AvailabilityPolicy">
AvailabilityPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>infrastructureAvailabilityPolicy specifies the availability policy applied to infrastructure services which run on the hosted cluster data plane like the ingress controller and image registry controller.
Possible values are HighlyAvailable and SingleReplica. The default value is SingleReplica.</p>
</td>
</tr>
<tr>
<td>
<code>dns</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.DNSSpec">
DNSSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>dns specifies the DNS configuration for the hosted cluster ingress.</p>
</td>
</tr>
<tr>
<td>
<code>networking</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">
ClusterNetworking
</a>
</em>
</td>
<td>
<p>networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: &ldquo;10.132.0.0/14&rdquo; and a service network of cidr: &ldquo;172.31.0.0/16&rdquo;.</p>
</td>
</tr>
<tr>
<td>
<code>autoscaling</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterAutoscaling">
ClusterAutoscaling
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoscaling specifies auto-scaling behavior that applies to all NodePools
associated with this HostedCluster.</p>
</td>
</tr>
<tr>
<td>
<code>autoNode,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AutoNode">
AutoNode
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoNode specifies the configuration for automatic node provisioning and lifecycle management.
When set, the provisioner(e.g. Karpenter) will be used to provision nodes for targeted workloads.</p>
</td>
</tr>
<tr>
<td>
<code>etcd</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdSpec">
EtcdSpec
</a>
</em>
</td>
<td>
<p>etcd specifies configuration for the control plane etcd cluster. The
default managementType is Managed. Once set, the managementType cannot be
changed.</p>
</td>
</tr>
<tr>
<td>
<code>services</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategyMapping">
[]ServicePublishingStrategyMapping
</a>
</em>
</td>
<td>
<p>services specifies how individual control plane services endpoints are published for consumption.
This requires APIServer;OAuthServer;Konnectivity;Ignition.
This field is immutable for all platforms but IBMCloud.
Max is 6 to account for OIDC;OVNSbDb for backward compatibility though they are no-op.</p>
<p>-kubebuilder:validation:XValidation:rule=&ldquo;self.all(s, !(s.service == &lsquo;APIServer&rsquo; &amp;&amp; s.servicePublishingStrategy.type == &lsquo;Route&rsquo;) || has(s.servicePublishingStrategy.route.hostname))&rdquo;,message=&ldquo;If serviceType is &lsquo;APIServer&rsquo; and publishing strategy is &lsquo;Route&rsquo;, then hostname must be set&rdquo;
-kubebuilder:validation:XValidation:rule=&ldquo;self.platform.type == &lsquo;IBMCloud&rsquo; ? [&lsquo;APIServer&rsquo;, &lsquo;OAuthServer&rsquo;, &lsquo;Konnectivity&rsquo;].all(requiredType, self.exists(s, s.service == requiredType))&rdquo;,message=&ldquo;Services list must contain at least &lsquo;APIServer&rsquo;, &lsquo;OAuthServer&rsquo;, and &lsquo;Konnectivity&rsquo; service types&rdquo; : [&lsquo;APIServer&rsquo;, &lsquo;OAuthServer&rsquo;, &lsquo;Konnectivity&rsquo;, &lsquo;Ignition&rsquo;].all(requiredType, self.exists(s, s.service == requiredType))&ldquo;,message=&ldquo;Services list must contain at least &lsquo;APIServer&rsquo;, &lsquo;OAuthServer&rsquo;, &lsquo;Konnectivity&rsquo;, and &lsquo;Ignition&rsquo; service types&rdquo;
-kubebuilder:validation:XValidation:rule=&ldquo;self.filter(s, s.servicePublishingStrategy.type == &lsquo;Route&rsquo; &amp;&amp; has(s.servicePublishingStrategy.route) &amp;&amp; has(s.servicePublishingStrategy.route.hostname)).all(x, self.filter(y, y.servicePublishingStrategy.type == &lsquo;Route&rsquo; &amp;&amp; (has(y.servicePublishingStrategy.route) &amp;&amp; has(y.servicePublishingStrategy.route.hostname) &amp;&amp; y.servicePublishingStrategy.route.hostname == x.servicePublishingStrategy.route.hostname)).size() &lt;= 1)&rdquo;,message=&ldquo;Each route publishingStrategy &lsquo;hostname&rsquo; must be unique within the Services list.&rdquo;
-kubebuilder:validation:XValidation:rule=&ldquo;self.filter(s, s.servicePublishingStrategy.type == &lsquo;NodePort&rsquo; &amp;&amp; has(s.servicePublishingStrategy.nodePort) &amp;&amp; has(s.servicePublishingStrategy.nodePort.address) &amp;&amp; has(s.servicePublishingStrategy.nodePort.port)).all(x, self.filter(y, y.servicePublishingStrategy.type == &lsquo;NodePort&rsquo; &amp;&amp; (has(y.servicePublishingStrategy.nodePort) &amp;&amp; has(y.servicePublishingStrategy.nodePort.address) &amp;&amp; y.servicePublishingStrategy.nodePort.address == x.servicePublishingStrategy.nodePort.address &amp;&amp; has(y.servicePublishingStrategy.nodePort.port) &amp;&amp; y.servicePublishingStrategy.nodePort.port == x.servicePublishingStrategy.nodePort.port )).size() &lt;= 1)&rdquo;,message=&ldquo;Each nodePort publishingStrategy &lsquo;nodePort&rsquo; and &lsquo;hostname&rsquo; must be unique within the Services list.&rdquo;
TODO(alberto): this breaks the cost budget for &lt; 4.17. We should figure why and enable it back. And If not fixable, consider imposing a minimum version on the management cluster.</p>
</td>
</tr>
<tr>
<td>
<code>pullSecret</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>pullSecret is a local reference to a Secret that must have a &ldquo;.dockerconfigjson&rdquo; key whose content must be a valid Openshift pull secret JSON.
If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
TODO(alberto): Signal this in a condition.
This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
Updating the referenced Secret&rsquo;s data in place (without changing this reference) does not trigger that rollout.
In AWS and Azure NodePools using the Replace upgrade strategy, the Secret&rsquo;s data in place changes
will still propagate the updated credentials down to the guest cluster and kubelet config.
TODO(alberto): have our own local reference type to include our opinions and avoid transparent changes.</p>
</td>
</tr>
<tr>
<td>
<code>sshKey</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>sshKey is a local reference to a Secret that must have a &ldquo;id_rsa.pub&rdquo; key whose content must be the public part of 1..N SSH keys.
If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
TODO(alberto): Signal this in a condition.
When sshKey is set, the controllers will generate a machineConfig with the sshAuthorizedKeys <a href="https://coreos.github.io/ignition/configuration-v3_2/">https://coreos.github.io/ignition/configuration-v3_2/</a> populated with this value.
This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>issuerURL</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>issuerURL is an OIDC issuer URL which will be used as the issuer in all
ServiceAccount tokens generated by the control plane API server via &ndash;service-account-issuer kube api server flag.
<a href="https://k8s-docs.netlify.app/en/docs/reference/command-line-tools-reference/kube-apiserver/">https://k8s-docs.netlify.app/en/docs/reference/command-line-tools-reference/kube-apiserver/</a>
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection</a>
The default value is kubernetes.default.svc, which only works for in-cluster
validation.
If the platform is AWS and this value is set, the controller will update an s3 object with the appropriate OIDC documents (using the serviceAccountSigningKey info) into that issuerURL.
The expectation is for this s3 url to be backed by an OIDC provider in the AWS IAM.</p>
</td>
</tr>
<tr>
<td>
<code>serviceAccountSigningKey</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>serviceAccountSigningKey is a local reference to a secret that must have a &ldquo;key&rdquo; key whose content must be the private key
used by the service account token issuer.
If not specified, a service account signing key will
be generated automatically for the cluster.
When specifying a service account signing key, an IssuerURL must also be specified.
If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
TODO(alberto): Signal this in a condition.</p>
<p>For key rotation, the secret may optionally contain an &ldquo;old-key.pub&rdquo; key whose content is the PEM-encoded
public key of the previous signing key. When present, the kube-apiserver will accept tokens signed by
both the current and previous keys, allowing for graceful key rotation without invalidating existing tokens.</p>
</td>
</tr>
<tr>
<td>
<code>configuration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterConfiguration">
ClusterConfiguration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>configuration specifies configuration for individual OCP components in the
cluster, represented as embedded resources that correspond to the openshift
configuration API.</p>
</td>
</tr>
<tr>
<td>
<code>operatorConfiguration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OperatorConfiguration">
OperatorConfiguration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>operatorConfiguration specifies configuration for individual OCP operators in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>auditWebhook</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>auditWebhook contains metadata for configuring an audit webhook endpoint
for a cluster to process cluster audit events. It references a secret that
contains the webhook information for the audit webhook endpoint. It is a
secret because if the endpoint has mTLS the kubeconfig will contain client
keys. The kubeconfig needs to be stored in the secret with a secret key
name that corresponds to the constant AuditWebhookKubeconfigKey.</p>
</td>
</tr>
<tr>
<td>
<code>imageContentSources</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ImageContentSource">
[]ImageContentSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageContentSources specifies image mirrors that can be used by cluster
nodes to pull content.
When imageContentSources is set, the controllers will generate a machineConfig.
This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>additionalTrustBundle</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>additionalTrustBundle is a local reference to a ConfigMap that must have a &ldquo;ca-bundle.crt&rdquo; key
whose content must be a PEM-encoded X.509 certificate bundle that will be added to the hosted controlplane and nodes
If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
TODO(alberto): Signal this in a condition.
This will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>secretEncryption</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionSpec">
SecretEncryptionSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>secretEncryption specifies a Kubernetes secret encryption strategy for the
control plane.</p>
</td>
</tr>
<tr>
<td>
<code>fips</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>fips indicates whether this cluster&rsquo;s nodes will be running in FIPS mode.
If set to true, the control plane&rsquo;s ignition server will be configured to
expect that nodes joining the cluster will be FIPS-enabled.</p>
</td>
</tr>
<tr>
<td>
<code>pausedUntil</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>pausedUntil is a field that can be used to pause reconciliation on the HostedCluster controller, resulting in any change to the HostedCluster being ignored.
Either a date can be provided in RFC3339 format or a boolean as in &lsquo;true&rsquo;, &lsquo;false&rsquo;, &lsquo;True&rsquo;, &lsquo;False&rsquo;. If a date is
provided: reconciliation is paused on the resource until that date. If the boolean true is
provided: reconciliation is paused on the resource until the field is removed.</p>
</td>
</tr>
<tr>
<td>
<code>olmCatalogPlacement</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OLMCatalogPlacement">
OLMCatalogPlacement
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>olmCatalogPlacement specifies the placement of OLM catalog components. By default,
this is set to management and OLM catalog components are deployed onto the management
cluster. If set to guest, the OLM catalog components will be deployed onto the guest
cluster.</p>
</td>
</tr>
<tr>
<td>
<code>nodeSelector</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeSelector when specified, is propagated to all control plane Deployments and Stateful sets running management side.
It must be satisfied by the management Nodes for the pods to be scheduled. Otherwise the HostedCluster will enter a degraded state.
Changes to this field will propagate to existing Deployments and StatefulSets.
TODO(alberto): add additional validation for the map key/values.</p>
</td>
</tr>
<tr>
<td>
<code>tolerations</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#toleration-v1-core">
[]Kubernetes core/v1.Toleration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>tolerations when specified, define what custom tolerations are added to the hcp pods.</p>
</td>
</tr>
<tr>
<td>
<code>labels</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>labels when specified, define what custom labels are added to the hcp pods.
Changing this day 2 will cause a rollout of all hcp pods.
Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
Valid values are those in <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set">https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set</a></p>
<p>-kubebuilder:validation:XValidation:rule=<code>self.all(key, size(key) &lt;= 317 &amp;&amp; key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))</code>, message=&ldquo;label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (<em>), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)&rdquo;
-kubebuilder:validation:XValidation:rule=<code>self.all(key, size(self[key]) &lt;= 63 &amp;&amp; self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))</code>, message=&ldquo;label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (</em>) or dots (.), and begin and end with an alphanumeric character&rdquo;
TODO: key/value validations break cost budget for &lt;=4.17. We should figure why and enable it back.</p>
</td>
</tr>
<tr>
<td>
<code>capabilities</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Capabilities">
Capabilities
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>capabilities allows for disabling optional components at cluster install time.
This field is optional and once set cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>monitoring,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MonitoringSpec">
MonitoringSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>monitoring configures monitoring for the hosted cluster, including
forwarding of control plane metrics to the hosted cluster&rsquo;s monitoring stack.
When omitted, metrics forwarding behavior is determined by the
hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility.
If neither is set, metrics forwarding is disabled.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterStatus">
HostedClusterStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>status is the latest observed status of the HostedCluster.</p>
</td>
</tr>
</tbody>
</table>
##NodePool { #hypershift.openshift.io/v1beta1.NodePool }
<p>
<p>NodePool is a scalable set of worker nodes attached to a HostedCluster.
NodePool machine architectures are uniform within a given pool, and are
independent of the control plane&rsquo;s underlying machine architecture.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code></br>
string</td>
<td>
<code>
hypershift.openshift.io/v1beta1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code></br>
string
</td>
<td><code>NodePool</code></td>
</tr>
<tr>
<td>
<code>metadata</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metadata is the metadata for the NodePool.</p>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolSpec">
NodePoolSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>spec is the desired behavior of the NodePool.</p>
<br/>
<br/>
<table>
<tr>
<td>
<code>clusterName</code></br>
<em>
string
</em>
</td>
<td>
<p>clusterName is the name of the HostedCluster this NodePool belongs to.
If a HostedCluster with this name doesn&rsquo;t exist, the controller will no-op until it exists.</p>
</td>
</tr>
<tr>
<td>
<code>release</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Release">
Release
</a>
</em>
</td>
<td>
<p>release specifies the OCP release used for this NodePool. It drives the machine ignition configuration (including
the kubelet version) and other platform-specific properties (e.g. an AMI on AWS).</p>
<p>Version-skew rules and effects:
- The minor-version skew relative to the control-plane release must be &lt;= N-2.
This is not currently enforced, but exceeding this limit is unsupported and
may lead to unpredictable behavior.
- If the specified release is higher than the HostedCluster&rsquo;s release, the
NodePool will be degraded and the ValidReleaseImage condition will be false.
- If the specified release is lower than the NodePool&rsquo;s current y-stream,
the NodePool will be degraded and the ValidReleaseImage condition will be false.</p>
<p>Changing this field triggers a NodePool rollout.</p>
</td>
</tr>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">
NodePoolPlatform
</a>
</em>
</td>
<td>
<p>platform specifies the underlying infrastructure provider for the NodePool
and is used to configure platform specific behavior.</p>
</td>
</tr>
<tr>
<td>
<code>replicas</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>replicas is the desired number of nodes the pool should maintain. If unset, the controller default value is 0.
replicas is mutually exclusive with autoscaling. If autoscaling is configured, replicas must be omitted and autoscaling will control the NodePool size internally.</p>
</td>
</tr>
<tr>
<td>
<code>management</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolManagement">
NodePoolManagement
</a>
</em>
</td>
<td>
<p>management specifies behavior for managing nodes in the pool, such as
upgrade strategies and auto-repair behaviors.</p>
</td>
</tr>
<tr>
<td>
<code>autoScaling</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolAutoScaling">
NodePoolAutoScaling
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoScaling specifies auto-scaling behavior for the NodePool.
autoScaling is mutually exclusive with replicas. If replicas is set, this field must be omitted.</p>
</td>
</tr>
<tr>
<td>
<code>config</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
[]Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>config is a list of references to ConfigMaps containing serialized
MachineConfig resources to be injected into the ignition configurations of
nodes in the NodePool. The MachineConfig API schema is defined here:</p>
<p><a href="https://github.com/openshift/machine-config-operator/blob/18963e4f8fe66e8c513ca4b131620760a414997f/pkg/apis/machineconfiguration.openshift.io/v1/types.go#L185">https://github.com/openshift/machine-config-operator/blob/18963e4f8fe66e8c513ca4b131620760a414997f/pkg/apis/machineconfiguration.openshift.io/v1/types.go#L185</a></p>
<p>Each ConfigMap must have a single key named &ldquo;config&rdquo; whose value is the YML
with one or more serialized machineconfiguration.openshift.io resources:</p>
<ul>
<li>KubeletConfig</li>
<li>ContainerRuntimeConfig</li>
<li>MachineConfig</li>
<li>ClusterImagePolicy</li>
<li>ImageContentSourcePolicy</li>
<li>ImageDigestMirrorSet</li>
</ul>
<p>This is validated in the backend and signaled back via validMachineConfig condition.
Changing this field will trigger a NodePool rollout.</p>
</td>
</tr>
<tr>
<td>
<code>nodeDrainTimeout</code></br>
<em>
<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
Kubernetes meta/v1.Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeDrainTimeout is the maximum amount of time that the controller will spend on retrying to drain a node until it succeeds.
The default value is 0, meaning that the node can retry drain without any time limitations.
Changing this field propagate inplace into existing Nodes.</p>
</td>
</tr>
<tr>
<td>
<code>nodeVolumeDetachTimeout</code></br>
<em>
<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
Kubernetes meta/v1.Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeVolumeDetachTimeout is the maximum amount of time that the controller will spend on detaching volumes from a node.
The default value is 0, meaning that the volumes will be detached from the node without any time limitations.
After the timeout, any remaining attached volumes will be ignored and the removal of the machine will continue.
Changing this field propagate inplace into existing Nodes.</p>
</td>
</tr>
<tr>
<td>
<code>nodeLabels</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeLabels propagates a list of labels to Nodes, only once on creation.
Valid values are those in <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set">https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set</a></p>
</td>
</tr>
<tr>
<td>
<code>taints</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Taint">
[]Taint
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>taints if specified, propagates a list of taints to Nodes, only once on creation.
These taints are additive to the ones applied by other controllers</p>
</td>
</tr>
<tr>
<td>
<code>pausedUntil</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>pausedUntil is a field that can be used to pause reconciliation on the NodePool controller. Resulting in any change to the NodePool being ignored.
Either a date can be provided in RFC3339 format or a boolean as in &lsquo;true&rsquo;, &lsquo;false&rsquo;, &lsquo;True&rsquo;, &lsquo;False&rsquo;. If a date is
provided: reconciliation is paused on the resource until that date. If the boolean true is
provided: reconciliation is paused on the resource until the field is removed.</p>
</td>
</tr>
<tr>
<td>
<code>tuningConfig</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
[]Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>tuningConfig is a list of references to ConfigMaps containing serialized
Tuned or PerformanceProfile resources to define the tuning configuration to be applied to
nodes in the NodePool. The Tuned API is defined here:</p>
<p><a href="https://github.com/openshift/cluster-node-tuning-operator/blob/2c76314fb3cc8f12aef4a0dcd67ddc3677d5b54f/pkg/apis/tuned/v1/tuned_types.go">https://github.com/openshift/cluster-node-tuning-operator/blob/2c76314fb3cc8f12aef4a0dcd67ddc3677d5b54f/pkg/apis/tuned/v1/tuned_types.go</a></p>
<p>The PerformanceProfile API is defined here:
<a href="https://github.com/openshift/cluster-node-tuning-operator/tree/b41042d42d4ba5bb2e99960248cf1d6ae4935018/pkg/apis/performanceprofile/v2">https://github.com/openshift/cluster-node-tuning-operator/tree/b41042d42d4ba5bb2e99960248cf1d6ae4935018/pkg/apis/performanceprofile/v2</a></p>
<p>Each ConfigMap must have a single key named &ldquo;tuning&rdquo; whose value is the
JSON or YAML of a serialized Tuned or PerformanceProfile.
Changing this field will trigger a NodePool rollout.</p>
</td>
</tr>
<tr>
<td>
<code>arch</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>arch is the preferred processor architecture for the NodePool. Different platforms might have different supported architectures.
TODO: This is set as optional to prevent validation from failing due to a limitation on client side validation with open API machinery:
<a href="https://github.com/kubernetes/kubernetes/issues/108768#issuecomment-1253912215">https://github.com/kubernetes/kubernetes/issues/108768#issuecomment-1253912215</a></p>
</td>
</tr>
<tr>
<td>
<code>osImageStream,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OSImageStreamReference">
OSImageStreamReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>osImageStream specifies an OS stream to be used for nodes in this pool.</p>
<p>This field can be optionally set to a known OSImageStream name to change
the OS and Extension images with a well-known, tested, release-provided
set of images. This enables a streamlined way of switching the pool&rsquo;s
node OS to a different version than the cluster default, such as
transitioning to a major RHEL version.</p>
<p>When set, the referenced stream overrides the default OS images for the
pool. When omitted, the pool uses the release version&rsquo;s default stream
(rhel-9 for OCP &lt; 5.0, rhel-10 for OCP &gt;= 5.0).
Changing this field triggers a rollout. Forward transitions
(rhel-9 -&gt; rhel-10) are allowed; backward transitions
(rhel-10 -&gt; rhel-9) are rejected by CEL validation because
in-place OS downgrades are not supported.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolStatus">
NodePoolStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>status is the latest observed status of the NodePool.</p>
</td>
</tr>
</tbody>
</table>
###AESCBCKeyStatus { #hypershift.openshift.io/v1beta1.AESCBCKeyStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus">SecretEncryptionKeyStatus</a>)
</p>
<p>
<p>AESCBCKeyStatus contains a reference to the AESCBC key secret and a SHA-256 hash
of its contents for fingerprinting.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>secret,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretReference">
SecretReference
</a>
</em>
</td>
<td>
<p>secret is a reference to the secret containing the AESCBC key.</p>
</td>
</tr>
<tr>
<td>
<code>dataHash</code></br>
<em>
string
</em>
</td>
<td>
<p>dataHash is the hex-encoded SHA-256 hash of the secret&rsquo;s &ldquo;key&rdquo; data field
at the time re-encryption completed.</p>
</td>
</tr>
</tbody>
</table>
###AESCBCSpec { #hypershift.openshift.io/v1beta1.AESCBCSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionSpec">SecretEncryptionSpec</a>)
</p>
<p>
<p>AESCBCSpec defines metadata about the AESCBC secret encryption strategy</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>activeKey</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>activeKey defines the active key used to encrypt new secrets</p>
</td>
</tr>
<tr>
<td>
<code>backupKey</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>backupKey defines the old key during the rotation process so previously created
secrets can continue to be decrypted until they are all re-encrypted with the active key.</p>
<p>Deprecated: This field will be ignored when status.secretEncryption.activeKey is set.
The system automatically manages the previous key via the status field.</p>
</td>
</tr>
</tbody>
</table>
###APIServerNetworking { #hypershift.openshift.io/v1beta1.APIServerNetworking }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">ClusterNetworking</a>)
</p>
<p>
<p>APIServerNetworking specifies how the APIServer is exposed inside a cluster
node.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>advertiseAddress</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>advertiseAddress is the address that pods within the nodes will use to talk to the API
server. This is an address associated with the loopback adapter of each
node. If not specified, the controller will take default values.
The default values will be set as 172.20.0.1 or fd00::1.
This value is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>port</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>port is the port at which the APIServer is exposed inside a node. Other
pods using host networking cannot listen on this port.
If omitted 6443 is used.
This is useful to choose a port other than the default one which might interfere with customer environments e.g. <a href="https://github.com/openshift/hypershift/pull/356">https://github.com/openshift/hypershift/pull/356</a>.
Setting this to 443 is possible only for backward compatibility reasons and it&rsquo;s discouraged.
Doing so, it would result in the controller overriding the KAS endpoint in the guest cluster having a discrepancy with the KAS Pod and potentially causing temporarily network failures.
This value is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>allowedCIDRBlocks</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.CIDRBlock">
[]CIDRBlock
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>allowedCIDRBlocks is an allow list of CIDR blocks that can access the APIServer.
If not specified, traffic is allowed from all addresses.
This field is enforced for ARO (Azure Red Hat OpenShift) via the shared-ingress HAProxy.
For platforms other than ARO, the enforcement depends on whether the underlying cloud provider supports the Service LoadBalancerSourceRanges field.
If the platform does not support LoadBalancerSourceRanges, this field may have no effect.</p>
</td>
</tr>
</tbody>
</table>
###AWSCloudProviderConfig { #hypershift.openshift.io/v1beta1.AWSCloudProviderConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSPlatformSpec">AWSPlatformSpec</a>)
</p>
<p>
<p>AWSCloudProviderConfig specifies AWS networking configuration.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>subnet</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSResourceReference">
AWSResourceReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>subnet is the subnet to use for control plane cloud resources.</p>
</td>
</tr>
<tr>
<td>
<code>zone</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>zone is the availability zone where control plane cloud resources are
created.</p>
</td>
</tr>
<tr>
<td>
<code>vpc</code></br>
<em>
string
</em>
</td>
<td>
<p>vpc is the VPC to use for control plane cloud resources.</p>
</td>
</tr>
</tbody>
</table>
###AWSEndpointAccessType { #hypershift.openshift.io/v1beta1.AWSEndpointAccessType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSPlatformSpec">AWSPlatformSpec</a>)
</p>
<p>
<p>AWSEndpointAccessType specifies the publishing scope of cluster endpoints.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Private&#34;</p></td>
<td><p>Private endpoint access allows only private API server access and private
node communication with the control plane.</p>
</td>
</tr><tr><td><p>&#34;Public&#34;</p></td>
<td><p>Public endpoint access allows public API server access and public node
communication with the control plane.</p>
</td>
</tr><tr><td><p>&#34;PublicAndPrivate&#34;</p></td>
<td><p>PublicAndPrivate endpoint access allows public API server access and
private node communication with the control plane.</p>
</td>
</tr></tbody>
</table>
###AWSKMSAuthSpec { #hypershift.openshift.io/v1beta1.AWSKMSAuthSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSKMSSpec">AWSKMSSpec</a>)
</p>
<p>
<p>AWSKMSAuthSpec defines metadata about the management of credentials used to interact and encrypt data via AWS KMS key.
The referenced role must have a trust relationship that allows it to be assumed via web identity.
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html</a>.
Example:</p>
<pre><code>{
&quot;Version&quot;: &quot;2012-10-17&quot;,
&quot;Statement&quot;: [
{
&quot;Effect&quot;: &quot;Allow&quot;,
&quot;Principal&quot;: {
&quot;Federated&quot;: &quot;{{ .ProviderARN }}&quot;
},
&quot;Action&quot;: &quot;sts:AssumeRoleWithWebIdentity&quot;,
&quot;Condition&quot;: {
&quot;StringEquals&quot;: {
&quot;{{ .ProviderName }}:sub&quot;: {{ .ServiceAccounts }}
}
}
}
]
}
</code></pre>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>awsKms</code></br>
<em>
string
</em>
</td>
<td>
<p>awsKms is an ARN value referencing a role appropriate for managing the auth via the AWS KMS key.</p>
<p>The following is an example of a valid policy document:</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;kms:Encrypt&rdquo;,
&ldquo;kms:Decrypt&rdquo;,
&ldquo;kms:ReEncrypt<em>&rdquo;,
&ldquo;kms:GenerateDataKey</em>&rdquo;,
&ldquo;kms:DescribeKey&rdquo;
],
&ldquo;Resource&rdquo;: %q
}
]
}</p>
</td>
</tr>
</tbody>
</table>
###AWSKMSKeyEntry { #hypershift.openshift.io/v1beta1.AWSKMSKeyEntry }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSKMSSpec">AWSKMSSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus">SecretEncryptionKeyStatus</a>)
</p>
<p>
<p>AWSKMSKeyEntry defines metadata to locate the encryption key in AWS</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>arn</code></br>
<em>
string
</em>
</td>
<td>
<p>arn is the Amazon Resource Name for the encryption key</p>
</td>
</tr>
</tbody>
</table>
###AWSKMSSpec { #hypershift.openshift.io/v1beta1.AWSKMSSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KMSSpec">KMSSpec</a>)
</p>
<p>
<p>AWSKMSSpec defines metadata about the configuration of the AWS KMS Secret Encryption provider</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>region</code></br>
<em>
string
</em>
</td>
<td>
<p>region contains the AWS region</p>
</td>
</tr>
<tr>
<td>
<code>activeKey</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSKMSKeyEntry">
AWSKMSKeyEntry
</a>
</em>
</td>
<td>
<p>activeKey defines the active key used to encrypt new secrets</p>
</td>
</tr>
<tr>
<td>
<code>backupKey</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSKMSKeyEntry">
AWSKMSKeyEntry
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>backupKey defines the old key during the rotation process so previously created
secrets can continue to be decrypted until they are all re-encrypted with the active key.</p>
<p>Deprecated: This field will be ignored when status.secretEncryption.activeKey is set.
The system automatically manages the previous key via the status field.</p>
</td>
</tr>
<tr>
<td>
<code>auth</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSKMSAuthSpec">
AWSKMSAuthSpec
</a>
</em>
</td>
<td>
<p>auth defines metadata about the management of credentials used to interact with AWS KMS</p>
</td>
</tr>
</tbody>
</table>
###AWSNodePoolPlatform { #hypershift.openshift.io/v1beta1.AWSNodePoolPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>)
</p>
<p>
<p>AWSNodePoolPlatform specifies the configuration of a NodePool when operating
on AWS.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>instanceType</code></br>
<em>
string
</em>
</td>
<td>
<p>instanceType is an ec2 instance type for node instances (e.g. m5.large).</p>
</td>
</tr>
<tr>
<td>
<code>instanceProfile</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>instanceProfile is the AWS EC2 instance profile, which is a container for an IAM role that the EC2 instance uses.</p>
</td>
</tr>
<tr>
<td>
<code>subnet</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSResourceReference">
AWSResourceReference
</a>
</em>
</td>
<td>
<p>subnet is the subnet to use for node instances.</p>
</td>
</tr>
<tr>
<td>
<code>ami</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ami is the image id to use for node instances. If unspecified, the default
is chosen based on the NodePool release payload image.</p>
</td>
</tr>
<tr>
<td>
<code>imageType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ImageType">
ImageType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageType specifies the type of image to use for node instances.
Valid values are &ldquo;Linux&rdquo; or &ldquo;Windows&rdquo;
When set to Windows, the controller will automatically populate the AMI field
with a Windows-compatible AMI based on the region and OpenShift version.
When the AMI field is also set, it will take precedence over automatic selection based
on imageType. Also note that Windows ImageType is only compatible with an Arch of amd64</p>
</td>
</tr>
<tr>
<td>
<code>securityGroups</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSResourceReference">
[]AWSResourceReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>securityGroups is an optional set of security groups to associate with node
instances.</p>
</td>
</tr>
<tr>
<td>
<code>rootVolume</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Volume">
Volume
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>rootVolume specifies configuration for the root volume of node instances.</p>
</td>
</tr>
<tr>
<td>
<code>resourceTags</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSResourceTag">
[]AWSResourceTag
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>resourceTags is an optional list of additional tags to apply to AWS node
instances. Changes to this field will be propagated in-place to AWS EC2 instances and their initial EBS volumes.
Volumes created by the storage operator and attached to instances after they are created do not get these tags applied.</p>
<p>These will be merged with HostedCluster scoped tags, which take precedence in case of conflicts.
These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.</p>
<p>See <a href="https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html">https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html</a> for
information on tagging AWS resources. AWS supports a maximum of 50 tags per
resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
for the user.</p>
</td>
</tr>
<tr>
<td>
<code>placement</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlacementOptions">
PlacementOptions
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>placement specifies the placement options for the EC2 instances.</p>
</td>
</tr>
</tbody>
</table>
###AWSPlatformSpec { #hypershift.openshift.io/v1beta1.AWSPlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>AWSPlatformSpec specifies configuration for clusters running on Amazon Web Services.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>region</code></br>
<em>
string
</em>
</td>
<td>
<p>region is the AWS region in which the cluster resides. This configures the
OCP control plane cloud integrations, and is used by NodePool to resolve
the correct boot AMI for a given release.</p>
</td>
</tr>
<tr>
<td>
<code>cloudProviderConfig</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSCloudProviderConfig">
AWSCloudProviderConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>cloudProviderConfig specifies AWS networking configuration for the control
plane.
This is mainly used for cloud provider controller config:
<a href="https://github.com/kubernetes/kubernetes/blob/f5be5052e3d0808abb904aebd3218fe4a5c2dd82/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L1347-L1364">https://github.com/kubernetes/kubernetes/blob/f5be5052e3d0808abb904aebd3218fe4a5c2dd82/staging/src/k8s.io/legacy-cloud-providers/aws/aws.go#L1347-L1364</a>
TODO(dan): should this be named AWSNetworkConfig?</p>
</td>
</tr>
<tr>
<td>
<code>serviceEndpoints</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSServiceEndpoint">
[]AWSServiceEndpoint
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>serviceEndpoints specifies optional custom endpoints which will override
the default service endpoint of specific AWS Services.</p>
<p>There must be only one ServiceEndpoint for a given service name.</p>
</td>
</tr>
<tr>
<td>
<code>rolesRef</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSRolesRef">
AWSRolesRef
</a>
</em>
</td>
<td>
<p>rolesRef contains references to various AWS IAM roles required to enable
integrations such as OIDC.</p>
</td>
</tr>
<tr>
<td>
<code>resourceTags</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSResourceTag">
[]AWSResourceTag
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>resourceTags is a list of additional tags to apply to AWS resources created
for the cluster. See
<a href="https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html">https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html</a> for
information on tagging AWS resources. AWS supports a maximum of 50 tags per
resource. OpenShift reserves 25 tags for its use, leaving 25 tags available
for the user.
Changes to this field will be propagated in-place to AWS resources (VPC Endpoints, EC2 instances, initial EBS volumes and default/endpoint security groups).
These tags will be propagated to the infrastructure CR in the guest cluster, where other OCP operators might choose to honor this input to reconcile AWS resources created by them.
Please consult the official documentation for a list of all AWS resources that support in-place tag updates.
These take precedence over tags defined out of band (i.e., tags added manually or by other tools outside of HyperShift) in AWS in case of conflicts.</p>
</td>
</tr>
<tr>
<td>
<code>endpointAccess</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSEndpointAccessType">
AWSEndpointAccessType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>endpointAccess specifies the publishing scope of cluster endpoints. The
default is Public.</p>
</td>
</tr>
<tr>
<td>
<code>additionalAllowedPrincipals</code></br>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>additionalAllowedPrincipals specifies a list of additional allowed principal ARNs
to be added to the hosted control plane&rsquo;s VPC Endpoint Service to enable additional
VPC Endpoint connection requests to be automatically accepted.
See <a href="https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html">https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html</a>
for more details around VPC Endpoint Service allowed principals.</p>
</td>
</tr>
<tr>
<td>
<code>multiArch</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>multiArch specifies whether the Hosted Cluster will be expected to support NodePools with different
CPU architectures, i.e., supporting arm64 NodePools and supporting amd64 NodePools on the same Hosted Cluster.
Deprecated: This field is no longer used. The HyperShift Operator now performs multi-arch validations
automatically despite the platform type. The HyperShift Operator will set HostedCluster.Status.PayloadArch based
on the HostedCluster release image. This field is used by the NodePool controller to validate the
NodePool.Spec.Arch is supported.</p>
</td>
</tr>
<tr>
<td>
<code>sharedVPC</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSSharedVPC">
AWSSharedVPC
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>sharedVPC contains fields that must be specified if the HostedCluster must use a VPC that is
created in a different AWS account and is shared with the AWS account where the HostedCluster
will be created.</p>
</td>
</tr>
<tr>
<td>
<code>terminationHandlerQueueURL</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>terminationHandlerQueueURL specifies the SQS queue URL for EC2 spot interruption events.
This is required when using spot instances (marketType: Spot) in NodePools to enable
graceful handling of spot instance terminations.</p>
<p>The queue should be configured to receive EC2 Spot Instance Interruption Warnings
and EC2 Instance Rebalance Recommendations via EventBridge rules.
The AWS Node Termination Handler will poll this queue and cordon/drain nodes
before they are terminated, providing a best effort for graceful shutdown.</p>
<p>Supports both standard and FIFO queues (FIFO queues end with .fifo suffix).</p>
</td>
</tr>
</tbody>
</table>
###AWSPlatformStatus { #hypershift.openshift.io/v1beta1.AWSPlatformStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlatformStatus">PlatformStatus</a>)
</p>
<p>
<p>AWSPlatformStatus contains status specific to the AWS platform</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>defaultWorkerSecurityGroupID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>defaultWorkerSecurityGroupID is the ID of a security group created by
the control plane operator. It is always added to worker machines in
addition to any security groups specified in the NodePool.</p>
</td>
</tr>
</tbody>
</table>
###AWSResourceReference { #hypershift.openshift.io/v1beta1.AWSResourceReference }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSCloudProviderConfig">AWSCloudProviderConfig</a>, 
<a href="#hypershift.openshift.io/v1beta1.AWSNodePoolPlatform">AWSNodePoolPlatform</a>)
</p>
<p>
<p>AWSResourceReference is a reference to a specific AWS resource by ID or filters.
Only one of ID or Filters may be specified. Specifying more than one will result in
a validation error.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>id</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>id of resource</p>
</td>
</tr>
<tr>
<td>
<code>filters</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Filter">
[]Filter
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>filters is a set of key/value pairs used to identify a resource
They are applied according to the rules defined by the AWS API:
<a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html">https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html</a></p>
</td>
</tr>
</tbody>
</table>
###AWSResourceTag { #hypershift.openshift.io/v1beta1.AWSResourceTag }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSNodePoolPlatform">AWSNodePoolPlatform</a>, 
<a href="#hypershift.openshift.io/v1beta1.AWSPlatformSpec">AWSPlatformSpec</a>)
</p>
<p>
<p>AWSResourceTag is a tag to apply to AWS resources created for the cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>key</code></br>
<em>
string
</em>
</td>
<td>
<p>key is the key of the tag.</p>
</td>
</tr>
<tr>
<td>
<code>value</code></br>
<em>
string
</em>
</td>
<td>
<p>value is the value of the tag.</p>
<p>Some AWS service do not support empty values. Since tags are added to
resources in many services, the length of the tag value must meet the
requirements of all services.</p>
</td>
</tr>
</tbody>
</table>
###AWSRoleCredentials { #hypershift.openshift.io/v1beta1.AWSRoleCredentials }
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>arn</code></br>
<em>
string
</em>
</td>
<td>
<p>arn is the ARN of the role.</p>
</td>
</tr>
<tr>
<td>
<code>namespace</code></br>
<em>
string
</em>
</td>
<td>
<p>namespace is the namespace of the role.</p>
</td>
</tr>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is the name of the role.</p>
</td>
</tr>
</tbody>
</table>
###AWSRolesRef { #hypershift.openshift.io/v1beta1.AWSRolesRef }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSPlatformSpec">AWSPlatformSpec</a>)
</p>
<p>
<p>AWSRolesRef contains references to various AWS IAM roles required for operators to make calls against the AWS API.
The referenced role must have a trust relationship that allows it to be assumed via web identity.
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html</a>.
Example:</p>
<pre><code>{
&quot;Version&quot;: &quot;2012-10-17&quot;,
&quot;Statement&quot;: [
{
&quot;Effect&quot;: &quot;Allow&quot;,
&quot;Principal&quot;: {
&quot;Federated&quot;: &quot;{{ .ProviderARN }}&quot;
},
&quot;Action&quot;: &quot;sts:AssumeRoleWithWebIdentity&quot;,
&quot;Condition&quot;: {
&quot;StringEquals&quot;: {
&quot;{{ .ProviderName }}:sub&quot;: {{ .ServiceAccounts }}
}
}
}
]
}
</code></pre>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>ingressARN</code></br>
<em>
string
</em>
</td>
<td>
<p>ingressARN is an ARN value referencing a role appropriate for the Ingress Operator.</p>
<p>The following is an example of a valid policy document:</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;elasticloadbalancing:DescribeLoadBalancers&rdquo;,
&ldquo;tag:GetResources&rdquo;,
&ldquo;route53:ListHostedZones&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;*&rdquo;
},
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;route53:ChangeResourceRecordSets&rdquo;
],
&ldquo;Resource&rdquo;: [
&ldquo;arn:aws:route53:::PUBLIC_ZONE_ID&rdquo;,
&ldquo;arn:aws:route53:::PRIVATE_ZONE_ID&rdquo;
]
}
]
}</p>
</td>
</tr>
<tr>
<td>
<code>imageRegistryARN</code></br>
<em>
string
</em>
</td>
<td>
<p>imageRegistryARN is an ARN value referencing a role appropriate for the Image Registry Operator.</p>
<p>The following is an example of a valid policy document:</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;s3:CreateBucket&rdquo;,
&ldquo;s3:DeleteBucket&rdquo;,
&ldquo;s3:PutBucketTagging&rdquo;,
&ldquo;s3:GetBucketTagging&rdquo;,
&ldquo;s3:PutBucketPublicAccessBlock&rdquo;,
&ldquo;s3:GetBucketPublicAccessBlock&rdquo;,
&ldquo;s3:PutEncryptionConfiguration&rdquo;,
&ldquo;s3:GetEncryptionConfiguration&rdquo;,
&ldquo;s3:PutLifecycleConfiguration&rdquo;,
&ldquo;s3:GetLifecycleConfiguration&rdquo;,
&ldquo;s3:GetBucketLocation&rdquo;,
&ldquo;s3:ListBucket&rdquo;,
&ldquo;s3:GetObject&rdquo;,
&ldquo;s3:PutObject&rdquo;,
&ldquo;s3:DeleteObject&rdquo;,
&ldquo;s3:ListBucketMultipartUploads&rdquo;,
&ldquo;s3:AbortMultipartUpload&rdquo;,
&ldquo;s3:ListMultipartUploadParts&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;*&rdquo;
}
]
}</p>
</td>
</tr>
<tr>
<td>
<code>storageARN</code></br>
<em>
string
</em>
</td>
<td>
<p>storageARN is an ARN value referencing a role appropriate for the Storage Operator.</p>
<p>The following is an example of a valid policy document:</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;ec2:AttachVolume&rdquo;,
&ldquo;ec2:CreateSnapshot&rdquo;,
&ldquo;ec2:CreateTags&rdquo;,
&ldquo;ec2:CreateVolume&rdquo;,
&ldquo;ec2:DeleteSnapshot&rdquo;,
&ldquo;ec2:DeleteTags&rdquo;,
&ldquo;ec2:DeleteVolume&rdquo;,
&ldquo;ec2:DescribeInstances&rdquo;,
&ldquo;ec2:DescribeSnapshots&rdquo;,
&ldquo;ec2:DescribeTags&rdquo;,
&ldquo;ec2:DescribeVolumes&rdquo;,
&ldquo;ec2:DescribeVolumesModifications&rdquo;,
&ldquo;ec2:DetachVolume&rdquo;,
&ldquo;ec2:ModifyVolume&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;*&rdquo;
}
]
}</p>
</td>
</tr>
<tr>
<td>
<code>networkARN</code></br>
<em>
string
</em>
</td>
<td>
<p>networkARN is an ARN value referencing a role appropriate for the Network Operator.</p>
<p>The following is an example of a valid policy document:</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;ec2:DescribeInstances&rdquo;,
&ldquo;ec2:DescribeInstanceStatus&rdquo;,
&ldquo;ec2:DescribeInstanceTypes&rdquo;,
&ldquo;ec2:UnassignPrivateIpAddresses&rdquo;,
&ldquo;ec2:AssignPrivateIpAddresses&rdquo;,
&ldquo;ec2:UnassignIpv6Addresses&rdquo;,
&ldquo;ec2:AssignIpv6Addresses&rdquo;,
&ldquo;ec2:DescribeSubnets&rdquo;,
&ldquo;ec2:DescribeNetworkInterfaces&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;*&rdquo;
}
]
}</p>
</td>
</tr>
<tr>
<td>
<code>kubeCloudControllerARN</code></br>
<em>
string
</em>
</td>
<td>
<p>kubeCloudControllerARN is an ARN value referencing a role appropriate for the KCM/KCC.
Source: <a href="https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies">https://cloud-provider-aws.sigs.k8s.io/prerequisites/#iam-policies</a></p>
<p>The following is an example of a valid policy document:</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Action&rdquo;: [
&ldquo;autoscaling:DescribeAutoScalingGroups&rdquo;,
&ldquo;autoscaling:DescribeLaunchConfigurations&rdquo;,
&ldquo;autoscaling:DescribeTags&rdquo;,
&ldquo;ec2:DescribeAvailabilityZones&rdquo;,
&ldquo;ec2:DescribeInstances&rdquo;,
&ldquo;ec2:DescribeImages&rdquo;,
&ldquo;ec2:DescribeRegions&rdquo;,
&ldquo;ec2:DescribeRouteTables&rdquo;,
&ldquo;ec2:DescribeSecurityGroups&rdquo;,
&ldquo;ec2:DescribeSubnets&rdquo;,
&ldquo;ec2:DescribeVolumes&rdquo;,
&ldquo;ec2:CreateSecurityGroup&rdquo;,
&ldquo;ec2:CreateTags&rdquo;,
&ldquo;ec2:CreateVolume&rdquo;,
&ldquo;ec2:ModifyInstanceAttribute&rdquo;,
&ldquo;ec2:ModifyVolume&rdquo;,
&ldquo;ec2:AttachVolume&rdquo;,
&ldquo;ec2:AuthorizeSecurityGroupIngress&rdquo;,
&ldquo;ec2:CreateRoute&rdquo;,
&ldquo;ec2:DeleteRoute&rdquo;,
&ldquo;ec2:DeleteSecurityGroup&rdquo;,
&ldquo;ec2:DeleteVolume&rdquo;,
&ldquo;ec2:DetachVolume&rdquo;,
&ldquo;ec2:RevokeSecurityGroupIngress&rdquo;,
&ldquo;ec2:DescribeVpcs&rdquo;,
&ldquo;elasticloadbalancing:AddTags&rdquo;,
&ldquo;elasticloadbalancing:AttachLoadBalancerToSubnets&rdquo;,
&ldquo;elasticloadbalancing:ApplySecurityGroupsToLoadBalancer&rdquo;,
&ldquo;elasticloadbalancing:CreateLoadBalancer&rdquo;,
&ldquo;elasticloadbalancing:CreateLoadBalancerPolicy&rdquo;,
&ldquo;elasticloadbalancing:CreateLoadBalancerListeners&rdquo;,
&ldquo;elasticloadbalancing:ConfigureHealthCheck&rdquo;,
&ldquo;elasticloadbalancing:DeleteLoadBalancer&rdquo;,
&ldquo;elasticloadbalancing:DeleteLoadBalancerListeners&rdquo;,
&ldquo;elasticloadbalancing:DescribeLoadBalancers&rdquo;,
&ldquo;elasticloadbalancing:DescribeLoadBalancerAttributes&rdquo;,
&ldquo;elasticloadbalancing:DetachLoadBalancerFromSubnets&rdquo;,
&ldquo;elasticloadbalancing:DeregisterInstancesFromLoadBalancer&rdquo;,
&ldquo;elasticloadbalancing:ModifyLoadBalancerAttributes&rdquo;,
&ldquo;elasticloadbalancing:RegisterInstancesWithLoadBalancer&rdquo;,
&ldquo;elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer&rdquo;,
&ldquo;elasticloadbalancing:AddTags&rdquo;,
&ldquo;elasticloadbalancing:CreateListener&rdquo;,
&ldquo;elasticloadbalancing:CreateTargetGroup&rdquo;,
&ldquo;elasticloadbalancing:DeleteListener&rdquo;,
&ldquo;elasticloadbalancing:DeleteTargetGroup&rdquo;,
&ldquo;elasticloadbalancing:DeregisterTargets&rdquo;,
&ldquo;elasticloadbalancing:DescribeListeners&rdquo;,
&ldquo;elasticloadbalancing:DescribeLoadBalancerPolicies&rdquo;,
&ldquo;elasticloadbalancing:DescribeTargetGroups&rdquo;,
&ldquo;elasticloadbalancing:DescribeTargetHealth&rdquo;,
&ldquo;elasticloadbalancing:ModifyListener&rdquo;,
&ldquo;elasticloadbalancing:ModifyTargetGroup&rdquo;,
&ldquo;elasticloadbalancing:RegisterTargets&rdquo;,
&ldquo;elasticloadbalancing:SetLoadBalancerPoliciesOfListener&rdquo;,
&ldquo;iam:CreateServiceLinkedRole&rdquo;,
&ldquo;kms:DescribeKey&rdquo;
],
&ldquo;Resource&rdquo;: [
&ldquo;*&rdquo;
],
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;
}
]
}</p>
</td>
</tr>
<tr>
<td>
<code>nodePoolManagementARN</code></br>
<em>
string
</em>
</td>
<td>
<p>nodePoolManagementARN is an ARN value referencing a role appropriate for the CAPI Controller.</p>
<p>The following is an example of a valid policy document:</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Action&rdquo;: [
&ldquo;ec2:AssociateRouteTable&rdquo;,
&ldquo;ec2:AttachInternetGateway&rdquo;,
&ldquo;ec2:AuthorizeSecurityGroupIngress&rdquo;,
&ldquo;ec2:CreateInternetGateway&rdquo;,
&ldquo;ec2:CreateNatGateway&rdquo;,
&ldquo;ec2:CreateRoute&rdquo;,
&ldquo;ec2:CreateRouteTable&rdquo;,
&ldquo;ec2:CreateSecurityGroup&rdquo;,
&ldquo;ec2:CreateSubnet&rdquo;,
&ldquo;ec2:CreateTags&rdquo;,
&ldquo;ec2:DeleteInternetGateway&rdquo;,
&ldquo;ec2:DeleteNatGateway&rdquo;,
&ldquo;ec2:DeleteRouteTable&rdquo;,
&ldquo;ec2:DeleteSecurityGroup&rdquo;,
&ldquo;ec2:DeleteSubnet&rdquo;,
&ldquo;ec2:DeleteTags&rdquo;,
&ldquo;ec2:DescribeAccountAttributes&rdquo;,
&ldquo;ec2:DescribeAddresses&rdquo;,
&ldquo;ec2:DescribeAvailabilityZones&rdquo;,
&ldquo;ec2:DescribeImages&rdquo;,
&ldquo;ec2:DescribeInstances&rdquo;,
&ldquo;ec2:DescribeInternetGateways&rdquo;,
&ldquo;ec2:DescribeNatGateways&rdquo;,
&ldquo;ec2:DescribeNetworkInterfaces&rdquo;,
&ldquo;ec2:DescribeNetworkInterfaceAttribute&rdquo;,
&ldquo;ec2:DescribeRouteTables&rdquo;,
&ldquo;ec2:DescribeSecurityGroups&rdquo;,
&ldquo;ec2:DescribeSubnets&rdquo;,
&ldquo;ec2:DescribeVpcs&rdquo;,
&ldquo;ec2:DescribeVpcAttribute&rdquo;,
&ldquo;ec2:DescribeVolumes&rdquo;,
&ldquo;ec2:DetachInternetGateway&rdquo;,
&ldquo;ec2:DisassociateRouteTable&rdquo;,
&ldquo;ec2:DisassociateAddress&rdquo;,
&ldquo;ec2:ModifyInstanceAttribute&rdquo;,
&ldquo;ec2:ModifyNetworkInterfaceAttribute&rdquo;,
&ldquo;ec2:ModifySubnetAttribute&rdquo;,
&ldquo;ec2:RevokeSecurityGroupIngress&rdquo;,
&ldquo;ec2:RunInstances&rdquo;,
&ldquo;ec2:TerminateInstances&rdquo;,
&ldquo;tag:GetResources&rdquo;,
&ldquo;ec2:CreateLaunchTemplate&rdquo;,
&ldquo;ec2:CreateLaunchTemplateVersion&rdquo;,
&ldquo;ec2:DescribeLaunchTemplates&rdquo;,
&ldquo;ec2:DescribeLaunchTemplateVersions&rdquo;,
&ldquo;ec2:DeleteLaunchTemplate&rdquo;,
&ldquo;ec2:DeleteLaunchTemplateVersions&rdquo;
],
&ldquo;Resource&rdquo;: [
&ldquo;<em>&rdquo;
],
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;
},
{
&ldquo;Condition&rdquo;: {
&ldquo;StringLike&rdquo;: {
&ldquo;iam:AWSServiceName&rdquo;: &ldquo;elasticloadbalancing.amazonaws.com&rdquo;
}
},
&ldquo;Action&rdquo;: [
&ldquo;iam:CreateServiceLinkedRole&rdquo;
],
&ldquo;Resource&rdquo;: [
&ldquo;arn:</em>:iam::<em>:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing&rdquo;
],
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;
},
{
&ldquo;Action&rdquo;: [
&ldquo;iam:PassRole&rdquo;
],
&ldquo;Resource&rdquo;: [
&ldquo;arn:</em>:iam::<em>:role/</em>-worker-role&rdquo;
],
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;
},
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;kms:Decrypt&rdquo;,
&ldquo;kms:ReEncrypt&rdquo;,
&ldquo;kms:GenerateDataKeyWithoutPlainText&rdquo;,
&ldquo;kms:DescribeKey&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;<em>&rdquo;
},
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;kms:CreateGrant&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;</em>&rdquo;,
&ldquo;Condition&rdquo;: {
&ldquo;Bool&rdquo;: {
&ldquo;kms:GrantIsForAWSResource&rdquo;: true
}
}
}
]
}</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneOperatorARN</code></br>
<em>
string
</em>
</td>
<td>
<p>controlPlaneOperatorARN  is an ARN value referencing a role appropriate for the Control Plane Operator.</p>
<p>The following is an example of a valid policy document:</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;ec2:CreateVpcEndpoint&rdquo;,
&ldquo;ec2:DescribeVpcEndpoints&rdquo;,
&ldquo;ec2:ModifyVpcEndpoint&rdquo;,
&ldquo;ec2:DeleteVpcEndpoints&rdquo;,
&ldquo;ec2:CreateTags&rdquo;,
&ldquo;route53:ListHostedZones&rdquo;,
&ldquo;ec2:CreateSecurityGroup&rdquo;,
&ldquo;ec2:AuthorizeSecurityGroupIngress&rdquo;,
&ldquo;ec2:AuthorizeSecurityGroupEgress&rdquo;,
&ldquo;ec2:DeleteSecurityGroup&rdquo;,
&ldquo;ec2:RevokeSecurityGroupIngress&rdquo;,
&ldquo;ec2:RevokeSecurityGroupEgress&rdquo;,
&ldquo;ec2:DescribeSecurityGroups&rdquo;,
&ldquo;ec2:DescribeVpcs&rdquo;,
],
&ldquo;Resource&rdquo;: &ldquo;*&rdquo;
},
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;route53:ChangeResourceRecordSets&rdquo;,
&ldquo;route53:ListResourceRecordSets&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;arn:aws:route53:::%s&rdquo;
}
]
}</p>
</td>
</tr>
</tbody>
</table>
###AWSServiceEndpoint { #hypershift.openshift.io/v1beta1.AWSServiceEndpoint }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSPlatformSpec">AWSPlatformSpec</a>)
</p>
<p>
<p>AWSServiceEndpoint stores the configuration for services to
override existing defaults of AWS Services.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is the name of the AWS service.
This must be provided and cannot be empty.</p>
</td>
</tr>
<tr>
<td>
<code>url</code></br>
<em>
string
</em>
</td>
<td>
<p>url is fully qualified URI with scheme https, that overrides the default generated
endpoint for a client.
This must be provided and cannot be empty.</p>
</td>
</tr>
</tbody>
</table>
###AWSSharedVPC { #hypershift.openshift.io/v1beta1.AWSSharedVPC }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSPlatformSpec">AWSPlatformSpec</a>)
</p>
<p>
<p>AWSSharedVPC contains fields needed to create a HostedCluster using a VPC that has been
created and shared from a different AWS account than the AWS account where the cluster
is getting created.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>rolesRef</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSSharedVPCRolesRef">
AWSSharedVPCRolesRef
</a>
</em>
</td>
<td>
<p>rolesRef contains references to roles in the VPC owner account that enable a
HostedCluster on a shared VPC.</p>
</td>
</tr>
<tr>
<td>
<code>localZoneID</code></br>
<em>
string
</em>
</td>
<td>
<p>localZoneID is the ID of the route53 hosted zone for [cluster-name].hypershift.local that is
associated with the HostedCluster&rsquo;s VPC and exists in the VPC owner account.</p>
</td>
</tr>
</tbody>
</table>
###AWSSharedVPCRolesRef { #hypershift.openshift.io/v1beta1.AWSSharedVPCRolesRef }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSSharedVPC">AWSSharedVPC</a>)
</p>
<p>
<p>AWSSharedVPCRolesRef contains references to AWS IAM roles required for a shared VPC hosted cluster.
These roles must exist in the VPC owner&rsquo;s account.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>ingressARN</code></br>
<em>
string
</em>
</td>
<td>
<p>ingressARN is an ARN value referencing the role in the VPC owner account that allows the
ingress operator in the cluster account to create and manage records in the private DNS
hosted zone.</p>
<p>The referenced role must have a trust relationship that allows it to be assumed by the
ingress operator role in the VPC creator account.
Example:
{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Sid&rdquo;: &ldquo;Statement1&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Principal&rdquo;: {
&ldquo;AWS&rdquo;: &ldquo;arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-openshift-ingress&rdquo;
},
&ldquo;Action&rdquo;: &ldquo;sts:AssumeRole&rdquo;
}
]
}</p>
<p>The following is an example of the policy document for this role.
(Based on <a href="https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa-shared-vpc-config.html#rosa-sharing-vpc-dns-and-roles_rosa-shared-vpc-config">https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa-shared-vpc-config.html#rosa-sharing-vpc-dns-and-roles_rosa-shared-vpc-config</a>)</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;route53:ListHostedZones&rdquo;,
&ldquo;route53:ListHostedZonesByName&rdquo;,
&ldquo;route53:ChangeTagsForResource&rdquo;,
&ldquo;route53:GetAccountLimit&rdquo;,
&ldquo;route53:GetChange&rdquo;,
&ldquo;route53:GetHostedZone&rdquo;,
&ldquo;route53:ListTagsForResource&rdquo;,
&ldquo;route53:UpdateHostedZoneComment&rdquo;,
&ldquo;tag:GetResources&rdquo;,
&ldquo;tag:UntagResources&rdquo;
&ldquo;route53:ChangeResourceRecordSets&rdquo;,
&ldquo;route53:ListResourceRecordSets&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;*&rdquo;
},
]
}</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneARN</code></br>
<em>
string
</em>
</td>
<td>
<p>controlPlaneARN is an ARN value referencing the role in the VPC owner account that allows
the control plane operator in the cluster account to create and manage a VPC endpoint, its
corresponding Security Group, and DNS records in the hypershift local hosted zone.</p>
<p>The referenced role must have a trust relationship that allows it to be assumed by the
control plane operator role in the VPC creator account.
Example:
{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Sid&rdquo;: &ldquo;Statement1&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Principal&rdquo;: {
&ldquo;AWS&rdquo;: &ldquo;arn:aws:iam::[cluster-creator-account-id]:role/[infra-id]-control-plane-operator&rdquo;
},
&ldquo;Action&rdquo;: &ldquo;sts:AssumeRole&rdquo;
}
]
}</p>
<p>The following is an example of the policy document for this role.</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;ec2:CreateVpcEndpoint&rdquo;,
&ldquo;ec2:DescribeVpcEndpoints&rdquo;,
&ldquo;ec2:ModifyVpcEndpoint&rdquo;,
&ldquo;ec2:DeleteVpcEndpoints&rdquo;,
&ldquo;ec2:CreateTags&rdquo;,
&ldquo;route53:ListHostedZones&rdquo;,
&ldquo;ec2:CreateSecurityGroup&rdquo;,
&ldquo;ec2:AuthorizeSecurityGroupIngress&rdquo;,
&ldquo;ec2:AuthorizeSecurityGroupEgress&rdquo;,
&ldquo;ec2:DeleteSecurityGroup&rdquo;,
&ldquo;ec2:RevokeSecurityGroupIngress&rdquo;,
&ldquo;ec2:RevokeSecurityGroupEgress&rdquo;,
&ldquo;ec2:DescribeSecurityGroups&rdquo;,
&ldquo;ec2:DescribeVpcs&rdquo;,
&ldquo;route53:ChangeResourceRecordSets&rdquo;,
&ldquo;route53:ListResourceRecordSets&rdquo;
],
&ldquo;Resource&rdquo;: &ldquo;*&rdquo;
}
]
}</p>
</td>
</tr>
</tbody>
</table>
###AddressPair { #hypershift.openshift.io/v1beta1.AddressPair }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PortSpec">PortSpec</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>ipAddress</code></br>
<em>
string
</em>
</td>
<td>
<p>ipAddress is the IP address of the allowed address pair. Depending on
the configuration of Neutron, it may be supported to specify a CIDR
instead of a specific IP address.</p>
</td>
</tr>
</tbody>
</table>
###AgentNodePoolPlatform { #hypershift.openshift.io/v1beta1.AgentNodePoolPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>)
</p>
<p>
<p>AgentNodePoolPlatform specifies the configuration of a NodePool when operating
on the Agent platform.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>agentLabelSelector</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#labelselector-v1-meta">
Kubernetes meta/v1.LabelSelector
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>agentLabelSelector contains labels that must be set on an Agent in order to
be selected for a Machine.</p>
</td>
</tr>
</tbody>
</table>
###AgentPlatformSpec { #hypershift.openshift.io/v1beta1.AgentPlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>AgentPlatformSpec specifies configuration for agent-based installations.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>agentNamespace</code></br>
<em>
string
</em>
</td>
<td>
<p>agentNamespace is the namespace where to search for Agents for this cluster</p>
</td>
</tr>
</tbody>
</table>
###AllocateNodeCIDRsMode { #hypershift.openshift.io/v1beta1.AllocateNodeCIDRsMode }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">ClusterNetworking</a>)
</p>
<p>
<p>AllocateNodeCIDRsMode specifies whether the KCM manages node CIDR allocation.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Disabled&#34;</p></td>
<td><p>AllocateNodeCIDRsDisabled disables node CIDR allocation by the KCM</p>
</td>
</tr><tr><td><p>&#34;Enabled&#34;</p></td>
<td><p>AllocateNodeCIDRsEnabled enables node CIDR allocation by the KCM</p>
</td>
</tr></tbody>
</table>
###AllocationPool { #hypershift.openshift.io/v1beta1.AllocationPool }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.SubnetSpec">SubnetSpec</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>start</code></br>
<em>
string
</em>
</td>
<td>
<p>start represents the start of the AllocationPool, that is the lowest IP of the pool.</p>
</td>
</tr>
<tr>
<td>
<code>end</code></br>
<em>
string
</em>
</td>
<td>
<p>end represents the end of the AlloctionPool, that is the highest IP of the pool.</p>
</td>
</tr>
</tbody>
</table>
###AutoNode { #hypershift.openshift.io/v1beta1.AutoNode }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>AutoNode specifies the configuration for automatic node provisioning and lifecycle management.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>provisionerConfig,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ProvisionerConfig">
ProvisionerConfig
</a>
</em>
</td>
<td>
<p>provisionerConfig specifies the provisioner used for automatic node management.</p>
</td>
</tr>
</tbody>
</table>
###AutoNodeStatus { #hypershift.openshift.io/v1beta1.AutoNodeStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterStatus">HostedClusterStatus</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneStatus">HostedControlPlaneStatus</a>)
</p>
<p>
<p>AutoNodeStatus contains the observed state of the AutoNode provisioner.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>nodeCount</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeCount is the number of nodes fully provisioned by Karpenter.
These are node objects that exist in the cluster and carry the karpenter.sh/nodepool label.</p>
</td>
</tr>
<tr>
<td>
<code>nodeClaimCount</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeClaimCount is the total number of NodeClaims managed by Karpenter.
This represents what Karpenter intends to provision, whether or not the node object exists yet.</p>
</td>
</tr>
<tr>
<td>
<code>vcpus</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>vcpus is the total number of virtual CPUs across all Karpenter-managed nodes
that have registered and reported capacity. This is the sum of CPU capacity
from each NodeClaim whose corresponding node exists (status.nodeName is set).
This value is 0 when no Karpenter nodes are provisioned.
Used by the metrics collector for billing aggregation.</p>
</td>
</tr>
</tbody>
</table>
###AvailabilityPolicy { #hypershift.openshift.io/v1beta1.AvailabilityPolicy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>availabilityPolicy specifies a high level availability policy for components.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;HighlyAvailable&#34;</p></td>
<td><p>HighlyAvailable means components should be resilient to problems across
fault boundaries as defined by the component to which the policy is
attached. This usually means running critical workloads with 3 replicas and
with little or no toleration of disruption of the component.</p>
</td>
</tr><tr><td><p>&#34;SingleReplica&#34;</p></td>
<td><p>SingleReplica means components are not expected to be resilient to problems
across most fault boundaries associated with high availability. This
usually means running critical workloads with just 1 replica and with
toleration of full disruption of the component.</p>
</td>
</tr></tbody>
</table>
###AzureAuthenticationConfiguration { #hypershift.openshift.io/v1beta1.AzureAuthenticationConfiguration }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePlatformSpec">AzurePlatformSpec</a>)
</p>
<p>
<p>azureAuthenticationConfiguration is a discriminated union type that contains the Azure authentication configuration
for a Hosted Cluster. This configuration is used to determine how the Hosted Cluster authenticates with Azure&rsquo;s API,
either with managed identities or workload identities.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>azureAuthenticationConfigType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureAuthenticationType">
AzureAuthenticationType
</a>
</em>
</td>
<td>
<p>azureAuthenticationConfigType is the type of identity configuration used in the Hosted Cluster. This field is
used to determine which identity configuration is being used. Valid values are &ldquo;ManagedIdentities&rdquo; and
&ldquo;WorkloadIdentities&rdquo;.</p>
</td>
</tr>
<tr>
<td>
<code>managedIdentities</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureResourceManagedIdentities">
AzureResourceManagedIdentities
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>managedIdentities contains the managed identities needed for HCP control plane and data plane components that
authenticate with Azure&rsquo;s API.</p>
<p>These are required for managed Azure, also known as ARO HCP.</p>
</td>
</tr>
<tr>
<td>
<code>workloadIdentities</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureWorkloadIdentities">
AzureWorkloadIdentities
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>workloadIdentities is a struct of client IDs for each component that needs to authenticate with Azure&rsquo;s API in
self-managed Azure. These client IDs are used to authenticate with Azure cloud on both the control plane and data
plane.</p>
<p>This is required for self-managed Azure.</p>
</td>
</tr>
</tbody>
</table>
###AzureAuthenticationType { #hypershift.openshift.io/v1beta1.AzureAuthenticationType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureAuthenticationConfiguration">AzureAuthenticationConfiguration</a>)
</p>
<p>
<p>AzureAuthenticationType is a discriminated union type that contains the Azure authentication configuration for an
Azure Hosted Cluster. This type is used to determine which authentication configuration is being used. Valid values
are &ldquo;ManagedIdentities&rdquo; and &ldquo;WorkloadIdentities&rdquo;.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;ManagedIdentities&#34;</p></td>
<td><p>&ldquo;ManagedIdentities&rdquo; means that the Hosted Cluster is using managed identities to authenticate with Azure&rsquo;s API.
This is only valid for managed Azure, also known as ARO HCP.</p>
</td>
</tr><tr><td><p>&#34;WorkloadIdentities&#34;</p></td>
<td><p>&ldquo;WorkloadIdentities&rdquo; means that the Hosted Cluster is using workload identities to authenticate with Azure&rsquo;s API.
This is only valid for self-managed Azure.</p>
</td>
</tr></tbody>
</table>
###AzureClientID { #hypershift.openshift.io/v1beta1.AzureClientID }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">ManagedIdentity</a>, 
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">WorkloadIdentity</a>)
</p>
<p>
<p>AzureClientID is a string that represents the client ID of a managed identity.</p>
</p>
###AzureContainerRegistryConfig { #hypershift.openshift.io/v1beta1.AzureContainerRegistryConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePlatformSpec">AzurePlatformSpec</a>)
</p>
<p>
<p>AzureContainerRegistryConfig configures Azure Container Registry integration for a hosted cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>credentials,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialConfig">
AzureContainerRegistryCredentialConfig
</a>
</em>
</td>
<td>
<p>credentials configures authentication for worker nodes pulling images from ACR
using a user-assigned managed identity.
The identity does not need to be in the same subscription or resource group as the
HostedCluster, but it must be in the same Azure AD tenant. The management cluster&rsquo;s
CAPZ identity must have Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action
on the identity&rsquo;s scope to attach it to worker virtual machines at creation time.</p>
</td>
</tr>
</tbody>
</table>
###AzureContainerRegistryCredentialConfig { #hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureContainerRegistryConfig">AzureContainerRegistryConfig</a>)
</p>
<p>
<p>AzureContainerRegistryCredentialConfig configures authentication credentials for Azure Container Registry.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialType">
AzureContainerRegistryCredentialType
</a>
</em>
</td>
<td>
<p>type specifies the credential type used for ACR image pulls.</p>
</td>
</tr>
<tr>
<td>
<code>managedIdentity,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.UserAssignedManagedIdentity">
UserAssignedManagedIdentity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>managedIdentity identifies the user-assigned managed identity used for ACR image pulls.</p>
</td>
</tr>
</tbody>
</table>
###AzureContainerRegistryCredentialType { #hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialConfig">AzureContainerRegistryCredentialConfig</a>)
</p>
<p>
<p>AzureContainerRegistryCredentialType identifies the type of credential used for ACR image pulls.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;ManagedIdentity&#34;</p></td>
<td><p>AzureContainerRegistryCredentialManagedIdentity uses a user-assigned managed identity for ACR authentication.</p>
</td>
</tr></tbody>
</table>
###AzureDiagnosticsStorageAccountType { #hypershift.openshift.io/v1beta1.AzureDiagnosticsStorageAccountType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.Diagnostics">Diagnostics</a>)
</p>
<p>
<p>AzureDiagnosticsStorageAccountType specifies the type of storage account for storing Azure VM diagnostics data.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Disabled&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Managed&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;UserManaged&#34;</p></td>
<td></td>
</tr></tbody>
</table>
###AzureDiskPersistence { #hypershift.openshift.io/v1beta1.AzureDiskPersistence }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureNodePoolOSDisk">AzureNodePoolOSDisk</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Ephemeral&#34;</p></td>
<td><p>EphemeralDiskPersistence is the ephemeral disk type.</p>
</td>
</tr><tr><td><p>&#34;Persistent&#34;</p></td>
<td><p>PersistentDiskPersistence is the persistent disk type.</p>
</td>
</tr></tbody>
</table>
###AzureDiskStorageAccountType { #hypershift.openshift.io/v1beta1.AzureDiskStorageAccountType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureNodePoolOSDisk">AzureNodePoolOSDisk</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Premium_LRS&#34;</p></td>
<td><p>DiskStorageAccountTypesPremiumLRS - Premium SSD locally redundant storage. Best for production and performance sensitive
workloads.</p>
</td>
</tr><tr><td><p>&#34;PremiumV2_LRS&#34;</p></td>
<td><p>DiskStorageAccountTypesPremiumV2LRS - Premium SSD v2 locally redundant storage. Best for production and performance-sensitive
workloads that consistently require low latency and high IOPS and throughput.</p>
</td>
</tr><tr><td><p>&#34;Standard_LRS&#34;</p></td>
<td><p>DiskStorageAccountTypesStandardLRS - Standard HDD locally redundant storage. Best for backup, non-critical, and infrequent
access.</p>
</td>
</tr><tr><td><p>&#34;StandardSSD_LRS&#34;</p></td>
<td><p>DiskStorageAccountTypesStandardSSDLRS - Standard SSD locally redundant storage. Best for web servers, lightly used enterprise
applications and dev/test.</p>
</td>
</tr></tbody>
</table>
###AzureKMSKey { #hypershift.openshift.io/v1beta1.AzureKMSKey }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureKMSSpec">AzureKMSSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus">SecretEncryptionKeyStatus</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>keyVaultName</code></br>
<em>
string
</em>
</td>
<td>
<p>keyVaultName is the name of the keyvault. Must match criteria specified at <a href="https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name">https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name</a>
Your Microsoft Entra application used to create the cluster must be authorized to access this keyvault, e.g using the AzureCLI:
<code>az keyvault set-policy -n $KEYVAULT_NAME --key-permissions decrypt encrypt --spn &lt;YOUR APPLICATION CLIENT ID&gt;</code></p>
</td>
</tr>
<tr>
<td>
<code>keyName</code></br>
<em>
string
</em>
</td>
<td>
<p>keyName is the name of the keyvault key used for encrypt/decrypt</p>
</td>
</tr>
<tr>
<td>
<code>keyVersion</code></br>
<em>
string
</em>
</td>
<td>
<p>keyVersion contains the version of the key to use</p>
</td>
</tr>
</tbody>
</table>
###AzureKMSSpec { #hypershift.openshift.io/v1beta1.AzureKMSSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KMSSpec">KMSSpec</a>)
</p>
<p>
<p>AzureKMSSpec defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure key vault</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>activeKey</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureKMSKey">
AzureKMSKey
</a>
</em>
</td>
<td>
<p>activeKey defines the active key used to encrypt new secrets</p>
</td>
</tr>
<tr>
<td>
<code>backupKey</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureKMSKey">
AzureKMSKey
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>backupKey defines the old key during the rotation process so previously created
secrets can continue to be decrypted until they are all re-encrypted with the active key.</p>
<p>Deprecated: This field will be ignored when status.secretEncryption.activeKey is set.
The system automatically manages the previous key via the status field.</p>
</td>
</tr>
<tr>
<td>
<code>kms,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kms is a pre-existing managed identity used to authenticate with Azure KMS.
This is used for managed Azure (ARO HCP) clusters.
kms and workloadIdentity are mutually exclusive.</p>
</td>
</tr>
<tr>
<td>
<code>workloadIdentity,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>workloadIdentity contains the workload identity used to authenticate
with Azure Key Vault for KMS encryption via a token-minter sidecar.
This identity must have &ldquo;Key Vault Crypto User&rdquo; role on the Key Vault.
kms and workloadIdentity are mutually exclusive.</p>
</td>
</tr>
<tr>
<td>
<code>keyVaultAccess</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureKeyVaultAccessType">
AzureKeyVaultAccessType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>keyVaultAccess specifies how the Key Vault should be accessed.
When set to &ldquo;Private&rdquo;, the control plane routes Key Vault traffic through
the private router to reach the Key Vault&rsquo;s private endpoint in the customer VNet.
When set to &ldquo;Public&rdquo; or omitted, the Key Vault is accessed via its public endpoint.</p>
</td>
</tr>
</tbody>
</table>
###AzureKeyVaultAccessType { #hypershift.openshift.io/v1beta1.AzureKeyVaultAccessType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureKMSSpec">AzureKMSSpec</a>)
</p>
<p>
<p>AzureKeyVaultAccessType specifies the access method for the Azure Key Vault.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Private&#34;</p></td>
<td><p>AzureKeyVaultPrivate indicates the Key Vault is behind a private endpoint
and traffic must be routed through the private router (Swift).</p>
</td>
</tr><tr><td><p>&#34;Public&#34;</p></td>
<td><p>AzureKeyVaultPublic indicates the Key Vault is accessible via its public endpoint.</p>
</td>
</tr></tbody>
</table>
###AzureManagedIdentityResourceID { #hypershift.openshift.io/v1beta1.AzureManagedIdentityResourceID }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.UserAssignedManagedIdentity">UserAssignedManagedIdentity</a>)
</p>
<p>
<p>AzureManagedIdentityResourceID is an ARM resource ID for a user-assigned managed identity
in the format /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{name}.</p>
</p>
###AzureMarketplaceImage { #hypershift.openshift.io/v1beta1.AzureMarketplaceImage }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureVMImage">AzureVMImage</a>)
</p>
<p>
<p>AzureMarketplaceImage specifies the information needed to create an Azure VM from an Azure Marketplace image.
This struct supports two usage patterns:
1. Specify only imageGeneration to use marketplace defaults from the release payload (HyperShift will select the appropriate image)
2. Specify publisher, offer, sku, and version to use an explicit marketplace image (with optional imageGeneration)</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>imageGeneration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureVMImageGeneration">
AzureVMImageGeneration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageGeneration specifies the Hyper-V generation of the Azure Marketplace image to use for the nodes.
This field is used by HyperShift to select the appropriate marketplace image (Gen1 or Gen2)
from the release payload metadata when publisher, offer, sku, and version are not explicitly provided.
It is not passed to CAPZ (Cluster API Provider Azure); the generation information is
encoded into the SKU field that CAPZ uses.
Valid values are Gen1 and Gen2. If unspecified, defaults to Gen2.</p>
</td>
</tr>
<tr>
<td>
<code>publisher</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>publisher is the name of the organization that created the image.
It must be between 3 and 50 characters in length, and consist of only lowercase letters, numbers, and hyphens (-) and underscores (_).
It must start with a lowercase letter or a number.
TODO: Can we explain where a user might find this value, or provide an example of one they might want to use</p>
</td>
</tr>
<tr>
<td>
<code>offer</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>offer specifies the name of a group of related images created by the publisher.
TODO: What is the valid character set for this field? What about minimum and maximum lengths?</p>
</td>
</tr>
<tr>
<td>
<code>sku</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>sku specifies an instance of an offer, such as a major release of a distribution.
For example, 22<em>04-lts-gen2, 8-lvm-gen2.
The value must consist only of lowercase letters, numbers, and hyphens (-) and underscores (</em>).
TODO: What about length limits?</p>
</td>
</tr>
<tr>
<td>
<code>version</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>version specifies the version of an image sku. The allowed formats are Major.Minor.Build or &lsquo;latest&rsquo;. Major,
Minor, and Build are decimal numbers, e.g. &lsquo;1.2.0&rsquo;. Specify &lsquo;latest&rsquo; to use the latest version of an image available at
deployment time. Even if you use &lsquo;latest&rsquo;, the VM image will not automatically update after deploy time even if a
new version becomes available.</p>
</td>
</tr>
</tbody>
</table>
###AzureNodePoolOSDisk { #hypershift.openshift.io/v1beta1.AzureNodePoolOSDisk }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureNodePoolPlatform">AzureNodePoolPlatform</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>sizeGiB</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>sizeGiB is the size in GiB (1024^3 bytes) to assign to the OS disk.
This should be between 16 and 32,767.
When not set, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
The current default is 30.</p>
</td>
</tr>
<tr>
<td>
<code>diskStorageAccountType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureDiskStorageAccountType">
AzureDiskStorageAccountType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>diskStorageAccountType is the disk storage account type to use.
Valid values are Premium_LRS, PremiumV2_LRS, Standard_LRS, StandardSSD_LRS.
Note that Standard means a HDD.
UltraSSD_LRS is not supported for OS disks (see <a href="https://learn.microsoft.com/en-us/azure/virtual-machines/disks-types#disk-type-comparison">https://learn.microsoft.com/en-us/azure/virtual-machines/disks-types#disk-type-comparison</a>).
The disk performance is tied to the disk type, please refer to the Azure documentation for further details
<a href="https://docs.microsoft.com/en-us/azure/virtual-machines/disks-types#disk-type-comparison">https://docs.microsoft.com/en-us/azure/virtual-machines/disks-types#disk-type-comparison</a>.
When omitted this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
The current default is Premium SSD LRS.</p>
</td>
</tr>
<tr>
<td>
<code>encryptionSetID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>encryptionSetID is the ID of the DiskEncryptionSet resource to use to encrypt the OS disks for the VMs.
Configuring a DiskEncyptionSet allows greater control over the encryption of the VM OS disk at rest.
Can be used with either platform (Azure) managed, or customer managed encryption keys.
This needs to exist in the same subscription id listed in the Hosted Cluster, HostedCluster.Spec.Platform.Azure.SubscriptionID.
DiskEncryptionSetID should also exist in a resource group under the same subscription id and the same location
listed in the Hosted Cluster, HostedCluster.Spec.Platform.Azure.Location.
The encryptionSetID should be in the format <code>/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Copmute/diskEncryptionSets/{resourceName}</code>.
The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
The resourceName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores.
TODO: Are there other encryption related options we may want to expose, should this be in a struct as well?</p>
</td>
</tr>
<tr>
<td>
<code>persistence</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureDiskPersistence">
AzureDiskPersistence
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>persistence determines whether the OS disk should be persisted beyond the life of the VM.
Valid values are Persistent and Ephemeral.
When set to Ephmeral, the OS disk will not be persisted to Azure storage and implies restrictions to the VM size and caching type.
Full details can be found in the Azure documentation <a href="https://learn.microsoft.com/en-us/azure/virtual-machines/ephemeral-os-disks">https://learn.microsoft.com/en-us/azure/virtual-machines/ephemeral-os-disks</a>.
Ephmeral disks are primarily used for stateless applications, provide lower latency than Persistent disks and also incur no storage costs.
When not set, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.</p>
</td>
</tr>
</tbody>
</table>
###AzureNodePoolPlatform { #hypershift.openshift.io/v1beta1.AzureNodePoolPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>)
</p>
<p>
<p>AzureNodePoolPlatform is the platform specific configuration for an Azure node pool.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>vmSize</code></br>
<em>
string
</em>
</td>
<td>
<p>vmSize is the Azure VM instance type to use for the nodes being created in the nodepool.
The size naming convention is documented here <a href="https://learn.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions">https://learn.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions</a>.
Size names should start with a Family name, which is represented by one of more capital letters, and then be followed by the CPU count.
This is followed by 0 or more additional features, represented by a, b, d, i, l, m, p, t, s, C, and NP, refer to the Azure documentation for an explanation of these features.
Optionally an accelerator such as a GPU can be added, prefixed by an underscore, for example A100, H100 or MI300X.
The size may also be versioned, in which case it should be suffixed with _v<version> where the version is a number.
For example, &ldquo;D32ads_v5&rdquo; would be a suitable general purpose VM size, or &ldquo;ND96_MI300X_v5&rdquo; would represent a GPU accelerated VM.</p>
</td>
</tr>
<tr>
<td>
<code>image</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureVMImage">
AzureVMImage
</a>
</em>
</td>
<td>
<p>image is used to configure the VM boot image. If unset, the default image at the location below will be used and
is expected to exist: subscription/<subscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.Compute/images/rhcos.x86_64.vhd.
The <subscriptionID> and the <resourceGroupName> are expected to be the same resource group documented in the
Hosted Cluster specification respectively, HostedCluster.Spec.Platform.Azure.SubscriptionID and
HostedCluster.Spec.Platform.Azure.ResourceGroupName.</p>
</td>
</tr>
<tr>
<td>
<code>osDisk</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureNodePoolOSDisk">
AzureNodePoolOSDisk
</a>
</em>
</td>
<td>
<p>osDisk provides configuration for the OS disk for the nodepool.
This can be used to configure the size, storage account type, encryption options and whether the disk is persistent or ephemeral.
When not provided, the platform will choose reasonable defaults which are subject to change over time.
Review the fields within the osDisk for more details.</p>
</td>
</tr>
<tr>
<td>
<code>availabilityZone</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>availabilityZone is the failure domain identifier where the VM should be attached to. This must not be specified
for clusters in a location that does not support AvailabilityZone because it would cause a failure from Azure API.</p>
</td>
</tr>
<tr>
<td>
<code>encryptionAtHost</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>encryptionAtHost enables encryption at host on virtual machines. According to Microsoft documentation, this
means data stored on the VM host is encrypted at rest and flows encrypted to the Storage service. See
<a href="https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-powershell">https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-powershell</a>
for more information.</p>
</td>
</tr>
<tr>
<td>
<code>subnetID</code></br>
<em>
string
</em>
</td>
<td>
<p>subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
HostedCluster.Spec.Platform.Azure.SubscriptionID.
subnetID is immutable once set.
The subnetID should be in the format <code>/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}</code>.
The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.</p>
</td>
</tr>
<tr>
<td>
<code>diagnostics</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Diagnostics">
Diagnostics
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>diagnostics specifies the diagnostics settings for a virtual machine.
If not specified, then Boot diagnostics will be disabled.</p>
</td>
</tr>
</tbody>
</table>
###AzurePlatformSpec { #hypershift.openshift.io/v1beta1.AzurePlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>AzurePlatformSpec specifies configuration for clusters running on Azure. Generally, the HyperShift API assumes bring
your own (BYO) cloud infrastructure resources. For example, resources like a resource group, a subnet, or a vnet
would be pre-created and then their names would be used respectively in the ResourceGroupName, SubnetName, VnetName
fields of the Hosted Cluster CR. An existing cloud resource is expected to exist under the same SubscriptionID.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>cloud</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>cloud is the cloud environment identifier, valid values could be found here: <a href="https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33">https://github.com/Azure/go-autorest/blob/4c0e21ca2bbb3251fe7853e6f9df6397f53dd419/autorest/azure/environments.go#L33</a></p>
</td>
</tr>
<tr>
<td>
<code>location</code></br>
<em>
string
</em>
</td>
<td>
<p>location is the Azure region in where all the cloud infrastructure resources will be created.</p>
<p>Example: eastus</p>
</td>
</tr>
<tr>
<td>
<code>resourceGroup</code></br>
<em>
string
</em>
</td>
<td>
<p>resourceGroup is the name of an existing resource group where all cloud resources created by the Hosted
Cluster are to be placed. The resource group is expected to exist under the same subscription as SubscriptionID.</p>
<p>In ARO HCP, this will be the managed resource group where customer cloud resources will be created.</p>
<p>Resource group naming requirements can be found here: <a href="https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ResourceGroup.Name/">https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ResourceGroup.Name/</a>.</p>
<p>Example: if your resource group ID is /subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>, your
ResourceGroupName is <resourceGroupName>.</p>
</td>
</tr>
<tr>
<td>
<code>vnetID</code></br>
<em>
string
</em>
</td>
<td>
<p>vnetID is the ID of an existing VNET to use in creating VMs. The VNET can exist in a different resource group
other than the one specified in ResourceGroupName, but it must exist under the same subscription as
SubscriptionID.</p>
<p>In ARO HCP, this will be the ID of the customer provided VNET.</p>
<p>Example: /subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.Network/virtualNetworks/<vnetName></p>
</td>
</tr>
<tr>
<td>
<code>subnetID</code></br>
<em>
string
</em>
</td>
<td>
<p>subnetID is the subnet ID of an existing subnet where the nodes in the nodepool will be created. This can be a
different subnet than the one listed in the HostedCluster, HostedCluster.Spec.Platform.Azure.SubnetID, but must
exist in the same network, HostedCluster.Spec.Platform.Azure.VnetID, and must exist under the same subscription ID,
HostedCluster.Spec.Platform.Azure.SubscriptionID.
subnetID is immutable once set.
The subnetID should be in the format <code>/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}</code>.
The subscriptionId in the encryptionSetID must be a valid UUID. It should be 5 groups of hyphen separated hexadecimal characters in the form 8-4-4-4-12.
The resourceGroupName should be between 1 and 90 characters, consisting only of alphanumeric characters, hyphens, underscores, periods and parenthesis and must not end with a period (.) character.
The vnetName should be between 2 and 64 characters, consisting only of alphanumeric characters, hyphens, underscores and periods and must not end with either a period (.) or hyphen (-) character.
The subnetName should be between 1 and 80 characters, consisting only of alphanumeric characters, hyphens and underscores and must start with an alphanumeric character and must not end with a period (.) or hyphen (-) character.</p>
</td>
</tr>
<tr>
<td>
<code>subscriptionID</code></br>
<em>
string
</em>
</td>
<td>
<p>subscriptionID is a unique identifier for an Azure subscription used to manage resources.</p>
</td>
</tr>
<tr>
<td>
<code>securityGroupID</code></br>
<em>
string
</em>
</td>
<td>
<p>securityGroupID is the ID of an existing security group on the SubnetID. This field is provided as part of the
configuration for the Azure cloud provider, aka Azure cloud controller manager (CCM). This security group is
expected to exist under the same subscription as SubscriptionID.</p>
</td>
</tr>
<tr>
<td>
<code>azureAuthenticationConfig</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureAuthenticationConfiguration">
AzureAuthenticationConfiguration
</a>
</em>
</td>
<td>
<p>azureAuthenticationConfig is the type of Azure authentication configuration to use to authenticate with Azure&rsquo;s
Cloud API.</p>
</td>
</tr>
<tr>
<td>
<code>tenantID</code></br>
<em>
string
</em>
</td>
<td>
<p>tenantID is a unique identifier for the tenant where Azure resources will be created and managed in.</p>
</td>
</tr>
<tr>
<td>
<code>containerRegistry,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureContainerRegistryConfig">
AzureContainerRegistryConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>containerRegistry configures how worker nodes authenticate to Azure Container Registry (ACR).
When set, the managed identity is attached to worker virtual machines and its resource ID is
written into the worker cloud provider config so kubelet&rsquo;s ACR credential provider can
authenticate without image pull secrets.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>topology</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureTopologyType">
AzureTopologyType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>topology specifies the network topology of the API server endpoint for the hosted cluster.
- Public: The API server is accessible only via a public endpoint.
- PublicAndPrivate: The API server is accessible via both public and private endpoints.
- Private: The API server is accessible only via a private endpoint.
When omitted, this means no opinion and the platform is left to choose a reasonable
default, which is subject to change over time. The current default is Public.
This field must be set explicitly for self-hosted environments (WorkloadIdentities).
Transitions between PublicAndPrivate and Private are allowed after creation.
Transitions from Public to non-Public (or vice versa) are not allowed.
When set to Private or PublicAndPrivate, the private field must be provided.</p>
</td>
</tr>
<tr>
<td>
<code>private,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateSpec">
AzurePrivateSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>private configures private connectivity to the hosted cluster&rsquo;s API server.
This field is required when topology is Private or PublicAndPrivate, and must
not be set when topology is Public.
Once set at cluster creation, this field cannot be removed, and it cannot be
added to an existing cluster that was created without it.</p>
</td>
</tr>
</tbody>
</table>
###AzurePrivateLinkServiceSpec { #hypershift.openshift.io/v1beta1.AzurePrivateLinkServiceSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkService">AzurePrivateLinkService</a>)
</p>
<p>
<p>AzurePrivateLinkServiceSpec defines the desired state of AzurePrivateLinkService</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>loadBalancerIP</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>loadBalancerIP is the frontend IP address of the internal load balancer that
fronts the hosted control plane&rsquo;s API server. This field is populated automatically
by the control plane operator from the kube-apiserver service status.
It is not set by users directly.
When set, the value must be a valid IPv4 or IPv6 address.</p>
</td>
</tr>
<tr>
<td>
<code>subscriptionID</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureSubscriptionID">
AzureSubscriptionID
</a>
</em>
</td>
<td>
<p>subscriptionID is the Azure subscription ID where the Private Link Service
resources will be created. Must be a valid UUID consisting of hexadecimal
characters and hyphens in the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
where x is a hexadecimal digit <a href="e.g.," title="550e8400-e29b-41d4-a716-446655440000">0-9a-f</a>.</p>
</td>
</tr>
<tr>
<td>
<code>resourceGroupName</code></br>
<em>
string
</em>
</td>
<td>
<p>resourceGroupName is the name of the Azure resource group where the Private Link
Service resources will be created. Must be 1-90 characters consisting of
alphanumerics, underscores, hyphens, periods, and parentheses. Cannot end with a period.
See <a href="https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules">https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules</a></p>
</td>
</tr>
<tr>
<td>
<code>location</code></br>
<em>
string
</em>
</td>
<td>
<p>location is the Azure region where the Private Link Service resources will be
created (e.g., &ldquo;eastus&rdquo;, &ldquo;westeurope&rdquo;, &ldquo;centralus&rdquo;). Must match the region
of the management cluster.</p>
</td>
</tr>
<tr>
<td>
<code>natSubnetID</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureSubnetResourceID">
AzureSubnetResourceID
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>natSubnetID is the full Azure resource ID of the subnet used for Private Link Service
NAT IP allocation. This subnet must have privateLinkServiceNetworkPolicies disabled.
If not provided, the controller will auto-create a NAT subnet in the HC&rsquo;s VNet.
The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}</p>
</td>
</tr>
<tr>
<td>
<code>additionalAllowedSubscriptions</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureSubscriptionID">
[]AzureSubscriptionID
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>additionalAllowedSubscriptions is an optional list of additional Azure subscription IDs
permitted to create Private Endpoints to the Private Link Service. The guest cluster&rsquo;s
own subscription (derived from guestSubnetID) is always automatically allowed, so it
does not need to be listed here.
Each entry must be a valid UUID of exactly 36 characters consisting of
lowercase hexadecimal characters and hyphens in the format
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx where x is a hexadecimal digit <a href="e.g.," title="550e8400-e29b-41d4-a716-446655440000">0-9a-f</a>.
A maximum of 50 subscriptions may be specified.</p>
</td>
</tr>
<tr>
<td>
<code>guestSubnetID</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureSubnetResourceID">
AzureSubnetResourceID
</a>
</em>
</td>
<td>
<p>guestSubnetID is the full Azure resource ID of the subnet in the guest VNet where
the Private Endpoint will be created.
The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}</p>
</td>
</tr>
<tr>
<td>
<code>guestVNetID</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureVNetResourceID">
AzureVNetResourceID
</a>
</em>
</td>
<td>
<p>guestVNetID is the full Azure resource ID of the guest VNet for Private DNS zone linking.
The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/virtualNetworks/{vnetName}</p>
</td>
</tr>
<tr>
<td>
<code>baseDomain</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>baseDomain is the cluster&rsquo;s base domain (e.g., &ldquo;example.hypershift.azure.devcluster.openshift.com&rdquo;).
Used to create a Private DNS Zone so that worker VMs can resolve the API and OAuth
hostnames (api-<name>.<baseDomain>, oauth-<name>.<baseDomain>) to the Private Endpoint IP.
Persisted in spec so that deletion does not depend on the HostedControlPlane still existing.
baseDomain must be at most 253 characters in length and must consist only of
lowercase alphanumeric characters, hyphens, and periods. Each period-separated segment
must start and end with an alphanumeric character.</p>
</td>
</tr>
</tbody>
</table>
###AzurePrivateLinkServiceStatus { #hypershift.openshift.io/v1beta1.AzurePrivateLinkServiceStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkService">AzurePrivateLinkService</a>)
</p>
<p>
<p>AzurePrivateLinkServiceStatus defines the observed state of AzurePrivateLinkService</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>conditions</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#condition-v1-meta">
[]Kubernetes meta/v1.Condition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>conditions represent the current state of PLS infrastructure.
Current condition types are: &ldquo;AzurePrivateLinkServiceAvailable&rdquo;, &ldquo;AzureInternalLoadBalancerAvailable&rdquo;,
&ldquo;AzurePLSCreated&rdquo;, &ldquo;AzurePrivateEndpointAvailable&rdquo;, &ldquo;AzurePrivateDNSAvailable&rdquo;</p>
</td>
</tr>
<tr>
<td>
<code>internalLoadBalancerID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>internalLoadBalancerID is the Azure resource ID of the internal load balancer
fronting the hosted control plane. The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/loadBalancers/{loadBalancerName}
where subscriptionID is a UUID, resourceGroup is up to 90 characters, and
loadBalancerName is up to 80 characters.</p>
</td>
</tr>
<tr>
<td>
<code>privateLinkServiceID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>privateLinkServiceID is the Azure resource ID of the Private Link Service.
The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/privateLinkServices/{plsName}</p>
</td>
</tr>
<tr>
<td>
<code>privateLinkServiceAlias</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>privateLinkServiceAlias is the globally unique alias for the Private Link Service,
auto-generated by Azure in the format {plsName}.{guid}.{region}.azure.privatelinkservice.
MaxLength=170 covers: PLS name (80) + GUID (36) + region (19, e.g. &ldquo;southcentralusstage&rdquo;)</p>
</td>
</tr>
<tr>
<td>
<code>privateEndpointID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>privateEndpointID is the Azure resource ID of the Private Endpoint.
The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/privateEndpoints/{endpointName}</p>
</td>
</tr>
<tr>
<td>
<code>privateEndpointIP</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>privateEndpointIP is the private IP address assigned to the Private Endpoint.
Must be a valid IPv4 (e.g., &ldquo;10.0.1.4&rdquo;) or IPv6 address.</p>
</td>
</tr>
<tr>
<td>
<code>privateDNSZoneID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>privateDNSZoneID is the Azure resource ID of the Private DNS Zone.
The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/privateDnsZones/{zoneName}</p>
</td>
</tr>
<tr>
<td>
<code>dnsZoneName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>dnsZoneName is the Private DNS zone name (derived from the KAS hostname).
Persisted at creation time so that deletion does not depend on the
HostedControlPlane still existing.
Must be a valid DNS domain name consisting of alphanumeric characters, hyphens,
and periods, where each segment starts and ends with an alphanumeric character
(e.g., &ldquo;api-mycluster.example.hypershift.azure.devcluster.openshift.com&rdquo;).</p>
</td>
</tr>
<tr>
<td>
<code>baseDomainDNSZoneID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>baseDomainDNSZoneID is the Azure resource ID of the base domain Private DNS Zone.
The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/privateDnsZones/{zoneName}</p>
</td>
</tr>
</tbody>
</table>
###AzurePrivateLinkSpec { #hypershift.openshift.io/v1beta1.AzurePrivateLinkSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateSpec">AzurePrivateSpec</a>)
</p>
<p>
<p>AzurePrivateLinkSpec configures Azure Private Link Service connectivity.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>natSubnetID</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureSubnetResourceID">
AzureSubnetResourceID
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>natSubnetID is the Azure resource ID of the subnet used for Private Link Service NAT IP allocation.
This subnet must have privateLinkServiceNetworkPolicies disabled.
If not provided, the controller will auto-create a NAT subnet in the HC&rsquo;s VNet.
The expected format is:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}
The maximum length is 355 characters.</p>
</td>
</tr>
<tr>
<td>
<code>additionalAllowedSubscriptions</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureSubscriptionID">
[]AzureSubscriptionID
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>additionalAllowedSubscriptions is an optional list of additional Azure subscription IDs
permitted to create Private Endpoints to the Private Link Service. The guest cluster&rsquo;s
own subscription is always automatically allowed, so it does not need to be listed here.
Each item must be a valid UUID consisting of lowercase hexadecimal characters and hyphens,
in the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
(e.g., &ldquo;550e8400-e29b-41d4-a716-446655440000&rdquo;). A maximum of 50 subscriptions may be specified.</p>
</td>
</tr>
</tbody>
</table>
###AzurePrivateSpec { #hypershift.openshift.io/v1beta1.AzurePrivateSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePlatformSpec">AzurePlatformSpec</a>)
</p>
<p>
<p>AzurePrivateSpec configures private connectivity to an Azure hosted cluster&rsquo;s API server.
It is a discriminated union keyed on the type field, which selects the private connectivity
mechanism.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateType">
AzurePrivateType
</a>
</em>
</td>
<td>
<p>type specifies the private connectivity mechanism used for the hosted cluster&rsquo;s API server.
&ldquo;PrivateLink&rdquo; selects Azure Private Link Service for private API server access.
&ldquo;Swift&rdquo; selects Azure Swift pod networking for private API server access, used by ARO HCP.
This field is immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>privateLink,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkSpec">
AzurePrivateLinkSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>privateLink configures Azure Private Link Service for private API server access.
This field is required when type is &ldquo;PrivateLink&rdquo; and must not be set otherwise.</p>
</td>
</tr>
<tr>
<td>
<code>swift,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureSwiftSpec">
AzureSwiftSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>swift configures Azure Swift pod networking for private API server access.
Swift networking requires the management cluster to be pre-configured with
Azure Swift support; this is not provisioned by HyperShift automatically.
This field is required when type is &ldquo;Swift&rdquo; and must not be set otherwise.</p>
</td>
</tr>
</tbody>
</table>
###AzurePrivateType { #hypershift.openshift.io/v1beta1.AzurePrivateType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateSpec">AzurePrivateSpec</a>)
</p>
<p>
<p>AzurePrivateType specifies the type of private connectivity mechanism used for the Azure
hosted cluster&rsquo;s API server. This acts as the discriminator for the AzurePrivateSpec union.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;PrivateLink&#34;</p></td>
<td><p>AzurePrivateTypePrivateLink specifies private connectivity using Azure Private Link Service.
In this mode, the operator creates a Private Link Service backed by the management cluster&rsquo;s
internal load balancer, and a Private Endpoint in the guest VNet for private API server access.</p>
</td>
</tr><tr><td><p>&#34;Swift&#34;</p></td>
<td><p>AzurePrivateTypeSwift specifies private connectivity using Azure Swift pod networking.
In this mode, Azure Swift assigns a private IP from the customer VNet directly
to the hosted cluster&rsquo;s router pods, providing private API server access without a
separate Private Link Service. This is used by ARO HCP managed clusters.</p>
</td>
</tr></tbody>
</table>
###AzureResourceManagedIdentities { #hypershift.openshift.io/v1beta1.AzureResourceManagedIdentities }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureAuthenticationConfiguration">AzureAuthenticationConfiguration</a>)
</p>
<p>
<p>AzureResourceManagedIdentities contains the managed identities needed for HCP control plane and data plane components
that authenticate with Azure&rsquo;s API.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>controlPlane</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneManagedIdentities">
ControlPlaneManagedIdentities
</a>
</em>
</td>
<td>
<p>controlPlane contains the client IDs of all the managed identities on the HCP control plane needing to
authenticate with Azure&rsquo;s API.</p>
</td>
</tr>
<tr>
<td>
<code>dataPlane</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.DataPlaneManagedIdentities">
DataPlaneManagedIdentities
</a>
</em>
</td>
<td>
<p>dataPlane contains the client IDs of all the managed identities on the data plane needing to authenticate with
Azure&rsquo;s API.</p>
</td>
</tr>
</tbody>
</table>
###AzureSubnetResourceID { #hypershift.openshift.io/v1beta1.AzureSubnetResourceID }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkServiceSpec">AzurePrivateLinkServiceSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkSpec">AzurePrivateLinkSpec</a>)
</p>
<p>
<p>AzureSubnetResourceID is a full Azure resource ID for a subnet.
The expected format is:</p>
<pre><code>/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}
</code></pre>
</p>
###AzureSubscriptionID { #hypershift.openshift.io/v1beta1.AzureSubscriptionID }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkServiceSpec">AzurePrivateLinkServiceSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkSpec">AzurePrivateLinkSpec</a>)
</p>
<p>
<p>AzureSubscriptionID is an Azure subscription ID in UUID format.
Must be exactly 36 characters consisting of hexadecimal digits [0-9a-fA-F] and hyphens
in the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (e.g., &ldquo;550e8400-e29b-41d4-a716-446655440000&rdquo;).</p>
</p>
###AzureSwiftSpec { #hypershift.openshift.io/v1beta1.AzureSwiftSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateSpec">AzurePrivateSpec</a>)
</p>
<p>
<p>AzureSwiftSpec configures Azure Swift pod networking for private API server access.
Swift assigns a private IP from the customer VNet directly to the hosted cluster&rsquo;s
router pods, providing private connectivity without a separate Private Link Service.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>podNetworkInstance</code></br>
<em>
string
</em>
</td>
<td>
<p>podNetworkInstance is the name of a PodNetworkInstance custom resource in the
hosted control plane namespace. This resource configures Azure Swift pod networking
for private connectivity to the hosted cluster&rsquo;s router pods.
The value must be a valid Kubernetes object name (RFC 1123 DNS label): lowercase
alphanumeric characters or hyphens, must start and end with an alphanumeric character.
This field is immutable once set.</p>
</td>
</tr>
</tbody>
</table>
###AzureTopologyType { #hypershift.openshift.io/v1beta1.AzureTopologyType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePlatformSpec">AzurePlatformSpec</a>)
</p>
<p>
<p>AzureTopologyType specifies the network topology of the Azure API server endpoint.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Private&#34;</p></td>
<td><p>AzureTopologyPrivate indicates the API server is accessible only via a private endpoint.</p>
</td>
</tr><tr><td><p>&#34;Public&#34;</p></td>
<td><p>AzureTopologyPublic indicates the API server is accessible only via a public endpoint.</p>
</td>
</tr><tr><td><p>&#34;PublicAndPrivate&#34;</p></td>
<td><p>AzureTopologyPublicAndPrivate indicates the API server is accessible via both public and private endpoints.</p>
</td>
</tr></tbody>
</table>
###AzureVMImage { #hypershift.openshift.io/v1beta1.AzureVMImage }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureNodePoolPlatform">AzureNodePoolPlatform</a>)
</p>
<p>
<p>AzureVMImage represents the different types of boot image sources that can be provided for an Azure VM.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureVMImageType">
AzureVMImageType
</a>
</em>
</td>
<td>
<p>type is the type of image data that will be provided to the Azure VM.
Valid values are &ldquo;ImageID&rdquo; and &ldquo;AzureMarketplace&rdquo;.
ImageID means is used for legacy managed VM images. This is where the user uploads a VM image directly to their resource group.
AzureMarketplace means the VM will boot from an Azure Marketplace image.
Marketplace images are preconfigured and published by the OS vendors and may include preconfigured software for the VM.
When Type is &ldquo;AzureMarketplace&rdquo;, you can either:
1. Specify only imageGeneration to use marketplace defaults from the release payload
2. Specify publisher, offer, sku, and version to use an explicit marketplace image
3. Specify all fields (imageGeneration along with publisher, offer, sku, version)</p>
</td>
</tr>
<tr>
<td>
<code>imageID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageID is the Azure resource ID of a VHD image to use to boot the Azure VMs from.
TODO: What is the valid character set for this field? What about minimum and maximum lengths?</p>
</td>
</tr>
<tr>
<td>
<code>azureMarketplace</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureMarketplaceImage">
AzureMarketplaceImage
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>azureMarketplace contains the Azure Marketplace image info to use to boot the Azure VMs from.</p>
</td>
</tr>
</tbody>
</table>
###AzureVMImageGeneration { #hypershift.openshift.io/v1beta1.AzureVMImageGeneration }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureMarketplaceImage">AzureMarketplaceImage</a>)
</p>
<p>
<p>AzureVMImageGeneration represents the Hyper-V generation of an Azure VM image.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Gen1&#34;</p></td>
<td><p>Gen1 represents Hyper-V Generation 1 VMs</p>
</td>
</tr><tr><td><p>&#34;Gen2&#34;</p></td>
<td><p>Gen2 represents Hyper-V Generation 2 VMs</p>
</td>
</tr></tbody>
</table>
###AzureVMImageType { #hypershift.openshift.io/v1beta1.AzureVMImageType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureVMImage">AzureVMImage</a>)
</p>
<p>
<p>AzureVMImageType is used to specify the source of the Azure VM boot image.
Valid values are ImageID and AzureMarketplace.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;AzureMarketplace&#34;</p></td>
<td><p>AzureMarketplace is used to specify the Azure Marketplace image info to use to boot the Azure VMs from.</p>
</td>
</tr><tr><td><p>&#34;ImageID&#34;</p></td>
<td><p>ImageID is the used to specify that an Azure resource ID of a VHD image is used to boot the Azure VMs from.</p>
</td>
</tr></tbody>
</table>
###AzureVNetResourceID { #hypershift.openshift.io/v1beta1.AzureVNetResourceID }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzurePrivateLinkServiceSpec">AzurePrivateLinkServiceSpec</a>)
</p>
<p>
<p>AzureVNetResourceID is a full Azure resource ID for a virtual network.
The expected format is:</p>
<pre><code>/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/virtualNetworks/{vnetName}
</code></pre>
</p>
###AzureWorkloadIdentities { #hypershift.openshift.io/v1beta1.AzureWorkloadIdentities }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureAuthenticationConfiguration">AzureAuthenticationConfiguration</a>)
</p>
<p>
<p>AzureWorkloadIdentities is a struct that contains the client IDs of all the managed identities in self-managed Azure
needing to authenticate with Azure&rsquo;s API.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>imageRegistry</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<p>imageRegistry is the client ID of a federated managed identity, associated with cluster-image-registry-operator, used in
workload identity authentication.</p>
</td>
</tr>
<tr>
<td>
<code>ingress</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<p>ingress is the client ID of a federated managed identity, associated with cluster-ingress-operator, used in
workload identity authentication.</p>
</td>
</tr>
<tr>
<td>
<code>file</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<p>file is the client ID of a federated managed identity, associated with cluster-storage-operator-file,
used in workload identity authentication.</p>
</td>
</tr>
<tr>
<td>
<code>disk</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<p>disk is the client ID of a federated managed identity, associated with cluster-storage-operator-disk,
used in workload identity authentication.</p>
</td>
</tr>
<tr>
<td>
<code>nodePoolManagement</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<p>nodePoolManagement is the client ID of a federated managed identity, associated with cluster-api-provider-azure, used
in workload identity authentication.</p>
</td>
</tr>
<tr>
<td>
<code>cloudProvider</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<p>cloudProvider is the client ID of a federated managed identity, associated with azure-cloud-provider, used in
workload identity authentication.</p>
</td>
</tr>
<tr>
<td>
<code>network</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<p>network is the client ID of a federated managed identity, associated with cluster-network-operator, used in
workload identity authentication.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneOperator,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.WorkloadIdentity">
WorkloadIdentity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controlPlaneOperator is the client ID of a federated managed identity, associated with control-plane-operator,
used in workload identity authentication for Azure Private Link Service operations.</p>
</td>
</tr>
</tbody>
</table>
###CIDRBlock { #hypershift.openshift.io/v1beta1.CIDRBlock }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.APIServerNetworking">APIServerNetworking</a>)
</p>
<p>
</p>
###Capabilities { #hypershift.openshift.io/v1beta1.Capabilities }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>capabilities allows enabling or disabling optional components at install time.
When this is not supplied, the cluster will use the DefaultCapabilitySet defined for the respective
OpenShift version, minus the baremetal capability.
Once set, it cannot be changed.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>enabled</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OptionalCapability">
[]OptionalCapability
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>enabled when specified, explicitly enables the specified capabilitíes on the hosted cluster.
Once set, this field cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>disabled</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OptionalCapability">
[]OptionalCapability
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>disabled when specified, explicitly disables the specified capabilitíes on the hosted cluster.
Once set, this field cannot be changed.</p>
<p>Note: Disabling &lsquo;openshift-samples&rsquo;,&lsquo;Insights&rsquo;, &lsquo;Console&rsquo;, &lsquo;NodeTuning&rsquo;, &lsquo;Ingress&rsquo; are only supported in OpenShift versions 4.20 and above.</p>
</td>
</tr>
</tbody>
</table>
###CapacityReservationOptions { #hypershift.openshift.io/v1beta1.CapacityReservationOptions }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlacementOptions">PlacementOptions</a>)
</p>
<p>
<p>CapacityReservationOptions specifies Capacity Reservation options for the NodePool instances.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>id</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>id specifies the target Capacity Reservation into which the EC2 instances should be launched.
Must follow the format: cr- followed by 17 lowercase hexadecimal characters. For example: cr-0123456789abcdef0
When empty, no specific Capacity Reservation is targeted.</p>
<p>When specified, preference cannot be set to &lsquo;None&rsquo; or &lsquo;Open&rsquo; as these
are mutually exclusive with targeting a specific reservation. Use preference &lsquo;CapacityReservationsOnly&rsquo;
or omit preference field when targeting a specific reservation.</p>
</td>
</tr>
<tr>
<td>
<code>marketType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MarketType">
MarketType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>marketType specifies the market type of the CapacityReservation for the EC2 instances.</p>
<p>Deprecated: Use placement.marketType instead. This field is maintained for backward compatibility.
When both placement.marketType and capacityReservation.marketType are set, placement.marketType takes precedence.</p>
<p>Valid values are OnDemand, CapacityBlocks and omitted:
- &ldquo;OnDemand&rdquo;: EC2 instances run as standard On-Demand instances.
- &ldquo;CapacityBlocks&rdquo;: scheduled pre-purchased compute capacity. Recommended for GPU/ML workloads.</p>
<p>When set to &lsquo;CapacityBlocks&rsquo;, a specific Capacity Reservation ID must be provided.</p>
</td>
</tr>
<tr>
<td>
<code>preference</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.CapacityReservationPreference">
CapacityReservationPreference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>preference specifies the preference for use of Capacity Reservations by the instance. Valid values include:
- &ldquo;&rdquo;: No preference (platform default)
- &ldquo;Open&rdquo;: The instance may make use of open Capacity Reservations that match its AZ and InstanceType
- &ldquo;None&rdquo;: The instance may not make use of any Capacity Reservations. This is to conserve open reservations for desired workloads
- &ldquo;CapacityReservationsOnly&rdquo;: The instance will only run if matched or targeted to a Capacity Reservation</p>
<p>Cannot be set to &lsquo;None&rsquo; or &lsquo;Open&rsquo; when a specific Capacity Reservation ID is provided,
as targeting a specific reservation is mutually exclusive with these general preference settings.</p>
</td>
</tr>
</tbody>
</table>
###CapacityReservationPreference { #hypershift.openshift.io/v1beta1.CapacityReservationPreference }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.CapacityReservationOptions">CapacityReservationOptions</a>)
</p>
<p>
<p>CapacityReservationPreference describes the preferred use of capacity reservations
of an instance</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;None&#34;</p></td>
<td><p>CapacityReservationPreferenceNone the instance may not make use of any Capacity Reservations. This is to conserve open reservations for desired workloads</p>
</td>
</tr><tr><td><p>&#34;CapacityReservationsOnly&#34;</p></td>
<td><p>CapacityReservationPreferenceOnly the instance will only run if matched or targeted to a Capacity Reservation</p>
</td>
</tr><tr><td><p>&#34;Open&#34;</p></td>
<td><p>CapacityReservationPreferenceOpen the instance may make use of open Capacity Reservations that match its AZ and InstanceType.</p>
</td>
</tr></tbody>
</table>
###CertificateSigningRequestApprovalSpec { #hypershift.openshift.io/v1beta1.CertificateSigningRequestApprovalSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.CertificateSigningRequestApproval">CertificateSigningRequestApproval</a>)
</p>
<p>
<p>CertificateSigningRequestApprovalSpec defines the desired state of CertificateSigningRequestApproval</p>
</p>
###CertificateSigningRequestApprovalStatus { #hypershift.openshift.io/v1beta1.CertificateSigningRequestApprovalStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.CertificateSigningRequestApproval">CertificateSigningRequestApproval</a>)
</p>
<p>
<p>CertificateSigningRequestApprovalStatus defines the observed state of CertificateSigningRequestApproval</p>
</p>
###ClusterAutoscaling { #hypershift.openshift.io/v1beta1.ClusterAutoscaling }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>ClusterAutoscaling specifies auto-scaling behavior that applies to all
NodePools associated with a control plane.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>scaling</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ScalingType">
ScalingType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>scaling defines the scaling behavior for the cluster autoscaler.
ScaleUpOnly means the autoscaler will only scale up nodes, never scale down.
ScaleUpAndScaleDown means the autoscaler will both scale up and scale down nodes.
When set to ScaleUpAndScaleDown, the scaleDown field can be used to configure scale down behavior.</p>
<p>Note: This field is only supported in OpenShift versions 4.19 and above.</p>
</td>
</tr>
<tr>
<td>
<code>scaleDown</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ScaleDownConfig">
ScaleDownConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>scaleDown configures the behavior of the Cluster Autoscaler scale down operation.
This field is only valid when scaling is set to ScaleUpAndScaleDown.</p>
</td>
</tr>
<tr>
<td>
<code>balancingIgnoredLabels</code></br>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>balancingIgnoredLabels sets &ldquo;&ndash;balancing-ignore-label <label name>&rdquo; flag on cluster-autoscaler for each listed label.
This option specifies labels that cluster autoscaler should ignore when considering node group similarity.
For example, if you have nodes with &ldquo;topology.ebs.csi.aws.com/zone&rdquo; label, you can add name of this label here
to prevent cluster autoscaler from splitting nodes into different node groups based on its value.</p>
<p>HyperShift automatically appends platform-specific balancing ignore labels:
- AWS: &ldquo;lifecycle&rdquo;, &ldquo;k8s.amazonaws.com/eniConfig&rdquo;, &ldquo;topology.k8s.aws/zone-id&rdquo;
- Azure: &ldquo;agentpool&rdquo;, &ldquo;kubernetes.azure.com/agentpool&rdquo;
- Common:
- &ldquo;hypershift.openshift.io/nodePool&rdquo;
- &ldquo;topology.ebs.csi.aws.com/zone&rdquo;
- &ldquo;topology.disk.csi.azure.com/zone&rdquo;
- &ldquo;ibm-cloud.kubernetes.io/worker-id&rdquo;
- &ldquo;vpc-block-csi-driver-labels&rdquo;
These labels are added by default and do not need to be manually specified.</p>
</td>
</tr>
<tr>
<td>
<code>maxNodesTotal</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>maxNodesTotal is the maximum allowable number of nodes for the Autoscaler scale out to be operational.
The autoscaler will not grow the cluster beyond this number.
If omitted, the autoscaler will not have a maximum limit.
number.</p>
</td>
</tr>
<tr>
<td>
<code>maxPodGracePeriod</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>maxPodGracePeriod is the maximum seconds to wait for graceful pod
termination before scaling down a NodePool. The default is 600 seconds.</p>
</td>
</tr>
<tr>
<td>
<code>maxNodeProvisionTime</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>maxNodeProvisionTime is the maximum time to wait for node provisioning
before considering the provisioning to be unsuccessful, expressed as a Go
duration string. The default is 15 minutes.</p>
</td>
</tr>
<tr>
<td>
<code>maxFreeDifferenceRatioPercent</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>maxFreeDifferenceRatioPercent sets the maximum difference ratio for free resources between similar node groups. This parameter controls how strict the similarity check is when comparing node groups for load balancing.
The value represents a percentage from 0 to 100.
When set to 0, this means node groups must have exactly the same free resources to be considered similar (no difference allowed).
When set to 100, this means node groups will be considered similar regardless of their free resource differences (any difference allowed).
A value between 0 and 100 represents the maximum allowed difference ratio for free resources between node groups to be considered similar.
When omitted, the autoscaler defaults to 10%.
This affects the &ldquo;&ndash;max-free-difference-ratio&rdquo; flag on cluster-autoscaler.</p>
</td>
</tr>
<tr>
<td>
<code>podPriorityThreshold</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>podPriorityThreshold enables users to schedule &ldquo;best-effort&rdquo; pods, which
shouldn&rsquo;t trigger autoscaler actions, but only run when there are spare
resources available. The default is -10.</p>
<p>See the following for more details:
<a href="https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#how-does-cluster-autoscaler-work-with-pod-priority-and-preemption">https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#how-does-cluster-autoscaler-work-with-pod-priority-and-preemption</a></p>
</td>
</tr>
<tr>
<td>
<code>expanders</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ExpanderString">
[]ExpanderString
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>expanders guide the autoscaler in choosing node groups during scale-out.
Sets the order of expanders for scaling out node groups.
Options include:
* LeastWaste - selects the group with minimal idle CPU and memory after scaling.
* Priority - selects the group with the highest user-defined priority.
* Random - selects a group randomly.
If not specified, <code>[Priority, LeastWaste]</code> is the default.
Maximum of 3 expanders can be specified.</p>
</td>
</tr>
</tbody>
</table>
###ClusterConfiguration { #hypershift.openshift.io/v1beta1.ClusterConfiguration }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>ClusterConfiguration specifies configuration for individual OCP components in the
cluster, represented as embedded resources that correspond to the openshift
configuration API.</p>
<p>The API for individual configuration items is at:
<a href="https://docs.openshift.com/container-platform/4.7/rest_api/config_apis/config-apis-index.html">https://docs.openshift.com/container-platform/4.7/rest_api/config_apis/config-apis-index.html</a></p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiServer</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.APIServerSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>apiServer holds configuration (like serving certificates, client CA and CORS domains)
shared by all API servers in the system, among them especially kube-apiserver
and openshift-apiserver.</p>
</td>
</tr>
<tr>
<td>
<code>authentication</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.AuthenticationSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>authentication specifies cluster-wide settings for authentication (like OAuth and
webhook token authenticators).</p>
</td>
</tr>
<tr>
<td>
<code>featureGate</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.FeatureGateSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>featureGate holds cluster-wide information about feature gates.</p>
</td>
</tr>
<tr>
<td>
<code>image</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.ImageSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>image governs policies related to imagestream imports and runtime configuration
for external registries. It allows cluster admins to configure which registries
OpenShift is allowed to import images from, extra CA trust bundles for external
registries, and policies to block or allow registry hostnames.
When exposing OpenShift&rsquo;s image registry to the public, this also lets cluster
admins specify the external hostname.
This input will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>ingress</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.IngressSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ingress holds cluster-wide information about ingress, including the default ingress domain
used for routes.</p>
</td>
</tr>
<tr>
<td>
<code>network</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.NetworkSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>network holds cluster-wide information about the network. It is used to configure the desired network configuration, such as: IP address pools for services/pod IPs, network plugin, etc.
Please view network.spec for an explanation on what applies when configuring this resource.
TODO (csrwng): Add validation here to exclude changes that conflict with networking settings in the HostedCluster.Spec.Networking field.</p>
</td>
</tr>
<tr>
<td>
<code>oauth</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.OAuthSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>oauth holds cluster-wide information about OAuth.
It is used to configure the integrated OAuth server.
This configuration is only honored when the top level Authentication config has type set to IntegratedOAuth.</p>
</td>
</tr>
<tr>
<td>
<code>operatorhub</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.OperatorHubSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>operatorhub specifies the configuration for the Operator Lifecycle Manager in the HostedCluster. This is only configured at deployment time but the controller are not reconcilling over it.
The OperatorHub configuration will be constantly reconciled if catalog placement is management, but only on cluster creation otherwise.</p>
</td>
</tr>
<tr>
<td>
<code>scheduler</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.SchedulerSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>scheduler holds cluster-wide config information to run the Kubernetes Scheduler
and influence its placement decisions. The canonical name for this config is <code>cluster</code>.</p>
</td>
</tr>
<tr>
<td>
<code>proxy</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.ProxySpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>proxy holds cluster-wide information on how to configure default proxies for the cluster.
This affects traffic flowing from the hosted cluster data plane.
The controllers will generate a machineConfig with the proxy config for the cluster.
This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
</tbody>
</table>
###ClusterNetworkEntry { #hypershift.openshift.io/v1beta1.ClusterNetworkEntry }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">ClusterNetworking</a>)
</p>
<p>
<p>ClusterNetworkEntry is a single IP address block for pod IP blocks. IP blocks
are allocated with size 2^HostSubnetLength.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>cidr</code></br>
<em>
<a href="#">
github.com/openshift/hypershift/api/util/ipnet.IPNet
</a>
</em>
</td>
<td>
<p>cidr is the IP block address pool.</p>
</td>
</tr>
<tr>
<td>
<code>hostPrefix</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>hostPrefix is the prefix size to allocate to each node from the CIDR.
For example, 24 would allocate 2^(32-24)=2^8=256 addresses to each node. If this
field is not used by the plugin, it can be left unset.</p>
</td>
</tr>
</tbody>
</table>
###ClusterNetworkOperatorSpec { #hypershift.openshift.io/v1beta1.ClusterNetworkOperatorSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OperatorConfiguration">OperatorConfiguration</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>disableMultiNetwork</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>disableMultiNetwork when set to true disables the Multus CNI plugin and related components
in the hosted cluster. This prevents the installation of multus daemon sets in the
guest cluster and the multus-admission-controller in the management cluster.
Default is false (Multus is enabled).
This field is immutable.
This field can only be set to true when NetworkType is &ldquo;Other&rdquo;. Setting it to true
with any other NetworkType will result in a validation error during cluster creation.</p>
</td>
</tr>
<tr>
<td>
<code>ovnKubernetesConfig</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OVNKubernetesConfig">
OVNKubernetesConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ovnKubernetesConfig holds OVN-Kubernetes specific configuration.
This is only consumed when NetworkType is OVNKubernetes.</p>
</td>
</tr>
</tbody>
</table>
###ClusterNetworking { #hypershift.openshift.io/v1beta1.ClusterNetworking }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>clusterNetworking specifies network configuration for a cluster.
All CIDRs must be unique. Additional validation to check for CIDRs overlap and consistent network stack is performed by the controllers.
Failing that validation will result in the HostedCluster being degraded and the validConfiguration condition being false.
TODO this is available in vanilla kube from 1.31 API servers and in Openshift from 4.16.
TODO(alberto): Use CEL cidr library for all these validation when all management clusters are &gt;= 1.31.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>machineNetwork</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MachineNetworkEntry">
[]MachineNetworkEntry
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>machineNetwork is the list of IP address pools for machines.
This might be used among other things to generate appropriate networking security groups in some clouds providers.
Currently only one entry or two for dual stack is supported.
This field is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>clusterNetwork</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworkEntry">
[]ClusterNetworkEntry
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>clusterNetwork is the list of IP address pools for pods.
Defaults to cidr: &ldquo;10.132.0.0/14&rdquo;.
Currently only one entry is supported.
This field is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>serviceNetwork</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ServiceNetworkEntry">
[]ServiceNetworkEntry
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>serviceNetwork is the list of IP address pools for services.
Defaults to cidr: &ldquo;172.31.0.0/16&rdquo;.
Currently only one entry is supported.
This field is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>networkType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NetworkType">
NetworkType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>networkType specifies the SDN provider used for cluster networking.
Defaults to OVNKubernetes.
This field is required and immutable.
kubebuilder:validation:XValidation:rule=&ldquo;self == oldSelf&rdquo;, message=&ldquo;networkType is immutable&rdquo;</p>
</td>
</tr>
<tr>
<td>
<code>apiServer</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.APIServerNetworking">
APIServerNetworking
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>apiServer contains advanced network settings for the API server that affect
how the APIServer is exposed inside a hosted cluster node.</p>
</td>
</tr>
<tr>
<td>
<code>allocateNodeCIDRs</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AllocateNodeCIDRsMode">
AllocateNodeCIDRsMode
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>allocateNodeCIDRs controls whether the kube-controller-manager manages node CIDR allocation.
When using networkType=Other, it is recommended to set this field to &ldquo;Enabled&rdquo;
if Flannel is used as the CNI, as it relies on this behavior.
Default is &ldquo;Disabled&rdquo;.
This field can only be set to &ldquo;Enabled&rdquo; when NetworkType is &ldquo;Other&rdquo;. Setting it to &ldquo;Enabled&rdquo;
with any other NetworkType will result in a validation error during cluster creation.</p>
</td>
</tr>
</tbody>
</table>
###ClusterVersionOperatorSpec { #hypershift.openshift.io/v1beta1.ClusterVersionOperatorSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OperatorConfiguration">OperatorConfiguration</a>)
</p>
<p>
<p>ClusterVersionOperatorSpec is the specification of the desired behavior of the Cluster Version Operator.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>operatorLogLevel</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.LogLevel">
LogLevel
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>operatorLogLevel is an intent based logging for the operator itself. It does not give fine-grained control,
but it is a simple way to manage coarse grained logging choices that operators have to interpret for themselves.</p>
<p>Valid values are: &ldquo;Normal&rdquo;, &ldquo;Debug&rdquo;, &ldquo;Trace&rdquo;, &ldquo;TraceAll&rdquo;.
Defaults to &ldquo;Normal&rdquo;.</p>
</td>
</tr>
</tbody>
</table>
###ClusterVersionStatus { #hypershift.openshift.io/v1beta1.ClusterVersionStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterStatus">HostedClusterStatus</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneStatus">HostedControlPlaneStatus</a>)
</p>
<p>
<p>ClusterVersionStatus reports the status of the cluster versioning,
including any upgrades that are in progress. The current field will
be set to whichever version the cluster is reconciling to, and the
conditions array will report whether the update succeeded, is in
progress, or is failing.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>desired</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.Release
</a>
</em>
</td>
<td>
<p>desired is the version that the cluster is reconciling towards.
If the cluster is not yet fully initialized desired will be set
with the information available, which may be an image or a tag.</p>
</td>
</tr>
<tr>
<td>
<code>history</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
[]github.com/openshift/api/config/v1.UpdateHistory
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>history contains a list of the most recent versions applied to the cluster.
This value may be empty during cluster startup, and then will be updated
when a new update is being applied. The newest update is first in the
list and it is ordered by recency. Updates in the history have state
Completed if the rollout completed - if an update was failing or halfway
applied the state will be Partial. Only a limited amount of update history
is preserved.</p>
</td>
</tr>
<tr>
<td>
<code>observedGeneration</code></br>
<em>
int64
</em>
</td>
<td>
<p>observedGeneration reports which version of the spec is being synced.
If this value is not equal to metadata.generation, then the desired
and conditions fields may represent a previous version.</p>
</td>
</tr>
<tr>
<td>
<code>availableUpdates</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
[]github.com/openshift/api/config/v1.Release
</a>
</em>
</td>
<td>
<p>availableUpdates contains updates recommended for this
cluster. Updates which appear in conditionalUpdates but not in
availableUpdates may expose this cluster to known issues. This list
may be empty if no updates are recommended, if the update service
is unavailable, or if an invalid channel has been specified.</p>
</td>
</tr>
<tr>
<td>
<code>conditionalUpdates</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
[]github.com/openshift/api/config/v1.ConditionalUpdate
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>conditionalUpdates contains the list of updates that may be
recommended for this cluster if it meets specific required
conditions. Consumers interested in the set of updates that are
actually recommended for this cluster should use
availableUpdates. This list may be empty if no updates are
recommended, if the update service is unavailable, or if an empty
or invalid channel has been specified.</p>
</td>
</tr>
</tbody>
</table>
###ComponentResource { #hypershift.openshift.io/v1beta1.ComponentResource }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneComponentStatus">ControlPlaneComponentStatus</a>)
</p>
<p>
<p>ComponentResource defines a resource reconciled by a ControlPlaneComponent.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>kind</code></br>
<em>
string
</em>
</td>
<td>
<p>kind is the name of the resource schema.</p>
</td>
</tr>
<tr>
<td>
<code>group</code></br>
<em>
string
</em>
</td>
<td>
<p>group is the API group for this resource type.</p>
</td>
</tr>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is the name of this resource.</p>
</td>
</tr>
</tbody>
</table>
###ConditionType { #hypershift.openshift.io/v1beta1.ConditionType }
<p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;AWSDefaultSecurityGroupCreated&#34;</p></td>
<td><p>AWSDefaultSecurityGroupCreated indicates whether the default security group
for AWS workers has been created.
A failure here indicates that NodePools without a security group will be
blocked from creating machines.</p>
</td>
</tr><tr><td><p>&#34;AWSDefaultSecurityGroupDeleted&#34;</p></td>
<td><p>AWSDefaultSecurityGroupDeleted indicates whether the default security group
for AWS workers has been deleted.
A failure here indicates that the Security Group has some dependencies that
there are still pending cloud resources to be deleted that are using that SG.</p>
</td>
</tr><tr><td><p>&#34;AWSEndpointAvailable&#34;</p></td>
<td><p>AWSEndpointServiceAvailable indicates whether the AWS Endpoint has been
created in the guest VPC</p>
</td>
</tr><tr><td><p>&#34;AWSEndpointServiceAvailable&#34;</p></td>
<td><p>AWSEndpointServiceAvailable indicates whether the AWS Endpoint Service
has been created for the specified NLB in the management VPC</p>
</td>
</tr><tr><td><p>&#34;AutoNodeEnabled&#34;</p></td>
<td><p>AutoNodeEnabled indicates whether AutoNode is configured and operational for this HostedCluster.
<strong>True</strong> means AutoNode is configured in the HostedCluster spec and the Karpenter components are fully rolled out and ready.
<strong>False / AutoNodeProgressing</strong> means AutoNode is being enabled or disabled — the operation is in progress.
<strong>False / AutoNodeNotConfigured</strong> means AutoNode is not configured in the spec and all Karpenter components have been removed.</p>
</td>
</tr><tr><td><p>&#34;AzureInternalLoadBalancerAvailable&#34;</p></td>
<td><p>AzureInternalLoadBalancerAvailable indicates the ILB has been provisioned with a frontend IP</p>
</td>
</tr><tr><td><p>&#34;AzurePLSCreated&#34;</p></td>
<td><p>AzurePLSCreated indicates the Azure Private Link Service has been created in the management cluster resource group</p>
</td>
</tr><tr><td><p>&#34;AzurePrivateDNSAvailable&#34;</p></td>
<td><p>AzurePrivateDNSAvailable indicates the Private DNS zone and A records have been created</p>
</td>
</tr><tr><td><p>&#34;AzurePrivateEndpointAvailable&#34;</p></td>
<td><p>AzurePrivateEndpointAvailable indicates the Private Endpoint has been created in the guest VNet</p>
</td>
</tr><tr><td><p>&#34;AzurePrivateLinkServiceAvailable&#34;</p></td>
<td><p>AzurePrivateLinkServiceAvailable indicates overall PLS infrastructure availability</p>
</td>
</tr><tr><td><p>&#34;BackupCompleted&#34;</p></td>
<td><p>BackupCompleted indicates whether the etcd backup has completed.</p>
</td>
</tr><tr><td><p>&#34;CVOScaledDown&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;CloudResourcesDestroyed&#34;</p></td>
<td><p>CloudResourcesDestroyed bubbles up the same condition from HCP. It signals if the cloud provider infrastructure created by Kubernetes
in the consumer cloud provider account was destroyed.
A failure here may require external user intervention to resolve. E.g. cloud provider perms were corrupted. E.g. the guest cluster was broken
and kube resource deletion that affects cloud infra like service type load balancer can&rsquo;t succeed.</p>
</td>
</tr><tr><td><p>&#34;ClusterVersionAvailable&#34;</p></td>
<td><p>ClusterVersionAvailable bubbles up Failing configv1.OperatorAvailable from the CVO.</p>
</td>
</tr><tr><td><p>&#34;ClusterVersionFailing&#34;</p></td>
<td><p>ClusterVersionFailing bubbles up Failing from the CVO.</p>
</td>
</tr><tr><td><p>&#34;ClusterVersionProgressing&#34;</p></td>
<td><p>ClusterVersionProgressing bubbles up configv1.OperatorProgressing from the CVO.</p>
</td>
</tr><tr><td><p>&#34;ClusterVersionReleaseAccepted&#34;</p></td>
<td><p>ClusterVersionReleaseAccepted bubbles up Failing ReleaseAccepted from the CVO.</p>
</td>
</tr><tr><td><p>&#34;ClusterVersionRetrievedUpdates&#34;</p></td>
<td><p>ClusterVersionRetrievedUpdates bubbles up RetrievedUpdates from the CVO.</p>
</td>
</tr><tr><td><p>&#34;ClusterVersionSucceeding&#34;</p></td>
<td><p>ClusterVersionSucceeding indicates the current status of the desired release
version of the HostedCluster as indicated by the Failing condition in the
underlying cluster&rsquo;s ClusterVersion.</p>
</td>
</tr><tr><td><p>&#34;ClusterVersionUpgradeable&#34;</p></td>
<td><p>ClusterVersionUpgradeable indicates the Upgradeable condition in the
underlying cluster&rsquo;s ClusterVersion.</p>
</td>
</tr><tr><td><p>&#34;ConfigOperatorReconciliationSucceeded&#34;</p></td>
<td><p>ConfigOperatorReconciliationSucceeded indicates if the HostedCluster Config
Operator (HCCO) reconciliation succeeded. The HCCO is responsible for
reconciling resources inside the hosted cluster (e.g. global configuration,
CRDs, RBAC, and connectivity checks).
A failure here often means a software bug, a non-stable cluster, or
connectivity issues between the control plane and the hosted cluster.</p>
</td>
</tr><tr><td><p>&#34;Available&#34;</p></td>
<td><p>ControlPlaneComponentAvailable indicates whether the ControlPlaneComponent is available.</p>
</td>
</tr><tr><td><p>&#34;RolloutComplete&#34;</p></td>
<td><p>ControlPlaneComponentRolloutComplete indicates whether the ControlPlaneComponent has completed its rollout.</p>
</td>
</tr><tr><td><p>&#34;ControlPlaneConnectionAvailable&#34;</p></td>
<td><p>ControlPlaneConnectionAvailable indicates whether data plane workloads have a successful
network connection to the control plane components. This condition is computed using
a 3-replica Deployment that tests the full data path (DNS resolution of kubernetes.default.svc
-&gt; advertise address on lo -&gt; apiserver proxy -&gt; KAS on HCP) and reports results to a shared
ConfigMap. The HCCO evaluates the staleness of the lastSucceeded timestamp in the ConfigMap.
<strong>True</strong> means the data plane can successfully reach the control plane (a recent successful check was recorded).
<strong>False</strong> means there are connectivity failures preventing the data plane from reaching the control plane,
or the last successful check is stale (older than 5 minutes).
<strong>Unknown</strong> means the status cannot be determined due to true inability to inspect (e.g., no worker nodes exist or inspection cannot be performed),
not due to missing required components.</p>
</td>
</tr><tr><td><p>&#34;DataPlaneConnectionAvailable&#34;</p></td>
<td><p>DataPlaneConnectionAvailable indicates whether the control plane has a successful
network connection to the data plane components.
<strong>True</strong> means the control plane can successfully reach the data plane nodes.
<strong>False</strong> means there are network connection issues preventing the control plane from reaching the data plane.
A failure here suggests potential issues such as: network policy restrictions,
firewall rules, missing data plane nodes, or problems with infrastructure
components like the konnectivity-agent workload.
<strong>Unknown</strong> means the status cannot be determined (e.g., no worker nodes available or unable to inspect).</p>
</td>
</tr><tr><td><p>&#34;EtcdAvailable&#34;</p></td>
<td><p>EtcdAvailable bubbles up the same condition from HCP. It signals if etcd is available.
A failure here often means a software bug or a non-stable cluster.</p>
</td>
</tr><tr><td><p>&#34;EtcdBackupSucceeded&#34;</p></td>
<td><p>EtcdBackupSucceeded bubbles up from HCP. It indicates the result of the
most recent etcd backup. True means the last backup completed successfully;
False means a backup is in progress or the last backup failed.</p>
</td>
</tr><tr><td><p>&#34;EtcdDataEncryptionUpToDate&#34;</p></td>
<td><p>EtcdDataEncryptionUpToDate indicates whether all etcd data is encrypted with the
currently active encryption key.
True: all data confirmed encrypted with the active key.
False: re-encryption is in progress or has failed.
Absent: encryption is not configured.</p>
</td>
</tr><tr><td><p>&#34;EtcdRecoveryActive&#34;</p></td>
<td><p>EtcdRecoveryActive indicates that the Etcd cluster is failing and the
recovery job was triggered.</p>
</td>
</tr><tr><td><p>&#34;EtcdSnapshotRestored&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;ExternalDNSReachable&#34;</p></td>
<td><p>ExternalDNSReachable bubbles up the same condition from HCP. It signals if the configured external DNS is reachable.
A failure here requires external user intervention to resolve. E.g. changing the external DNS domain or making sure the domain is created
and registered correctly.</p>
</td>
</tr><tr><td><p>&#34;GCPDNSAvailable&#34;</p></td>
<td><p>GCPDNSAvailable indicates whether the DNS configuration has been
created in the customer VPC</p>
</td>
</tr><tr><td><p>&#34;GCPEndpointAvailable&#34;</p></td>
<td><p>GCPEndpointAvailable indicates whether the GCP PSC Endpoint has been
created in the customer VPC</p>
</td>
</tr><tr><td><p>&#34;GCPPrivateServiceConnectAvailable&#34;</p></td>
<td><p>GCPPrivateServiceConnectAvailable indicates overall PSC infrastructure availability</p>
</td>
</tr><tr><td><p>&#34;GCPServiceAttachmentAvailable&#34;</p></td>
<td><p>GCPServiceAttachmentAvailable indicates whether the GCP Service Attachment
has been created for the specified Internal Load Balancer in the management VPC</p>
</td>
</tr><tr><td><p>&#34;Available&#34;</p></td>
<td><p>HostedClusterAvailable indicates whether the HostedCluster has a healthy
control plane.
When this is false for too long and there&rsquo;s no clear indication in the &ldquo;Reason&rdquo;, please check the remaining more granular conditions.</p>
</td>
</tr><tr><td><p>&#34;Degraded&#34;</p></td>
<td><p>HostedClusterDegraded indicates whether the HostedCluster is encountering
an error that may require user intervention to resolve.</p>
</td>
</tr><tr><td><p>&#34;HostedClusterDestroyed&#34;</p></td>
<td><p>HostedClusterDestroyed indicates that a hosted has finished destroying and that it is waiting for a destroy grace period to go away.
The grace period is determined by the hypershift.openshift.io/destroy-grace-period annotation in the HostedCluster if present.</p>
</td>
</tr><tr><td><p>&#34;Progressing&#34;</p></td>
<td><p>HostedClusterProgressing indicates whether the HostedCluster is attempting
an initial deployment or upgrade.
When this is false for too long and there&rsquo;s no clear indication in the &ldquo;Reason&rdquo;, please check the remaining more granular conditions.</p>
</td>
</tr><tr><td><p>&#34;HostedClusterRestoredFromBackup&#34;</p></td>
<td><p>HostedClusterRestoredFromBackup indicates that the HostedCluster was restored from backup.
This condition is set to true when the HostedCluster is restored from backup and the recovery process is complete.
This condition is used to track the status of the recovery process and to determine if the HostedCluster
is ready to be used after restoration.</p>
</td>
</tr><tr><td><p>&#34;Available&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Degraded&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;IgnitionEndpointAvailable&#34;</p></td>
<td><p>IgnitionEndpointAvailable indicates whether the ignition server for the
HostedCluster is available to handle ignition requests.
A failure here often means a software bug or a non-stable cluster.</p>
</td>
</tr><tr><td><p>&#34;IgnitionServerValidReleaseInfo&#34;</p></td>
<td><p>IgnitionServerValidReleaseInfo indicates if the release contains all the images used by the local ignition provider
and reports missing images if any.</p>
</td>
</tr><tr><td><p>&#34;InfrastructureReady&#34;</p></td>
<td><p>InfrastructureReady bubbles up the same condition from HCP. It signals if the infrastructure for a control plane to be operational,
e.g. load balancers were created successfully.
A failure here may require external user intervention to resolve. E.g. hitting quotas on the cloud provider.</p>
</td>
</tr><tr><td><p>&#34;KubeAPIServerAvailable&#34;</p></td>
<td><p>KubeAPIServerAvailable bubbles up the same condition from HCP. It signals if the kube API server is available.
A failure here often means a software bug or a non-stable cluster.</p>
</td>
</tr><tr><td><p>&#34;KubeVirtNodesLiveMigratable&#34;</p></td>
<td><p>KubeVirtNodesLiveMigratable indicates if all nodes (VirtualMachines) of the kubevirt
hosted cluster can be live migrated without experiencing a node restart</p>
</td>
</tr><tr><td><p>&#34;PlatformCredentialsFound&#34;</p></td>
<td><p>PlatformCredentialsFound indicates that credentials required for the
desired platform are valid.
A failure here is unlikely to resolve without the changing user input.</p>
</td>
</tr><tr><td><p>&#34;PublicEndpointExposed&#34;</p></td>
<td><p>PublicEndpointExposed indicates whether public API server endpoints are
currently configured and exposed for this cluster via the management
cluster&rsquo;s shared ingress. Status reflects observed state: True means
public endpoints are reachable, False means they are not.</p>
</td>
</tr><tr><td><p>&#34;ReconciliationActive&#34;</p></td>
<td><p>ReconciliationActive indicates if reconciliation of the HostedCluster is
active or paused hostedCluster.spec.pausedUntil.</p>
</td>
</tr><tr><td><p>&#34;ReconciliationSucceeded&#34;</p></td>
<td><p>ReconciliationSucceeded indicates if the HostedCluster reconciliation
succeeded.
A failure here often means a software bug or a non-stable cluster.</p>
</td>
</tr><tr><td><p>&#34;SupportedHostedCluster&#34;</p></td>
<td><p>SupportedHostedCluster indicates whether a HostedCluster is supported by
the current configuration of the hypershift-operator.
e.g. If HostedCluster requests endpointAcess Private but the hypershift-operator
is running on a management cluster outside AWS or is not configured with AWS
credentials, the HostedCluster is not supported.
A failure here is unlikely to resolve without the changing user input.</p>
</td>
</tr><tr><td><p>&#34;UnmanagedEtcdAvailable&#34;</p></td>
<td><p>UnmanagedEtcdAvailable indicates whether a user-managed etcd cluster is
healthy.</p>
</td>
</tr><tr><td><p>&#34;ValidAWSIdentityProvider&#34;</p></td>
<td><p>ValidAWSIdentityProvider indicates if the Identity Provider referenced
in the cloud credentials is healthy. E.g. for AWS the idp ARN is referenced in the iam roles.
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Principal&rdquo;: {
&ldquo;Federated&rdquo;: &ldquo;{{ .ProviderARN }}&rdquo;
},
&ldquo;Action&rdquo;: &ldquo;sts:AssumeRoleWithWebIdentity&rdquo;,
&ldquo;Condition&rdquo;: {
&ldquo;StringEquals&rdquo;: {
&ldquo;{{ .ProviderName }}:sub&rdquo;: {{ .ServiceAccounts }}
}
}
}
]</p>
<p>A failure here may require external user intervention to resolve.</p>
</td>
</tr><tr><td><p>&#34;ValidAWSKMSConfig&#34;</p></td>
<td><p>ValidAWSKMSConfig indicates whether the AWS KMS role and encryption key are valid and operational
A failure here indicates that the role or the key are invalid, or the role doesn&rsquo;t have access to use the key.</p>
</td>
</tr><tr><td><p>&#34;ValidAzureKMSConfig&#34;</p></td>
<td><p>ValidAzureKMSConfig indicates whether the given KMS input for the Azure platform is valid and operational
A failure here indicates that the input is invalid, or permissions are missing to use the encryption key.</p>
</td>
</tr><tr><td><p>&#34;ValidGCPCredentials&#34;</p></td>
<td><p>ValidGCPCredentials indicates if GCP credentials are valid and operational
for the HostedCluster. This includes service account authentication and
proper IAM permissions for CAPG controllers.
A failure here may require external user intervention to resolve.</p>
</td>
</tr><tr><td><p>&#34;ValidGCPWorkloadIdentity&#34;</p></td>
<td><p>ValidGCPWorkloadIdentity indicates if GCP Workload Identity Federation
is properly configured and operational for the cluster.
A failure here may require external user intervention to resolve.</p>
</td>
</tr><tr><td><p>&#34;ValidConfiguration&#34;</p></td>
<td><p>ValidHostedClusterConfiguration signals if the hostedCluster input is valid and
supported by the underlying management cluster.
A failure here is unlikely to resolve without the changing user input.</p>
</td>
</tr><tr><td><p>&#34;ValidHostedControlPlaneConfiguration&#34;</p></td>
<td><p>ValidHostedControlPlaneConfiguration bubbles up the same condition from HCP. It signals if the hostedControlPlane input is valid and
supported by the underlying management cluster.
A failure here is unlikely to resolve without the changing user input.</p>
</td>
</tr><tr><td><p>&#34;ValidIDPConfiguration&#34;</p></td>
<td><p>ValidIDPConfiguration indicates if the Identity Provider configuration is valid.
A failure here may require external user intervention to resolve
e.g. the user-provided IDP configuration provided is invalid or the IDP is not reachable.</p>
</td>
</tr><tr><td><p>&#34;ValidKubeVirtInfraNetworkMTU&#34;</p></td>
<td><p>ValidKubeVirtInfraNetworkMTU indicates if the MTU configured on an infra cluster
hosting a guest cluster utilizing kubevirt platform is a sufficient value that will avoid
performance degradation due to fragmentation of the double encapsulation in ovn-kubernetes</p>
</td>
</tr><tr><td><p>&#34;ValidKubeVirtInfraNetworkPolicyRBAC&#34;</p></td>
<td><p>ValidKubeVirtInfraNetworkPolicyRBAC indicates whether the external infra
kubeconfig has sufficient permissions to create/update the virt-launcher network policy
on the infrastructure cluster. This covers both reading the
cluster network configuration (networks.config.openshift.io) for CIDR-
based egress blocking and creating/updating NetworkPolicy resources in
the infra namespace. When false, tenant isolation may be weaker: the
NetworkPolicy may be missing or lack CIDR-based egress restrictions.</p>
</td>
</tr><tr><td><p>&#34;ValidOIDCConfiguration&#34;</p></td>
<td><p>ValidOIDCConfiguration indicates if an AWS cluster&rsquo;s OIDC condition is
detected as invalid.
A failure here may require external user intervention to resolve. E.g. oidc was deleted out of band.</p>
</td>
</tr><tr><td><p>&#34;ValidProxyConfiguration&#34;</p></td>
<td><p>ValidProxyConfiguration indicates if the proxy CA bundle is valid.
A failure here may require external user intervention to resolve. E.g. certificates in the CA bundle have expired.</p>
</td>
</tr><tr><td><p>&#34;ValidReleaseImage&#34;</p></td>
<td><p>ValidReleaseImage indicates if the release image set in the spec is valid
for the HostedCluster. For example, this can be set false if the
HostedCluster itself attempts an unsupported version before 4.9 or an
unsupported upgrade e.g y-stream upgrade before 4.11.
A failure here is unlikely to resolve without the changing user input.</p>
</td>
</tr><tr><td><p>&#34;ValidReleaseInfo&#34;</p></td>
<td><p>ValidReleaseInfo bubbles up the same condition from HCP. It indicates if the release contains all the images used by hypershift
and reports missing images if any.</p>
</td>
</tr></tbody>
</table>
###ConfigurationStatus { #hypershift.openshift.io/v1beta1.ConfigurationStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterStatus">HostedClusterStatus</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneStatus">HostedControlPlaneStatus</a>)
</p>
<p>
<p>ConfigurationStatus contains the status of HostedCluster configuration</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>authentication</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.AuthenticationStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>authentication contains the observed authentication configuration status from the hosted cluster.
This field reflects the current state of the cluster authentication including OAuth metadata,
OIDC client status, and other authentication-related configurations.</p>
</td>
</tr>
</tbody>
</table>
###ControlPlaneComponent { #hypershift.openshift.io/v1beta1.ControlPlaneComponent }
<p>
<p>ControlPlaneComponent specifies the state of a ControlPlane Component</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>metadata</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metadata is the metadata for the ControlPlaneComponent.</p>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneComponentSpec">
ControlPlaneComponentSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>spec is the specification for the ControlPlaneComponent.</p>
<br/>
<br/>
<table>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneComponentStatus">
ControlPlaneComponentStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>status is the status of the ControlPlaneComponent.</p>
</td>
</tr>
</tbody>
</table>
###ControlPlaneComponentSpec { #hypershift.openshift.io/v1beta1.ControlPlaneComponentSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneComponent">ControlPlaneComponent</a>)
</p>
<p>
<p>ControlPlaneComponentSpec defines the desired state of ControlPlaneComponent</p>
</p>
###ControlPlaneComponentStatus { #hypershift.openshift.io/v1beta1.ControlPlaneComponentStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneComponent">ControlPlaneComponent</a>)
</p>
<p>
<p>ControlPlaneComponentStatus defines the observed state of ControlPlaneComponent</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>conditions</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#condition-v1-meta">
[]Kubernetes meta/v1.Condition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>conditions contains details for the current state of the ControlPlane Component.
If there is an error, then the Available condition will be false.</p>
<p>Current condition types are: &ldquo;Available&rdquo;, &ldquo;RolloutComplete&rdquo;</p>
</td>
</tr>
<tr>
<td>
<code>version</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>version reports the current version of this component.</p>
</td>
</tr>
<tr>
<td>
<code>resources</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ComponentResource">
[]ComponentResource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>resources is a list of the resources reconciled by this component.</p>
</td>
</tr>
<tr>
<td>
<code>observedGeneration</code></br>
<em>
int64
</em>
</td>
<td>
<em>(Optional)</em>
<p>observedGeneration reports which generation of the HostedControlPlane spec has been reconciled by this component.</p>
</td>
</tr>
</tbody>
</table>
###ControlPlaneManagedIdentities { #hypershift.openshift.io/v1beta1.ControlPlaneManagedIdentities }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureResourceManagedIdentities">AzureResourceManagedIdentities</a>)
</p>
<p>
<p>ControlPlaneManagedIdentities contains the managed identities on the HCP control plane needing to authenticate with
Azure&rsquo;s API.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>managedIdentitiesKeyVault</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedAzureKeyVault">
ManagedAzureKeyVault
</a>
</em>
</td>
<td>
<p>managedIdentitiesKeyVault contains information on the management cluster&rsquo;s managed identities Azure Key Vault.
This Key Vault is where the managed identities certificates are stored. These certificates are pulled out of the
Key Vault by the Secrets Store CSI driver and mounted into a volume on control plane pods requiring
authentication with Azure API.</p>
<p>More information on how the Secrets Store CSI driver works to do this can be found here:
<a href="https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver">https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver</a>.</p>
</td>
</tr>
<tr>
<td>
<code>cloudProvider</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<p>cloudProvider is a pre-existing managed identity associated with the azure cloud provider, aka cloud controller
manager.</p>
</td>
</tr>
<tr>
<td>
<code>nodePoolManagement</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<p>nodePoolManagement is a pre-existing managed identity associated with the operator managing the NodePools.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneOperator</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<p>controlPlaneOperator is a pre-existing managed identity associated with the control plane operator.</p>
</td>
</tr>
<tr>
<td>
<code>imageRegistry</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageRegistry is a pre-existing managed identity associated with the cluster-image-registry-operator.</p>
</td>
</tr>
<tr>
<td>
<code>ingress</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<p>ingress is a pre-existing managed identity associated with the cluster-ingress-operator.</p>
</td>
</tr>
<tr>
<td>
<code>network</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<p>network is a pre-existing managed identity associated with the cluster-network-operator.</p>
</td>
</tr>
<tr>
<td>
<code>disk</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<p>disk is a pre-existing managed identity associated with the azure-disk-controller.</p>
</td>
</tr>
<tr>
<td>
<code>file</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">
ManagedIdentity
</a>
</em>
</td>
<td>
<p>file is a pre-existing managed identity associated with the azure-disk-controller.</p>
</td>
</tr>
</tbody>
</table>
###ControlPlaneUpdateHistory { #hypershift.openshift.io/v1beta1.ControlPlaneUpdateHistory }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneVersionStatus">ControlPlaneVersionStatus</a>)
</p>
<p>
<p>ControlPlaneUpdateHistory is a record of a single version transition for management-side
control plane components. Each entry captures the target version, its release image, when
the rollout started, and when (or whether) it completed.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>state</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.UpdateState
</a>
</em>
</td>
<td>
<p>state reflects whether the update was fully applied. The Partial state
indicates the update is not fully applied, while the Completed state
indicates the update was successfully rolled out.</p>
</td>
</tr>
<tr>
<td>
<code>startedTime,omitempty,omitzero</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#time-v1-meta">
Kubernetes meta/v1.Time
</a>
</em>
</td>
<td>
<p>startedTime is the time at which the update was started.</p>
</td>
</tr>
<tr>
<td>
<code>completionTime,omitempty,omitzero</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#time-v1-meta">
Kubernetes meta/v1.Time
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>completionTime is the time at which the update completed. It is set
when all management-side components have reached the target version.
It is not set while the update is in progress.</p>
</td>
</tr>
<tr>
<td>
<code>version</code></br>
<em>
string
</em>
</td>
<td>
<p>version is a semantic version string identifying the update version
(e.g. &ldquo;4.20.1&rdquo;).</p>
</td>
</tr>
<tr>
<td>
<code>image</code></br>
<em>
string
</em>
</td>
<td>
<p>image is the release image pullspec used for this update.</p>
</td>
</tr>
</tbody>
</table>
###ControlPlaneVersionStatus { #hypershift.openshift.io/v1beta1.ControlPlaneVersionStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterStatus">HostedClusterStatus</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneStatus">HostedControlPlaneStatus</a>)
</p>
<p>
<p>ControlPlaneVersionStatus tracks the rollout state of management-side control plane components.
It records the desired release, a pruned history of version transitions (newest first), and
the last observed generation of the HostedControlPlane spec.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>desired,omitempty,omitzero</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.Release
</a>
</em>
</td>
<td>
<p>desired is the release version that the control plane is reconciling towards.
It is derived from the HostedControlPlane release image fields.</p>
</td>
</tr>
<tr>
<td>
<code>history</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneUpdateHistory">
[]ControlPlaneUpdateHistory
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>history contains a list of versions applied to management-side control plane components. The newest entry is
first in the list. Entries have state Completed when all ControlPlaneComponent resources report the target
version with RolloutComplete=True. Entries have state Partial when the rollout is in progress or has failed.</p>
</td>
</tr>
<tr>
<td>
<code>observedGeneration,omitempty,omitzero</code></br>
<em>
int64
</em>
</td>
<td>
<em>(Optional)</em>
<p>observedGeneration reports which generation of the HostedControlPlane spec is being synced.</p>
</td>
</tr>
</tbody>
</table>
###DNSSpec { #hypershift.openshift.io/v1beta1.DNSSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>DNSSpec specifies the DNS configuration for the hosted cluster ingress.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>baseDomain</code></br>
<em>
string
</em>
</td>
<td>
<p>baseDomain is the base domain of the hosted cluster.
It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
Once set, this field is immutable.
When the value is the empty string &ldquo;&rdquo;, the controller might default to a value depending on the platform.</p>
</td>
</tr>
<tr>
<td>
<code>baseDomainPrefix</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>baseDomainPrefix is the base domain prefix for the hosted cluster ingress.
It will be used to configure ingress in the hosted cluster through the subdomain baseDomainPrefix.baseDomain.
If baseDomainPrefix is omitted, the hostedCluster.name will be used as the subdomain.
Set baseDomainPrefix to an empty string &ldquo;&rdquo;, if you don&rsquo;t want a prefix at all (not even hostedCluster.name) to be prepended to baseDomain.
This field is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>publicZoneID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>publicZoneID is the Hosted Zone ID where all the DNS records that are publicly accessible to the internet exist.
This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
Once set, this value is immutable.</p>
<p>On Azure, this is a full Azure resource ID for a DNS Zone in the format:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/dnsZones/{zoneName}
The maximum length of 258 is derived from Azure resource naming limits
(see <a href="https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules):">https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules):</a>
/subscriptions/ (15) + UUID (36) + /resourceGroups/ (16) + resource group name (90)</p>
</td>
</tr>
<tr>
<td>
<code>privateZoneID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>privateZoneID is the Hosted Zone ID where all the DNS records that are only available internally to the cluster exist.
This field is optional and mainly leveraged in cloud environments where the DNS records for the .baseDomain are created by controllers in this zone.
Once set, this value is immutable.</p>
<p>On Azure, this is a full Azure resource ID for a Private DNS Zone in the format:
/subscriptions/{subscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.Network/privateDnsZones/{zoneName}
The maximum length of 265 is derived from Azure resource naming limits
(see <a href="https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules):">https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules):</a>
/subscriptions/ (15) + UUID (36) + /resourceGroups/ (16) + resource group name (90)</p>
</td>
</tr>
</tbody>
</table>
###DNSZoneStatus { #hypershift.openshift.io/v1beta1.DNSZoneStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPPrivateServiceConnectStatus">GCPPrivateServiceConnectStatus</a>)
</p>
<p>
<p>DNSZoneStatus represents a single DNS zone and its records</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is the DNS zone name</p>
</td>
</tr>
<tr>
<td>
<code>records</code></br>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>records lists the DNS records created in this zone</p>
</td>
</tr>
</tbody>
</table>
###DataPlaneManagedIdentities { #hypershift.openshift.io/v1beta1.DataPlaneManagedIdentities }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureResourceManagedIdentities">AzureResourceManagedIdentities</a>)
</p>
<p>
<p>DataPlaneManagedIdentities contains the client IDs of all the managed identities on the data plane needing to
authenticate with Azure&rsquo;s API.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>imageRegistryMSIClientID</code></br>
<em>
string
</em>
</td>
<td>
<p>imageRegistryMSIClientID is the client ID of a pre-existing managed identity ID associated with the image
registry controller.</p>
</td>
</tr>
<tr>
<td>
<code>diskMSIClientID</code></br>
<em>
string
</em>
</td>
<td>
<p>diskMSIClientID is the client ID of a pre-existing managed identity ID associated with the CSI Disk driver.</p>
</td>
</tr>
<tr>
<td>
<code>fileMSIClientID</code></br>
<em>
string
</em>
</td>
<td>
<p>fileMSIClientID is the client ID of a pre-existing managed identity ID associated with the CSI File driver.</p>
</td>
</tr>
</tbody>
</table>
###Diagnostics { #hypershift.openshift.io/v1beta1.Diagnostics }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureNodePoolPlatform">AzureNodePoolPlatform</a>)
</p>
<p>
<p>Diagnostics specifies the diagnostics settings for a virtual machine.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>storageAccountType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureDiagnosticsStorageAccountType">
AzureDiagnosticsStorageAccountType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>storageAccountType determines if the storage account for storing the diagnostics data
should be disabled (Disabled), provisioned by Azure (Managed) or by the user (UserManaged).</p>
</td>
</tr>
<tr>
<td>
<code>userManaged</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.UserManagedDiagnostics">
UserManagedDiagnostics
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>userManaged specifies the diagnostics settings for a virtual machine when the storage account is managed by the user.</p>
</td>
</tr>
</tbody>
</table>
###EncryptionKeyReference { #hypershift.openshift.io/v1beta1.EncryptionKeyReference }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.EncryptionMigrationHistory">EncryptionMigrationHistory</a>)
</p>
<p>
<p>EncryptionKeyReference identifies an encryption key by its provider and fingerprint.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>provider</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionProvider">
SecretEncryptionProvider
</a>
</em>
</td>
<td>
<p>provider identifies the encryption provider.</p>
</td>
</tr>
<tr>
<td>
<code>fingerprint</code></br>
<em>
string
</em>
</td>
<td>
<p>fingerprint is the hex-encoded SHA-256 hash of the key&rsquo;s identity fields.</p>
</td>
</tr>
</tbody>
</table>
###EncryptionMigrationHistory { #hypershift.openshift.io/v1beta1.EncryptionMigrationHistory }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionStatus">SecretEncryptionStatus</a>)
</p>
<p>
<p>EncryptionMigrationHistory records a key rotation, including in-progress rotations.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>from,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EncryptionKeyReference">
EncryptionKeyReference
</a>
</em>
</td>
<td>
<p>from is the key that data was migrated from (the previous active key).</p>
</td>
</tr>
<tr>
<td>
<code>to,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EncryptionKeyReference">
EncryptionKeyReference
</a>
</em>
</td>
<td>
<p>to is the key that data was migrated to (the target key).</p>
</td>
</tr>
<tr>
<td>
<code>state</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EncryptionMigrationState">
EncryptionMigrationState
</a>
</em>
</td>
<td>
<p>state tracks the current phase of this rotation.</p>
</td>
</tr>
<tr>
<td>
<code>startedTime,omitzero</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#time-v1-meta">
Kubernetes meta/v1.Time
</a>
</em>
</td>
<td>
<p>startedTime is when the rotation was initiated.</p>
</td>
</tr>
<tr>
<td>
<code>completionTime,omitzero</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#time-v1-meta">
Kubernetes meta/v1.Time
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>completionTime is when the rotation finished. Not set while the rotation is in progress.</p>
</td>
</tr>
</tbody>
</table>
###EncryptionMigrationState { #hypershift.openshift.io/v1beta1.EncryptionMigrationState }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.EncryptionMigrationHistory">EncryptionMigrationHistory</a>)
</p>
<p>
<p>EncryptionMigrationState tracks the lifecycle of a key rotation.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Completed&#34;</p></td>
<td><p>EncryptionMigrationStateCompleted means all data was successfully re-encrypted with the target key.</p>
</td>
</tr><tr><td><p>&#34;Interrupted&#34;</p></td>
<td><p>EncryptionMigrationStateInterrupted means the rotation was abandoned before data was encrypted
with the target key (e.g., targetKey replaced during ReadOnlyDeploy).</p>
</td>
</tr><tr><td><p>&#34;Migrating&#34;</p></td>
<td><p>EncryptionMigrationStateMigrating means all KAS replicas have converged on the new write
provider and re-encryption (StorageVersionMigration) is in progress.</p>
</td>
</tr><tr><td><p>&#34;ReadOnlyDeploy&#34;</p></td>
<td><p>EncryptionMigrationStateReadOnlyDeploy means the new key is being deployed as a read-only
provider. The old key remains the write provider.</p>
</td>
</tr><tr><td><p>&#34;WritePromote&#34;</p></td>
<td><p>EncryptionMigrationStateWritePromote means the new key is being promoted to write provider.
The old key becomes read-only.</p>
</td>
</tr></tbody>
</table>
###EtcdManagementType { #hypershift.openshift.io/v1beta1.EtcdManagementType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.EtcdSpec">EtcdSpec</a>)
</p>
<p>
<p>EtcdManagementType is a enum specifying the strategy for managing the cluster&rsquo;s etcd instance</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Managed&#34;</p></td>
<td><p>Managed means HyperShift should provision and operator the etcd cluster
automatically.</p>
</td>
</tr><tr><td><p>&#34;Unmanaged&#34;</p></td>
<td><p>Unmanaged means HyperShift will not provision or manage the etcd cluster,
and the user is responsible for doing so.</p>
</td>
</tr></tbody>
</table>
###EtcdShardResource { #hypershift.openshift.io/v1beta1.EtcdShardResource }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardSpec">ManagedEtcdShardSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.UnmanagedEtcdShardSpec">UnmanagedEtcdShardSpec</a>)
</p>
<p>
<p>EtcdShardResource identifies a Kubernetes resource type to be routed to an
etcd shard. It is used to build the KAS &ndash;etcd-servers-overrides flag.
The combination of apiGroup and resource uniquely identifies a resource type.</p>
<p>Routing only takes effect for resource types compiled into the
kube-apiserver binary (built-in types such as events, pods, or
coordination.k8s.io/leases). This is a kube-apiserver limitation:
&ndash;etcd-servers-overrides does not apply to other resource types. In
particular, resources backed by CustomResourceDefinitions and resources
served by aggregated API servers (such as the openshift.io groups served
by openshift-apiserver and oauth-apiserver) are NOT routed: entries for
such resources are accepted but have no effect, and their data remains in
the default shard while the configured shard stays empty.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiGroup</code></br>
<em>
string
</em>
</td>
<td>
<p>apiGroup is the API group of the resource (e.g., &ldquo;coordination.k8s.io&rdquo;
for leases). An empty string designates the core API group (e.g.,
events, pods, configmaps). For core-group resources, specify
apiGroup: &ldquo;&rdquo; explicitly (e.g., {apiGroup: &ldquo;&rdquo;, resource: &ldquo;events&rdquo;}).
When non-empty, must be at most 253 characters in length and consist
of only lowercase alphanumeric characters, hyphens and periods. Each
period separated segment must start and end with an alphanumeric
character.</p>
</td>
</tr>
<tr>
<td>
<code>resource</code></br>
<em>
string
</em>
</td>
<td>
<p>resource is the plural resource name (e.g., &ldquo;events&rdquo;, &ldquo;leases&rdquo;,
&ldquo;configmaps&rdquo;). Must be a valid DNS label (RFC 1123): lowercase
alphanumeric characters or hyphens, starting and ending with an
alphanumeric character, max 63 characters.</p>
</td>
</tr>
</tbody>
</table>
###EtcdShardSchedulingSpec { #hypershift.openshift.io/v1beta1.EtcdShardSchedulingSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardSpec">ManagedEtcdShardSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdSpec">ManagedEtcdSpec</a>)
</p>
<p>
<p>EtcdShardSchedulingSpec configures pod placement for a single etcd shard.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>nodeSelector</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeSelector constrains this shard&rsquo;s pods to nodes matching the
specified labels, in addition to the framework&rsquo;s control plane node
selector. Keys and values must be valid Kubernetes label key/value
pairs. Maximum 16 entries.</p>
</td>
</tr>
<tr>
<td>
<code>tolerations</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#toleration-v1-core">
[]Kubernetes core/v1.Toleration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>tolerations allows this shard&rsquo;s pods to schedule on nodes with
matching taints, in addition to the framework&rsquo;s control plane
tolerations. Maximum 16 entries.</p>
</td>
</tr>
</tbody>
</table>
###EtcdSpec { #hypershift.openshift.io/v1beta1.EtcdSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>EtcdSpec specifies configuration for a control plane etcd cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>managementType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdManagementType">
EtcdManagementType
</a>
</em>
</td>
<td>
<p>managementType defines how the etcd cluster is managed.
This can be either Managed or Unmanaged.
This field is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>managed</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdSpec">
ManagedEtcdSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>managed specifies the behavior of an etcd cluster managed by HyperShift.</p>
</td>
</tr>
<tr>
<td>
<code>unmanaged</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.UnmanagedEtcdSpec">
UnmanagedEtcdSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>unmanaged specifies configuration which enables the control plane to
integrate with an externally managed etcd cluster.</p>
</td>
</tr>
</tbody>
</table>
###EtcdTLSConfig { #hypershift.openshift.io/v1beta1.EtcdTLSConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.UnmanagedEtcdSpec">UnmanagedEtcdSpec</a>)
</p>
<p>
<p>EtcdTLSConfig specifies TLS configuration for HTTPS etcd client endpoints.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>clientSecret</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>clientSecret refers to a secret for client mTLS authentication with the etcd cluster. It
may have the following key/value pairs:</p>
<pre><code>etcd-client-ca.crt: Certificate Authority value
etcd-client.crt: Client certificate value
etcd-client.key: Client certificate key value
</code></pre>
</td>
</tr>
</tbody>
</table>
###ExpanderString { #hypershift.openshift.io/v1beta1.ExpanderString }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterAutoscaling">ClusterAutoscaling</a>)
</p>
<p>
<p>ExpanderString contains the name of an expander to be used by the cluster autoscaler.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;LeastWaste&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Priority&#34;</p></td>
<td><p>Selects the node group with the least idle resources.</p>
</td>
</tr><tr><td><p>&#34;Random&#34;</p></td>
<td><p>Selects the node group with the highest priority.</p>
</td>
</tr></tbody>
</table>
###Filter { #hypershift.openshift.io/v1beta1.Filter }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSResourceReference">AWSResourceReference</a>)
</p>
<p>
<p>Filter is a filter used to identify an AWS resource</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is the name of the filter.</p>
</td>
</tr>
<tr>
<td>
<code>values</code></br>
<em>
[]string
</em>
</td>
<td>
<p>values is a list of values for the filter.</p>
</td>
</tr>
</tbody>
</table>
###FilterByNeutronTags { #hypershift.openshift.io/v1beta1.FilterByNeutronTags }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NetworkFilter">NetworkFilter</a>, 
<a href="#hypershift.openshift.io/v1beta1.RouterFilter">RouterFilter</a>, 
<a href="#hypershift.openshift.io/v1beta1.SubnetFilter">SubnetFilter</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>tags</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NeutronTag">
[]NeutronTag
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>tags is a list of tags to filter by. If specified, the resource must
have all of the tags specified to be included in the result.</p>
</td>
</tr>
<tr>
<td>
<code>tagsAny</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NeutronTag">
[]NeutronTag
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>tagsAny is a list of tags to filter by. If specified, the resource
must have at least one of the tags specified to be included in the
result.</p>
</td>
</tr>
<tr>
<td>
<code>notTags</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NeutronTag">
[]NeutronTag
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>notTags is a list of tags to filter by. If specified, resources which
contain all of the given tags will be excluded from the result.</p>
</td>
</tr>
<tr>
<td>
<code>notTagsAny</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NeutronTag">
[]NeutronTag
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>notTagsAny is a list of tags to filter by. If specified, resources
which contain any of the given tags will be excluded from the result.</p>
</td>
</tr>
</tbody>
</table>
###GCPBootDisk { #hypershift.openshift.io/v1beta1.GCPBootDisk }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodePoolPlatform">GCPNodePoolPlatform</a>)
</p>
<p>
<p>GCPBootDisk specifies configuration for the boot disk of GCP node instances.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>diskSizeGB</code></br>
<em>
int64
</em>
</td>
<td>
<em>(Optional)</em>
<p>diskSizeGB specifies the size of the boot disk in gigabytes.
Must be at least 20 GB for RHCOS images.</p>
</td>
</tr>
<tr>
<td>
<code>diskType</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>diskType specifies the disk type for the boot disk.
Valid values include:
- &ldquo;pd-standard&rdquo; - Standard persistent disk (magnetic)
- &ldquo;pd-ssd&rdquo; - SSD persistent disk
- &ldquo;pd-balanced&rdquo; - Balanced persistent disk (recommended)
If not specified, defaults to &ldquo;pd-balanced&rdquo;.</p>
</td>
</tr>
<tr>
<td>
<code>encryptionKey,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPDiskEncryptionKey">
GCPDiskEncryptionKey
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>encryptionKey specifies customer-managed encryption key (CMEK) configuration.
If not specified, Google-managed encryption keys are used.</p>
</td>
</tr>
</tbody>
</table>
###GCPDiskEncryptionKey { #hypershift.openshift.io/v1beta1.GCPDiskEncryptionKey }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPBootDisk">GCPBootDisk</a>)
</p>
<p>
<p>GCPDiskEncryptionKey specifies configuration for customer-managed encryption keys.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>kmsKeyName</code></br>
<em>
string
</em>
</td>
<td>
<p>kmsKeyName is the resource name of the Cloud KMS key used for disk encryption.
Format: projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{key}</p>
</td>
</tr>
</tbody>
</table>
###GCPEndpointAccessType { #hypershift.openshift.io/v1beta1.GCPEndpointAccessType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPPlatformSpec">GCPPlatformSpec</a>)
</p>
<p>
<p>GCPEndpointAccessType defines the endpoint access type for GCP clusters.
Equivalent to AWS EndpointAccessType but adapted for GCP networking model.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Private&#34;</p></td>
<td><p>GCPEndpointAccessPrivate endpoint access allows only private API server access and private
node communication with the control plane via Private Service Connect.</p>
</td>
</tr><tr><td><p>&#34;PublicAndPrivate&#34;</p></td>
<td><p>GCPEndpointAccessPublicAndPrivate endpoint access allows public API server access and
private node communication with the control plane via Private Service Connect.</p>
</td>
</tr></tbody>
</table>
###GCPNetworkConfig { #hypershift.openshift.io/v1beta1.GCPNetworkConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPPlatformSpec">GCPPlatformSpec</a>)
</p>
<p>
<p>GCPNetworkConfig specifies VPC configuration for GCP clusters and Private Service Connect endpoint creation.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>network,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceReference">
GCPResourceReference
</a>
</em>
</td>
<td>
<p>network is the VPC network name</p>
</td>
</tr>
<tr>
<td>
<code>privateServiceConnectSubnet,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceReference">
GCPResourceReference
</a>
</em>
</td>
<td>
<p>privateServiceConnectSubnet is the subnet for Private Service Connect endpoints</p>
</td>
</tr>
</tbody>
</table>
###GCPNodePoolPlatform { #hypershift.openshift.io/v1beta1.GCPNodePoolPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>)
</p>
<p>
<p>GCPNodePoolPlatform specifies the configuration of a NodePool when operating on GCP.
This follows the AWS and Azure patterns for platform-specific NodePool configuration.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>machineType</code></br>
<em>
string
</em>
</td>
<td>
<p>machineType is the GCP machine type for node instances (e.g. n2-standard-4).
Must follow GCP machine type naming conventions as documented at:
<a href="https://cloud.google.com/compute/docs/machine-resource#machine_type_comparison">https://cloud.google.com/compute/docs/machine-resource#machine_type_comparison</a></p>
<p>Valid machine type formats:
- predefined: n1-standard-1, n2-highmem-4, c2-standard-8, etc.
- custom: custom-{cpus}-{memory} (e.g. custom-4-8192)
- custom with extended memory: custom-{cpus}-{memory}-ext (e.g. custom-2-13312-ext)</p>
</td>
</tr>
<tr>
<td>
<code>zone</code></br>
<em>
string
</em>
</td>
<td>
<p>zone is the GCP zone where node instances will be created.
Must be a valid zone within the cluster&rsquo;s region.
Format: {region}-{zone} (e.g. us-central1-a, europe-west2-b)
See <a href="https://cloud.google.com/compute/docs/regions-zones">https://cloud.google.com/compute/docs/regions-zones</a> for available zones.</p>
</td>
</tr>
<tr>
<td>
<code>subnet</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceName">
GCPResourceName
</a>
</em>
</td>
<td>
<p>subnet is the name of the subnet where node instances will be created.
Must be a subnet within the VPC network specified in the HostedCluster&rsquo;s
networkConfig and located in the same region as the zone.
The subnet must have enough IP addresses available for the expected number of nodes.</p>
</td>
</tr>
<tr>
<td>
<code>image</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>image specifies the boot image for node instances.
If unspecified, the default RHCOS image will be used based on the NodePool release payload.
Can be:
- A family name: projects/rhel-cloud/global/images/family/rhel-8
- A specific image: projects/rhel-cloud/global/images/rhel-8-v20231010
- A full resource URL: <a href="https://www.googleapis.com/compute/v1/projects/rhel-cloud/global/images/rhel-8-v20231010">https://www.googleapis.com/compute/v1/projects/rhel-cloud/global/images/rhel-8-v20231010</a></p>
</td>
</tr>
<tr>
<td>
<code>bootDisk</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPBootDisk">
GCPBootDisk
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>bootDisk specifies the configuration for the boot disk of node instances.</p>
</td>
</tr>
<tr>
<td>
<code>serviceAccount</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodeServiceAccount">
GCPNodeServiceAccount
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>serviceAccount configures the Google Service Account attached to node instances.
If not specified, uses the default compute service account for the project.</p>
</td>
</tr>
<tr>
<td>
<code>resourceLabels</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceLabel">
[]GCPResourceLabel
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>resourceLabels is an optional list of additional labels to apply to GCP node
instances and their associated resources (disks, etc.).
Labels will be merged with cluster-level resource labels, with NodePool labels
taking precedence in case of conflicts.</p>
<p>Keys and values must conform to GCP labeling requirements:
- Keys: 1–63 chars, must start with a lowercase letter; allowed [a-z0-9<em>-]
- Values: empty or 1–63 chars; allowed [a-z0-9</em>-]
- Maximum 60 user labels per resource (GCP limit is 64 total, with ~4 reserved)</p>
</td>
</tr>
<tr>
<td>
<code>networkTags</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceName">
[]GCPResourceName
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>networkTags is an optional list of network tags to apply to node instances.
These tags are used by GCP firewall rules to control network access.
Tags must conform to GCP naming conventions:
- 1-63 characters
- Lowercase letters, numbers, and hyphens only
- Must start with lowercase letter
- Cannot end with hyphen</p>
</td>
</tr>
<tr>
<td>
<code>provisioningModel</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPProvisioningModel">
GCPProvisioningModel
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>provisioningModel specifies the provisioning model for node instances.
Spot and Preemptible instances cost less but can be terminated by GCP with 30 seconds notice.
Spot instances are recommended over Preemptible as they have no maximum runtime limit.
Standard instances are regular VMs that run until explicitly stopped.
If not specified, defaults to &ldquo;Standard&rdquo;.</p>
</td>
</tr>
<tr>
<td>
<code>onHostMaintenance</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPOnHostMaintenance">
GCPOnHostMaintenance
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>onHostMaintenance specifies the behavior when host maintenance occurs.
For Spot and Preemptible instances, this must be &ldquo;TERMINATE&rdquo;.
For Standard instances, can be &ldquo;MIGRATE&rdquo; (live migrate) or &ldquo;TERMINATE&rdquo;.
If not specified, defaults to &ldquo;MIGRATE&rdquo; for Standard instances and &ldquo;TERMINATE&rdquo; for Spot/Preemptible.</p>
</td>
</tr>
</tbody>
</table>
###GCPNodeServiceAccount { #hypershift.openshift.io/v1beta1.GCPNodeServiceAccount }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodePoolPlatform">GCPNodePoolPlatform</a>)
</p>
<p>
<p>GCPNodeServiceAccount specifies the Google Service Account configuration for node instances.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>email</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountEmail">
GCPServiceAccountEmail
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>email specifies the email address of the Google Service Account to use for node instances.
If not specified, uses the default compute service account for the project.
The service account must have the necessary permissions for the node to function:
- Logging writer
- Monitoring metric writer
- Storage object viewer (for pulling container images)</p>
</td>
</tr>
<tr>
<td>
<code>scopes</code></br>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>scopes specifies the access scopes for the service account.
If not specified, defaults to standard compute scopes.
Common scopes include:
- &ldquo;<a href="https://www.googleapis.com/auth/devstorage.read_only&quot;">https://www.googleapis.com/auth/devstorage.read_only&rdquo;</a> - Storage read-only
- &ldquo;<a href="https://www.googleapis.com/auth/logging.write&quot;">https://www.googleapis.com/auth/logging.write&rdquo;</a> - Logging write
- &ldquo;<a href="https://www.googleapis.com/auth/monitoring.write&quot;">https://www.googleapis.com/auth/monitoring.write&rdquo;</a> - Monitoring write
- &ldquo;<a href="https://www.googleapis.com/auth/cloud-platform&quot;">https://www.googleapis.com/auth/cloud-platform&rdquo;</a> - Full access (use with caution)</p>
</td>
</tr>
</tbody>
</table>
###GCPOnHostMaintenance { #hypershift.openshift.io/v1beta1.GCPOnHostMaintenance }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodePoolPlatform">GCPNodePoolPlatform</a>)
</p>
<p>
<p>GCPOnHostMaintenance defines the behavior when a host maintenance event occurs.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;MIGRATE&#34;</p></td>
<td><p>GCPOnHostMaintenanceMigrate causes Compute Engine to live migrate an instance during host maintenance.</p>
</td>
</tr><tr><td><p>&#34;TERMINATE&#34;</p></td>
<td><p>GCPOnHostMaintenanceTerminate causes Compute Engine to stop an instance during host maintenance.</p>
</td>
</tr></tbody>
</table>
###GCPPlatformSpec { #hypershift.openshift.io/v1beta1.GCPPlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>GCPPlatformSpec specifies configuration for clusters running on Google Cloud Platform.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>project</code></br>
<em>
string
</em>
</td>
<td>
<p>project is the GCP project ID.
A valid project ID must satisfy the following rules:
length: Must be between 6 and 30 characters, inclusive
characters: Only lowercase letters (<code>a-z</code>), digits (<code>0-9</code>), and hyphens (<code>-</code>) are allowed
start and end: Must begin with a lowercase letter and must not end with a hyphen
valid examples: &ldquo;my-project&rdquo;, &ldquo;my-project-1&rdquo;, &ldquo;my-project-123&rdquo;.
See <a href="https://cloud.google.com/resource-manager/docs/creating-managing-projects">https://cloud.google.com/resource-manager/docs/creating-managing-projects</a> for project ID naming rules.</p>
</td>
</tr>
<tr>
<td>
<code>region</code></br>
<em>
string
</em>
</td>
<td>
<p>region is the GCP region in which the cluster resides (e.g., us-central1, europe-west2).
Must start with lowercase letters, contain exactly one hyphen, and end with digits.
For a full list of valid regions, see: <a href="https://cloud.google.com/compute/docs/regions-zones">https://cloud.google.com/compute/docs/regions-zones</a>.</p>
</td>
</tr>
<tr>
<td>
<code>networkConfig,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPNetworkConfig">
GCPNetworkConfig
</a>
</em>
</td>
<td>
<p>networkConfig specifies VPC configuration for Private Service Connect.
Required for VPC configuration in Private Service Connect deployments.</p>
</td>
</tr>
<tr>
<td>
<code>endpointAccess</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPEndpointAccessType">
GCPEndpointAccessType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>endpointAccess controls API endpoint accessibility for the HostedControlPlane on GCP.
Allowed values: &ldquo;Private&rdquo;, &ldquo;PublicAndPrivate&rdquo;. Defaults to &ldquo;Private&rdquo;.</p>
</td>
</tr>
<tr>
<td>
<code>resourceLabels</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceLabel">
[]GCPResourceLabel
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>resourceLabels are applied to all GCP resources created for the cluster.
Labels are key-value pairs used for organizing and managing GCP resources.
Changes to this field will be propagated in-place to GCP resources where supported.
GCP supports a maximum of 64 labels per resource. HyperShift reserves approximately 4 labels for system use.
For GCP labeling guidance, see <a href="https://cloud.google.com/compute/docs/labeling-resources">https://cloud.google.com/compute/docs/labeling-resources</a></p>
</td>
</tr>
<tr>
<td>
<code>workloadIdentity,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPWorkloadIdentityConfig">
GCPWorkloadIdentityConfig
</a>
</em>
</td>
<td>
<p>workloadIdentity configures Workload Identity Federation for the cluster.
This enables secure, short-lived token-based authentication without storing
long-term service account keys. These fields are immutable after cluster creation
to prevent breaking the authentication chain.</p>
<p>Prerequisites for WIF setup:
- Workload Identity Pool and Provider must exist in the GCP project
- Provider must be configured with audience mapping for OpenShift SA tokens
- Target Google Service Account must have roles/iam.workloadIdentityUser
granted to the workload pool principal (e.g., principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/system:serviceaccount:kube-system:capi-gcp-controller-manager)
- Attribute mappings on the provider should include google.subject for token subject verification</p>
</td>
</tr>
</tbody>
</table>
###GCPPrivateServiceConnectSpec { #hypershift.openshift.io/v1beta1.GCPPrivateServiceConnectSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPPrivateServiceConnect">GCPPrivateServiceConnect</a>)
</p>
<p>
<p>GCPPrivateServiceConnectSpec defines the desired state of PSC infrastructure</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>loadBalancerIP</code></br>
<em>
string
</em>
</td>
<td>
<p>loadBalancerIP is the IP address of the Internal Load Balancer
Populated by the observer from service status
This value must be a valid IPv4 or IPv6 address.</p>
</td>
</tr>
<tr>
<td>
<code>forwardingRuleName</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceName">
GCPResourceName
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>forwardingRuleName is the name of the Internal Load Balancer forwarding rule
Populated by the reconciler via GCP API lookup</p>
</td>
</tr>
<tr>
<td>
<code>consumerAcceptList</code></br>
<em>
[]string
</em>
</td>
<td>
<p>consumerAcceptList specifies which customer projects can connect.
Accepts both project IDs (e.g. &ldquo;my-project-123&rdquo;) and project numbers (e.g. &ldquo;123456789012&rdquo;).
A maximum of 50 entries are allowed.
See <a href="https://cloud.google.com/resource-manager/docs/creating-managing-projects">https://cloud.google.com/resource-manager/docs/creating-managing-projects</a> for project ID and number formats.</p>
</td>
</tr>
<tr>
<td>
<code>natSubnet</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceName">
GCPResourceName
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>natSubnet is the subnet used for NAT by the Service Attachment
Auto-populated by the HyperShift Operator</p>
</td>
</tr>
</tbody>
</table>
###GCPPrivateServiceConnectStatus { #hypershift.openshift.io/v1beta1.GCPPrivateServiceConnectStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPPrivateServiceConnect">GCPPrivateServiceConnect</a>)
</p>
<p>
<p>GCPPrivateServiceConnectStatus defines the observed state of PSC infrastructure</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>conditions</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#condition-v1-meta">
[]Kubernetes meta/v1.Condition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>conditions represent the current state of PSC infrastructure
Current condition types are: &ldquo;GCPPrivateServiceConnectAvailable&rdquo;, &ldquo;GCPServiceAttachmentAvailable&rdquo;, &ldquo;GCPEndpointAvailable&rdquo;, &ldquo;GCPDNSAvailable&rdquo;</p>
</td>
</tr>
<tr>
<td>
<code>serviceAttachmentName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>serviceAttachmentName is the name of the created Service Attachment</p>
</td>
</tr>
<tr>
<td>
<code>serviceAttachmentURI</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>serviceAttachmentURI is the URI customers use to connect.
Format: projects/{project}/regions/{region}/serviceAttachments/{name}
See <a href="https://cloud.google.com/vpc/docs/configure-private-service-connect-producer">https://cloud.google.com/vpc/docs/configure-private-service-connect-producer</a> for service attachment details.</p>
</td>
</tr>
<tr>
<td>
<code>endpointIP</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>endpointIP is the reserved IP address for the PSC endpoint
This value must be a valid IPv4 or IPv6 address.</p>
</td>
</tr>
<tr>
<td>
<code>dnsZones</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.DNSZoneStatus">
[]DNSZoneStatus
</a>
</em>
</td>
<td>
<p>dnsZones contains DNS zone information created for this cluster</p>
</td>
</tr>
</tbody>
</table>
###GCPProvisioningModel { #hypershift.openshift.io/v1beta1.GCPProvisioningModel }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodePoolPlatform">GCPNodePoolPlatform</a>)
</p>
<p>
<p>GCPProvisioningModel defines the provisioning model for GCP node instances.
Follows GCP&rsquo;s provisioning model terminology for compute instances.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Preemptible&#34;</p></td>
<td><p>GCPProvisioningModelPreemptible specifies preemptible instances (legacy).
Preemptible instances are lower-cost instances that can be terminated by GCP
with 30 seconds notice when capacity is needed elsewhere.
Note: Preemptible instances have a maximum runtime of 24 hours.
Consider using Spot instances instead, which have no maximum runtime limit.</p>
</td>
</tr><tr><td><p>&#34;Spot&#34;</p></td>
<td><p>GCPProvisioningModelSpot specifies Spot instances.
Spot instances are lower-cost instances that can be terminated by GCP
with 30 seconds notice when capacity is needed elsewhere.
Unlike preemptible instances, Spot instances have no maximum runtime limit.
This is the recommended option for cost-effective, interruptible workloads.</p>
</td>
</tr><tr><td><p>&#34;Standard&#34;</p></td>
<td><p>GCPProvisioningModelStandard specifies standard (non-preemptible) instances.
Standard instances run until explicitly stopped and are not subject to automatic termination.</p>
</td>
</tr></tbody>
</table>
###GCPResourceLabel { #hypershift.openshift.io/v1beta1.GCPResourceLabel }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodePoolPlatform">GCPNodePoolPlatform</a>, 
<a href="#hypershift.openshift.io/v1beta1.GCPPlatformSpec">GCPPlatformSpec</a>)
</p>
<p>
<p>GCPResourceLabel is a label to apply to GCP resources created for the cluster.
Labels are key-value pairs used for organizing and managing GCP resources.
See <a href="https://cloud.google.com/compute/docs/labeling-resources">https://cloud.google.com/compute/docs/labeling-resources</a> for GCP labeling guidance.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>key</code></br>
<em>
string
</em>
</td>
<td>
<p>key is the key part of the label. A label key can have a maximum of 63 characters and cannot be empty.
For Compute Engine resources (VMs, disks, networks created by CAPG), keys must:
- Start with a lowercase letter
- Contain only lowercase letters, digits, underscores, or hyphens
- End with a lowercase letter or digit (not a hyphen or underscore)
- Be 1-63 characters long
GCP reserves the &lsquo;goog&rsquo; prefix for system labels.
See <a href="https://cloud.google.com/compute/docs/labeling-resources">https://cloud.google.com/compute/docs/labeling-resources</a> for Compute Engine label requirements.</p>
</td>
</tr>
<tr>
<td>
<code>value</code></br>
<em>
string
</em>
</td>
<td>
<p>value is the value part of the label. A label value can have a maximum of 63 characters.
Empty values are allowed by GCP. If non-empty, it must start with a lowercase letter,
contain only lowercase letters, digits, underscores, or hyphens, and end with a lowercase letter or digit.
See <a href="https://cloud.google.com/compute/docs/labeling-resources">https://cloud.google.com/compute/docs/labeling-resources</a> for Compute Engine label requirements.</p>
</td>
</tr>
</tbody>
</table>
###GCPResourceName { #hypershift.openshift.io/v1beta1.GCPResourceName }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodePoolPlatform">GCPNodePoolPlatform</a>, 
<a href="#hypershift.openshift.io/v1beta1.GCPPrivateServiceConnectSpec">GCPPrivateServiceConnectSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.GCPResourceReference">GCPResourceReference</a>)
</p>
<p>
<p>GCPResourceName is the name of a GCP resource following RFC 1035 naming conventions.
Must start with a lowercase letter, contain only lowercase letters, digits, and hyphens,
must not end with a hyphen, and be 1-63 characters long.
See <a href="https://cloud.google.com/compute/docs/naming-resources">https://cloud.google.com/compute/docs/naming-resources</a> for details.</p>
</p>
###GCPResourceReference { #hypershift.openshift.io/v1beta1.GCPResourceReference }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPNetworkConfig">GCPNetworkConfig</a>)
</p>
<p>
<p>GCPResourceReference represents a reference to a GCP resource by name.
Follows GCP naming patterns (name-based APIs, not ID-based like AWS).
See <a href="https://google.aip.dev/122">https://google.aip.dev/122</a> for GCP resource name standards.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPResourceName">
GCPResourceName
</a>
</em>
</td>
<td>
<p>name is the name of the GCP resource.
Must conform to GCP resource naming standards: lowercase letters, numbers, and hyphens only.
Must start with a lowercase letter and end with a lowercase letter or number, max 63 characters.
Pattern: &ldquo;^<a href="[-a-z0-9]*[a-z0-9]">a-z</a>?$&rdquo; (max 63 chars), per GCP naming requirements.
See <a href="https://cloud.google.com/compute/docs/naming-resources">https://cloud.google.com/compute/docs/naming-resources</a> for details.</p>
</td>
</tr>
</tbody>
</table>
###GCPServiceAccountEmail { #hypershift.openshift.io/v1beta1.GCPServiceAccountEmail }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodeServiceAccount">GCPNodeServiceAccount</a>, 
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountsEmails">GCPServiceAccountsEmails</a>)
</p>
<p>
<p>GCPServiceAccountEmail is the email address of a Google Service Account.
Format: service-account-name@project-id.iam.gserviceaccount.com
See <a href="https://cloud.google.com/iam/docs/service-accounts-create">https://cloud.google.com/iam/docs/service-accounts-create</a> for service account naming rules.</p>
</p>
###GCPServiceAccountsEmails { #hypershift.openshift.io/v1beta1.GCPServiceAccountsEmails }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPWorkloadIdentityConfig">GCPWorkloadIdentityConfig</a>)
</p>
<p>
<p>GCPServiceAccountsEmails contains email addresses of Google Service Accounts for different controllers.
Each service account should have the appropriate IAM permissions for its specific role.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>nodePool</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountEmail">
GCPServiceAccountEmail
</a>
</em>
</td>
<td>
<p>nodePool is the Google Service Account email for CAPG controllers
that manage NodePool infrastructure (VMs, networks, disks, etc.).
This GSA requires the following IAM roles:
- roles/compute.instanceAdmin.v1 (Compute Instance Admin v1)
- roles/compute.networkAdmin (Compute Network Admin)
- roles/iam.serviceAccountUser (Service Account User - to attach service accounts to VMs)
See cmd/infra/gcp/iam-bindings.json for the authoritative role definitions.
Format: service-account-name@project-id.iam.gserviceaccount.com</p>
<p>This is a user-provided value referencing a pre-created Google Service Account.
Typically obtained from the output of <code>hypershift infra create gcp</code> which creates
the required service accounts with appropriate IAM roles and WIF bindings.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlane</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountEmail">
GCPServiceAccountEmail
</a>
</em>
</td>
<td>
<p>controlPlane is the Google Service Account email for the Control Plane Operator
that manages control plane infrastructure and resources.
This GSA requires the following IAM roles:
- roles/dns.admin (DNS Admin - for managing DNS records)
- roles/compute.networkAdmin (Compute Network Admin - for network management)
- roles/compute.viewer (Compute Viewer - for CCM to read instance metadata)
See cmd/infra/gcp/iam-bindings.json for the authoritative role definitions.
Format: service-account-name@project-id.iam.gserviceaccount.com</p>
<p>This is a user-provided value referencing a pre-created Google Service Account.
Typically obtained from the output of <code>hypershift infra create gcp</code> which creates
the required service accounts with appropriate IAM roles and WIF bindings.</p>
</td>
</tr>
<tr>
<td>
<code>cloudController</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountEmail">
GCPServiceAccountEmail
</a>
</em>
</td>
<td>
<p>cloudController is the Google Service Account email for the Cloud Controller Manager
that manages LoadBalancer services and node lifecycle in the hosted cluster.
This GSA requires the following IAM roles:
- roles/compute.loadBalancerAdmin (Load Balancer Admin - for provisioning GCP load balancers)
- roles/compute.securityAdmin (Security Admin - for managing firewall rules)
- roles/compute.viewer (Compute Viewer - for reading instance metadata for node management)
See cmd/infra/gcp/iam-bindings.json for the authoritative role definitions.
Format: service-account-name@project-id.iam.gserviceaccount.com</p>
<p>This is a user-provided value referencing a pre-created Google Service Account.
Typically obtained from the output of <code>hypershift infra create gcp</code> which creates
the required service accounts with appropriate IAM roles and WIF bindings.</p>
</td>
</tr>
<tr>
<td>
<code>storage</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountEmail">
GCPServiceAccountEmail
</a>
</em>
</td>
<td>
<p>storage is the Google Service Account email for the GCP PD CSI Driver
that manages Persistent Disk storage operations (create, attach, delete volumes).
This GSA requires the following IAM roles:
- roles/compute.storageAdmin (Compute Storage Admin - for managing persistent disks)
- roles/compute.instanceAdmin.v1 (Compute Instance Admin - for attaching disks to VMs)
- roles/iam.serviceAccountUser (Service Account User - for impersonation)
- roles/resourcemanager.tagUser (Tag User - for applying resource tags to disks)
See cmd/infra/gcp/iam-bindings.json for the authoritative role definitions.
Format: service-account-name@project-id.iam.gserviceaccount.com</p>
<p>This is a user-provided value referencing a pre-created Google Service Account.
Typically obtained from the output of <code>hypershift infra create gcp</code> which creates
the required service accounts with appropriate IAM roles and WIF bindings.</p>
</td>
</tr>
<tr>
<td>
<code>imageRegistry</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountEmail">
GCPServiceAccountEmail
</a>
</em>
</td>
<td>
<p>imageRegistry is the Google Service Account email for the Image Registry Operator
that manages GCS storage for the internal container image registry.
This GSA requires the following IAM roles:
- roles/storage.admin (Storage Admin - for creating and managing GCS buckets and objects)
See cmd/infra/gcp/iam-bindings.json for the authoritative role definitions.
Format: service-account-name@project-id.iam.gserviceaccount.com</p>
<p>This is a user-provided value referencing a pre-created Google Service Account.
Typically obtained from the output of <code>hypershift infra create gcp</code> which creates
the required service accounts with appropriate IAM roles and WIF bindings.</p>
</td>
</tr>
<tr>
<td>
<code>network</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountEmail">
GCPServiceAccountEmail
</a>
</em>
</td>
<td>
<p>network is the Google Service Account email for the Cloud Network Config Controller
that manages cloud-level network configurations (egress IPs, subnets).
This GSA requires the following IAM roles:
- roles/compute.instanceAdmin.v1 (Compute Instance Admin - for managing network interfaces)
- roles/compute.networkUser (Compute Network User - for using subnets)
See cmd/infra/gcp/iam-bindings.json for the authoritative role definitions.
Format: service-account-name@project-id.iam.gserviceaccount.com</p>
<p>This is a user-provided value referencing a pre-created Google Service Account.
Typically obtained from the output of <code>hypershift infra create gcp</code> which creates
the required service accounts with appropriate IAM roles and WIF bindings.</p>
</td>
</tr>
</tbody>
</table>
###GCPWorkloadIdentityConfig { #hypershift.openshift.io/v1beta1.GCPWorkloadIdentityConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.GCPPlatformSpec">GCPPlatformSpec</a>)
</p>
<p>
<p>GCPWorkloadIdentityConfig configures Workload Identity Federation for GCP clusters.
This enables secure, short-lived token-based authentication without storing
long-term service account keys.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>projectNumber</code></br>
<em>
string
</em>
</td>
<td>
<p>projectNumber is the numeric GCP project identifier for WIF configuration.
This differs from the project ID and is required for workload identity pools.
Must be a numeric string representing the GCP project number.
See <a href="https://cloud.google.com/resource-manager/docs/creating-managing-projects">https://cloud.google.com/resource-manager/docs/creating-managing-projects</a> for project number details.</p>
<p>This is a user-provided value obtained from GCP (found in GCP Console or via <code>gcloud projects describe PROJECT_ID</code>).
Also available in the output of <code>hypershift infra create gcp</code>.</p>
</td>
</tr>
<tr>
<td>
<code>poolID</code></br>
<em>
string
</em>
</td>
<td>
<p>poolID is the workload identity pool identifier within the project.
This pool is used to manage external identity mappings.
Must be 4-32 characters and start with a lowercase letter.
Allowed characters: lowercase letters (a-z), digits (0-9), hyphens (-).
Cannot start or end with a hyphen.
The prefix &ldquo;gcp-&rdquo; is reserved by Google and cannot be used.
See <a href="https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers">https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers</a> for naming rules.</p>
<p>This is a user-provided value referencing a pre-created Workload Identity Pool.
Typically obtained from the output of <code>hypershift infra create gcp</code> which creates
the WIF infrastructure and generates appropriate pool IDs.</p>
</td>
</tr>
<tr>
<td>
<code>providerID</code></br>
<em>
string
</em>
</td>
<td>
<p>providerID is the workload identity provider identifier within the pool.
This provider handles the token exchange between external and GCP identities.
Must be 4-32 characters and start with a lowercase letter.
Allowed characters: lowercase letters (a-z), digits (0-9), hyphens (-).
Cannot start or end with a hyphen.
The prefix &ldquo;gcp-&rdquo; is reserved by Google and cannot be used.
See <a href="https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers">https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers</a> for naming rules.</p>
<p>This is a user-provided value referencing a pre-created OIDC Provider within the WIF Pool.
Typically obtained from the output of <code>hypershift infra create gcp</code>.</p>
</td>
</tr>
<tr>
<td>
<code>serviceAccountsEmails,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPServiceAccountsEmails">
GCPServiceAccountsEmails
</a>
</em>
</td>
<td>
<p>serviceAccountsEmails contains email addresses of various Google Service Accounts
required to enable integrations for different controllers and operators.
This follows the AWS pattern of having different roles for different purposes.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupAzureBlob { #hypershift.openshift.io/v1beta1.HCPEtcdBackupAzureBlob }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupStorage">HCPEtcdBackupStorage</a>)
</p>
<p>
<p>HCPEtcdBackupAzureBlob defines the Azure Blob storage configuration for etcd backups.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>container</code></br>
<em>
string
</em>
</td>
<td>
<p>container is the name of the Azure Blob container where backups are stored.
Must be 3-63 characters, lowercase letters, numbers, and hyphens only.
Must start and end with a letter or number. Consecutive hyphens are not allowed.
See <a href="https://learn.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#container-names">https://learn.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers&ndash;blobs&ndash;and-metadata#container-names</a></p>
</td>
</tr>
<tr>
<td>
<code>storageAccount</code></br>
<em>
string
</em>
</td>
<td>
<p>storageAccount is the name of the Azure Storage Account.
Must be 3-24 characters, lowercase letters and numbers only.
See <a href="https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview#storage-account-name">https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview#storage-account-name</a></p>
</td>
</tr>
<tr>
<td>
<code>keyPrefix</code></br>
<em>
string
</em>
</td>
<td>
<p>keyPrefix is the blob name prefix for the backup file.
Must consist of valid blob name characters: alphanumeric characters, forward slashes,
hyphens, underscores, and periods.
See <a href="https://learn.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#blob-names">https://learn.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers&ndash;blobs&ndash;and-metadata#blob-names</a></p>
</td>
</tr>
<tr>
<td>
<code>credentials,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretReference">
SecretReference
</a>
</em>
</td>
<td>
<p>credentials references a Secret containing Azure credentials for uploading
to Blob Storage. The Secret must exist in the Hypershift Operator namespace.</p>
</td>
</tr>
<tr>
<td>
<code>encryptionKeyURL</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>encryptionKeyURL is the URL of the Azure Key Vault key used for encryption.
Must be a valid Azure Key Vault key URL in the format
&ldquo;https://<vault-name>.vault.azure.net/keys/<key-name>[/<key-version>]&rdquo;.
This field is immutable once set and cannot be removed.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupConfig { #hypershift.openshift.io/v1beta1.HCPEtcdBackupConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdSpec">ManagedEtcdSpec</a>)
</p>
<p>
<p>HCPEtcdBackupConfig defines the backup encryption configuration that is propagated
from the HostedCluster to the HostedControlPlane via ManagedEtcdSpec.
Exactly one platform-specific block must be specified, matching the platform discriminator.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupConfigPlatform">
HCPEtcdBackupConfigPlatform
</a>
</em>
</td>
<td>
<p>platform specifies the cloud platform for backup encryption configuration.
Valid values are &ldquo;AWS&rdquo; for AWS KMS encryption and &ldquo;Azure&rdquo; for Azure Key Vault encryption.</p>
</td>
</tr>
<tr>
<td>
<code>aws,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupConfigAWS">
HCPEtcdBackupConfigAWS
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aws contains AWS-specific backup encryption configuration.
Required when platform is &ldquo;AWS&rdquo;, and forbidden otherwise.</p>
</td>
</tr>
<tr>
<td>
<code>azure,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupConfigAzure">
HCPEtcdBackupConfigAzure
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>azure contains Azure-specific backup encryption configuration.
Required when platform is &ldquo;Azure&rdquo;, and forbidden otherwise.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupConfigAWS { #hypershift.openshift.io/v1beta1.HCPEtcdBackupConfigAWS }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupConfig">HCPEtcdBackupConfig</a>)
</p>
<p>
<p>HCPEtcdBackupConfigAWS defines AWS-specific encryption settings for etcd backups.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>kmsKeyARN</code></br>
<em>
string
</em>
</td>
<td>
<p>kmsKeyARN is the ARN of the AWS KMS key to use for encrypting etcd backup artifacts in S3.
Must be a valid AWS KMS key ARN in the format
&ldquo;arn:<partition>:kms:<region>:<account-id>:key/<key-id>&rdquo;
where partition is one of aws, aws-cn, or aws-us-gov.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupConfigAzure { #hypershift.openshift.io/v1beta1.HCPEtcdBackupConfigAzure }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupConfig">HCPEtcdBackupConfig</a>)
</p>
<p>
<p>HCPEtcdBackupConfigAzure defines Azure-specific encryption settings for etcd backups.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>encryptionKeyURL</code></br>
<em>
string
</em>
</td>
<td>
<p>encryptionKeyURL is the URL of the Azure Key Vault key to use for encrypting etcd backup artifacts.
Must be a valid Azure Key Vault key URL in the format
&ldquo;https://<vault-name>.vault.azure.net/keys/<key-name>[/<key-version>]&rdquo;.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupConfigPlatform { #hypershift.openshift.io/v1beta1.HCPEtcdBackupConfigPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupConfig">HCPEtcdBackupConfig</a>)
</p>
<p>
<p>HCPEtcdBackupConfigPlatform identifies the cloud platform for backup encryption configuration.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;AWS&#34;</p></td>
<td><p>AWSBackupConfigPlatform indicates AWS KMS encryption for backup artifacts.</p>
</td>
</tr><tr><td><p>&#34;Azure&#34;</p></td>
<td><p>AzureBackupConfigPlatform indicates Azure Key Vault encryption for backup artifacts.</p>
</td>
</tr></tbody>
</table>
###HCPEtcdBackupEncryptionMetadata { #hypershift.openshift.io/v1beta1.HCPEtcdBackupEncryptionMetadata }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupStatus">HCPEtcdBackupStatus</a>)
</p>
<p>
<p>HCPEtcdBackupEncryptionMetadata contains platform-specific metadata about the
encryption applied to the backup artifact in cloud storage.
The presence of a platform block indicates that encryption was applied.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>aws,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupEncryptionMetadataAWS">
HCPEtcdBackupEncryptionMetadataAWS
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aws contains AWS-specific encryption metadata for the backup.</p>
</td>
</tr>
<tr>
<td>
<code>azure,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupEncryptionMetadataAzure">
HCPEtcdBackupEncryptionMetadataAzure
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>azure contains Azure-specific encryption metadata for the backup.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupEncryptionMetadataAWS { #hypershift.openshift.io/v1beta1.HCPEtcdBackupEncryptionMetadataAWS }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupEncryptionMetadata">HCPEtcdBackupEncryptionMetadata</a>)
</p>
<p>
<p>HCPEtcdBackupEncryptionMetadataAWS contains AWS-specific encryption metadata.
The values here reflect the encryption settings from the HCPEtcdBackupConfig input.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>kmsKeyARN</code></br>
<em>
string
</em>
</td>
<td>
<p>kmsKeyARN is the ARN of the KMS key used for server-side encryption of the backup in S3.
Must be a valid AWS KMS key ARN in the format
&ldquo;arn:<partition>:kms:<region>:<account-id>:key/<key-id>&rdquo;
where partition is one of aws, aws-cn, or aws-us-gov.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupEncryptionMetadataAzure { #hypershift.openshift.io/v1beta1.HCPEtcdBackupEncryptionMetadataAzure }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupEncryptionMetadata">HCPEtcdBackupEncryptionMetadata</a>)
</p>
<p>
<p>HCPEtcdBackupEncryptionMetadataAzure contains Azure-specific encryption metadata.
The values here reflect the encryption settings from the HCPEtcdBackupConfig input.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>encryptionKeyURL</code></br>
<em>
string
</em>
</td>
<td>
<p>encryptionKeyURL is the URL of the Azure Key Vault key used for encryption of the backup.
Must be a valid Azure Key Vault key URL in the format
&ldquo;https://<vault-name>.vault.azure.net/keys/<key-name>[/<key-version>]&rdquo;.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupS3 { #hypershift.openshift.io/v1beta1.HCPEtcdBackupS3 }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupStorage">HCPEtcdBackupStorage</a>)
</p>
<p>
<p>HCPEtcdBackupS3 defines the S3 storage configuration for etcd backups.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>bucket</code></br>
<em>
string
</em>
</td>
<td>
<p>bucket is the name of the S3 bucket where backups are stored.
Must be 3-63 characters, lowercase letters, numbers, hyphens, and periods only.
Must start and end with a letter or number. Consecutive periods are not allowed.
See <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html">https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html</a></p>
</td>
</tr>
<tr>
<td>
<code>region</code></br>
<em>
string
</em>
</td>
<td>
<p>region is the AWS region where the S3 bucket is located (e.g. &ldquo;us-east-1&rdquo;).
Must be a valid AWS region identifier: lowercase letters, digits, and hyphens.
Must start and end with an alphanumeric character, no consecutive hyphens.</p>
</td>
</tr>
<tr>
<td>
<code>keyPrefix</code></br>
<em>
string
</em>
</td>
<td>
<p>keyPrefix is the S3 key prefix for the backup file.
Must consist of safe S3 object key characters: alphanumeric characters,
forward slashes, hyphens, underscores, periods, exclamation marks,
asterisks, single quotes, and parentheses.
See <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html">https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html</a></p>
</td>
</tr>
<tr>
<td>
<code>credentials,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretReference">
SecretReference
</a>
</em>
</td>
<td>
<p>credentials references a Secret containing AWS credentials for uploading
to S3. The Secret must exist in the Hypershift Operator namespace and contain a
&lsquo;credentials&rsquo; key with a valid AWS credentials file.</p>
</td>
</tr>
<tr>
<td>
<code>kmsKeyARN</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>kmsKeyARN is the ARN of the KMS key used for server-side encryption of the backup.
Must be a valid AWS KMS key ARN in the format
&ldquo;arn:<partition>:kms:<region>:<account-id>:key/<key-id>&rdquo;
where partition is one of aws, aws-cn, or aws-us-gov.
This field is immutable once set and cannot be removed.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupSpec { #hypershift.openshift.io/v1beta1.HCPEtcdBackupSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackup">HCPEtcdBackup</a>)
</p>
<p>
<p>HCPEtcdBackupSpec defines the desired state of HCPEtcdBackup.
HCPEtcdBackup is a one-shot backup request; the entire spec is immutable once created.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>storage,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupStorage">
HCPEtcdBackupStorage
</a>
</em>
</td>
<td>
<p>storage defines the cloud storage backend where the etcd snapshot will be uploaded.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupStatus { #hypershift.openshift.io/v1beta1.HCPEtcdBackupStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackup">HCPEtcdBackup</a>)
</p>
<p>
<p>HCPEtcdBackupStatus defines the observed state of HCPEtcdBackup.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>conditions</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#condition-v1-meta">
[]Kubernetes meta/v1.Condition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>conditions contains details for the current state of the etcd backup.
The following condition types are expected:
- &ldquo;BackupCompleted&rdquo;: indicates whether the etcd backup has completed (True=success, False=failure).</p>
</td>
</tr>
<tr>
<td>
<code>snapshotURL</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>snapshotURL is the URL of the completed backup snapshot in cloud storage.
Must be a valid URL with scheme https or s3.</p>
</td>
</tr>
<tr>
<td>
<code>encryptionMetadata,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupEncryptionMetadata">
HCPEtcdBackupEncryptionMetadata
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>encryptionMetadata contains metadata about the encryption of the backup.
When present, at least one platform-specific encryption block must be set.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupStorage { #hypershift.openshift.io/v1beta1.HCPEtcdBackupStorage }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupSpec">HCPEtcdBackupSpec</a>)
</p>
<p>
<p>HCPEtcdBackupStorage defines the cloud storage backend configuration for the backup.
Exactly one storage backend must be specified, matching the storageType discriminator.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>storageType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupStorageType">
HCPEtcdBackupStorageType
</a>
</em>
</td>
<td>
<p>storageType specifies the type of cloud storage backend for the etcd backup.
Valid values are &ldquo;S3&rdquo; for AWS S3 storage and &ldquo;AzureBlob&rdquo; for Azure Blob Storage.</p>
</td>
</tr>
<tr>
<td>
<code>s3,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupS3">
HCPEtcdBackupS3
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>s3 specifies the S3 storage configuration for the etcd backup.
Required when storageType is &ldquo;S3&rdquo;, and forbidden otherwise.</p>
</td>
</tr>
<tr>
<td>
<code>azureBlob,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupAzureBlob">
HCPEtcdBackupAzureBlob
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>azureBlob specifies the Azure Blob storage configuration for the etcd backup.
Required when storageType is &ldquo;AzureBlob&rdquo;, and forbidden otherwise.</p>
</td>
</tr>
</tbody>
</table>
###HCPEtcdBackupStorageType { #hypershift.openshift.io/v1beta1.HCPEtcdBackupStorageType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupStorage">HCPEtcdBackupStorage</a>)
</p>
<p>
<p>HCPEtcdBackupStorageType is the type of storage for etcd backups.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;AzureBlob&#34;</p></td>
<td><p>AzureBlobBackupStorage indicates that the backup is stored in Azure Blob Storage.</p>
</td>
</tr><tr><td><p>&#34;S3&#34;</p></td>
<td><p>S3BackupStorage indicates that the backup is stored in AWS S3.</p>
</td>
</tr></tbody>
</table>
###HostedClusterSpec { #hypershift.openshift.io/v1beta1.HostedClusterSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedCluster">HostedCluster</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>release</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Release">
Release
</a>
</em>
</td>
<td>
<p>release specifies the desired OCP release payload for all the hosted cluster components.
This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc.
The maximum and minimum supported release versions are determined by the running Hypersfhit Operator.
Attempting to use an unsupported version will result in the HostedCluster being degraded and the validateReleaseImage condition being false.
Attempting to use a release with a skew against a NodePool release bigger than N-2 for the y-stream will result in leaving the NodePool in an unsupported state.
Changing this field will trigger a rollout of the control plane components.
The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneRelease</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Release">
Release
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controlPlaneRelease is like spec.release but only for the components running on the management cluster.
This excludes any operand which will land in the hosted cluster data plane.
It is useful when you need to apply patch management side like a CVE, transparently for the hosted cluster.
Version input for this field is free, no validation is performed against spec.release or maximum and minimum is performed.
If defined, it will dicate the version of the components running management side, while spec.release will dictate the version of the components landing in the hosted cluster data plane.
If not defined, spec.release is used for both.
Changing this field will trigger a rollout of the control plane.
The behavior of the rollout will be driven by the ControllerAvailabilityPolicy and InfrastructureAvailabilityPolicy for PDBs and maxUnavailable and surce policies.</p>
</td>
</tr>
<tr>
<td>
<code>clusterID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>clusterID uniquely identifies this cluster. This is expected to be an RFC4122 UUID value (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx in hexadecimal digits).
As with a Kubernetes metadata.uid, this ID uniquely identifies this cluster in space and time.
This value identifies the cluster in metrics pushed to telemetry and metrics produced by the control plane operators.
If a value is not specified, a random clusterID will be generated and set by the controller.
Once set, this value is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>infraID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>infraID is a globally unique identifier for the cluster.
It must consist of lowercase alphanumeric characters and hyphens (&lsquo;-&rsquo;) only, and start and end with an alphanumeric character.
It must be no more than 253 characters in length.
This identifier will be used to associate various cloud resources with the HostedCluster and its associated NodePools.
infraID is used to compute and tag created resources with &ldquo;kubernetes.io/cluster/&rdquo;+hcluster.Spec.InfraID which has contractual meaning for the cloud provider implementations.
If a value is not specified, a random infraID will be generated and set by the controller.
Once set, this value is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>updateService</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.URL
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>updateService may be used to specify the preferred upstream update service.
If omitted we will use the appropriate update service for the cluster and region.
This is used by the control plane operator to determine and signal the appropriate available upgrades in the hostedCluster.status.</p>
</td>
</tr>
<tr>
<td>
<code>channel</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>channel is an identifier for explicitly requesting that a non-default set of updates be applied to this cluster.
If omitted no particular upgrades are suggested.
TODO(alberto): Consider the backend to use the default channel by default. Default channel will contain stable updates that are appropriate for production clusters.</p>
</td>
</tr>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">
PlatformSpec
</a>
</em>
</td>
<td>
<p>platform specifies the underlying infrastructure provider for the cluster
and is used to configure platform specific behavior.</p>
</td>
</tr>
<tr>
<td>
<code>kubeAPIServerDNSName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
If it&rsquo;s set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.</p>
</td>
</tr>
<tr>
<td>
<code>controllerAvailabilityPolicy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AvailabilityPolicy">
AvailabilityPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controllerAvailabilityPolicy specifies the availability policy applied to critical control plane components like the Kube API Server.
Possible values are HighlyAvailable and SingleReplica. The default value is HighlyAvailable.
This field is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>infrastructureAvailabilityPolicy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AvailabilityPolicy">
AvailabilityPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>infrastructureAvailabilityPolicy specifies the availability policy applied to infrastructure services which run on the hosted cluster data plane like the ingress controller and image registry controller.
Possible values are HighlyAvailable and SingleReplica. The default value is SingleReplica.</p>
</td>
</tr>
<tr>
<td>
<code>dns</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.DNSSpec">
DNSSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>dns specifies the DNS configuration for the hosted cluster ingress.</p>
</td>
</tr>
<tr>
<td>
<code>networking</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">
ClusterNetworking
</a>
</em>
</td>
<td>
<p>networking specifies network configuration for the hosted cluster.
Defaults to OVNKubernetes with a cluster network of cidr: &ldquo;10.132.0.0/14&rdquo; and a service network of cidr: &ldquo;172.31.0.0/16&rdquo;.</p>
</td>
</tr>
<tr>
<td>
<code>autoscaling</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterAutoscaling">
ClusterAutoscaling
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoscaling specifies auto-scaling behavior that applies to all NodePools
associated with this HostedCluster.</p>
</td>
</tr>
<tr>
<td>
<code>autoNode,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AutoNode">
AutoNode
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoNode specifies the configuration for automatic node provisioning and lifecycle management.
When set, the provisioner(e.g. Karpenter) will be used to provision nodes for targeted workloads.</p>
</td>
</tr>
<tr>
<td>
<code>etcd</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdSpec">
EtcdSpec
</a>
</em>
</td>
<td>
<p>etcd specifies configuration for the control plane etcd cluster. The
default managementType is Managed. Once set, the managementType cannot be
changed.</p>
</td>
</tr>
<tr>
<td>
<code>services</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategyMapping">
[]ServicePublishingStrategyMapping
</a>
</em>
</td>
<td>
<p>services specifies how individual control plane services endpoints are published for consumption.
This requires APIServer;OAuthServer;Konnectivity;Ignition.
This field is immutable for all platforms but IBMCloud.
Max is 6 to account for OIDC;OVNSbDb for backward compatibility though they are no-op.</p>
<p>-kubebuilder:validation:XValidation:rule=&ldquo;self.all(s, !(s.service == &lsquo;APIServer&rsquo; &amp;&amp; s.servicePublishingStrategy.type == &lsquo;Route&rsquo;) || has(s.servicePublishingStrategy.route.hostname))&rdquo;,message=&ldquo;If serviceType is &lsquo;APIServer&rsquo; and publishing strategy is &lsquo;Route&rsquo;, then hostname must be set&rdquo;
-kubebuilder:validation:XValidation:rule=&ldquo;self.platform.type == &lsquo;IBMCloud&rsquo; ? [&lsquo;APIServer&rsquo;, &lsquo;OAuthServer&rsquo;, &lsquo;Konnectivity&rsquo;].all(requiredType, self.exists(s, s.service == requiredType))&rdquo;,message=&ldquo;Services list must contain at least &lsquo;APIServer&rsquo;, &lsquo;OAuthServer&rsquo;, and &lsquo;Konnectivity&rsquo; service types&rdquo; : [&lsquo;APIServer&rsquo;, &lsquo;OAuthServer&rsquo;, &lsquo;Konnectivity&rsquo;, &lsquo;Ignition&rsquo;].all(requiredType, self.exists(s, s.service == requiredType))&ldquo;,message=&ldquo;Services list must contain at least &lsquo;APIServer&rsquo;, &lsquo;OAuthServer&rsquo;, &lsquo;Konnectivity&rsquo;, and &lsquo;Ignition&rsquo; service types&rdquo;
-kubebuilder:validation:XValidation:rule=&ldquo;self.filter(s, s.servicePublishingStrategy.type == &lsquo;Route&rsquo; &amp;&amp; has(s.servicePublishingStrategy.route) &amp;&amp; has(s.servicePublishingStrategy.route.hostname)).all(x, self.filter(y, y.servicePublishingStrategy.type == &lsquo;Route&rsquo; &amp;&amp; (has(y.servicePublishingStrategy.route) &amp;&amp; has(y.servicePublishingStrategy.route.hostname) &amp;&amp; y.servicePublishingStrategy.route.hostname == x.servicePublishingStrategy.route.hostname)).size() &lt;= 1)&rdquo;,message=&ldquo;Each route publishingStrategy &lsquo;hostname&rsquo; must be unique within the Services list.&rdquo;
-kubebuilder:validation:XValidation:rule=&ldquo;self.filter(s, s.servicePublishingStrategy.type == &lsquo;NodePort&rsquo; &amp;&amp; has(s.servicePublishingStrategy.nodePort) &amp;&amp; has(s.servicePublishingStrategy.nodePort.address) &amp;&amp; has(s.servicePublishingStrategy.nodePort.port)).all(x, self.filter(y, y.servicePublishingStrategy.type == &lsquo;NodePort&rsquo; &amp;&amp; (has(y.servicePublishingStrategy.nodePort) &amp;&amp; has(y.servicePublishingStrategy.nodePort.address) &amp;&amp; y.servicePublishingStrategy.nodePort.address == x.servicePublishingStrategy.nodePort.address &amp;&amp; has(y.servicePublishingStrategy.nodePort.port) &amp;&amp; y.servicePublishingStrategy.nodePort.port == x.servicePublishingStrategy.nodePort.port )).size() &lt;= 1)&rdquo;,message=&ldquo;Each nodePort publishingStrategy &lsquo;nodePort&rsquo; and &lsquo;hostname&rsquo; must be unique within the Services list.&rdquo;
TODO(alberto): this breaks the cost budget for &lt; 4.17. We should figure why and enable it back. And If not fixable, consider imposing a minimum version on the management cluster.</p>
</td>
</tr>
<tr>
<td>
<code>pullSecret</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>pullSecret is a local reference to a Secret that must have a &ldquo;.dockerconfigjson&rdquo; key whose content must be a valid Openshift pull secret JSON.
If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
TODO(alberto): Signal this in a condition.
This pull secret is included in NodePool ignition/bootstrap payloads and applied to the container runtime when nodes provision.
Changing this value will trigger a rollout for all existing NodePools in the cluster (for both replace and inplace upgrade types).
Updating the referenced Secret&rsquo;s data in place (without changing this reference) does not trigger that rollout.
In AWS and Azure NodePools using the Replace upgrade strategy, the Secret&rsquo;s data in place changes
will still propagate the updated credentials down to the guest cluster and kubelet config.
TODO(alberto): have our own local reference type to include our opinions and avoid transparent changes.</p>
</td>
</tr>
<tr>
<td>
<code>sshKey</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>sshKey is a local reference to a Secret that must have a &ldquo;id_rsa.pub&rdquo; key whose content must be the public part of 1..N SSH keys.
If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
TODO(alberto): Signal this in a condition.
When sshKey is set, the controllers will generate a machineConfig with the sshAuthorizedKeys <a href="https://coreos.github.io/ignition/configuration-v3_2/">https://coreos.github.io/ignition/configuration-v3_2/</a> populated with this value.
This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>issuerURL</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>issuerURL is an OIDC issuer URL which will be used as the issuer in all
ServiceAccount tokens generated by the control plane API server via &ndash;service-account-issuer kube api server flag.
<a href="https://k8s-docs.netlify.app/en/docs/reference/command-line-tools-reference/kube-apiserver/">https://k8s-docs.netlify.app/en/docs/reference/command-line-tools-reference/kube-apiserver/</a>
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection</a>
The default value is kubernetes.default.svc, which only works for in-cluster
validation.
If the platform is AWS and this value is set, the controller will update an s3 object with the appropriate OIDC documents (using the serviceAccountSigningKey info) into that issuerURL.
The expectation is for this s3 url to be backed by an OIDC provider in the AWS IAM.</p>
</td>
</tr>
<tr>
<td>
<code>serviceAccountSigningKey</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>serviceAccountSigningKey is a local reference to a secret that must have a &ldquo;key&rdquo; key whose content must be the private key
used by the service account token issuer.
If not specified, a service account signing key will
be generated automatically for the cluster.
When specifying a service account signing key, an IssuerURL must also be specified.
If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
TODO(alberto): Signal this in a condition.</p>
<p>For key rotation, the secret may optionally contain an &ldquo;old-key.pub&rdquo; key whose content is the PEM-encoded
public key of the previous signing key. When present, the kube-apiserver will accept tokens signed by
both the current and previous keys, allowing for graceful key rotation without invalidating existing tokens.</p>
</td>
</tr>
<tr>
<td>
<code>configuration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterConfiguration">
ClusterConfiguration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>configuration specifies configuration for individual OCP components in the
cluster, represented as embedded resources that correspond to the openshift
configuration API.</p>
</td>
</tr>
<tr>
<td>
<code>operatorConfiguration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OperatorConfiguration">
OperatorConfiguration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>operatorConfiguration specifies configuration for individual OCP operators in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>auditWebhook</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>auditWebhook contains metadata for configuring an audit webhook endpoint
for a cluster to process cluster audit events. It references a secret that
contains the webhook information for the audit webhook endpoint. It is a
secret because if the endpoint has mTLS the kubeconfig will contain client
keys. The kubeconfig needs to be stored in the secret with a secret key
name that corresponds to the constant AuditWebhookKubeconfigKey.</p>
</td>
</tr>
<tr>
<td>
<code>imageContentSources</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ImageContentSource">
[]ImageContentSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageContentSources specifies image mirrors that can be used by cluster
nodes to pull content.
When imageContentSources is set, the controllers will generate a machineConfig.
This MachineConfig will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>additionalTrustBundle</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>additionalTrustBundle is a local reference to a ConfigMap that must have a &ldquo;ca-bundle.crt&rdquo; key
whose content must be a PEM-encoded X.509 certificate bundle that will be added to the hosted controlplane and nodes
If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state.
TODO(alberto): Signal this in a condition.
This will be part of every payload generated by the controllers for any NodePool of the HostedCluster.
Changing this value will trigger a rollout for all existing NodePools in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>secretEncryption</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionSpec">
SecretEncryptionSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>secretEncryption specifies a Kubernetes secret encryption strategy for the
control plane.</p>
</td>
</tr>
<tr>
<td>
<code>fips</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>fips indicates whether this cluster&rsquo;s nodes will be running in FIPS mode.
If set to true, the control plane&rsquo;s ignition server will be configured to
expect that nodes joining the cluster will be FIPS-enabled.</p>
</td>
</tr>
<tr>
<td>
<code>pausedUntil</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>pausedUntil is a field that can be used to pause reconciliation on the HostedCluster controller, resulting in any change to the HostedCluster being ignored.
Either a date can be provided in RFC3339 format or a boolean as in &lsquo;true&rsquo;, &lsquo;false&rsquo;, &lsquo;True&rsquo;, &lsquo;False&rsquo;. If a date is
provided: reconciliation is paused on the resource until that date. If the boolean true is
provided: reconciliation is paused on the resource until the field is removed.</p>
</td>
</tr>
<tr>
<td>
<code>olmCatalogPlacement</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OLMCatalogPlacement">
OLMCatalogPlacement
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>olmCatalogPlacement specifies the placement of OLM catalog components. By default,
this is set to management and OLM catalog components are deployed onto the management
cluster. If set to guest, the OLM catalog components will be deployed onto the guest
cluster.</p>
</td>
</tr>
<tr>
<td>
<code>nodeSelector</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeSelector when specified, is propagated to all control plane Deployments and Stateful sets running management side.
It must be satisfied by the management Nodes for the pods to be scheduled. Otherwise the HostedCluster will enter a degraded state.
Changes to this field will propagate to existing Deployments and StatefulSets.
TODO(alberto): add additional validation for the map key/values.</p>
</td>
</tr>
<tr>
<td>
<code>tolerations</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#toleration-v1-core">
[]Kubernetes core/v1.Toleration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>tolerations when specified, define what custom tolerations are added to the hcp pods.</p>
</td>
</tr>
<tr>
<td>
<code>labels</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>labels when specified, define what custom labels are added to the hcp pods.
Changing this day 2 will cause a rollout of all hcp pods.
Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
Valid values are those in <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set">https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set</a></p>
<p>-kubebuilder:validation:XValidation:rule=<code>self.all(key, size(key) &lt;= 317 &amp;&amp; key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))</code>, message=&ldquo;label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (<em>), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)&rdquo;
-kubebuilder:validation:XValidation:rule=<code>self.all(key, size(self[key]) &lt;= 63 &amp;&amp; self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))</code>, message=&ldquo;label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (</em>) or dots (.), and begin and end with an alphanumeric character&rdquo;
TODO: key/value validations break cost budget for &lt;=4.17. We should figure why and enable it back.</p>
</td>
</tr>
<tr>
<td>
<code>capabilities</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Capabilities">
Capabilities
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>capabilities allows for disabling optional components at cluster install time.
This field is optional and once set cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>monitoring,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MonitoringSpec">
MonitoringSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>monitoring configures monitoring for the hosted cluster, including
forwarding of control plane metrics to the hosted cluster&rsquo;s monitoring stack.
When omitted, metrics forwarding behavior is determined by the
hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility.
If neither is set, metrics forwarding is disabled.</p>
</td>
</tr>
</tbody>
</table>
###HostedClusterStatus { #hypershift.openshift.io/v1beta1.HostedClusterStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedCluster">HostedCluster</a>)
</p>
<p>
<p>HostedClusterStatus is the latest observed status of a HostedCluster.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>conditions</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#condition-v1-meta">
[]Kubernetes meta/v1.Condition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>conditions represents the latest available observations of a control
plane&rsquo;s current state.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneVersion,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneVersionStatus">
ControlPlaneVersionStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controlPlaneVersion tracks the rollout status of the control plane
components running on the management cluster, independently from
the data-plane version reported in the version field.</p>
</td>
</tr>
<tr>
<td>
<code>version</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterVersionStatus">
ClusterVersionStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>version is the status of the release version applied to the
HostedCluster.</p>
</td>
</tr>
<tr>
<td>
<code>kubeconfig</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeconfig is a reference to the secret containing the default kubeconfig
for the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>customKubeconfig</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>customKubeconfig is a local secret reference to the external custom kubeconfig.
Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the <code>HostedCluster</code> namespace.</p>
</td>
</tr>
<tr>
<td>
<code>kubeadminPassword</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeadminPassword is a reference to the secret that contains the initial
kubeadmin user password for the guest cluster.</p>
</td>
</tr>
<tr>
<td>
<code>ignitionEndpoint</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ignitionEndpoint is the endpoint injected in the ign config userdata.
It exposes the config for instances to become kubernetes nodes.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneEndpoint</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.APIEndpoint">
APIEndpoint
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controlPlaneEndpoint contains the endpoint information by which
external clients can access the control plane. This is populated
after the infrastructure is ready.</p>
</td>
</tr>
<tr>
<td>
<code>oauthCallbackURLTemplate</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>oauthCallbackURLTemplate contains a template for the URL to use as a callback
for identity providers. The [identity-provider-name] placeholder must be replaced
with the name of an identity provider defined on the HostedCluster.
This is populated after the infrastructure is ready.</p>
</td>
</tr>
<tr>
<td>
<code>payloadArch</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PayloadArchType">
PayloadArchType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>payloadArch represents the CPU architecture type of the HostedCluster.Spec.Release.Image. The valid values are:
Multi, ARM64, AMD64, S390X, or PPC64LE.</p>
</td>
</tr>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlatformStatus">
PlatformStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>platform contains platform-specific status of the HostedCluster</p>
</td>
</tr>
<tr>
<td>
<code>autoNode,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AutoNodeStatus">
AutoNodeStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoNode contains the observed state of the autoNode (Karpenter) provisioner.</p>
</td>
</tr>
<tr>
<td>
<code>configuration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ConfigurationStatus">
ConfigurationStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>configuration contains the cluster configuration status of the HostedCluster</p>
</td>
</tr>
<tr>
<td>
<code>lastSuccessfulEtcdBackupURL</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>lastSuccessfulEtcdBackupURL is the cloud storage URL of the most recent
successful etcd backup snapshot. Persisted here because HCPEtcdBackup CRs
are ephemeral and may be deleted by retention policies.</p>
</td>
</tr>
<tr>
<td>
<code>secretEncryption,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionStatus">
SecretEncryptionStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>secretEncryption tracks the state of secret encryption key rotation and re-encryption.</p>
</td>
</tr>
</tbody>
</table>
###HostedControlPlaneSpec { #hypershift.openshift.io/v1beta1.HostedControlPlaneSpec }
<p>
<p>HostedControlPlaneSpec defines the desired state of HostedControlPlane</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>releaseImage</code></br>
<em>
string
</em>
</td>
<td>
<p>releaseImage is the release image applied to the hosted control plane.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneReleaseImage</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>controlPlaneReleaseImage specifies the desired OCP release payload for
control plane components running on the management cluster.
If not defined, ReleaseImage is used</p>
</td>
</tr>
<tr>
<td>
<code>updateService</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.URL
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>updateService may be used to specify the preferred upstream update service.
By default it will use the appropriate update service for the cluster and region.</p>
</td>
</tr>
<tr>
<td>
<code>channel</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>channel is an identifier for explicitly requesting that a non-default
set of updates be applied to this cluster. The default channel will be
contain stable updates that are appropriate for production clusters.</p>
</td>
</tr>
<tr>
<td>
<code>pullSecret</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>pullSecret is a reference to a secret containing the pull secret for the hosted control plane.</p>
</td>
</tr>
<tr>
<td>
<code>issuerURL</code></br>
<em>
string
</em>
</td>
<td>
<p>issuerURL is an OIDC issuer URL which is used as the issuer in all
ServiceAccount tokens generated by the control plane API server. The
default value is kubernetes.default.svc, which only works for in-cluster
validation.</p>
</td>
</tr>
<tr>
<td>
<code>networking</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">
ClusterNetworking
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>networking specifies network configuration for the cluster.
Temporarily optional for backward compatibility, required in future releases.</p>
</td>
</tr>
<tr>
<td>
<code>sshKey</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>sshKey is a reference to a secret containing the SSH key for the hosted control plane.</p>
</td>
</tr>
<tr>
<td>
<code>clusterID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>clusterID is the unique id that identifies the cluster externally.
Making it optional here allows us to keep compatibility with previous
versions of the control-plane-operator that have no knowledge of this
field.</p>
</td>
</tr>
<tr>
<td>
<code>infraID</code></br>
<em>
string
</em>
</td>
<td>
<p>infraID is the unique id that identifies the cluster internally.</p>
</td>
</tr>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">
PlatformSpec
</a>
</em>
</td>
<td>
<p>platform is the platform configuration for the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>dns</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.DNSSpec">
DNSSpec
</a>
</em>
</td>
<td>
<p>dns is the DNS configuration for the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>serviceAccountSigningKey</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>serviceAccountSigningKey is a reference to a secret containing the private key
used by the service account token issuer. The secret is expected to contain
a single key named &ldquo;key&rdquo;. If not specified, a service account signing key will
be generated automatically for the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>controllerAvailabilityPolicy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AvailabilityPolicy">
AvailabilityPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controllerAvailabilityPolicy specifies the availability policy applied to
critical control plane components. The default value is SingleReplica.</p>
</td>
</tr>
<tr>
<td>
<code>infrastructureAvailabilityPolicy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AvailabilityPolicy">
AvailabilityPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>infrastructureAvailabilityPolicy specifies the availability policy applied
to infrastructure services which run on cluster nodes. The default value is
SingleReplica.</p>
</td>
</tr>
<tr>
<td>
<code>fips</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>fips specifies if the nodes for the cluster will be running in FIPS mode</p>
</td>
</tr>
<tr>
<td>
<code>kubeconfig</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubeconfigSecretRef">
KubeconfigSecretRef
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeconfig specifies the name and key for the kubeconfig secret</p>
</td>
</tr>
<tr>
<td>
<code>kubeAPIServerDNSName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
If it&rsquo;s set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.</p>
</td>
</tr>
<tr>
<td>
<code>services</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategyMapping">
[]ServicePublishingStrategyMapping
</a>
</em>
</td>
<td>
<p>services defines metadata about how control plane services are published
in the management cluster.</p>
</td>
</tr>
<tr>
<td>
<code>auditWebhook</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>auditWebhook contains metadata for configuring an audit webhook
endpoint for a cluster to process cluster audit events. It references
a secret that contains the webhook information for the audit webhook endpoint.
It is a secret because if the endpoint has MTLS the kubeconfig will contain client
keys. This is currently only supported in IBM Cloud. The kubeconfig needs to be stored
in the secret with a secret key name that corresponds to the constant AuditWebhookKubeconfigKey.</p>
</td>
</tr>
<tr>
<td>
<code>etcd</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdSpec">
EtcdSpec
</a>
</em>
</td>
<td>
<p>etcd contains metadata about the etcd cluster the hypershift managed Openshift control plane components
use to store data.</p>
</td>
</tr>
<tr>
<td>
<code>configuration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterConfiguration">
ClusterConfiguration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>configuration embeds resources that correspond to the openshift configuration API:
<a href="https://docs.openshift.com/container-platform/4.7/rest_api/config_apis/config-apis-index.html">https://docs.openshift.com/container-platform/4.7/rest_api/config_apis/config-apis-index.html</a></p>
</td>
</tr>
<tr>
<td>
<code>operatorConfiguration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OperatorConfiguration">
OperatorConfiguration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>operatorConfiguration specifies configuration for individual OCP operators in the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>monitoring,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MonitoringSpec">
MonitoringSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>monitoring configures monitoring for the hosted cluster, including
forwarding of control plane metrics to the hosted cluster&rsquo;s monitoring stack.
When omitted, metrics forwarding is not configured and will be inactive.</p>
</td>
</tr>
<tr>
<td>
<code>imageContentSources</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ImageContentSource">
[]ImageContentSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageContentSources lists sources/repositories for the release-image content.</p>
</td>
</tr>
<tr>
<td>
<code>additionalTrustBundle</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>additionalTrustBundle references a ConfigMap containing a PEM-encoded X.509 certificate bundle</p>
</td>
</tr>
<tr>
<td>
<code>secretEncryption</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionSpec">
SecretEncryptionSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>secretEncryption contains metadata about the kubernetes secret encryption strategy being used for the
cluster when applicable.</p>
</td>
</tr>
<tr>
<td>
<code>pausedUntil</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>pausedUntil is a field that can be used to pause reconciliation on a resource.
Either a date can be provided in RFC3339 format or a boolean. If a date is
provided: reconciliation is paused on the resource until that date. If the boolean true is
provided: reconciliation is paused on the resource until the field is removed.</p>
</td>
</tr>
<tr>
<td>
<code>olmCatalogPlacement</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OLMCatalogPlacement">
OLMCatalogPlacement
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>olmCatalogPlacement specifies the placement of OLM catalog components. By default,
this is set to management and OLM catalog components are deployed onto the management
cluster. If set to guest, the OLM catalog components will be deployed onto the guest
cluster.</p>
</td>
</tr>
<tr>
<td>
<code>autoscaling</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterAutoscaling">
ClusterAutoscaling
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoscaling specifies auto-scaling behavior that applies to all NodePools
associated with the control plane.</p>
</td>
</tr>
<tr>
<td>
<code>autoNode,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AutoNode">
AutoNode
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoNode specifies the configuration for automatic node provisioning
and lifecycle management. When set, nodes are automatically provisioned
using the specified provisioner (e.g. Karpenter) instead of requiring
manual NodePool management.</p>
</td>
</tr>
<tr>
<td>
<code>nodeSelector</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeSelector when specified, must be true for the pods managed by the HostedCluster to be scheduled.</p>
</td>
</tr>
<tr>
<td>
<code>tolerations</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#toleration-v1-core">
[]Kubernetes core/v1.Toleration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>tolerations when specified, define what custom tolerations are added to the hcp pods.</p>
</td>
</tr>
<tr>
<td>
<code>labels</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>labels when specified, define what custom labels are added to the hcp pods.
Changing this day 2 will cause a rollout of all hcp pods.
Duplicate keys are not supported. If duplicate keys are defined, only the last key/value pair is preserved.
Valid values are those in <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set">https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set</a></p>
<p>-kubebuilder:validation:XValidation:rule=<code>self.all(key, size(key) &lt;= 317 &amp;&amp; key.matches('^(([A-Za-z0-9]+(\\.[A-Za-z0-9]+)?)*[A-Za-z0-9]\\/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$'))</code>, message=&ldquo;label key must have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (<em>), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/)&rdquo;
-kubebuilder:validation:XValidation:rule=<code>self.all(key, size(self[key]) &lt;= 63 &amp;&amp; self[key].matches('^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$'))</code>, message=&ldquo;label value must be 63 characters or less (can be empty), consist of alphanumeric characters, dashes (-), underscores (</em>) or dots (.), and begin and end with an alphanumeric character&rdquo;
TODO: key/value validations break cost budget for &lt;=4.17. We should figure why and enable it back.</p>
</td>
</tr>
<tr>
<td>
<code>capabilities</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Capabilities">
Capabilities
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>capabilities allows for disabling optional components at cluster install time.
This field is optional and once set cannot be changed.</p>
</td>
</tr>
</tbody>
</table>
###HostedControlPlaneStatus { #hypershift.openshift.io/v1beta1.HostedControlPlaneStatus }
<p>
<p>HostedControlPlaneStatus defines the observed state of HostedControlPlane</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>conditions</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#condition-v1-meta">
[]Kubernetes meta/v1.Condition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>conditions contains details for one aspect of the current state of the HostedControlPlane.
Current condition types are: &ldquo;Available&rdquo;</p>
</td>
</tr>
<tr>
<td>
<code>ready</code></br>
<em>
bool
</em>
</td>
<td>
<p>ready denotes that the HostedControlPlane API Server is ready to
receive requests
This satisfies CAPI contract <a href="https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L226-L230">https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L226-L230</a></p>
</td>
</tr>
<tr>
<td>
<code>initialized</code></br>
<em>
bool
</em>
</td>
<td>
<p>initialized denotes whether or not the control plane has
provided a kubeadm-config.
Once this condition is marked true, its value is never changed. See the Ready condition for an indication of
the current readiness of the cluster&rsquo;s control plane.
This satisfies CAPI contract <a href="https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L238-L252">https://github.com/kubernetes-sigs/cluster-api/blob/cd3a694deac89d5ebeb888307deaa61487207aa0/controllers/cluster_controller_phases.go#L238-L252</a></p>
</td>
</tr>
<tr>
<td>
<code>externalManagedControlPlane</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>externalManagedControlPlane indicates to cluster-api that the control plane
is managed by an external service.
<a href="https://github.com/kubernetes-sigs/cluster-api/blob/65e5385bffd71bf4aad3cf34a537f11b217c7fab/controllers/machine_controller.go#L468">https://github.com/kubernetes-sigs/cluster-api/blob/65e5385bffd71bf4aad3cf34a537f11b217c7fab/controllers/machine_controller.go#L468</a></p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneEndpoint</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.APIEndpoint">
APIEndpoint
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controlPlaneEndpoint contains the endpoint information by which
external clients can access the control plane.  This is populated
after the infrastructure is ready.</p>
</td>
</tr>
<tr>
<td>
<code>oauthCallbackURLTemplate</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>oauthCallbackURLTemplate contains a template for the URL to use as a callback
for identity providers. The [identity-provider-name] placeholder must be replaced
with the name of an identity provider defined on the HostedCluster.
This is populated after the infrastructure is ready.</p>
</td>
</tr>
<tr>
<td>
<code>controlPlaneVersion,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneVersionStatus">
ControlPlaneVersionStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>controlPlaneVersion tracks the rollout status of the control plane
components running on the management cluster, independently from
the data-plane version reported in the version field.</p>
</td>
</tr>
<tr>
<td>
<code>versionStatus</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterVersionStatus">
ClusterVersionStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>versionStatus is the status of the release version applied by the
hosted control plane operator.</p>
</td>
</tr>
<tr>
<td>
<code>version</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>version is the semantic version of the release applied by
the hosted control plane operator</p>
<p>Deprecated: Use versionStatus.desired.version instead.</p>
</td>
</tr>
<tr>
<td>
<code>releaseImage</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>releaseImage is the release image applied to the hosted control plane.</p>
<p>Deprecated: Use versionStatus.desired.image instead.</p>
</td>
</tr>
<tr>
<td>
<code>lastReleaseImageTransitionTime</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#time-v1-meta">
Kubernetes meta/v1.Time
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>lastReleaseImageTransitionTime is the time of the last update to the current
releaseImage property.</p>
<p>Deprecated: Use versionStatus.history[0].startedTime instead.</p>
</td>
</tr>
<tr>
<td>
<code>kubeConfig</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubeconfigSecretRef">
KubeconfigSecretRef
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeConfig is a reference to the secret containing the default kubeconfig
for this control plane.</p>
</td>
</tr>
<tr>
<td>
<code>customKubeconfig</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubeconfigSecretRef">
KubeconfigSecretRef
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>customKubeconfig references an external custom kubeconfig secret.
This field is populated in the status when a custom kubeconfig secret has been generated
for the hosted cluster. It contains the name and key of the secret located in the
hostedCluster namespace. This field is only populated when kubeApiExternalName is set.
If this field is removed during a day 2 operation, the referenced secret will be deleted
and this field will be removed from the hostedCluster status.</p>
</td>
</tr>
<tr>
<td>
<code>kubeadminPassword</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeadminPassword is a reference to the secret containing the initial kubeadmin password
for the guest cluster.</p>
</td>
</tr>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlatformStatus">
PlatformStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>platform contains platform-specific status of the HostedCluster</p>
</td>
</tr>
<tr>
<td>
<code>nodeCount</code></br>
<em>
int
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeCount tracks the number of nodes in the HostedControlPlane.</p>
</td>
</tr>
<tr>
<td>
<code>autoNode,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AutoNodeStatus">
AutoNodeStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoNode contains the observed state of the autoNode (Karpenter) provisioner.</p>
</td>
</tr>
<tr>
<td>
<code>configuration</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ConfigurationStatus">
ConfigurationStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>configuration contains the cluster configuration status of the HostedCluster</p>
</td>
</tr>
<tr>
<td>
<code>secretEncryption,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionStatus">
SecretEncryptionStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>secretEncryption tracks the state of secret encryption key rotation and re-encryption.</p>
</td>
</tr>
</tbody>
</table>
###IBMCloudKMSAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSSpec">IBMCloudKMSSpec</a>)
</p>
<p>
<p>IBMCloudKMSAuthSpec defines metadata for how authentication is done with IBM Cloud KMS</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSAuthType">
IBMCloudKMSAuthType
</a>
</em>
</td>
<td>
<p>type defines the IBM Cloud KMS authentication strategy</p>
</td>
</tr>
<tr>
<td>
<code>unmanaged</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSUnmanagedAuthSpec">
IBMCloudKMSUnmanagedAuthSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>unmanaged defines the auth metadata the customer provides to interact with IBM Cloud KMS</p>
</td>
</tr>
<tr>
<td>
<code>managed</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSManagedAuthSpec">
IBMCloudKMSManagedAuthSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>managed defines metadata around the service to service authentication strategy for the IBM Cloud
KMS system (all provider managed).</p>
</td>
</tr>
</tbody>
</table>
###IBMCloudKMSAuthType { #hypershift.openshift.io/v1beta1.IBMCloudKMSAuthType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec">IBMCloudKMSAuthSpec</a>)
</p>
<p>
<p>IBMCloudKMSAuthType defines the IBM Cloud KMS authentication strategy</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Managed&#34;</p></td>
<td><p>IBMCloudKMSManagedAuth defines the KMS authentication strategy where the IKS/ROKS platform uses
service to service auth to call IBM Cloud KMS APIs (no customer credentials required)</p>
</td>
</tr><tr><td><p>&#34;Unmanaged&#34;</p></td>
<td><p>IBMCloudKMSUnmanagedAuth defines the KMS authentication strategy where a customer supplies IBM Cloud
authentication to interact with IBM Cloud KMS APIs</p>
</td>
</tr></tbody>
</table>
###IBMCloudKMSKeyEntry { #hypershift.openshift.io/v1beta1.IBMCloudKMSKeyEntry }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSSpec">IBMCloudKMSSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus">SecretEncryptionKeyStatus</a>)
</p>
<p>
<p>IBMCloudKMSKeyEntry defines metadata for an IBM Cloud KMS encryption key</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>crkID</code></br>
<em>
string
</em>
</td>
<td>
<p>crkID is the customer rook key id</p>
</td>
</tr>
<tr>
<td>
<code>instanceID</code></br>
<em>
string
</em>
</td>
<td>
<p>instanceID is the id for the key protect instance</p>
</td>
</tr>
<tr>
<td>
<code>correlationID</code></br>
<em>
string
</em>
</td>
<td>
<p>correlationID is an identifier used to track all api call usage from hypershift</p>
</td>
</tr>
<tr>
<td>
<code>url</code></br>
<em>
string
</em>
</td>
<td>
<p>url is the url to call key protect apis over</p>
</td>
</tr>
<tr>
<td>
<code>keyVersion</code></br>
<em>
int
</em>
</td>
<td>
<p>keyVersion is a unique number associated with the key. The number increments whenever a new
key is enabled for data encryption.</p>
</td>
</tr>
</tbody>
</table>
###IBMCloudKMSManagedAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSManagedAuthSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec">IBMCloudKMSAuthSpec</a>)
</p>
<p>
<p>IBMCloudKMSManagedAuthSpec defines metadata around the service to service authentication strategy for the IBM Cloud
KMS system (all provider managed).</p>
</p>
###IBMCloudKMSSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KMSSpec">KMSSpec</a>)
</p>
<p>
<p>IBMCloudKMSSpec defines metadata for the IBM Cloud KMS encryption strategy</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>region</code></br>
<em>
string
</em>
</td>
<td>
<p>region is the IBM Cloud region</p>
</td>
</tr>
<tr>
<td>
<code>auth</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec">
IBMCloudKMSAuthSpec
</a>
</em>
</td>
<td>
<p>auth defines metadata for how authentication is done with IBM Cloud KMS</p>
</td>
</tr>
<tr>
<td>
<code>keyList</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSKeyEntry">
[]IBMCloudKMSKeyEntry
</a>
</em>
</td>
<td>
<p>keyList defines the list of keys used for data encryption</p>
</td>
</tr>
</tbody>
</table>
###IBMCloudKMSUnmanagedAuthSpec { #hypershift.openshift.io/v1beta1.IBMCloudKMSUnmanagedAuthSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSAuthSpec">IBMCloudKMSAuthSpec</a>)
</p>
<p>
<p>IBMCloudKMSUnmanagedAuthSpec defines the auth metadata the customer provides to interact with IBM Cloud KMS</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>credentials</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>credentials should reference a secret with a key field of IBMCloudIAMAPIKeySecretKey that contains a apikey to
call IBM Cloud KMS APIs</p>
</td>
</tr>
</tbody>
</table>
###IBMCloudPlatformSpec { #hypershift.openshift.io/v1beta1.IBMCloudPlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>, 
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>IBMCloudPlatformSpec defines IBMCloud specific settings for components</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>providerType</code></br>
<em>
<a href="https://docs.openshift.com/container-platform/4.10/rest_api/config_apis/config-apis-index.html">
github.com/openshift/api/config/v1.IBMCloudProviderType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>providerType is a specific supported infrastructure provider within IBM Cloud.</p>
</td>
</tr>
</tbody>
</table>
###ImageContentSource { #hypershift.openshift.io/v1beta1.ImageContentSource }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>ImageContentSource specifies image mirrors that can be used by cluster nodes
to pull content. For cluster workloads, if a container image registry host of
the pullspec matches Source then one of the Mirrors are substituted as hosts
in the pullspec and tried in order to fetch the image.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>source</code></br>
<em>
string
</em>
</td>
<td>
<p>source is the repository that users refer to, e.g. in image pull
specifications.</p>
</td>
</tr>
<tr>
<td>
<code>mirrors</code></br>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>mirrors are one or more repositories that may also contain the same images.</p>
</td>
</tr>
</tbody>
</table>
###ImageType { #hypershift.openshift.io/v1beta1.ImageType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSNodePoolPlatform">AWSNodePoolPlatform</a>)
</p>
<p>
<p>ImageType specifies the type of image to use for node instances.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Linux&#34;</p></td>
<td><p>ImageTypeLinux represents the default image type (Linux/RHCOS).
This is used when ImageType is empty or unspecified.</p>
</td>
</tr><tr><td><p>&#34;Windows&#34;</p></td>
<td><p>ImageTypeWindows represents a Windows-based image type.
When set, the controller will automatically populate the AMI field
with a Windows-compatible AMI based on the region and OpenShift version.</p>
</td>
</tr></tbody>
</table>
###InPlaceUpgrade { #hypershift.openshift.io/v1beta1.InPlaceUpgrade }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolManagement">NodePoolManagement</a>)
</p>
<p>
<p>InPlaceUpgrade specifies an upgrade strategy which upgrades nodes in-place
without any new nodes being created or any old nodes being deleted.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>maxUnavailable</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#intorstring-intstr-util">
k8s.io/apimachinery/pkg/util/intstr.IntOrString
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>maxUnavailable is the maximum number of nodes that can be unavailable
during the update.</p>
<p>Value can be an absolute number (ex: 5) or a percentage of desired nodes
(ex: 10%).</p>
<p>Absolute number is calculated from percentage by rounding down.</p>
<p>Defaults to 1.</p>
<p>Example: when this is set to 30%, a max of 30% of the nodes can be made
unschedulable/unavailable immediately when the update starts. Once a set
of nodes is updated, more nodes can be made unschedulable for update,
ensuring that the total number of nodes schedulable at all times during
the update is at least 70% of desired nodes.</p>
</td>
</tr>
</tbody>
</table>
###IngressOperatorSpec { #hypershift.openshift.io/v1beta1.IngressOperatorSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OperatorConfiguration">OperatorConfiguration</a>)
</p>
<p>
<p>IngressOperatorSpec is the specification of the desired behavior of the Ingress Operator.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>endpointPublishingStrategy</code></br>
<em>
github.com/openshift/api/operator/v1.EndpointPublishingStrategy
</em>
</td>
<td>
<em>(Optional)</em>
<p>endpointPublishingStrategy is used to publish the default ingress controller endpoints.</p>
<p>The endpoint publishing strategy is determined by the following precedence order:
1. User-specified endpointPublishingStrategy (highest priority) - if this field is set,
it takes precedence over all other configuration methods
2. Platform-specific defaults with annotation overrides - if no user strategy is set,
the platform type determines the default strategy, which can be further modified by:
- hypershift.openshift.io/private-ingress-controller annotation (sets PrivateStrategyType)
- hypershift.openshift.io/ingress-controller-load-balancer-scope annotation (sets LoadBalancerScope)
3. Generic LoadBalancer fallback - if the platform is not recognized, defaults to
LoadBalancerService with External scope</p>
<p>Platform-specific defaults when endpointPublishingStrategy is not set:
- AWS: LoadBalancerService with External scope (or NLB if configured)
- Azure, GCP: LoadBalancerService with External scope
- IBMCloud: LoadBalancerService with External scope (or NodePort for UPI)
- None: HostNetwork
- KubeVirt: NodePortService
- OpenStack: LoadBalancerService with External scope and optional FloatingIP
- Other platforms: LoadBalancerService with External scope</p>
<p>See the OpenShift Ingress Operator EndpointPublishingStrategy type for the full specification:
<a href="https://github.com/openshift/api/blob/master/operator/v1/types_ingress.go">https://github.com/openshift/api/blob/master/operator/v1/types_ingress.go</a></p>
</td>
</tr>
</tbody>
</table>
###InstanceType { #hypershift.openshift.io/v1beta1.InstanceType }
<p>
</p>
###KMSProvider { #hypershift.openshift.io/v1beta1.KMSProvider }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KMSSpec">KMSSpec</a>)
</p>
<p>
<p>KMSProvider defines the supported KMS providers</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;AWS&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Azure&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;IBMCloud&#34;</p></td>
<td></td>
</tr></tbody>
</table>
###KMSSpec { #hypershift.openshift.io/v1beta1.KMSSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionSpec">SecretEncryptionSpec</a>)
</p>
<p>
<p>KMSSpec defines metadata about the kms secret encryption strategy</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>provider</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KMSProvider">
KMSProvider
</a>
</em>
</td>
<td>
<p>provider defines the KMS provider</p>
</td>
</tr>
<tr>
<td>
<code>ibmcloud</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSSpec">
IBMCloudKMSSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ibmcloud defines metadata for the IBM Cloud KMS encryption strategy</p>
</td>
</tr>
<tr>
<td>
<code>aws</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSKMSSpec">
AWSKMSSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aws defines metadata about the configuration of the AWS KMS Secret Encryption provider</p>
</td>
</tr>
<tr>
<td>
<code>azure</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureKMSSpec">
AzureKMSSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>azure defines metadata about the configuration of the Azure KMS Secret Encryption provider using Azure key vault</p>
</td>
</tr>
</tbody>
</table>
###KarpenterAWSConfig { #hypershift.openshift.io/v1beta1.KarpenterAWSConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KarpenterConfig">KarpenterConfig</a>)
</p>
<p>
<p>KarpenterAWSConfig specifies AWS-specific configuration for the Karpenter provisioner.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>roleARN</code></br>
<em>
string
</em>
</td>
<td>
<p>roleARN specifies the ARN of the IAM role that Karpenter assumes to provision
and manage EC2 instances in the hosted cluster&rsquo;s AWS account.</p>
<p>The referenced role must have a trust relationship that allows it to be assumed
by the karpenter service account in the hosted cluster via OIDC.
Example:
{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Principal&rdquo;: {
&ldquo;Federated&rdquo;: &ldquo;<oidc-provider-arn>&rdquo;
},
&ldquo;Action&rdquo;: &ldquo;sts:AssumeRoleWithWebIdentity&rdquo;,
&ldquo;Condition&rdquo;: {
&ldquo;StringEquals&rdquo;: {
&ldquo;<oidc-provider-name>:sub&rdquo;: &ldquo;system:serviceaccount:kube-system:karpenter&rdquo;
}
}
}
]
}</p>
<p>The following is an example of the policy document for this role.</p>
<p>{
&ldquo;Version&rdquo;: &ldquo;2012-10-17&rdquo;,
&ldquo;Statement&rdquo;: [
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedEC2InstanceAccessActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: [
&ldquo;arn:<em>:ec2:</em>::image/<em>&rdquo;,
&ldquo;arn:</em>:ec2:<em>::snapshot/</em>&rdquo;,
&ldquo;arn:<em>:ec2:</em>:<em>:security-group/</em>&rdquo;,
&ldquo;arn:<em>:ec2:</em>:<em>:subnet/</em>&rdquo;
],
&ldquo;Action&rdquo;: [
&ldquo;ec2:RunInstances&rdquo;,
&ldquo;ec2:CreateFleet&rdquo;
]
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedEC2LaunchTemplateAccessActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;arn:<em>:ec2:</em>:<em>:launch-template/</em>&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;ec2:RunInstances&rdquo;,
&ldquo;ec2:CreateFleet&rdquo;
]
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedEC2InstanceActionsWithTags&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: [
&ldquo;arn:<em>:ec2:</em>:<em>:fleet/</em>&rdquo;,
&ldquo;arn:<em>:ec2:</em>:<em>:instance/</em>&rdquo;,
&ldquo;arn:<em>:ec2:</em>:<em>:volume/</em>&rdquo;,
&ldquo;arn:<em>:ec2:</em>:<em>:network-interface/</em>&rdquo;,
&ldquo;arn:<em>:ec2:</em>:<em>:launch-template/</em>&rdquo;,
&ldquo;arn:<em>:ec2:</em>:<em>:spot-instances-request/</em>&rdquo;
],
&ldquo;Action&rdquo;: [
&ldquo;ec2:RunInstances&rdquo;,
&ldquo;ec2:CreateFleet&rdquo;,
&ldquo;ec2:CreateLaunchTemplate&rdquo;
],
&ldquo;Condition&rdquo;: {
&ldquo;StringLike&rdquo;: {
&ldquo;aws:RequestTag/karpenter.sh/nodepool&rdquo;: &ldquo;<em>&rdquo;
}
}
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedResourceCreationTagging&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: [
&ldquo;arn:</em>:ec2:<em>:</em>:fleet/<em>&rdquo;,
&ldquo;arn:</em>:ec2:<em>:</em>:instance/<em>&rdquo;,
&ldquo;arn:</em>:ec2:<em>:</em>:volume/<em>&rdquo;,
&ldquo;arn:</em>:ec2:<em>:</em>:network-interface/<em>&rdquo;,
&ldquo;arn:</em>:ec2:<em>:</em>:launch-template/<em>&rdquo;,
&ldquo;arn:</em>:ec2:<em>:</em>:spot-instances-request/<em>&rdquo;
],
&ldquo;Action&rdquo;: &ldquo;ec2:CreateTags&rdquo;,
&ldquo;Condition&rdquo;: {
&ldquo;StringEquals&rdquo;: {
&ldquo;ec2:CreateAction&rdquo;: [
&ldquo;RunInstances&rdquo;,
&ldquo;CreateFleet&rdquo;,
&ldquo;CreateLaunchTemplate&rdquo;
]
},
&ldquo;StringLike&rdquo;: {
&ldquo;aws:RequestTag/karpenter.sh/nodepool&rdquo;: &ldquo;</em>&rdquo;
}
}
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedResourceTagging&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;arn:<em>:ec2:</em>:<em>:instance/</em>&rdquo;,
&ldquo;Action&rdquo;: &ldquo;ec2:CreateTags&rdquo;,
&ldquo;Condition&rdquo;: {
&ldquo;StringLike&rdquo;: {
&ldquo;aws:ResourceTag/karpenter.sh/nodepool&rdquo;: &ldquo;<em>&rdquo;
}
}
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedDeletion&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: [
&ldquo;arn:</em>:ec2:<em>:</em>:instance/<em>&rdquo;,
&ldquo;arn:</em>:ec2:<em>:</em>:launch-template/<em>&rdquo;
],
&ldquo;Action&rdquo;: [
&ldquo;ec2:TerminateInstances&rdquo;,
&ldquo;ec2:DeleteLaunchTemplate&rdquo;
],
&ldquo;Condition&rdquo;: {
&ldquo;StringLike&rdquo;: {
&ldquo;aws:ResourceTag/karpenter.sh/nodepool&rdquo;: &ldquo;</em>&rdquo;
}
}
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowRegionalReadActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;<em>&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;ec2:DescribeImages&rdquo;,
&ldquo;ec2:DescribeInstances&rdquo;,
&ldquo;ec2:DescribeInstanceTypeOfferings&rdquo;,
&ldquo;ec2:DescribeInstanceTypes&rdquo;,
&ldquo;ec2:DescribeLaunchTemplates&rdquo;,
&ldquo;ec2:DescribeSecurityGroups&rdquo;,
&ldquo;ec2:DescribeSpotPriceHistory&rdquo;,
&ldquo;ec2:DescribeSubnets&rdquo;
]
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowSSMReadActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;arn:</em>:ssm:<em>::parameter/aws/service/</em>&rdquo;,
&ldquo;Action&rdquo;: &ldquo;ssm:GetParameter&rdquo;
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowPricingReadActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;<em>&rdquo;,
&ldquo;Action&rdquo;: &ldquo;pricing:GetProducts&rdquo;
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowInterruptionQueueActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;</em>&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;sqs:DeleteMessage&rdquo;,
&ldquo;sqs:GetQueueUrl&rdquo;,
&ldquo;sqs:ReceiveMessage&rdquo;
]
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowPassingInstanceRole&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;arn:<em>:iam::</em>:role/<em>&rdquo;,
&ldquo;Action&rdquo;: &ldquo;iam:PassRole&rdquo;,
&ldquo;Condition&rdquo;: {
&ldquo;StringEquals&rdquo;: {
&ldquo;iam:PassedToService&rdquo;: [
&ldquo;ec2.amazonaws.com&rdquo;,
&ldquo;ec2.amazonaws.com.cn&rdquo;
]
}
}
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedInstanceProfileCreationActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;arn:</em>:iam::<em>:instance-profile/</em>&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;iam:CreateInstanceProfile&rdquo;
],
&ldquo;Condition&rdquo;: {
&ldquo;StringLike&rdquo;: {
&ldquo;aws:RequestTag/karpenter.k8s.aws/ec2nodeclass&rdquo;: &ldquo;<em>&rdquo;
}
}
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedInstanceProfileTagActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;arn:</em>:iam::<em>:instance-profile/</em>&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;iam:TagInstanceProfile&rdquo;
],
&ldquo;Condition&rdquo;: {
&ldquo;StringLike&rdquo;: {
&ldquo;aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass&rdquo;: &ldquo;<em>&rdquo;,
&ldquo;aws:RequestTag/karpenter.k8s.aws/ec2nodeclass&rdquo;: &ldquo;</em>&rdquo;
}
}
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowScopedInstanceProfileActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;arn:<em>:iam::</em>:instance-profile/<em>&rdquo;,
&ldquo;Action&rdquo;: [
&ldquo;iam:AddRoleToInstanceProfile&rdquo;,
&ldquo;iam:RemoveRoleFromInstanceProfile&rdquo;,
&ldquo;iam:DeleteInstanceProfile&rdquo;
],
&ldquo;Condition&rdquo;: {
&ldquo;StringLike&rdquo;: {
&ldquo;aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass&rdquo;: &ldquo;</em>&rdquo;
}
}
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowInstanceProfileReadActions&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;arn:<em>:iam::</em>:instance-profile/<em>&rdquo;,
&ldquo;Action&rdquo;: &ldquo;iam:GetInstanceProfile&rdquo;
},
{
&ldquo;Sid&rdquo;: &ldquo;AllowUnscopedInstanceProfileListAction&rdquo;,
&ldquo;Effect&rdquo;: &ldquo;Allow&rdquo;,
&ldquo;Resource&rdquo;: &ldquo;</em>&rdquo;,
&ldquo;Action&rdquo;: &ldquo;iam:ListInstanceProfiles&rdquo;
}
]
}</p>
</td>
</tr>
</tbody>
</table>
###KarpenterConfig { #hypershift.openshift.io/v1beta1.KarpenterConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ProvisionerConfig">ProvisionerConfig</a>)
</p>
<p>
<p>KarpenterConfig specifies the configuration for the Karpenter provisioner
including the target platform and platform-specific settings.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlatformType">
PlatformType
</a>
</em>
</td>
<td>
<p>platform specifies the infrastructure platform that Karpenter should provision nodes on.</p>
</td>
</tr>
<tr>
<td>
<code>aws,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KarpenterAWSConfig">
KarpenterAWSConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aws specifies the AWS-specific configuration for Karpenter.</p>
</td>
</tr>
</tbody>
</table>
###KubeVirtNodePoolStatus { #hypershift.openshift.io/v1beta1.KubeVirtNodePoolStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatformStatus">NodePoolPlatformStatus</a>)
</p>
<p>
<p>KubeVirtNodePoolStatus contains the KubeVirt platform statuses</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>cacheName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>cacheName holds the name of the cache DataVolume, if exists</p>
</td>
</tr>
<tr>
<td>
<code>credentials</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtPlatformCredentials">
KubevirtPlatformCredentials
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>credentials shows the client credentials used when creating KubeVirt virtual machines.
This filed is only exists when the KubeVirt virtual machines are being placed
on a cluster separate from the one hosting the Hosted Control Plane components.</p>
<p>The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
the same cluster and namespace as the Hosted Control Plane.</p>
</td>
</tr>
</tbody>
</table>
###KubevirtCachingStrategy { #hypershift.openshift.io/v1beta1.KubevirtCachingStrategy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtRootVolume">KubevirtRootVolume</a>)
</p>
<p>
<p>KubevirtCachingStrategy defines the boot image caching strategy</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtCachingStrategyType">
KubevirtCachingStrategyType
</a>
</em>
</td>
<td>
<p>type is the type of the caching strategy</p>
</td>
</tr>
</tbody>
</table>
###KubevirtCachingStrategyType { #hypershift.openshift.io/v1beta1.KubevirtCachingStrategyType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtCachingStrategy">KubevirtCachingStrategy</a>)
</p>
<p>
<p>KubevirtCachingStrategyType is the type of the boot image caching mechanism for the KubeVirt provider</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;None&#34;</p></td>
<td><p>KubevirtCachingStrategyNone means that hypershift will not cache the boot image</p>
</td>
</tr><tr><td><p>&#34;PVC&#34;</p></td>
<td><p>KubevirtCachingStrategyPVC means that hypershift will cache the boot image into a PVC; only relevant when using
a QCOW boot image, and is ignored when using a container image</p>
</td>
</tr></tbody>
</table>
###KubevirtCompute { #hypershift.openshift.io/v1beta1.KubevirtCompute }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtNodePoolPlatform">KubevirtNodePoolPlatform</a>)
</p>
<p>
<p>KubevirtCompute contains values associated with the virtual compute hardware requested for the VM.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>memory</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#quantity-resource-api">
k8s.io/apimachinery/pkg/api/resource.Quantity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>memory represents how much guest memory the VM should have</p>
</td>
</tr>
<tr>
<td>
<code>cores</code></br>
<em>
uint32
</em>
</td>
<td>
<em>(Optional)</em>
<p>cores is the number of CPU cores for the KubeVirt VM.</p>
</td>
</tr>
<tr>
<td>
<code>qosClass</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.QoSClass">
QoSClass
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>qosClass if set to &ldquo;Guaranteed&rdquo;, requests the scheduler to place the VirtualMachineInstance on a node with
limit memory and CPU, equal to be the requested values, to set the VMI as a Guaranteed QoS Class;
See here for more details:
<a href="https://kubevirt.io/user-guide/operations/node_overcommit/#requesting-the-right-qos-class-for-virtualmachineinstances">https://kubevirt.io/user-guide/operations/node_overcommit/#requesting-the-right-qos-class-for-virtualmachineinstances</a></p>
</td>
</tr>
</tbody>
</table>
###KubevirtDiskImage { #hypershift.openshift.io/v1beta1.KubevirtDiskImage }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtRootVolume">KubevirtRootVolume</a>)
</p>
<p>
<p>KubevirtDiskImage contains values representing where the rhcos image is located</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>containerDiskImage</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>containerDiskImage is a string representing the container image that holds the root disk</p>
</td>
</tr>
</tbody>
</table>
###KubevirtHostDevice { #hypershift.openshift.io/v1beta1.KubevirtHostDevice }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtNodePoolPlatform">KubevirtNodePoolPlatform</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>deviceName</code></br>
<em>
string
</em>
</td>
<td>
<p>deviceName is the name of the host device that is desired to be utilized in the HostedCluster&rsquo;s NodePool
The device can be any supported PCI device, including GPU, either as a passthrough or a vGPU slice.</p>
</td>
</tr>
<tr>
<td>
<code>count</code></br>
<em>
int
</em>
</td>
<td>
<em>(Optional)</em>
<p>count is the number of instances the specified host device will be attached to each of the
NodePool&rsquo;s nodes. Default is 1.</p>
</td>
</tr>
</tbody>
</table>
###KubevirtManualStorageDriverConfig { #hypershift.openshift.io/v1beta1.KubevirtManualStorageDriverConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtStorageDriverSpec">KubevirtStorageDriverSpec</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>storageClassMapping</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtStorageClassMapping">
[]KubevirtStorageClassMapping
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>storageClassMapping maps StorageClasses on the infra cluster hosting
the KubeVirt VMs to StorageClasses that are made available within the
Guest Cluster.</p>
<p>NOTE: It is possible that not all capabilities of an infra cluster&rsquo;s
storageclass will be present for the corresponding guest clusters storageclass.</p>
</td>
</tr>
<tr>
<td>
<code>volumeSnapshotClassMapping</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtVolumeSnapshotClassMapping">
[]KubevirtVolumeSnapshotClassMapping
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>volumeSnapshotClassMapping maps VolumeSnapshotClasses on the infra cluster hosting
the KubeVirt VMs to VolumeSnapshotClasses that are made available within the
Guest Cluster.</p>
</td>
</tr>
</tbody>
</table>
###KubevirtNetwork { #hypershift.openshift.io/v1beta1.KubevirtNetwork }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtNodePoolPlatform">KubevirtNodePoolPlatform</a>)
</p>
<p>
<p>KubevirtNetwork specifies the configuration for a virtual machine
network interface</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name specify the network attached to the nodes
it is a value with the format &ldquo;[namespace]/[name]&rdquo; to reference the
multus network attachment definition</p>
</td>
</tr>
</tbody>
</table>
###KubevirtNodePoolPlatform { #hypershift.openshift.io/v1beta1.KubevirtNodePoolPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>)
</p>
<p>
<p>KubevirtNodePoolPlatform specifies the configuration of a NodePool when operating
on KubeVirt platform.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>rootVolume</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtRootVolume">
KubevirtRootVolume
</a>
</em>
</td>
<td>
<p>rootVolume represents values associated with the VM volume that will host rhcos</p>
</td>
</tr>
<tr>
<td>
<code>compute</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtCompute">
KubevirtCompute
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>compute contains values representing the virtual hardware requested for the VM</p>
</td>
</tr>
<tr>
<td>
<code>networkInterfaceMultiqueue</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MultiQueueSetting">
MultiQueueSetting
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>networkInterfaceMultiqueue if set to &ldquo;Enable&rdquo;, virtual network interfaces configured with a virtio bus will also
enable the vhost multiqueue feature for network devices. The number of queues created depends on additional
factors of the VirtualMachineInstance, like the number of guest CPUs.</p>
</td>
</tr>
<tr>
<td>
<code>additionalNetworks</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtNetwork">
[]KubevirtNetwork
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>additionalNetworks specify the extra networks attached to the nodes</p>
</td>
</tr>
<tr>
<td>
<code>attachDefaultNetwork</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>attachDefaultNetwork specify if the default pod network should be attached to the nodes
this can only be set to false if AdditionalNetworks are configured</p>
</td>
</tr>
<tr>
<td>
<code>nodeSelector</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeSelector is a selector which must be true for the kubevirt VirtualMachine to fit on a node.
Selector which must match a node&rsquo;s labels for the VM to be scheduled on that node. More info:
<a href="https://kubernetes.io/docs/concepts/configuration/assign-pod-node/">https://kubernetes.io/docs/concepts/configuration/assign-pod-node/</a></p>
</td>
</tr>
<tr>
<td>
<code>hostDevices</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtHostDevice">
[]KubevirtHostDevice
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>hostDevices specifies the host devices (e.g. GPU devices) to be passed
from the management cluster, to the nodepool nodes</p>
</td>
</tr>
</tbody>
</table>
###KubevirtPersistentVolume { #hypershift.openshift.io/v1beta1.KubevirtPersistentVolume }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtVolume">KubevirtVolume</a>)
</p>
<p>
<p>KubevirtPersistentVolume contains the values involved with provisioning persistent storage for a KubeVirt VM.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>size</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#quantity-resource-api">
k8s.io/apimachinery/pkg/api/resource.Quantity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>size is the size of the persistent storage volume</p>
</td>
</tr>
<tr>
<td>
<code>storageClass</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>storageClass is the storageClass used for the underlying PVC that hosts the volume</p>
</td>
</tr>
<tr>
<td>
<code>accessModes</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PersistentVolumeAccessMode">
[]PersistentVolumeAccessMode
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>accessModes is an array that contains the desired Access Modes the root volume should have.
More info: <a href="https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes">https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes</a></p>
</td>
</tr>
<tr>
<td>
<code>volumeMode</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#persistentvolumemode-v1-core">
Kubernetes core/v1.PersistentVolumeMode
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>volumeMode defines what type of volume is required by the claim.
Value of Filesystem is implied when not included in claim spec.</p>
</td>
</tr>
</tbody>
</table>
###KubevirtPlatformCredentials { #hypershift.openshift.io/v1beta1.KubevirtPlatformCredentials }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubeVirtNodePoolStatus">KubeVirtNodePoolStatus</a>, 
<a href="#hypershift.openshift.io/v1beta1.KubevirtPlatformSpec">KubevirtPlatformSpec</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>infraKubeConfigSecret</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubeconfigSecretRef">
KubeconfigSecretRef
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>infraKubeConfigSecret is a reference to the secret containing the kubeconfig
of an external infrastructure cluster for kubevirt provider</p>
</td>
</tr>
<tr>
<td>
<code>infraNamespace</code></br>
<em>
string
</em>
</td>
<td>
<p>infraNamespace is the namespace in the external infrastructure cluster
where kubevirt resources will be created</p>
</td>
</tr>
</tbody>
</table>
###KubevirtPlatformSpec { #hypershift.openshift.io/v1beta1.KubevirtPlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>KubevirtPlatformSpec specifies configuration for kubevirt guest cluster installations</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>baseDomainPassthrough</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>baseDomainPassthrough toggles whether or not an automatically
generated base domain for the guest cluster should be used that
is a subdomain of the management cluster&rsquo;s *.apps DNS.</p>
<p>For the KubeVirt platform, the basedomain can be autogenerated using
the *.apps domain of the management/infra hosting cluster
This makes the guest cluster&rsquo;s base domain a subdomain of the
hypershift infra/mgmt cluster&rsquo;s base domain.</p>
<p>Example:
Infra/Mgmt cluster&rsquo;s DNS
Base: example.com
Cluster: mgmt-cluster.example.com
Apps:    *.apps.mgmt-cluster.example.com
KubeVirt Guest cluster&rsquo;s DNS
Base: apps.mgmt-cluster.example.com
Cluster: guest.apps.mgmt-cluster.example.com
Apps: *.apps.guest.apps.mgmt-cluster.example.com</p>
<p>This is possible using OCP wildcard routes</p>
</td>
</tr>
<tr>
<td>
<code>generateID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>generateID is used to uniquely apply a name suffix to resources associated with
kubevirt infrastructure resources</p>
</td>
</tr>
<tr>
<td>
<code>credentials</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtPlatformCredentials">
KubevirtPlatformCredentials
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>credentials defines the client credentials used when creating KubeVirt virtual machines.
Defining credentials is only necessary when the KubeVirt virtual machines are being placed
on a cluster separate from the one hosting the Hosted Control Plane components.</p>
<p>The default behavior when Credentials is not defined is for the KubeVirt VMs to be placed on
the same cluster and namespace as the Hosted Control Plane.</p>
</td>
</tr>
<tr>
<td>
<code>storageDriver</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtStorageDriverSpec">
KubevirtStorageDriverSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>storageDriver defines how the KubeVirt CSI driver exposes StorageClasses on
the infra cluster (hosting the VMs) to the guest cluster.</p>
</td>
</tr>
</tbody>
</table>
###KubevirtRootVolume { #hypershift.openshift.io/v1beta1.KubevirtRootVolume }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtNodePoolPlatform">KubevirtNodePoolPlatform</a>)
</p>
<p>
<p>KubevirtRootVolume represents the volume that the rhcos disk will be stored and run from.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>diskImage</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtDiskImage">
KubevirtDiskImage
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>diskImage represents what rhcos image to use for the node pool</p>
</td>
</tr>
<tr>
<td>
<code>KubevirtVolume</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtVolume">
KubevirtVolume
</a>
</em>
</td>
<td>
<p>
(Members of <code>KubevirtVolume</code> are embedded into this type.)
</p>
<p>kubevirtVolume represents of type of storage to run the image on</p>
</td>
</tr>
<tr>
<td>
<code>cacheStrategy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtCachingStrategy">
KubevirtCachingStrategy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>cacheStrategy defines the boot image caching strategy. Default - no caching</p>
</td>
</tr>
</tbody>
</table>
###KubevirtStorageClassMapping { #hypershift.openshift.io/v1beta1.KubevirtStorageClassMapping }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtManualStorageDriverConfig">KubevirtManualStorageDriverConfig</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>group</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>group contains which group this mapping belongs to.</p>
</td>
</tr>
<tr>
<td>
<code>infraStorageClassName</code></br>
<em>
string
</em>
</td>
<td>
<p>infraStorageClassName is the name of the infra cluster storage class that
will be exposed to the guest.</p>
</td>
</tr>
<tr>
<td>
<code>guestStorageClassName</code></br>
<em>
string
</em>
</td>
<td>
<p>guestStorageClassName is the name that the corresponding storageclass will
be called within the guest cluster</p>
</td>
</tr>
</tbody>
</table>
###KubevirtStorageDriverConfigType { #hypershift.openshift.io/v1beta1.KubevirtStorageDriverConfigType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtStorageDriverSpec">KubevirtStorageDriverSpec</a>)
</p>
<p>
<p>KubevirtStorageDriverConfigType defines how the kubevirt storage driver is configured.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Default&#34;</p></td>
<td><p>DefaultKubevirtStorageDriverConfigType means the kubevirt storage driver maps to the
underlying infra cluster&rsquo;s default storageclass</p>
</td>
</tr><tr><td><p>&#34;Manual&#34;</p></td>
<td><p>ManualKubevirtStorageDriverConfigType means the kubevirt storage driver mapping is
explicitly defined.</p>
</td>
</tr><tr><td><p>&#34;None&#34;</p></td>
<td><p>NoneKubevirtStorageDriverConfigType means no kubevirt storage driver is used</p>
</td>
</tr></tbody>
</table>
###KubevirtStorageDriverSpec { #hypershift.openshift.io/v1beta1.KubevirtStorageDriverSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtPlatformSpec">KubevirtPlatformSpec</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtStorageDriverConfigType">
KubevirtStorageDriverConfigType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>type represents the type of kubevirt csi driver configuration to use</p>
</td>
</tr>
<tr>
<td>
<code>manual</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtManualStorageDriverConfig">
KubevirtManualStorageDriverConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>manual is used to explicitly define how the infra storageclasses are
mapped to guest storageclasses</p>
</td>
</tr>
</tbody>
</table>
###KubevirtVolume { #hypershift.openshift.io/v1beta1.KubevirtVolume }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtRootVolume">KubevirtRootVolume</a>)
</p>
<p>
<p>KubevirtVolume represents what kind of storage to use for a KubeVirt VM volume</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtVolumeType">
KubevirtVolumeType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>type represents the type of storage to associate with the kubevirt VMs.</p>
</td>
</tr>
<tr>
<td>
<code>persistent</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtPersistentVolume">
KubevirtPersistentVolume
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>persistent volume type means the VM&rsquo;s storage is backed by a PVC
VMs that use persistent volumes can survive disruption events like restart and eviction
This is the default type used when no storage type is defined.</p>
</td>
</tr>
</tbody>
</table>
###KubevirtVolumeSnapshotClassMapping { #hypershift.openshift.io/v1beta1.KubevirtVolumeSnapshotClassMapping }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtManualStorageDriverConfig">KubevirtManualStorageDriverConfig</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>group</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>group contains which group this mapping belongs to.</p>
</td>
</tr>
<tr>
<td>
<code>infraVolumeSnapshotClassName</code></br>
<em>
string
</em>
</td>
<td>
<p>infraVolumeSnapshotClassName is the name of the infra cluster volume snapshot class that
will be exposed to the guest.</p>
</td>
</tr>
<tr>
<td>
<code>guestVolumeSnapshotClassName</code></br>
<em>
string
</em>
</td>
<td>
<p>guestVolumeSnapshotClassName is the name that the corresponding volumeSnapshotClass will
be called within the guest cluster</p>
</td>
</tr>
</tbody>
</table>
###KubevirtVolumeType { #hypershift.openshift.io/v1beta1.KubevirtVolumeType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtVolume">KubevirtVolume</a>)
</p>
<p>
<p>KubevirtVolumeType is a specific supported KubeVirt volumes</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Persistent&#34;</p></td>
<td><p>KubevirtVolumeTypePersistent represents persistent volume for kubevirt VMs</p>
</td>
</tr></tbody>
</table>
###LoadBalancerPublishingStrategy { #hypershift.openshift.io/v1beta1.LoadBalancerPublishingStrategy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategy">ServicePublishingStrategy</a>)
</p>
<p>
<p>LoadBalancerPublishingStrategy specifies setting used to expose a service as a LoadBalancer.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>hostname</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>hostname is the name of the DNS record that will be created pointing to the LoadBalancer and passed through to consumers of the service.
If omitted, the value will be inferred from the corev1.Service Load balancer type .status.</p>
</td>
</tr>
</tbody>
</table>
###LogLevel { #hypershift.openshift.io/v1beta1.LogLevel }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterVersionOperatorSpec">ClusterVersionOperatorSpec</a>)
</p>
<p>
</p>
###MachineNetworkEntry { #hypershift.openshift.io/v1beta1.MachineNetworkEntry }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">ClusterNetworking</a>)
</p>
<p>
<p>MachineNetworkEntry is a single IP address block for node IP blocks.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>cidr</code></br>
<em>
<a href="#">
github.com/openshift/hypershift/api/util/ipnet.IPNet
</a>
</em>
</td>
<td>
<p>cidr is the IP block address pool for machines within the cluster.</p>
</td>
</tr>
</tbody>
</table>
###ManagedAzureKeyVault { #hypershift.openshift.io/v1beta1.ManagedAzureKeyVault }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneManagedIdentities">ControlPlaneManagedIdentities</a>)
</p>
<p>
<p>ManagedAzureKeyVault is an Azure Key Vault on the management cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is the name of the Azure Key Vault on the management cluster.</p>
</td>
</tr>
<tr>
<td>
<code>tenantID</code></br>
<em>
string
</em>
</td>
<td>
<p>tenantID is the tenant ID of the Azure Key Vault on the management cluster.</p>
</td>
</tr>
</tbody>
</table>
###ManagedEtcdShardPersistentVolumeSpec { #hypershift.openshift.io/v1beta1.ManagedEtcdShardPersistentVolumeSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardStorageSpec">ManagedEtcdShardStorageSpec</a>)
</p>
<p>
<p>ManagedEtcdShardPersistentVolumeSpec configures PVC storage for an etcd shard.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>storageClassName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>storageClassName overrides the StorageClass for this shard&rsquo;s PVCs.
If not specified, the parent ManagedEtcdSpec&rsquo;s storageClassName is used.
Must be a valid DNS1123 subdomain (lowercase alphanumeric, hyphens, or
dots, starting and ending with an alphanumeric character), max 253
characters.</p>
</td>
</tr>
</tbody>
</table>
###ManagedEtcdShardSpec { #hypershift.openshift.io/v1beta1.ManagedEtcdShardSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdSpec">ManagedEtcdSpec</a>)
</p>
<p>
<p>ManagedEtcdShardSpec defines the configuration for a single etcd shard
within a managed etcd deployment.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is a unique identifier for this shard. It is used to derive
resource names (e.g., StatefulSet &ldquo;etcd-{name}&rdquo;, Service
&ldquo;etcd-client-{name}&rdquo;).
Must be a valid DNS1123 label (lowercase alphanumeric with hyphens,
starting and ending with an alphanumeric character), max 48 characters.
Immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>resources</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdShardResource">
[]EtcdShardResource
</a>
</em>
</td>
<td>
<p>resources is the list of Kubernetes resource types routed to this
shard. Each entry identifies a resource by its API group and plural
resource name. For example, events in the core group would be
{apiGroup: &ldquo;&rdquo;, resource: &ldquo;events&rdquo;}, and leases in the coordination group would be
{apiGroup: &ldquo;coordination.k8s.io&rdquo;, resource: &ldquo;leases&rdquo;}.
Only resource types built into the kube-apiserver are routed; entries
for CRD-backed or aggregated API resources have no effect (see
EtcdShardResource).
Minimum 1, maximum 20 entries. Immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>storage,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardStorageSpec">
ManagedEtcdShardStorageSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>storage configures the storage backend for this shard.
If not specified, the shard inherits PersistentVolume storage from
the parent ManagedEtcdSpec.Storage. Immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>replicas</code></br>
<em>
int32
</em>
</td>
<td>
<p>replicas is the number of etcd replicas for this shard. Must be 1 or 3.
Immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>scheduling,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdShardSchedulingSpec">
EtcdShardSchedulingSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>scheduling configures per-shard pod placement constraints. These
constraints are merged with the framework&rsquo;s control plane node
isolation settings (nodeSelector, tolerations, topology spread).</p>
</td>
</tr>
</tbody>
</table>
###ManagedEtcdShardStorageSpec { #hypershift.openshift.io/v1beta1.ManagedEtcdShardStorageSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardSpec">ManagedEtcdShardSpec</a>)
</p>
<p>
<p>ManagedEtcdShardStorageSpec configures storage for a single etcd shard.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardStorageType">
ManagedEtcdShardStorageType
</a>
</em>
</td>
<td>
<p>type is the kind of storage backend to use for this shard.
Valid values are PersistentVolume and EmptyDir.
When set to PersistentVolume, a PersistentVolumeClaim is created for
each etcd replica via the StatefulSet volumeClaimTemplates. The
optional persistentVolume field can override the StorageClass for
this shard; when persistentVolume is omitted, the shard inherits
the StorageClass and size from the parent spec.etcd.managed.storage
configuration.
When set to EmptyDir, the shard uses memory-backed ephemeral
storage (tmpfs). Data is lost when the pod restarts. This is
suitable for shards holding expendable, high-churn data such as
events or leases.</p>
</td>
</tr>
<tr>
<td>
<code>persistentVolume,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardPersistentVolumeSpec">
ManagedEtcdShardPersistentVolumeSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>persistentVolume configures PVC-based storage for this shard.
Only valid when type is PersistentVolume.
When omitted and type is PersistentVolume, the shard inherits the
StorageClass and volume size from the parent
spec.etcd.managed.storage.persistentVolume configuration.</p>
</td>
</tr>
</tbody>
</table>
###ManagedEtcdShardStorageType { #hypershift.openshift.io/v1beta1.ManagedEtcdShardStorageType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardStorageSpec">ManagedEtcdShardStorageSpec</a>)
</p>
<p>
<p>ManagedEtcdShardStorageType defines the type of storage for an etcd shard.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;EmptyDir&#34;</p></td>
<td><p>EmptyDirEtcdShardStorage uses memory-backed EmptyDir for shard storage.</p>
</td>
</tr><tr><td><p>&#34;PersistentVolume&#34;</p></td>
<td><p>PersistentVolumeEtcdShardStorage uses PersistentVolumes for shard storage.</p>
</td>
</tr></tbody>
</table>
###ManagedEtcdSpec { #hypershift.openshift.io/v1beta1.ManagedEtcdSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.EtcdSpec">EtcdSpec</a>)
</p>
<p>
<p>ManagedEtcdSpec specifies the behavior of an etcd cluster managed by
HyperShift.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>storage</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdStorageSpec">
ManagedEtcdStorageSpec
</a>
</em>
</td>
<td>
<p>storage specifies how etcd data is persisted.</p>
</td>
</tr>
<tr>
<td>
<code>backup,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupConfig">
HCPEtcdBackupConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>backup defines the backup configuration for managed etcd, including
optional KMS key settings for artifact encryption in cloud storage.
This configuration is only used when an HCPEtcdBackup CR exists.</p>
</td>
</tr>
<tr>
<td>
<code>scheduling,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdShardSchedulingSpec">
EtcdShardSchedulingSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>scheduling specifies scheduling constraints for the default etcd shard pods.</p>
</td>
</tr>
<tr>
<td>
<code>shards</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdShardSpec">
[]ManagedEtcdShardSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>shards defines additional etcd shards for resource-level routing.
The existing storage and scheduling fields above configure
the default shard (catch-all for all resources not explicitly
routed). Entries in this list define non-default shards,
each deployed as an independent StatefulSet and ControlPlaneComponent.
Minimum 1, maximum 10 entries. Resources must not overlap across
shards. Immutable after creation: shards cannot be added, removed,
or reordered.</p>
<p>WARNING: In the current TechPreview implementation, shard data is NOT
included in HCPEtcdBackup. Resources routed to shards will not be
backed up. This will be addressed before promotion beyond TechPreview.</p>
</td>
</tr>
</tbody>
</table>
###ManagedEtcdStorageSpec { #hypershift.openshift.io/v1beta1.ManagedEtcdStorageSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdSpec">ManagedEtcdSpec</a>)
</p>
<p>
<p>ManagedEtcdStorageSpec describes the storage configuration for etcd data.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdStorageType">
ManagedEtcdStorageType
</a>
</em>
</td>
<td>
<p>type is the kind of persistent storage implementation to use for etcd.
Only PersistentVolume is supported at the moment.</p>
</td>
</tr>
<tr>
<td>
<code>persistentVolume</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PersistentVolumeEtcdStorageSpec">
PersistentVolumeEtcdStorageSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>persistentVolume is the configuration for PersistentVolume etcd storage.
With this implementation, a PersistentVolume will be allocated for every
etcd member (either 1 or 3 depending on the HostedCluster control plane
availability configuration).</p>
</td>
</tr>
<tr>
<td>
<code>restoreSnapshotURL</code></br>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>restoreSnapshotURL allows an optional URL to be provided where
an etcd snapshot can be downloaded, for example a pre-signed URL
referencing a storage service.
This snapshot will be restored on initial startup, only when the etcd PV
is empty.</p>
</td>
</tr>
</tbody>
</table>
###ManagedEtcdStorageType { #hypershift.openshift.io/v1beta1.ManagedEtcdStorageType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdStorageSpec">ManagedEtcdStorageSpec</a>)
</p>
<p>
<p>ManagedEtcdStorageType is a storage type for an etcd cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;PersistentVolume&#34;</p></td>
<td><p>PersistentVolumeEtcdStorage uses PersistentVolumes for etcd storage.</p>
</td>
</tr></tbody>
</table>
###ManagedIdentity { #hypershift.openshift.io/v1beta1.ManagedIdentity }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureKMSSpec">AzureKMSSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.ControlPlaneManagedIdentities">ControlPlaneManagedIdentities</a>)
</p>
<p>
<p>ManagedIdentity contains the client ID, and its certificate name, of a managed identity. This managed identity is
used, by an HCP component, to authenticate with the Azure API.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>clientID</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureClientID">
AzureClientID
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>clientID is the client ID of a managed identity associated with CredentialsSecretName. This field is optional and
mainly used for CI purposes.</p>
</td>
</tr>
<tr>
<td>
<code>objectEncoding</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ObjectEncodingFormat">
ObjectEncodingFormat
</a>
</em>
</td>
<td>
<p>objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
the managed identity. objectEncoding needs to match the encoding format used when the certificate was stored in the
Azure Key Vault. If objectEncoding doesn&rsquo;t match the encoding format of the certificate, the certificate will
unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
SecretProviderClass custom resource related to the managed identity.</p>
<p>The default value is utf-8.</p>
<p>See this for more info - <a href="https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md">https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md</a></p>
</td>
</tr>
<tr>
<td>
<code>credentialsSecretName</code></br>
<em>
string
</em>
</td>
<td>
<p>credentialsSecretName is the name of an Azure Key Vault secret. This field assumes the secret contains the JSON
format of a UserAssignedIdentityCredentials struct. At a minimum, the secret needs to contain the ClientId,
ClientSecret, AuthenticationEndpoint, NotBefore, and NotAfter, and TenantId.</p>
<p>More info on this struct can be found here - <a href="https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156">https://github.com/Azure/msi-dataplane/blob/63fb37d3a1aaac130120624674df795d2e088083/pkg/dataplane/internal/generated_client.go#L156</a>.</p>
<p>credentialsSecretName must be between 1 and 127 characters and use only alphanumeric characters and hyphens.
credentialsSecretName must also be unique within the Azure Key Vault. See more details here - <a href="https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/">https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SecretName/</a>.</p>
</td>
</tr>
</tbody>
</table>
###MarketType { #hypershift.openshift.io/v1beta1.MarketType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.CapacityReservationOptions">CapacityReservationOptions</a>, 
<a href="#hypershift.openshift.io/v1beta1.PlacementOptions">PlacementOptions</a>)
</p>
<p>
<p>MarketType describes the market type for EC2 instances.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;CapacityBlocks&#34;</p></td>
<td><p>MarketTypeCapacityBlock is a MarketType enum value for Capacity Blocks.</p>
</td>
</tr><tr><td><p>&#34;OnDemand&#34;</p></td>
<td><p>MarketTypeOnDemand is a MarketType enum value for standard on-demand instances.</p>
</td>
</tr><tr><td><p>&#34;Spot&#34;</p></td>
<td><p>MarketTypeSpot is a MarketType enum value for Spot instances.
Spot instances use spare EC2 capacity at reduced prices but may be interrupted.</p>
</td>
</tr></tbody>
</table>
###MetricsForwardingMode { #hypershift.openshift.io/v1beta1.MetricsForwardingMode }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.MetricsForwardingSpec">MetricsForwardingSpec</a>)
</p>
<p>
<p>MetricsForwardingMode controls whether metrics forwarding is active for a hosted cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Forward&#34;</p></td>
<td><p>MetricsForwardingModeForward indicates metrics forwarding is active.</p>
</td>
</tr><tr><td><p>&#34;None&#34;</p></td>
<td><p>MetricsForwardingModeNone indicates metrics forwarding is inactive.</p>
</td>
</tr></tbody>
</table>
###MetricsForwardingSpec { #hypershift.openshift.io/v1beta1.MetricsForwardingSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.MonitoringSpec">MonitoringSpec</a>)
</p>
<p>
<p>MetricsForwardingSpec configures metrics forwarding for the hosted cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>mode</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MetricsForwardingMode">
MetricsForwardingMode
</a>
</em>
</td>
<td>
<p>mode controls whether metrics forwarding is active for this hosted cluster.
When set to &ldquo;Forward&rdquo;, metrics-proxy and endpoint-resolver are deployed in the
control plane, and a metrics-forwarder is deployed in the hosted cluster.
When set to &ldquo;None&rdquo;, metrics forwarding is inactive.</p>
</td>
</tr>
<tr>
<td>
<code>metricsSet</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MetricsSet">
MetricsSet
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metricsSet specifies which set of metrics to forward to the hosted
cluster&rsquo;s monitoring stack. This controls only the metrics-proxy forwarding
path and does not affect management-cluster-side ServiceMonitor/PodMonitor
relabel configurations.
When not specified, the value from monitoring.metricsSet is used, which itself
falls back to the global METRICS_SET environment variable (default &ldquo;Telemetry&rdquo;).</p>
<p>&ldquo;Telemetry&rdquo; forwards only the minimal set of metrics required for OpenShift Telemetry.
&ldquo;SRE&rdquo; forwards the Telemetry set plus additional metrics defined in the sre-metric-set
ConfigMap, needed for SRE dashboards and alerts.
&ldquo;All&rdquo; forwards all metrics from control plane components without filtering,
which produces significantly higher metrics volume.</p>
</td>
</tr>
</tbody>
</table>
###MetricsSet { #hypershift.openshift.io/v1beta1.MetricsSet }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.MetricsForwardingSpec">MetricsForwardingSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.MonitoringSpec">MonitoringSpec</a>)
</p>
<p>
<p>MetricsSet specifies the set of metrics to collect and forward from hosted clusters.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;All&#34;</p></td>
<td><p>MetricsSetAll collects all metrics from control plane components without
any filtering. Use this for debugging or when full metric visibility is
needed, but be aware it produces significantly higher metrics volume.</p>
</td>
</tr><tr><td><p>&#34;SRE&#34;</p></td>
<td><p>MetricsSetSRE collects the metrics defined in the sre-metric-set ConfigMap,
which includes the Telemetry set plus additional metrics needed for SRE
monitoring dashboards and alerts. Use this for clusters that require
SRE observability.</p>
</td>
</tr><tr><td><p>&#34;Telemetry&#34;</p></td>
<td><p>MetricsSetTelemetry collects only the minimal set of metrics required for
OpenShift Telemetry. Use this to minimize metrics volume while still
satisfying cluster telemetry requirements.</p>
</td>
</tr></tbody>
</table>
###MonitoringSpec { #hypershift.openshift.io/v1beta1.MonitoringSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>MonitoringSpec configures monitoring for the hosted cluster.
At least one field must be specified when this struct is present.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>metricsForwarding,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MetricsForwardingSpec">
MetricsForwardingSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metricsForwarding configures forwarding of control plane metrics into
the hosted cluster&rsquo;s monitoring stack.
When omitted, metrics forwarding behavior is determined by the
hypershift.openshift.io/enable-metrics-forwarding annotation for backward compatibility.
If neither is set, metrics forwarding is disabled.</p>
</td>
</tr>
<tr>
<td>
<code>metricsSet</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MetricsSet">
MetricsSet
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>metricsSet specifies which set of metrics to collect and forward.
This overrides the global METRICS_SET environment variable configured on the HyperShift Operator.
When not specified, the global METRICS_SET value is used, which defaults to &ldquo;Telemetry&rdquo;.</p>
<p>&ldquo;Telemetry&rdquo; collects only the minimal set of metrics required for OpenShift Telemetry.
&ldquo;SRE&rdquo; collects the Telemetry set plus additional metrics defined in the sre-metric-set ConfigMap,
needed for SRE dashboards and alerts.
&ldquo;All&rdquo; collects all metrics from control plane components without filtering,
which produces significantly higher metrics volume.</p>
</td>
</tr>
</tbody>
</table>
###MultiQueueSetting { #hypershift.openshift.io/v1beta1.MultiQueueSetting }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtNodePoolPlatform">KubevirtNodePoolPlatform</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Disable&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Enable&#34;</p></td>
<td></td>
</tr></tbody>
</table>
###NetworkFilter { #hypershift.openshift.io/v1beta1.NetworkFilter }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NetworkParam">NetworkParam</a>)
</p>
<p>
<p>NetworkFilter specifies a query to select an OpenStack network. At least one property must be set.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>name is the name of the network to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>description</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>description is the description of the network to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>projectID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>projectID is the project ID of the network to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>FilterByNeutronTags</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.FilterByNeutronTags">
FilterByNeutronTags
</a>
</em>
</td>
<td>
<p>
(Members of <code>FilterByNeutronTags</code> are embedded into this type.)
</p>
<em>(Optional)</em>
<p>FilterByNeutronTags specifies tags to filter by.</p>
</td>
</tr>
</tbody>
</table>
###NetworkParam { #hypershift.openshift.io/v1beta1.NetworkParam }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackPlatformSpec">OpenStackPlatformSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.PortSpec">PortSpec</a>)
</p>
<p>
<p>NetworkParam specifies an OpenStack network. It may be specified by either ID or Filter, but not both.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>id</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>id is the ID of the network to use. If ID is provided, the other filters cannot be provided. Must be in UUID format.</p>
</td>
</tr>
<tr>
<td>
<code>filter</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NetworkFilter">
NetworkFilter
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>filter specifies a filter to select an OpenStack network. If provided, cannot be empty.</p>
</td>
</tr>
</tbody>
</table>
###NetworkType { #hypershift.openshift.io/v1beta1.NetworkType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">ClusterNetworking</a>)
</p>
<p>
<p>NetworkType specifies the SDN provider used for cluster networking.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Calico&#34;</p></td>
<td><p>Calico specifies Calico as the SDN provider</p>
</td>
</tr><tr><td><p>&#34;OVNKubernetes&#34;</p></td>
<td><p>OVNKubernetes specifies OVN as the SDN provider</p>
</td>
</tr><tr><td><p>&#34;OpenShiftSDN&#34;</p></td>
<td><p>OpenShiftSDN specifies OpenShiftSDN as the SDN provider</p>
</td>
</tr><tr><td><p>&#34;Other&#34;</p></td>
<td><p>Other specifies an undefined SDN provider</p>
</td>
</tr></tbody>
</table>
###NeutronTag { #hypershift.openshift.io/v1beta1.NeutronTag }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.FilterByNeutronTags">FilterByNeutronTags</a>)
</p>
<p>
<p>NeutronTag represents a tag on a Neutron resource.
It may not be empty and may not contain commas.</p>
</p>
###NodePoolAutoScaling { #hypershift.openshift.io/v1beta1.NodePoolAutoScaling }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolSpec">NodePoolSpec</a>)
</p>
<p>
<p>NodePoolAutoScaling specifies auto-scaling behavior for a NodePool.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>min</code></br>
<em>
int32
</em>
</td>
<td>
<p>min is the minimum number of nodes to maintain in the pool.
Can be set to 0 for scale-from-zero for AWS and Azure platforms.
Must be &gt;= 0 and &lt;= .Max.</p>
</td>
</tr>
<tr>
<td>
<code>max</code></br>
<em>
int32
</em>
</td>
<td>
<p>max is the maximum number of nodes allowed in the pool. Must be &gt;= 1 and &gt;= Min.</p>
</td>
</tr>
</tbody>
</table>
###NodePoolCondition { #hypershift.openshift.io/v1beta1.NodePoolCondition }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolStatus">NodePoolStatus</a>)
</p>
<p>
<p>We define our own condition type since metav1.Condition has validation
for Reason that might be broken by what we bubble up from CAPI.
NodePoolCondition defines an observation of NodePool resource operational state.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
string
</em>
</td>
<td>
<p>type of condition in CamelCase or in foo.example.com/CamelCase.
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
can be useful (see .node.status.conditions), the ability to deconflict is important.</p>
</td>
</tr>
<tr>
<td>
<code>status</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#conditionstatus-v1-core">
Kubernetes core/v1.ConditionStatus
</a>
</em>
</td>
<td>
<p>status of the condition, one of True, False, Unknown.</p>
</td>
</tr>
<tr>
<td>
<code>severity</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>severity provides an explicit classification of Reason code, so the users or machines can immediately
understand the current situation and act accordingly.
The Severity field MUST be set only when Status=False.</p>
</td>
</tr>
<tr>
<td>
<code>lastTransitionTime</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#time-v1-meta">
Kubernetes meta/v1.Time
</a>
</em>
</td>
<td>
<p>lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when
the API field changed is acceptable.</p>
</td>
</tr>
<tr>
<td>
<code>reason</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>reason for the condition&rsquo;s last transition in CamelCase.
The specific API may choose whether or not this field is considered a guaranteed API.
This field may not be empty.</p>
</td>
</tr>
<tr>
<td>
<code>message</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>message is a human readable message indicating details about the transition.
This field may be empty.</p>
</td>
</tr>
<tr>
<td>
<code>observedGeneration</code></br>
<em>
int64
</em>
</td>
<td>
<em>(Optional)</em>
<p>observedGeneration represents the .metadata.generation that the condition was set based upon.</p>
</td>
</tr>
</tbody>
</table>
###NodePoolManagement { #hypershift.openshift.io/v1beta1.NodePoolManagement }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolSpec">NodePoolSpec</a>)
</p>
<p>
<p>NodePoolManagement specifies behavior for managing nodes in a NodePool, such
as upgrade strategies and auto-repair behaviors.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>upgradeType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.UpgradeType">
UpgradeType
</a>
</em>
</td>
<td>
<p>upgradeType specifies the type of strategy for handling upgrades.
This can be either &ldquo;Replace&rdquo; or &ldquo;InPlace&rdquo;.
&ldquo;Replace&rdquo; will update Nodes by recreating the underlying instances.
&ldquo;InPlace&rdquo; will update Nodes by applying changes to the existing instances. This might or might not result in a reboot.</p>
</td>
</tr>
<tr>
<td>
<code>replace</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ReplaceUpgrade">
ReplaceUpgrade
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>replace is the configuration for rolling upgrades.
It defaults to a RollingUpdate strategy with maxSurge of 1 and maxUnavailable of 0.</p>
</td>
</tr>
<tr>
<td>
<code>inPlace</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.InPlaceUpgrade">
InPlaceUpgrade
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>inPlace is the configuration for in-place upgrades.</p>
</td>
</tr>
<tr>
<td>
<code>autoRepair</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoRepair specifies whether health checks should be enabled for machines in the NodePool. The default is false.
Enabling this feature will cause the controller to automatically delete unhealthy machines.
The unhealthy criteria is reserved for the controller implementation and subject to change.
But generally it&rsquo;s determined by checking the Node ready condition is true and a timeout that might vary depending on the platform provider.
AutoRepair will no-op when more than 2 Nodes are unhealthy at the same time. Giving time for the cluster to stabilize or to the user to manually intervene.</p>
</td>
</tr>
</tbody>
</table>
###NodePoolNodesInfo { #hypershift.openshift.io/v1beta1.NodePoolNodesInfo }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolStatus">NodePoolStatus</a>)
</p>
<p>
<p>NodePoolNodesInfo aggregates observed information about nodes belonging to this NodePool.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>nodeVersions</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodeVersion">
[]NodeVersion
</a>
</em>
</td>
<td>
<p>nodeVersions summarizes the versions and health of nodes belonging
to this NodePool. Each entry represents a distinct version combination
and the number of ready/unready nodes running it.</p>
</td>
</tr>
</tbody>
</table>
###NodePoolPlatform { #hypershift.openshift.io/v1beta1.NodePoolPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolSpec">NodePoolSpec</a>)
</p>
<p>
<p>NodePoolPlatform specifies the underlying infrastructure provider for the
NodePool and is used to configure platform specific behavior.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlatformType">
PlatformType
</a>
</em>
</td>
<td>
<p>type specifies the platform name.</p>
</td>
</tr>
<tr>
<td>
<code>aws</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSNodePoolPlatform">
AWSNodePoolPlatform
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aws specifies the configuration used when operating on AWS.</p>
</td>
</tr>
<tr>
<td>
<code>ibmcloud</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudPlatformSpec">
IBMCloudPlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ibmcloud defines IBMCloud specific settings for components</p>
</td>
</tr>
<tr>
<td>
<code>kubevirt</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtNodePoolPlatform">
KubevirtNodePoolPlatform
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubevirt specifies the configuration used when operating on KubeVirt platform.</p>
</td>
</tr>
<tr>
<td>
<code>agent</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AgentNodePoolPlatform">
AgentNodePoolPlatform
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>agent specifies the configuration used when using Agent platform.</p>
</td>
</tr>
<tr>
<td>
<code>azure</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureNodePoolPlatform">
AzureNodePoolPlatform
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>azure specifies the configuration used when using Azure platform.</p>
</td>
</tr>
<tr>
<td>
<code>powervs</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSNodePoolPlatform">
PowerVSNodePoolPlatform
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>powervs specifies the configuration used when using IBMCloud PowerVS platform.</p>
</td>
</tr>
<tr>
<td>
<code>openstack</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackNodePoolPlatform">
OpenStackNodePoolPlatform
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>openstack specifies the configuration used when using OpenStack platform.</p>
</td>
</tr>
<tr>
<td>
<code>gcp</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPNodePoolPlatform">
GCPNodePoolPlatform
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>gcp specifies the configuration used when operating on GCP.</p>
</td>
</tr>
</tbody>
</table>
###NodePoolPlatformStatus { #hypershift.openshift.io/v1beta1.NodePoolPlatformStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolStatus">NodePoolStatus</a>)
</p>
<p>
<p>NodePoolPlatformStatus struct contains platform-specific status information.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>kubeVirt</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubeVirtNodePoolStatus">
KubeVirtNodePoolStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubeVirt contains the KubeVirt platform statuses</p>
</td>
</tr>
</tbody>
</table>
###NodePoolSpec { #hypershift.openshift.io/v1beta1.NodePoolSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePool">NodePool</a>)
</p>
<p>
<p>NodePoolSpec is the desired behavior of a NodePool.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>clusterName</code></br>
<em>
string
</em>
</td>
<td>
<p>clusterName is the name of the HostedCluster this NodePool belongs to.
If a HostedCluster with this name doesn&rsquo;t exist, the controller will no-op until it exists.</p>
</td>
</tr>
<tr>
<td>
<code>release</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Release">
Release
</a>
</em>
</td>
<td>
<p>release specifies the OCP release used for this NodePool. It drives the machine ignition configuration (including
the kubelet version) and other platform-specific properties (e.g. an AMI on AWS).</p>
<p>Version-skew rules and effects:
- The minor-version skew relative to the control-plane release must be &lt;= N-2.
This is not currently enforced, but exceeding this limit is unsupported and
may lead to unpredictable behavior.
- If the specified release is higher than the HostedCluster&rsquo;s release, the
NodePool will be degraded and the ValidReleaseImage condition will be false.
- If the specified release is lower than the NodePool&rsquo;s current y-stream,
the NodePool will be degraded and the ValidReleaseImage condition will be false.</p>
<p>Changing this field triggers a NodePool rollout.</p>
</td>
</tr>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">
NodePoolPlatform
</a>
</em>
</td>
<td>
<p>platform specifies the underlying infrastructure provider for the NodePool
and is used to configure platform specific behavior.</p>
</td>
</tr>
<tr>
<td>
<code>replicas</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>replicas is the desired number of nodes the pool should maintain. If unset, the controller default value is 0.
replicas is mutually exclusive with autoscaling. If autoscaling is configured, replicas must be omitted and autoscaling will control the NodePool size internally.</p>
</td>
</tr>
<tr>
<td>
<code>management</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolManagement">
NodePoolManagement
</a>
</em>
</td>
<td>
<p>management specifies behavior for managing nodes in the pool, such as
upgrade strategies and auto-repair behaviors.</p>
</td>
</tr>
<tr>
<td>
<code>autoScaling</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolAutoScaling">
NodePoolAutoScaling
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>autoScaling specifies auto-scaling behavior for the NodePool.
autoScaling is mutually exclusive with replicas. If replicas is set, this field must be omitted.</p>
</td>
</tr>
<tr>
<td>
<code>config</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
[]Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>config is a list of references to ConfigMaps containing serialized
MachineConfig resources to be injected into the ignition configurations of
nodes in the NodePool. The MachineConfig API schema is defined here:</p>
<p><a href="https://github.com/openshift/machine-config-operator/blob/18963e4f8fe66e8c513ca4b131620760a414997f/pkg/apis/machineconfiguration.openshift.io/v1/types.go#L185">https://github.com/openshift/machine-config-operator/blob/18963e4f8fe66e8c513ca4b131620760a414997f/pkg/apis/machineconfiguration.openshift.io/v1/types.go#L185</a></p>
<p>Each ConfigMap must have a single key named &ldquo;config&rdquo; whose value is the YML
with one or more serialized machineconfiguration.openshift.io resources:</p>
<ul>
<li>KubeletConfig</li>
<li>ContainerRuntimeConfig</li>
<li>MachineConfig</li>
<li>ClusterImagePolicy</li>
<li>ImageContentSourcePolicy</li>
<li>ImageDigestMirrorSet</li>
</ul>
<p>This is validated in the backend and signaled back via validMachineConfig condition.
Changing this field will trigger a NodePool rollout.</p>
</td>
</tr>
<tr>
<td>
<code>nodeDrainTimeout</code></br>
<em>
<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
Kubernetes meta/v1.Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeDrainTimeout is the maximum amount of time that the controller will spend on retrying to drain a node until it succeeds.
The default value is 0, meaning that the node can retry drain without any time limitations.
Changing this field propagate inplace into existing Nodes.</p>
</td>
</tr>
<tr>
<td>
<code>nodeVolumeDetachTimeout</code></br>
<em>
<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
Kubernetes meta/v1.Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeVolumeDetachTimeout is the maximum amount of time that the controller will spend on detaching volumes from a node.
The default value is 0, meaning that the volumes will be detached from the node without any time limitations.
After the timeout, any remaining attached volumes will be ignored and the removal of the machine will continue.
Changing this field propagate inplace into existing Nodes.</p>
</td>
</tr>
<tr>
<td>
<code>nodeLabels</code></br>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodeLabels propagates a list of labels to Nodes, only once on creation.
Valid values are those in <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set">https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set</a></p>
</td>
</tr>
<tr>
<td>
<code>taints</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Taint">
[]Taint
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>taints if specified, propagates a list of taints to Nodes, only once on creation.
These taints are additive to the ones applied by other controllers</p>
</td>
</tr>
<tr>
<td>
<code>pausedUntil</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>pausedUntil is a field that can be used to pause reconciliation on the NodePool controller. Resulting in any change to the NodePool being ignored.
Either a date can be provided in RFC3339 format or a boolean as in &lsquo;true&rsquo;, &lsquo;false&rsquo;, &lsquo;True&rsquo;, &lsquo;False&rsquo;. If a date is
provided: reconciliation is paused on the resource until that date. If the boolean true is
provided: reconciliation is paused on the resource until the field is removed.</p>
</td>
</tr>
<tr>
<td>
<code>tuningConfig</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
[]Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>tuningConfig is a list of references to ConfigMaps containing serialized
Tuned or PerformanceProfile resources to define the tuning configuration to be applied to
nodes in the NodePool. The Tuned API is defined here:</p>
<p><a href="https://github.com/openshift/cluster-node-tuning-operator/blob/2c76314fb3cc8f12aef4a0dcd67ddc3677d5b54f/pkg/apis/tuned/v1/tuned_types.go">https://github.com/openshift/cluster-node-tuning-operator/blob/2c76314fb3cc8f12aef4a0dcd67ddc3677d5b54f/pkg/apis/tuned/v1/tuned_types.go</a></p>
<p>The PerformanceProfile API is defined here:
<a href="https://github.com/openshift/cluster-node-tuning-operator/tree/b41042d42d4ba5bb2e99960248cf1d6ae4935018/pkg/apis/performanceprofile/v2">https://github.com/openshift/cluster-node-tuning-operator/tree/b41042d42d4ba5bb2e99960248cf1d6ae4935018/pkg/apis/performanceprofile/v2</a></p>
<p>Each ConfigMap must have a single key named &ldquo;tuning&rdquo; whose value is the
JSON or YAML of a serialized Tuned or PerformanceProfile.
Changing this field will trigger a NodePool rollout.</p>
</td>
</tr>
<tr>
<td>
<code>arch</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>arch is the preferred processor architecture for the NodePool. Different platforms might have different supported architectures.
TODO: This is set as optional to prevent validation from failing due to a limitation on client side validation with open API machinery:
<a href="https://github.com/kubernetes/kubernetes/issues/108768#issuecomment-1253912215">https://github.com/kubernetes/kubernetes/issues/108768#issuecomment-1253912215</a></p>
</td>
</tr>
<tr>
<td>
<code>osImageStream,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OSImageStreamReference">
OSImageStreamReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>osImageStream specifies an OS stream to be used for nodes in this pool.</p>
<p>This field can be optionally set to a known OSImageStream name to change
the OS and Extension images with a well-known, tested, release-provided
set of images. This enables a streamlined way of switching the pool&rsquo;s
node OS to a different version than the cluster default, such as
transitioning to a major RHEL version.</p>
<p>When set, the referenced stream overrides the default OS images for the
pool. When omitted, the pool uses the release version&rsquo;s default stream
(rhel-9 for OCP &lt; 5.0, rhel-10 for OCP &gt;= 5.0).
Changing this field triggers a rollout. Forward transitions
(rhel-9 -&gt; rhel-10) are allowed; backward transitions
(rhel-10 -&gt; rhel-9) are rejected by CEL validation because
in-place OS downgrades are not supported.</p>
</td>
</tr>
</tbody>
</table>
###NodePoolStatus { #hypershift.openshift.io/v1beta1.NodePoolStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePool">NodePool</a>)
</p>
<p>
<p>NodePoolStatus is the latest observed status of a NodePool.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>replicas</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>replicas is the latest observed number of nodes in the pool.</p>
</td>
</tr>
<tr>
<td>
<code>version</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>version is the semantic version of the latest applied release specified by
the NodePool.</p>
</td>
</tr>
<tr>
<td>
<code>nodesInfo,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolNodesInfo">
NodePoolNodesInfo
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodesInfo contains aggregated information observed from nodes belonging
to this NodePool.</p>
</td>
</tr>
<tr>
<td>
<code>platform</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatformStatus">
NodePoolPlatformStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>platform holds the specific statuses</p>
</td>
</tr>
<tr>
<td>
<code>osImageStream,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OSImageStreamReference">
OSImageStreamReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>osImageStream reports the OS stream observed on the nodes in this pool.</p>
<p>When omitted, the pool is using the release version&rsquo;s default OS images.</p>
</td>
</tr>
<tr>
<td>
<code>conditions</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolCondition">
[]NodePoolCondition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>conditions represents the latest available observations of the node pool&rsquo;s
current state.</p>
</td>
</tr>
</tbody>
</table>
###NodePortPublishingStrategy { #hypershift.openshift.io/v1beta1.NodePortPublishingStrategy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategy">ServicePublishingStrategy</a>)
</p>
<p>
<p>NodePortPublishingStrategy specifies a NodePort used to expose a service.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>address</code></br>
<em>
string
</em>
</td>
<td>
<p>address is the host/ip that the NodePort service is exposed over.</p>
</td>
</tr>
<tr>
<td>
<code>port</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>port is the port of the NodePort service. If &lt;=0, the port is dynamically
assigned when the service is created.</p>
</td>
</tr>
</tbody>
</table>
###NodeVersion { #hypershift.openshift.io/v1beta1.NodeVersion }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolNodesInfo">NodePoolNodesInfo</a>)
</p>
<p>
<p>NodeVersion represents a version combination and the count of ready and unready nodes running it.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>ocpVersion</code></br>
<em>
string
</em>
</td>
<td>
<p>ocpVersion is the OpenShift release version this node was provisioned
or upgraded with.</p>
</td>
</tr>
<tr>
<td>
<code>kubeletVersion</code></br>
<em>
string
</em>
</td>
<td>
<p>kubeletVersion is the kubelet version reported by the node, as observed
from Machine.Status.NodeInfo.KubeletVersion.</p>
</td>
</tr>
<tr>
<td>
<code>readyNodeCount</code></br>
<em>
int32
</em>
</td>
<td>
<p>readyNodeCount is the number of nodes running this version where the
CAPI NodeHealthy condition is True.</p>
</td>
</tr>
<tr>
<td>
<code>unreadyNodeCount</code></br>
<em>
int32
</em>
</td>
<td>
<p>unreadyNodeCount is the number of nodes running this version where the
CAPI NodeHealthy condition is not True. Useful for tracking upgrade
progress and detecting stuck nodes.</p>
</td>
</tr>
</tbody>
</table>
###OLMCatalogPlacement { #hypershift.openshift.io/v1beta1.OLMCatalogPlacement }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>OLMCatalogPlacement is an enum specifying the placement of OLM catalog components.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;guest&#34;</p></td>
<td><p>GuestOLMCatalogPlacement indicates OLM catalog components will be placed in
the guest cluster.</p>
</td>
</tr><tr><td><p>&#34;management&#34;</p></td>
<td><p>ManagementOLMCatalogPlacement indicates OLM catalog components will be placed in
the management cluster.</p>
</td>
</tr></tbody>
</table>
###OSImageStreamReference { #hypershift.openshift.io/v1beta1.OSImageStreamReference }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolSpec">NodePoolSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.NodePoolStatus">NodePoolStatus</a>)
</p>
<p>
<p>OSImageStreamReference references an OSImageStream by name.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is a required reference to an OSImageStream to be used for the pool.</p>
</td>
</tr>
</tbody>
</table>
###OVNIPv4Config { #hypershift.openshift.io/v1beta1.OVNIPv4Config }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OVNKubernetesConfig">OVNKubernetesConfig</a>)
</p>
<p>
<p>OVNIPv4Config contains IPv4-specific configuration options for OVN-Kubernetes.
<a href="https://github.com/openshift/api/blob/6d3c4e25a8d3aeb57ad61649d80c38cbd27d1cc8/operator/v1/types_network.go#L473-L503">https://github.com/openshift/api/blob/6d3c4e25a8d3aeb57ad61649d80c38cbd27d1cc8/operator/v1/types_network.go#L473-L503</a></p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>internalTransitSwitchSubnet</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>internalTransitSwitchSubnet is a v4 subnet in IPV4 CIDR format used internally
by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
architecture that connects the cluster routers on each node together to enable
east west traffic. The subnet chosen should not overlap with other networks
specified for OVN-Kubernetes as well as other networks used on the host.
When omitted, this means no opinion and the platform is left to choose a reasonable
default which is subject to change over time.
The current default subnet is 100.88.0.0/16
The subnet must be large enough to accommodate one IP per node in your cluster
The value must be in proper IPV4 CIDR format</p>
</td>
</tr>
<tr>
<td>
<code>internalJoinSubnet</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>internalJoinSubnet is a v4 subnet used internally by ovn-kubernetes in case the
default one is being already used by something else. It must not overlap with
any other subnet being used by OpenShift or by the node network. The size of the
subnet must be larger than the number of nodes.
The current default value is 100.64.0.0/16
The subnet must be large enough to accommodate one IP per node in your cluster
The value must be in proper IPV4 CIDR format</p>
</td>
</tr>
</tbody>
</table>
###OVNIPv6Config { #hypershift.openshift.io/v1beta1.OVNIPv6Config }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OVNKubernetesConfig">OVNKubernetesConfig</a>)
</p>
<p>
<p>OVNIPv6Config contains IPv6-specific configuration options for OVN-Kubernetes.
<a href="https://github.com/openshift/api/blob/6d3c4e25a8d3aeb57ad61649d80c38cbd27d1cc8/operator/v1/types_network.go#L541-L570">https://github.com/openshift/api/blob/6d3c4e25a8d3aeb57ad61649d80c38cbd27d1cc8/operator/v1/types_network.go#L541-L570</a></p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>internalTransitSwitchSubnet</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>internalTransitSwitchSubnet is a v6 subnet in IPv6 CIDR format used internally
by OVN-Kubernetes for the distributed transit switch in the OVN Interconnect
architecture that connects the cluster routers on each node together to enable
east west traffic. The subnet chosen should not overlap with other networks
specified for OVN-Kubernetes as well as other networks used on the host.
When omitted, this means no opinion and the platform is left to choose a reasonable
default which is subject to change over time.
The current default subnet is fd97::/64.
The subnet must be large enough to accommodate one IP per node in your cluster.
The value must be a valid IPv6 CIDR (e.g. fd97::/64). IPv4 addresses,
IPv4-mapped IPv6 addresses, and dual-stack addresses are not permitted.
The prefix length must be in the range /0 to /125 inclusive.
This field is immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>internalJoinSubnet</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>internalJoinSubnet is a v6 subnet used internally by ovn-kubernetes in case the
default one is being already used by something else. It must not overlap with
any other subnet being used by OpenShift or by the node network. The size of the
subnet must be larger than the number of nodes.
The current default value is fd98::/64.
For KubeVirt hosted clusters, if this field is not set, HyperShift will
automatically use fd99::/64 to avoid collisions with the management cluster&rsquo;s
default join subnet (fd98::/64).
The subnet must be large enough to accommodate one IP per node in your cluster.
The value must be a valid IPv6 CIDR (e.g. fd98::/64). IPv4 addresses,
IPv4-mapped IPv6 addresses, and dual-stack addresses are not permitted.
The prefix length must be in the range /0 to /125 inclusive.
This field is immutable once set.</p>
</td>
</tr>
</tbody>
</table>
###OVNKubernetesConfig { #hypershift.openshift.io/v1beta1.OVNKubernetesConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworkOperatorSpec">ClusterNetworkOperatorSpec</a>)
</p>
<p>
<p>OVNKubernetesConfig contains OVN-Kubernetes specific configuration options.
<a href="https://github.com/openshift/api/blob/6d3c4e25a8d3aeb57ad61649d80c38cbd27d1cc8/operator/v1/types_network.go#L400-L471">https://github.com/openshift/api/blob/6d3c4e25a8d3aeb57ad61649d80c38cbd27d1cc8/operator/v1/types_network.go#L400-L471</a></p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>ipv4</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OVNIPv4Config">
OVNIPv4Config
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ipv4 allows users to configure IP settings for IPv4 connections. When omitted,
this means no opinions and the default configuration is used. Check individual
fields within ipv4 for details of default values.</p>
</td>
</tr>
<tr>
<td>
<code>ipv6,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OVNIPv6Config">
OVNIPv6Config
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ipv6 allows users to configure IP settings for IPv6 connections. When omitted,
this means no opinions and the default configuration is used. Check individual
fields within ipv6 for details of default values.
For KubeVirt hosted clusters using dual-stack networking, it is recommended to
set ipv6.internalJoinSubnet to a value different from the management cluster&rsquo;s
join subnet (default fd98::/64) to avoid IPv6 routing conflicts.</p>
</td>
</tr>
<tr>
<td>
<code>mtu</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>mtu is the MTU to use for the tunnel interface on hosted cluster nodes.
This must be 100 bytes smaller than the uplink MTU.
When unset, the cluster-network-operator will determine the MTU automatically
based on the infrastructure (e.g., for commercial AWS regions, it defaults
to 8901 based on the 9001 uplink MTU minus 100 bytes overhead).
Some non-commercial AWS regions do not support 9001 uplink MTU,
requiring this field to be explicitly set to a lower value.
The maximum is 9216, which is the standard jumbo frame upper limit
supported by datacenter and cloud network interfaces.
The minimum is 576, which is the minimum IPv4 MTU per RFC 791.
This field is immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>v4InternalSubnet</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>v4InternalSubnet configures the IPv4 subnet used by OVN-Kubernetes for gateway
router logical router port (LRP) addresses and masquerade/SNAT traffic within
the OVN logical topology. It must not overlap with any other subnet being used
by OpenShift or by the node network. The size of the subnet must be larger than
the number of nodes.
This field is distinct from ipv4.internalJoinSubnet, which configures the subnet
for the join switch that interconnects per-node gateway routers with the cluster
router. Both default to 100.64.0.0/16 but control different OVN-Kubernetes
internal networks and can be configured independently to avoid overlaps with
existing network infrastructure.
Once set, the value is immutable and cannot be modified in subsequent updates.
The default is 100.64.0.0/16.
The value must be in IPv4 CIDR notation (e.g., 192.168.0.0/16), consisting of
four decimal octets (0-255) separated by dots, followed by a slash and a prefix
length. The prefix length must be between 0 and 30 inclusive, and the first
octet must not be 0.
The value must be between 9 and 18 characters in length.
This field is immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>v6InternalSubnet</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>v6InternalSubnet configures the IPv6 subnet used by OVN-Kubernetes for gateway
router logical router port (LRP) addresses and masquerade/SNAT traffic within
the OVN logical topology. It must not overlap with any other subnet being used
by OpenShift or by the node network. The size of the subnet must be larger than
the number of nodes.
This field is distinct from ipv6.internalJoinSubnet, which configures the subnet
for the join switch that interconnects per-node gateway routers with the cluster
router. Both default to fd98::/64 but control different OVN-Kubernetes internal
networks and can be configured independently to avoid overlaps with existing
network infrastructure.
Once set, the value is immutable and cannot be modified in subsequent updates.
The default is fd98::/64.
The value must be in IPv6 CIDR notation (e.g., fd98::/64), consisting of an
IPv6 address followed by a slash and a prefix length. The prefix length must
be between 0 and 125 inclusive.
The value must be between 4 and 48 characters in length.
This field is immutable once set.</p>
</td>
</tr>
</tbody>
</table>
###ObjectEncodingFormat { #hypershift.openshift.io/v1beta1.ObjectEncodingFormat }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedIdentity">ManagedIdentity</a>)
</p>
<p>
<p>objectEncoding represents the encoding for the Azure Key Vault secret containing the certificate related to
CertificateName. objectEncoding needs to match the encoding format used when the certificate was stored in the
Azure Key Vault. If objectEncoding doesn&rsquo;t match the encoding format of the certificate, the certificate will
unsuccessfully be read by the Secrets CSI driver and an error will occur. This error will only be visible on the
SecretProviderClass custom resource related to the managed identity.</p>
<p>The default value is utf-8.</p>
<p>See this for more info - <a href="https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md">https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/website/content/en/getting-started/usage/_index.md</a></p>
</p>
###OpenStackIdentityReference { #hypershift.openshift.io/v1beta1.OpenStackIdentityReference }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackPlatformSpec">OpenStackPlatformSpec</a>)
</p>
<p>
<p>OpenStackIdentityReference is a reference to an infrastructure
provider identity to be used to provision cluster resources.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is the name of a secret in the same namespace as the resource being provisioned.
The secret must contain a key named <code>clouds.yaml</code> which contains an OpenStack clouds.yaml file.
The secret may optionally contain a key named <code>cacert</code> containing a PEM-encoded CA certificate.</p>
</td>
</tr>
<tr>
<td>
<code>cloudName</code></br>
<em>
string
</em>
</td>
<td>
<p>cloudName specifies the name of the entry in the clouds.yaml file to use.</p>
</td>
</tr>
</tbody>
</table>
###OpenStackNodePoolPlatform { #hypershift.openshift.io/v1beta1.OpenStackNodePoolPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>flavor</code></br>
<em>
string
</em>
</td>
<td>
<p>flavor is the OpenStack flavor to use for the node instances.</p>
</td>
</tr>
<tr>
<td>
<code>imageName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageName is the OpenStack Glance image name to use for node instances. If unspecified, the default
is chosen based on the NodePool release payload image.</p>
</td>
</tr>
<tr>
<td>
<code>availabilityZone</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>availabilityZone is the nova availability zone in which the provider will create the VM.
If not specified, the VM will be created in the default availability zone specified in the nova configuration.
Availability zone names must NOT contain : since it is used by admin users to specify hosts where instances
are launched in server creation. Also, it must not contain spaces otherwise it will lead to node that belongs
to this availability zone register failure, see kubernetes/cloud-provider-openstack#1379 for further information.
The maximum length of availability zone name is 63 as per labels limits.</p>
</td>
</tr>
<tr>
<td>
<code>additionalPorts</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PortSpec">
[]PortSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>additionalPorts is a list of additional ports to create on the node instances.</p>
</td>
</tr>
</tbody>
</table>
###OpenStackPlatformSpec { #hypershift.openshift.io/v1beta1.OpenStackPlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>OpenStackPlatformSpec specifies configuration for clusters running on OpenStack.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>identityRef</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackIdentityReference">
OpenStackIdentityReference
</a>
</em>
</td>
<td>
<p>identityRef is a reference to a secret holding OpenStack credentials
to be used when reconciling the hosted cluster.</p>
</td>
</tr>
<tr>
<td>
<code>managedSubnets</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SubnetSpec">
[]SubnetSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>managedSubnets describe the OpenStack Subnet to be created. Cluster actuator will create a network,
and a subnet with the defined DNSNameservers, AllocationPools and the CIDR defined in the HostedCluster
MachineNetwork, and a router connected to the subnet. Currently only one IPv4
subnet is supported.</p>
</td>
</tr>
<tr>
<td>
<code>router</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.RouterParam">
RouterParam
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>router specifies an existing router to be used if ManagedSubnets are
specified. If specified, no new router will be created.</p>
</td>
</tr>
<tr>
<td>
<code>network</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NetworkParam">
NetworkParam
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>network specifies an existing network to use if no ManagedSubnets
are specified.</p>
</td>
</tr>
<tr>
<td>
<code>subnets</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SubnetParam">
[]SubnetParam
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>subnets specifies existing subnets to use if not ManagedSubnets are
specified. All subnets must be in the network specified by Network.
There can be zero, one, or two subnets. If no subnets are specified,
all subnets in Network will be used. If 2 subnets are specified, one
must be IPv4 and the other IPv6.</p>
</td>
</tr>
<tr>
<td>
<code>networkMTU</code></br>
<em>
int
</em>
</td>
<td>
<em>(Optional)</em>
<p>networkMTU is the MTU for the network.</p>
</td>
</tr>
<tr>
<td>
<code>externalNetwork</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NetworkParam">
NetworkParam
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>externalNetwork is the OpenStack Network to be used to get public internet to the VMs.
This option is ignored if DisableExternalNetwork is set to true.</p>
<p>If ExternalNetwork is defined it must refer to exactly one external network.</p>
<p>If ExternalNetwork is not defined or is empty the controller will use any
existing external network as long as there is only one. It is an
error if ExternalNetwork is not defined and there are multiple
external networks unless DisableExternalNetwork is also set.</p>
<p>If ExternalNetwork is not defined and there are no external networks
the controller will proceed as though DisableExternalNetwork was set.</p>
</td>
</tr>
<tr>
<td>
<code>disableExternalNetwork</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>disableExternalNetwork specifies whether or not to attempt to connect the cluster
to an external network. This allows for the creation of clusters when connecting
to an external network is not possible or desirable, e.g. if using a provider network.</p>
</td>
</tr>
<tr>
<td>
<code>tags</code></br>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>tags to set on all resources in cluster which support tags</p>
</td>
</tr>
<tr>
<td>
<code>ingressFloatingIP</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ingressFloatingIP is an available floating IP in your OpenStack cluster that will
be associated with the OpenShift ingress port.
When not specified, an IP address will be assigned randomly by the OpenStack cloud provider.
When specified, the floating IP has to be pre-created.  If the
specified value is not a floating IP or is already claimed, the
OpenStack cloud provider won&rsquo;t be able to provision the load
balancer.
This value must be a valid IPv4 or IPv6 address.</p>
</td>
</tr>
</tbody>
</table>
###OperatorConfiguration { #hypershift.openshift.io/v1beta1.OperatorConfiguration }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>OperatorConfiguration specifies configuration for individual OCP operators in the cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>clusterVersionOperator</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterVersionOperatorSpec">
ClusterVersionOperatorSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>clusterVersionOperator specifies the configuration for the Cluster Version Operator in the hosted cluster.</p>
</td>
</tr>
<tr>
<td>
<code>clusterNetworkOperator</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworkOperatorSpec">
ClusterNetworkOperatorSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>clusterNetworkOperator specifies the configuration for the Cluster Network Operator in the hosted cluster.</p>
</td>
</tr>
<tr>
<td>
<code>ingressOperator</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IngressOperatorSpec">
IngressOperatorSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ingressOperator specifies the configuration for the Ingress Operator in the hosted cluster.
This allows configuring how the default ingress controller endpoints are published.</p>
</td>
</tr>
</tbody>
</table>
###OptionalCapability { #hypershift.openshift.io/v1beta1.OptionalCapability }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.Capabilities">Capabilities</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;baremetal&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Console&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;ImageRegistry&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Ingress&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Insights&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;NodeTuning&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;openshift-samples&#34;</p></td>
<td></td>
</tr></tbody>
</table>
###PayloadArchType { #hypershift.openshift.io/v1beta1.PayloadArchType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterStatus">HostedClusterStatus</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;AMD64&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;ARM64&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Multi&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;PPC64LE&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;S390X&#34;</p></td>
<td></td>
</tr></tbody>
</table>
###PersistentVolumeAccessMode { #hypershift.openshift.io/v1beta1.PersistentVolumeAccessMode }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtPersistentVolume">KubevirtPersistentVolume</a>)
</p>
<p>
</p>
###PersistentVolumeEtcdStorageSpec { #hypershift.openshift.io/v1beta1.PersistentVolumeEtcdStorageSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ManagedEtcdStorageSpec">ManagedEtcdStorageSpec</a>)
</p>
<p>
<p>PersistentVolumeEtcdStorageSpec is the configuration for PersistentVolume
etcd storage.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>storageClassName</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>storageClassName is the StorageClass of the data volume for each etcd member.
See <a href="https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1">https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1</a>.
TODO(alberto): This shouldn&rsquo;t really be a pointer. There&rsquo;s no real different semantic for nil and empty string. Revisit all pointer vs non-pointer choices.</p>
</td>
</tr>
<tr>
<td>
<code>size</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#quantity-resource-api">
k8s.io/apimachinery/pkg/api/resource.Quantity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>size is the minimum size of the data volume for each etcd member.
Default is 8Gi.
This field is immutable</p>
</td>
</tr>
</tbody>
</table>
###PlacementOptions { #hypershift.openshift.io/v1beta1.PlacementOptions }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSNodePoolPlatform">AWSNodePoolPlatform</a>)
</p>
<p>
<p>PlacementOptions specifies the placement options for the EC2 instances.</p>
<p>The instance market type is determined by the marketType field:
- &ldquo;OnDemand&rdquo; (default): Standard on-demand instances
- &ldquo;Spot&rdquo;: Spot instances using spare EC2 capacity at reduced prices
- &ldquo;CapacityBlocks&rdquo;: Scheduled pre-purchased compute capacity for ML workloads</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>tenancy</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>tenancy indicates if instance should run on shared or single-tenant hardware.</p>
<p>Possible values:
- &ldquo;default&rdquo;: NodePool instances run on shared hardware.
- &ldquo;dedicated&rdquo;: Each NodePool instance runs on single-tenant hardware (Dedicated Instances).
- &ldquo;host&rdquo;: NodePool instances run on user&rsquo;s pre-allocated dedicated hosts (Dedicated Hosts).</p>
<p>When tenancy is set to &ldquo;host&rdquo;, capacityReservation cannot be specified
as AWS does not support Capacity Reservations with Dedicated Hosts.</p>
</td>
</tr>
<tr>
<td>
<code>marketType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.MarketType">
MarketType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>marketType specifies the EC2 instance purchasing model.
Supported values are &ldquo;OnDemand&rdquo; for standard on-demand instances,
&ldquo;Spot&rdquo; for spot instances that use spare EC2 capacity at reduced prices
but may be interrupted (optionally accepts spot options and requires
terminationHandlerQueueURL on the HostedCluster), and &ldquo;CapacityBlocks&rdquo; for scheduled pre-purchased
compute capacity recommended for GPU/ML workloads (requires
capacityReservation with a specific reservation ID).
When omitted, the default is &ldquo;OnDemand&rdquo;.</p>
</td>
</tr>
<tr>
<td>
<code>spot,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SpotOptions">
SpotOptions
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>spot configures optional Spot instance overrides.
When omitted, Spot instances use AWS defaults.</p>
<p>Spot instances use spare EC2 capacity at reduced prices but may be interrupted
with a 2-minute warning. Requires terminationHandlerQueueURL to be set on the
HostedCluster&rsquo;s AWS platform spec for graceful handling of interruptions.</p>
</td>
</tr>
<tr>
<td>
<code>capacityReservation</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.CapacityReservationOptions">
CapacityReservationOptions
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>capacityReservation specifies Capacity Reservation options for the NodePool instances.</p>
<p>Cannot be specified when tenancy is set to &ldquo;host&rdquo; as Dedicated Hosts
do not support Capacity Reservations. Compatible with &ldquo;default&rdquo; and &ldquo;dedicated&rdquo; tenancy.</p>
<p>Required when marketType is &ldquo;CapacityBlocks&rdquo;.</p>
</td>
</tr>
</tbody>
</table>
###PlatformSpec { #hypershift.openshift.io/v1beta1.PlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>PlatformSpec specifies the underlying infrastructure provider for the cluster
and is used to configure platform specific behavior.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PlatformType">
PlatformType
</a>
</em>
</td>
<td>
<p>type is the type of infrastructure provider for the cluster.</p>
</td>
</tr>
<tr>
<td>
<code>aws</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSPlatformSpec">
AWSPlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aws specifies configuration for clusters running on Amazon Web Services.</p>
</td>
</tr>
<tr>
<td>
<code>agent</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AgentPlatformSpec">
AgentPlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>agent specifies configuration for agent-based installations.</p>
</td>
</tr>
<tr>
<td>
<code>ibmcloud</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudPlatformSpec">
IBMCloudPlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ibmcloud defines IBMCloud specific settings for components</p>
</td>
</tr>
<tr>
<td>
<code>azure</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzurePlatformSpec">
AzurePlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>azure defines azure specific settings</p>
</td>
</tr>
<tr>
<td>
<code>powervs</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSPlatformSpec">
PowerVSPlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>powervs specifies configuration for clusters running on IBMCloud Power VS Service.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>kubevirt</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtPlatformSpec">
KubevirtPlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kubevirt defines KubeVirt specific settings for cluster components.</p>
</td>
</tr>
<tr>
<td>
<code>openstack</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackPlatformSpec">
OpenStackPlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>openstack specifies configuration for clusters running on OpenStack.</p>
</td>
</tr>
<tr>
<td>
<code>gcp</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.GCPPlatformSpec">
GCPPlatformSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>gcp specifies configuration for clusters running on Google Cloud Platform.</p>
</td>
</tr>
</tbody>
</table>
###PlatformStatus { #hypershift.openshift.io/v1beta1.PlatformStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterStatus">HostedClusterStatus</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneStatus">HostedControlPlaneStatus</a>)
</p>
<p>
<p>PlatformStatus contains platform-specific status</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>aws</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSPlatformStatus">
AWSPlatformStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aws contains platform-specific status for AWS</p>
</td>
</tr>
</tbody>
</table>
###PlatformType { #hypershift.openshift.io/v1beta1.PlatformType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KarpenterConfig">KarpenterConfig</a>, 
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>, 
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>PlatformType is a specific supported infrastructure provider.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;AWS&#34;</p></td>
<td><p>AWSPlatform represents Amazon Web Services infrastructure.</p>
</td>
</tr><tr><td><p>&#34;Agent&#34;</p></td>
<td><p>AgentPlatform represents user supplied insfrastructure booted with agents.</p>
</td>
</tr><tr><td><p>&#34;Azure&#34;</p></td>
<td><p>AzurePlatform represents Azure infrastructure.</p>
</td>
</tr><tr><td><p>&#34;GCP&#34;</p></td>
<td><p>GCPPlatform represents Google Cloud Platform infrastructure.</p>
</td>
</tr><tr><td><p>&#34;IBMCloud&#34;</p></td>
<td><p>IBMCloudPlatform represents IBM Cloud infrastructure.</p>
</td>
</tr><tr><td><p>&#34;KubeVirt&#34;</p></td>
<td><p>KubevirtPlatform represents Kubevirt infrastructure.</p>
</td>
</tr><tr><td><p>&#34;None&#34;</p></td>
<td><p>NonePlatform represents user supplied (e.g. bare metal) infrastructure.</p>
</td>
</tr><tr><td><p>&#34;OpenStack&#34;</p></td>
<td><p>OpenStackPlatform represents OpenStack infrastructure.</p>
</td>
</tr><tr><td><p>&#34;PowerVS&#34;</p></td>
<td><p>PowerVSPlatform represents PowerVS infrastructure.</p>
</td>
</tr></tbody>
</table>
###PortSecurityPolicy { #hypershift.openshift.io/v1beta1.PortSecurityPolicy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PortSpec">PortSpec</a>)
</p>
<p>
<p>PortSecurityPolicy defines whether or not to enable port security on a port.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;&#34;</p></td>
<td><p>PortSecurityDefault uses the default port security policy.</p>
</td>
</tr><tr><td><p>&#34;Disabled&#34;</p></td>
<td><p>PortSecurityDisabled disables port security on a port.</p>
</td>
</tr><tr><td><p>&#34;Enabled&#34;</p></td>
<td><p>PortSecurityEnabled enables port security on a port.</p>
</td>
</tr></tbody>
</table>
###PortSpec { #hypershift.openshift.io/v1beta1.PortSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackNodePoolPlatform">OpenStackNodePoolPlatform</a>)
</p>
<p>
<p>PortSpec specifies the options for creating a port.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>network</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NetworkParam">
NetworkParam
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>network is a query for an openstack network that the port will be created or discovered on.
This will fail if the query returns more than one network.</p>
</td>
</tr>
<tr>
<td>
<code>description</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>description is a human-readable description for the port.</p>
</td>
</tr>
<tr>
<td>
<code>allowedAddressPairs</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AddressPair">
[]AddressPair
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>allowedAddressPairs is a list of address pairs which Neutron will
allow the port to send traffic from in addition to the port&rsquo;s
addresses. If not specified, the MAC Address will be the MAC Address
of the port. Depending on the configuration of Neutron, it may be
supported to specify a CIDR instead of a specific IP address.</p>
</td>
</tr>
<tr>
<td>
<code>vnicType</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>vnicType specifies the type of vNIC which this port should be
attached to. This is used to determine which mechanism driver(s) to
be used to bind the port. The valid values are normal, macvtap,
direct, baremetal, direct-physical, virtio-forwarder, smart-nic and
remote-managed, although these values will not be validated in this
API to ensure compatibility with future neutron changes or custom
implementations. What type of vNIC is actually available depends on
deployments. If not specified, the Neutron default value is used.</p>
</td>
</tr>
<tr>
<td>
<code>portSecurityPolicy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PortSecurityPolicy">
PortSecurityPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>portSecurityPolicy specifies whether or not to enable port security on the port.
Allowed values are &ldquo;Enabled&rdquo;, &ldquo;Disabled&rdquo; and omitted.
When not set, it takes the value of the corresponding field at the network level.</p>
</td>
</tr>
</tbody>
</table>
###PowerVSNodePoolImageDeletePolicy { #hypershift.openshift.io/v1beta1.PowerVSNodePoolImageDeletePolicy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSNodePoolPlatform">PowerVSNodePoolPlatform</a>)
</p>
<p>
<p>PowerVSNodePoolImageDeletePolicy defines image delete policy to be used for PowerVSNodePoolPlatform</p>
</p>
###PowerVSNodePoolPlatform { #hypershift.openshift.io/v1beta1.PowerVSNodePoolPlatform }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolPlatform">NodePoolPlatform</a>)
</p>
<p>
<p>PowerVSNodePoolPlatform specifies the configuration of a NodePool when operating
on IBMCloud PowerVS platform.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>systemType</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>systemType is the System type used to host the instance.
systemType determines the number of cores and memory that is available.
Few of the supported SystemTypes are s922,e880,e980.
e880 systemType available only in Dallas Datacenters.
e980 systemType available in Datacenters except Dallas and Washington.
When omitted, this means that the user has no opinion and the platform is left to choose a
reasonable default. The current default is s922 which is generally available.</p>
</td>
</tr>
<tr>
<td>
<code>processorType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSNodePoolProcType">
PowerVSNodePoolProcType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>processorType is the VM instance processor type.
It must be set to one of the following values: Dedicated, Capped or Shared.</p>
<p>Dedicated: resources are allocated for a specific client, The hypervisor makes a 1:1 binding of a partition&rsquo;s processor to a physical processor core.
Shared: Shared among other clients.
Capped: Shared, but resources do not expand beyond those that are requested, the amount of CPU time is Capped to the value specified for the entitlement.</p>
<p>if the processorType is selected as Dedicated, then Processors value cannot be fractional.
When omitted, this means that the user has no opinion and the platform is left to choose a
reasonable default. The current default is shared.</p>
</td>
</tr>
<tr>
<td>
<code>processors</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#intorstring-intstr-util">
k8s.io/apimachinery/pkg/util/intstr.IntOrString
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>processors is the number of virtual processors in a virtual machine.
when the processorType is selected as Dedicated the processors value cannot be fractional.
maximum value for the Processors depends on the selected SystemType.
when SystemType is set to e880 or e980 maximum Processors value is 143.
when SystemType is set to s922 maximum Processors value is 15.
minimum value for Processors depends on the selected ProcessorType.
when ProcessorType is set as Shared or Capped, The minimum processors is 0.5.
when ProcessorType is set as Dedicated, The minimum processors is 1.
When omitted, this means that the user has no opinion and the platform is left to choose a
reasonable default. The default is set based on the selected ProcessorType.
when ProcessorType selected as Dedicated, the default is set to 1.
when ProcessorType selected as Shared or Capped, the default is set to 0.5.</p>
</td>
</tr>
<tr>
<td>
<code>memoryGiB</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>memoryGiB is the size of a virtual machine&rsquo;s memory, in GiB.
maximum value for the MemoryGiB depends on the selected SystemType.
when SystemType is set to e880 maximum MemoryGiB value is 7463 GiB.
when SystemType is set to e980 maximum MemoryGiB value is 15307 GiB.
when SystemType is set to s922 maximum MemoryGiB value is 942 GiB.
The minimum memory is 32 GiB.</p>
<p>When omitted, this means the user has no opinion and the platform is left to choose a reasonable
default. The current default is 32.</p>
</td>
</tr>
<tr>
<td>
<code>image</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSResourceReference">
PowerVSResourceReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>image used for deploying the nodes. If unspecified, the default
is chosen based on the NodePool release payload image.</p>
</td>
</tr>
<tr>
<td>
<code>storageType</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSNodePoolStorageType">
PowerVSNodePoolStorageType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>storageType for the image and nodes, this will be ignored if Image is specified.
The storage tiers in PowerVS are based on I/O operations per second (IOPS).
It means that the performance of your storage volumes is limited to the maximum number of IOPS based on volume size and storage tier.
Although, the exact numbers might change over time, the Tier 3 storage is currently set to 3 IOPS/GB, and the Tier 1 storage is currently set to 10 IOPS/GB.</p>
<p>The default is tier1</p>
</td>
</tr>
<tr>
<td>
<code>imageDeletePolicy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSNodePoolImageDeletePolicy">
PowerVSNodePoolImageDeletePolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>imageDeletePolicy is policy for the image deletion.</p>
<p>delete: delete the image from the infrastructure.
retain: delete the image from the openshift but retain in the infrastructure.</p>
<p>The default is delete</p>
</td>
</tr>
</tbody>
</table>
###PowerVSNodePoolProcType { #hypershift.openshift.io/v1beta1.PowerVSNodePoolProcType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSNodePoolPlatform">PowerVSNodePoolPlatform</a>)
</p>
<p>
<p>PowerVSNodePoolProcType defines processor type to be used for PowerVSNodePoolPlatform</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;capped&#34;</p></td>
<td><p>PowerVSNodePoolCappedProcType defines capped processor type</p>
</td>
</tr><tr><td><p>&#34;dedicated&#34;</p></td>
<td><p>PowerVSNodePoolDedicatedProcType defines dedicated processor type</p>
</td>
</tr><tr><td><p>&#34;shared&#34;</p></td>
<td><p>PowerVSNodePoolSharedProcType defines shared processor type</p>
</td>
</tr></tbody>
</table>
###PowerVSNodePoolStorageType { #hypershift.openshift.io/v1beta1.PowerVSNodePoolStorageType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSNodePoolPlatform">PowerVSNodePoolPlatform</a>)
</p>
<p>
<p>PowerVSNodePoolStorageType defines storage type to be used for PowerVSNodePoolPlatform</p>
</p>
###PowerVSPlatformSpec { #hypershift.openshift.io/v1beta1.PowerVSPlatformSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlatformSpec">PlatformSpec</a>)
</p>
<p>
<p>PowerVSPlatformSpec defines IBMCloud PowerVS specific settings for components</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>accountID</code></br>
<em>
string
</em>
</td>
<td>
<p>accountID is the IBMCloud account id.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>cisInstanceCRN</code></br>
<em>
string
</em>
</td>
<td>
<p>cisInstanceCRN is the IBMCloud CIS Service Instance&rsquo;s Cloud Resource Name
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>resourceGroup</code></br>
<em>
string
</em>
</td>
<td>
<p>resourceGroup is the IBMCloud Resource Group in which the cluster resides.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>region</code></br>
<em>
string
</em>
</td>
<td>
<p>region is the IBMCloud region in which the cluster resides. This configures the
OCP control plane cloud integrations, and is used by NodePool to resolve
the correct boot image for a given release.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>zone</code></br>
<em>
string
</em>
</td>
<td>
<p>zone is the availability zone where control plane cloud resources are
created.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>subnet</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSResourceReference">
PowerVSResourceReference
</a>
</em>
</td>
<td>
<p>subnet is the subnet to use for control plane cloud resources.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>serviceInstanceID</code></br>
<em>
string
</em>
</td>
<td>
<p>serviceInstanceID is the reference to the Power VS service on which the server instance(VM) will be created.
Power VS service is a container for all Power VS instances at a specific geographic region.
serviceInstance can be created via IBM Cloud catalog or CLI.
ServiceInstanceID is the unique identifier that can be obtained from IBM Cloud UI or IBM Cloud cli.</p>
<p>More detail about Power VS service instance.
<a href="https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server">https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server</a></p>
<p>This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>vpc</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSVPC">
PowerVSVPC
</a>
</em>
</td>
<td>
<p>vpc specifies IBM Cloud PowerVS Load Balancing configuration for the control
plane.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>kubeCloudControllerCreds</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>kubeCloudControllerCreds is a reference to a secret containing cloud
credentials with permissions matching the cloud controller policy.
This field is immutable. Once set, it cannot be changed.</p>
<p>The secret must contain the key <code>ibmcloud_api_key</code> whose value is
an IBM Cloud API key with the following IAM policies:</p>
<ol>
<li><p>Resource Group: Viewer role</p>
<ul>
<li>Attribute: resourceType=resource-group</li>
<li>Role: crn:v1:bluemix:public:iam::::role:Viewer</li>
</ul></li>
<li><p>VPC Infrastructure Services: Editor, Operator, and Viewer roles</p>
<ul>
<li>Attribute: serviceName=is</li>
<li>Roles: crn:v1:bluemix:public:iam::::role:Editor,
crn:v1:bluemix:public:iam::::role:Operator,
crn:v1:bluemix:public:iam::::role:Viewer</li>
</ul></li>
<li><p>Power Virtual Server (PowerVS): Viewer role, Reader and Manager service roles
(scoped to the PowerVS service instance identified by <code>serviceInstanceID</code>)</p>
<ul>
<li>Attributes: serviceName=power-iaas,
serviceInstance={serviceInstanceID}</li>
<li>Roles: crn:v1:bluemix:public:iam::::role:Viewer,
crn:v1:bluemix:public:iam::::serviceRole:Reader,
crn:v1:bluemix:public:iam::::serviceRole:Manager</li>
</ul></li>
</ol>
</td>
</tr>
<tr>
<td>
<code>nodePoolManagementCreds</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>nodePoolManagementCreds is a reference to a secret containing cloud
credentials with permissions matching the node pool management policy.
This field is immutable. Once set, it cannot be changed.</p>
<p>The secret must contain the key <code>ibmcloud_api_key</code> whose value is
an IBM Cloud API key with the following IAM policies:</p>
<ol>
<li>Power Virtual Server (PowerVS): Manager service role and Editor role
(scoped to the PowerVS service instance identified by <code>serviceInstanceID</code>)
<ul>
<li>Attributes: serviceName=power-iaas,
serviceInstance={serviceInstanceID}</li>
<li>Roles: crn:v1:bluemix:public:iam::::serviceRole:Manager,
crn:v1:bluemix:public:iam::::role:Editor</li>
</ul></li>
</ol>
</td>
</tr>
<tr>
<td>
<code>ingressOperatorCloudCreds</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>ingressOperatorCloudCreds is a reference to a secret containing IBM Cloud
credentials for the ingress operator to get authenticated with IBM Cloud.
This field is immutable. Once set, it cannot be changed.</p>
<p>The secret must contain the key <code>ibmcloud_api_key</code> whose value is
an IBM Cloud API key with the following IAM policies:</p>
<ol>
<li>Internet Services (CIS): Manager service role and Editor role
<ul>
<li>Attribute: serviceName=internet-svcs</li>
<li>Roles: crn:v1:bluemix:public:iam::::serviceRole:Manager,
crn:v1:bluemix:public:iam::::role:Editor</li>
</ul></li>
</ol>
</td>
</tr>
<tr>
<td>
<code>storageOperatorCloudCreds</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>storageOperatorCloudCreds is a reference to a secret containing IBM Cloud
credentials for the storage operator to get authenticated with IBM Cloud.
This field is immutable. Once set, it cannot be changed.</p>
<p>The secret must contain the key <code>ibmcloud_api_key</code> whose value is
an IBM Cloud API key with the following IAM policies:</p>
<ol>
<li><p>Power Virtual Server (PowerVS): Manager service role and Editor role
(scoped to the PowerVS service instance identified by <code>serviceInstanceID</code>)</p>
<ul>
<li>Attributes: serviceName=power-iaas,
serviceInstance={serviceInstanceID}</li>
<li>Roles: crn:v1:bluemix:public:iam::::serviceRole:Manager,
crn:v1:bluemix:public:iam::::role:Editor</li>
</ul></li>
<li><p>Resource Group: Viewer role</p>
<ul>
<li>Attribute: resourceType=resource-group</li>
<li>Role: crn:v1:bluemix:public:iam::::role:Viewer</li>
</ul></li>
</ol>
</td>
</tr>
<tr>
<td>
<code>imageRegistryOperatorCloudCreds</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>imageRegistryOperatorCloudCreds is a reference to a secret containing IBM Cloud
credentials for the image registry operator to get authenticated with IBM Cloud.
This field is immutable. Once set, it cannot be changed.</p>
<p>The secret must contain the key <code>ibmcloud_api_key</code> whose value is
an IBM Cloud API key with the following IAM policies:</p>
<ol>
<li><p>Cloud Object Storage: Administrator (platform) and Manager (service) roles</p>
<ul>
<li>Attribute: serviceName=cloud-object-storage</li>
<li>Roles: crn:v1:bluemix:public:iam::::role:Administrator,
crn:v1:bluemix:public:iam::::serviceRole:Manager</li>
</ul></li>
<li><p>Resource Group: Viewer role</p>
<ul>
<li>Attribute: resourceType=resource-group</li>
<li>Role: crn:v1:bluemix:public:iam::::role:Viewer</li>
</ul></li>
</ol>
</td>
</tr>
</tbody>
</table>
###PowerVSResourceReference { #hypershift.openshift.io/v1beta1.PowerVSResourceReference }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSNodePoolPlatform">PowerVSNodePoolPlatform</a>, 
<a href="#hypershift.openshift.io/v1beta1.PowerVSPlatformSpec">PowerVSPlatformSpec</a>)
</p>
<p>
<p>PowerVSResourceReference is a reference to a specific IBMCloud PowerVS resource by ID, or Name.
Only one of ID, or Name may be specified. Specifying more than one will result in
a validation error.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>id</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>id of resource</p>
</td>
</tr>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>name of resource</p>
</td>
</tr>
</tbody>
</table>
###PowerVSVPC { #hypershift.openshift.io/v1beta1.PowerVSVPC }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PowerVSPlatformSpec">PowerVSPlatformSpec</a>)
</p>
<p>
<p>PowerVSVPC specifies IBM Cloud PowerVS LoadBalancer configuration for the control
plane.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name for VPC to used for all the service load balancer.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>region</code></br>
<em>
string
</em>
</td>
<td>
<p>region is the IBMCloud region in which VPC gets created, this VPC used for all the ingress traffic
into the OCP cluster.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>zone</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>zone is the availability zone where load balancer cloud resources are
created.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
<tr>
<td>
<code>subnet</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>subnet is the subnet to use for load balancer.
This field is immutable. Once set, it cannot be changed.</p>
</td>
</tr>
</tbody>
</table>
###Provisioner { #hypershift.openshift.io/v1beta1.Provisioner }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ProvisionerConfig">ProvisionerConfig</a>)
</p>
<p>
<p>Provisioner is the name of a supported node provisioner.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Karpenter&#34;</p></td>
<td><p>ProvisionerKarpenter indicates that Karpenter is used for automatic node provisioning.</p>
</td>
</tr></tbody>
</table>
###ProvisionerConfig { #hypershift.openshift.io/v1beta1.ProvisionerConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AutoNode">AutoNode</a>)
</p>
<p>
<p>ProvisionerConfig specifies the provisioner used for automatic node management
and its associated configuration.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.Provisioner">
Provisioner
</a>
</em>
</td>
<td>
<p>name specifies the name of the provisioner to use for automatic node management.</p>
</td>
</tr>
<tr>
<td>
<code>karpenter,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KarpenterConfig">
KarpenterConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>karpenter specifies the configuration for the Karpenter provisioner.</p>
</td>
</tr>
</tbody>
</table>
###PublishingStrategyType { #hypershift.openshift.io/v1beta1.PublishingStrategyType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategy">ServicePublishingStrategy</a>)
</p>
<p>
<p>PublishingStrategyType defines publishing strategies for services.</p>
</p>
###QoSClass { #hypershift.openshift.io/v1beta1.QoSClass }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.KubevirtCompute">KubevirtCompute</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Burstable&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Guaranteed&#34;</p></td>
<td></td>
</tr></tbody>
</table>
###Release { #hypershift.openshift.io/v1beta1.Release }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.NodePoolSpec">NodePoolSpec</a>)
</p>
<p>
<p>Release represents the metadata for an OCP release payload image.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>image</code></br>
<em>
string
</em>
</td>
<td>
<p>image is the image pullspec of an OCP release payload image.
See <a href="https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags">https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags</a> for a list of available images.</p>
</td>
</tr>
</tbody>
</table>
###ReplaceUpgrade { #hypershift.openshift.io/v1beta1.ReplaceUpgrade }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolManagement">NodePoolManagement</a>)
</p>
<p>
<p>ReplaceUpgrade specifies upgrade behavior that replaces existing nodes
according to a given strategy.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>strategy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.UpgradeStrategy">
UpgradeStrategy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>strategy is the node replacement strategy for nodes in the pool.
In can be either &ldquo;RollingUpdate&rdquo; or &ldquo;OnDelete&rdquo;. RollingUpdate will rollout Nodes honoring maxSurge and maxUnavailable.
OnDelete provide more granular control and will replace nodes as the old ones are manually deleted.</p>
</td>
</tr>
<tr>
<td>
<code>rollingUpdate</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.RollingUpdate">
RollingUpdate
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>rollingUpdate specifies a rolling update strategy which upgrades nodes by
creating new nodes and deleting the old ones.</p>
</td>
</tr>
</tbody>
</table>
###RetentionPolicy { #hypershift.openshift.io/v1beta1.RetentionPolicy }
<p>
<p>RetentionPolicy defines the policy for handling resources associated with a cluster when the cluster is deleted.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;Orphan&#34;</p></td>
<td><p>OrphanRetentionPolicy will keep the resources associated with the cluster
when the cluster is deleted.</p>
</td>
</tr><tr><td><p>&#34;Prune&#34;</p></td>
<td><p>PruneRetentionPolicy will delete the resources associated with the cluster
when the cluster is deleted.</p>
</td>
</tr></tbody>
</table>
###RollingUpdate { #hypershift.openshift.io/v1beta1.RollingUpdate }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ReplaceUpgrade">ReplaceUpgrade</a>)
</p>
<p>
<p>RollingUpdate specifies a rolling update strategy which upgrades nodes by
creating new nodes and deleting the old ones.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>maxUnavailable</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#intorstring-intstr-util">
k8s.io/apimachinery/pkg/util/intstr.IntOrString
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>maxUnavailable is the maximum number of nodes that can be unavailable
during the update.</p>
<p>Value can be an absolute number (ex: 5) or a percentage of desired nodes
(ex: 10%).</p>
<p>Absolute number is calculated from percentage by rounding down.</p>
<p>This can not be 0 if MaxSurge is 0.</p>
<p>Defaults to 0.</p>
<p>Example: when this is set to 30%, old nodes can be deleted down to 70% of
desired nodes immediately when the rolling update starts. Once new nodes
are ready, more old nodes be deleted, followed by provisioning new nodes,
ensuring that the total number of nodes available at all times during the
update is at least 70% of desired nodes.</p>
</td>
</tr>
<tr>
<td>
<code>maxSurge</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#intorstring-intstr-util">
k8s.io/apimachinery/pkg/util/intstr.IntOrString
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>maxSurge is the maximum number of nodes that can be provisioned above the
desired number of nodes.</p>
<p>Value can be an absolute number (ex: 5) or a percentage of desired nodes
(ex: 10%).</p>
<p>Absolute number is calculated from percentage by rounding up.</p>
<p>This can not be 0 if MaxUnavailable is 0.</p>
<p>Defaults to 1.</p>
<p>Example: when this is set to 30%, new nodes can be provisioned immediately
when the rolling update starts, such that the total number of old and new
nodes do not exceed 130% of desired nodes. Once old nodes have been
deleted, new nodes can be provisioned, ensuring that total number of nodes
running at any time during the update is at most 130% of desired nodes.</p>
</td>
</tr>
</tbody>
</table>
###RoutePublishingStrategy { #hypershift.openshift.io/v1beta1.RoutePublishingStrategy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategy">ServicePublishingStrategy</a>)
</p>
<p>
<p>RoutePublishingStrategy specifies options for exposing a service as a Route.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>hostname</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>hostname is the name of the DNS record that will be created pointing to the Route and passed through to consumers of the service.
If omitted, the value will be inferred from management ingress.Spec.Domain.</p>
</td>
</tr>
</tbody>
</table>
###RouterFilter { #hypershift.openshift.io/v1beta1.RouterFilter }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.RouterParam">RouterParam</a>)
</p>
<p>
<p>RouterFilter specifies a query to select an OpenStack router. At least one property must be set.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>name is the name of the router to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>description</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>description is the description of the router to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>projectID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>projectID is the project ID of the router to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>FilterByNeutronTags</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.FilterByNeutronTags">
FilterByNeutronTags
</a>
</em>
</td>
<td>
<p>
(Members of <code>FilterByNeutronTags</code> are embedded into this type.)
</p>
<em>(Optional)</em>
<p>FilterByNeutronTags specifies tags to filter by.</p>
</td>
</tr>
</tbody>
</table>
###RouterParam { #hypershift.openshift.io/v1beta1.RouterParam }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackPlatformSpec">OpenStackPlatformSpec</a>)
</p>
<p>
<p>RouterParam specifies an OpenStack router to use. It may be specified by either ID or filter, but not both.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>id</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>id is the ID of the router to use. If ID is provided, the other filters cannot be provided. Must be in UUID format.</p>
</td>
</tr>
<tr>
<td>
<code>filter</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.RouterFilter">
RouterFilter
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>filter specifies a filter to select an OpenStack router. If provided, cannot be empty.</p>
</td>
</tr>
</tbody>
</table>
###ScaleDownConfig { #hypershift.openshift.io/v1beta1.ScaleDownConfig }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterAutoscaling">ClusterAutoscaling</a>)
</p>
<p>
<p>Configures when and how to scale down cluster nodes.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>delayAfterAddSeconds</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>delayAfterAddSeconds sets how long after scale up the scale down evaluation resumes in seconds.
It must be between 0 and 86400 (24 hours).
When set to 0, this means scale down evaluation will resume immediately after scale up, without any delay.
When omitted, the autoscaler defaults to 600s (10 minutes).</p>
</td>
</tr>
<tr>
<td>
<code>delayAfterDeleteSeconds</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>delayAfterDeleteSeconds sets how long after node deletion, scale down evaluation resumes, defaults to scan-interval.
It must be between 0 and 86400 (24 hours).
When set to 0, this means scale down evaluation will resume immediately after node deletion, without any delay.
When omitted, the autoscaler defaults to 0s.</p>
</td>
</tr>
<tr>
<td>
<code>delayAfterFailureSeconds</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>delayAfterFailureSeconds sets how long after a scale down failure, scale down evaluation resumes.
It must be between 0 and 86400 (24 hours).
When set to 0, this means scale down evaluation will resume immediately after a scale down failure, without any delay.
When omitted, the autoscaler defaults to 180s (3 minutes).</p>
</td>
</tr>
<tr>
<td>
<code>unneededDurationSeconds</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>unneededDurationSeconds establishes how long a node should be unneeded before it is eligible for scale down in seconds.
It must be between 0 and 86400 (24 hours).
When omitted, the autoscaler defaults to 600s (10 minutes).</p>
</td>
</tr>
<tr>
<td>
<code>utilizationThresholdPercent</code></br>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>utilizationThresholdPercent determines the node utilization level, defined as sum of requested resources divided by capacity, below which a node can be considered for scale down.
The value represents a percentage from 0 to 100.
When set to 0, this means nodes will only be considered for scale down if they are completely idle (0% utilization).
When set to 100, this means nodes will be considered for scale down regardless of their utilization level.
A value between 0 and 100 represents the utilization threshold below which a node can be considered for scale down.
When omitted, the autoscaler defaults to 50%.</p>
</td>
</tr>
</tbody>
</table>
###ScalingType { #hypershift.openshift.io/v1beta1.ScalingType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterAutoscaling">ClusterAutoscaling</a>)
</p>
<p>
<p>ScalingType defines the scaling behavior for the cluster autoscaler.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;ScaleUpAndScaleDown&#34;</p></td>
<td><p>ScaleUpAndScaleDown means the autoscaler will both scale up and scale down nodes.</p>
</td>
</tr><tr><td><p>&#34;ScaleUpOnly&#34;</p></td>
<td><p>ScaleUpOnly means the autoscaler will only scale up nodes, never scale down.</p>
</td>
</tr></tbody>
</table>
###SecretEncryptionKeyStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionStatus">SecretEncryptionStatus</a>)
</p>
<p>
<p>SecretEncryptionKeyStatus records the active key identity using the same types as the spec.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>provider</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionProvider">
SecretEncryptionProvider
</a>
</em>
</td>
<td>
<p>provider identifies the encryption provider.</p>
</td>
</tr>
<tr>
<td>
<code>azure,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureKMSKey">
AzureKMSKey
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>azure holds the Azure KMS key identity fields.</p>
</td>
</tr>
<tr>
<td>
<code>aws,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AWSKMSKeyEntry">
AWSKMSKeyEntry
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aws holds the AWS KMS key identity fields.</p>
</td>
</tr>
<tr>
<td>
<code>ibmCloud,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.IBMCloudKMSKeyEntry">
IBMCloudKMSKeyEntry
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ibmCloud holds the IBM Cloud KMS key identity fields.</p>
</td>
</tr>
<tr>
<td>
<code>aescbc,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AESCBCKeyStatus">
AESCBCKeyStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aescbc holds a reference to the AESCBC key secret.</p>
</td>
</tr>
</tbody>
</table>
###SecretEncryptionProvider { #hypershift.openshift.io/v1beta1.SecretEncryptionProvider }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.EncryptionKeyReference">EncryptionKeyReference</a>, 
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus">SecretEncryptionKeyStatus</a>)
</p>
<p>
<p>SecretEncryptionProvider identifies the encryption provider recorded in status.
This is a separate type from KMSProvider because the KMSProvider enum does not include AESCBC.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;AESCBC&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;AWS&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;Azure&#34;</p></td>
<td></td>
</tr><tr><td><p>&#34;IBMCloud&#34;</p></td>
<td></td>
</tr></tbody>
</table>
###SecretEncryptionSpec { #hypershift.openshift.io/v1beta1.SecretEncryptionSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>SecretEncryptionSpec contains metadata about the kubernetes secret encryption strategy being used for the
cluster when applicable.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionType">
SecretEncryptionType
</a>
</em>
</td>
<td>
<p>type defines the type of kube secret encryption being used</p>
</td>
</tr>
<tr>
<td>
<code>kms</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.KMSSpec">
KMSSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>kms defines metadata about the kms secret encryption strategy</p>
</td>
</tr>
<tr>
<td>
<code>aescbc</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AESCBCSpec">
AESCBCSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>aescbc defines metadata about the AESCBC secret encryption strategy</p>
</td>
</tr>
</tbody>
</table>
###SecretEncryptionStatus { #hypershift.openshift.io/v1beta1.SecretEncryptionStatus }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterStatus">HostedClusterStatus</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneStatus">HostedControlPlaneStatus</a>)
</p>
<p>
<p>SecretEncryptionStatus tracks the state of secret encryption key rotation and re-encryption.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>activeKey,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus">
SecretEncryptionKeyStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>activeKey is the encryption key specification that all etcd data is confirmed encrypted with.
Updated after successful re-encryption.</p>
</td>
</tr>
<tr>
<td>
<code>targetKey,omitzero</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionKeyStatus">
SecretEncryptionKeyStatus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>targetKey is the key being rolled out during an active rotation. Snapshot from
spec.secretEncryption&rsquo;s active key when the rotation starts. The CPO uses this
(not the current spec) during the rotation, so mid-rotation spec changes are
safely queued until the current rotation completes. Cleared when rotation completes.</p>
</td>
</tr>
<tr>
<td>
<code>history</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EncryptionMigrationHistory">
[]EncryptionMigrationHistory
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>history contains a list of key rotations applied to this cluster. The newest
entry is first in the list. Entries have state Completed when re-encryption
has finished. The current rotation phase is always history[0].state when
history[0] is not Completed or Interrupted.</p>
</td>
</tr>
</tbody>
</table>
###SecretEncryptionType { #hypershift.openshift.io/v1beta1.SecretEncryptionType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.SecretEncryptionSpec">SecretEncryptionSpec</a>)
</p>
<p>
<p>SecretEncryptionType defines the type of kube secret encryption being used.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;aescbc&#34;</p></td>
<td><p>AESCBC uses AES-CBC with PKCS#7 padding to do secret encryption</p>
</td>
</tr><tr><td><p>&#34;kms&#34;</p></td>
<td><p>KMS integrates with a cloud provider&rsquo;s key management service to do secret encryption</p>
</td>
</tr></tbody>
</table>
###SecretReference { #hypershift.openshift.io/v1beta1.SecretReference }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AESCBCKeyStatus">AESCBCKeyStatus</a>, 
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupAzureBlob">HCPEtcdBackupAzureBlob</a>, 
<a href="#hypershift.openshift.io/v1beta1.HCPEtcdBackupS3">HCPEtcdBackupS3</a>)
</p>
<p>
<p>SecretReference contains a reference to a Secret by name.
The Secret must exist in the same namespace as the referencing resource.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is the name of the Secret. It must be a valid DNS-1123 subdomain: at most
253 characters, consisting of lowercase alphanumeric characters, hyphens, and periods.
Each period-separated segment must start and end with an alphanumeric character.</p>
</td>
</tr>
</tbody>
</table>
###ServiceNetworkEntry { #hypershift.openshift.io/v1beta1.ServiceNetworkEntry }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ClusterNetworking">ClusterNetworking</a>)
</p>
<p>
<p>ServiceNetworkEntry is a single IP address block for the service network.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>cidr</code></br>
<em>
<a href="#">
github.com/openshift/hypershift/api/util/ipnet.IPNet
</a>
</em>
</td>
<td>
<p>cidr is the IP block address pool for services within the cluster in CIDR format (e.g., 192.168.1.0/24 or 2001:0db8::/64)</p>
</td>
</tr>
</tbody>
</table>
###ServicePublishingStrategy { #hypershift.openshift.io/v1beta1.ServicePublishingStrategy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategyMapping">ServicePublishingStrategyMapping</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.PublishingStrategyType">
PublishingStrategyType
</a>
</em>
</td>
<td>
<p>type is the publishing strategy used for the service.
It can be LoadBalancer;NodePort;Route;None;S3</p>
</td>
</tr>
<tr>
<td>
<code>nodePort</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.NodePortPublishingStrategy">
NodePortPublishingStrategy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>nodePort configures exposing a service using a NodePort.</p>
</td>
</tr>
<tr>
<td>
<code>loadBalancer</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.LoadBalancerPublishingStrategy">
LoadBalancerPublishingStrategy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>loadBalancer configures exposing a service using a dedicated LoadBalancer.</p>
</td>
</tr>
<tr>
<td>
<code>route</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.RoutePublishingStrategy">
RoutePublishingStrategy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>route configures exposing a service using a Route through and an ingress controller behind a cloud Load Balancer.
The specifics of the setup are platform dependent.</p>
</td>
</tr>
</tbody>
</table>
###ServicePublishingStrategyMapping { #hypershift.openshift.io/v1beta1.ServicePublishingStrategyMapping }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.HostedClusterSpec">HostedClusterSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.HostedControlPlaneSpec">HostedControlPlaneSpec</a>)
</p>
<p>
<p>ServicePublishingStrategyMapping specifies how individual control plane services endpoints are published for consumption.
This includes APIServer;OAuthServer;Konnectivity;Ignition.
If a given service is not present in this list, it will be exposed publicly by default.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>service</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ServiceType">
ServiceType
</a>
</em>
</td>
<td>
<p>service identifies the type of service being published.
It can be APIServer;OAuthServer;Konnectivity;Ignition
OVNSbDb;OIDC are no-op and kept for backward compatibility.
This field is immutable.</p>
</td>
</tr>
<tr>
<td>
<code>servicePublishingStrategy</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategy">
ServicePublishingStrategy
</a>
</em>
</td>
<td>
<p>servicePublishingStrategy specifies how to publish a service endpoint.</p>
</td>
</tr>
</tbody>
</table>
###ServiceType { #hypershift.openshift.io/v1beta1.ServiceType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ServicePublishingStrategyMapping">ServicePublishingStrategyMapping</a>)
</p>
<p>
<p>ServiceType defines what control plane services can be exposed from the
management control plane.</p>
</p>
###SpotOptions { #hypershift.openshift.io/v1beta1.SpotOptions }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.PlacementOptions">PlacementOptions</a>)
</p>
<p>
<p>SpotOptions configures options for Spot instances.</p>
<p>Spot instances use spare EC2 capacity at reduced prices but may be interrupted
with a 2-minute warning when EC2 needs the capacity back.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>maxPrice</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>maxPrice defines the maximum price the user is willing to pay for Spot instances.
If not specified, the on-demand price is used as the maximum (you pay the actual spot price).
The value should be a decimal number representing the price per hour in USD.
For example, &ldquo;0.50&rdquo; means 50 cents per hour.</p>
<p>Note: AWS recommends NOT setting maxPrice to reduce interruption frequency.
When omitted, you pay the current Spot price (capped at On-Demand price).
AWS minimum allowed value is $0.001.</p>
</td>
</tr>
</tbody>
</table>
###SubnetFilter { #hypershift.openshift.io/v1beta1.SubnetFilter }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.SubnetParam">SubnetParam</a>)
</p>
<p>
<p>SubnetFilter specifies a filter to select a subnet. At least one parameter must be specified.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>name is the name of the subnet to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>description</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>description is the description of the subnet to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>projectID</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>projectID is the project ID of the subnet to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>ipVersion</code></br>
<em>
int
</em>
</td>
<td>
<em>(Optional)</em>
<p>ipVersion is the IP version of the subnet to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>gatewayIP</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>gatewayIP is the gateway IP of the subnet to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>cidr</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>cidr is the CIDR of the subnet to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>ipv6AddressMode</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ipv6AddressMode is the IPv6 address mode of the subnet to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>ipv6RAMode</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ipv6RAMode is the IPv6 RA mode of the subnet to filter by.</p>
</td>
</tr>
<tr>
<td>
<code>FilterByNeutronTags</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.FilterByNeutronTags">
FilterByNeutronTags
</a>
</em>
</td>
<td>
<p>
(Members of <code>FilterByNeutronTags</code> are embedded into this type.)
</p>
<em>(Optional)</em>
<p>FilterByNeutronTags specifies tags to filter by.</p>
</td>
</tr>
</tbody>
</table>
###SubnetParam { #hypershift.openshift.io/v1beta1.SubnetParam }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackPlatformSpec">OpenStackPlatformSpec</a>)
</p>
<p>
<p>SubnetParam specifies an OpenStack subnet to use. It may be specified by either ID or filter, but not both.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>id</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>id is the uuid of the subnet. It will not be validated.</p>
</td>
</tr>
<tr>
<td>
<code>filter</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.SubnetFilter">
SubnetFilter
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>filter specifies a filter to select the subnet. It must match exactly one subnet.</p>
</td>
</tr>
</tbody>
</table>
###SubnetSpec { #hypershift.openshift.io/v1beta1.SubnetSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.OpenStackPlatformSpec">OpenStackPlatformSpec</a>)
</p>
<p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>dnsNameservers</code></br>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>dnsNameservers holds a list of DNS server addresses that will be provided when creating
the subnet. These addresses need to have the same IP version as CIDR.</p>
</td>
</tr>
<tr>
<td>
<code>allocationPools</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AllocationPool">
[]AllocationPool
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>allocationPools is an array of AllocationPool objects that will be applied to OpenStack Subnet being created.
If set, OpenStack will only allocate these IPs for Machines. It will still be possible to create ports from
outside of these ranges manually.</p>
</td>
</tr>
</tbody>
</table>
###Taint { #hypershift.openshift.io/v1beta1.Taint }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolSpec">NodePoolSpec</a>)
</p>
<p>
<p>taint is as v1 Core but without TimeAdded.
<a href="https://github.com/kubernetes/kubernetes/blob/ed8cad1e80d096257921908a52ac69cf1f41a098/staging/src/k8s.io/api/core/v1/types.go#L3037-L3053">https://github.com/kubernetes/kubernetes/blob/ed8cad1e80d096257921908a52ac69cf1f41a098/staging/src/k8s.io/api/core/v1/types.go#L3037-L3053</a>
Validation replicates the same validation as the upstream <a href="https://github.com/kubernetes/kubernetes/blob/9a2a7537f035969a68e432b4cc276dbce8ce1735/pkg/util/taints/taints.go#L273">https://github.com/kubernetes/kubernetes/blob/9a2a7537f035969a68e432b4cc276dbce8ce1735/pkg/util/taints/taints.go#L273</a>.
See also <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/names/">https://kubernetes.io/docs/concepts/overview/working-with-objects/names/</a>.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>key</code></br>
<em>
string
</em>
</td>
<td>
<p>key is the taint key to be applied to a node.</p>
</td>
</tr>
<tr>
<td>
<code>value</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>value is the taint value corresponding to the taint key.</p>
</td>
</tr>
<tr>
<td>
<code>effect</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#tainteffect-v1-core">
Kubernetes core/v1.TaintEffect
</a>
</em>
</td>
<td>
<p>effect is the effect of the taint on pods
that do not tolerate the taint.
Valid effects are NoSchedule, PreferNoSchedule and NoExecute.</p>
</td>
</tr>
</tbody>
</table>
###UnmanagedEtcdShardSpec { #hypershift.openshift.io/v1beta1.UnmanagedEtcdShardSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.UnmanagedEtcdSpec">UnmanagedEtcdSpec</a>)
</p>
<p>
<p>UnmanagedEtcdShardSpec defines the configuration for a single etcd shard
within an unmanaged (externally operated) etcd deployment.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code></br>
<em>
string
</em>
</td>
<td>
<p>name is a unique identifier for this shard.
Must be a valid DNS1123 label (lowercase alphanumeric with hyphens,
starting and ending with an alphanumeric character), max 48 characters.
Immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>resources</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdShardResource">
[]EtcdShardResource
</a>
</em>
</td>
<td>
<p>resources is the list of Kubernetes resource types routed to this
shard. Uses the same format as ManagedEtcdShardSpec.Resources.
Only resource types built into the kube-apiserver are routed; entries
for CRD-backed or aggregated API resources have no effect (see
EtcdShardResource).
Minimum 1, maximum 20 entries. Immutable once set.</p>
</td>
</tr>
<tr>
<td>
<code>endpoint</code></br>
<em>
string
</em>
</td>
<td>
<p>endpoint is the full etcd client endpoint URL for this shard.
Must be a valid HTTPS URL, max 267 characters. Immutable once set.
All shards must share the same CA and client certificate as the
top-level UnmanagedEtcdSpec.TLS, because kube-apiserver uses a
single &ndash;etcd-cafile/&ndash;etcd-certfile/&ndash;etcd-keyfile for all etcd
connections; &ndash;etcd-servers-overrides only overrides server URLs.</p>
</td>
</tr>
</tbody>
</table>
###UnmanagedEtcdSpec { #hypershift.openshift.io/v1beta1.UnmanagedEtcdSpec }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.EtcdSpec">EtcdSpec</a>)
</p>
<p>
<p>UnmanagedEtcdSpec specifies configuration which enables the control plane to
integrate with an eternally managed etcd cluster.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>endpoint</code></br>
<em>
string
</em>
</td>
<td>
<p>endpoint is the full etcd cluster client endpoint URL. For example:</p>
<pre><code>https://etcd-client:2379
</code></pre>
<p>If the URL uses an HTTPS scheme, the TLS field is required.</p>
</td>
</tr>
<tr>
<td>
<code>tls</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.EtcdTLSConfig">
EtcdTLSConfig
</a>
</em>
</td>
<td>
<p>tls specifies TLS configuration for HTTPS etcd client endpoints.</p>
</td>
</tr>
<tr>
<td>
<code>shards</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.UnmanagedEtcdShardSpec">
[]UnmanagedEtcdShardSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>shards defines additional etcd shards for resource-level routing.
The top-level endpoint and tls fields define the default shard
(the catch-all for all resources not explicitly routed). Entries
in this list define non-default shards, each with its own endpoint
and TLS configuration.
Minimum 1, maximum 10 entries. Resources must not overlap across
shards. Immutable after creation: shards cannot be added, removed,
or reordered.</p>
</td>
</tr>
</tbody>
</table>
###UpgradeStrategy { #hypershift.openshift.io/v1beta1.UpgradeStrategy }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.ReplaceUpgrade">ReplaceUpgrade</a>)
</p>
<p>
<p>UpgradeStrategy is a specific strategy for upgrading nodes in a NodePool.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;OnDelete&#34;</p></td>
<td><p>UpgradeStrategyOnDelete replaces old nodes when the deletion of the
associated node instances are completed.</p>
</td>
</tr><tr><td><p>&#34;RollingUpdate&#34;</p></td>
<td><p>UpgradeStrategyRollingUpdate means use a rolling update for nodes.</p>
</td>
</tr></tbody>
</table>
###UpgradeType { #hypershift.openshift.io/v1beta1.UpgradeType }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.NodePoolManagement">NodePoolManagement</a>)
</p>
<p>
<p>UpgradeType is a type of high-level upgrade behavior nodes in a NodePool.</p>
</p>
<table>
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>&#34;InPlace&#34;</p></td>
<td><p>UpgradeTypeInPlace is a strategy which replaces nodes in-place with no
additional node capacity requirements.</p>
</td>
</tr><tr><td><p>&#34;Replace&#34;</p></td>
<td><p>UpgradeTypeReplace is a strategy which replaces nodes using surge node
capacity.</p>
</td>
</tr></tbody>
</table>
###UserAssignedManagedIdentity { #hypershift.openshift.io/v1beta1.UserAssignedManagedIdentity }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureContainerRegistryCredentialConfig">AzureContainerRegistryCredentialConfig</a>)
</p>
<p>
<p>UserAssignedManagedIdentity identifies a user-assigned managed identity by its ARM resource ID.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>resourceID</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureManagedIdentityResourceID">
AzureManagedIdentityResourceID
</a>
</em>
</td>
<td>
<p>resourceID is the ARM resource ID of the user-assigned managed identity
in the format /subscriptions/{subscriptionID}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}.
The identity must have the AcrPull role on the target Azure Container Registry.
It does not need to be in the same subscription or resource group as the HostedCluster,
but it must be in the same Azure AD tenant.</p>
</td>
</tr>
</tbody>
</table>
###UserManagedDiagnostics { #hypershift.openshift.io/v1beta1.UserManagedDiagnostics }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.Diagnostics">Diagnostics</a>)
</p>
<p>
<p>UserManagedDiagnostics specifies the diagnostics settings for a virtual machine when the storage account is managed by the user.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>storageAccountURI</code></br>
<em>
string
</em>
</td>
<td>
<p>storageAccountURI is the URI of the user-managed storage account.
The URI typically will be <code>https://&lt;mystorageaccountname&gt;.blob.core.windows.net/</code>
but may differ if you are using Azure DNS zone endpoints.
You can find the correct endpoint by looking for the Blob Primary Endpoint in the
endpoints tab in the Azure console or with the CLI by issuing
<code>az storage account list --query='[].{name: name, &quot;resource group&quot;: resourceGroup, &quot;blob endpoint&quot;: primaryEndpoints.blob}'</code>.</p>
</td>
</tr>
</tbody>
</table>
###Volume { #hypershift.openshift.io/v1beta1.Volume }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AWSNodePoolPlatform">AWSNodePoolPlatform</a>)
</p>
<p>
<p>Volume specifies the configuration options for node instance storage devices.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>size</code></br>
<em>
int64
</em>
</td>
<td>
<p>size is the size of the volume in gibibytes (GiB).</p>
<p>Must be greater than the image snapshot size or 8 (whichever is greater).</p>
</td>
</tr>
<tr>
<td>
<code>type</code></br>
<em>
string
</em>
</td>
<td>
<p>type is the type of volume to provision.</p>
</td>
</tr>
<tr>
<td>
<code>iops</code></br>
<em>
int64
</em>
</td>
<td>
<em>(Optional)</em>
<p>iops is the number of IOPS requested for the disk. This is only valid
for type io1.</p>
</td>
</tr>
<tr>
<td>
<code>encrypted</code></br>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>encrypted indicates whether the EBS volume should be encrypted or not.</p>
</td>
</tr>
<tr>
<td>
<code>encryptionKey</code></br>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>encryptionKey is the KMS key to use for volume encryption.</p>
</td>
</tr>
</tbody>
</table>
###WorkloadIdentity { #hypershift.openshift.io/v1beta1.WorkloadIdentity }
<p>
(<em>Appears on:</em>
<a href="#hypershift.openshift.io/v1beta1.AzureKMSSpec">AzureKMSSpec</a>, 
<a href="#hypershift.openshift.io/v1beta1.AzureWorkloadIdentities">AzureWorkloadIdentities</a>)
</p>
<p>
<p>WorkloadIdentity is a struct that contains the client ID of a federated managed identity used in workload identity
authentication.</p>
</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>clientID</code></br>
<em>
<a href="#hypershift.openshift.io/v1beta1.AzureClientID">
AzureClientID
</a>
</em>
</td>
<td>
<p>clientID is client ID of a federated managed identity used in workload identity authentication</p>
</td>
</tr>
</tbody>
</table>
<hr/>
