aws

type AssumeRole struct {
	RoleARN string `json:"roleARN"`

	// ExternalID is random string generated by platform so that assume role
	// is protected from confused deputy problem.
	// more info: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html
	// +optional
	ExternalID string `json:"externalID,omitempty"`
}

type EC2Metadata struct {
	// Authentication determines whether or not the host requires the use of authentication when interacting with the metadata service.
	// When using authentication, this enforces v2 interaction method (IMDSv2) with the metadata service.
	// When omitted, this means the user has no opinion and the value is left to the platform to choose a good
	// default, which is subject to change over time. The current default is optional.
	// At this point this field represents `HttpTokens` parameter from `InstanceMetadataOptionsRequest` structure in AWS EC2 API
	// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html
	// +optional
	Authentication string `json:"authentication,omitempty"`
}

type EC2RootVolume struct {
	// IOPS defines the iops for the storage.
	// +optional
	IOPS int `json:"iops,omitempty"`
	// Size defines the size of the storage.
	Size int `json:"size"`
	// Type defines the type of the storage.
	Type string `json:"type"`
	// The KMS key that will be used to encrypt the EBS volume.
	// If no key is provided the default KMS key for the account will be used.
	// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetEbsDefaultKmsKeyId.html
	// +optional
	KMSKeyARN string `json:"kmsKeyARN,omitempty"`
}

type MachinePoolPlatform struct {
	// Zones is list of availability zones that can be used.
	Zones []string `json:"zones,omitempty"`

	// Subnets is the list of IDs of subnets to which to attach the machines.
	// There must be exactly one subnet for each availability zone used.
	// These subnets may be public or private.
	// As a special case, for consistency with install-config, you may specify exactly one
	// private and one public subnet for each availability zone. In this case, the public
	// subnets will be filtered out and only the private subnets will be used.
	// If empty/omitted, we will look for subnets in each availability zone tagged with
	// Name=<clusterID>-private-<az>.
	Subnets []string `json:"subnets,omitempty"`

	// InstanceType defines the ec2 instance type.
	// eg. m4-large
	InstanceType string `json:"type"`

	// EC2RootVolume defines the storage for ec2 instance.
	EC2RootVolume `json:"rootVolume"`

	// SpotMarketOptions allows users to configure instances to be run using AWS Spot instances.
	// +optional
	SpotMarketOptions *SpotMarketOptions `json:"spotMarketOptions,omitempty"`

	// EC2MetadataOptions defines metadata service interaction options for EC2 instances in the machine pool.
	// +optional
	EC2Metadata *EC2Metadata `json:"metadataService,omitempty"`

	// AdditionalSecurityGroupIDs contains IDs of additional security groups for machines, where each ID
	// is presented in the format sg-xxxx.
	//
	// +optional
	AdditionalSecurityGroupIDs []string `json:"additionalSecurityGroupIDs,omitempty"`

	// UserTags contains the user defined tags to be supplied for the ec2 instance.
	// Note that these will be merged with ClusterDeployment.Spec.Platform.AWS.UserTags, with
	// this field taking precedence when keys collide.
	// +optional
	UserTags map[string]string `json:"userTags,omitempty"`
}

type Metadata struct {
	// HostedZoneRole is the role to assume when performing operations
	// on a hosted zone owned by another account.
	HostedZoneRole *string `json:"hostedZoneRole,omitempty"`
}

type Platform struct {
	// CredentialsSecretRef refers to a secret that contains the AWS account access
	// credentials.
	// +optional
	CredentialsSecretRef corev1.LocalObjectReference `json:"credentialsSecretRef,omitempty"`

	// CredentialsAssumeRole refers to the IAM role that must be assumed to obtain
	// AWS account access for the cluster operations.
	// +optional
	CredentialsAssumeRole *AssumeRole `json:"credentialsAssumeRole,omitempty"`

	// Region specifies the AWS region where the cluster will be created.
	Region string `json:"region"`

	// UserTags specifies additional tags for AWS resources created for the cluster.
	// +optional
	UserTags map[string]string `json:"userTags,omitempty"`

	// PrivateLink allows uses to enable access to the cluster's API server using AWS
	// PrivateLink. AWS PrivateLink includes a pair of VPC Endpoint Service and VPC
	// Endpoint accross AWS accounts and allows clients to connect to services using AWS's
	// internal networking instead of the Internet.
	PrivateLink *PrivateLinkAccess `json:"privateLink,omitempty"`
}

type PlatformStatus struct {
	PrivateLink *PrivateLinkAccessStatus `json:"privateLink,omitempty"`
}

type PrivateLinkAccess struct {
	Enabled bool `json:"enabled"`

	// AdditionalAllowedPrincipals is a list of additional allowed principal ARNs to be configured
	// for the Private Link cluster's VPC Endpoint Service.
	// ARNs provided as AdditionalAllowedPrincipals will be configured for the cluster's VPC Endpoint
	// Service in addition to the IAM entity used by Hive.
	// +optional
	AdditionalAllowedPrincipals *[]string `json:"additionalAllowedPrincipals,omitempty"`
}

type PrivateLinkAccessStatus struct {
	// +optional
	VPCEndpointService VPCEndpointService `json:"vpcEndpointService,omitempty"`
	// +optional
	VPCEndpointID string `json:"vpcEndpointID,omitempty"`
	// +optional
	HostedZoneID string `json:"hostedZoneID,omitempty"`
}

type SpotMarketOptions struct {
	// The maximum price the user is willing to pay for their instances
	// Default: On-Demand price
	// +optional
	MaxPrice *string `json:"maxPrice,omitempty"`
}

type VPCEndpointService struct {
	Name string `json:"name,omitempty"`
	ID   string `json:"id,omitempty"`
	// DefaultAllowedPrincipal is the ARN of the IAM entity used by Hive as configured for the Private
	// Link cluster's VPC Endpoint Service.
	// +optional
	DefaultAllowedPrincipal *string `json:"defaultAllowedPrincipal,omitempty"`
	// AdditionalAllowedPrincipals is a list of additional allowed principal ARNs that have been configured
	// for the Private Link cluster's VPC Endpoint Service. This list in Status is used to determine if a sync
	// of Allowed Principals is needed outside of the regular reconcile period of 2hrs.
	// +optional
	AdditionalAllowedPrincipals *[]string `json:"additionalAllowedPrincipals,omitempty"`
}