awsAuthRoleArn:
  source:
    filePath: data.mapRoles
    fileType: YAML
    k8sTypes:
    - ConfigMap
    paths:
    - '[*].rolearn'
  targets:
  - awsType: AWS::IAM::Role
    field: _arn_
awsAuthUserArn:
  source:
    filePath: data.mapUsers
    fileType: YAML
    k8sTypes:
    - ConfigMap
    paths:
    - '[*].userarn'
  targets:
  - awsType: AWS::IAM::User
    field: _arn_
containerAnnotationArns:
  source:
    k8sTypes:
    - CronJob
    - DaemonSet
    - Deployment
    - Job
    - Pod
    - Rollout
    - StatefulSet
    paths:
    - $.spec.template.metadata.annotations.*
    - $.spec.jobTemplate.spec.template.metadata.annotations.*
  targets:
  - awsType: '*'
    field: _arn_
containerArgs:
  source:
    k8sTypes:
    - CronJob
    - DaemonSet
    - Deployment
    - Job
    - Pod
    - Rollout
    - StatefulSet
    paths:
    - $.spec.containers,initContainers,ephemeralContainers[*].args.[*]
    - $.spec.template.spec.containers,initContainers,ephemeralContainers[*].args.[*]
    - $.spec.jobTemplate.spec.template.spec.containers,initContainers,ephemeralContainers[*].args.[*]
  targets:
  - awsType: '*'
    field: _identifier_
    matcher: substring
  - field: Id
    matcher: substring
    type: AWS::Region
  - awsType: AWS::AutoScaling::AutoScalingGroup
    field: Tags
    matcher: tag_matcher
    prefix: --node-group-auto-discovery=asg:tag=
  - awsType: AWS::IAM::Role
    field: RoleName
containerEnvVars:
  source:
    k8sTypes:
    - CronJob
    - DaemonSet
    - Deployment
    - Job
    - Pod
    - Rollout
    - StatefulSet
    paths:
    - $.spec.containers,initContainers,ephemeralContainers[*].env[*].value
    - $.spec.template.spec.containers,initContainers,ephemeralContainers[*].env[*].value
    - $.spec.jobTemplate.spec.template.spec.containers,initContainers,ephemeralContainers[*].env[*].value
  targets:
  - awsType: '*'
    field: _identifier_
    matcher: substring
  - field: Id
    type: AWS::Region
  - field: endpoint
    type: AWS::EKS::Cluster
  - awsType: AWS::SQS::Queue
    field: QueueName
containerImageEcr:
  source:
    k8sTypes:
    - CronJob
    - DaemonSet
    - Deployment
    - Job
    - Pod
    - Rollout
    - StatefulSet
    paths:
    - $.spec.containers,initContainers,ephemeralContainers[*].image
    - $.spec.template.spec.containers,initContainers,ephemeralContainers[*].image
    - $.spec.jobTemplate.spec.template.spec.containers,initContainers,ephemeralContainers[*].image
    - $.spec.volumes[*].image.reference
    - $.spec.template.spec.volumes[*].image.reference
    - $.spec.jobTemplate.spec.template.spec.volumes[*].image.reference
  targets:
  - awsType: AWS::ECR::Repository
    field: repositoryUri
    matcher: substring
  - field: Id
    matcher: substring
    type: AWS::ECR::HostedRepository
csiParameters:
  source:
    filePath: spec.parameters.objects
    fileType: YAML
    k8sTypes:
    - SecretProviderClass
    paths:
    - $[?(@.objectType =="ssmparameter")].objectName,objectAlias
  targets:
  - awsType: AWS::SSM::Parameter
    field: Name
csiSecrets:
  source:
    filePath: spec.parameters.objects
    fileType: YAML
    k8sTypes:
    - SecretProviderClass
    paths:
    - $[?(@.objectType =="secretsmanager")].objectName,objectAlias
  targets:
  - awsType: AWS::SecretsManager::Secret
    field: Name
csiSecretsArns:
  source:
    filePath: spec.parameters.objects
    fileType: YAML
    k8sTypes:
    - SecretProviderClass
    paths:
    - $..objectName
  targets:
  - awsType: AWS::SecretsManager::Secret
    field: _arn_
ebsVolumeAzs:
  source:
    k8sTypes:
    - PersistentVolume
    paths:
    - spec.nodeAffinity.required.nodeSelectorTerms[*].matchExpressions[*].values[*]
  targets:
  - field: Name
    type: AWS::AvailabilityZone
  - field: Id
    type: AWS::Region
eniConfigAzId:
  source:
    k8sTypes:
    - ENIConfig
    paths:
    - metadata.name
  targets:
  - field: Name
    type: AWS::AvailabilityZone
eniConfigSg:
  source:
    k8sTypes:
    - ENIConfig
    paths:
    - spec.securityGroups[*]
  targets:
  - awsType: AWS::EC2::SecurityGroup
    field: GroupId
eniConfigSubnet:
  source:
    k8sTypes:
    - ENIConfig
    paths:
    - spec.subnet
  targets:
  - awsType: AWS::EC2::Subnet
    field: SubnetId
externalSecretStoreRegion:
  source:
    k8sTypes:
    - SecretStore
    - ClusterSecretStore
    paths:
    - spec.provider.aws.region
  targets:
  - field: Id
    type: AWS::Region
imageStreamEcr:
  source:
    k8sTypes:
    - ImageStream
    paths:
    - $.spec.tags[*].dockerImageReference
  targets:
  - awsType: AWS::ECR::Repository
    field: repositoryUri
    matcher: substring
ingressBucket:
  source:
    k8sTypes:
    - Ingress
    paths:
    - metadata.annotations."alb.ingress.kubernetes.io/load-balancer-attributes"
  targets:
  - awsType: AWS::S3::Bucket
    field: Name
    matcher: substring
ingressCert:
  source:
    k8sTypes:
    - Ingress
    paths:
    - metadata.annotations."alb.ingress.kubernetes.io/certificate-arn"
  targets:
  - awsType: AWS::ACM::Certificate
    field: _arn_
    matcher: csv
ingressSg:
  source:
    k8sTypes:
    - Ingress
    paths:
    - metadata.annotations."alb.ingress.kubernetes.io/security-groups"
  targets:
  - awsType: AWS::EC2::SecurityGroup
    field: GroupId
    matcher: csv
ingressSubnet:
  source:
    k8sTypes:
    - Ingress
    paths:
    - metadata.annotations."alb.ingress.kubernetes.io/subnets"
  targets:
  - awsType: AWS::EC2::Subnet
    field: SubnetId
    matcher: csv
ingressWafAcl:
  source:
    k8sTypes:
    - Ingress
    paths:
    - metadata.annotations."alb.ingress.kubernetes.io/wafv2-acl-arn"
  targets:
  - awsType: AWS::WAFv2::WebACL
    field: _arn_
    matcher: csv
jaegerEcr:
  source:
    k8sTypes:
    - Jaeger
    paths:
    - spec.agent.image
    - spec.collector.image
    - spec.query.image
    - spec.storage.esIndexCleaner.image
    - spec.storage.esRollover.image
  targets:
  - awsType: AWS::ECR::Repository
    field: repositoryUri
    matcher: substring
jaegerOsUri:
  source:
    k8sTypes:
    - Jaeger
    paths:
    - spec.storage.options.es.server-urls
  targets:
  - awsType: AWS::OpenSearchService::Domain
    field: DomainEndpoint
    matcher: substring
karpenterInterruptionQueue:
  source:
    k8sTypes:
    - Deployment
    paths:
    - $.spec.template.spec.containers[*].env[?name=="INTERRUPTION_QUEUE"].value
  targets:
  - awsType: AWS::SQS::Queue
    field: QueueName
karpenterNodeClassAcct:
  source:
    k8sTypes:
    - EC2NodeClass
    paths:
    - spec.amiSelectorTerms[*].owner
  targets:
  - field: Id
    type: AWS::Account
karpenterNodeClassAmi:
  source:
    k8sTypes:
    - EC2NodeClass
    paths:
    - spec.amiSelectorTerms[*].id
    - status.amis[*].id
  targets:
  - awsType: AWS::EC2::Image
    field: ImageId
karpenterNodeClassRole:
  source:
    k8sTypes:
    - EC2NodeClass
    paths:
    - spec.role
  targets:
  - awsType: AWS::IAM::Role
    field: RoleName
karpenterNodeClassSg:
  source:
    k8sTypes:
    - EC2NodeClass
    paths:
    - spec.securityGroupSelectorTerms[*].id
    - status.securityGroups[*].id
  targets:
  - awsType: AWS::EC2::SecurityGroup
    field: GroupId
karpenterNodeClassSubnet:
  source:
    k8sTypes:
    - EC2NodeClass
    paths:
    - spec.subnetSelectorTerms[*].id
    - status.subnets[*].id
  targets:
  - awsType: AWS::EC2::Subnet
    field: SubnetId
kubeProxyServerApi:
  source:
    filePath: data.kubeconfig
    fileType: YAML
    k8sTypes:
    - ConfigMap
    paths:
    - clusters[*].cluster.server
  targets:
  - awsType: AWS::EKS::Cluster
    field: endpoint
linkerdConfigMap:
  source:
    filePath: data.values
    fileType: YAML
    k8sTypes:
    - ConfigMap
    paths:
    - controllerImage
    - policyController.image.name
    - proxy.image.name
    - proxyInit.image.name
  targets:
  - awsType: AWS::ECR::Repository
    field: repositoryUri
    matcher: substring
nodeSelectorAz:
  source:
    k8sTypes:
    - CronJob
    - DaemonSet
    - Deployment
    - Job
    - Pod
    - Rollout
    - StatefulSet
    paths:
    - $..spec.nodeSelector.*
    - $..nodeSelectorTerms[*].matchExpressions[*].values[*]
  targets:
  - field: Id
    type: AWS::AvailabilityZone
  - field: Name
    type: AWS::AvailabilityZone
observabilityRegion:
  source:
    k8sTypes:
    - ConfigMap
    paths:
    - data.'output.conf'
  targets:
  - field: Id
    matcher: substring
    type: AWS::Region
oldKarpenterGlobalSettingsConfigMapInstanceProfile:
  source:
    k8sTypes:
    - ConfigMap
    paths:
    - data.'aws.defaultInstanceProfile'
  targets:
  - awsType: AWS::IAM::InstanceProfile
    field: InstanceProfileName
oldKarpenterGlobalSettingsConfigMapSQS:
  source:
    k8sTypes:
    - ConfigMap
    paths:
    - data.'aws.interruptionQueueName'
  targets:
  - awsType: AWS::SQS::Queue
    field: QueueName
oldKarpenterNodeTemplateAcct:
  source:
    k8sTypes:
    - AWSNodeTemplate
    paths:
    - spec.amiSelector."aws::owners",aws-owners
  targets:
  - field: Id
    type: AWS::Account
oldKarpenterNodeTemplateAmi:
  source:
    k8sTypes:
    - AWSNodeTemplate
    paths:
    - spec.amiSelector."aws::ids",aws-ids
  targets:
  - awsType: AWS::EC2::Image
    field: ImageId
    matcher: csv
oldKarpenterNodeTemplateSg:
  source:
    k8sTypes:
    - AWSNodeTemplate
    paths:
    - spec.securityGroupSelector."aws::ids",aws-ids
  targets:
  - awsType: AWS::EC2::SecurityGroup
    field: GroupId
    matcher: csv
oldKarpenterNodeTemplateSubnet:
  source:
    k8sTypes:
    - AWSNodeTemplate
    paths:
    - spec.subnetSelector."aws::ids",aws-ids
  targets:
  - awsType: AWS::EC2::Subnet
    field: SubnetId
    matcher: csv
openSearchUri:
  source:
    k8sTypes:
    - ConfigMap
    paths:
    - data.'output.conf'
  targets:
  - awsType: AWS::OpenSearchService::Domain
    field: DomainEndpoint
    matcher: substring
prometheusEcr:
  source:
    k8sTypes:
    - Prometheus
    paths:
    - spec.image
    - spec.thanos.image
  targets:
  - awsType: AWS::ECR::Repository
    field: repositoryUri
    matcher: substring
pvRegionLabel:
  source:
    k8sTypes:
    - PersistentVolume
    paths:
    - metadata.labels."topology.kubernetes.io/region"
  targets:
  - field: Id
    type: AWS::Region
pvZoneLabel:
  source:
    k8sTypes:
    - PersistentVolume
    paths:
    - metadata.labels."topology.kubernetes.io/zone"
  targets:
  - field: Name
    type: AWS::AvailabilityZone
secretData:
  source:
    k8sTypes:
    - Secret
    paths:
    - $.data.*
  targets:
  - awsType: '*'
    field: _identifier_
    matcher: substring_b64
serviceAccountRoleArns:
  source:
    k8sTypes:
    - ServiceAccount
    paths:
    - $.metadata.annotations.'eks.amazonaws.com/role-arn'
  targets:
  - awsType: AWS::IAM::Role
    field: _arn_
serviceNlbCert:
  source:
    k8sTypes:
    - Service
    paths:
    - metadata.annotations."service.beta.kubernetes.io/aws-load-balancer-ssl-cert"
  targets:
  - awsType: AWS::ACM::Certificate
    field: _arn_
    matcher: csv
serviceNlbSg:
  source:
    k8sTypes:
    - Service
    paths:
    - metadata.annotations."service.beta.kubernetes.io/aws-load-balancer-security-groups"
  targets:
  - awsType: AWS::EC2::SecurityGroup
    field: GroupId
    matcher: csv
  - awsType: AWS::EC2::SecurityGroup
    field: Tags[?Key=="Name"].Value
    matcher: csv
serviceNlbSubnet:
  source:
    k8sTypes:
    - Service
    paths:
    - metadata.annotations."service.beta.kubernetes.io/aws-load-balancer-subnets"
  targets:
  - awsType: AWS::EC2::Subnet
    field: SubnetId
    matcher: csv
  - awsType: AWS::EC2::Subnet
    field: Tags[?Key=="Name"].Value
    matcher: csv
sgPolicy:
  source:
    k8sTypes:
    - SecurityGroupPolicy
    paths:
    - spec.securityGroups.groupIds.[*]
  targets:
  - awsType: AWS::EC2::SecurityGroup
    field: GroupId
thanosObjstoreBucketB64:
  source:
    filePath: data."objstore.yml"
    fileType: YAML.b64
    k8sTypes:
    - Secret
    paths:
    - config.bucket
  targets:
  - awsType: AWS::S3::Bucket
    field: Name
thanosObjstoreRegionB64:
  source:
    filePath: data."objstore.yml"
    fileType: YAML.b64
    k8sTypes:
    - Secret
    paths:
    - config.region
  targets:
  - field: Id
    type: AWS::Region
thanosObjstoreS3EndpointB64:
  source:
    filePath: data."objstore.yml"
    fileType: YAML.b64
    k8sTypes:
    - Secret
    paths:
    - config.endpoint
  targets:
  - field: Id
    matcher: substring
    type: AWS::Region
thanosSecretBucket:
  source:
    filePath: stringData."thanos.yaml"
    fileType: YAML
    k8sTypes:
    - Secret
    paths:
    - config.bucket
  targets:
  - awsType: AWS::S3::Bucket
    field: Name
thanosSecretBucketB64:
  source:
    filePath: data."thanos.yaml"
    fileType: YAML.b64
    k8sTypes:
    - Secret
    paths:
    - config.bucket
  targets:
  - awsType: AWS::S3::Bucket
    field: Name
thanosSecretRegion:
  source:
    filePath: stringData."thanos.yaml"
    fileType: YAML
    k8sTypes:
    - Secret
    paths:
    - config.region
  targets:
  - field: Id
    type: AWS::Region
thanosSecretRegionB64:
  source:
    filePath: data."thanos.yaml"
    fileType: YAML.b64
    k8sTypes:
    - Secret
    paths:
    - config.region
  targets:
  - field: Id
    type: AWS::Region
thanosSecretS3Endpoint:
  source:
    filePath: stringData."thanos.yaml"
    fileType: YAML
    k8sTypes:
    - Secret
    paths:
    - config.endpoint
  targets:
  - field: Id
    matcher: substring
    type: AWS::Region
thanosSecretS3EndpointB64:
  source:
    filePath: data."thanos.yaml"
    fileType: YAML.b64
    k8sTypes:
    - Secret
    paths:
    - config.endpoint
  targets:
  - field: Id
    matcher: substring
    type: AWS::Region
veleroBackupLocationBucket:
  source:
    k8sTypes:
    - BackupStorageLocation
    paths:
    - spec.objectStorage.bucket
  targets:
  - awsType: AWS::S3::Bucket
    field: Name
veleroBackupLocationRegion:
  source:
    k8sTypes:
    - BackupStorageLocation
    paths:
    - spec.config.region
  targets:
  - field: Id
    type: AWS::Region
veleroSnapshotLocation:
  source:
    k8sTypes:
    - VolumeSnapshotLocation
    paths:
    - spec.config.region
  targets:
  - field: Id
    type: AWS::Region