kind: Composition
apiVersion: apiextensions.crossplane.io/v1
metadata:
  name: xnetworks.aws.platformref.crossplane.io
  creationTimestamp: null
  labels:
    provider: aws
spec:
  compositeTypeRef:
    apiVersion: aws.platformref.crossplane.io/v1alpha1
    kind: XNetwork
  patchSets:
    - name: network-id
      patches:
        - type: FromCompositeFieldPath
          fromFieldPath: spec.id
          toFieldPath: metadata.labels[networks.aws.platformref.crossplane.io/network-id]
  resources:
    - name: platformref-vcp
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: VPC
        spec:
          forProvider:
            cidrBlock: 192.168.0.0/16
            enableDnsHostNames: true
            enableDnsSupport: true
            region: us-west-2
            tags:
              - key: Owner
                value: Platform Team
              - key: Name
                value: platformref-vpc
      patches:
        - type: PatchSet
          patchSetName: network-id
    - name: gateway
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: InternetGateway
        spec:
          forProvider:
            region: us-west-2
            vpcIdSelector:
              matchControllerRef: true
      patches:
        - type: PatchSet
          patchSetName: network-id
    - name: subnet-public-west-2a
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: Subnet
        metadata:
          labels:
            access: public
            zone: us-west-2a
        spec:
          forProvider:
            availabilityZone: us-west-2a
            cidrBlock: 192.168.0.0/18
            mapPublicIPOnLaunch: true
            region: us-west-2
            tags:
              - key: kubernetes.io/role/elb
                value: "1"
            vpcIdSelector:
              matchControllerRef: true
      patches:
        - type: PatchSet
          patchSetName: network-id
    - name: subnet-public-west-2b
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: Subnet
        metadata:
          labels:
            access: public
            zone: us-west-2b
        spec:
          forProvider:
            availabilityZone: us-west-2b
            cidrBlock: 192.168.64.0/18
            mapPublicIPOnLaunch: true
            region: us-west-2
            tags:
              - key: kubernetes.io/role/elb
                value: "1"
            vpcIdSelector:
              matchControllerRef: true
      patches:
        - type: PatchSet
          patchSetName: network-id
    - name: subnet-private-west-2a
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: Subnet
        metadata:
          labels:
            access: private
            zone: us-west-2a
        spec:
          forProvider:
            availabilityZone: us-west-2a
            cidrBlock: 192.168.128.0/18
            region: us-west-2
            tags:
              - key: ""
                value: shared
              - key: kubernetes.io/role/internal-elb
                value: "1"
            vpcIdSelector:
              matchControllerRef: true
      patches:
        - type: PatchSet
          patchSetName: network-id
        - fromFieldPath: spec.id
          toFieldPath: spec.forProvider.tags[0].key
          transforms:
            - type: string
              string:
                fmt: kubernetes.io/cluster/%s
    - name: subnet-private-west-2b
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: Subnet
        metadata:
          labels:
            access: private
            zone: us-west-2b
        spec:
          forProvider:
            availabilityZone: us-west-2b
            cidrBlock: 192.168.192.0/18
            region: us-west-2
            tags:
              - key: ""
                value: shared
              - key: kubernetes.io/role/internal-elb
                value: "1"
            vpcIdSelector:
              matchControllerRef: true
      patches:
        - type: PatchSet
          patchSetName: network-id
        - fromFieldPath: spec.id
          toFieldPath: spec.forProvider.tags[0].key
          transforms:
            - type: string
              string:
                fmt: kubernetes.io/cluster/%s
    - name: routeTable
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: RouteTable
        spec:
          forProvider:
            associations:
              - subnetIdSelector:
                  matchControllerRef: true
                  matchLabels:
                    access: public
                    zone: us-west-2a
              - subnetIdSelector:
                  matchControllerRef: true
                  matchLabels:
                    access: public
                    zone: us-west-2b
              - subnetIdSelector:
                  matchControllerRef: true
                  matchLabels:
                    access: private
                    zone: us-west-2a
              - subnetIdSelector:
                  matchControllerRef: true
                  matchLabels:
                    access: private
                    zone: us-west-2b
            region: us-west-2
            routes:
              - destinationCidrBlock: 0.0.0.0/0
                gatewayIdSelector:
                  matchControllerRef: true
            vpcIdSelector:
              matchControllerRef: true
      patches:
        - type: PatchSet
          patchSetName: network-id
    - name: securityGroup
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: SecurityGroup
        spec:
          forProvider:
            description: Allow access to PostgreSQL
            groupName: platform-ref-aws-cluster
            ingress:
              - fromPort: 5432
                ipProtocol: tcp
                ipRanges:
                  - cidrIp: 0.0.0.0/0
                    description: Everywhere
                toPort: 5432
            region: us-west-2
            vpcIdSelector:
              matchControllerRef: true
      patches:
        - type: PatchSet
          patchSetName: network-id
  writeConnectionSecretsToNamespace: upbound-system