OpenSearch Serverless

10 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

OpenSearchAccessPolicy # GA

OpenSearchAccessPolicy is the Schema for managing OpenSearch Serverless access policies.

kubectl get opensearchaccesspolicies · example on GitHub

Example

# OpenSearchAccessPolicy — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchaccesspolicy
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchAccessPolicy
metadata:
  name: example-opensearchaccesspolicy
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-opensearchaccesspolicy
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  providerRef:
    name: example-opensearchaccesspolicy
    region: us-east-1
  type: data

Spec

Field	Type	Required	Description
`description`	string	—	Description is a description of the policy.
`name`	string	yes	Name is the name of the access policy.
`policyDocument`	string	yes	PolicyDocument is the JSON policy document.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`type`	enum	yes	Type is the access policy type (data). Allowed: `data`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`policyVersion`	string	—	PolicyVersion is the current version of the policy.

OpenSearchServerlessAccessPolicy # CLOUD CONTROL · AWS::OpenSearchServerless::AccessPolicy

OpenSearchServerlessAccessPolicy manages AWS::OpenSearchServerless::AccessPolicy through the AWS Cloud Control API.

kubectl get opensearchserverlessaccesspolicies · example on GitHub

Example

# OpenSearchServerlessAccessPolicy — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlessaccesspolicy
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessAccessPolicy
metadata:
  name: example-opensearchserverlessaccesspolicy
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-opensearchserverlessacce
  policy: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource":
    "*"}]}'
  providerRef:
    name: example-opensearchserverlessaccesspolicy
    region: us-east-1
  type: data

Spec

Field	Type	Required	Description
`description`	string	—	The description of the policy
`name`	string	yes	The name of the policy Create-only in AWS: changing it requires replacing the resource.
`policy`	string	yes	The JSON policy document that is the content for the policy
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`type`	enum	yes	Create-only in AWS: changing it requires replacing the resource. Allowed: `data`

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

OpenSearchServerlessCollection # GA

OpenSearchServerlessCollection is the Schema for managing OpenSearch Serverless collections.

kubectl get opensearchserverlesscollections · example on GitHub

Example

# OpenSearchServerlessCollection — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlesscollection
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessCollection
metadata:
  name: example-opensearchserverlesscollection
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-opensearchserverlesscollection
  providerRef:
    name: example-opensearchserverlesscollection
    region: us-east-1
  tags:
    environment: dev
    team: platform
  type: SEARCH

Spec

Field	Type	Required	Description
`description`	string	—	Description is the description of the collection.
`name`	string	yes	Name is the name of the collection.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are metadata tags for the collection.
`type`	enum	—	Type is the collection type (SEARCH, TIMESERIES, or VECTORSEARCH). Allowed: `SEARCH, TIMESERIES, VECTORSEARCH`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`collectionARN`	string	—	CollectionARN is the ARN of the collection.
`collectionEndpoint`	string	—	CollectionEndpoint is the endpoint URL for the collection.
`collectionID`	string	—	CollectionID is the unique identifier of the collection.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`status`	string	—	Status is the current status of the collection.

OpenSearchServerlessCollectionGroup # CLOUD CONTROL · AWS::OpenSearchServerless::CollectionGroup

OpenSearchServerlessCollectionGroup manages AWS::OpenSearchServerless::CollectionGroup through the AWS Cloud Control API.

kubectl get opensearchserverlesscollectiongroups · example on GitHub

Example

# OpenSearchServerlessCollectionGroup — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlesscollectiongroup
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessCollectionGroup
metadata:
  name: example-opensearchserverlesscollectiongroup
  namespace: default
spec:
  capacityLimits:
    maxIndexingCapacityInOcu: 2
    maxSearchCapacityInOcu: 2
    minIndexingCapacityInOcu: 2
    minSearchCapacityInOcu: 2
  description: Managed by konfig-konector
  generation: CLASSIC
  name: example-opensearchserverlesscoll
  providerRef:
    name: example-opensearchserverlesscollectiongroup
    region: us-east-1
  standbyReplicas: ENABLED
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`capacityLimits`	object	—	OpenSearchServerlessCollectionGroupCapacityLimits is a nested property type of AWS::OpenSearchServerless::CollectionGroup.
`capacityLimits.maxIndexingCapacityInOcu`	number	—	The maximum indexing capacity for collections in the group.
`capacityLimits.maxSearchCapacityInOcu`	number	—	The maximum search capacity for collections in the group.
`capacityLimits.minIndexingCapacityInOcu`	number	—	The minimum indexing capacity for collections in the group.
`capacityLimits.minSearchCapacityInOcu`	number	—	The minimum search capacity for collections in the group.
`description`	string	—	The description of the collection group.
`generation`	enum	—	The generation of Amazon OpenSearch Serverless for the collection group. Allowed: `CLASSIC, NEXTGEN`
`name`	string	yes	The name of the collection group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`standbyReplicas`	enum	yes	Indicates whether standby replicas are used for the collection group. Allowed: `ENABLED, DISABLED`
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the collection group.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The unique identifier of the collection group.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

OpenSearchServerlessCollectionIndex # CLOUD CONTROL · AWS::OpenSearchServerless::CollectionIndex

OpenSearchServerlessCollectionIndex manages AWS::OpenSearchServerless::CollectionIndex through the AWS Cloud Control API.

kubectl get opensearchserverlesscollectionindices · example on GitHub

Example

# OpenSearchServerlessCollectionIndex — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlesscollectionindex
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessCollectionIndex
metadata:
  name: example-opensearchserverlesscollectionindex
  namespace: default
spec:
  id: example-id
  indexName: example-opensearchserverlesscollectionindex
  indexSchema: example
  providerRef:
    name: example-opensearchserverlesscollectionindex
    region: us-east-1

Spec

Field	Type	Required	Description
`id`	string	yes	The identifier of the collection Create-only in AWS: changing it requires replacing the resource.
`indexName`	string	yes	The name of the collection index Create-only in AWS: changing it requires replacing the resource.
`indexSchema`	string	—	The Mappings for the collection index
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

OpenSearchServerlessIndex # CLOUD CONTROL · AWS::OpenSearchServerless::Index

OpenSearchServerlessIndex manages AWS::OpenSearchServerless::Index through the AWS Cloud Control API.

kubectl get opensearchserverlessindices · example on GitHub

Example

# OpenSearchServerlessIndex — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlessindex
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessIndex
metadata:
  name: example-opensearchserverlessindex
  namespace: default
spec:
  collectionEndpoint: example
  indexName: example-opensearchserverlessindex
  mappings:
    properties: {}
  providerRef:
    name: example-opensearchserverlessindex
    region: us-east-1
  settings:
    analysis:
      analyzer: {}
    index:
      knn: false
      knnAlgoParamEfSearch: 1
      refreshInterval: example

Spec

Field	Type	Required	Description
`collectionEndpoint`	string	yes	The endpoint for the collection.
`indexName`	string	yes	The name of the OpenSearch Serverless index.
`mappings`	object	—	Index Mappings
`mappings.properties`	map<string>	—	Defines the fields within the mapping, including their types and configurations
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`settings`	object	—	Index settings
`settings.analysis`	object	—	Custom analysis configuration including analyzers, tokenizers, and filters
`settings.analysis.analyzer`	map<string>	—	Custom analyzer definitions
`settings.index`	object	—	OpenSearchServerlessIndexIndexSettingsIndex is a nested property type of AWS::OpenSearchServerless::Index.
`settings.index.knn`	boolean	—	Enable/disable k-nearest neighbor search capability
`settings.index.knnAlgoParamEfSearch`	integer	—	Size of the dynamic list for the nearest neighbors
`settings.index.refreshInterval`	string	—	How often to perform refresh operation (e.g.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`uuid`	string	—	The unique identifier for the index.

OpenSearchServerlessLifecyclePolicy # CLOUD CONTROL · AWS::OpenSearchServerless::LifecyclePolicy

OpenSearchServerlessLifecyclePolicy manages AWS::OpenSearchServerless::LifecyclePolicy through the AWS Cloud Control API.

kubectl get opensearchserverlesslifecyclepolicies · example on GitHub

Example

# OpenSearchServerlessLifecyclePolicy — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlesslifecyclepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessLifecyclePolicy
metadata:
  name: example-opensearchserverlesslifecyclepolicy
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-opensearchserverlesslife
  policy: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource":
    "*"}]}'
  providerRef:
    name: example-opensearchserverlesslifecyclepolicy
    region: us-east-1
  type: retention

Spec

Field	Type	Required	Description
`description`	string	—	The description of the policy
`name`	string	yes	The name of the policy Create-only in AWS: changing it requires replacing the resource.
`policy`	string	yes	The JSON policy document that is the content for the policy
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`type`	enum	yes	Create-only in AWS: changing it requires replacing the resource. Allowed: `retention`

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

OpenSearchServerlessSecurityConfig # CLOUD CONTROL · AWS::OpenSearchServerless::SecurityConfig

OpenSearchServerlessSecurityConfig manages AWS::OpenSearchServerless::SecurityConfig through the AWS Cloud Control API.

kubectl get opensearchserverlesssecurityconfigs · example on GitHub

Example

# OpenSearchServerlessSecurityConfig — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlesssecurityconfig
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessSecurityConfig
metadata:
  name: example-opensearchserverlesssecurityconfig
  namespace: default
spec:
  description: Managed by konfig-konector
  iamFederationOptions:
    groupAttribute: example
    userAttribute: example
  iamIdentityCenterOptions:
    applicationArn: arn:aws:iam::123456789012:role/example-role
    applicationDescription: Managed by konfig-konector
    applicationName: example-opensearchserverlesssecurityconfig
    groupAttribute: example
    instanceArn: arn:aws:iam::123456789012:role/example-role
    userAttribute: example
  name: example-opensearchserverlesssecu
  providerRef:
    name: example-opensearchserverlesssecurityconfig
    region: us-east-1
  samlOptions:
    groupAttribute: example
    metadata: example
    sessionTimeout: 300
    userAttribute: example
  type: saml

Spec

Field	Type	Required	Description
`description`	string	—	Security config description
`iamFederationOptions`	object	—	OpenSearchServerlessSecurityConfigIamFederationConfigOptions is a nested property type of AWS::OpenSearchServerless::SecurityConfig.
`iamFederationOptions.groupAttribute`	string	—	Group attribute for this IAM federation integration
`iamFederationOptions.userAttribute`	string	—	User attribute for this IAM federation integration
`iamIdentityCenterOptions`	object	—	OpenSearchServerlessSecurityConfigIamIdentityCenterConfigOptions is a nested property type of AWS::OpenSearchServerless::SecurityConfig.
`iamIdentityCenterOptions.applicationArn`	string	—
`iamIdentityCenterOptions.applicationDescription`	string	—	The description of the IAM Identity Center application used to integrate with OpenSearch Serverless
`iamIdentityCenterOptions.applicationName`	string	—	The name of the IAM Identity Center application used to integrate with OpenSearch Serverless
`iamIdentityCenterOptions.groupAttribute`	string	—
`iamIdentityCenterOptions.instanceArn`	string	yes
`iamIdentityCenterOptions.userAttribute`	string	—
`name`	string	—	The friendly name of the security config Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`samlOptions`	object	—	OpenSearchServerlessSecurityConfigSamlConfigOptions is a nested property type of AWS::OpenSearchServerless::SecurityConfig.
`samlOptions.groupAttribute`	string	—	Group attribute for this saml integration
`samlOptions.metadata`	string	yes	The XML saml provider metadata document that you want to use
`samlOptions.openSearchServerlessEntityId`	string	—	Custom entity id attribute to override default entity id for this saml integration
`samlOptions.sessionTimeout`	integer	—	Defines the session timeout in minutes
`samlOptions.userAttribute`	string	—	Custom attribute for this saml integration
`type`	enum	—	Create-only in AWS: changing it requires replacing the resource. Allowed: `saml, iamidentitycenter, iamfederation`

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The identifier of the security config Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

OpenSearchServerlessSecurityPolicy # CLOUD CONTROL · AWS::OpenSearchServerless::SecurityPolicy

OpenSearchServerlessSecurityPolicy manages AWS::OpenSearchServerless::SecurityPolicy through the AWS Cloud Control API.

kubectl get opensearchserverlesssecuritypolicies · example on GitHub

Example

# OpenSearchServerlessSecurityPolicy — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlesssecuritypolicy
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessSecurityPolicy
metadata:
  name: example-opensearchserverlesssecuritypolicy
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-opensearchserverlesssecu
  policy: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource":
    "*"}]}'
  providerRef:
    name: example-opensearchserverlesssecuritypolicy
    region: us-east-1
  type: encryption

Spec

Field	Type	Required	Description
`description`	string	—	The description of the policy
`name`	string	yes	The name of the policy Create-only in AWS: changing it requires replacing the resource.
`policy`	string	yes	The JSON policy document that is the content for the policy
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`type`	enum	yes	Create-only in AWS: changing it requires replacing the resource. Allowed: `encryption, network`

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

OpenSearchServerlessVpcEndpoint # CLOUD CONTROL · AWS::OpenSearchServerless::VpcEndpoint

OpenSearchServerlessVpcEndpoint manages AWS::OpenSearchServerless::VpcEndpoint through the AWS Cloud Control API.

kubectl get opensearchserverlessvpcendpoints · example on GitHub

Example

# OpenSearchServerlessVpcEndpoint — OpenSearch Serverless
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/opensearchserverless.html#opensearchserverlessvpcendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: OpenSearchServerlessVpcEndpoint
metadata:
  name: example-opensearchserverlessvpcendpoint
  namespace: default
spec:
  name: example-opensearchserverlessvpce
  providerRef:
    name: example-opensearchserverlessvpcendpoint
    region: us-east-1
  securityGroupIds:
  - example
  subnetIds:
  - example
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`name`	string	yes	The name of the VPC Endpoint Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`securityGroupIds`	array<string>	—	The ID of one or more security groups to associate with the endpoint network interface
`subnetIds`	array<string>	yes	The ID of one or more subnets in which to create an endpoint network interface
`vpcId`	string	yes	The ID of the VPC in which the endpoint will be used.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The identifier of the VPC Endpoint Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.