uxp-eks-composition.yaml

apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: official-eks
  labels:
    crossplane.io/xrd: xmanagedclusters.compositions.io
    provider: official
    cluster: eks
spec:
  compositeTypeRef:
    apiVersion: compositions.io/v1alpha1
    kind: XManagedCluster
  writeConnectionSecretsToNamespace: upbound-system
  patchSets:
  - name: metadata
    patches:
    - fromFieldPath: metadata.labels
  - name: region
    patches:
    - fromFieldPath: spec.parameters.region
      toFieldPath: spec.forProvider.region
      transforms:
      - type: map
        map:                    # Standard AZs: a-c; Fargate Support
          use1: us-east-1       # a-f
          use2: us-east-2
          usw1: us-west-1       # ac
          usw2: us-west-2       # a-d
          cac: ca-central-1     # abd, FG: ab
          sae: sa-east-1
          afs: af-south-1       # default: disabled
          euc: eu-central-1
          euw1: eu-west-1
          euw2: eu-west-2
          euw3: eu-west-3
          eus: eu-south-1       # default: disabled
          eun: eu-north-1
          ape: ap-east-1        # default: disabled
          aps1: ap-south-1
          apne1: ap-northeast-1 # acd
          apne2: ap-northeast-2 # a-d
          apne3: ap-northeast-3
          apse1: ap-southeast-1
          apse2: ap-southeast-2
          apse3: ap-southeast-3 # default: disabled
  - name: snet-zone-1
    patches:
    - fromFieldPath: spec.parameters.region
      toFieldPath: metadata.labels.zone
      transforms:
      - type: map
        map:
          use1: us-east-1a
          use2: us-east-2a
          usw1: us-west-1a
          usw2: us-west-2a
          cac: ca-central-1a
          sae: sa-east-1a
          afs: af-south-1a
          euc: eu-central-1a
          euw1: eu-west-1a
          euw2: eu-west-2a
          euw3: eu-west-3a
          eus: eu-south-1a
          eun: eu-north-1a
          ape: ap-east-1a
          aps1: ap-south-1a
          apne1: ap-northeast-1a
          apne2: ap-northeast-2a
          apne3: ap-northeast-3a
          apse1: ap-southeast-1a
          apse2: ap-southeast-2a
          apse3: ap-southeast-3a
    - fromFieldPath: spec.parameters.region
      toFieldPath: spec.forProvider.availabilityZone
      transforms:
      - type: map
        map:
          use1: us-east-1a
          use2: us-east-2a
          usw1: us-west-1a
          usw2: us-west-2a
          cac: ca-central-1a
          sae: sa-east-1a
          afs: af-south-1a
          euc: eu-central-1a
          euw1: eu-west-1a
          euw2: eu-west-2a
          euw3: eu-west-3a
          eus: eu-south-1a
          eun: eu-north-1a
          ape: ap-east-1a
          aps1: ap-south-1a
          apne1: ap-northeast-1a
          apne2: ap-northeast-2a
          apne3: ap-northeast-3a
          apse1: ap-southeast-1a
          apse2: ap-southeast-2a
          apse3: ap-southeast-3a
  - name: snet-zone-2
    patches:
    - fromFieldPath: spec.parameters.region
      toFieldPath: metadata.labels.zone
      transforms:
      - type: map
        map:
          use1: us-east-1b
          use2: us-east-2b
          usw1: us-west-1a       # No b zone
          usw2: us-west-2b
          cac: ca-central-1b
          sae: sa-east-1b
          afs: af-south-1b
          euc: eu-central-1b
          euw1: eu-west-1b
          euw2: eu-west-2b
          euw3: eu-west-3b
          eus: eu-south-1b
          eun: eu-north-1b
          ape: ap-east-1b
          aps1: ap-south-1b
          apne1: ap-northeast-1d # No b zone
          apne2: ap-northeast-2b
          apne3: ap-northeast-3b
          apse1: ap-southeast-1b
          apse2: ap-southeast-2b
          apse3: ap-southeast-3b
    - fromFieldPath: spec.parameters.region
      toFieldPath: spec.forProvider.availabilityZone
      transforms:
      - type: map
        map:
          use1: us-east-1b
          use2: us-east-2b
          usw1: us-west-1a       # No b zone
          usw2: us-west-2b
          cac: ca-central-1b
          sae: sa-east-1b
          afs: af-south-1b
          euc: eu-central-1b
          euw1: eu-west-1b
          euw2: eu-west-2b
          euw3: eu-west-3b
          eus: eu-south-1b
          eun: eu-north-1b
          ape: ap-east-1b
          aps1: ap-south-1b
          apne1: ap-northeast-1d # No b zone
          apne2: ap-northeast-2b
          apne3: ap-northeast-3b
          apse1: ap-southeast-1b
          apse2: ap-southeast-2b
          apse3: ap-southeast-3b
  - name: snet-zone-3
    patches:
    - fromFieldPath: spec.parameters.region
      toFieldPath: metadata.labels.zone
      transforms:
      - type: map
        map:
          use1: us-east-1c
          use2: us-east-2c
          usw1: us-west-1c
          usw2: us-west-2c
          cac: ca-central-1b # No c zone; d zone not support FG
          sae: sa-east-1c
          afs: af-south-1c
          euc: eu-central-1c
          euw1: eu-west-1c
          euw2: eu-west-2c
          euw3: eu-west-3c
          eus: eu-south-1c
          eun: eu-north-1c
          ape: ap-east-1c
          aps1: ap-south-1c
          apne1: ap-northeast-1c
          apne2: ap-northeast-2c
          apne3: ap-northeast-3c
          apse1: ap-southeast-1c
          apse2: ap-southeast-2c
          apse3: ap-southeast-3c
    - fromFieldPath: spec.parameters.region
      toFieldPath: spec.forProvider.availabilityZone
      transforms:
      - type: map
        map:
          use1: us-east-1c
          use2: us-east-2c
          usw1: us-west-1c
          usw2: us-west-2c
          cac: ca-central-1b # No c zone; d zone not support FG
          sae: sa-east-1c
          afs: af-south-1c
          euc: eu-central-1c
          euw1: eu-west-1c
          euw2: eu-west-2c
          euw3: eu-west-3c
          eus: eu-south-1c
          eun: eu-north-1c
          ape: ap-east-1c
          aps1: ap-south-1c
          apne1: ap-northeast-1c
          apne2: ap-northeast-2c
          apne3: ap-northeast-3c
          apse1: ap-southeast-1c
          apse2: ap-southeast-2c
          apse3: ap-southeast-3c
  - name: route-zone-1
    patches:
    - fromFieldPath: spec.parameters.region
      toFieldPath: spec.forProvider.subnetIdSelector.matchLabels.zone
      transforms:
      - type: map
        map:
          use1: us-east-1a
          use2: us-east-2a
          usw1: us-west-1a
          usw2: us-west-2a
          cac: ca-central-1a
          sae: sa-east-1a
          afs: af-south-1a
          euc: eu-central-1a
          euw1: eu-west-1a
          euw2: eu-west-2a
          euw3: eu-west-3a
          eus: eu-south-1a
          eun: eu-north-1a
          ape: ap-east-1a
          aps1: ap-south-1a
          apne1: ap-northeast-1a
          apne2: ap-northeast-2a
          apne3: ap-northeast-3a
          apse1: ap-southeast-1a
          apse2: ap-southeast-2a
          apse3: ap-southeast-3a
  - name: route-zone-2
    patches:
    - fromFieldPath: spec.parameters.region
      toFieldPath: spec.forProvider.subnetIdSelector.matchLabels.zone
      transforms:
      - type: map
        map:
          use1: us-east-1b
          use2: us-east-2b
          usw1: us-west-1a       # No b zone
          usw2: us-west-2b
          cac: ca-central-1b
          sae: sa-east-1b
          afs: af-south-1b
          euc: eu-central-1b
          euw1: eu-west-1b
          euw2: eu-west-2b
          euw3: eu-west-3b
          eus: eu-south-1b
          eun: eu-north-1b
          ape: ap-east-1b
          aps1: ap-south-1b
          apne1: ap-northeast-1d # No b zone
          apne2: ap-northeast-2b
          apne3: ap-northeast-3b
          apse1: ap-southeast-1b
          apse2: ap-southeast-2b
          apse3: ap-southeast-3b
  - name: route-zone-3
    patches:
    - fromFieldPath: spec.parameters.region
      toFieldPath: spec.forProvider.subnetIdSelector.matchLabels.zone
      transforms:
      - type: map
        map:
          use1: us-east-1c
          use2: us-east-2c
          usw1: us-west-1c
          usw2: us-west-2c
          cac: ca-central-1b # No c zone; d zone not support FG
          sae: sa-east-1c
          afs: af-south-1c
          euc: eu-central-1c
          euw1: eu-west-1c
          euw2: eu-west-2c
          euw3: eu-west-3c
          eus: eu-south-1c
          eun: eu-north-1c
          ape: ap-east-1c
          aps1: ap-south-1c
          apne1: ap-northeast-1c
          apne2: ap-northeast-2c
          apne3: ap-northeast-3c
          apse1: ap-southeast-1c
          apse2: ap-southeast-2c
          apse3: ap-southeast-3c

  resources:
  # IAM Roles
  - name: iamrole-controlplane
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: Role
      spec:
        forProvider:
          assumeRolePolicy: |
            {
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Effect": "Allow",
                      "Principal": {
                          "Service": [
                              "eks.amazonaws.com"
                          ]
                      },
                      "Action": [
                          "sts:AssumeRole"
                      ]
                  }
              ]
            }
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-controlplane"
    - fromFieldPath: spec.id
      toFieldPath: metadata.labels.role
      transforms:
      - type: string
        string:
          fmt: "%s-controlplane"
  - name: iamrole-nodegroup
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: Role
      spec:
        forProvider:
          assumeRolePolicy: |
            {
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Effect": "Allow",
                      "Principal": {
                          "Service": [
                              "ec2.amazonaws.com"
                          ]
                      },
                      "Action": [
                          "sts:AssumeRole"
                      ]
                  }
              ]
            }
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-nodegroup"
    - fromFieldPath: spec.id
      toFieldPath: metadata.labels.role
      transforms:
      - type: string
        string:
          fmt: "%s-nodegroup"
  - name: iamrole-fargateprofile
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: Role
      spec:
        forProvider:
          assumeRolePolicy: |
            {
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Effect": "Allow",
                      "Principal": {
                          "Service": [
                              "eks-fargate-pods.amazonaws.com"
                          ]
                      },
                      "Action": [
                          "sts:AssumeRole"
                      ]
                  }
              ]
            }
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-fargateprofile"
    - fromFieldPath: spec.id
      toFieldPath: metadata.labels.role
      transforms:
      - type: string
        string:
          fmt: "%s-fargateprofile"

  # IAM ROLE POLICY ATTCHMENTS
  - name: iamrolepolicy-cp-001
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: RolePolicyAttachment
      spec:
        forProvider:
          policyArn: arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
          roleSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-cp-001"
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.roleSelector.matchLabels.role
      transforms:
      - type: string
        string:
          fmt: "%s-controlplane"
  - name: iamrolepolicy-cp-002
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: RolePolicyAttachment
      spec:
        forProvider:
          policyArn: arn:aws:iam::aws:policy/AmazonEKSServicePolicy
          roleSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-cp-002"
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.roleSelector.matchLabels.role
      transforms:
      - type: string
        string:
          fmt: "%s-controlplane"
  - name:  iamrolepolicy-ng-001
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: RolePolicyAttachment
      spec:
        forProvider:
          policyArn: arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
          roleSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-ng-001"
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.roleSelector.matchLabels.role
      transforms:
      - type: string
        string:
          fmt: "%s-nodegroup"
  - name: iamrolepolicy-ng-002
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: RolePolicyAttachment
      spec:
        forProvider:
          policyArn: arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
          roleSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-ng-002"
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.roleSelector.matchLabels.role
      transforms:
      - type: string
        string:
          fmt: "%s-nodegroup"
  - name: iamrolepolicy-ng-003
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: RolePolicyAttachment
      spec:
        forProvider:
          policyArn: arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
          roleSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-ng-003"
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.roleSelector.matchLabels.role
      transforms:
      - type: string
        string:
          fmt: "%s-nodegroup"
  - name:  iamrolepolicy-fp-001
    base:
      apiVersion: iam.aws.upbound.io/v1beta1
      kind: RolePolicyAttachment
      spec:
        forProvider:
          policyArn: arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy
          roleSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-fp-001"
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.roleSelector.matchLabels.role
      transforms:
      - type: string
        string:
          fmt: "%s-fargateprofile"

  - name: ec2vpc
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: VPC
      spec:
        forProvider:
          cidrBlock: 10.0.0.0/16
          tags:
            Name: eks-cluster
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name

  - name: ec2sg-ng
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: SecurityGroup
      spec:
        forProvider:
          description: Cluster communication with worker nodes
          name: ekscluster-sg
          vpcIdSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-sg"

  - name: ec2sg-rule
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: SecurityGroupRule
      spec:
        forProvider:
          securityGroupIdSelector:
            matchControllerRef: true
          type: egress
          protocol: "-1"
          fromPort: 0
          toPort: 0
          cidrBlocks:
          - "0.0.0.0/0"
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-sgrule"

  - name: ec2snet-pub-a
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: Subnet
      metadata:
        labels:
          access: public
      spec:
        forProvider:
          cidrBlock: 10.0.0.0/24
          vpcIdSelector:
            matchControllerRef: true
          mapPublicIpOnLaunch: true
          tags:
            Name: eks-snet
            kubernetes.io/role/elb: "1"
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: snet-zone-1
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-pub-a"
  - name: ec2snet-pub-b
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: Subnet
      metadata:
        labels:
          access: public
      spec:
        forProvider:
          cidrBlock: 10.0.1.0/24
          vpcIdSelector:
            matchControllerRef: true
          mapPublicIpOnLaunch: true
          tags:
            Name: eks-snet
            kubernetes.io/role/elb: "1"
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: snet-zone-2
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-pub-b"
  - name: ec2snet-pub-c
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: Subnet
      metadata:
        labels:
          access: public
      spec:
        forProvider:
          cidrBlock: 10.0.2.0/24
          vpcIdSelector:
            matchControllerRef: true
          mapPublicIpOnLaunch: true
          tags:
            Name: eks-snet
            kubernetes.io/role/elb: "1"
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: snet-zone-3
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-pub-c"

  - name: ec2snet-prv-a
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: Subnet
      metadata:
        labels:
          access: private
      spec:
        forProvider:
          cidrBlock: 10.0.100.0/24
          vpcIdSelector:
            matchControllerRef: true
          mapPublicIpOnLaunch: false
          tags:
            Name: eks-snet
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: snet-zone-1
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-prv-a"
  - name: ec2snet-prv-b
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: Subnet
      metadata:
        labels:
          access: private
      spec:
        forProvider:
          cidrBlock: 10.0.101.0/24
          vpcIdSelector:
            matchControllerRef: true
          mapPublicIpOnLaunch: false
          tags:
            Name: eks-snet
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: snet-zone-2
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-prv-b"
  - name: ec2snet-prv-c
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: Subnet
      metadata:
        labels:
          access: private
      spec:
        forProvider:
          cidrBlock: 10.0.102.0/24
          vpcIdSelector:
            matchControllerRef: true
          mapPublicIpOnLaunch: true
          tags:
            Name: eks-snet
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: snet-zone-3
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-prv-c"

  - name: ec2-ig
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: InternetGateway
      spec:
        forProvider:
          vpcIdSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name

  - name: ec2-rt
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: RouteTable
      spec:
        forProvider:
          vpcIdSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-rt"
  - name: ec2-rt-route
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: Route
      spec:
        forProvider:
          routeTableIdSelector:
            matchControllerRef: true
          gatewayIdSelector:
            matchControllerRef: true
          destinationCidrBlock: 0.0.0.0/0
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-route"
  - name: ec2-rt-assoc-a
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: RouteTableAssociation
      spec:
        forProvider:
          routeTableIdSelector:
            matchControllerRef: true
          subnetIdSelector:
            matchControllerRef: true
            matchLabels:
              access: public
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: route-zone-1
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-rta-a"
  - name: ec2-rt-assoc-b
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: RouteTableAssociation
      spec:
        forProvider:
          routeTableIdSelector:
            matchControllerRef: true
          subnetIdSelector:
            matchControllerRef: true
            matchLabels:
              access: public
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: route-zone-2
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-rta-b"
  - name: ec2-rt-assoc-c
    base:
      apiVersion: ec2.aws.upbound.io/v1beta1
      kind: RouteTableAssociation
      spec:
        forProvider:
          routeTableIdSelector:
            matchControllerRef: true
          subnetIdSelector:
            matchControllerRef: true
            matchLabels:
              access: public
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - type: PatchSet
      patchSetName: route-zone-3
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "%s-rta-c"

  - name: ekscluster
    base:
      apiVersion: eks.aws.upbound.io/v1beta1
      kind: Cluster
      spec:
        forProvider:
          roleArnSelector:
            matchControllerRef: true
          vpcConfig:
          - endpointPrivateAccess: true
            endpointPublicAccess: true
            subnetIdSelector:
              matchControllerRef: true
        # writeConnectionSecretToRef:
        #   namespace: upbound-system
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    # - fromFieldPath: spec.id
    #   toFieldPath: metadata.name
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
      - type: string
        string:
          fmt: "cluster-%s"
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.roleArnSelector.matchLabels.role
      transforms:
        - type: string
          string:
            fmt: "%s-controlplane"
    - fromFieldPath: spec.parameters.version
      toFieldPath: spec.forProvider.version
    # - fromFieldPath: spec.id
    #   toFieldPath: spec.writeConnectionSecretToRef.name
    #   transforms:
    #     - type: string
    #       string:
    #         fmt: "%s-ekscluster"
    # - fromFieldPath: spec.writeConnectionSecretToRef.namespace
    - type: ToCompositeFieldPath
      fromFieldPath: metadata.name
      toFieldPath: status.clusterName
    - type: ToCompositeFieldPath
      fromFieldPath: status.atProvider.status
      toFieldPath: status.controlPlaneStatus
    connectionDetails:
    - fromConnectionSecretKey: kubeconfig
    readinessChecks:
    - type: MatchString
      fieldPath: status.atProvider.status
      matchString: ACTIVE

  - name: eksnode
    base:
      apiVersion: eks.aws.upbound.io/v1beta1
      kind: NodeGroup
      spec:
        forProvider:
          clusterNameSelector:
            matchControllerRef: true
          nodeRoleArnSelector:
            matchControllerRef: true
          subnetIdSelector:
            matchControllerRef: true
            matchLabels:
              access: public
          scalingConfig:
          - maxSize: 10
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
    - fromFieldPath: spec.parameters.nodeSize
      toFieldPath: spec.forProvider.instanceTypes[0]
      transforms:
        - type: map
          map:
            small: t3.small
            medium: t3.medium
            large: t3.large
    - fromFieldPath: spec.parameters.nodeCount
      toFieldPath: spec.forProvider.scalingConfig[0].minSize
    - fromFieldPath: spec.parameters.nodeCount
      toFieldPath: spec.forProvider.scalingConfig[0].desiredSize
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.nodeRoleArnSelector.matchLabels.role
      transforms:
        - type: string
          string:
            fmt: "%s-nodegroup"
    - type: ToCompositeFieldPath
      fromFieldPath: status.atProvider.status
      toFieldPath: status.nodePoolStatus
    readinessChecks:
    - type: MatchString
      fieldPath: status.atProvider.status
      matchString: ACTIVE

  - name: eksfargate
    base:
      apiVersion: eks.aws.upbound.io/v1beta1
      kind: FargateProfile
      spec:
        forProvider:
          clusterNameSelector:
            matchControllerRef: true
          podExecutionRoleArnSelector:
            matchControllerRef: true
          subnetIdSelector:
            matchControllerRef: true
            matchLabels:
              access: private
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
    - fromFieldPath: spec.parameters.fargateNamespace
      toFieldPath: spec.forProvider.selector[0].namespace
    - fromFieldPath: spec.id
      toFieldPath: spec.forProvider.podExecutionRoleArnSelector.matchLabels.role
      transforms:
        - type: string
          string:
            fmt: "%s-fargateprofile"
    - type: ToCompositeFieldPath
      fromFieldPath: status.atProvider.status
      toFieldPath: status.fargateProfileStatus
    readinessChecks:
    - type: MatchString
      fieldPath: status.atProvider.status
      matchString: ACTIVE

  - name: kubernetesClusterAuth
    base:
      apiVersion: eks.aws.upbound.io/v1beta1
      kind: ClusterAuth
      spec:
        forProvider:
          clusterNameSelector:
            matchControllerRef: true
        providerConfigRef:
          name: aws-uxp-provider
    patches:
    - type: PatchSet
      patchSetName: region
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
    - fromFieldPath: spec.writeConnectionSecretToRef.namespace
    - fromFieldPath: spec.id
      toFieldPath: spec.writeConnectionSecretToRef.name
      transforms:
        - type: string
          string:
            fmt: "%s-ekscluster"
    connectionDetails:
    - fromConnectionSecretKey: kubeconfig

  - name: kubernetes
    base:
      apiVersion: kubernetes.crossplane.io/v1alpha1
      kind: ProviderConfig
      spec:
        credentials:
          source: Secret
          secretRef:
            key: kubeconfig
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
    - fromFieldPath: spec.writeConnectionSecretToRef.namespace
      toFieldPath: spec.credentials.secretRef.namespace
    - fromFieldPath: spec.id
      toFieldPath: spec.credentials.secretRef.name
      transforms:
        - type: string
          string:
            fmt: "%s-ekscluster"
    readinessChecks:
      - type: None
  - name: k8s-ns-xp
    base:
      apiVersion: kubernetes.crossplane.io/v1alpha1
      kind: Object
      spec:
        forProvider:
          manifest:
            apiVersion: v1
            kind: Namespace
            metadata:
              name: upbound-system
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
        - type: string
          string:
            fmt: "%s-ns-xp"
    - fromFieldPath: spec.id
      toFieldPath: spec.providerConfigRef.name

  - name: helm
    base:
        apiVersion: helm.crossplane.io/v1beta1
        kind: ProviderConfig
        spec:
          credentials:
            source: Secret
            secretRef:
              key: kubeconfig
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
    - fromFieldPath: spec.writeConnectionSecretToRef.namespace
      toFieldPath: spec.credentials.secretRef.namespace
    - fromFieldPath: spec.id
      toFieldPath: spec.credentials.secretRef.name
      transforms:
        - type: string
          string:
            fmt: "%s-ekscluster"
    readinessChecks:
      - type: None
  - name: helm-uxp
    base:
        apiVersion: helm.crossplane.io/v1beta1
        kind: Release
        spec:
          rollbackLimit: 3
          forProvider:
            namespace: upbound-system
            chart:
              name: universal-crossplane
              repository: https://charts.upbound.io/stable
              version: "1.9.1-up.2"
    patches:
    - fromFieldPath: spec.id
      toFieldPath: metadata.name
      transforms:
        - type: string
          string:
            fmt: "%s-uxp"
    - fromFieldPath: spec.id
      toFieldPath: spec.providerConfigRef.name