apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: openshift-machine-api-aws
  namespace: openshift-cloud-credential-operator
  annotations:
    exclude.release.openshift.io/internal-openshift-hosted: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
spec:
  secretRef:
    name: aws-cloud-credentials
    namespace: openshift-machine-api
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: AWSProviderSpec
    statementEntries:
    - effect: Allow
      action:
      - ec2:CreateTags
      - ec2:DescribeAvailabilityZones
      - ec2:DescribeDhcpOptions
      - ec2:DescribeImages
      - ec2:DescribeInstances
      - ec2:DescribeSecurityGroups
      - ec2:DescribeSubnets
      - ec2:DescribeVpcs
      - ec2:RunInstances
      - ec2:TerminateInstances
      - elasticloadbalancing:DescribeLoadBalancers
      - elasticloadbalancing:DescribeTargetGroups
      - elasticloadbalancing:RegisterInstancesWithLoadBalancer
      - elasticloadbalancing:RegisterTargets
      - iam:PassRole
      - iam:CreateServiceLinkedRole
      resource: "*"
    - effect: Allow
      action:
      - kms:Decrypt
      - kms:Encrypt
      - kms:GenerateDataKey
      - kms:GenerateDataKeyWithoutPlainText
      - kms:DescribeKey
      resource: '*'
    - effect: Allow
      action:
      - kms:RevokeGrant
      - kms:CreateGrant
      - kms:ListGrants
      resource: '*'
      policyCondition:
        "Bool":
          "kms:GrantIsForAWSResource": true

---
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: openshift-machine-api-azure
  namespace: openshift-cloud-credential-operator
  annotations:
    exclude.release.openshift.io/internal-openshift-hosted: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
spec:
  secretRef:
    name: azure-cloud-credentials
    namespace: openshift-machine-api
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: AzureProviderSpec
    roleBindings:
    - role: Contributor
---
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: openshift-machine-api-openstack
  namespace: openshift-cloud-credential-operator
  annotations:
    exclude.release.openshift.io/internal-openshift-hosted: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
spec:
  secretRef:
    name: openstack-cloud-credentials
    namespace: openshift-machine-api
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: OpenStackProviderSpec
---
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: openshift-machine-api-gcp
  namespace: openshift-cloud-credential-operator
  annotations:
    exclude.release.openshift.io/internal-openshift-hosted: "true"
    include.release.openshift.io/self-managed-high-availability: "true"
spec:
  secretRef:
    name: gcp-cloud-credentials
    namespace: openshift-machine-api
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: GCPProviderSpec
    predefinedRoles:
    - "roles/compute.instanceAdmin.v1"
    - "roles/iam.serviceAccountUser"
    - "roles/compute.loadBalancerAdmin"
# includes compute.targetPools.* currently used to add masters to LB in DR scenarios.
# https://cloud.google.com/compute/docs/access/iam#compute.loadBalancerAdmin

---
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: openshift-machine-api-ovirt
  namespace: openshift-cloud-credential-operator
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
spec:
  secretRef:
    name: ovirt-credentials
    namespace: openshift-machine-api
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: OvirtProviderSpec
---
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: openshift-machine-api-vsphere
  namespace: openshift-cloud-credential-operator
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
spec:
  secretRef:
    name: vsphere-cloud-credentials
    namespace: openshift-machine-api
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: VSphereProviderSpec
---
apiVersion: cloudcredential.openshift.io/v1
kind: CredentialsRequest
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: openshift-machine-api-kubevirt
  namespace: openshift-cloud-credential-operator
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
spec:
  secretRef:
    namespace: openshift-machine-api
    name: kubevirt-credentials
  providerSpec:
    apiVersion: cloudcredential.openshift.io/v1
    kind: KubevirtProviderSpec
