cluster-class.yaml

apiVersion: cluster.x-k8s.io/v1beta1
kind: ClusterClass
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Version }}
spec:
  controlPlane:
    ref:
      apiVersion: controlplane.cluster.x-k8s.io/v1beta1
      kind: KubeadmControlPlaneTemplate
      name: {{ .Release.Name }}-{{ .Chart.Version }}-control-plane
    machineInfrastructure:
      ref:
        kind: OpenStackMachineTemplate
        apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
        name: {{ .Release.Name }}-{{ .Chart.Version }}-control-plane
  infrastructure:
    ref:
      apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
      kind: OpenStackClusterTemplate
      name: {{ .Release.Name }}-{{ .Chart.Version }}-cluster
  workers:
    machineDeployments:
    - class: default-worker
      template:
        bootstrap:
          ref:
            apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
            kind: KubeadmConfigTemplate
            name: {{ .Release.Name }}-{{ .Chart.Version }}-default-worker
        infrastructure:
          ref:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            name: {{ .Release.Name }}-{{ .Chart.Version }}-default-worker
  variables:
    - name: external_id
      required: false
      schema:
        openAPIV3Schema:
          type: string
          example: "ebfe5546-f09f-4f42-ab54-094e457d42ec"
          format: "uuid4"
          description: "ExternalNetworkID is the ID of an external OpenStack Network. This is necessary to get public internet to the VMs."
    - name: controller_flavor
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: "SCS-2V-4-20s"
          example: "SCS-2V-4-20s"
          description: "OpenStack instance flavor for control-plane nodes."
    - name: worker_flavor
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: "SCS-2V-4"
          example: "SCS-2V-4"
          description: "OpenStack instance flavor for worker nodes."
    - name: controller_root_disk
      required: false
      schema:
        openAPIV3Schema:
          type: integer
          minimum: 1
          example: 25
          description: "Root disk size in GiB for control-plane nodes. OpenStack volume will be created and used instead of an ephemeral disk defined in flavor. Should only be used for the diskless flavors."
    - name: worker_root_disk
      required: false
      schema:
        openAPIV3Schema:
          type: integer
          minimum: 1
          default: 25
          example: 25
          description: "Root disk size in GiB for worker nodes. OpenStack volume will be created and used instead of an ephemeral disk defined in flavor. Should be used for the diskless flavors."
    - name: yawol_flavor_id
      required: false
      schema:
        openAPIV3Schema:
          type: string
          format: "uuid4"
          example: "0a79590e-10d7-4c2c-8f69-ca0a2c6208d2"
          description: "ID of the existing flavor used as a default yawol flavor."
    - name: yawol_image_id
      required: false
      schema:
        openAPIV3Schema:
          type: string
          format: "uuid4"
          example: "f0b2ef46-f0ff-43d2-9c08-f58a5a6e9060"
          description: "ID of the existing imaged used as a default yawol image."
    - name: kube_vip_network_id
      required: false
      schema:
        openAPIV3Schema:
          type: string
          format: "uuid4"
          example: "40a51f6c-9e4b-4b24-9187-49851a410c97"
          description: "ID of the existing network. The network should have one subnet with one port reserved as virtual IP."
    - name: kube_vip_apiserver_virtual_ip
      required: false
      schema:
        openAPIV3Schema:
          type: string
          format: "ipv4"
          example: "10.0.0.197"
          description: "Virtual IP address reserved in kube_vip_network_id."
    - name: kube_vip_apiserver_public_ip
      required: false
      schema:
        openAPIV3Schema:
          type: string
          format: "ipv4"
          description: "Public IP address associated with kube_vip_apiserver_virtual_ip. It is needed only when the management cluster is on a different network as a workload cluster."
    - name: registry_mirrors
      required: false
      schema:
        openAPIV3Schema:
          type: array
          default: []
          example: [ { hostname_upstream: "docker.io", url_upstream: "https://registry-1.docker.io", url_mirror: "https://registry.foo.tld/v2/foo", cert_mirror: "" }, { hostname_upstream: "gcr.io", url_upstream: "https://gcr.io", url_mirror: "https://registry.bar.tld/v2/foo", cert_mirror: "" } ]
          description: "Registry mirrors for upstream registries"
          items:
            type: object
            properties:
              hostname_upstream:
                type: string
                example: "docker.io"
                description: "The hostname of the upstream registry"
              url_upstream:
                type: string
                example: "https://registry-1.docker.io"
                description: "The url of the upstream registry"
              url_mirror:
                type: string
                example: "https://registry.xyz.tld/v2/dockerhub"
                description: "The url of the mirror"
              cert_mirror:
                type: string
                example: "<PEM>"
                description: "The certificate of mirror in PEM format"
    - name: openstack_security_groups
      required: false
      schema:
        openAPIV3Schema:
          type: array
          default: []
          example: ["security-group-1"]
          description: "The names of the security groups to assign to the instance"
          items:
            type: string
    - name: cloud_name
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: "openstack"
          example: "openstack"
          description: "The name of the cloud to use from the clouds secret"
    - name: secret_name
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: "openstack"
          example: "openstack"
          description: "The name of the clouds secret"
    - name: controller_server_group_id
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: ""
          example: "3adf4e92-bb33-4e44-8ad3-afda9dfe8ec3"
          description: "The server group to assign the control plane nodes to."
    - name: worker_server_group_id
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: ""
          example: "869fe071-1e56-46a9-9166-47c9f228e297"
          description: "The server group to assign the worker nodes to."
    - name: ssh_key
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: ""
          example: "capi-keypair"
          description: "The ssh key to inject in the nodes."
    - name: apiserver_loadbalancer
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: "octavia-amphora"
          example: "none, octavia-amphora, octavia-ovn, kube-vip"
          description: | 
            "In this cluster-stack we have two kind of loadbalancers. Each of them has its own configuration variable. This setting here is to configure the loadbalancer that is placed in front of the apiserver.
            To configure the loadbalancer for the workloads, see variable workload_loadbalancer.
            You can choose from 4 options:

            none:
              No loadbalancer solution will be deployed

            octavia-amphora:
              (default) Uses openstack's loadbalancer service (provider:amphora)
            
            octavia-ovn:
              Uses openstack's loadbalancer service (provider:ovn)

            kube-vip:
              Uses kube-vip as loadbalancer.
              You have to provide the following additional variables: 
                kube_vip_network_id
                kube_vip_apiserver_virtual_ip
                kube_vip_apiserver_public_ip 
             
              Requires Kubernetes version < 1.29
              Also the settings node_cidr and dns_nameservers will no longer have an effect.
       
    - name: workload_loadbalancer
      required: false
      schema:
        openAPIV3Schema:
          type: string
          default: "octavia-amphora"
          example: "none, octavia-amphora, octavia-ovn, yawol"
          description: |
            "This setting here is to configure the loadbalancer solution for your services inside your cluster.
            If you want to configure the loadbalancer in front of your apiserver, see variable apiserver_loadbalancer instead.
            You can choose from 4 options:

            none:
              No loadbalancer solution will be deployed

            octavia-amphora:
              (default) Uses openstack's loadbalancer service (provider:amphora)
            
            octavia-ovn:
              Uses openstack's loadbalancer service (provider:ovn)

            yawol:
              Uses yawol as loadbalancer.
              You have to provide the following additional variables: 
                yawol_flavor_id
                yawol_image_id
              
              Also note this setting does not work with application credentials (only username/password)"
    - name: dns_nameservers
      required: false
      schema:
        openAPIV3Schema:
          type: array
          description: |
            "DNSNameservers is the list of nameservers for the OpenStack Subnet being created. Set this value when you need to create a new network/subnet while the access through DNS is required.
            This setting has no effect when apiserver_loadbalancer is set to kube-vip.
            However you can set the dns server when creating the subnet for kube-vip."
          default: ["5.1.66.255", "185.150.99.255"]
          example: ["5.1.66.255", "185.150.99.255"]
          items:
            type: string
    - name: node_cidr
      required: false
      schema:
        openAPIV3Schema:
          type: string
          format: "cidr"
          default: "10.8.0.0/20"
          example: "10.8.0.0/20"
          description: |
            "NodeCIDR is the OpenStack Subnet to be created. Cluster actuator will create a network, a subnet with NodeCIDR, and a router connected to this subnet. If you leave this empty, no network will be created.
            This setting has no effect when apiserver_loadbalancer is set to kube-vip.
            However you can set the node_cidr when creating the subnet for kube-vip."
    - name: certSANs
      required: false
      schema:
        openAPIV3Schema:
          type: array
          default: []
          example: ["mydomain.example"]
          description: "CertSANs sets extra Subject Alternative Names for the API Server signing cert."
          items:
            type: string
    - name: oidc_config
      required: false
      schema:
        openAPIV3Schema:
          type: object
          properties:
            client_id:
              type: string
              example: "kubectl"
              description: "A client id that all tokens must be issued for."
            issuer_url:
              type: string
              example: "https://dex.k8s.scs.community"
              description: "URL of the provider that allows the API server to
dis cover public signing keys. Only URLs that use the https:// scheme are
acc epted. This is typically the provider's discovery URL, changed to have an
emp ty path"
            username_claim:
              type: string
              example: "preferred_username"
              default: "preferred_username"
              description: "JWT claim to use as the user name. By default sub,
whi ch is expected to be a unique identifier of the end user. Admins can choose
oth er claims, such as email or name, depending on their provider. However,
cla ims other than email will be prefixed with the issuer URL to prevent naming
cla shes with other plugins."
            groups_claim:
              type: string
              example: "groups"
              default: "groups"
              description: "JWT claim to use as the user's group. If the claim
is  present it must be an array of strings."
            username_prefix:
              type: string
              example: "oidc:"
              default: "oidc:"
              description: "Prefix prepended to username claims to prevent
cla shes with existing names (such as system: users). For example, the value
oid c: will create usernames like oidc:jane.doe. If this flag isn't provided and
--o idc-username-claim is a value other than email the prefix defaults to (
Iss uer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value
- c an be used to disable all prefixing."
            groups_prefix:
              type: string
              example: "oidc:"
              default: "oidc:"
              description: "Prefix prepended to group claims to prevent clashes
wit h existing names (such as system: groups). For example, the value oidc: will
cre ate group names like oidc:engineering and oidc:infra."
    - name: network_mtu
      required: false
      schema:
        openAPIV3Schema:
          type: integer
          example: 1500
          description: "NetworkMTU sets the maximum transmission unit (MTU) value to address fragmentation for the private network ID."
    - name: controlPlaneAvailabilityZones
      required: false
      schema:
        openAPIV3Schema:
          type: array
          example: ["nova"]
          description: "ControlPlaneAvailabilityZones is the set of availability zones which control plane machines may be deployed to."
          items:
            type: string
    - name: controlPlaneOmitAvailabilityZone
      required: false
      schema:
        openAPIV3Schema:
          type: boolean
          example: true
          description: "ControlPlaneOmitAvailabilityZone causes availability zone to be omitted when creating control plane nodes, allowing the Nova scheduler to make a decision on which availability zone to use based on other scheduling constraints."
  patches:
    - name: k8s_version
      description: "Sets the openstack node image for workers and the controlplane to the cluster-api image with the version mentioned in spec.topology.version."
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/image/filter/name"
            valueFrom:
              template: ubuntu-capi-image-{{ `{{ .builtin.cluster.topology.version }}` }}
    - name: apiserver_loadbalancer_octavia-amphora
      description: "Takes care of the patches that should be applied when variable apiserver_loadbalancer is set to octavia-amphora."
      enabledIf: {{ `'{{ eq .apiserver_loadbalancer "octavia-amphora" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/apiServerLoadBalancer/enabled"
            value: true
          - op: add
            path: "/spec/template/spec/apiServerLoadBalancer/provider"
            value: "amphora"
    - name: apiserver_loadbalancer_octavia-ovn
      description: "Takes care of the patches that should be applied when variable apiserver_loadbalancer is set to octavia-ovn."
      enabledIf: {{ `'{{ eq .apiserver_loadbalancer "octavia-ovn" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/apiServerLoadBalancer/enabled"
            value: true
          - op: add
            path: "/spec/template/spec/apiServerLoadBalancer/provider"
            value: "ovn"
    - name: apiserver_loadbalancer_kube-vip
      description: "Takes care of the patches that should be applied when variable apiserver_loadbalancer is set to kube-vip."
      enabledIf: {{ `'{{ eq .apiserver_loadbalancer "kube-vip" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/network"
            valueFrom:
              template: |
                id: {{"{{"}} .kube_vip_network_id {{"}}"}}
          - op: add
            path: "/spec/template/spec/disableAPIServerFloatingIP"
            value: true
          - op: add
            path: "/spec/template/spec/apiServerFixedIP"
            valueFrom:
              template: {{ `"{{ if .kube_vip_apiserver_public_ip }}{{.kube_vip_apiserver_public_ip}}{{else}}{{.kube_vip_apiserver_virtual_ip}}{{end}}"` }}
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/ports"
            valueFrom:
              template: |
                - network:
                    id: {{"{{"}} .kube_vip_network_id {{"}}"}}
                  allowedAddressPairs:
                  - ipAddress: {{"{{"}} .kube_vip_apiserver_virtual_ip {{"}}"}}
        - selector:
            apiVersion: controlplane.cluster.x-k8s.io/v1beta1
            kind: KubeadmControlPlaneTemplate
            matchResources:
              controlPlane: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/preKubeadmCommands"
            valueFrom:
              template: |
                - modprobe --all ip_vs ip_vs_rr nf_conntrack
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/files"
            valueFrom:
              template: |
                - content: |
                    ip_vs
                    ip_vs_rr
                    nf_conntrack
                  owner: "root:root"
                  path: /etc/modules-load.d/kube-vip.conf
                  permissions: "0644"
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/files/-"
            valueFrom:
              template: |
                content: |
                  # docker run --network host --rm ghcr.io/kube-vip/kube-vip:v0.7.2 manifest pod --address '{{"{{"}} .kube_vip_apiserver_virtual_ip {{"}}"}}' --controlplane --arp --leaderElection --enableLoadBalancer
                  apiVersion: v1
                  kind: Pod
                  metadata:
                    creationTimestamp: null
                    name: kube-vip
                    namespace: kube-system
                  spec:
                    containers:
                    - args:
                      - manager
                      env:
                      - name: vip_arp
                        value: "true"
                      - name: port
                        value: "6443"
                      - name: vip_cidr
                        value: "32"
                      - name: dns_mode
                        value: first
                      - name: cp_enable
                        value: "true"
                      - name: cp_namespace
                        value: kube-system
                      - name: vip_leaderelection
                        value: "true"
                      - name: vip_leasename
                        value: plndr-cp-lock
                      - name: vip_leaseduration
                        value: "5"
                      - name: vip_renewdeadline
                        value: "3"
                      - name: vip_retryperiod
                        value: "1"
                      - name: lb_enable
                        value: "true"
                      - name: lb_port
                        value: "6443"
                      - name: lb_fwdmethod
                        value: local
                      - name: address
                        value: '{{"{{"}} .kube_vip_apiserver_virtual_ip {{"}}"}}'
                      - name: prometheus_server
                        value: :2112
                      image: ghcr.io/kube-vip/kube-vip:v0.7.2
                      imagePullPolicy: IfNotPresent # Always
                      name: kube-vip
                      resources: {}
                      securityContext:
                        capabilities:
                          add:
                          - NET_ADMIN
                          - NET_RAW
                      volumeMounts:
                      - mountPath: /etc/kubernetes/admin.conf
                        name: kubeconfig
                    hostAliases:
                    - hostnames:
                      - kubernetes
                      ip: 127.0.0.1
                    hostNetwork: true
                    volumes:
                    - hostPath:
                        path: /etc/kubernetes/admin.conf
                      name: kubeconfig
                  status: {}
                owner: "root:root"
                path: /etc/kubernetes/manifests/kube-vip.yaml
                permissions: "0644"
    - name: controller_flavor
      description: "Sets the openstack instance flavor for the KubeadmControlPlane."
      enabledIf: {{ `'{{ ne .controller_flavor "" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/flavor"
            valueFrom:
              variable: controller_flavor
    - name: worker_flavor
      description: "Sets the openstack instance flavor for the worker nodes."
      enabledIf: {{ `'{{ ne .worker_flavor "" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: false
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/flavor"
            valueFrom:
              variable: worker_flavor
    - name: controller_root_disk
      description: "Sets the root disk size in GiB for control-plane nodes."
      enabledIf: {{ `"{{ if .controller_root_disk }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/rootVolume"
            valueFrom:
              template: |
                sizeGiB: {{"{{"}} .controller_root_disk {{"}}"}}
    - name: worker_root_disk
      description: "Sets the root disk size in GiB for worker nodes."
      enabledIf: {{ `"{{ if .worker_root_disk }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: false
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: add
            path: "/spec/template/spec/rootVolume"
            valueFrom:
              template: |
                sizeGiB: {{"{{"}} .worker_root_disk {{"}}"}}
    - name: external_id
      description: "Sets the ID of an external OpenStack Network. This is necessary to get public internet to the VMs."
      enabledIf: {{ `"{{ if .external_id }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/externalNetwork"
            value: {}
          - op: add
            path: "/spec/template/spec/externalNetwork/id"
            valueFrom:
              variable: external_id
    - name: network_mtu
      description: "Sets the network MTU when variable network_mtu exist in cluster resource."
      enabledIf: {{ `"{{ if .network_mtu }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/networkMTU"
            valueFrom:
              variable: network_mtu
    - name: controlPlaneAvailabilityZones
      description: "Sets the availability zones which control plane machines may be deployed to."
      enabledIf: {{ `"{{ if .controlPlaneAvailabilityZones }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/controlPlaneAvailabilityZones"
            valueFrom:
              variable: controlPlaneAvailabilityZones
    - name: controlPlaneOmitAvailabilityZone
      description: "Causes availability zone to be omitted when creating control plane nodes."
      enabledIf: {{ `"{{ if .controlPlaneOmitAvailabilityZone }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/controlPlaneOmitAvailabilityZone"
            valueFrom:
              variable: controlPlaneOmitAvailabilityZone
    - name: openstack_security_groups
      description: "Sets the list of the openstack security groups for the worker and the controlplane instances."
      enabledIf: {{ `"{{ if .openstack_security_groups }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: add
            path: "/spec/template/spec/securityGroups"
            valueFrom:
              template: {{ `"[ {{ range .openstack_security_groups }} { filter: { name: {{ . }}}}, {{ end }} ]"` }}
    - name: cloud_name
      description: "Sets the name of the cloud to use from the clouds secret."
      enabledIf: {{ `'{{ ne .cloud_name "" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/identityRef/cloudName"
            valueFrom:
              variable: cloud_name
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/identityRef/cloudName"
            valueFrom:
              variable: cloud_name
    - name: secret_name
      description: "Sets the name of the clouds secret."
      enabledIf: {{ `'{{ ne .secret_name "" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/identityRef/name"
            valueFrom:
              variable: secret_name
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: replace
            path: "/spec/template/spec/identityRef/name"
            valueFrom:
              variable: secret_name
    - name: controller_server_group_id
      description: "Sets the server group to assign the control plane nodes to."
      enabledIf: {{ `'{{ ne .controller_server_group_id "" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/serverGroup"
            valueFrom:
              template: |
                id: {{"{{"}} .controller_server_group_id {{"}}"}}
    - name: worker_server_group_id
      description: "Sets the server group to assign the worker nodes to."
      enabledIf: {{ `'{{ ne .worker_server_group_id "" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: false
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: add
            path: "/spec/template/spec/serverGroup"
            valueFrom:
              template: |
                id: {{"{{"}} .worker_server_group_id {{"}}"}}
    - name: ssh_key
      description: "Sets the ssh key to inject in the nodes."
      enabledIf: {{ `'{{ ne .ssh_key "" }}'` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackMachineTemplate
            matchResources:
              controlPlane: true
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: add
            path: "/spec/template/spec/sshKeyName"
            valueFrom:
              variable: ssh_key
    - name: certSANs
      description: "CertSANs sets extra Subject Alternative Names for the API Server signing cert."
      enabledIf: {{ `"{{ if .certSANs }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: controlplane.cluster.x-k8s.io/v1beta1
            kind: KubeadmControlPlaneTemplate
            matchResources:
              controlPlane: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/certSANs"
            valueFrom:
              variable: certSANs
    - name: oidc_config
      description: "Configure API Server to use external authentication service."
      enabledIf: {{ `"{{ if and .oidc_config .oidc_config.client_id .oidc_config.issuer_url }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: controlplane.cluster.x-k8s.io/v1beta1
            kind: KubeadmControlPlaneTemplate
            matchResources:
              controlPlane: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-client-id"
            valueFrom:
              variable: oidc_config.client_id
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-issuer-url"
            valueFrom:
              variable: oidc_config.issuer_url
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-claim"
            valueFrom:
              variable: oidc_config.username_claim
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-claim"
            valueFrom:
              variable: oidc_config.groups_claim
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-prefix"
            valueFrom:
              variable: oidc_config.username_prefix
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-prefix"
            valueFrom:
              variable: oidc_config.groups_prefix
    - name: subnet
      description: "Sets the NodeCIDR for the OpenStack Subnet to be created. Cluster actuator will create a network, a subnet with NodeCIDR, and a router connected to this subnet."
      enabledIf: {{ `"{{ if and .node_cidr (ne .apiserver_loadbalancer \"kube-vip\")}}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
            kind: OpenStackClusterTemplate
            matchResources:
              infrastructureCluster: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/managedSubnets"
            valueFrom:
              template: |
                - cidr: '{{"{{"}} .node_cidr {{"}}"}}'
                  dnsNameservers:
                  {{`{{- range .dns_nameservers }}`}}
                                  - {{`{{ . }}`}}
                  {{`{{- end }}`}}
    - name: registry_mirrors_worker
      description: "Configure registry mirrors for containerd (worker)."
      enabledIf: {{ `"{{ if .registry_mirrors }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
            kind: KubeadmConfigTemplate
            matchResources:
              machineDeploymentClass:
                names:
                  - default-worker
          jsonPatches:
          - op: add
            path: "/spec/template/spec/files"
            valueFrom:
              template: |
                {{`{{- range $r := .registry_mirrors }}
                - content: |
                    server = "{{ $r.url_upstream }}"
                    [host."{{ $r.url_mirror }}"]
                      capabilities = ["pull","resolve"]
                      override_path = true
                  owner: root:root
                  path: /etc/containerd/certs.d/{{ $r.hostname_upstream }}/hosts.toml
                  permissions: "0644"
                {{- if $r.cert_mirror }}
                - content: "{{ $r.cert_mirror }}"
                  owner: root:root
                  path: /etc/containerd/certs/{{ $r.hostname_upstream }}
                  permissions: "0644"
                {{- end }}
                {{- end }}`}}
    - name: registry_mirrors_control_plane
      description: "Configure registry mirrors for containerd (control plane)."
      enabledIf: {{ `"{{ if .registry_mirrors }}true{{end}}"` }}
      definitions:
        - selector:
            apiVersion: controlplane.cluster.x-k8s.io/v1beta1
            kind: KubeadmControlPlaneTemplate
            matchResources:
              controlPlane: true
          jsonPatches:
          - op: add
            path: "/spec/template/spec/kubeadmConfigSpec/files"
            valueFrom:
              template: |
                {{`{{- range $r := .registry_mirrors }}
                - content: |
                    server = "{{ $r.url_upstream }}"
                    [host."{{ $r.url_mirror }}"]
                      capabilities = ["pull","resolve"]
                      override_path = true
                  owner: root:root
                  path: /etc/containerd/certs.d/{{ $r.hostname_upstream }}/hosts.toml
                  permissions: "0644"
                {{- if $r.cert_mirror }}
                - content: "{{ $r.cert_mirror }}"
                  owner: root:root
                  path: /etc/containerd/certs/{{ $r.hostname_upstream }}
                  permissions: "0644"
                {{- end }}
                {{- end }}`}}