Systems Manager
12 resource kinds. Generated from the operator's CRD schemas.
aws.konfig.io/v1alpha1
SSMAssociation # GA
SSMAssociation is the Schema for managing SSM State Manager associations.
kubectl get ssmassociations · example on GitHub
Example
# SSMAssociation — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmassociation
apiVersion: aws.konfig.io/v1alpha1
kind: SSMAssociation
metadata:
name: example-ssmassociation
namespace: default
spec:
associationName: example-ssmassociation
documentRef:
documentName: example-ssmassociation
name: example-ssmassociation
name: example-ssmassociation
parameters: {}
providerRef:
name: example-ssmassociation
region: us-east-1
scheduleExpression: example
targets:
- key: example
values:
- example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
associationName | string | — | AssociationName is a human-readable name for the association. |
documentRef | object | — | DocumentRef references the SSM document to associate. |
documentRef.documentName | string | — | DocumentName is a direct SSM document name (e.g. |
documentRef.name | string | — | Name of an SSMDocument CR in the same namespace. |
name | string | — | Name is a direct SSM document name to associate. |
parameters | map<string> | — | Parameters passed to the document. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
scheduleExpression | string | — | ScheduleExpression is a cron or rate expression for re-application. |
targets | array<object> | — | Targets select the managed nodes. |
targets[].key | string | yes | Key is the target key, e.g. |
targets[].values | array<string> | yes | Values for the target key. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
associationId | string | — | AssociationID is the AWS association ID. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
SSMCloudConnector # CLOUD CONTROL · AWS::SSM::CloudConnector
SSMCloudConnector manages AWS::SSM::CloudConnector through the AWS Cloud Control API.
kubectl get ssmcloudconnectors · example on GitHub
Example
# SSMCloudConnector — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmcloudconnector
apiVersion: aws.konfig.io/v1alpha1
kind: SSMCloudConnector
metadata:
name: example-ssmcloudconnector
namespace: default
spec:
configConnectorArn: arn:aws:iam::123456789012:role/example-role
configuration:
azureConfiguration:
applicationDisplayName: example-ssmcloudconnector
applicationId: example-id
targets:
subscriptions:
- displayName: example-ssmcloudconnector
id: example-id
tenantDisplayName: example-ssmcloudconnector
tenantId: example-id
description: Managed by konfig-konector
displayName: example-ssmcloudconnector
providerRef:
name: example-ssmcloudconnector
region: us-east-1
roleArn: arn:aws:iam::123456789012:role/example-role
tags:
- key: example
value: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
configConnectorArn | string | yes | The ARN of the AWS Config connector. |
configuration | object | yes | The configuration for the cloud connector. |
configuration.azureConfiguration | object | yes | SSMCloudConnectorAzureConfiguration is a nested property type of AWS::SSM::CloudConnector. |
configuration.azureConfiguration.applicationDisplayName | string | — | The display name of the Azure AD application. |
configuration.azureConfiguration.applicationId | string | yes | The Azure AD application ID. |
configuration.azureConfiguration.targets | object | — | SSMCloudConnectorConfigurationTargets is a nested property type of AWS::SSM::CloudConnector. |
configuration.azureConfiguration.targets.subscriptions | array<object> | yes | List of Azure subscriptions. |
configuration.azureConfiguration.targets.subscriptions[].displayName | string | — | The display name of the Azure subscription. |
configuration.azureConfiguration.targets.subscriptions[].id | string | yes | The Azure subscription ID. |
configuration.azureConfiguration.tenantDisplayName | string | — | The display name of the Azure AD tenant. |
configuration.azureConfiguration.tenantId | string | yes | The Azure AD tenant ID. |
description | string | — | The description of the cloud connector. |
displayName | string | yes | The display name of the cloud connector. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
roleArn | string | yes | The IAM role ARN used by the cloud connector. |
tags | array<object> | — | Tags to apply to the cloud connector. |
tags[].key | string | yes | |
tags[].value | string | yes |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
cloudConnectorArn | string | — | The ARN of the cloud connector. |
cloudConnectorId | string | — | The unique identifier of the cloud connector. |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
createdAt | string | — | The timestamp when the cloud connector was created. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
updatedAt | string | — | The timestamp when the cloud connector was last updated. |
SSMDocument # GA
SSMDocument is the Schema for managing SSM documents.
kubectl get ssmdocuments · example on GitHub
Example
# SSMDocument — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmdocument
apiVersion: aws.konfig.io/v1alpha1
kind: SSMDocument
metadata:
name: example-ssmdocument
namespace: default
spec:
content: example
documentFormat: JSON
documentType: Command
name: example-ssmdocument
providerRef:
name: example-ssmdocument
region: us-east-1
tags:
environment: dev
team: platform
versionName: example-ssmdocument
Spec
| Field | Type | Required | Description |
|---|---|---|---|
content | string | yes | Content is the document content in JSON or YAML format. |
documentFormat | enum | — | DocumentFormat is the format of the document (JSON or YAML). Allowed: JSON, YAML, TEXT |
documentType | enum | — | DocumentType is the type of the document. Allowed: Command, Policy, Automation, Session, Package, ApplicationConfiguration, ApplicationConfigurationSchema, DeploymentStrategy… |
name | string | yes | Name is the name of the SSM document. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
tags | map<string> | — | Tags are metadata tags for the document. |
versionName | string | — | VersionName is an optional version identifier. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
documentVersion | string | — | DocumentVersion is the current version of the document. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
status | string | — | Status is the current status of the document. |
SSMMaintenanceWindow # GA
SSMMaintenanceWindow is the Schema for managing SSM maintenance windows.
kubectl get ssmmaintenancewindows · example on GitHub
Example
# SSMMaintenanceWindow — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmmaintenancewindow
apiVersion: aws.konfig.io/v1alpha1
kind: SSMMaintenanceWindow
metadata:
name: example-ssmmaintenancewindow
namespace: default
spec:
allowUnassociatedTargets: false
cutoff: 1
description: Managed by konfig-konector
duration: 1
name: example-ssmmaintenancewindow
providerRef:
name: example-ssmmaintenancewindow
region: us-east-1
schedule: example
tags:
environment: dev
team: platform
timezone: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
allowUnassociatedTargets | boolean | — | AllowUnassociatedTargets permits running tasks on targets not registered with the window. |
cutoff | integer | yes | Cutoff is the number of hours before the end of the window that new tasks stop being scheduled. |
description | string | — | Description of the maintenance window. |
duration | integer | yes | Duration of the maintenance window in hours. |
name | string | yes | Name is the name of the maintenance window. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
schedule | string | yes | Schedule is a cron or rate expression, e.g. |
tags | map<string> | — | Tags are AWS resource tags to apply on creation. |
timezone | string | — | Timezone in IANA format, e.g. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
windowId | string | — | WindowID is the AWS maintenance window ID (mw-...). |
SSMMaintenanceWindowTarget # CLOUD CONTROL · AWS::SSM::MaintenanceWindowTarget
SSMMaintenanceWindowTarget manages AWS::SSM::MaintenanceWindowTarget through the AWS Cloud Control API.
kubectl get ssmmaintenancewindowtargets · example on GitHub
Example
# SSMMaintenanceWindowTarget — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmmaintenancewindowtarget
apiVersion: aws.konfig.io/v1alpha1
kind: SSMMaintenanceWindowTarget
metadata:
name: example-ssmmaintenancewindowtarget
namespace: default
spec:
description: Managed by konfig-konector
name: example-ssmmaintenancewindowtarget
ownerInformation: example
providerRef:
name: example-ssmmaintenancewindowtarget
region: us-east-1
resourceType: example
targets:
- key: example
values:
- example
windowId: example-id
Spec
| Field | Type | Required | Description |
|---|---|---|---|
description | string | — | A description for the target. |
name | string | — | The name for the maintenance window target. |
ownerInformation | string | — | A user-provided value that will be included in any Amazon CloudWatch Events events that are raised while running tasks for these targets in this maintenance window. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
resourceType | string | yes | The type of target that is being registered with the maintenance window. |
targets | array<object> | yes | The targets to register with the maintenance window. |
targets[].key | string | yes | User-defined criteria for sending commands that target managed nodes that meet the criteria. |
targets[].values | array<string> | yes | User-defined criteria that maps to Key. |
windowId | string | yes | The ID of the maintenance window to register the target with. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
windowTargetId | string | — | The ID of the target. |
SSMMaintenanceWindowTask # CLOUD CONTROL · AWS::SSM::MaintenanceWindowTask
SSMMaintenanceWindowTask manages AWS::SSM::MaintenanceWindowTask through the AWS Cloud Control API.
kubectl get ssmmaintenancewindowtasks · example on GitHub
Example
# SSMMaintenanceWindowTask — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmmaintenancewindowtask
apiVersion: aws.konfig.io/v1alpha1
kind: SSMMaintenanceWindowTask
metadata:
name: example-ssmmaintenancewindowtask
namespace: default
spec:
cutoffBehavior: example
description: Managed by konfig-konector
loggingInfo:
region: us-east-1
s3Bucket: example
s3Prefix: example
maxConcurrency: example
maxErrors: example
name: example-ssmmaintenancewindowtask
priority: 1
providerRef:
name: example-ssmmaintenancewindowtask
region: us-east-1
serviceRoleArn: arn:aws:iam::123456789012:role/example-role
targets:
- key: example
values:
- example
taskArn: arn:aws:iam::123456789012:role/example-role
taskInvocationParameters:
maintenanceWindowAutomationParameters:
documentVersion: '1.0'
maintenanceWindowLambdaParameters:
clientContext: example
payload: example
qualifier: example
maintenanceWindowRunCommandParameters:
cloudWatchOutputConfig:
cloudWatchLogGroupName: example-ssmmaintenancewindowtask
cloudWatchOutputEnabled: true
comment: Managed by konfig-konector
documentHash: example
documentHashType: example
documentVersion: '1.0'
notificationConfig:
notificationArn: arn:aws:iam::123456789012:role/example-role
notificationEvents:
- example
notificationType: example
outputS3BucketName: example-ssmmaintenancewindowtask
outputS3KeyPrefix: example
serviceRoleArn: arn:aws:iam::123456789012:role/example-role
timeoutSeconds: 300
maintenanceWindowStepFunctionsParameters:
input: example
name: example-ssmmaintenancewindowtask
taskType: example
windowId: example-id
Spec
| Field | Type | Required | Description |
|---|---|---|---|
cutoffBehavior | string | — | The specification for whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached. |
description | string | — | A description of the task. |
loggingInfo | object | — | Information about an Amazon S3 bucket to write Run Command task-level logs to. |
loggingInfo.region | string | yes | |
loggingInfo.s3Bucket | string | yes | |
loggingInfo.s3Prefix | string | — | |
maxConcurrency | string | — | The maximum number of targets this task can be run for, in parallel. |
maxErrors | string | — | The maximum number of errors allowed before this task stops being scheduled. |
name | string | — | The task name. |
priority | integer | yes | The priority of the task in the maintenance window. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
serviceRoleArn | string | — | The Amazon Resource Name (ARN) of the IAM service role for AWS Systems Manager to assume when running a maintenance window task. |
targets | array<object> | — | The targets (either instances or window target ids). |
targets[].key | string | yes | |
targets[].values | array<string> | yes | |
taskArn | string | yes | The resource that the task uses during execution. |
taskInvocationParameters | object | — | The parameters to pass to the task when it runs. |
taskInvocationParameters.maintenanceWindowAutomationParameters | object | — | SSMMaintenanceWindowTaskMaintenanceWindowAutomationParameters is a nested property type of AWS::SSM::MaintenanceWindowTask. |
taskInvocationParameters.maintenanceWindowAutomationParameters.documentVersion | string | — | |
taskInvocationParameters.maintenanceWindowAutomationParameters.parameters | object | — | |
taskInvocationParameters.maintenanceWindowLambdaParameters | object | — | SSMMaintenanceWindowTaskMaintenanceWindowLambdaParameters is a nested property type of AWS::SSM::MaintenanceWindowTask. |
taskInvocationParameters.maintenanceWindowLambdaParameters.clientContext | string | — | |
taskInvocationParameters.maintenanceWindowLambdaParameters.payload | string | — | |
taskInvocationParameters.maintenanceWindowLambdaParameters.qualifier | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters | object | — | SSMMaintenanceWindowTaskMaintenanceWindowRunCommandParameters is a nested property type of AWS::SSM::MaintenanceWindowTask. |
taskInvocationParameters.maintenanceWindowRunCommandParameters.cloudWatchOutputConfig | object | — | SSMMaintenanceWindowTaskCloudWatchOutputConfig is a nested property type of AWS::SSM::MaintenanceWindowTask. |
taskInvocationParameters.maintenanceWindowRunCommandParameters.cloudWatchOutputConfig.cloudWatchLogGroupName | string | — | The name of the CloudWatch log group where you want to send command output. |
taskInvocationParameters.maintenanceWindowRunCommandParameters.cloudWatchOutputConfig.cloudWatchOutputEnabled | boolean | — | Enables Systems Manager to send command output to CloudWatch Logs. |
taskInvocationParameters.maintenanceWindowRunCommandParameters.comment | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.documentHash | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.documentHashType | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.documentVersion | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.notificationConfig | object | — | SSMMaintenanceWindowTaskNotificationConfig is a nested property type of AWS::SSM::MaintenanceWindowTask. |
taskInvocationParameters.maintenanceWindowRunCommandParameters.notificationConfig.notificationArn | string | yes | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.notificationConfig.notificationEvents | array<string> | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.notificationConfig.notificationType | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.outputS3BucketName | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.outputS3KeyPrefix | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.parameters | object | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.serviceRoleArn | string | — | |
taskInvocationParameters.maintenanceWindowRunCommandParameters.timeoutSeconds | integer | — | |
taskInvocationParameters.maintenanceWindowStepFunctionsParameters | object | — | SSMMaintenanceWindowTaskMaintenanceWindowStepFunctionsParameters is a nested property type of AWS::SSM::MaintenanceWindowTask. |
taskInvocationParameters.maintenanceWindowStepFunctionsParameters.input | string | — | |
taskInvocationParameters.maintenanceWindowStepFunctionsParameters.name | string | — | |
taskParameters | object | — | The parameters to pass to the task when it runs. |
taskType | string | yes | The type of task. |
windowId | string | yes | The ID of the maintenance window where the task is registered. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
windowTaskId | string | — | Unique identifier of the maintenance window task. |
SSMOpsItem # CLOUD CONTROL · AWS::SSM::OpsItem
SSMOpsItem manages AWS::SSM::OpsItem through the AWS Cloud Control API.
kubectl get ssmopsitems · example on GitHub
Example
# SSMOpsItem — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmopsitem
apiVersion: aws.konfig.io/v1alpha1
kind: SSMOpsItem
metadata:
name: example-ssmopsitem
namespace: default
spec:
category: example
description: Managed by konfig-konector
priority: 1
providerRef:
name: example-ssmopsitem
region: us-east-1
severity: example
source: example
tags:
- key: example
value: example
title: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
category | string | — | The category of the OpsItem. |
description | string | yes | The description of the OpsItem. |
priority | integer | — | The priority of the OpsItem. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
severity | string | — | The severity of the OpsItem. |
source | string | yes | The origin of the OpsItem. |
tags | array<object> | — | Tags for the OpsItem. |
tags[].key | string | yes | |
tags[].value | string | yes | |
title | string | yes | The title of the OpsItem. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
createdBy | string | — | The user who created the OpsItem. |
createdTime | string | — | The time the OpsItem was created. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastModifiedBy | string | — | The user who last modified the OpsItem. |
lastModifiedTime | string | — | The time the OpsItem was last modified. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
opsItemArn | string | — | The ARN of the OpsItem. |
opsItemId | string | — | The ID of the OpsItem. |
opsItemType | string | — | The type of OpsItem. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
status | string | — | The status of the OpsItem. |
version | string | — | The version of the OpsItem. |
SSMParameter # GA
SSMParameter is the Schema for managing AWS SSM Parameters.
kubectl get ssmparameters · example on GitHub
Example
# SSMParameter — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmparameter
apiVersion: aws.konfig.io/v1alpha1
kind: SSMParameter
metadata:
name: example-ssmparameter
namespace: default
spec:
description: Managed by konfig-konector
kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
overwrite: false
parameterName: example-ssmparameter
providerRef:
name: example-ssmparameter
region: us-east-1
tags:
environment: dev
team: platform
tier: Standard
type: String
value: example
valueFrom:
key: example
name: example-ssmparameter
Spec
| Field | Type | Required | Description |
|---|---|---|---|
description | string | — | Description is a human-readable description. |
kmsKeyId | string | — | KMSKeyID is the KMS key ID for SecureString parameters. |
overwrite | boolean | — | Overwrite allows updating an existing parameter. |
parameterName | string | yes | ParameterName is the full name of the parameter (e.g. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
tags | map<string> | — | Tags are AWS resource tags to apply. |
tier | enum | — | Tier is the parameter tier. Allowed: Standard, Advanced, Intelligent-Tiering |
type | enum | yes | Type is the parameter type. Allowed: String, StringList, SecureString |
value | string | — | Value is the parameter value. |
valueFrom | object | — | ValueFrom references a Kubernetes Secret containing the parameter value. |
valueFrom.key | string | yes | Key is the key within the Secret whose value to use. |
valueFrom.name | string | yes | Name of the Kubernetes Secret. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | ARN is the ARN of the SSM parameter. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
version | integer | — | Version is the current version of the parameter. |
SSMPatchBaseline # GA
SSMPatchBaseline is the Schema for managing SSM patch baselines.
kubectl get ssmpatchbaselines · example on GitHub
Example
# SSMPatchBaseline — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmpatchbaseline
apiVersion: aws.konfig.io/v1alpha1
kind: SSMPatchBaseline
metadata:
name: example-ssmpatchbaseline
namespace: default
spec:
approvalRules:
- approveAfterDays: 1
complianceLevel: CRITICAL
patchFilters:
- key: example
values:
- example
approvedPatches:
- example
description: Managed by konfig-konector
name: example-ssmpatchbaseline
operatingSystem: example
providerRef:
name: example-ssmpatchbaseline
region: us-east-1
rejectedPatches:
- example
tags:
environment: dev
team: platform
Spec
| Field | Type | Required | Description |
|---|---|---|---|
approvalRules | array<object> | — | ApprovalRules are the auto-approval rules. |
approvalRules[].approveAfterDays | integer | — | ApproveAfterDays auto-approves patches this many days after release. |
approvalRules[].complianceLevel | enum | — | ComplianceLevel assigned to approved patches: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, or UNSPECIFIED. Allowed: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNSPECIFIED |
approvalRules[].patchFilters | array<object> | yes | PatchFilters select the patches the rule applies to. |
approvalRules[].patchFilters[].key | string | yes | Key is the patch filter key, e.g. |
approvalRules[].patchFilters[].values | array<string> | yes | Values for the filter key. |
approvedPatches | array<string> | — | ApprovedPatches is an explicit list of approved patch IDs. |
description | string | — | Description of the patch baseline. |
name | string | yes | Name is the name of the patch baseline. |
operatingSystem | string | yes | OperatingSystem the baseline applies to, e.g. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
rejectedPatches | array<string> | — | RejectedPatches is an explicit list of rejected patch IDs. |
tags | map<string> | — | Tags are AWS resource tags to apply on creation. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
baselineId | string | — | BaselineID is the AWS patch baseline ID (pb-...). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
lastSyncTime | string | — | LastSyncTime is when the resource was last successfully reconciled. |
observedGeneration | integer | — | ObservedGeneration is the most recent .metadata.generation reconciled. |
SSMResourceDataSync # CLOUD CONTROL · AWS::SSM::ResourceDataSync
SSMResourceDataSync manages AWS::SSM::ResourceDataSync through the AWS Cloud Control API.
kubectl get ssmresourcedatasyncs · example on GitHub
Example
# SSMResourceDataSync — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmresourcedatasync
apiVersion: aws.konfig.io/v1alpha1
kind: SSMResourceDataSync
metadata:
name: example-ssmresourcedatasync
namespace: default
spec:
bucketName: example-ssmresourcedatasync
bucketPrefix: example
bucketRegion: example
kmsKeyArn: arn:aws:iam::123456789012:role/example-role
providerRef:
name: example-ssmresourcedatasync
region: us-east-1
s3Destination:
bucketName: example-ssmresourcedatasync
bucketPrefix: example
bucketRegion: example
kmsKeyArn: arn:aws:iam::123456789012:role/example-role
syncFormat: example
syncFormat: example
syncName: example-ssmresourcedatasync
syncSource:
awsOrganizationsSource:
organizationSourceType: example
organizationalUnits:
- example
includeFutureRegions: false
sourceRegions:
- example
sourceType: example
syncType: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
bucketName | string | — | Create-only in AWS: changing it requires replacing the resource. |
bucketPrefix | string | — | Create-only in AWS: changing it requires replacing the resource. |
bucketRegion | string | — | Create-only in AWS: changing it requires replacing the resource. |
kmsKeyArn | string | — | Create-only in AWS: changing it requires replacing the resource. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
s3Destination | object | — | Create-only in AWS: changing it requires replacing the resource. |
s3Destination.bucketName | string | yes | |
s3Destination.bucketPrefix | string | — | |
s3Destination.bucketRegion | string | yes | |
s3Destination.kmsKeyArn | string | — | |
s3Destination.syncFormat | string | yes | |
syncFormat | string | — | Create-only in AWS: changing it requires replacing the resource. |
syncName | string | yes | Create-only in AWS: changing it requires replacing the resource. |
syncSource | object | — | SSMResourceDataSyncSyncSource is a nested property type of AWS::SSM::ResourceDataSync. |
syncSource.awsOrganizationsSource | object | — | SSMResourceDataSyncAwsOrganizationsSource is a nested property type of AWS::SSM::ResourceDataSync. |
syncSource.awsOrganizationsSource.organizationSourceType | string | yes | |
syncSource.awsOrganizationsSource.organizationalUnits | array<string> | — | |
syncSource.includeFutureRegions | boolean | — | |
syncSource.sourceRegions | array<string> | yes | |
syncSource.sourceType | string | yes | |
syncType | string | — | Create-only in AWS: changing it requires replacing the resource. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
SSMResourcePolicy # CLOUD CONTROL · AWS::SSM::ResourcePolicy
SSMResourcePolicy manages AWS::SSM::ResourcePolicy through the AWS Cloud Control API.
kubectl get ssmresourcepolicies · example on GitHub
Example
# SSMResourcePolicy — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: SSMResourcePolicy
metadata:
name: example-ssmresourcepolicy
namespace: default
spec:
providerRef:
name: example-ssmresourcepolicy
region: us-east-1
resourceArn: arn:aws:iam::123456789012:role/example-role
Spec
| Field | Type | Required | Description |
|---|---|---|---|
policy | object | yes | Actual policy statement. |
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
resourceArn | string | yes | Arn of OpsItemGroup etc. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
policyHash | string | — | A snapshot identifier for the policy over time. |
policyId | string | — | An unique identifier within the policies of a resource. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
SSMServiceSetting # CLOUD CONTROL · AWS::SSM::ServiceSetting
SSMServiceSetting manages AWS::SSM::ServiceSetting through the AWS Cloud Control API.
kubectl get ssmservicesettings · example on GitHub
Example
# SSMServiceSetting — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmservicesetting
apiVersion: aws.konfig.io/v1alpha1
kind: SSMServiceSetting
metadata:
name: example-ssmservicesetting
namespace: default
spec:
providerRef:
name: example-ssmservicesetting
region: us-east-1
settingId: example-id
settingValue: example
Spec
| Field | Type | Required | Description |
|---|---|---|---|
providerRef | object | — | ProviderRef selects the AWSProvider (account/region) this resource is reconciled against. |
providerRef.name | string | yes | Name of a cluster-scoped AWSProvider. |
providerRef.region | string | — | Region overrides the provider's region for this resource only. |
settingId | string | yes | The ID of the service setting, such as /ssm/parameter-store/high-throughput-enabled. |
settingValue | string | yes | The value of the service setting. |
Status
| Field | Type | Required | Description |
|---|---|---|---|
arn | string | — | The ARN of the service setting. |
attempt | integer | — | Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure. |
awsProvider | object | — | AWSProvider confirms the account and region this resource was reconciled against. |
awsProvider.accountId | string | — | AccountID the resource lives in. |
awsProvider.name | string | — | Name of the AWSProvider used; empty when the operator's own credentials were used. |
awsProvider.region | string | — | Region the resource lives in (empty for global services). |
conditions | array<object> | — | Conditions describe the current state of the resource. |
conditions[].lastTransitionTime | string | yes | lastTransitionTime is the last time the condition transitioned from one status to another. |
conditions[].message | string | yes | message is a human readable message indicating details about the transition. |
conditions[].observedGeneration | integer | — | observedGeneration represents the .metadata.generation that the condition was set based upon. |
conditions[].reason | string | yes | reason contains a programmatic identifier indicating the reason for the condition's last transition. |
conditions[].status | enum | yes | status of the condition, one of True, False, Unknown. Allowed: True, False, Unknown |
conditions[].type | string | yes | type of condition in CamelCase or in foo.example.com/CamelCase. |
identifier | string | — | Identifier is the Cloud Control primary identifier of the resource. |
lastModifiedDate | string | — | The last time the service setting was modified. |
lastModifiedUser | string | — | The ARN of the last modified user. |
lastSyncTime | string | — | |
observedGeneration | integer | — | |
operation | string | — | Operation is the in-flight operation (CREATE, UPDATE, DELETE). |
operationStatus | string | — | OperationStatus is the last reported operation status. |
requestToken | string | — | RequestToken tracks an in-flight asynchronous operation. |
status | string | — | The status of the service setting. |