{
  "description": "AWSMachine is the schema for Amazon EC2 machines.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "AWSMachineSpec defines the desired state of an Amazon EC2 instance.",
      "properties": {
        "additionalSecurityGroups": {
          "description": "AdditionalSecurityGroups is an array of references to security groups that should be applied to the\ninstance. These security groups would be set in addition to any security groups defined\nat the cluster level or in the actuator. It is possible to specify either IDs of Filters. Using Filters\nwill cause additional requests to AWS API and if tags change the attached security groups might change too.",
          "items": {
            "description": "AWSResourceReference is a reference to a specific AWS resource by ID or filters.\nOnly one of ID or Filters may be specified. Specifying more than one will result in\na validation error.",
            "properties": {
              "filters": {
                "description": "Filters is a set of key/value pairs used to identify a resource\nThey are applied according to the rules defined by the AWS API:\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html",
                "items": {
                  "description": "Filter is a filter used to identify an AWS resource.",
                  "properties": {
                    "name": {
                      "description": "Name of the filter. Filter names are case-sensitive.",
                      "type": "string"
                    },
                    "values": {
                      "description": "Values includes one or more filter values. Filter values are case-sensitive.",
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    }
                  },
                  "required": [
                    "name",
                    "values"
                  ],
                  "type": "object",
                  "additionalProperties": false
                },
                "type": "array"
              },
              "id": {
                "description": "ID of resource",
                "type": "string"
              }
            },
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "additionalTags": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "AdditionalTags is an optional set of tags to add to an instance, in addition to the ones added by default by the\nAWS provider. If both the AWSCluster and the AWSMachine specify the same tag name with different values, the\nAWSMachine's value takes precedence.",
          "type": "object"
        },
        "ami": {
          "description": "AMI is the reference to the AMI from which to create the machine instance.",
          "properties": {
            "eksLookupType": {
              "description": "EKSOptimizedLookupType If specified, will look up an EKS Optimized image in SSM Parameter store",
              "enum": [
                "AmazonLinux",
                "AmazonLinuxGPU"
              ],
              "type": "string"
            },
            "id": {
              "description": "ID of resource",
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "capacityReservationId": {
          "description": "CapacityReservationID specifies the target Capacity Reservation into which the instance should be launched.",
          "type": "string"
        },
        "cloudInit": {
          "description": "CloudInit defines options related to the bootstrapping systems where\nCloudInit is used.",
          "properties": {
            "insecureSkipSecretsManager": {
              "description": "InsecureSkipSecretsManager, when set to true will not use AWS Secrets Manager\nor AWS Systems Manager Parameter Store to ensure privacy of userdata.\nBy default, a cloud-init boothook shell script is prepended to download\nthe userdata from Secrets Manager and additionally delete the secret.",
              "type": "boolean"
            },
            "secretCount": {
              "description": "SecretCount is the number of secrets used to form the complete secret",
              "format": "int32",
              "type": "integer"
            },
            "secretPrefix": {
              "description": "SecretPrefix is the prefix for the secret name. This is stored\ntemporarily, and deleted when the machine registers as a node against\nthe workload cluster.",
              "type": "string"
            },
            "secureSecretsBackend": {
              "description": "SecureSecretsBackend, when set to parameter-store will utilize the AWS Systems Manager\nParameter Storage to distribute secrets. By default or with the value of secrets-manager,\nwill use AWS Secrets Manager instead.",
              "enum": [
                "secrets-manager",
                "ssm-parameter-store"
              ],
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "elasticIpPool": {
          "description": "ElasticIPPool is the configuration to allocate Public IPv4 address (Elastic IP/EIP) from user-defined pool.",
          "properties": {
            "publicIpv4Pool": {
              "description": "PublicIpv4Pool sets a custom Public IPv4 Pool used to create Elastic IP address for resources\ncreated in public IPv4 subnets. Every IPv4 address, Elastic IP, will be allocated from the custom\nPublic IPv4 pool that you brought to AWS, instead of Amazon-provided pool. The public IPv4 pool\nresource ID starts with 'ipv4pool-ec2'.",
              "maxLength": 30,
              "type": "string"
            },
            "publicIpv4PoolFallbackOrder": {
              "description": "PublicIpv4PoolFallBackOrder defines the fallback action when the Public IPv4 Pool has been exhausted,\nno more IPv4 address available in the pool.\n\n\nWhen set to 'amazon-pool', the controller check if the pool has available IPv4 address, when pool has reached the\nIPv4 limit, the address will be claimed from Amazon-pool (default).\n\n\nWhen set to 'none', the controller will fail the Elastic IP allocation when the publicIpv4Pool is exhausted.",
              "enum": [
                "amazon-pool",
                "none"
              ],
              "type": "string",
              "x-kubernetes-validations": [
                {
                  "message": "allowed values are 'none' and 'amazon-pool'",
                  "rule": "self in ['none','amazon-pool']"
                }
              ]
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "iamInstanceProfile": {
          "description": "IAMInstanceProfile is a name of an IAM instance profile to assign to the instance",
          "type": "string"
        },
        "ignition": {
          "description": "Ignition defined options related to the bootstrapping systems where Ignition is used.",
          "properties": {
            "proxy": {
              "description": "Proxy defines proxy settings for Ignition.\nOnly valid for Ignition versions 3.1 and above.",
              "properties": {
                "httpProxy": {
                  "description": "HTTPProxy is the HTTP proxy to use for Ignition.\nA single URL that specifies the proxy server to use for HTTP and HTTPS requests,\nunless overridden by the HTTPSProxy or NoProxy options.",
                  "type": "string"
                },
                "httpsProxy": {
                  "description": "HTTPSProxy is the HTTPS proxy to use for Ignition.\nA single URL that specifies the proxy server to use for HTTPS requests,\nunless overridden by the NoProxy option.",
                  "type": "string"
                },
                "noProxy": {
                  "description": "NoProxy is the list of domains to not proxy for Ignition.\nSpecifies a list of strings to hosts that should be excluded from proxying.\n\n\nEach value is represented by:\n- An IP address prefix (1.2.3.4)\n- An IP address prefix in CIDR notation (1.2.3.4/8)\n- A domain name\n  - A domain name matches that name and all subdomains\n  - A domain name with a leading . matches subdomains only\n- A special DNS label (*), indicates that no proxying should be done\n\n\nAn IP address prefix and domain name can also include a literal port number (1.2.3.4:80).",
                  "items": {
                    "description": "IgnitionNoProxy defines the list of domains to not proxy for Ignition.",
                    "maxLength": 2048,
                    "type": "string"
                  },
                  "maxItems": 64,
                  "type": "array"
                }
              },
              "type": "object",
              "additionalProperties": false
            },
            "storageType": {
              "default": "ClusterObjectStore",
              "description": "StorageType defines how to store the boostrap user data for Ignition.\nThis can be used to instruct Ignition from where to fetch the user data to bootstrap an instance.\n\n\nWhen omitted, the storage option will default to ClusterObjectStore.\n\n\nWhen set to \"ClusterObjectStore\", if the capability is available and a Cluster ObjectStore configuration\nis correctly provided in the Cluster object (under .spec.s3Bucket),\nan object store will be used to store bootstrap user data.\n\n\nWhen set to \"UnencryptedUserData\", EC2 Instance User Data will be used to store the machine bootstrap user data, unencrypted.\nThis option is considered less secure than others as user data may contain sensitive informations (keys, certificates, etc.)\nand users with ec2:DescribeInstances permission or users running pods\nthat can access the ec2 metadata service have access to this sensitive information.\nSo this is only to be used at ones own risk, and only when other more secure options are not viable.",
              "enum": [
                "ClusterObjectStore",
                "UnencryptedUserData"
              ],
              "type": "string"
            },
            "tls": {
              "description": "TLS defines TLS settings for Ignition.\nOnly valid for Ignition versions 3.1 and above.",
              "properties": {
                "certificateAuthorities": {
                  "description": "CASources defines the list of certificate authorities to use for Ignition.\nThe value is the certificate bundle (in PEM format). The bundle can contain multiple concatenated certificates.\nSupported schemes are http, https, tftp, s3, arn, gs, and `data` (RFC 2397) URL scheme.",
                  "items": {
                    "description": "IgnitionCASource defines the source of the certificate authority to use for Ignition.",
                    "maxLength": 65536,
                    "type": "string"
                  },
                  "maxItems": 64,
                  "type": "array"
                }
              },
              "type": "object",
              "additionalProperties": false
            },
            "version": {
              "default": "2.3",
              "description": "Version defines which version of Ignition will be used to generate bootstrap data.",
              "enum": [
                "2.3",
                "3.0",
                "3.1",
                "3.2",
                "3.3",
                "3.4"
              ],
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "imageLookupBaseOS": {
          "description": "ImageLookupBaseOS is the name of the base operating system to use for\nimage lookup the AMI is not set.",
          "type": "string"
        },
        "imageLookupFormat": {
          "description": "ImageLookupFormat is the AMI naming format to look up the image for this\nmachine It will be ignored if an explicit AMI is set. Supports\nsubstitutions for {{.BaseOS}} and {{.K8sVersion}} with the base OS and\nkubernetes version, respectively. The BaseOS will be the value in\nImageLookupBaseOS or ubuntu (the default), and the kubernetes version as\ndefined by the packages produced by kubernetes/release without v as a\nprefix: 1.13.0, 1.12.5-mybuild.1, or 1.17.3. For example, the default\nimage format of capa-ami-{{.BaseOS}}-?{{.K8sVersion}}-* will end up\nsearching for AMIs that match the pattern capa-ami-ubuntu-?1.18.0-* for a\nMachine that is targeting kubernetes v1.18.0 and the ubuntu base OS. See\nalso: https://golang.org/pkg/text/template/",
          "type": "string"
        },
        "imageLookupOrg": {
          "description": "ImageLookupOrg is the AWS Organization ID to use for image lookup if AMI is not set.",
          "type": "string"
        },
        "instanceID": {
          "description": "InstanceID is the EC2 instance ID for this machine.",
          "type": "string"
        },
        "instanceMetadataOptions": {
          "description": "InstanceMetadataOptions is the metadata options for the EC2 instance.",
          "properties": {
            "httpEndpoint": {
              "default": "enabled",
              "description": "Enables or disables the HTTP metadata endpoint on your instances.\n\n\nIf you specify a value of disabled, you cannot access your instance metadata.\n\n\nDefault: enabled",
              "enum": [
                "enabled",
                "disabled"
              ],
              "type": "string"
            },
            "httpPutResponseHopLimit": {
              "default": 1,
              "description": "The desired HTTP PUT response hop limit for instance metadata requests. The\nlarger the number, the further instance metadata requests can travel.\n\n\nDefault: 1",
              "format": "int64",
              "maximum": 64,
              "minimum": 1,
              "type": "integer"
            },
            "httpTokens": {
              "default": "optional",
              "description": "The state of token usage for your instance metadata requests.\n\n\nIf the state is optional, you can choose to retrieve instance metadata with\nor without a session token on your request. If you retrieve the IAM role\ncredentials without a token, the version 1.0 role credentials are returned.\nIf you retrieve the IAM role credentials using a valid session token, the\nversion 2.0 role credentials are returned.\n\n\nIf the state is required, you must send a session token with any instance\nmetadata retrieval requests. In this state, retrieving the IAM role credentials\nalways returns the version 2.0 credentials; the version 1.0 credentials are\nnot available.\n\n\nDefault: optional",
              "enum": [
                "optional",
                "required"
              ],
              "type": "string"
            },
            "instanceMetadataTags": {
              "default": "disabled",
              "description": "Set to enabled to allow access to instance tags from the instance metadata.\nSet to disabled to turn off access to instance tags from the instance metadata.\nFor more information, see Work with instance tags using the instance metadata\n(https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#work-with-tags-in-IMDS).\n\n\nDefault: disabled",
              "enum": [
                "enabled",
                "disabled"
              ],
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "instanceType": {
          "description": "InstanceType is the type of instance to create. Example: m4.xlarge",
          "minLength": 2,
          "type": "string"
        },
        "networkInterfaces": {
          "description": "NetworkInterfaces is a list of ENIs to associate with the instance.\nA maximum of 2 may be specified.",
          "items": {
            "type": "string"
          },
          "maxItems": 2,
          "type": "array"
        },
        "nonRootVolumes": {
          "description": "Configuration options for the non root storage volumes.",
          "items": {
            "description": "Volume encapsulates the configuration options for the storage device.",
            "properties": {
              "deviceName": {
                "description": "Device name",
                "type": "string"
              },
              "encrypted": {
                "description": "Encrypted is whether the volume should be encrypted or not.",
                "type": "boolean"
              },
              "encryptionKey": {
                "description": "EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.\nIf Encrypted is set and this is omitted, the default AWS key will be used.\nThe key must already exist and be accessible by the controller.",
                "type": "string"
              },
              "iops": {
                "description": "IOPS is the number of IOPS requested for the disk. Not applicable to all types.",
                "format": "int64",
                "type": "integer"
              },
              "size": {
                "description": "Size specifies size (in Gi) of the storage device.\nMust be greater than the image snapshot size or 8 (whichever is greater).",
                "format": "int64",
                "minimum": 8,
                "type": "integer"
              },
              "throughput": {
                "description": "Throughput to provision in MiB/s supported for the volume type. Not applicable to all types.",
                "format": "int64",
                "type": "integer"
              },
              "type": {
                "description": "Type is the type of the volume (e.g. gp2, io1, etc...).",
                "type": "string"
              }
            },
            "required": [
              "size"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "placementGroupName": {
          "description": "PlacementGroupName specifies the name of the placement group in which to launch the instance.",
          "type": "string"
        },
        "placementGroupPartition": {
          "description": "PlacementGroupPartition is the partition number within the placement group in which to launch the instance.\nThis value is only valid if the placement group, referred in `PlacementGroupName`, was created with\nstrategy set to partition.",
          "format": "int64",
          "maximum": 7,
          "minimum": 1,
          "type": "integer"
        },
        "privateDnsName": {
          "description": "PrivateDNSName is the options for the instance hostname.",
          "properties": {
            "enableResourceNameDnsAAAARecord": {
              "description": "EnableResourceNameDNSAAAARecord indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.",
              "type": "boolean"
            },
            "enableResourceNameDnsARecord": {
              "description": "EnableResourceNameDNSARecord indicates whether to respond to DNS queries for instance hostnames with DNS A records.",
              "type": "boolean"
            },
            "hostnameType": {
              "description": "The type of hostname to assign to an instance.",
              "enum": [
                "ip-name",
                "resource-name"
              ],
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "providerID": {
          "description": "ProviderID is the unique identifier as specified by the cloud provider.",
          "type": "string"
        },
        "publicIP": {
          "description": "PublicIP specifies whether the instance should get a public IP.\nPrecedence for this setting is as follows:\n1. This field if set\n2. Cluster/flavor setting\n3. Subnet default",
          "type": "boolean"
        },
        "rootVolume": {
          "description": "RootVolume encapsulates the configuration options for the root volume",
          "properties": {
            "deviceName": {
              "description": "Device name",
              "type": "string"
            },
            "encrypted": {
              "description": "Encrypted is whether the volume should be encrypted or not.",
              "type": "boolean"
            },
            "encryptionKey": {
              "description": "EncryptionKey is the KMS key to use to encrypt the volume. Can be either a KMS key ID or ARN.\nIf Encrypted is set and this is omitted, the default AWS key will be used.\nThe key must already exist and be accessible by the controller.",
              "type": "string"
            },
            "iops": {
              "description": "IOPS is the number of IOPS requested for the disk. Not applicable to all types.",
              "format": "int64",
              "type": "integer"
            },
            "size": {
              "description": "Size specifies size (in Gi) of the storage device.\nMust be greater than the image snapshot size or 8 (whichever is greater).",
              "format": "int64",
              "minimum": 8,
              "type": "integer"
            },
            "throughput": {
              "description": "Throughput to provision in MiB/s supported for the volume type. Not applicable to all types.",
              "format": "int64",
              "type": "integer"
            },
            "type": {
              "description": "Type is the type of the volume (e.g. gp2, io1, etc...).",
              "type": "string"
            }
          },
          "required": [
            "size"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "securityGroupOverrides": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "SecurityGroupOverrides is an optional set of security groups to use for the node.\nThis is optional - if not provided security groups from the cluster will be used.",
          "type": "object"
        },
        "spotMarketOptions": {
          "description": "SpotMarketOptions allows users to configure instances to be run using AWS Spot instances.",
          "properties": {
            "maxPrice": {
              "description": "MaxPrice defines the maximum price the user is willing to pay for Spot VM instances",
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "sshKeyName": {
          "description": "SSHKeyName is the name of the ssh key to attach to the instance. Valid values are empty string (do not use SSH keys), a valid SSH key name, or omitted (use the default SSH key name)",
          "type": "string"
        },
        "subnet": {
          "description": "Subnet is a reference to the subnet to use for this instance. If not specified,\nthe cluster subnet will be used.",
          "properties": {
            "filters": {
              "description": "Filters is a set of key/value pairs used to identify a resource\nThey are applied according to the rules defined by the AWS API:\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html",
              "items": {
                "description": "Filter is a filter used to identify an AWS resource.",
                "properties": {
                  "name": {
                    "description": "Name of the filter. Filter names are case-sensitive.",
                    "type": "string"
                  },
                  "values": {
                    "description": "Values includes one or more filter values. Filter values are case-sensitive.",
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  }
                },
                "required": [
                  "name",
                  "values"
                ],
                "type": "object",
                "additionalProperties": false
              },
              "type": "array"
            },
            "id": {
              "description": "ID of resource",
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "tenancy": {
          "description": "Tenancy indicates if instance should run on shared or single-tenant hardware.",
          "enum": [
            "default",
            "dedicated",
            "host"
          ],
          "type": "string"
        },
        "uncompressedUserData": {
          "description": "UncompressedUserData specify whether the user data is gzip-compressed before it is sent to ec2 instance.\ncloud-init has built-in support for gzip-compressed user data\nuser data stored in aws secret manager is always gzip-compressed.",
          "type": "boolean"
        }
      },
      "required": [
        "instanceType"
      ],
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "AWSMachineStatus defines the observed state of AWSMachine.",
      "properties": {
        "addresses": {
          "description": "Addresses contains the AWS instance associated addresses.",
          "items": {
            "description": "MachineAddress contains information for the node's address.",
            "properties": {
              "address": {
                "description": "The machine address.",
                "type": "string"
              },
              "type": {
                "description": "Machine address type, one of Hostname, ExternalIP, InternalIP, ExternalDNS or InternalDNS.",
                "type": "string"
              }
            },
            "required": [
              "address",
              "type"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "conditions": {
          "description": "Conditions defines current service state of the AWSMachine.",
          "items": {
            "description": "Condition defines an observation of a Cluster API resource operational state.",
            "properties": {
              "lastTransitionTime": {
                "description": "Last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when\nthe API field changed is acceptable.",
                "format": "date-time",
                "type": "string"
              },
              "message": {
                "description": "A human readable message indicating details about the transition.\nThis field may be empty.",
                "type": "string"
              },
              "reason": {
                "description": "The reason for the condition's last transition in CamelCase.\nThe specific API may choose whether or not this field is considered a guaranteed API.\nThis field may not be empty.",
                "type": "string"
              },
              "severity": {
                "description": "Severity provides an explicit classification of Reason code, so the users or machines can immediately\nunderstand the current situation and act accordingly.\nThe Severity field MUST be set only when Status=False.",
                "type": "string"
              },
              "status": {
                "description": "Status of the condition, one of True, False, Unknown.",
                "type": "string"
              },
              "type": {
                "description": "Type of condition in CamelCase or in foo.example.com/CamelCase.\nMany .condition.type values are consistent across resources like Available, but because arbitrary conditions\ncan be useful (see .node.status.conditions), the ability to deconflict is important.",
                "type": "string"
              }
            },
            "required": [
              "lastTransitionTime",
              "status",
              "type"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "failureMessage": {
          "description": "FailureMessage will be set in the event that there is a terminal problem\nreconciling the Machine and will contain a more verbose string suitable\nfor logging and human consumption.\n\n\nThis field should not be set for transitive errors that a controller\nfaces that are expected to be fixed automatically over\ntime (like service outages), but instead indicate that something is\nfundamentally wrong with the Machine's spec or the configuration of\nthe controller, and that manual intervention is required. Examples\nof terminal errors would be invalid combinations of settings in the\nspec, values that are unsupported by the controller, or the\nresponsible controller itself being critically misconfigured.\n\n\nAny transient errors that occur during the reconciliation of Machines\ncan be added as events to the Machine object and/or logged in the\ncontroller's output.",
          "type": "string"
        },
        "failureReason": {
          "description": "FailureReason will be set in the event that there is a terminal problem\nreconciling the Machine and will contain a succinct value suitable\nfor machine interpretation.\n\n\nThis field should not be set for transitive errors that a controller\nfaces that are expected to be fixed automatically over\ntime (like service outages), but instead indicate that something is\nfundamentally wrong with the Machine's spec or the configuration of\nthe controller, and that manual intervention is required. Examples\nof terminal errors would be invalid combinations of settings in the\nspec, values that are unsupported by the controller, or the\nresponsible controller itself being critically misconfigured.\n\n\nAny transient errors that occur during the reconciliation of Machines\ncan be added as events to the Machine object and/or logged in the\ncontroller's output.",
          "type": "string"
        },
        "instanceState": {
          "description": "InstanceState is the state of the AWS instance for this machine.",
          "type": "string"
        },
        "interruptible": {
          "description": "Interruptible reports that this machine is using spot instances and can therefore be interrupted by CAPI when it receives a notice that the spot instance is to be terminated by AWS.\nThis will be set to true when SpotMarketOptions is not nil (i.e. this machine is using a spot instance).",
          "type": "boolean"
        },
        "ready": {
          "description": "Ready is true when the provider resource is ready.",
          "type": "boolean"
        }
      },
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}