ECR

11 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

ECRLifecyclePolicy # GA

ECRLifecyclePolicy is the Schema for managing ECR Lifecycle Policies.

kubectl get ecrlifecyclepolicies · example on GitHub

Example

# ECRLifecyclePolicy — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrlifecyclepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: ECRLifecyclePolicy
metadata:
  name: example-ecrlifecyclepolicy
  namespace: default
spec:
  lifecyclePolicyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  providerRef:
    name: example-ecrlifecyclepolicy
    region: us-east-1
  repositoryRef:
    name: example-ecrlifecyclepolicy
    repositoryName: example-ecrlifecyclepolicy

Spec

FieldTypeRequiredDescription
lifecyclePolicyDocumentstringyesLifecyclePolicyDocument is the JSON lifecycle policy.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
repositoryRefobjectyesRepositoryRef references the ECR repository.
repositoryRef.namestring—Name of an ECRRepository CR in the same namespace.
repositoryRef.repositoryNamestring—RepositoryName is a direct AWS ECR repository name.

Status

FieldTypeRequiredDescription
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.

ECRPublicRepository # CLOUD CONTROL · AWS::ECR::PublicRepository

ECRPublicRepository manages AWS::ECR::PublicRepository through the AWS Cloud Control API.

kubectl get ecrpublicrepositories · example on GitHub

Example

# ECRPublicRepository — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrpublicrepository
apiVersion: aws.konfig.io/v1alpha1
kind: ECRPublicRepository
metadata:
  name: example-ecrpublicrepository
  namespace: default
spec:
  providerRef:
    name: example-ecrpublicrepository
    region: us-east-1
  repositoryCatalogData:
    aboutText: example
    architectures:
    - example
    operatingSystems:
    - example
    repositoryDescription: Managed by konfig-konector
    usageText: example
  repositoryName: example-ecrpublicrepository
  tags:
  - key: example
    value: example

Spec

FieldTypeRequiredDescription
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
repositoryCatalogDataobject—The details about the repository that are publicly visible in the Amazon ECR Public Gallery.
repositoryCatalogData.aboutTextstring—
repositoryCatalogData.architecturesarray<string>—
repositoryCatalogData.operatingSystemsarray<string>—
repositoryCatalogData.repositoryDescriptionstring—
repositoryCatalogData.usageTextstring—
repositoryNamestring—The name to use for the public repository.
repositoryPolicyTextobject—The JSON repository policy text to apply to the public repository.
tagsarray<object>—An array of key-value pairs to apply to this resource.
tags[].keystringyes
tags[].valuestringyes

Status

FieldTypeRequiredDescription
arnstring—Read-only: reported by AWS after creation.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

ECRPullThroughCacheRule # CLOUD CONTROL · AWS::ECR::PullThroughCacheRule

ECRPullThroughCacheRule manages AWS::ECR::PullThroughCacheRule through the AWS Cloud Control API.

kubectl get ecrpullthroughcacherules · example on GitHub

Example

# ECRPullThroughCacheRule — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrpullthroughcacherule
apiVersion: aws.konfig.io/v1alpha1
kind: ECRPullThroughCacheRule
metadata:
  name: example-ecrpullthroughcacherule
  namespace: default
spec:
  credentialArn: arn:aws:iam::123456789012:role/example-role
  customRoleArn: arn:aws:iam::123456789012:role/example-role
  ecrRepositoryPrefix: example
  providerRef:
    name: example-ecrpullthroughcacherule
    region: us-east-1
  upstreamRegistry: example
  upstreamRegistryUrl: example
  upstreamRepositoryPrefix: example

Spec

FieldTypeRequiredDescription
credentialArnstring—The ARN of the Secrets Manager secret associated with the pull through cache rule.
customRoleArnstring—The ARN of the IAM role associated with the pull through cache rule.
ecrRepositoryPrefixstring—The Amazon ECR repository prefix associated with the pull through cache rule.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
upstreamRegistrystring—The name of the upstream source registry associated with the pull through cache rule.
upstreamRegistryUrlstring—The upstream registry URL associated with the pull through cache rule.
upstreamRepositoryPrefixstring—The upstream repository prefix associated with the pull through cache rule.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

ECRPullTimeUpdateExclusion # CLOUD CONTROL · AWS::ECR::PullTimeUpdateExclusion

ECRPullTimeUpdateExclusion manages AWS::ECR::PullTimeUpdateExclusion through the AWS Cloud Control API.

kubectl get ecrpulltimeupdateexclusions · example on GitHub

Example

# ECRPullTimeUpdateExclusion — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrpulltimeupdateexclusion
apiVersion: aws.konfig.io/v1alpha1
kind: ECRPullTimeUpdateExclusion
metadata:
  name: example-ecrpulltimeupdateexclusion
  namespace: default
spec:
  principalArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ecrpulltimeupdateexclusion
    region: us-east-1

Spec

FieldTypeRequiredDescription
principalArnstringyesThe ARN of the IAM principal to remove from the pull time update exclusion list.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

ECRRegistryPolicy # CLOUD CONTROL · AWS::ECR::RegistryPolicy

ECRRegistryPolicy manages AWS::ECR::RegistryPolicy through the AWS Cloud Control API.

kubectl get ecrregistrypolicies · example on GitHub

Example

# ECRRegistryPolicy — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrregistrypolicy
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRegistryPolicy
metadata:
  name: example-ecrregistrypolicy
  namespace: default
spec:
  providerRef:
    name: example-ecrregistrypolicy
    region: us-east-1

Spec

FieldTypeRequiredDescription
policyTextobjectyesThe JSON policy text for your registry.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
registryIdstring—Read-only: reported by AWS after creation.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

ECRRegistryScanningConfiguration # CLOUD CONTROL · AWS::ECR::RegistryScanningConfiguration

ECRRegistryScanningConfiguration manages AWS::ECR::RegistryScanningConfiguration through the AWS Cloud Control API.

kubectl get ecrregistryscanningconfigurations · example on GitHub

Example

# ECRRegistryScanningConfiguration — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrregistryscanningconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRegistryScanningConfiguration
metadata:
  name: example-ecrregistryscanningconfiguration
  namespace: default
spec:
  providerRef:
    name: example-ecrregistryscanningconfiguration
    region: us-east-1
  rules:
  - repositoryFilters:
    - filter: example
      filterType: WILDCARD
    scanFrequency: SCAN_ON_PUSH
  scanType: BASIC

Spec

FieldTypeRequiredDescription
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
rulesarray<object>yesThe scanning rules associated with the registry.
rules[].repositoryFiltersarray<object>yesThe details of a scanning repository filter.
rules[].repositoryFilters[].filterstringyesThe filter to use when scanning.
rules[].repositoryFilters[].filterTypeenumyesThe type associated with the filter. Allowed: WILDCARD
rules[].scanFrequencyenumyesThe frequency that scans are performed at for a private registry. Allowed: SCAN_ON_PUSH, CONTINUOUS_SCAN
scanTypeenumyesThe type of scanning configured for the registry. Allowed: BASIC, ENHANCED

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
registryIdstring—Read-only: reported by AWS after creation.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

ECRReplicationConfiguration # CLOUD CONTROL · AWS::ECR::ReplicationConfiguration

ECRReplicationConfiguration manages AWS::ECR::ReplicationConfiguration through the AWS Cloud Control API.

kubectl get ecrreplicationconfigurations · example on GitHub

Example

# ECRReplicationConfiguration — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrreplicationconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: ECRReplicationConfiguration
metadata:
  name: example-ecrreplicationconfiguration
  namespace: default
spec:
  providerRef:
    name: example-ecrreplicationconfiguration
    region: us-east-1
  replicationConfiguration:
    rules:
    - destinations:
      - region: us-east-1
        registryId: example-id
      repositoryFilters:
      - filter: example
        filterType: PREFIX_MATCH

Spec

FieldTypeRequiredDescription
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
replicationConfigurationobjectyesThe replication configuration for a registry.
replicationConfiguration.rulesarray<object>yesAn array of objects representing the replication destinations and repository filters for a replication configuration.
replicationConfiguration.rules[].destinationsarray<object>yesAn array of objects representing the destination for a replication rule.
replicationConfiguration.rules[].destinations[].regionstringyesThe Region to replicate to.
replicationConfiguration.rules[].destinations[].registryIdstringyesThe AWS account ID of the Amazon ECR private registry to replicate to.
replicationConfiguration.rules[].repositoryFiltersarray<object>—An array of objects representing the filters for a replication rule.
replicationConfiguration.rules[].repositoryFilters[].filterstringyesThe repository filter details.
replicationConfiguration.rules[].repositoryFilters[].filterTypeenumyesThe repository filter type. Allowed: PREFIX_MATCH

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
registryIdstring—Read-only: reported by AWS after creation.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

ECRRepository # GA

ECRRepository is the Schema for managing ECR Repositories.

kubectl get ecrrepositories · example on GitHub

Example

# ECRRepository — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrrepository
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRepository
metadata:
  name: example-ecrrepository
  namespace: default
spec:
  encryptionType: AES256
  imageTagMutability: MUTABLE
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ecrrepository
    region: us-east-1
  repositoryName: example-ecrrepository
  scanOnPush: false
  tags:
    environment: dev
    team: platform

Spec

FieldTypeRequiredDescription
encryptionTypeenum—EncryptionType is the encryption type for the repository. Allowed: AES256, KMS
imageTagMutabilityenum—ImageTagMutability controls whether image tags can be overwritten. Allowed: MUTABLE, IMMUTABLE
kmsKeyArnstring—KMSKeyARN is the KMS key ARN for KMS encryption.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
repositoryNamestringyesRepositoryName is the name of the repository.
scanOnPushboolean—ScanOnPush enables automatic image scanning on push.
tagsmap<string>—Tags are AWS resource tags to apply.

Status

FieldTypeRequiredDescription
arnstring—ARN is the ARN of the repository.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.
repositoryUristring—RepositoryURI is the URI of the repository.

ECRRepositoryCreationTemplate # CLOUD CONTROL · AWS::ECR::RepositoryCreationTemplate

ECRRepositoryCreationTemplate manages AWS::ECR::RepositoryCreationTemplate through the AWS Cloud Control API.

kubectl get ecrrepositorycreationtemplates · example on GitHub

Example

# ECRRepositoryCreationTemplate — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrrepositorycreationtemplate
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRepositoryCreationTemplate
metadata:
  name: example-ecrrepositorycreationtemplate
  namespace: default
spec:
  appliedFor:
  - example
  customRoleArn: arn:aws:iam::123456789012:role/example-role
  description: Managed by konfig-konector
  encryptionConfiguration:
    encryptionType: AES256
    kmsKey: example
  imageTagMutability: MUTABLE
  imageTagMutabilityExclusionFilters:
  - imageTagMutabilityExclusionFilterType: WILDCARD
    imageTagMutabilityExclusionFilterValue: example
  lifecyclePolicy: example
  prefix: example
  providerRef:
    name: example-ecrrepositorycreationtemplate
    region: us-east-1
  repositoryPolicy: example
  resourceTags:
  - key: example
    value: example

Spec

FieldTypeRequiredDescription
appliedForarray<string>yesA list of enumerable Strings representing the repository creation scenarios that this template will apply towards.
customRoleArnstring—The ARN of the role to be assumed by Amazon ECR.
descriptionstring—The description associated with the repository creation template.
encryptionConfigurationobject—The encryption configuration associated with the repository creation template.
encryptionConfiguration.encryptionTypeenumyesThe encryption type to use. Allowed: AES256, KMS, KMS_DSSE
encryptionConfiguration.kmsKeystring—If you use the ``KMS`` encryption type, specify the KMS key to use for encryption.
imageTagMutabilityenum—The tag mutability setting for the repository. Allowed: MUTABLE, IMMUTABLE, IMMUTABLE_WITH_EXCLUSION, MUTABLE_WITH_EXCLUSION
imageTagMutabilityExclusionFiltersarray<object>—A list of filters that specify which image tags are excluded from the repository creation template's image tag mutability setting.
imageTagMutabilityExclusionFilters[].imageTagMutabilityExclusionFilterTypeenumyesAllowed: WILDCARD
imageTagMutabilityExclusionFilters[].imageTagMutabilityExclusionFilterValuestringyes
lifecyclePolicystring—The lifecycle policy to use for repositories created using the template.
prefixstringyesThe repository namespace prefix associated with the repository creation template.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
repositoryPolicystring—The repository policy to apply to repositories created using the template.
resourceTagsarray<object>—The metadata to apply to the repository to help you categorize and organize.
resourceTags[].keystringyes
resourceTags[].valuestringyes

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
createdAtstring—Read-only: reported by AWS after creation.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.
updatedAtstring—Read-only: reported by AWS after creation.

ECRRepositoryPolicy # GA

ECRRepositoryPolicy is the Schema for managing ECR Repository Policies.

kubectl get ecrrepositorypolicies · example on GitHub

Example

# ECRRepositoryPolicy — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrrepositorypolicy
apiVersion: aws.konfig.io/v1alpha1
kind: ECRRepositoryPolicy
metadata:
  name: example-ecrrepositorypolicy
  namespace: default
spec:
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  providerRef:
    name: example-ecrrepositorypolicy
    region: us-east-1
  repositoryRef:
    name: example-ecrrepositorypolicy
    repositoryName: example-ecrrepositorypolicy

Spec

FieldTypeRequiredDescription
policyDocumentstringyesPolicyDocument is the JSON resource policy to apply.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
repositoryRefobjectyesRepositoryRef references the ECR repository.
repositoryRef.namestring—Name of an ECRRepository CR in the same namespace.
repositoryRef.repositoryNamestring—RepositoryName is a direct AWS ECR repository name.

Status

FieldTypeRequiredDescription
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.

ECRSigningConfiguration # CLOUD CONTROL · AWS::ECR::SigningConfiguration

ECRSigningConfiguration manages AWS::ECR::SigningConfiguration through the AWS Cloud Control API.

kubectl get ecrsigningconfigurations · example on GitHub

Example

# ECRSigningConfiguration — ECR
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ecr.html#ecrsigningconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: ECRSigningConfiguration
metadata:
  name: example-ecrsigningconfiguration
  namespace: default
spec:
  providerRef:
    name: example-ecrsigningconfiguration
    region: us-east-1
  rules:
  - repositoryFilters:
    - filter: example
      filterType: WILDCARD_MATCH
    signingProfileArn: arn:aws:iam::123456789012:role/example-role

Spec

FieldTypeRequiredDescription
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
rulesarray<object>yesArray of signing rules that define which repositories should be signed and with which signing profiles.
rules[].repositoryFiltersarray<object>—Optional array of repository filters.
rules[].repositoryFilters[].filterstringyes
rules[].repositoryFilters[].filterTypeenumyesAllowed: WILDCARD_MATCH
rules[].signingProfileArnstringyesAWS Signer signing profile ARN to use for matched repositories.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
registryIdstring—12-digit AWS account ID of the ECR registry.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.