✨ rosa: add missing fields to spec

config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml

@@ -45,6 +45,12 @@ spec:
             type: object
           spec:
             properties:
+              additionalTags:
+                additionalProperties:
+                  type: string
+                description: AdditionalTags are user-defined tags to be added on the
+                  AWS resources associated with the control plane.
+                type: object
               autoscaling:
                 description: Autoscaling specifies auto scaling behaviour for the
                   MachinePools.
@@ -100,6 +106,15 @@ spec:
                     type: string
                 type: object
                 x-kubernetes-map-type: atomic
+              etcdEncryptionKMSArn:
+                description: EtcdEncryptionKMSArn is the ARN of the KMS key used to
+                  encrypt etcd. The key itself needs to be created out-of-band by
+                  the user and tagged with `red-hat:true`.
+                maxLength: 2048
+                type: string
+                x-kubernetes-validations:
+                - message: etcdEncryptionKMSArn must be a valid encryption key ARN
+                  rule: self.matches('^arn:aws[\\w-]*:kms:[\\w-]+:\\d{12}:key\\/(mrk-[0-9a-f]{32}$|[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$)')
               identityRef:
                 description: IdentityRef is a reference to an identity to be used
                   when reconciling the managed control plane. If no identity is specified,
@@ -162,6 +177,13 @@ spec:
               oidcID:
                 description: The ID of the OpenID Connect Provider.
                 type: string
+              private:
+                description: Private restricts master API endpoint and application
+                  routes to direct, private connectivity. Traffic to these endpoints
+                  will use AWS PrivateLink to have connectivity between VPCs, AWS
+                  services, and your on-premises networks without exposing your traffic
+                  to the public internet.
+                type: boolean
               region:
                 description: The AWS Region the cluster lives in.
                 type: string

controlplane/rosa/api/v1beta2/rosacontrolplane_types.go

@@ -99,6 +99,26 @@ type RosaControlPlaneSpec struct { //nolint: maligned
 	// Autoscaling specifies auto scaling behaviour for the MachinePools.
 	// +optional
 	Autoscaling *expinfrav1.RosaMachinePoolAutoScaling `json:"autoscaling,omitempty"`
+
+	// +kubebuilder:validation:Optional
+
+	// AdditionalTags are user-defined tags to be added on the AWS resources associated with the control plane.
+	AdditionalTags infrav1.Tags `json:"additionalTags,omitempty"`
+
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:MaxLength=2048
+	// +kubebuilder:validation:XValidation:rule=`self.matches('^arn:aws[\\w-]*:kms:[\\w-]+:\\d{12}:key\\/(mrk-[0-9a-f]{32}$|[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$)')`, message="etcdEncryptionKMSArn must be a valid encryption key ARN"
+
+	// EtcdEncryptionKMSArn is the ARN of the KMS key used to encrypt etcd. The key itself needs to be
+	// created out-of-band by the user and tagged with `red-hat:true`.
+	EtcdEncryptionKMSArn string `json:"etcdEncryptionKMSArn,omitempty"`
+
+	// +kubebuilder:validation:Optional
+
+	// Private restricts master API endpoint and application routes to direct, private connectivity.
+	// Traffic to these endpoints will use AWS PrivateLink to have connectivity between VPCs, AWS services,
+	// and your on-premises networks without exposing your traffic to the public internet.
+	Private *bool `json:"private,omitempty"`
 }
 
 // NetworkSpec for ROSA-HCP.

controlplane/rosa/controllers/rosacontrolplane_controller.go

@@ -278,6 +278,11 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
 		DisableWorkloadMonitoring: ptr.To(true),
 		DefaultIngress:            ocm.NewDefaultIngressSpec(), // n.b. this is a no-op when it's set to the default value
 		ComputeMachineType:        rosaScope.ControlPlane.Spec.InstanceType,
+		Tags:                      rosaScope.ControlPlane.Spec.AdditionalTags,
+		EtcdEncryption:            rosaScope.ControlPlane.Spec.EtcdEncryptionKMSArn != "",
+		EtcdEncryptionKMSArn:      rosaScope.ControlPlane.Spec.EtcdEncryptionKMSArn,
+		Private:                   rosaScope.ControlPlane.Spec.Private,
+		PrivateLink:               rosaScope.ControlPlane.Spec.Private, // all private ROSA HCP clusters are privateLink
 
 		SubnetIds:         rosaScope.ControlPlane.Spec.Subnets,
 		AvailabilityZones: rosaScope.ControlPlane.Spec.AvailabilityZones,