Compute — konfig-konector Docs

KeyPair # ✅ Working

Creates an EC2 key pair. The private key material is returned by AWS only once at creation time and is not stored in the CR status. Use AWS Secrets Manager or the AWS CLI to retrieve and store the private key immediately after creation.

Spec

Field	Type	Required	Description
keyName	string	✅	The name of the EC2 key pair. Immutable after creation.
keyType	string		Key type: `rsa` or `ed25519`. Default: `rsa`. Immutable after creation.
tags	map[string]string		AWS tags applied to the key pair.

Status

Field	Description
keyPairId	The ID of the key pair.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example

apiVersion: aws.konfig.io/v1alpha1
kind: KeyPair
metadata:
  name: prod-bastion-key
  namespace: compute
spec:
  keyName: prod-bastion-key
  keyType: ed25519
  tags:
    env: prod
    purpose: bastion

Notes

The private key material is NOT stored in the CR status. AWS returns it only once during CreateKeyPair. Store it securely immediately after first sync using the AWS console, CLI, or Systems Manager Parameter Store.
keyType is immutable after creation.
For automated access, consider using AWS Systems Manager Session Manager instead of SSH key pairs.

Deletion

Immediate. The key pair is deleted from EC2. Existing instances using this key pair are unaffected — deletion only prevents new instances from using it for SSH.

LaunchTemplate # ✅ Working

Creates an EC2 launch template. Spec changes create a new version rather than replacing the template, preserving version history. The template name is immutable.

Spec

Field	Type	Required	Description
launchTemplateName	string	✅	The name of the launch template. Immutable after creation.
imageId	string	✅	The AMI ID to use for instances (e.g. `ami-0abcdef1234567890`).
instanceType	string	✅	The instance type (e.g. `t3.medium`, `m5.xlarge`).
keyName	string		Name of the EC2 key pair for SSH access.
securityGroupRefs	[]string		Names of `SecurityGroup` CRs to attach to instances.
userData	string		Base64-encoded user data script to run on instance launch.
iamInstanceProfile	string		ARN or name of the IAM instance profile to attach to instances.
blockDeviceMappings	[]BlockDevice		EBS volume configurations for the instance.
blockDeviceMappings[].deviceName	string		Device name (e.g. `/dev/xvda`).
blockDeviceMappings[].volumeSize	int32		Volume size in GiB.
blockDeviceMappings[].volumeType	string		Volume type: `gp2`, `gp3`, `io1`, `io2`, etc.
blockDeviceMappings[].encrypted	bool		Encrypt the EBS volume.
tags	map[string]string		AWS tags applied to the launch template (and propagated to instances).

Status

Field	Description
launchTemplateId	The ID of the launch template.
latestVersionNumber	The version number of the most recently created version.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example

apiVersion: aws.konfig.io/v1alpha1
kind: LaunchTemplate
metadata:
  name: prod-worker-lt
  namespace: compute
spec:
  launchTemplateName: prod-worker-lt
  imageId: ami-0abcdef1234567890
  instanceType: m5.xlarge
  keyName: prod-bastion-key
  securityGroupRefs:
    - web-sg
  iamInstanceProfile: arn:aws:iam::123456789012:instance-profile/worker-profile
  userData: IyEvYmluL2Jhc2gKZWNobyAiSGVsbG8gV29ybGQi
  blockDeviceMappings:
    - deviceName: /dev/xvda
      volumeSize: 50
      volumeType: gp3
      encrypted: true
  tags:
    env: prod
    role: worker

Notes

Spec changes create a new launch template version using CreateLaunchTemplateVersion with the new version set as default. The template itself is never replaced.
launchTemplateName is immutable after creation.
When used with an AutoScalingGroup, updating the launch template version triggers an instance refresh.

Deletion

Immediate. The launch template and all its versions are deleted. Existing instances launched from this template are unaffected.

AutoScalingGroup # ✅ Working

Creates an Auto Scaling Group with a launch template reference. Manages min/max/desired capacity and subnet placement. Target tracking scaling policies are not managed by this resource.

Spec

Field	Type	Required	Description
autoScalingGroupName	string	✅	The name of the Auto Scaling Group. Immutable after creation.
launchTemplateRef.name	string	✅	Name of the `LaunchTemplate` CR to use.
launchTemplateRef.id	string		Direct launch template ID (alternative to `launchTemplateRef.name`).
launchTemplateRef.version	string		Launch template version. Use `$Latest` or `$Default`, or a specific version number. Default: `$Latest`.
minSize	int32	✅	Minimum number of instances in the group.
maxSize	int32	✅	Maximum number of instances in the group.
desiredCapacity	int32	✅	Desired number of instances. Must be between minSize and maxSize.
vpcZoneIdentifier	[]SubnetRef	✅	List of subnet references (CR names or direct IDs) to distribute instances across.
targetGroupArns	[]string		ARNs of target groups to register instances with on launch.
tags	map[string]string		AWS tags applied to the ASG and propagated to instances.

Status

Field	Description
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example

apiVersion: aws.konfig.io/v1alpha1
kind: AutoScalingGroup
metadata:
  name: prod-web-asg
  namespace: compute
spec:
  autoScalingGroupName: prod-web-asg
  launchTemplateRef:
    name: prod-worker-lt
    version: $Latest
  minSize: 2
  maxSize: 10
  desiredCapacity: 3
  vpcZoneIdentifier:
    - prod-private-subnet-1a
    - prod-private-subnet-1b
  targetGroupArns:
    - arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/prod-web/abc123
  tags:
    env: prod
    role: web

Notes

Updates to min/max/desired use UpdateAutoScalingGroup. Changing the launch template version triggers an instance refresh.
Scaling policies (target tracking, step scaling) are not managed by this resource — create them separately through the AWS console or CLI.
The ASG name is immutable after creation.

Deletion

Immediate. The controller force-deletes the ASG and terminates all instances in it. Running instances are terminated without draining.

EC2Instance # ✅ Working ⏱ async

Creates and manages a single EC2 instance. Best suited for long-lived singleton instances such as bastion hosts. For fleets, use AutoScalingGroup instead.

⏱ Async — instance launch takes 30–120 seconds depending on AMI and user data. Controller polls every 15 seconds until the instance reaches the running state.

Spec

Field	Type	Required	Description
imageId	string	✅	The AMI ID to launch (e.g. `ami-0abcdef1234567890`).
instanceType	string	✅	Instance type (e.g. `t3.micro`, `m5.large`).
keyName	string		EC2 key pair name for SSH access.
subnetRef.name	string		Name of the `Subnet` CR to place the instance in.
subnetRef.id	string		Direct subnet ID (alternative to `subnetRef.name`).
securityGroupRefs	[]string		Names of `SecurityGroup` CRs to attach.
iamInstanceProfile	string		ARN or name of the IAM instance profile.
userData	string		Base64-encoded user data script.
associatePublicIpAddress	bool		Associate a public IPv4 address with the instance. Default: false.
tags	map[string]string		AWS tags applied to the instance and its volumes.

Status

Field	Description
instanceId	The EC2 instance ID (e.g. `i-0abc123`).
privateIp	Private IPv4 address of the instance.
publicIp	Public IPv4 address (if `associatePublicIpAddress: true`).
state	Current instance state: `pending`, `running`, `stopping`, `stopped`, `terminated`.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example

apiVersion: aws.konfig.io/v1alpha1
kind: EC2Instance
metadata:
  name: prod-bastion
  namespace: compute
spec:
  imageId: ami-0abcdef1234567890
  instanceType: t3.micro
  keyName: prod-bastion-key
  subnetRef:
    name: prod-public-subnet-1a
  securityGroupRefs:
    - bastion-sg
  associatePublicIpAddress: true
  iamInstanceProfile: bastion-instance-profile
  tags:
    env: prod
    role: bastion
    Name: prod-bastion

Notes

For fleets or auto-healing, use AutoScalingGroup instead of multiple EC2Instance CRs.
If the instance is terminated manually in AWS, the controller will recreate it on the next reconcile cycle using the same spec.
Changes to imageId do not apply to the running instance — they only take effect when the instance is replaced. To apply an AMI change, delete the instance (it will be recreated with the new AMI).

Deletion

Immediate. The instance is terminated. EBS root volume is deleted by default based on the AMI's block device mapping settings.