ACM

6 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

ACMAccount # CLOUD CONTROL · AWS::CertificateManager::Account ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide ACM settings singleton. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. ACMAccount manages AWS::CertificateManager::Account through the AWS Cloud Control API.

kubectl get acmaccounts · example on GitHub

Example

# ACMAccount — ACM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/acm.html#acmaccount
apiVersion: aws.konfig.io/v1alpha1
kind: ACMAccount
metadata:
  name: example-acmaccount
  namespace: default
spec:
  expiryEventsConfiguration:
    daysBeforeExpiry: 1
  providerRef:
    name: example-acmaccount
    region: us-east-1

Spec

Field	Type	Required	Description
`expiryEventsConfiguration`	object	yes	ACMAccountExpiryEventsConfiguration is a nested property type of AWS::CertificateManager::Account.
`expiryEventsConfiguration.daysBeforeExpiry`	integer	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`accountId`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ACMAcmeDomainValidation # CLOUD CONTROL · AWS::CertificateManager::AcmeDomainValidation

ACMAcmeDomainValidation manages AWS::CertificateManager::AcmeDomainValidation through the AWS Cloud Control API.

kubectl get acmacmedomainvalidations · example on GitHub

Example

# ACMAcmeDomainValidation — ACM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/acm.html#acmacmedomainvalidation
apiVersion: aws.konfig.io/v1alpha1
kind: ACMAcmeDomainValidation
metadata:
  name: example-acmacmedomainvalidation
  namespace: default
spec:
  acmeEndpointArn: arn:aws:iam::123456789012:role/example-role
  domainName: example-acmacmedomainvalidation
  prevalidationOptions:
    dnsPrevalidation:
      domainScope:
        exactDomain: example
        subdomains: example
        wildcards: example
  providerRef:
    name: example-acmacmedomainvalidation
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`acmeEndpointArn`	string	yes	The ARN of the ACME endpoint this domain validation is associated with.
`domainName`	string	yes	The domain name to validate.
`prevalidationOptions`	object	yes	ACMAcmeDomainValidationPrevalidationOptions is a nested property type of AWS::CertificateManager::AcmeDomainValidation.
`prevalidationOptions.dnsPrevalidation`	object	yes	ACMAcmeDomainValidationDnsPrevalidationOptions is a nested property type of AWS::CertificateManager::AcmeDomainValidation.
`prevalidationOptions.dnsPrevalidation.domainScope`	object	—	ACMAcmeDomainValidationDomainScope is a nested property type of AWS::CertificateManager::AcmeDomainValidation.
`prevalidationOptions.dnsPrevalidation.domainScope.exactDomain`	string	—	Whether certificates may be issued for the exact domain.
`prevalidationOptions.dnsPrevalidation.domainScope.subdomains`	string	—	Whether certificates may be issued for subdomains of the domain.
`prevalidationOptions.dnsPrevalidation.domainScope.wildcards`	string	—	Whether wildcard certificates may be issued for the domain.
`prevalidationOptions.dnsPrevalidation.hostedZoneId`	string	—	The Route 53 hosted zone ID for automatic DNS record management.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags associated with the domain validation.
`tags[].key`	string	yes	The key name of the tag.
`tags[].value`	string	yes	The value for the tag.

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the domain validation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ACMAcmeEndpoint # CLOUD CONTROL · AWS::CertificateManager::AcmeEndpoint

ACMAcmeEndpoint manages AWS::CertificateManager::AcmeEndpoint through the AWS Cloud Control API.

kubectl get acmacmeendpoints · example on GitHub

Example

# ACMAcmeEndpoint — ACM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/acm.html#acmacmeendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: ACMAcmeEndpoint
metadata:
  name: example-acmacmeendpoint
  namespace: default
spec:
  authorizationBehavior: example
  certificateAuthority:
    publicCertificateAuthority:
      allowedKeyAlgorithms:
      - example
  certificateTags:
  - key: example
    value: example
  contact: example
  providerRef:
    name: example-acmacmeendpoint
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`authorizationBehavior`	string	yes	The authorization behavior for the ACME endpoint.
`certificateAuthority`	object	yes	ACMAcmeEndpointCertificateAuthority is a nested property type of AWS::CertificateManager::AcmeEndpoint.
`certificateAuthority.publicCertificateAuthority`	object	yes	ACMAcmeEndpointPublicCertificateAuthority is a nested property type of AWS::CertificateManager::AcmeEndpoint.
`certificateAuthority.publicCertificateAuthority.allowedKeyAlgorithms`	array<string>	—	The allowed key algorithms for certificates issued via this endpoint.
`certificateTags`	array<object>	—	Tags applied to certificates issued via this endpoint.
`certificateTags[].key`	string	yes
`certificateTags[].value`	string	yes
`contact`	string	—	Whether contact information is required for the ACME endpoint.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags associated with the ACME endpoint.
`tags[].key`	string	yes	The key name of the tag.
`tags[].value`	string	yes	The value for the tag.

Status

Field	Type	Required	Description
`acmeEndpointArn`	string	—	The Amazon Resource Name (ARN) of the ACME endpoint.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`endpointUrl`	string	—	The ACME directory URL for the endpoint.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ACMAcmeExternalAccountBinding # CLOUD CONTROL · AWS::CertificateManager::AcmeExternalAccountBinding

ACMAcmeExternalAccountBinding manages AWS::CertificateManager::AcmeExternalAccountBinding through the AWS Cloud Control API.

kubectl get acmacmeexternalaccountbindings · example on GitHub

Example

# ACMAcmeExternalAccountBinding — ACM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/acm.html#acmacmeexternalaccountbinding
apiVersion: aws.konfig.io/v1alpha1
kind: ACMAcmeExternalAccountBinding
metadata:
  name: example-acmacmeexternalaccountbinding
  namespace: default
spec:
  acmeEndpointArn: arn:aws:iam::123456789012:role/example-role
  expiration:
    type: example
    value: 1
  providerRef:
    name: example-acmacmeexternalaccountbinding
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`acmeEndpointArn`	string	yes	The ARN of the ACME endpoint this binding is associated with.
`expiration`	object	—	Create-only in AWS: changing it requires replacing the resource.
`expiration.type`	string	yes	The time unit for the expiration value.
`expiration.value`	integer	yes	The expiration value.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleArn`	string	yes	The IAM role ARN for cross-account access.
`tags`	array<object>	—	Tags associated with the external account binding.
`tags[].key`	string	yes	The key name of the tag.
`tags[].value`	string	yes	The value for the tag.

Status

Field	Type	Required	Description
`acmeExternalAccountBindingArn`	string	—	The Amazon Resource Name (ARN) of the external account binding.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

Certificate # GA

Certificate is the Schema for managing ACM Certificates.

kubectl get certificates · example on GitHub

Example

# Certificate — ACM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/acm.html#certificate
apiVersion: aws.konfig.io/v1alpha1
kind: Certificate
metadata:
  name: example-certificate
  namespace: default
spec:
  domainName: example-certificate
  providerRef:
    name: example-certificate
    region: us-east-1
  subjectAlternativeNames:
  - example
  tags:
    environment: dev
    team: platform
  validationMethod: DNS

Spec

Field	Type	Required	Description
`domainName`	string	yes	DomainName is the primary domain name for the certificate.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subjectAlternativeNames`	array<string>	—	SubjectAlternativeNames are additional domain names for the certificate.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`validationMethod`	enum	—	ValidationMethod is the method used to validate domain ownership. Allowed: `DNS, EMAIL`

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the ACM certificate.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`certificateStatus`	string	—	Status is the current status of the certificate (e.g.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

CertificateValidation # GA

CertificateValidation polls the ACM certificate status until it is ISSUED.

kubectl get certificatevalidations · example on GitHub

Example

# CertificateValidation — ACM
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/acm.html#certificatevalidation
apiVersion: aws.konfig.io/v1alpha1
kind: CertificateValidation
metadata:
  name: example-certificatevalidation
  namespace: default
spec:
  certificateRef:
    name: example-certificate
  providerRef:
    name: example-certificatevalidation
    region: us-east-1

Spec

Field	Type	Required	Description
`certificateRef`	object	yes	CertificateRef references the Certificate CR to watch.
`certificateRef.name`	string	—	Name of the resource in the same namespace.
`certificateRef.namespace`	string	—	Namespace of the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`validationStatus`	string	—	ValidationStatus is the ACM certificate status (e.g.