### Logging Configuration Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/configuration.md

Command-line example for setting log level and encoding.

```bash
ack-ec2-controller --log-level=debug --log-encoding=console

```

--------------------------------

### Example Kubernetes Probes

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/configuration.md

Example Kubernetes liveness and readiness probe configurations.

```yaml
livenessProbe:
  httpGet:
    path: /healthz
    port: 8081
  initialDelaySeconds: 15
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /readyz
    port: 8081
  initialDelaySeconds: 5
  periodSeconds: 5

```

--------------------------------

### Launch Template Tagging Strategy Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/launch-template.md

Example of applying consistent tags to resources within a launch template using `tagSpecifications`.

```yaml
tagSpecifications:
  - resourceType: instance
    tags:
      - key: CreatedFrom
        value: LaunchTemplate
      - key: TemplateName
        value: web-fleet-lt
      - key: Version
        value: "1"
```

--------------------------------

### Multi-VPC with Transit Gateway Configuration

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/API-REFERENCE-INDEX.md

YAML configuration example for a multi-VPC setup connected via a Transit Gateway, including subnetting and routing.

```yaml
# VPC 1
vpc-1: 10.0.0.0/16
subnets: 10.0.0.0/24, 10.0.1.0/24

# VPC 2
vpc-2: 10.1.0.0/16
subnets: 10.1.0.0/24, 10.1.1.0/24

# Transit Gateway
tgw: Connects vpc-1 and vpc-2
tgw-attachment-1: vpc-1 → tgw
tgw-attachment-2: vpc-2 → tgw

# Routes
VPC1 route table: 10.1.0.0/16 → tgw
VPC2 route table: 10.0.0.0/16 → tgw
```

--------------------------------

### Basic High Availability NAT Setup

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/nat-gateway.md

This example demonstrates setting up two NAT Gateways, one in each Availability Zone (AZ1 and AZ2), for high availability. It includes the creation of Elastic IP Addresses for each NAT Gateway and defines the NAT Gateway resources themselves, referencing the respective subnets and Elastic IPs. The `availabilityMode` is set to `zonal` for each.

```yaml
---
# Elastic IP for NAT Gateway 1
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: ElasticIPAddress
metadata:
  name: nat-eip-1
spec:
  domain: vpc
  tags:
    - key: Name
      value: NAT-EIP-1

---
# Elastic IP for NAT Gateway 2
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: ElasticIPAddress
metadata:
  name: nat-eip-2
spec:
  domain: vpc
  tags:
    - key: Name
      value: NAT-EIP-2

---
# NAT Gateway 1 in AZ1
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: NATGateway
metadata:
  name: nat-gateway-az1
spec:
  subnetRef:
    from:
      name: public-subnet-az1
  allocationRef:
    from:
      name: nat-eip-1
  availabilityMode: zonal
  tags:
    - key: Name
      value: NAT-AZ1

---
# NAT Gateway 2 in AZ2
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: NATGateway
metadata:
  name: nat-gateway-az2
spec:
  subnetRef:
    from:
      name: public-subnet-az2
  allocationRef:
    from:
      name: nat-eip-2
  availabilityMode: zonal
  tags:
    - key: Name
      value: NAT-AZ2

```

--------------------------------

### Resource Quotas Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/configuration.md

Example Kubernetes ResourceQuota manifest for the ack-system namespace.

```yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: ec2-quota
  namespace: ack-system
spec:
  hard:
    pods: "10"
    cpu: "5"
    memory: "2Gi"
  scopeSelector:
    matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["system-cluster-critical"]

```

--------------------------------

### Example: Basic VPC

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/vpc.md

A basic example of a VPC resource definition in YAML format.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: VPC
metadata:
  name: my-vpc
spec:
  cidrBlocks:
    - 10.0.0.0/16
  enableDNSSupport: true
  enableDNSHostnames: true
  tags:
    - key: Name
      value: MyVPC
    - key: Environment
      value: production
```

--------------------------------

### Tagging Best Practice Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/transit-gateway.md

Example of applying consistent tags to a Transit Gateway resource.

```yaml
tags:
  - key: Name
    value: corporate-tgw
  - key: Environment
    value: production
  - key: CostCenter
    value: network
  - key: Application
    value: multi-vpc-hub
```

--------------------------------

### Webhook Configuration Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/configuration.md

Example environment variables to enable and configure the webhook server in the deployment.

```yaml
# Enable webhooks in deployment
env:
  - name: ACK_ENABLE_WEBHOOK_SERVER
    value: "true"
  - name: ACK_WEBHOOK_SERVER_ADDR
    value: ":9443"

# Install ValidatingWebhookConfiguration and MutatingWebhookConfiguration
# These are created by the controller if enabled

```

--------------------------------

### Launch Template Naming Convention Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/launch-template.md

Example of a descriptive naming convention for launch templates, including environment, application, and purpose.

```text
{environment}-{application}-{purpose}-lt

Examples:
- prod-web-frontend-lt
- dev-db-primary-lt
- staging-api-backend-lt
```

--------------------------------

### Multi-Zone Deployment

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/subnet.md

Example of deploying multiple subnets across different availability zones for a multi-zone setup.

```yaml
---
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Subnet
metadata:
  name: az1-subnet
spec:
  vpcRef:
    from:
      name: my-vpc
  cidrBlock: 10.0.1.0/24
  availabilityZone: us-west-2a
  tags:
    - key: Name
      value: Subnet-AZ1
---
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Subnet
metadata:
  name: az2-subnet
spec:
  vpcRef:
    from:
      name: my-vpc
  cidrBlock: 10.0.2.0/24
  availabilityZone: us-west-2b
  tags:
    - key: Name
      value: Subnet-AZ2
```

--------------------------------

### Tag Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/types.md

Example of how to use the tags field.

```yaml
tags:
  - key: Name
    value: MyResource
  - key: Environment
    value: production
```

--------------------------------

### Web Server Fleet Launch Template Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/launch-template.md

Example YAML configuration for a LaunchTemplate to create a fleet of web servers, including instance type, security groups, user data, and block device mappings.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: LaunchTemplate
metadata:
  name: web-fleet-template
spec:
  launchTemplateName: web-fleet-lt
  description: Web servers with load balancer support
  launchTemplateData:
    imageID: ami-ubuntu-20
    instanceType: t3.micro
    keyName: fleet-key
    monitoring:
      enabled: true
    securityGroupIDs:
      - sg-web-sg
    userData: IyEvYmluL2Jhc2gKc3VkbyB5dW0gdXBkYXRlIC15CnN1ZG8geXVtIGluc3RhbGwgLXkgYXBhY2hlMg==
    blockDeviceMappings:
      - deviceName: /dev/sda1
        ebs:
          volumeSize: 20
          volumeType: gp3
          deleteOnTermination: true
```

--------------------------------

### Database Server Template Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/launch-template.md

Example YAML configuration for a LaunchTemplate to create high-performance database servers, specifying instance type, EBS optimization, IAM instance profile, and detailed block device mappings.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: LaunchTemplate
metadata:
  name: db-server-template
spec:
  launchTemplateName: db-server-lt
  description: High-performance database servers
  launchTemplateData:
    imageID: ami-database
    instanceType: m5.2xlarge
    ebsOptimized: true
    iamInstanceProfile:
      name: DatabaseServerRole
    blockDeviceMappings:
      - deviceName: /dev/sda1
        ebs:
          volumeSize: 100
          volumeType: io2
          iops: 6400
          deleteOnTermination: false
      - deviceName: /dev/sdb
        ebs:
          volumeSize: 500
          volumeType: io2
          iops: 20000
```

--------------------------------

### Container Host with Docker

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/instance.md

Example of an EC2 Instance resource configured as a container host with Docker installed via user data.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Instance
metadata:
  name: docker-host
spec:
  imageID: ami-0c55b159cbfafe1f0
  instanceType: t3.medium
  subnetRef:
    from:
      name: container-subnet
  iamInstanceProfile:
    name: ECS-Instance-Role
  userData: IyEvYmluL2Jhc2gKc3VkbyB5dW0gdXBkYXRlIC15CnN1ZG8geXVtIGluc3RhbGwgLXkgZG9ja2VyLWNlCnN1ZG8gc3lzdGVtY3RsIHN0YXJ0IGRvY2tlcg==
  securityGroupIDs:
    - sg-docker-sg
```

--------------------------------

### Example: Basic Subnet

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/subnet.md

This example demonstrates how to create a basic subnet resource with a specified VPC reference, CIDR block, availability zone, and tags.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Subnet
metadata:
  name: public-subnet-1
spec:
  vpcRef:
    from:
      name: my-vpc
  cidrBlock: 10.0.1.0/24
  availabilityZone: us-west-2a
  tags:
    - key: Name
      value: PublicSubnet1
    - key: Type
      value: public
```

--------------------------------

### Standard Internet Gateway Setup

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/internet-gateway.md

A standard setup for an Internet Gateway, specifying its attachment to a production VPC and including both Name and Environment tags.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: InternetGateway
metadata:
  name: production-igw
spec:
  vpcRef:
    from:
      name: production-vpc
  tags:
    - key: Name
      value: ProductionIGW
    - key: Environment
      value: production
```

--------------------------------

### Application Server Template Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/launch-template.md

Example YAML configuration for a LaunchTemplate to create containerized application servers, including instance type, IAM instance profile, user data, and tag specifications.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: LaunchTemplate
metadata:
  name: app-server-template
spec:
  launchTemplateName: app-server-lt
  description: Containerized application servers
  launchTemplateData:
    imageID: ami-ecs-optimized
    instanceType: t3.small
    iamInstanceProfile:
      name: ECSInstanceRole
    monitoring:
      enabled: true
    userData: IyEvYmluL2Jhc2gKZWNobyAiRUNTIENvbmZpZyIgPj4gL2V0Yy9lY3MvZWNzLmNvbmZpZw==
    tagSpecifications:
      - resourceType: instance
        tags:
          - key: ApplicationType
            value: Container
          - key: ManagedBy
            value: LaunchTemplate
```

--------------------------------

### Example Prometheus Configuration

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/configuration.md

Example Prometheus scrape configuration for the ack-ec2-controller.

```yaml
scrape_configs:
  - job_name: ack-ec2-controller
    kubernetes_sd_configs:
      - role: pod
        namespaces:
          names:
            - ack-system
    relabel_configs:
      - source_labels: [__meta_kubernetes_pod_label_app]
        action: keep
        regex: ack-ec2-controller
      - source_labels: [__meta_kubernetes_pod_container_port_name]
        action: keep
        regex: metrics

```

--------------------------------

### High-Availability Setup Workflow

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/API-REFERENCE-INDEX.md

Details the steps for configuring a high-availability setup with multiple subnets, NAT gateways, and horizontally scaled instances.

```text
1. Create 2 Subnets in different AZs
2. Create 2 ElasticIPAddresses
3. Create 2 NATGateways (one per AZ)
4. Create SecurityGroup with desired rules
5. Create Instance in each subnet → scale horizontally
```

--------------------------------

### Example: VPC with IPv6

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/vpc.md

An example of a VPC resource definition with IPv6 enabled.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: VPC
metadata:
  name: vpc-with-ipv6
spec:
  cidrBlocks:
    - 10.0.0.0/16
  amazonProvidedIPv6CIDRBlock: true
  enableDNSSupport: true
  enableDNSHostnames: true
```

--------------------------------

### Example: Private Subnet

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/subnet.md

This example shows how to create a private subnet, specifying the VPC reference, CIDR block, availability zone, and setting 'assignIPv6AddressOnCreation' to false.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Subnet
metadata:
  name: private-subnet-1
spec:
  vpcRef:
    from:
      name: my-vpc
  cidrBlock: 10.0.11.0/24
  availabilityZone: us-west-2b
  assignIPv6AddressOnCreation: false
  tags:
    - key: Name
      value: PrivateSubnet1
    - key: Type
      value: private
```

--------------------------------

### Helm Chart Installation

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/configuration.md

Commands to add the ACK Helm repository, update it, and install the EC2 controller Helm chart.

```bash
# Add the ECR Helm repository
helm repo add aws-controllers-k8s \
  https://aws-controllers-k8s.github.io/ec2-controller/charts

helm repo update

# Install the controller
helm install ec2-controller aws-controllers-k8s/ec2-controller \
  --namespace ack-system \
  --create-namespace \
  --set aws.region=us-west-2 \
  --set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::ACCOUNT_ID:role/EC2ControllerRole
```

--------------------------------

### Disassociation Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/elastic-ip-address.md

Example demonstrating how to configure an Elastic IP resource to indicate disassociation from an instance by omitting network interface and private IP details.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: ElasticIPAddress
metadata:
  name: instance-eip
spec:
  domain: vpc
  # Remove networkInterfaceID and privateIPAddress to disassociate
  tags:
    - key: Name
      value: DisassociatedEIP

```

--------------------------------

### RBAC Configuration Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/README.md

Example of RBAC configuration for the EC2 controller using kubebuilder annotations, specifying permissions for VPC resources.

```go
kubebuilder:rbac:groups=ec2.services.k8s.aws,resources=vpcs,verbs=get;list;watch;create;update;patch;delete
kubebuilder:rbac:groups=ec2.services.k8s.aws,resources=vpcs/status,verbs=get;update;patch
```

--------------------------------

### Example: Subnet with IPv6

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/subnet.md

This example illustrates the creation of a dual-stack subnet that supports both IPv4 and IPv6, including the IPv6 CIDR block and enabling automatic IPv6 address assignment.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Subnet
metadata:
  name: dual-stack-subnet
spec:
  vpcRef:
    from:
      name: my-vpc
  cidrBlock: 10.0.2.0/24
  ipv6CIDRBlock: 2600:1f13:e3e:e200::/64
  assignIPv6AddressOnCreation: true
  availabilityZone: us-west-2c
```

--------------------------------

### Example VPC Status Output

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/vpc.md

Example output from describing a VPC resource, showing its ARN, conditions, CIDR blocks, and other AWS attributes.

```yaml
Name:                   my-vpc
Status:
  ACK Resource Metadata:
    ARN:                        arn:aws:ec2:us-west-2:123456789012:vpc/vpc-12345678
    AWS Account ID:             123456789012
    AWS Region:                 us-west-2
    Owner Account ID:           123456789012
    Resource Type:              VPC
  Conditions:
    - Last Transition Time:     2024-01-15T10:30:00Z
      Message:                  Resource is in ACTIVE state in EC2
      Reason:                   ACKResourceSynced
      Status:                   True
      Type:                     ACK.ResourceSynced
  CIDR Block Association Set:
    - Association ID:           vpc-cidr-assoc-12345678
      CIDR Block:               10.0.0.0/16
      CIDR Block State:
        State:                  associated
  DHCP Options ID:              dopt-12345678
  Is Default:                   false
  Owner ID:                      123456789012
  State:                         available
  VPC ID:                        vpc-12345678
```

--------------------------------

### Manual Kubernetes Deployment

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/configuration.md

Example Kubernetes Deployment manifest for the ack-ec2-controller.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ack-ec2-controller
  namespace: ack-system
spec:
  replicas: 2
  selector:
    matchLabels:
      app: ack-ec2-controller
  template:
    metadata:
      labels:
        app: ack-ec2-controller
    spec:
      serviceAccountName: ack-ec2-controller
      containers:
        - name: controller
          image: public.ecr.aws/aws-controllers-k8s/ec2-controller:v1.6.0
          imagePullPolicy: IfNotPresent
          env:
            - name: ACK_ENABLE_DEVELOPMENT_LOGGING
              value: "false"
            - name: ACK_LOG_LEVEL
              value: "info"
            - name: AWS_REGION
              value: us-west-2
            - name: ACK_WATCH_NAMESPACE
              value: ""  # Watch all namespaces
          ports:
            - name: metrics
              containerPort: 8080
            - name: healthz
              containerPort: 8081
          livenessProbe:
            httpGet:
              path: /healthz
              port: healthz
            initialDelaySeconds: 15
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /readyz
              port: healthz
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 1000m
              memory: 512Mi

```

--------------------------------

### Building a Basic Network Workflow

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/API-REFERENCE-INDEX.md

Illustrates the creation order and dependencies for setting up a basic network including VPC, subnets, internet gateway, NAT gateway, and route tables.

```text
1. Create VPC
   └─ Create Subnets (public + private)
      ├─ Create InternetGateway → attach to VPC
      ├─ Create RouteTable → associate with public subnet
      │  └─ Create Route (0.0.0.0/0 → IGW)
      ├─ Create ElasticIPAddress
      ├─ Create NATGateway → associate with public subnet & EIP
      └─ Create RouteTable → associate with private subnet
         └─ Create Route (0.0.0.0/0 → NAT)
```

--------------------------------

### Basic Launch Template

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/launch-template.md

An example of a basic LaunchTemplate resource definition in YAML format.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: LaunchTemplate
metadata:
  name: web-server-template
spec:
  launchTemplateName: web-server-lt
  description: Launch template for web servers
  launchTemplateData:
    imageID: ami-0c55b159cbfafe1f0
    instanceType: t3.micro
    keyName: my-key-pair
    securityGroupIDs:
      - sg-12345678
  tags:
    - key: Name
      value: WebServerTemplate
```

--------------------------------

### Example: Dedicated Tenancy VPC

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/vpc.md

An example of a VPC resource definition with dedicated instance tenancy.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: VPC
metadata:
  name: dedicated-vpc
spec:
  cidrBlocks:
    - 10.0.0.0/16
  instanceTenancy: dedicated
  enableDNSSupport: true
  enableDNSHostnames: true
```

--------------------------------

### Check EC2 Controller Pod Status

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/helm/templates/NOTES.txt

Command to check the status of the EC2 controller pods after installation.

```bash
kubectl --namespace {{ .Release.Namespace }} get pods -l "app.kubernetes.io/instance={{ .Release.Name }}"
```

--------------------------------

### Launching an Application Workflow

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/API-REFERENCE-INDEX.md

Outlines the steps for launching an application, including creating a security group, launch template, and instance.

```text
1. Create SecurityGroup → define rules
2. Create LaunchTemplate → instance configuration
3. Create Instance → launch from template
   └─ Automatically joins SecurityGroup
   └─ Associates with Subnet
```

--------------------------------

### Web Server with Load Balancer Ready

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/instance.md

Example of an EC2 Instance resource configured as a web server with a load balancer tag.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Instance
metadata:
  name: web-server-1
spec:
  imageID: ami-0c55b159cbfafe1f0
  instanceType: t3.small
  keyName: ssh-key
  subnetRef:
    from:
      name: public-subnet-1
  securityGroupIDs:
    - sg-web-sg
  disableAPITermination: true
  tags:
    - key: Name
      value: WebServer1
    - key: LoadBalancer
      value: "true"
```

--------------------------------

### Restricted Database NACL Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/network-acl.md

An example Kubernetes NetworkACL resource configuration for a database, allowing specific traffic from an application tier.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: NetworkACL
metadata:
  name: db-nacl
spec:
  vpcRef:
    from:
      name: my-vpc
  ingressRules:
    # PostgreSQL from app tier only
    - ruleNumber: 100
      protocol: "6"  # TCP
      ruleAction: allow
      cidrBlock: 10.0.10.0/24  # App subnet
      portRange:
        from: 5432
        to: 5432
    # MySQL from app tier only
    - ruleNumber: 110
      protocol: "6"  # TCP
      ruleAction: allow
      cidrBlock: 10.0.10.0/24
      portRange:
        from: 3306
        to: 3306
    # Ephemeral response ports
    - ruleNumber: 120
      protocol: "6"  # TCP
      ruleAction: allow
      cidrBlock: 10.0.10.0/24
      portRange:
        from: 1024
        to: 65535
    # Deny everything else
    - ruleNumber: 32767
      protocol: "-1"
      ruleAction: deny
      cidrBlock: 0.0.0.0/0
  egressRules:
    # Allow outbound to app tier
    - ruleNumber: 100
      protocol: "-1"
      ruleAction: allow
      cidrBlock: 10.0.10.0/24
    # Deny everything else
    - ruleNumber: 32767
      protocol: "-1"
      ruleAction: deny
      cidrBlock: 0.0.0.0/0
```

--------------------------------

### Web Server NACL Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/network-acl.md

An example Kubernetes NetworkACL resource configuration for a web server, allowing HTTP and HTTPS traffic.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: NetworkACL
metadata:
  name: web-nacl
spec:
  vpcRef:
    from:
      name: my-vpc
  ingressRules:
    - ruleNumber: 100
      protocol: "6"  # TCP
      ruleAction: allow
      cidrBlock: 0.0.0.0/0
      portRange:
        from: 80
        to: 80
      description: HTTP
    - ruleNumber: 110
      protocol: "6"  # TCP
      ruleAction: allow
      cidrBlock: 0.0.0.0/0
      portRange:
        from: 443
        to: 443
      description: HTTPS
    - ruleNumber: 120
      protocol: "6"  # TCP
      ruleAction: allow
      cidrBlock: 0.0.0.0/0
      portRange:
        from: 1024
        to: 65535
      description: Ephemeral ports
    - ruleNumber: 32767
      protocol: "-1"
      ruleAction: deny
      cidrBlock: 0.0.0.0/0
  egressRules:
    - ruleNumber: 100
      protocol: "-1"  # All
      ruleAction: allow
      cidrBlock: 0.0.0.0/0
```

--------------------------------

### Launching Instances from Template using Instance Resource

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/launch-template.md

Example YAML for an EC2 Instance resource that specifies a LaunchTemplate to use for its configuration, referencing a specific template name and version.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Instance
metadata:
  name: web-server-1
spec:
  launchTemplate:
    launchTemplateName: web-fleet-lt
    version: $Default
  subnetRef:
    from:
      name: public-subnet
```

--------------------------------

### ID and Ref Pattern Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/types.md

Illustrates how resources can be referenced using either an ID or a reference object.

```yaml
# Using ID
vpcID: vpc-12345678

# Using Ref
vpcRef:
  from:
    name: my-vpc
```

--------------------------------

### Basic Security Group Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/security-group.md

Example YAML definition for a basic SecurityGroup resource, including ingress and egress rules for HTTP and HTTPS traffic.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: SecurityGroup
metadata:
  name: web-sg
spec:
  name: web-security-group
  description: Security group for web servers
  vpcRef:
    from:
      name: my-vpc
  ingressRules:
    - ipProtocol: tcp
      fromPort: 80
      toPort: 80
      ipRanges:
        - cidrIP: 0.0.0.0/0
          description: Allow HTTP from anywhere
    - ipProtocol: tcp
      fromPort: 443
      toPort: 443
      ipRanges:
        - cidrIP: 0.0.0.0/0
          description: Allow HTTPS from anywhere
  egressRules:
    - ipProtocol: -1
      ipRanges:
        - cidrIP: 0.0.0.0/0
          description: Allow all outbound traffic
  tags:
    - key: Name
      value: WebServers
    - key: Environment
      value: production
```

--------------------------------

### Instance with IAM Role and User Data

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/instance.md

Example of creating an EC2 instance with an IAM role and user data.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: Instance
metadata:
  name: app-server
spec:
  imageID: ami-0c55b159cbfafe1f0
  instanceType: t3.small
  keyName: my-key-pair
  subnetRef:
    from:
      name: private-subnet
  iamInstanceProfile:
    name: EC2-App-Role
  userData: IyEvYmluL2Jhc2gKYXB0IHVwZGF0ZQphcHQgaW5zdGFsbCAteSBkb2NrZXIuaW8=
  blockDeviceMappings:
    - deviceName: /dev/sda1
      ebs:
        volumeSize: 20
        volumeType: gp3
        deleteOnTermination: true
  tags:
    - key: Name
      value: AppServer
```

--------------------------------

### Advanced Launch Template

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/launch-template.md

An example of an advanced LaunchTemplate resource definition in YAML format, including more detailed configuration options.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: LaunchTemplate
metadata:
  name: application-template
spec:
  launchTemplateName: app-server-lt
  description: Template for application servers
  launchTemplateData:
    imageID: ami-0c55b159cbfafe1f0
    instanceType: t3.small
    keyName: app-key
    monitoring:
      enabled: true
    blockDeviceMappings:
      - deviceName: /dev/sda1
        ebs:
          volumeSize: 30
          volumeType: gp3
          deleteOnTermination: true
    cpuOptions:
      coreCount: 2
      threadsPerCore: 1
    iamInstanceProfile:
      name: EC2-App-Role
    userData: IyEvYmluL2Jhc2gKYXB0IHVwZGF0ZQpheHQgaW5zdGFsbCAteSBudWdpbng=
    tagSpecifications:
      - resourceType: instance
        tags:
          - key: ManagedBy
            value: LaunchTemplate
```

--------------------------------

### Security Group with Peer Rules Example

Source: https://github.com/aws-controllers-k8s/ec2-controller/blob/main/_autodocs/api-reference/security-group.md

Example YAML definition for a SecurityGroup resource demonstrating ingress rules that allow traffic from another specific security group.

```yaml
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: SecurityGroup
metadata:
  name: app-sg
spec:
  name: app-security-group
  description: Security group for application servers
  vpcRef:
    from:
      name: my-vpc
  ingressRules:
    - ipProtocol: tcp
      fromPort: 5432
      toPort: 5432
      userIDGroupPairs:
        - groupID: sg-12345678  # Allow from specific security group
          description: Allow PostgreSQL from web servers
```