ECR
11 resource kinds. Generated from the operator's CRD schemas.
aws.konfig.io/v1alpha1
ECRLifecyclePolicy # GA
ECRLifecyclePolicy is the Schema for managing ECR Lifecycle Policies.
kubectl get ecrlifecyclepolicies · example on GitHub
Example
# ECRLifecyclePolicy — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrlifecyclepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: ECRLifecyclePolicy
metadata:
name: example-ecrlifecyclepolicy
namespace: default
spec:
lifecyclePolicyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
"Resource": "*"}]}'
providerRef:
name: example-ecrlifecyclepolicy
region: us-east-1
repositoryRef:
name: example-ecrlifecyclepolicy
repositoryName: example-ecrlifecyclepolicy
Spec
| Field | Type | Required | Description |
|---|---|---|---|
lifecyclePolicyDocument | string | yes | LifecyclePolicyDocument is the JSON lifecycle policy. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
repositoryRef | object | yes | RepositoryRef references the ECR repository. |
repositoryRef.name | string | — | Name of an ECRRepository CR in the same namespace. |
repositoryRef.repositoryName | string | — | RepositoryName is a direct AWS ECR repository name. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
ECRPublicRepository # CLOUD CONTROL · AWS::ECR::PublicRepository
ECRPublicRepository manages AWS::ECR::PublicRepository through the AWS Cloud Control API.
kubectl get ecrpublicrepositories · example on GitHub
Example
# ECRPublicRepository — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrpublicrepository
apiVersion: aws.konfig.io/v1alpha1
kind: ECRPublicRepository
metadata:
name: example-ecrpublicrepository
namespace: default
spec:
providerRef:
name: example-ecrpublicrepository
region: us-east-1
repositoryCatalogData:
aboutText: example
architectures:
- example
operatingSystems:
- example
repositoryDescription: Managed by konfig-konector
usageText: example
repositoryName: example-ecrpublicrepository
tags:
- key: example
value: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
repositoryCatalogData | object | — | The details about the repository that are publicly visible in the Amazon ECR Public Gallery. |
repositoryCatalogData.aboutText | string | — | |
repositoryCatalogData.architectures | array<string> | — | |
repositoryCatalogData.operatingSystems | array<string> | — | |
repositoryCatalogData.repositoryDescription | string | — | |
repositoryCatalogData.usageText | string | — | |
repositoryName | string | — | The name to use for the public repository. |
repositoryPolicyText | object | — | The JSON repository policy text to apply to the public repository. |
tags | array<object> | — | An array of key-value pairs to apply to this resource. |
tags[].key | string | yes | |
tags[].value | string | yes |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | Read-only: reported by AWS after creation. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
ECRPullThroughCacheRule # CLOUD CONTROL · AWS::ECR::PullThroughCacheRule
ECRPullThroughCacheRule manages AWS::ECR::PullThroughCacheRule through the AWS Cloud Control API.
kubectl get ecrpullthroughcacherules · example on GitHub
Example
# ECRPullThroughCacheRule — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrpullthroughcacherule
apiVersion: aws.konfig.io/v1alpha1
kind: ECRPullThroughCacheRule
metadata:
name: example-ecrpullthroughcacherule
namespace: default
spec:
credentialArn: arn:aws:iam::123456789012:role/example-role
customRoleArn: arn:aws:iam::123456789012:role/example-role
ecrRepositoryPrefix: example
providerRef:
name: example-ecrpullthroughcacherule
region: us-east-1
upstreamRegistry: example
upstreamRegistryUrl: example
upstreamRepositoryPrefix: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
credentialArn | string | — | The ARN of the Secrets Manager secret associated with the pull through cache rule. |
customRoleArn | string | — | The ARN of the IAM role associated with the pull through cache rule. |
ecrRepositoryPrefix | string | — | The Amazon ECR repository prefix associated with the pull through cache rule. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
upstreamRegistry | string | — | The name of the upstream source registry associated with the pull through cache rule. |
upstreamRegistryUrl | string | — | The upstream registry URL associated with the pull through cache rule. |
upstreamRepositoryPrefix | string | — | The upstream repository prefix associated with the pull through cache rule. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
ECRPullTimeUpdateExclusion # CLOUD CONTROL · AWS::ECR::PullTimeUpdateExclusion
ECRPullTimeUpdateExclusion manages AWS::ECR::PullTimeUpdateExclusion through the AWS Cloud Control API.
kubectl get ecrpulltimeupdateexclusions · example on GitHub
Example
# ECRPullTimeUpdateExclusion — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrpulltimeupdateexclusion
apiVersion: aws.konfig.io/v1alpha1
kind: ECRPullTimeUpdateExclusion
metadata:
name: example-ecrpulltimeupdateexclusion
namespace: default
spec:
principalArn: arn:aws:iam::123456789012:role/example-role
providerRef:
name: example-ecrpulltimeupdateexclusion
region: us-east-1
Spec
| Field | Type | Required | Description |
|---|---|---|---|
principalArn | string | yes | The ARN of the IAM principal to remove from the pull time update exclusion list. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
ECRRegistryPolicy # CLOUD CONTROL · AWS::ECR::RegistryPolicy
ECRRegistryPolicy manages AWS::ECR::RegistryPolicy through the AWS Cloud Control API.
kubectl get ecrregistrypolicies · example on GitHub
Example
# ECRRegistryPolicy — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrregistrypolicy
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRegistryPolicy
metadata:
name: example-ecrregistrypolicy
namespace: default
spec:
providerRef:
name: example-ecrregistrypolicy
region: us-east-1
Spec
| Field | Type | Required | Description |
|---|---|---|---|
policyText | object | yes | The JSON policy text for your registry. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
registryId | string | — | Read-only: reported by AWS after creation. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
ECRRegistryScanningConfiguration # CLOUD CONTROL · AWS::ECR::RegistryScanningConfiguration
ECRRegistryScanningConfiguration manages AWS::ECR::RegistryScanningConfiguration through the AWS Cloud Control API.
kubectl get ecrregistryscanningconfigurations · example on GitHub
Example
# ECRRegistryScanningConfiguration — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrregistryscanningconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRegistryScanningConfiguration
metadata:
name: example-ecrregistryscanningconfiguration
namespace: default
spec:
providerRef:
name: example-ecrregistryscanningconfiguration
region: us-east-1
rules:
- repositoryFilters:
- filter: example
filterType: WILDCARD
scanFrequency: SCAN_ON_PUSH
scanType: BASIC
Spec
| Field | Type | Required | Description |
|---|---|---|---|
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
rules | array<object> | yes | The scanning rules associated with the registry. |
rules[].repositoryFilters | array<object> | yes | The details of a scanning repository filter. |
rules[].repositoryFilters[].filter | string | yes | The filter to use when scanning. |
rules[].repositoryFilters[].filterType | enum | yes | The type associated with the filter. Allowed: WILDCARD |
rules[].scanFrequency | enum | yes | The frequency that scans are performed at for a private registry. Allowed: SCAN_ON_PUSH, CONTINUOUS_SCAN |
scanType | enum | yes | The type of scanning configured for the registry. Allowed: BASIC, ENHANCED |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
registryId | string | — | Read-only: reported by AWS after creation. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
ECRReplicationConfiguration # CLOUD CONTROL · AWS::ECR::ReplicationConfiguration
ECRReplicationConfiguration manages AWS::ECR::ReplicationConfiguration through the AWS Cloud Control API.
kubectl get ecrreplicationconfigurations · example on GitHub
Example
# ECRReplicationConfiguration — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrreplicationconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: ECRReplicationConfiguration
metadata:
name: example-ecrreplicationconfiguration
namespace: default
spec:
providerRef:
name: example-ecrreplicationconfiguration
region: us-east-1
replicationConfiguration:
rules:
- destinations:
- region: us-east-1
registryId: example-id
repositoryFilters:
- filter: example
filterType: PREFIX_MATCH
Spec
| Field | Type | Required | Description |
|---|---|---|---|
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
replicationConfiguration | object | yes | The replication configuration for a registry. |
replicationConfiguration.rules | array<object> | yes | An array of objects representing the replication destinations and repository filters for a replication configuration. |
replicationConfiguration.rules[].destinations | array<object> | yes | An array of objects representing the destination for a replication rule. |
replicationConfiguration.rules[].destinations[].region | string | yes | The Region to replicate to. |
replicationConfiguration.rules[].destinations[].registryId | string | yes | The AWS account ID of the Amazon ECR private registry to replicate to. |
replicationConfiguration.rules[].repositoryFilters | array<object> | — | An array of objects representing the filters for a replication rule. |
replicationConfiguration.rules[].repositoryFilters[].filter | string | yes | The repository filter details. |
replicationConfiguration.rules[].repositoryFilters[].filterType | enum | yes | The repository filter type. Allowed: PREFIX_MATCH |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
registryId | string | — | Read-only: reported by AWS after creation. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
ECRRepository # GA
ECRRepository is the Schema for managing ECR Repositories.
kubectl get ecrrepositories · example on GitHub
Example
# ECRRepository — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrrepository
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRepository
metadata:
name: example-ecrrepository
namespace: default
spec:
encryptionType: AES256
imageTagMutability: MUTABLE
kmsKeyArn: arn:aws:iam::123456789012:role/example-role
providerRef:
name: example-ecrrepository
region: us-east-1
repositoryName: example-ecrrepository
scanOnPush: false
tags:
environment: dev
team: platform
Spec
| Field | Type | Required | Description |
|---|---|---|---|
encryptionType | enum | — | EncryptionType is the encryption type for the repository. Allowed: AES256, KMS |
imageTagMutability | enum | — | ImageTagMutability controls whether image tags can be overwritten. Allowed: MUTABLE, IMMUTABLE |
kmsKeyArn | string | — | KMSKeyARN is the KMS key ARN for KMS encryption. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
repositoryName | string | yes | RepositoryName is the name of the repository. |
scanOnPush | boolean | — | ScanOnPush enables automatic image scanning on push. |
tags | map<string> | — | Tags are AWS resource tags to apply. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | ARN is the ARN of the repository. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
repositoryUri | string | — | RepositoryURI is the URI of the repository. |
ECRRepositoryCreationTemplate # CLOUD CONTROL · AWS::ECR::RepositoryCreationTemplate
ECRRepositoryCreationTemplate manages AWS::ECR::RepositoryCreationTemplate through the AWS Cloud Control API.
kubectl get ecrrepositorycreationtemplates · example on GitHub
Example
# ECRRepositoryCreationTemplate — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrrepositorycreationtemplate
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRepositoryCreationTemplate
metadata:
name: example-ecrrepositorycreationtemplate
namespace: default
spec:
appliedFor:
- example
customRoleArn: arn:aws:iam::123456789012:role/example-role
description: Managed by konfig-konector
encryptionConfiguration:
encryptionType: AES256
kmsKey: example
imageTagMutability: MUTABLE
imageTagMutabilityExclusionFilters:
- imageTagMutabilityExclusionFilterType: WILDCARD
imageTagMutabilityExclusionFilterValue: example
lifecyclePolicy: example
prefix: example
providerRef:
name: example-ecrrepositorycreationtemplate
region: us-east-1
repositoryPolicy: example
resourceTags:
- key: example
value: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
appliedFor | array<string> | yes | A list of enumerable Strings representing the repository creation scenarios that this template will apply towards. |
customRoleArn | string | — | The ARN of the role to be assumed by Amazon ECR. |
description | string | — | The description associated with the repository creation template. |
encryptionConfiguration | object | — | The encryption configuration associated with the repository creation template. |
encryptionConfiguration.encryptionType | enum | yes | The encryption type to use. Allowed: AES256, KMS, KMS_DSSE |
encryptionConfiguration.kmsKey | string | — | If you use the ``KMS`` encryption type, specify the KMS key to use for encryption. |
imageTagMutability | enum | — | The tag mutability setting for the repository. Allowed: MUTABLE, IMMUTABLE, IMMUTABLE_WITH_EXCLUSION, MUTABLE_WITH_EXCLUSION |
imageTagMutabilityExclusionFilters | array<object> | — | A list of filters that specify which image tags are excluded from the repository creation template's image tag mutability setting. |
imageTagMutabilityExclusionFilters[].imageTagMutabilityExclusionFilterType | enum | yes | Allowed: WILDCARD |
imageTagMutabilityExclusionFilters[].imageTagMutabilityExclusionFilterValue | string | yes | |
lifecyclePolicy | string | — | The lifecycle policy to use for repositories created using the template. |
prefix | string | yes | The repository namespace prefix associated with the repository creation template. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
repositoryPolicy | string | — | The repository policy to apply to repositories created using the template. |
resourceTags | array<object> | — | The metadata to apply to the repository to help you categorize and organize. |
resourceTags[].key | string | yes | |
resourceTags[].value | string | yes |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
createdAt | string | — | Read-only: reported by AWS after creation. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
updatedAt | string | — | Read-only: reported by AWS after creation. |
ECRRepositoryPolicy # GA
ECRRepositoryPolicy is the Schema for managing ECR Repository Policies.
kubectl get ecrrepositorypolicies · example on GitHub
Example
# ECRRepositoryPolicy — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrrepositorypolicy
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRepositoryPolicy
metadata:
name: example-ecrrepositorypolicy
namespace: default
spec:
policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
"Resource": "*"}]}'
providerRef:
name: example-ecrrepositorypolicy
region: us-east-1
repositoryRef:
name: example-ecrrepositorypolicy
repositoryName: example-ecrrepositorypolicy
Spec
| Field | Type | Required | Description |
|---|---|---|---|
policyDocument | string | yes | PolicyDocument is the JSON resource policy to apply. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
repositoryRef | object | yes | RepositoryRef references the ECR repository. |
repositoryRef.name | string | — | Name of an ECRRepository CR in the same namespace. |
repositoryRef.repositoryName | string | — | RepositoryName is a direct AWS ECR repository name. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
ECRSigningConfiguration # CLOUD CONTROL · AWS::ECR::SigningConfiguration
ECRSigningConfiguration manages AWS::ECR::SigningConfiguration through the AWS Cloud Control API.
kubectl get ecrsigningconfigurations · example on GitHub
Example
# ECRSigningConfiguration — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrsigningconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: ECRSigningConfiguration
metadata:
name: example-ecrsigningconfiguration
namespace: default
spec:
providerRef:
name: example-ecrsigningconfiguration
region: us-east-1
rules:
- repositoryFilters:
- filter: example
filterType: WILDCARD_MATCH
signingProfileArn: arn:aws:iam::123456789012:role/example-role
Spec
| Field | Type | Required | Description |
|---|---|---|---|
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
rules | array<object> | yes | Array of signing rules that define which repositories should be signed and with which signing profiles. |
rules[].repositoryFilters | array<object> | — | Optional array of repository filters. |
rules[].repositoryFilters[].filter | string | yes | |
rules[].repositoryFilters[].filterType | enum | yes | Allowed: WILDCARD_MATCH |
rules[].signingProfileArn | string | yes | AWS Signer signing profile ARN to use for matched repositories. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
registryId | string | — | 12-digit AWS account ID of the ECR registry. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |