{
  "description": "GCPMachine is the Schema for the gcpmachines API.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "GCPMachineSpec defines the desired state of GCPMachine.",
      "properties": {
        "additionalDisks": {
          "description": "AdditionalDisks are optional non-boot attached disks.",
          "items": {
            "description": "AttachedDiskSpec degined GCP machine disk.",
            "properties": {
              "deviceType": {
                "description": "DeviceType is a device type of the attached disk.\nSupported types of non-root attached volumes:\n1. \"pd-standard\" - Standard (HDD) persistent disk\n2. \"pd-ssd\" - SSD persistent disk\n3. \"local-ssd\" - Local SSD disk (https://cloud.google.com/compute/docs/disks/local-ssd).\n4. \"pd-balanced\" - Balanced Persistent Disk\n5. \"hyperdisk-balanced\" - Hyperdisk Balanced\nDefault is \"pd-standard\".",
                "type": "string"
              },
              "encryptionKey": {
                "description": "EncryptionKey defines the KMS key to be used to encrypt the disk.",
                "properties": {
                  "keyType": {
                    "description": "KeyType is the type of encryption key. Must be either Managed, aka Customer-Managed Encryption Key (CMEK) or\nSupplied, aka Customer-Supplied EncryptionKey (CSEK).",
                    "enum": [
                      "Managed",
                      "Supplied"
                    ],
                    "type": "string"
                  },
                  "kmsKeyServiceAccount": {
                    "description": "KMSKeyServiceAccount is the service account being used for the encryption request for the given KMS key.\nIf absent, the Compute Engine default service account is used. For example:\n\"kmsKeyServiceAccount\": \"name@project_id.iam.gserviceaccount.com.\nThe maximum length is based on the Service Account ID (max 30), Project (max 30), and a valid gcloud email\nsuffix (\"iam.gserviceaccount.com\").",
                    "maxLength": 85,
                    "pattern": "[-_[A-Za-z0-9]+@[-_[A-Za-z0-9]+.iam.gserviceaccount.com",
                    "type": "string"
                  },
                  "managedKey": {
                    "description": "ManagedKey references keys managed by the Cloud Key Management Service. This should be set when KeyType is Managed.",
                    "properties": {
                      "kmsKeyName": {
                        "description": "KMSKeyName is the name of the encryption key that is stored in Google Cloud KMS. For example:\n\"kmsKeyName\": \"projects/kms_project_id/locations/region/keyRings/key_region/cryptoKeys/key",
                        "maxLength": 160,
                        "pattern": "projects\\/[-_[A-Za-z0-9]+\\/locations\\/[-_[A-Za-z0-9]+\\/keyRings\\/[-_[A-Za-z0-9]+\\/cryptoKeys\\/[-_[A-Za-z0-9]+",
                        "type": "string"
                      }
                    },
                    "required": [
                      "kmsKeyName"
                    ],
                    "type": "object",
                    "additionalProperties": false
                  },
                  "suppliedKey": {
                    "description": "SuppliedKey provides the key used to create or manage a disk. This should be set when KeyType is Managed.",
                    "maxProperties": 1,
                    "minProperties": 1,
                    "properties": {
                      "rawKey": {
                        "description": "RawKey specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648\nbase64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey.\nFor example: \"rawKey\": \"SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=\"",
                        "format": "byte",
                        "type": "string"
                      },
                      "rsaEncryptedKey": {
                        "description": "RSAEncryptedKey specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption\nkey to either encrypt or decrypt this resource. You can provide either the rawKey or the\nrsaEncryptedKey.\nFor example: \"rsaEncryptedKey\": \"ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFHi\nz0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoDi\nD6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==\"\nThe key must meet the following requirements before you can provide it to Compute Engine:\n1. The key is wrapped using a RSA public key certificate provided by Google.\n2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding.\nGets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem",
                        "format": "byte",
                        "type": "string"
                      }
                    },
                    "type": "object",
                    "additionalProperties": false
                  }
                },
                "required": [
                  "keyType"
                ],
                "type": "object",
                "additionalProperties": false
              },
              "size": {
                "description": "Size is the size of the disk in GBs.\nDefaults to 30GB. For \"local-ssd\" size is always 375GB.",
                "format": "int64",
                "type": "integer"
              }
            },
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "additionalLabels": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "AdditionalLabels is an optional set of tags to add to an instance, in addition to the ones added by default by the\nGCP provider. If both the GCPCluster and the GCPMachine specify the same tag name with different values, the\nGCPMachine's value takes precedence.",
          "type": "object"
        },
        "additionalMetadata": {
          "description": "AdditionalMetadata is an optional set of metadata to add to an instance, in addition to the ones added by default by the\nGCP provider.",
          "items": {
            "description": "MetadataItem defines a single piece of metadata associated with an instance.",
            "properties": {
              "key": {
                "description": "Key is the identifier for the metadata entry.",
                "type": "string"
              },
              "value": {
                "description": "Value is the value of the metadata entry.",
                "type": "string"
              }
            },
            "required": [
              "key"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array",
          "x-kubernetes-list-map-keys": [
            "key"
          ],
          "x-kubernetes-list-type": "map"
        },
        "additionalNetworkTags": {
          "description": "AdditionalNetworkTags is a list of network tags that should be applied to the\ninstance. These tags are set in addition to any network tags defined\nat the cluster level or in the actuator.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "confidentialCompute": {
          "description": "ConfidentialCompute Defines whether the instance should have confidential compute enabled.\nIf enabled OnHostMaintenance is required to be set to \"Terminate\".\nIf omitted, the platform chooses a default, which is subject to change over time, currently that default is false.",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "type": "string"
        },
        "image": {
          "description": "Image is the full reference to a valid image to be used for this machine.\nTakes precedence over ImageFamily.",
          "type": "string"
        },
        "imageFamily": {
          "description": "ImageFamily is the full reference to a valid image family to be used for this machine.",
          "type": "string"
        },
        "instanceType": {
          "description": "InstanceType is the type of instance to create. Example: n1.standard-2",
          "type": "string"
        },
        "ipForwarding": {
          "default": "Enabled",
          "description": "IPForwarding Allows this instance to send and receive packets with non-matching destination or source IPs.\nThis is required if you plan to use this instance to forward routes. Defaults to enabled.",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "type": "string"
        },
        "onHostMaintenance": {
          "description": "OnHostMaintenance determines the behavior when a maintenance event occurs that might cause the instance to reboot.\nIf omitted, the platform chooses a default, which is subject to change over time, currently that default is \"Migrate\".",
          "enum": [
            "Migrate",
            "Terminate"
          ],
          "type": "string"
        },
        "preemptible": {
          "description": "Preemptible defines if instance is preemptible",
          "type": "boolean"
        },
        "providerID": {
          "description": "ProviderID is the unique identifier as specified by the cloud provider.",
          "type": "string"
        },
        "provisioningModel": {
          "description": "ProvisioningModel defines if instance is spot.\nIf set to \"Standard\" while preemptible is true, then the VM will be of type \"Preemptible\".\nIf \"Spot\", VM type is \"Spot\". When unspecified, defaults to \"Standard\".",
          "enum": [
            "Standard",
            "Spot"
          ],
          "type": "string"
        },
        "publicIP": {
          "description": "PublicIP specifies whether the instance should get a public IP.\nSet this to true if you don't have a NAT instances or Cloud Nat setup.",
          "type": "boolean"
        },
        "resourceManagerTags": {
          "description": "ResourceManagerTags is an optional set of tags to apply to GCP resources managed\nby the GCP provider. GCP supports a maximum of 50 tags per resource.",
          "items": {
            "description": "ResourceManagerTag is a tag to apply to GCP resources managed by the GCP provider.",
            "properties": {
              "key": {
                "description": "Key is the key part of the tag. A tag key can have a maximum of 63 characters and cannot\nbe empty. Tag key must begin and end with an alphanumeric character, and must contain\nonly uppercase, lowercase alphanumeric characters, and the following special\ncharacters `._-`.",
                "maxLength": 63,
                "minLength": 1,
                "pattern": "^[a-zA-Z0-9]([0-9A-Za-z_.-]{0,61}[a-zA-Z0-9])?$",
                "type": "string"
              },
              "parentID": {
                "description": "ParentID is the ID of the hierarchical resource where the tags are defined\ne.g. at the Organization or the Project level. To find the Organization or Project ID ref\nhttps://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id\nhttps://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects\nAn OrganizationID must consist of decimal numbers, and cannot have leading zeroes.\nA ProjectID must be 6 to 30 characters in length, can only contain lowercase letters,\nnumbers, and hyphens, and must start with a letter, and cannot end with a hyphen.",
                "maxLength": 32,
                "minLength": 1,
                "pattern": "(^[1-9][0-9]{0,31}$)|(^[a-z][a-z0-9-]{4,28}[a-z0-9]$)",
                "type": "string"
              },
              "value": {
                "description": "Value is the value part of the tag. A tag value can have a maximum of 63 characters and\ncannot be empty. Tag value must begin and end with an alphanumeric character, and must\ncontain only uppercase, lowercase alphanumeric characters, and the following special\ncharacters `_-.@%=+:,*#&(){}[]` and spaces.",
                "maxLength": 63,
                "minLength": 1,
                "pattern": "^[a-zA-Z0-9]([0-9A-Za-z_.@%=+:,*#&()\\[\\]{}\\-\\s]{0,61}[a-zA-Z0-9])?$",
                "type": "string"
              }
            },
            "required": [
              "key",
              "parentID",
              "value"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "rootDeviceSize": {
          "description": "RootDeviceSize is the size of the root volume in GB.\nDefaults to 30.",
          "format": "int64",
          "type": "integer"
        },
        "rootDeviceType": {
          "description": "RootDeviceType is the type of the root volume.\nSupported types of root volumes:\n1. \"pd-standard\" - Standard (HDD) persistent disk\n2. \"pd-ssd\" - SSD persistent disk\n3. \"pd-balanced\" - Balanced Persistent Disk\n4. \"hyperdisk-balanced\" - Hyperdisk Balanced\nDefault is \"pd-standard\".",
          "type": "string"
        },
        "rootDiskEncryptionKey": {
          "description": "RootDiskEncryptionKey defines the KMS key to be used to encrypt the root disk.",
          "properties": {
            "keyType": {
              "description": "KeyType is the type of encryption key. Must be either Managed, aka Customer-Managed Encryption Key (CMEK) or\nSupplied, aka Customer-Supplied EncryptionKey (CSEK).",
              "enum": [
                "Managed",
                "Supplied"
              ],
              "type": "string"
            },
            "kmsKeyServiceAccount": {
              "description": "KMSKeyServiceAccount is the service account being used for the encryption request for the given KMS key.\nIf absent, the Compute Engine default service account is used. For example:\n\"kmsKeyServiceAccount\": \"name@project_id.iam.gserviceaccount.com.\nThe maximum length is based on the Service Account ID (max 30), Project (max 30), and a valid gcloud email\nsuffix (\"iam.gserviceaccount.com\").",
              "maxLength": 85,
              "pattern": "[-_[A-Za-z0-9]+@[-_[A-Za-z0-9]+.iam.gserviceaccount.com",
              "type": "string"
            },
            "managedKey": {
              "description": "ManagedKey references keys managed by the Cloud Key Management Service. This should be set when KeyType is Managed.",
              "properties": {
                "kmsKeyName": {
                  "description": "KMSKeyName is the name of the encryption key that is stored in Google Cloud KMS. For example:\n\"kmsKeyName\": \"projects/kms_project_id/locations/region/keyRings/key_region/cryptoKeys/key",
                  "maxLength": 160,
                  "pattern": "projects\\/[-_[A-Za-z0-9]+\\/locations\\/[-_[A-Za-z0-9]+\\/keyRings\\/[-_[A-Za-z0-9]+\\/cryptoKeys\\/[-_[A-Za-z0-9]+",
                  "type": "string"
                }
              },
              "required": [
                "kmsKeyName"
              ],
              "type": "object",
              "additionalProperties": false
            },
            "suppliedKey": {
              "description": "SuppliedKey provides the key used to create or manage a disk. This should be set when KeyType is Managed.",
              "maxProperties": 1,
              "minProperties": 1,
              "properties": {
                "rawKey": {
                  "description": "RawKey specifies a 256-bit customer-supplied encryption key, encoded in RFC 4648\nbase64 to either encrypt or decrypt this resource. You can provide either the rawKey or the rsaEncryptedKey.\nFor example: \"rawKey\": \"SGVsbG8gZnJvbSBHb29nbGUgQ2xvdWQgUGxhdGZvcm0=\"",
                  "format": "byte",
                  "type": "string"
                },
                "rsaEncryptedKey": {
                  "description": "RSAEncryptedKey specifies an RFC 4648 base64 encoded, RSA-wrapped 2048-bit customer-supplied encryption\nkey to either encrypt or decrypt this resource. You can provide either the rawKey or the\nrsaEncryptedKey.\nFor example: \"rsaEncryptedKey\": \"ieCx/NcW06PcT7Ep1X6LUTc/hLvUDYyzSZPPVCVPTVEohpeHASqC8uw5TzyO9U+Fka9JFHi\nz0mBibXUInrC/jEk014kCK/NPjYgEMOyssZ4ZINPKxlUh2zn1bV+MCaTICrdmuSBTWlUUiFoDi\nD6PYznLwh8ZNdaheCeZ8ewEXgFQ8V+sDroLaN3Xs3MDTXQEMMoNUXMCZEIpg9Vtp9x2oe==\"\nThe key must meet the following requirements before you can provide it to Compute Engine:\n1. The key is wrapped using a RSA public key certificate provided by Google.\n2. After being wrapped, the key must be encoded in RFC 4648 base64 encoding.\nGets the RSA public key certificate provided by Google at: https://cloud-certs.storage.googleapis.com/google-cloud-csek-ingress.pem",
                  "format": "byte",
                  "type": "string"
                }
              },
              "type": "object",
              "additionalProperties": false
            }
          },
          "required": [
            "keyType"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "serviceAccounts": {
          "description": "ServiceAccount specifies the service account email and which scopes to assign to the machine.\nDefaults to: email: \"default\", scope: []{compute.CloudPlatformScope}",
          "properties": {
            "email": {
              "description": "Email: Email address of the service account.",
              "type": "string"
            },
            "scopes": {
              "description": "Scopes: The list of scopes to be made available for this service\naccount.",
              "items": {
                "type": "string"
              },
              "type": "array"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "shieldedInstanceConfig": {
          "description": "ShieldedInstanceConfig is the Shielded VM configuration for this machine",
          "properties": {
            "integrityMonitoring": {
              "description": "IntegrityMonitoring determines whether the instance should have integrity monitoring that verify the runtime boot integrity.\nCompares the most recent boot measurements to the integrity policy baseline and return\na pair of pass/fail results depending on whether they match or not.\nIf omitted, the platform chooses a default, which is subject to change over time, currently that default is Enabled.",
              "enum": [
                "Enabled",
                "Disabled"
              ],
              "type": "string"
            },
            "secureBoot": {
              "description": "SecureBoot Defines whether the instance should have secure boot enabled.\nSecure Boot verify the digital signature of all boot components, and halting the boot process if signature verification fails.\nIf omitted, the platform chooses a default, which is subject to change over time, currently that default is Disabled.",
              "enum": [
                "Enabled",
                "Disabled"
              ],
              "type": "string"
            },
            "virtualizedTrustedPlatformModule": {
              "description": "VirtualizedTrustedPlatformModule enable virtualized trusted platform module measurements to create a known good boot integrity policy baseline.\nThe integrity policy baseline is used for comparison with measurements from subsequent VM boots to determine if anything has changed.\nIf omitted, the platform chooses a default, which is subject to change over time, currently that default is Enabled.",
              "enum": [
                "Enabled",
                "Disabled"
              ],
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "subnet": {
          "description": "Subnet is a reference to the subnetwork to use for this instance. If not specified,\nthe first subnetwork retrieved from the Cluster Region and Network is picked.",
          "type": "string"
        }
      },
      "required": [
        "instanceType"
      ],
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "GCPMachineStatus defines the observed state of GCPMachine.",
      "properties": {
        "addresses": {
          "description": "Addresses contains the GCP instance associated addresses.",
          "items": {
            "description": "NodeAddress contains information for the node's address.",
            "properties": {
              "address": {
                "description": "The node address.",
                "type": "string"
              },
              "type": {
                "description": "Node address type, one of Hostname, ExternalIP or InternalIP.",
                "type": "string"
              }
            },
            "required": [
              "address",
              "type"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "failureMessage": {
          "description": "FailureMessage will be set in the event that there is a terminal problem\nreconciling the Machine and will contain a more verbose string suitable\nfor logging and human consumption.\n\nThis field should not be set for transitive errors that a controller\nfaces that are expected to be fixed automatically over\ntime (like service outages), but instead indicate that something is\nfundamentally wrong with the Machine's spec or the configuration of\nthe controller, and that manual intervention is required. Examples\nof terminal errors would be invalid combinations of settings in the\nspec, values that are unsupported by the controller, or the\nresponsible controller itself being critically misconfigured.\n\nAny transient errors that occur during the reconciliation of Machines\ncan be added as events to the Machine object and/or logged in the\ncontroller's output.",
          "type": "string"
        },
        "failureReason": {
          "description": "FailureReason will be set in the event that there is a terminal problem\nreconciling the Machine and will contain a succinct value suitable\nfor machine interpretation.\n\nThis field should not be set for transitive errors that a controller\nfaces that are expected to be fixed automatically over\ntime (like service outages), but instead indicate that something is\nfundamentally wrong with the Machine's spec or the configuration of\nthe controller, and that manual intervention is required. Examples\nof terminal errors would be invalid combinations of settings in the\nspec, values that are unsupported by the controller, or the\nresponsible controller itself being critically misconfigured.\n\nAny transient errors that occur during the reconciliation of Machines\ncan be added as events to the Machine object and/or logged in the\ncontroller's output.",
          "type": "string"
        },
        "instanceState": {
          "description": "InstanceStatus is the status of the GCP instance for this machine.",
          "type": "string"
        },
        "ready": {
          "description": "Ready is true when the provider resource is ready.",
          "type": "boolean"
        }
      },
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}