generate with code-gen v0.53.1

michaelhtm · michaelhtm · commit b495830b826a · 2025-11-12T15:25:26.000-08:00
diff --git a/apis/v1alpha1/ack-generate-metadata.yaml b/apis/v1alpha1/ack-generate-metadata.yaml
@@ -1,8 +1,8 @@
 ack_generate_info:
-  build_date: "2025-09-19T17:08:09Z"
-  build_hash: 6b4211163dcc34776b01da9a18217bac0f4103fd
-  go_version: go1.24.6
-  version: v0.52.0
+  build_date: "2025-11-12T23:05:02Z"
+  build_hash: c833f2d14f4fe8953663ff92f4661ae5fb01b8c8
+  go_version: go1.25.1
+  version: v0.53.1
 api_directory_checksum: 2627dc306e3a83c86c04050c6c4336451459e728
 api_version: v1alpha1
 aws_sdk_go_version: v1.32.6
diff --git a/config/crd/bases/sqs.services.k8s.aws_queues.yaml b/config/crd/bases/sqs.services.k8s.aws_queues.yaml
@@ -137,15 +137,15 @@ spec:
 
                   When you use queue tags, keep the following guidelines in mind:
 
-                    - Adding more than 50 tags to a queue isn't recommended.
+                     * Adding more than 50 tags to a queue isn't recommended.
 
-                    - Tags don't have any semantic meaning. Amazon SQS interprets tags as
-                      character strings.
+                     * Tags don't have any semantic meaning. Amazon SQS interprets tags as
+                     character strings.
 
-                    - Tags are case-sensitive.
+                     * Tags are case-sensitive.
 
-                    - A new tag with a key identical to that of an existing tag overwrites
-                      the existing tag.
+                     * A new tag with a key identical to that of an existing tag overwrites
+                     the existing tag.
 
                   For a full list of tag restrictions, see Quotas related to queues (https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-limits.html#limits-queues)
                   in the Amazon SQS Developer Guide.
@@ -181,6 +181,24 @@ spec:
                       matches the supplied CR's Spec field values.
                       https://github.com/aws/aws-controllers-k8s/issues/270
                     type: string
+                  iamRoleSelector:
+                    description: |-
+                      IAMRoleSelector is the selected IAMRoleSelector that is used to manage
+                      the AWS resource. This will be nil if the default controller role is used.
+                    properties:
+                      resourceVersion:
+                        description: |-
+                          ResourceVersion is the metadata.resourceVersion of the selected
+                          IAMRoleSelector object
+                        type: string
+                      selectorName:
+                        description: SelectorName is the k8s resource name of the
+                          IAMRoleSelector object
+                        type: string
+                    required:
+                    - resourceVersion
+                    - selectorName
+                    type: object
                   ownerAccountID:
                     description: |-
                       OwnerAccountID is the AWS Account ID of the account that owns the
diff --git a/config/crd/common/bases/services.k8s.aws_fieldexports.yaml b/config/crd/common/bases/services.k8s.aws_fieldexports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: fieldexports.services.k8s.aws
 spec:
   group: services.k8s.aws
diff --git a/config/crd/common/bases/services.k8s.aws_iamroleselectors.yaml b/config/crd/common/bases/services.k8s.aws_iamroleselectors.yaml
@@ -40,6 +40,9 @@ spec:
             properties:
               arn:
                 type: string
+                x-kubernetes-validations:
+                - message: Value is immutable once set
+                  rule: self == oldSelf
               namespaceSelector:
                 description: IAMRoleSelectorSpec defines the desired state of IAMRoleSelector
                 properties:
@@ -62,9 +65,17 @@ spec:
                 type: object
               resourceTypeSelector:
                 items:
-                  description: |-
-                    GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
-                    to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+                  properties:
+                    group:
+                      type: string
+                    kind:
+                      type: string
+                    version:
+                      type: string
+                  required:
+                  - group
+                  - kind
+                  - version
                   type: object
                 type: array
             required:
diff --git a/config/rbac/cluster-role-controller.yaml b/config/rbac/cluster-role-controller.yaml
@@ -41,7 +41,6 @@ rules:
 - apiGroups:
   - services.k8s.aws
   resources:
-  - adoptedresources
   - fieldexports
   - iamroleselectors
   verbs:
@@ -55,7 +54,6 @@ rules:
 - apiGroups:
   - services.k8s.aws
   resources:
-  - adoptedresources/status
   - fieldexports/status
   - iamroleselectors/status
   verbs:
diff --git a/go.mod b/go.mod
@@ -7,7 +7,7 @@ toolchain go1.24.1
 require (
 	github.com/aws-controllers-k8s/iam-controller v1.1.1
 	github.com/aws-controllers-k8s/kms-controller v1.0.2
-	github.com/aws-controllers-k8s/runtime v0.52.0
+	github.com/aws-controllers-k8s/runtime v0.53.1
 	github.com/aws/aws-sdk-go v1.55.5
 	github.com/aws/aws-sdk-go-v2 v1.34.0
 	github.com/aws/aws-sdk-go-v2/service/sqs v1.37.10
@@ -91,5 +91,3 @@ require (
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
-
-replace github.com/aws-controllers-k8s/runtime => github.com/a-hilaly/ack-runtime v0.29.1-0.20251111191701-8066e43597d5
diff --git a/go.sum b/go.sum
@@ -1,9 +1,9 @@
-github.com/a-hilaly/ack-runtime v0.29.1-0.20251111191701-8066e43597d5 h1:pMlQRRNOrV6QekwaZXEb5KEs81ka6xPQf4JTSdV6BsM=
-github.com/a-hilaly/ack-runtime v0.29.1-0.20251111191701-8066e43597d5/go.mod h1:OkUJN+Ds799JLYZsMJrO2vDJ4snxUeHK2MgrQHbU+Qc=
 github.com/aws-controllers-k8s/iam-controller v1.1.1 h1:O6arh7DNlQF26MEKzgA2/kBEtZkkQKQypGYAxozNrjE=
 github.com/aws-controllers-k8s/iam-controller v1.1.1/go.mod h1:2+ARwRpazTq5MErjMz0MpXHhtAzRfNtY56Uj0gvu9vE=
 github.com/aws-controllers-k8s/kms-controller v1.0.2 h1:v8nh/oaX/U6spCwBDaWyem7XXpzoP/MnkJyEjNOZN9s=
 github.com/aws-controllers-k8s/kms-controller v1.0.2/go.mod h1:BeoijsyGjJ9G5VcDjpFdxBW0IxaeKXYX497XmUJiPSQ=
+github.com/aws-controllers-k8s/runtime v0.53.1 h1:l9MkR1KfZW8H8icT5rrRK3pdnVVA4io/eINVe5aspWs=
+github.com/aws-controllers-k8s/runtime v0.53.1/go.mod h1:OkUJN+Ds799JLYZsMJrO2vDJ4snxUeHK2MgrQHbU+Qc=
 github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
 github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v1.34.0 h1:9iyL+cjifckRGEVpRKZP3eIxVlL06Qk1Tk13vreaVQU=
diff --git a/helm/crds/services.k8s.aws_fieldexports.yaml b/helm/crds/services.k8s.aws_fieldexports.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: fieldexports.services.k8s.aws
 spec:
   group: services.k8s.aws
diff --git a/helm/crds/services.k8s.aws_iamroleselectors.yaml b/helm/crds/services.k8s.aws_iamroleselectors.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: iamroleselectors.services.k8s.aws
 spec:
   group: services.k8s.aws
@@ -12,7 +12,7 @@ spec:
     listKind: IAMRoleSelectorList
     plural: iamroleselectors
     singular: iamroleselector
-  scope: Namespaced
+  scope: Cluster
   versions:
   - name: v1alpha1
     schema:
@@ -40,6 +40,9 @@ spec:
             properties:
               arn:
                 type: string
+                x-kubernetes-validations:
+                - message: Value is immutable once set
+                  rule: self == oldSelf
               namespaceSelector:
                 description: IAMRoleSelectorSpec defines the desired state of IAMRoleSelector
                 properties:
@@ -53,18 +56,26 @@ spec:
                     required:
                     - matchLabels
                     type: object
-                  name:
+                  names:
                     items:
                       type: string
                     type: array
                 required:
-                - name
+                - names
                 type: object
               resourceTypeSelector:
                 items:
-                  description: |-
-                    GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
-                    to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+                  properties:
+                    group:
+                      type: string
+                    kind:
+                      type: string
+                    version:
+                      type: string
+                  required:
+                  - group
+                  - kind
+                  - version
                   type: object
                 type: array
             required:
diff --git a/helm/crds/sqs.services.k8s.aws_queues.yaml b/helm/crds/sqs.services.k8s.aws_queues.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.2
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: queues.sqs.services.k8s.aws
 spec:
   group: sqs.services.k8s.aws
@@ -181,6 +181,24 @@ spec:
                       matches the supplied CR's Spec field values.
                       https://github.com/aws/aws-controllers-k8s/issues/270
                     type: string
+                  iamRoleSelector:
+                    description: |-
+                      IAMRoleSelector is the selected IAMRoleSelector that is used to manage
+                      the AWS resource. This will be nil if the default controller role is used.
+                    properties:
+                      resourceVersion:
+                        description: |-
+                          ResourceVersion is the metadata.resourceVersion of the selected
+                          IAMRoleSelector object
+                        type: string
+                      selectorName:
+                        description: SelectorName is the k8s resource name of the
+                          IAMRoleSelector object
+                        type: string
+                    required:
+                    - resourceVersion
+                    - selectorName
+                    type: object
                   ownerAccountID:
                     description: |-
                       OwnerAccountID is the AWS Account ID of the account that owns the
diff --git a/helm/templates/_helpers.tpl b/helm/templates/_helpers.tpl
@@ -88,8 +88,8 @@ rules:
 - apiGroups:
   - services.k8s.aws
   resources:
-  - adoptedresources
   - fieldexports
+  - iamroleselectors
   verbs:
   - create
   - delete
@@ -101,8 +101,8 @@ rules:
 - apiGroups:
   - services.k8s.aws
   resources:
-  - adoptedresources/status
   - fieldexports/status
+  - iamroleselectors/status
   verbs:
   - get
   - patch
diff --git a/helm/templates/deployment.yaml b/helm/templates/deployment.yaml
@@ -91,7 +91,7 @@ spec:
         - --feature-gates
         - "$(FEATURE_GATES)"
 {{- end }}
-        - --enable-carm=${ENABLE_CARM}
+        - --enable-carm={{ .Values.enableCARM }}
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         name: controller
@@ -123,8 +123,6 @@ spec:
           value: {{ .Values.log.level | quote }}
         - name: ACK_RESOURCE_TAGS
           value: {{ join "," .Values.resourceTags | quote }}
-        - name: ENABLE_CARM
-          value: {{ .Values.enableCARM | quote }}
 {{- if gt (int .Values.reconcile.defaultResyncPeriod) 0 }}
         - name: RECONCILE_DEFAULT_RESYNC_SECONDS
           value: {{ .Values.reconcile.defaultResyncPeriod | quote }}
diff --git a/helm/values.yaml b/helm/values.yaml
@@ -181,4 +181,6 @@ featureGates:
   # Enable ReadOnlyResources feature/annotation. 
   ReadOnlyResources: true
   # Enable ResourceAdoption feature/annotation. 
-  ResourceAdoption: true
+  ResourceAdoption: true
+  # Enable IAMRoleSelector, a multirole feature, replacing CARM. See https://github.com/aws-controllers-k8s/community/pull/2628
+  IAMRoleSelector: false
diff --git a/pkg/resource/registry.go b/pkg/resource/registry.go
diff --git a/test/e2e/resources/queue_irs.yaml b/test/e2e/resources/queue_irs.yaml
diff --git a/test/e2e/tests/test_queue_irs.py b/test/e2e/tests/test_queue_irs.py
@@ -36,13 +36,12 @@
 UPDATE_WAIT_AFTER_SECONDS = 10
 DELETE_WAIT_AFTER_SECONDS = 10
 
-TESTING_NAMESPACE = "carm-testing"
-TESTING_ACCOUNT = "637423602339"
-TESTTING_ASSUME_ROLE = "arn:aws:iam::637423602339:role/ack-carm-role-DO-NOT-DELETE"
+TESTING_NAMESPACE = "irs-testing"
+TESTING_ASSUME_ROLE = "arn:aws:iam::637423602339:role/ack-carm-role-DO-NOT-DELETE"
 
 @service_marker
 @pytest.mark.canary
-class TestCARM:
+class TestIRS:
     def get_queue_url(self, queue_name: str) -> dict:
         sqs_client = boto3.client(
             "sqs",
@@ -70,7 +69,7 @@ def test_basic_queue(self):
         create_iam_role_selector(
             TESTING_NAMESPACE,
             "ack-role-selector",
-            TESTTING_ASSUME_ROLE
+            TESTING_ASSUME_ROLE
         )
 
         time.sleep(CREATE_WAIT_AFTER_SECONDS)
@@ -82,7 +81,7 @@ def test_basic_queue(self):
         replacements["NAMESPACE"] = TESTING_NAMESPACE
         # Load ECR CR
         resource_data = load_sqs_resource(
-            "queue_carm",
+            "queue_irs",
             additional_replacements=replacements,
         )
         logging.debug(resource_data)
@@ -100,14 +99,11 @@ def test_basic_queue(self):
 
         time.sleep(CREATE_WAIT_AFTER_SECONDS)
 
-        assert k8s.wait_on_condition(ref, "ACK.ResourceSynced", "True", wait_periods=5)
+        assert k8s.wait_on_condition(ref, "Ready", "True", wait_periods=5)
+        assert k8s.wait_on_condition(ref, "ACK.IAMRoleSelected", "True", wait_periods=5)
 
         # Check SQS queue exists
         resp = self.get_queue_url(resource_name)
-        print(os.environ["CARM_AWS_ACCESS_KEY_ID"])
-        print(os.environ["CARM_AWS_SECRET_ACCESS_KEY"])
-        print(os.environ["CARM_AWS_SESSION_TOKEN"])
-        print(resp)
         assert resp != None
 
         # Delete k8s resource
