diff --git a/apis/gridscale/v1alpha1/zz_generated.conversion_hubs.go b/apis/gridscale/v1alpha1/zz_generated.conversion_hubs.go
index 80e1a8e..ccc9f4f 100755
--- a/apis/gridscale/v1alpha1/zz_generated.conversion_hubs.go
+++ b/apis/gridscale/v1alpha1/zz_generated.conversion_hubs.go
@@ -12,6 +12,9 @@ func (tr *IPv4) Hub() {}
 // Hub marks this type as a conversion hub.
 func (tr *IPv6) Hub() {}
 
+// Hub marks this type as a conversion hub.
+func (tr *K8S) Hub() {}
+
 // Hub marks this type as a conversion hub.
 func (tr *Network) Hub() {}
 
diff --git a/apis/gridscale/v1alpha1/zz_generated.deepcopy.go b/apis/gridscale/v1alpha1/zz_generated.deepcopy.go
index 024adb5..db425bf 100644
--- a/apis/gridscale/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/gridscale/v1alpha1/zz_generated.deepcopy.go
@@ -631,6 +631,511 @@ func (in *IPv6Status) DeepCopy() *IPv6Status {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *K8S) DeepCopyInto(out *K8S) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8S.
+func (in *K8S) DeepCopy() *K8S {
+	if in == nil {
+		return nil
+	}
+	out := new(K8S)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *K8S) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *K8SInitParameters) DeepCopyInto(out *K8SInitParameters) {
+	*out = *in
+	if in.GskVersion != nil {
+		in, out := &in.GskVersion, &out.GskVersion
+		*out = new(string)
+		**out = **in
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make([]*string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(string)
+				**out = **in
+			}
+		}
+	}
+	if in.Name != nil {
+		in, out := &in.Name, &out.Name
+		*out = new(string)
+		**out = **in
+	}
+	if in.NodePool != nil {
+		in, out := &in.NodePool, &out.NodePool
+		*out = make([]NodePoolInitParameters, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.OidcCAPem != nil {
+		in, out := &in.OidcCAPem, &out.OidcCAPem
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcClientID != nil {
+		in, out := &in.OidcClientID, &out.OidcClientID
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcEnabled != nil {
+		in, out := &in.OidcEnabled, &out.OidcEnabled
+		*out = new(bool)
+		**out = **in
+	}
+	if in.OidcGroupsClaim != nil {
+		in, out := &in.OidcGroupsClaim, &out.OidcGroupsClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcGroupsPrefix != nil {
+		in, out := &in.OidcGroupsPrefix, &out.OidcGroupsPrefix
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcIssuerURL != nil {
+		in, out := &in.OidcIssuerURL, &out.OidcIssuerURL
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcRequiredClaim != nil {
+		in, out := &in.OidcRequiredClaim, &out.OidcRequiredClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcSigningAlgs != nil {
+		in, out := &in.OidcSigningAlgs, &out.OidcSigningAlgs
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcUsernameClaim != nil {
+		in, out := &in.OidcUsernameClaim, &out.OidcUsernameClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcUsernamePrefix != nil {
+		in, out := &in.OidcUsernamePrefix, &out.OidcUsernamePrefix
+		*out = new(string)
+		**out = **in
+	}
+	if in.Release != nil {
+		in, out := &in.Release, &out.Release
+		*out = new(string)
+		**out = **in
+	}
+	if in.SecurityZoneUUID != nil {
+		in, out := &in.SecurityZoneUUID, &out.SecurityZoneUUID
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8SInitParameters.
+func (in *K8SInitParameters) DeepCopy() *K8SInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(K8SInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *K8SList) DeepCopyInto(out *K8SList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]K8S, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8SList.
+func (in *K8SList) DeepCopy() *K8SList {
+	if in == nil {
+		return nil
+	}
+	out := new(K8SList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *K8SList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *K8SObservation) DeepCopyInto(out *K8SObservation) {
+	*out = *in
+	if in.ChangeTime != nil {
+		in, out := &in.ChangeTime, &out.ChangeTime
+		*out = new(string)
+		**out = **in
+	}
+	if in.CreateTime != nil {
+		in, out := &in.CreateTime, &out.CreateTime
+		*out = new(string)
+		**out = **in
+	}
+	if in.GskVersion != nil {
+		in, out := &in.GskVersion, &out.GskVersion
+		*out = new(string)
+		**out = **in
+	}
+	if in.ID != nil {
+		in, out := &in.ID, &out.ID
+		*out = new(string)
+		**out = **in
+	}
+	if in.K8SPrivateNetworkUUID != nil {
+		in, out := &in.K8SPrivateNetworkUUID, &out.K8SPrivateNetworkUUID
+		*out = new(string)
+		**out = **in
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make([]*string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(string)
+				**out = **in
+			}
+		}
+	}
+	if in.ListenPort != nil {
+		in, out := &in.ListenPort, &out.ListenPort
+		*out = make([]ListenPortObservation, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Name != nil {
+		in, out := &in.Name, &out.Name
+		*out = new(string)
+		**out = **in
+	}
+	if in.NetworkUUID != nil {
+		in, out := &in.NetworkUUID, &out.NetworkUUID
+		*out = new(string)
+		**out = **in
+	}
+	if in.NodePool != nil {
+		in, out := &in.NodePool, &out.NodePool
+		*out = make([]NodePoolObservation, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.OidcCAPem != nil {
+		in, out := &in.OidcCAPem, &out.OidcCAPem
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcClientID != nil {
+		in, out := &in.OidcClientID, &out.OidcClientID
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcEnabled != nil {
+		in, out := &in.OidcEnabled, &out.OidcEnabled
+		*out = new(bool)
+		**out = **in
+	}
+	if in.OidcGroupsClaim != nil {
+		in, out := &in.OidcGroupsClaim, &out.OidcGroupsClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcGroupsPrefix != nil {
+		in, out := &in.OidcGroupsPrefix, &out.OidcGroupsPrefix
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcIssuerURL != nil {
+		in, out := &in.OidcIssuerURL, &out.OidcIssuerURL
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcRequiredClaim != nil {
+		in, out := &in.OidcRequiredClaim, &out.OidcRequiredClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcSigningAlgs != nil {
+		in, out := &in.OidcSigningAlgs, &out.OidcSigningAlgs
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcUsernameClaim != nil {
+		in, out := &in.OidcUsernameClaim, &out.OidcUsernameClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcUsernamePrefix != nil {
+		in, out := &in.OidcUsernamePrefix, &out.OidcUsernamePrefix
+		*out = new(string)
+		**out = **in
+	}
+	if in.Release != nil {
+		in, out := &in.Release, &out.Release
+		*out = new(string)
+		**out = **in
+	}
+	if in.SecurityZoneUUID != nil {
+		in, out := &in.SecurityZoneUUID, &out.SecurityZoneUUID
+		*out = new(string)
+		**out = **in
+	}
+	if in.ServiceTemplateUUID != nil {
+		in, out := &in.ServiceTemplateUUID, &out.ServiceTemplateUUID
+		*out = new(string)
+		**out = **in
+	}
+	if in.Status != nil {
+		in, out := &in.Status, &out.Status
+		*out = new(string)
+		**out = **in
+	}
+	if in.UsageInMinutes != nil {
+		in, out := &in.UsageInMinutes, &out.UsageInMinutes
+		*out = new(float64)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8SObservation.
+func (in *K8SObservation) DeepCopy() *K8SObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(K8SObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *K8SParameters) DeepCopyInto(out *K8SParameters) {
+	*out = *in
+	if in.GskVersion != nil {
+		in, out := &in.GskVersion, &out.GskVersion
+		*out = new(string)
+		**out = **in
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make([]*string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(string)
+				**out = **in
+			}
+		}
+	}
+	if in.Name != nil {
+		in, out := &in.Name, &out.Name
+		*out = new(string)
+		**out = **in
+	}
+	if in.NodePool != nil {
+		in, out := &in.NodePool, &out.NodePool
+		*out = make([]NodePoolParameters, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.OidcCAPem != nil {
+		in, out := &in.OidcCAPem, &out.OidcCAPem
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcClientID != nil {
+		in, out := &in.OidcClientID, &out.OidcClientID
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcEnabled != nil {
+		in, out := &in.OidcEnabled, &out.OidcEnabled
+		*out = new(bool)
+		**out = **in
+	}
+	if in.OidcGroupsClaim != nil {
+		in, out := &in.OidcGroupsClaim, &out.OidcGroupsClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcGroupsPrefix != nil {
+		in, out := &in.OidcGroupsPrefix, &out.OidcGroupsPrefix
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcIssuerURL != nil {
+		in, out := &in.OidcIssuerURL, &out.OidcIssuerURL
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcRequiredClaim != nil {
+		in, out := &in.OidcRequiredClaim, &out.OidcRequiredClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcSigningAlgs != nil {
+		in, out := &in.OidcSigningAlgs, &out.OidcSigningAlgs
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcUsernameClaim != nil {
+		in, out := &in.OidcUsernameClaim, &out.OidcUsernameClaim
+		*out = new(string)
+		**out = **in
+	}
+	if in.OidcUsernamePrefix != nil {
+		in, out := &in.OidcUsernamePrefix, &out.OidcUsernamePrefix
+		*out = new(string)
+		**out = **in
+	}
+	if in.Release != nil {
+		in, out := &in.Release, &out.Release
+		*out = new(string)
+		**out = **in
+	}
+	if in.SecurityZoneUUID != nil {
+		in, out := &in.SecurityZoneUUID, &out.SecurityZoneUUID
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8SParameters.
+func (in *K8SParameters) DeepCopy() *K8SParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(K8SParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *K8SSpec) DeepCopyInto(out *K8SSpec) {
+	*out = *in
+	in.ResourceSpec.DeepCopyInto(&out.ResourceSpec)
+	in.ForProvider.DeepCopyInto(&out.ForProvider)
+	in.InitProvider.DeepCopyInto(&out.InitProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8SSpec.
+func (in *K8SSpec) DeepCopy() *K8SSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(K8SSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *K8SStatus) DeepCopyInto(out *K8SStatus) {
+	*out = *in
+	in.ResourceStatus.DeepCopyInto(&out.ResourceStatus)
+	in.AtProvider.DeepCopyInto(&out.AtProvider)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new K8SStatus.
+func (in *K8SStatus) DeepCopy() *K8SStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(K8SStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenPortInitParameters) DeepCopyInto(out *ListenPortInitParameters) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenPortInitParameters.
+func (in *ListenPortInitParameters) DeepCopy() *ListenPortInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenPortInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenPortObservation) DeepCopyInto(out *ListenPortObservation) {
+	*out = *in
+	if in.Name != nil {
+		in, out := &in.Name, &out.Name
+		*out = new(string)
+		**out = **in
+	}
+	if in.Port != nil {
+		in, out := &in.Port, &out.Port
+		*out = new(float64)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenPortObservation.
+func (in *ListenPortObservation) DeepCopy() *ListenPortObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenPortObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenPortParameters) DeepCopyInto(out *ListenPortParameters) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenPortParameters.
+func (in *ListenPortParameters) DeepCopy() *ListenPortParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenPortParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Network) DeepCopyInto(out *Network) {
 	*out = *in
@@ -990,6 +1495,201 @@ func (in *NetworkStatus) DeepCopy() *NetworkStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodePoolInitParameters) DeepCopyInto(out *NodePoolInitParameters) {
+	*out = *in
+	if in.ClusterCidr != nil {
+		in, out := &in.ClusterCidr, &out.ClusterCidr
+		*out = new(string)
+		**out = **in
+	}
+	if in.ClusterTrafficEncryption != nil {
+		in, out := &in.ClusterTrafficEncryption, &out.ClusterTrafficEncryption
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Cores != nil {
+		in, out := &in.Cores, &out.Cores
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Memory != nil {
+		in, out := &in.Memory, &out.Memory
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Name != nil {
+		in, out := &in.Name, &out.Name
+		*out = new(string)
+		**out = **in
+	}
+	if in.NodeCount != nil {
+		in, out := &in.NodeCount, &out.NodeCount
+		*out = new(float64)
+		**out = **in
+	}
+	if in.RocketStorage != nil {
+		in, out := &in.RocketStorage, &out.RocketStorage
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Storage != nil {
+		in, out := &in.Storage, &out.Storage
+		*out = new(float64)
+		**out = **in
+	}
+	if in.StorageType != nil {
+		in, out := &in.StorageType, &out.StorageType
+		*out = new(string)
+		**out = **in
+	}
+	if in.SurgeNode != nil {
+		in, out := &in.SurgeNode, &out.SurgeNode
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodePoolInitParameters.
+func (in *NodePoolInitParameters) DeepCopy() *NodePoolInitParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(NodePoolInitParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodePoolObservation) DeepCopyInto(out *NodePoolObservation) {
+	*out = *in
+	if in.ClusterCidr != nil {
+		in, out := &in.ClusterCidr, &out.ClusterCidr
+		*out = new(string)
+		**out = **in
+	}
+	if in.ClusterTrafficEncryption != nil {
+		in, out := &in.ClusterTrafficEncryption, &out.ClusterTrafficEncryption
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Cores != nil {
+		in, out := &in.Cores, &out.Cores
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Memory != nil {
+		in, out := &in.Memory, &out.Memory
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Name != nil {
+		in, out := &in.Name, &out.Name
+		*out = new(string)
+		**out = **in
+	}
+	if in.NodeCount != nil {
+		in, out := &in.NodeCount, &out.NodeCount
+		*out = new(float64)
+		**out = **in
+	}
+	if in.RocketStorage != nil {
+		in, out := &in.RocketStorage, &out.RocketStorage
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Storage != nil {
+		in, out := &in.Storage, &out.Storage
+		*out = new(float64)
+		**out = **in
+	}
+	if in.StorageType != nil {
+		in, out := &in.StorageType, &out.StorageType
+		*out = new(string)
+		**out = **in
+	}
+	if in.SurgeNode != nil {
+		in, out := &in.SurgeNode, &out.SurgeNode
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodePoolObservation.
+func (in *NodePoolObservation) DeepCopy() *NodePoolObservation {
+	if in == nil {
+		return nil
+	}
+	out := new(NodePoolObservation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodePoolParameters) DeepCopyInto(out *NodePoolParameters) {
+	*out = *in
+	if in.ClusterCidr != nil {
+		in, out := &in.ClusterCidr, &out.ClusterCidr
+		*out = new(string)
+		**out = **in
+	}
+	if in.ClusterTrafficEncryption != nil {
+		in, out := &in.ClusterTrafficEncryption, &out.ClusterTrafficEncryption
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Cores != nil {
+		in, out := &in.Cores, &out.Cores
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Memory != nil {
+		in, out := &in.Memory, &out.Memory
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Name != nil {
+		in, out := &in.Name, &out.Name
+		*out = new(string)
+		**out = **in
+	}
+	if in.NodeCount != nil {
+		in, out := &in.NodeCount, &out.NodeCount
+		*out = new(float64)
+		**out = **in
+	}
+	if in.RocketStorage != nil {
+		in, out := &in.RocketStorage, &out.RocketStorage
+		*out = new(float64)
+		**out = **in
+	}
+	if in.Storage != nil {
+		in, out := &in.Storage, &out.Storage
+		*out = new(float64)
+		**out = **in
+	}
+	if in.StorageType != nil {
+		in, out := &in.StorageType, &out.StorageType
+		*out = new(string)
+		**out = **in
+	}
+	if in.SurgeNode != nil {
+		in, out := &in.SurgeNode, &out.SurgeNode
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodePoolParameters.
+func (in *NodePoolParameters) DeepCopy() *NodePoolParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(NodePoolParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PinnedServersInitParameters) DeepCopyInto(out *PinnedServersInitParameters) {
 	*out = *in
diff --git a/apis/gridscale/v1alpha1/zz_generated.managed.go b/apis/gridscale/v1alpha1/zz_generated.managed.go
index 4f424d5..4b937bf 100644
--- a/apis/gridscale/v1alpha1/zz_generated.managed.go
+++ b/apis/gridscale/v1alpha1/zz_generated.managed.go
@@ -128,6 +128,66 @@ func (mg *IPv6) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
 	mg.Spec.WriteConnectionSecretToReference = r
 }
 
+// GetCondition of this K8S.
+func (mg *K8S) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
+	return mg.Status.GetCondition(ct)
+}
+
+// GetDeletionPolicy of this K8S.
+func (mg *K8S) GetDeletionPolicy() xpv1.DeletionPolicy {
+	return mg.Spec.DeletionPolicy
+}
+
+// GetManagementPolicies of this K8S.
+func (mg *K8S) GetManagementPolicies() xpv1.ManagementPolicies {
+	return mg.Spec.ManagementPolicies
+}
+
+// GetProviderConfigReference of this K8S.
+func (mg *K8S) GetProviderConfigReference() *xpv1.Reference {
+	return mg.Spec.ProviderConfigReference
+}
+
+// GetPublishConnectionDetailsTo of this K8S.
+func (mg *K8S) GetPublishConnectionDetailsTo() *xpv1.PublishConnectionDetailsTo {
+	return mg.Spec.PublishConnectionDetailsTo
+}
+
+// GetWriteConnectionSecretToReference of this K8S.
+func (mg *K8S) GetWriteConnectionSecretToReference() *xpv1.SecretReference {
+	return mg.Spec.WriteConnectionSecretToReference
+}
+
+// SetConditions of this K8S.
+func (mg *K8S) SetConditions(c ...xpv1.Condition) {
+	mg.Status.SetConditions(c...)
+}
+
+// SetDeletionPolicy of this K8S.
+func (mg *K8S) SetDeletionPolicy(r xpv1.DeletionPolicy) {
+	mg.Spec.DeletionPolicy = r
+}
+
+// SetManagementPolicies of this K8S.
+func (mg *K8S) SetManagementPolicies(r xpv1.ManagementPolicies) {
+	mg.Spec.ManagementPolicies = r
+}
+
+// SetProviderConfigReference of this K8S.
+func (mg *K8S) SetProviderConfigReference(r *xpv1.Reference) {
+	mg.Spec.ProviderConfigReference = r
+}
+
+// SetPublishConnectionDetailsTo of this K8S.
+func (mg *K8S) SetPublishConnectionDetailsTo(r *xpv1.PublishConnectionDetailsTo) {
+	mg.Spec.PublishConnectionDetailsTo = r
+}
+
+// SetWriteConnectionSecretToReference of this K8S.
+func (mg *K8S) SetWriteConnectionSecretToReference(r *xpv1.SecretReference) {
+	mg.Spec.WriteConnectionSecretToReference = r
+}
+
 // GetCondition of this Network.
 func (mg *Network) GetCondition(ct xpv1.ConditionType) xpv1.Condition {
 	return mg.Status.GetCondition(ct)
diff --git a/apis/gridscale/v1alpha1/zz_generated.managedlist.go b/apis/gridscale/v1alpha1/zz_generated.managedlist.go
index 9ec525b..f274b2e 100644
--- a/apis/gridscale/v1alpha1/zz_generated.managedlist.go
+++ b/apis/gridscale/v1alpha1/zz_generated.managedlist.go
@@ -26,6 +26,15 @@ func (l *IPv6List) GetItems() []resource.Managed {
 	return items
 }
 
+// GetItems of this K8SList.
+func (l *K8SList) GetItems() []resource.Managed {
+	items := make([]resource.Managed, len(l.Items))
+	for i := range l.Items {
+		items[i] = &l.Items[i]
+	}
+	return items
+}
+
 // GetItems of this NetworkList.
 func (l *NetworkList) GetItems() []resource.Managed {
 	items := make([]resource.Managed, len(l.Items))
diff --git a/apis/gridscale/v1alpha1/zz_k8s_terraformed.go b/apis/gridscale/v1alpha1/zz_k8s_terraformed.go
new file mode 100755
index 0000000..6dc8026
--- /dev/null
+++ b/apis/gridscale/v1alpha1/zz_k8s_terraformed.go
@@ -0,0 +1,129 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"dario.cat/mergo"
+	"github.com/pkg/errors"
+
+	"github.com/crossplane/upjet/pkg/resource"
+	"github.com/crossplane/upjet/pkg/resource/json"
+)
+
+// GetTerraformResourceType returns Terraform resource type for this K8S
+func (mg *K8S) GetTerraformResourceType() string {
+	return "gridscale_k8s"
+}
+
+// GetConnectionDetailsMapping for this K8S
+func (tr *K8S) GetConnectionDetailsMapping() map[string]string {
+	return map[string]string{"kubeconfig": "status.atProvider.kubeconfig"}
+}
+
+// GetObservation of this K8S
+func (tr *K8S) GetObservation() (map[string]any, error) {
+	o, err := json.TFParser.Marshal(tr.Status.AtProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(o, &base)
+}
+
+// SetObservation for this K8S
+func (tr *K8S) SetObservation(obs map[string]any) error {
+	p, err := json.TFParser.Marshal(obs)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Status.AtProvider)
+}
+
+// GetID returns ID of underlying Terraform resource of this K8S
+func (tr *K8S) GetID() string {
+	if tr.Status.AtProvider.ID == nil {
+		return ""
+	}
+	return *tr.Status.AtProvider.ID
+}
+
+// GetParameters of this K8S
+func (tr *K8S) GetParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.ForProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// SetParameters for this K8S
+func (tr *K8S) SetParameters(params map[string]any) error {
+	p, err := json.TFParser.Marshal(params)
+	if err != nil {
+		return err
+	}
+	return json.TFParser.Unmarshal(p, &tr.Spec.ForProvider)
+}
+
+// GetInitParameters of this K8S
+func (tr *K8S) GetInitParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.InitProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// GetInitParameters of this K8S
+func (tr *K8S) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
+// LateInitialize this K8S using its observed tfState.
+// returns True if there are any spec changes for the resource.
+func (tr *K8S) LateInitialize(attrs []byte) (bool, error) {
+	params := &K8SParameters{}
+	if err := json.TFParser.Unmarshal(attrs, params); err != nil {
+		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
+	}
+	opts := []resource.GenericLateInitializerOption{resource.WithZeroValueJSONOmitEmptyFilter(resource.CNameWildcard)}
+
+	li := resource.NewGenericLateInitializer(opts...)
+	return li.LateInitialize(&tr.Spec.ForProvider, params)
+}
+
+// GetTerraformSchemaVersion returns the associated Terraform schema version
+func (tr *K8S) GetTerraformSchemaVersion() int {
+	return 0
+}
diff --git a/apis/gridscale/v1alpha1/zz_k8s_types.go b/apis/gridscale/v1alpha1/zz_k8s_types.go
new file mode 100755
index 0000000..913cfa8
--- /dev/null
+++ b/apis/gridscale/v1alpha1/zz_k8s_types.go
@@ -0,0 +1,483 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	v1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
+)
+
+type K8SInitParameters struct {
+
+	// The gridscale's Kubernetes version of this instance (e.g. "1.21.14-gs1"). Define which gridscale k8s version will be used to create the cluster. For convenience, please use gscloud to get the list of available gridscale k8s version. NOTE: Either gsk_version or release is set at a time.
+	// The gridscale k8s PaaS version (issued by gridscale) of this instance.
+	GskVersion *string `json:"gskVersion,omitempty" tf:"gsk_version,omitempty"`
+
+	// List of labels in the format [ "label1", "label2" ].
+	// List of labels.
+	// +listType=set
+	Labels []*string `json:"labels,omitempty" tf:"labels,omitempty"`
+
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	Name *string `json:"name,omitempty" tf:"name,omitempty"`
+
+	// Node pool's specification. NOTE: The node pool's specification is not yet mutable (except node_count).
+	// Node pool's specification.
+	NodePool []NodePoolInitParameters `json:"nodePool,omitempty" tf:"node_pool,omitempty"`
+
+	// Custom CA from customer in pem format as string.
+	// Custom CA from customer in pem format as string.
+	OidcCAPem *string `json:"oidcCaPem,omitempty" tf:"oidc_ca_pem,omitempty"`
+
+	// A client ID that all tokens must be issued for.
+	// A client ID that all tokens must be issued for.
+	OidcClientID *string `json:"oidcClientId,omitempty" tf:"oidc_client_id,omitempty"`
+
+	// Enable OIDC for the k8s cluster.
+	// Disable or enable OIDC
+	OidcEnabled *bool `json:"oidcEnabled,omitempty" tf:"oidc_enabled,omitempty"`
+
+	// JWT claim to use as the user's group.
+	// JWT claim to use as the user's group.
+	OidcGroupsClaim *string `json:"oidcGroupsClaim,omitempty" tf:"oidc_groups_claim,omitempty"`
+
+	// Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+	// Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+	OidcGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" tf:"oidc_groups_prefix,omitempty"`
+
+	// URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+	// URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+	OidcIssuerURL *string `json:"oidcIssuerUrl,omitempty" tf:"oidc_issuer_url,omitempty"`
+
+	// A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2.
+	// A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2
+	OidcRequiredClaim *string `json:"oidcRequiredClaim,omitempty" tf:"oidc_required_claim,omitempty"`
+
+	// The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+	// The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+	OidcSigningAlgs *string `json:"oidcSigningAlgs,omitempty" tf:"oidc_signing_algs,omitempty"`
+
+	// JWT claim to use as the user name.
+	// JWT claim to use as the user name.
+	OidcUsernameClaim *string `json:"oidcUsernameClaim,omitempty" tf:"oidc_username_claim,omitempty"`
+
+	// Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+	// Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+	OidcUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" tf:"oidc_username_prefix,omitempty"`
+
+	// The Kubernetes release of this instance. Define which release will be used to create the cluster. For convenience, please use gscloud to get the list of available releases. NOTE: Either gsk_version or release is set at a time.
+	// The k8s release of this instance.
+	Release *string `json:"release,omitempty" tf:"release,omitempty"`
+
+	// DEPRECATED  Security zone UUID linked to the Kubernetes resource. If security_zone_uuid is not set, the default security zone will be created (if it doesn't exist) and linked. A change of this argument necessitates the re-creation of the resource.
+	// Security zone UUID linked to PaaS service.
+	SecurityZoneUUID *string `json:"securityZoneUuid,omitempty" tf:"security_zone_uuid,omitempty"`
+}
+
+type K8SObservation struct {
+
+	// Defines the date and time of the last object change.
+	// Time of the last change
+	ChangeTime *string `json:"changeTime,omitempty" tf:"change_time,omitempty"`
+
+	// The time the object was created.
+	// Time this service was created.
+	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`
+
+	// The gridscale's Kubernetes version of this instance (e.g. "1.21.14-gs1"). Define which gridscale k8s version will be used to create the cluster. For convenience, please use gscloud to get the list of available gridscale k8s version. NOTE: Either gsk_version or release is set at a time.
+	// The gridscale k8s PaaS version (issued by gridscale) of this instance.
+	GskVersion *string `json:"gskVersion,omitempty" tf:"gsk_version,omitempty"`
+
+	ID *string `json:"id,omitempty" tf:"id,omitempty"`
+
+	// Private network UUID which k8s nodes are attached to. It can be used to attach other PaaS/VMs.
+	// Private network UUID which k8s nodes are attached to. It can be used to attach other PaaS/VMs.
+	K8SPrivateNetworkUUID *string `json:"k8sPrivateNetworkUuid,omitempty" tf:"k8s_private_network_uuid,omitempty"`
+
+	// List of labels in the format [ "label1", "label2" ].
+	// List of labels.
+	// +listType=set
+	Labels []*string `json:"labels,omitempty" tf:"labels,omitempty"`
+
+	// The port number where this k8s service accepts connections.
+	ListenPort []ListenPortObservation `json:"listenPort,omitempty" tf:"listen_port,omitempty"`
+
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	Name *string `json:"name,omitempty" tf:"name,omitempty"`
+
+	// DEPRECATED  Network UUID containing security zone, which is linked to the k8s cluster.
+	// Network UUID containing security zone
+	NetworkUUID *string `json:"networkUuid,omitempty" tf:"network_uuid,omitempty"`
+
+	// Node pool's specification. NOTE: The node pool's specification is not yet mutable (except node_count).
+	// Node pool's specification.
+	NodePool []NodePoolObservation `json:"nodePool,omitempty" tf:"node_pool,omitempty"`
+
+	// Custom CA from customer in pem format as string.
+	// Custom CA from customer in pem format as string.
+	OidcCAPem *string `json:"oidcCaPem,omitempty" tf:"oidc_ca_pem,omitempty"`
+
+	// A client ID that all tokens must be issued for.
+	// A client ID that all tokens must be issued for.
+	OidcClientID *string `json:"oidcClientId,omitempty" tf:"oidc_client_id,omitempty"`
+
+	// Enable OIDC for the k8s cluster.
+	// Disable or enable OIDC
+	OidcEnabled *bool `json:"oidcEnabled,omitempty" tf:"oidc_enabled,omitempty"`
+
+	// JWT claim to use as the user's group.
+	// JWT claim to use as the user's group.
+	OidcGroupsClaim *string `json:"oidcGroupsClaim,omitempty" tf:"oidc_groups_claim,omitempty"`
+
+	// Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+	// Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+	OidcGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" tf:"oidc_groups_prefix,omitempty"`
+
+	// URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+	// URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+	OidcIssuerURL *string `json:"oidcIssuerUrl,omitempty" tf:"oidc_issuer_url,omitempty"`
+
+	// A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2.
+	// A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2
+	OidcRequiredClaim *string `json:"oidcRequiredClaim,omitempty" tf:"oidc_required_claim,omitempty"`
+
+	// The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+	// The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+	OidcSigningAlgs *string `json:"oidcSigningAlgs,omitempty" tf:"oidc_signing_algs,omitempty"`
+
+	// JWT claim to use as the user name.
+	// JWT claim to use as the user name.
+	OidcUsernameClaim *string `json:"oidcUsernameClaim,omitempty" tf:"oidc_username_claim,omitempty"`
+
+	// Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+	// Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+	OidcUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" tf:"oidc_username_prefix,omitempty"`
+
+	// The Kubernetes release of this instance. Define which release will be used to create the cluster. For convenience, please use gscloud to get the list of available releases. NOTE: Either gsk_version or release is set at a time.
+	// The k8s release of this instance.
+	Release *string `json:"release,omitempty" tf:"release,omitempty"`
+
+	// DEPRECATED  Security zone UUID linked to the Kubernetes resource. If security_zone_uuid is not set, the default security zone will be created (if it doesn't exist) and linked. A change of this argument necessitates the re-creation of the resource.
+	// Security zone UUID linked to PaaS service.
+	SecurityZoneUUID *string `json:"securityZoneUuid,omitempty" tf:"security_zone_uuid,omitempty"`
+
+	// PaaS service template that k8s service uses.g. the k8s service is upgraded by gridscale staffs).
+	// PaaS service template identifier for this service.
+	ServiceTemplateUUID *string `json:"serviceTemplateUuid,omitempty" tf:"service_template_uuid,omitempty"`
+
+	// status indicates the status of the object.
+	// Current status of the service
+	Status *string `json:"status,omitempty" tf:"status,omitempty"`
+
+	// The amount of minutes the IP address has been in use.
+	// Number of minutes that PaaS service is in use
+	UsageInMinutes *float64 `json:"usageInMinutes,omitempty" tf:"usage_in_minutes,omitempty"`
+}
+
+type K8SParameters struct {
+
+	// The gridscale's Kubernetes version of this instance (e.g. "1.21.14-gs1"). Define which gridscale k8s version will be used to create the cluster. For convenience, please use gscloud to get the list of available gridscale k8s version. NOTE: Either gsk_version or release is set at a time.
+	// The gridscale k8s PaaS version (issued by gridscale) of this instance.
+	// +kubebuilder:validation:Optional
+	GskVersion *string `json:"gskVersion,omitempty" tf:"gsk_version,omitempty"`
+
+	// List of labels in the format [ "label1", "label2" ].
+	// List of labels.
+	// +kubebuilder:validation:Optional
+	// +listType=set
+	Labels []*string `json:"labels,omitempty" tf:"labels,omitempty"`
+
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	// +kubebuilder:validation:Optional
+	Name *string `json:"name,omitempty" tf:"name,omitempty"`
+
+	// Node pool's specification. NOTE: The node pool's specification is not yet mutable (except node_count).
+	// Node pool's specification.
+	// +kubebuilder:validation:Optional
+	NodePool []NodePoolParameters `json:"nodePool,omitempty" tf:"node_pool,omitempty"`
+
+	// Custom CA from customer in pem format as string.
+	// Custom CA from customer in pem format as string.
+	// +kubebuilder:validation:Optional
+	OidcCAPem *string `json:"oidcCaPem,omitempty" tf:"oidc_ca_pem,omitempty"`
+
+	// A client ID that all tokens must be issued for.
+	// A client ID that all tokens must be issued for.
+	// +kubebuilder:validation:Optional
+	OidcClientID *string `json:"oidcClientId,omitempty" tf:"oidc_client_id,omitempty"`
+
+	// Enable OIDC for the k8s cluster.
+	// Disable or enable OIDC
+	// +kubebuilder:validation:Optional
+	OidcEnabled *bool `json:"oidcEnabled,omitempty" tf:"oidc_enabled,omitempty"`
+
+	// JWT claim to use as the user's group.
+	// JWT claim to use as the user's group.
+	// +kubebuilder:validation:Optional
+	OidcGroupsClaim *string `json:"oidcGroupsClaim,omitempty" tf:"oidc_groups_claim,omitempty"`
+
+	// Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+	// Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+	// +kubebuilder:validation:Optional
+	OidcGroupsPrefix *string `json:"oidcGroupsPrefix,omitempty" tf:"oidc_groups_prefix,omitempty"`
+
+	// URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+	// URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+	// +kubebuilder:validation:Optional
+	OidcIssuerURL *string `json:"oidcIssuerUrl,omitempty" tf:"oidc_issuer_url,omitempty"`
+
+	// A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2.
+	// A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2
+	// +kubebuilder:validation:Optional
+	OidcRequiredClaim *string `json:"oidcRequiredClaim,omitempty" tf:"oidc_required_claim,omitempty"`
+
+	// The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+	// The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+	// +kubebuilder:validation:Optional
+	OidcSigningAlgs *string `json:"oidcSigningAlgs,omitempty" tf:"oidc_signing_algs,omitempty"`
+
+	// JWT claim to use as the user name.
+	// JWT claim to use as the user name.
+	// +kubebuilder:validation:Optional
+	OidcUsernameClaim *string `json:"oidcUsernameClaim,omitempty" tf:"oidc_username_claim,omitempty"`
+
+	// Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+	// Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+	// +kubebuilder:validation:Optional
+	OidcUsernamePrefix *string `json:"oidcUsernamePrefix,omitempty" tf:"oidc_username_prefix,omitempty"`
+
+	// The Kubernetes release of this instance. Define which release will be used to create the cluster. For convenience, please use gscloud to get the list of available releases. NOTE: Either gsk_version or release is set at a time.
+	// The k8s release of this instance.
+	// +kubebuilder:validation:Optional
+	Release *string `json:"release,omitempty" tf:"release,omitempty"`
+
+	// DEPRECATED  Security zone UUID linked to the Kubernetes resource. If security_zone_uuid is not set, the default security zone will be created (if it doesn't exist) and linked. A change of this argument necessitates the re-creation of the resource.
+	// Security zone UUID linked to PaaS service.
+	// +kubebuilder:validation:Optional
+	SecurityZoneUUID *string `json:"securityZoneUuid,omitempty" tf:"security_zone_uuid,omitempty"`
+}
+
+type ListenPortInitParameters struct {
+}
+
+type ListenPortObservation struct {
+
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	Name *string `json:"name,omitempty" tf:"name,omitempty"`
+
+	Port *float64 `json:"port,omitempty" tf:"port,omitempty"`
+}
+
+type ListenPortParameters struct {
+}
+
+type NodePoolInitParameters struct {
+
+	// (Immutable) The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If the cluster CIDR is not set, the cluster will use "10.244.0.0/16" as it default (even though the cluster_cidr in the k8s resource is empty).
+	// The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If this field is empty, the default value is "10.244.0.0/16"
+	ClusterCidr *string `json:"clusterCidr,omitempty" tf:"cluster_cidr,omitempty"`
+
+	// Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+	// Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+	ClusterTrafficEncryption *bool `json:"clusterTrafficEncryption,omitempty" tf:"cluster_traffic_encryption,omitempty"`
+
+	// Cores per worker node.
+	// Cores per worker node.
+	Cores *float64 `json:"cores,omitempty" tf:"cores,omitempty"`
+
+	// Memory per worker node (in GiB).
+	// Memory per worker node (in GiB).
+	Memory *float64 `json:"memory,omitempty" tf:"memory,omitempty"`
+
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	// Name of node pool.
+	Name *string `json:"name,omitempty" tf:"name,omitempty"`
+
+	// Number of worker nodes.
+	// Number of worker nodes.
+	NodeCount *float64 `json:"nodeCount,omitempty" tf:"node_count,omitempty"`
+
+	// Rocket storage per worker node (in GiB).
+	// Rocket storage per worker node (in GiB).
+	RocketStorage *float64 `json:"rocketStorage,omitempty" tf:"rocket_storage,omitempty"`
+
+	// Storage per worker node (in GiB).
+	// Storage per worker node (in GiB).
+	Storage *float64 `json:"storage,omitempty" tf:"storage,omitempty"`
+
+	// Storage type (one of storage, storage_high, storage_insane).
+	// Storage type.
+	StorageType *string `json:"storageType,omitempty" tf:"storage_type,omitempty"`
+
+	// Enable surge node to avoid resources shortage during the cluster upgrade (Default: true).
+	// Enable surge node to avoid resources shortage during the cluster upgrade.
+	SurgeNode *bool `json:"surgeNode,omitempty" tf:"surge_node,omitempty"`
+}
+
+type NodePoolObservation struct {
+
+	// (Immutable) The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If the cluster CIDR is not set, the cluster will use "10.244.0.0/16" as it default (even though the cluster_cidr in the k8s resource is empty).
+	// The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If this field is empty, the default value is "10.244.0.0/16"
+	ClusterCidr *string `json:"clusterCidr,omitempty" tf:"cluster_cidr,omitempty"`
+
+	// Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+	// Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+	ClusterTrafficEncryption *bool `json:"clusterTrafficEncryption,omitempty" tf:"cluster_traffic_encryption,omitempty"`
+
+	// Cores per worker node.
+	// Cores per worker node.
+	Cores *float64 `json:"cores,omitempty" tf:"cores,omitempty"`
+
+	// Memory per worker node (in GiB).
+	// Memory per worker node (in GiB).
+	Memory *float64 `json:"memory,omitempty" tf:"memory,omitempty"`
+
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	// Name of node pool.
+	Name *string `json:"name,omitempty" tf:"name,omitempty"`
+
+	// Number of worker nodes.
+	// Number of worker nodes.
+	NodeCount *float64 `json:"nodeCount,omitempty" tf:"node_count,omitempty"`
+
+	// Rocket storage per worker node (in GiB).
+	// Rocket storage per worker node (in GiB).
+	RocketStorage *float64 `json:"rocketStorage,omitempty" tf:"rocket_storage,omitempty"`
+
+	// Storage per worker node (in GiB).
+	// Storage per worker node (in GiB).
+	Storage *float64 `json:"storage,omitempty" tf:"storage,omitempty"`
+
+	// Storage type (one of storage, storage_high, storage_insane).
+	// Storage type.
+	StorageType *string `json:"storageType,omitempty" tf:"storage_type,omitempty"`
+
+	// Enable surge node to avoid resources shortage during the cluster upgrade (Default: true).
+	// Enable surge node to avoid resources shortage during the cluster upgrade.
+	SurgeNode *bool `json:"surgeNode,omitempty" tf:"surge_node,omitempty"`
+}
+
+type NodePoolParameters struct {
+
+	// (Immutable) The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If the cluster CIDR is not set, the cluster will use "10.244.0.0/16" as it default (even though the cluster_cidr in the k8s resource is empty).
+	// The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If this field is empty, the default value is "10.244.0.0/16"
+	// +kubebuilder:validation:Optional
+	ClusterCidr *string `json:"clusterCidr,omitempty" tf:"cluster_cidr,omitempty"`
+
+	// Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+	// Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+	// +kubebuilder:validation:Optional
+	ClusterTrafficEncryption *bool `json:"clusterTrafficEncryption,omitempty" tf:"cluster_traffic_encryption,omitempty"`
+
+	// Cores per worker node.
+	// Cores per worker node.
+	// +kubebuilder:validation:Optional
+	Cores *float64 `json:"cores" tf:"cores,omitempty"`
+
+	// Memory per worker node (in GiB).
+	// Memory per worker node (in GiB).
+	// +kubebuilder:validation:Optional
+	Memory *float64 `json:"memory" tf:"memory,omitempty"`
+
+	// The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+	// Name of node pool.
+	// +kubebuilder:validation:Optional
+	Name *string `json:"name" tf:"name,omitempty"`
+
+	// Number of worker nodes.
+	// Number of worker nodes.
+	// +kubebuilder:validation:Optional
+	NodeCount *float64 `json:"nodeCount" tf:"node_count,omitempty"`
+
+	// Rocket storage per worker node (in GiB).
+	// Rocket storage per worker node (in GiB).
+	// +kubebuilder:validation:Optional
+	RocketStorage *float64 `json:"rocketStorage,omitempty" tf:"rocket_storage,omitempty"`
+
+	// Storage per worker node (in GiB).
+	// Storage per worker node (in GiB).
+	// +kubebuilder:validation:Optional
+	Storage *float64 `json:"storage" tf:"storage,omitempty"`
+
+	// Storage type (one of storage, storage_high, storage_insane).
+	// Storage type.
+	// +kubebuilder:validation:Optional
+	StorageType *string `json:"storageType" tf:"storage_type,omitempty"`
+
+	// Enable surge node to avoid resources shortage during the cluster upgrade (Default: true).
+	// Enable surge node to avoid resources shortage during the cluster upgrade.
+	// +kubebuilder:validation:Optional
+	SurgeNode *bool `json:"surgeNode,omitempty" tf:"surge_node,omitempty"`
+}
+
+// K8SSpec defines the desired state of K8S
+type K8SSpec struct {
+	v1.ResourceSpec `json:",inline"`
+	ForProvider     K8SParameters `json:"forProvider"`
+	// THIS IS A BETA FIELD. It will be honored
+	// unless the Management Policies feature flag is disabled.
+	// InitProvider holds the same fields as ForProvider, with the exception
+	// of Identifier and other resource reference fields. The fields that are
+	// in InitProvider are merged into ForProvider when the resource is created.
+	// The same fields are also added to the terraform ignore_changes hook, to
+	// avoid updating them after creation. This is useful for fields that are
+	// required on creation, but we do not desire to update them after creation,
+	// for example because of an external controller is managing them, like an
+	// autoscaler.
+	InitProvider K8SInitParameters `json:"initProvider,omitempty"`
+}
+
+// K8SStatus defines the observed state of K8S.
+type K8SStatus struct {
+	v1.ResourceStatus `json:",inline"`
+	AtProvider        K8SObservation `json:"atProvider,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+
+// K8S is the Schema for the K8Ss API. Manages a k8s cluster in gridscale.
+// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
+// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
+// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
+// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:resource:scope=Cluster,categories={crossplane,managed,gridscale}
+type K8S struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.name) || (has(self.initProvider) && has(self.initProvider.name))",message="spec.forProvider.name is a required parameter"
+	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.nodePool) || (has(self.initProvider) && has(self.initProvider.nodePool))",message="spec.forProvider.nodePool is a required parameter"
+	Spec   K8SSpec   `json:"spec"`
+	Status K8SStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// K8SList contains a list of K8Ss
+type K8SList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []K8S `json:"items"`
+}
+
+// Repository type metadata.
+var (
+	K8S_Kind             = "K8S"
+	K8S_GroupKind        = schema.GroupKind{Group: CRDGroup, Kind: K8S_Kind}.String()
+	K8S_KindAPIVersion   = K8S_Kind + "." + CRDGroupVersion.String()
+	K8S_GroupVersionKind = CRDGroupVersion.WithKind(K8S_Kind)
+)
+
+func init() {
+	SchemeBuilder.Register(&K8S{}, &K8SList{})
+}
diff --git a/config/compute/config.go b/config/compute/config.go
new file mode 100644
index 0000000..60ee363
--- /dev/null
+++ b/config/compute/config.go
@@ -0,0 +1,10 @@
+package compute
+
+import (
+	"github.com/crossplane/upjet/pkg/config"
+)
+
+// Configure configures individual resources by adding custom ResourceConfigurators.
+func Configure(p *config.Provider) {
+	p.AddResourceConfigurator("gridscale_k8s", func(r *config.Resource) {})
+}
diff --git a/config/external_name.go b/config/external_name.go
index 2be6d2c..f32fddd 100644
--- a/config/external_name.go
+++ b/config/external_name.go
@@ -14,6 +14,9 @@ var ExternalNameConfigs = map[string]config.ExternalName{
 	"gridscale_ipv6":    config.IdentifierFromProvider,
 	"gridscale_network": config.IdentifierFromProvider,
 	"gridscale_sshkey":  config.IdentifierFromProvider,
+
+	// Compute
+	"gridscale_k8s": config.IdentifierFromProvider,
 }
 
 // ExternalNameConfigurations applies all external name configs listed in the
diff --git a/config/provider.go b/config/provider.go
index 1f22388..cd4ca4e 100644
--- a/config/provider.go
+++ b/config/provider.go
@@ -10,6 +10,7 @@ import (
 
 	ujconfig "github.com/crossplane/upjet/pkg/config"
 
+	"github.com/dNationCloud/provider-gridscale/config/compute"
 	"github.com/dNationCloud/provider-gridscale/config/networking"
 )
 
@@ -37,6 +38,7 @@ func GetProvider() *ujconfig.Provider {
 	for _, configure := range []func(provider *ujconfig.Provider){
 		// add custom config functions
 		networking.Configure,
+		compute.Configure,
 	} {
 		configure(pc)
 	}
diff --git a/examples-generated/gridscale/v1alpha1/k8s.yaml b/examples-generated/gridscale/v1alpha1/k8s.yaml
new file mode 100644
index 0000000..4f69e33
--- /dev/null
+++ b/examples-generated/gridscale/v1alpha1/k8s.yaml
@@ -0,0 +1,20 @@
+apiVersion: gridscale.crossplane.io/v1alpha1
+kind: K8S
+metadata:
+  annotations:
+    meta.upbound.io/example-id: gridscale/v1alpha1/k8s
+  labels:
+    testing.upbound.io/example-name: k8s-test
+  name: k8s-test
+spec:
+  forProvider:
+    name: test
+    nodePool:
+    - cores: 1
+      memory: 2
+      name: my_node_pool
+      nodeCount: 2
+      rocketStorage: 90
+      storage: 10
+      storageType: storage_insane
+    release: "1.26"
diff --git a/examples/compute/k8s.yaml b/examples/compute/k8s.yaml
new file mode 100644
index 0000000..71f9694
--- /dev/null
+++ b/examples/compute/k8s.yaml
@@ -0,0 +1,21 @@
+apiVersion: gridscale.crossplane.io/v1alpha1
+kind: K8S
+metadata:
+  name: k8s-test
+spec:
+  forProvider:
+    name: test
+    nodePool:
+    - cores: 1
+      memory: 2
+      name: my_node_pool
+      nodeCount: 2
+      # rocketStorage: 70
+      storage: 30
+      storageType: storage_insane
+    release: "1.27"
+  providerConfigRef:
+    name: default
+  writeConnectionSecretToRef: # kubectl --kubeconfig <(kubectl get secret -n crossplane-system k8s-test-kubeconfig -ojsonpath='{.data.attribute\.kubeconfig}' | base64 -d) get no -owide
+    name: k8s-test-kubeconfig
+    namespace: crossplane-system
diff --git a/internal/controller/gridscale/k8s/zz_controller.go b/internal/controller/gridscale/k8s/zz_controller.go
new file mode 100755
index 0000000..10bbdb5
--- /dev/null
+++ b/internal/controller/gridscale/k8s/zz_controller.go
@@ -0,0 +1,87 @@
+// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by upjet. DO NOT EDIT.
+
+package k8s
+
+import (
+	"time"
+
+	"github.com/crossplane/crossplane-runtime/pkg/connection"
+	"github.com/crossplane/crossplane-runtime/pkg/event"
+	"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
+	"github.com/crossplane/crossplane-runtime/pkg/reconciler/managed"
+	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
+	"github.com/crossplane/crossplane-runtime/pkg/statemetrics"
+	tjcontroller "github.com/crossplane/upjet/pkg/controller"
+	"github.com/crossplane/upjet/pkg/controller/handler"
+	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/pkg/errors"
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	v1alpha1 "github.com/dNationCloud/provider-gridscale/apis/gridscale/v1alpha1"
+	features "github.com/dNationCloud/provider-gridscale/internal/features"
+)
+
+// Setup adds a controller that reconciles K8S managed resources.
+func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
+	name := managed.ControllerName(v1alpha1.K8S_GroupVersionKind.String())
+	var initializers managed.InitializerChain
+	cps := []managed.ConnectionPublisher{managed.NewAPISecretPublisher(mgr.GetClient(), mgr.GetScheme())}
+	if o.SecretStoreConfigGVK != nil {
+		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
+	}
+	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1alpha1.K8S_GroupVersionKind)))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1alpha1.K8S_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	opts := []managed.ReconcilerOption{
+		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["gridscale_k8s"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
+			tjcontroller.WithCallbackProvider(ac),
+		)),
+		managed.WithLogger(o.Logger.WithValues("controller", name)),
+		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
+		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithTimeout(3 * time.Minute),
+		managed.WithInitializers(initializers),
+		managed.WithConnectionPublishers(cps...),
+		managed.WithPollInterval(o.PollInterval),
+	}
+	if o.PollJitter != 0 {
+		opts = append(opts, managed.WithPollJitterHook(o.PollJitter))
+	}
+	if o.Features.Enabled(features.EnableBetaManagementPolicies) {
+		opts = append(opts, managed.WithManagementPolicies())
+	}
+	if o.MetricOptions != nil {
+		opts = append(opts, managed.WithMetricRecorder(o.MetricOptions.MRMetrics))
+	}
+
+	// register webhooks for the kind v1alpha1.K8S
+	// if they're enabled.
+	if o.StartWebhooks {
+		if err := ctrl.NewWebhookManagedBy(mgr).
+			For(&v1alpha1.K8S{}).
+			Complete(); err != nil {
+			return errors.Wrap(err, "cannot register webhook for the kind v1alpha1.K8S")
+		}
+	}
+
+	if o.MetricOptions != nil && o.MetricOptions.MRStateMetrics != nil {
+		stateMetricsRecorder := statemetrics.NewMRStateRecorder(
+			mgr.GetClient(), o.Logger, o.MetricOptions.MRStateMetrics, &v1alpha1.K8SList{}, o.MetricOptions.PollStateMetricInterval,
+		)
+		if err := mgr.Add(stateMetricsRecorder); err != nil {
+			return errors.Wrap(err, "cannot register MR state metrics recorder for kind v1alpha1.K8SList")
+		}
+	}
+
+	r := managed.NewReconciler(mgr, xpresource.ManagedKind(v1alpha1.K8S_GroupVersionKind), opts...)
+
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(name).
+		WithOptions(o.ForControllerRuntime()).
+		WithEventFilter(xpresource.DesiredStateChanged()).
+		Watches(&v1alpha1.K8S{}, eventHandler).
+		Complete(ratelimiter.NewReconciler(name, r, o.GlobalRateLimiter))
+}
diff --git a/internal/controller/zz_setup.go b/internal/controller/zz_setup.go
index de8162b..0c69d67 100755
--- a/internal/controller/zz_setup.go
+++ b/internal/controller/zz_setup.go
@@ -11,6 +11,7 @@ import (
 
 	ipv4 "github.com/dNationCloud/provider-gridscale/internal/controller/gridscale/ipv4"
 	ipv6 "github.com/dNationCloud/provider-gridscale/internal/controller/gridscale/ipv6"
+	k8s "github.com/dNationCloud/provider-gridscale/internal/controller/gridscale/k8s"
 	network "github.com/dNationCloud/provider-gridscale/internal/controller/gridscale/network"
 	sshkey "github.com/dNationCloud/provider-gridscale/internal/controller/gridscale/sshkey"
 	providerconfig "github.com/dNationCloud/provider-gridscale/internal/controller/providerconfig"
@@ -22,6 +23,7 @@ func Setup(mgr ctrl.Manager, o controller.Options) error {
 	for _, setup := range []func(ctrl.Manager, controller.Options) error{
 		ipv4.Setup,
 		ipv6.Setup,
+		k8s.Setup,
 		network.Setup,
 		sshkey.Setup,
 		providerconfig.Setup,
diff --git a/package/crds/gridscale.crossplane.io_k8ses.yaml b/package/crds/gridscale.crossplane.io_k8ses.yaml
new file mode 100644
index 0000000..6f5fa33
--- /dev/null
+++ b/package/crds/gridscale.crossplane.io_k8ses.yaml
@@ -0,0 +1,790 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  name: k8ses.gridscale.crossplane.io
+spec:
+  group: gridscale.crossplane.io
+  names:
+    categories:
+    - crossplane
+    - managed
+    - gridscale
+    kind: K8S
+    listKind: K8SList
+    plural: k8ses
+    singular: k8s
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=='Synced')].status
+      name: SYNCED
+      type: string
+    - jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: READY
+      type: string
+    - jsonPath: .metadata.annotations.crossplane\.io/external-name
+      name: EXTERNAL-NAME
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: AGE
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: K8S is the Schema for the K8Ss API. Manages a k8s cluster in
+          gridscale.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: K8SSpec defines the desired state of K8S
+            properties:
+              deletionPolicy:
+                default: Delete
+                description: |-
+                  DeletionPolicy specifies what will happen to the underlying external
+                  when this managed resource is deleted - either "Delete" or "Orphan" the
+                  external resource.
+                  This field is planned to be deprecated in favor of the ManagementPolicies
+                  field in a future release. Currently, both could be set independently and
+                  non-default values would be honored if the feature flag is enabled.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                enum:
+                - Orphan
+                - Delete
+                type: string
+              forProvider:
+                properties:
+                  gskVersion:
+                    description: |-
+                      The gridscale's Kubernetes version of this instance (e.g. "1.21.14-gs1"). Define which gridscale k8s version will be used to create the cluster. For convenience, please use gscloud to get the list of available gridscale k8s version. NOTE: Either gsk_version or release is set at a time.
+                      The gridscale k8s PaaS version (issued by gridscale) of this instance.
+                    type: string
+                  labels:
+                    description: |-
+                      List of labels in the format [ "label1", "label2" ].
+                      List of labels.
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: set
+                  name:
+                    description: |-
+                      The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                      The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                    type: string
+                  nodePool:
+                    description: |-
+                      Node pool's specification. NOTE: The node pool's specification is not yet mutable (except node_count).
+                      Node pool's specification.
+                    items:
+                      properties:
+                        clusterCidr:
+                          description: |-
+                            (Immutable) The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If the cluster CIDR is not set, the cluster will use "10.244.0.0/16" as it default (even though the cluster_cidr in the k8s resource is empty).
+                            The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If this field is empty, the default value is "10.244.0.0/16"
+                          type: string
+                        clusterTrafficEncryption:
+                          description: |-
+                            Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+                            Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+                          type: boolean
+                        cores:
+                          description: |-
+                            Cores per worker node.
+                            Cores per worker node.
+                          type: number
+                        memory:
+                          description: |-
+                            Memory per worker node (in GiB).
+                            Memory per worker node (in GiB).
+                          type: number
+                        name:
+                          description: |-
+                            The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                            Name of node pool.
+                          type: string
+                        nodeCount:
+                          description: |-
+                            Number of worker nodes.
+                            Number of worker nodes.
+                          type: number
+                        rocketStorage:
+                          description: |-
+                            Rocket storage per worker node (in GiB).
+                            Rocket storage per worker node (in GiB).
+                          type: number
+                        storage:
+                          description: |-
+                            Storage per worker node (in GiB).
+                            Storage per worker node (in GiB).
+                          type: number
+                        storageType:
+                          description: |-
+                            Storage type (one of storage, storage_high, storage_insane).
+                            Storage type.
+                          type: string
+                        surgeNode:
+                          description: |-
+                            Enable surge node to avoid resources shortage during the cluster upgrade (Default: true).
+                            Enable surge node to avoid resources shortage during the cluster upgrade.
+                          type: boolean
+                      type: object
+                    type: array
+                  oidcCaPem:
+                    description: |-
+                      Custom CA from customer in pem format as string.
+                      Custom CA from customer in pem format as string.
+                    type: string
+                  oidcClientId:
+                    description: |-
+                      A client ID that all tokens must be issued for.
+                      A client ID that all tokens must be issued for.
+                    type: string
+                  oidcEnabled:
+                    description: |-
+                      Enable OIDC for the k8s cluster.
+                      Disable or enable OIDC
+                    type: boolean
+                  oidcGroupsClaim:
+                    description: |-
+                      JWT claim to use as the user's group.
+                      JWT claim to use as the user's group.
+                    type: string
+                  oidcGroupsPrefix:
+                    description: |-
+                      Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+                      Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+                    type: string
+                  oidcIssuerUrl:
+                    description: |-
+                      URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+                      URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+                    type: string
+                  oidcRequiredClaim:
+                    description: |-
+                      A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2.
+                      A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2
+                    type: string
+                  oidcSigningAlgs:
+                    description: |-
+                      The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+                      The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+                    type: string
+                  oidcUsernameClaim:
+                    description: |-
+                      JWT claim to use as the user name.
+                      JWT claim to use as the user name.
+                    type: string
+                  oidcUsernamePrefix:
+                    description: |-
+                      Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+                      Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+                    type: string
+                  release:
+                    description: |-
+                      The Kubernetes release of this instance. Define which release will be used to create the cluster. For convenience, please use gscloud to get the list of available releases. NOTE: Either gsk_version or release is set at a time.
+                      The k8s release of this instance.
+                    type: string
+                  securityZoneUuid:
+                    description: |-
+                      DEPRECATED  Security zone UUID linked to the Kubernetes resource. If security_zone_uuid is not set, the default security zone will be created (if it doesn't exist) and linked. A change of this argument necessitates the re-creation of the resource.
+                      Security zone UUID linked to PaaS service.
+                    type: string
+                type: object
+              initProvider:
+                description: |-
+                  THIS IS A BETA FIELD. It will be honored
+                  unless the Management Policies feature flag is disabled.
+                  InitProvider holds the same fields as ForProvider, with the exception
+                  of Identifier and other resource reference fields. The fields that are
+                  in InitProvider are merged into ForProvider when the resource is created.
+                  The same fields are also added to the terraform ignore_changes hook, to
+                  avoid updating them after creation. This is useful for fields that are
+                  required on creation, but we do not desire to update them after creation,
+                  for example because of an external controller is managing them, like an
+                  autoscaler.
+                properties:
+                  gskVersion:
+                    description: |-
+                      The gridscale's Kubernetes version of this instance (e.g. "1.21.14-gs1"). Define which gridscale k8s version will be used to create the cluster. For convenience, please use gscloud to get the list of available gridscale k8s version. NOTE: Either gsk_version or release is set at a time.
+                      The gridscale k8s PaaS version (issued by gridscale) of this instance.
+                    type: string
+                  labels:
+                    description: |-
+                      List of labels in the format [ "label1", "label2" ].
+                      List of labels.
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: set
+                  name:
+                    description: |-
+                      The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                      The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                    type: string
+                  nodePool:
+                    description: |-
+                      Node pool's specification. NOTE: The node pool's specification is not yet mutable (except node_count).
+                      Node pool's specification.
+                    items:
+                      properties:
+                        clusterCidr:
+                          description: |-
+                            (Immutable) The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If the cluster CIDR is not set, the cluster will use "10.244.0.0/16" as it default (even though the cluster_cidr in the k8s resource is empty).
+                            The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If this field is empty, the default value is "10.244.0.0/16"
+                          type: string
+                        clusterTrafficEncryption:
+                          description: |-
+                            Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+                            Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+                          type: boolean
+                        cores:
+                          description: |-
+                            Cores per worker node.
+                            Cores per worker node.
+                          type: number
+                        memory:
+                          description: |-
+                            Memory per worker node (in GiB).
+                            Memory per worker node (in GiB).
+                          type: number
+                        name:
+                          description: |-
+                            The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                            Name of node pool.
+                          type: string
+                        nodeCount:
+                          description: |-
+                            Number of worker nodes.
+                            Number of worker nodes.
+                          type: number
+                        rocketStorage:
+                          description: |-
+                            Rocket storage per worker node (in GiB).
+                            Rocket storage per worker node (in GiB).
+                          type: number
+                        storage:
+                          description: |-
+                            Storage per worker node (in GiB).
+                            Storage per worker node (in GiB).
+                          type: number
+                        storageType:
+                          description: |-
+                            Storage type (one of storage, storage_high, storage_insane).
+                            Storage type.
+                          type: string
+                        surgeNode:
+                          description: |-
+                            Enable surge node to avoid resources shortage during the cluster upgrade (Default: true).
+                            Enable surge node to avoid resources shortage during the cluster upgrade.
+                          type: boolean
+                      type: object
+                    type: array
+                  oidcCaPem:
+                    description: |-
+                      Custom CA from customer in pem format as string.
+                      Custom CA from customer in pem format as string.
+                    type: string
+                  oidcClientId:
+                    description: |-
+                      A client ID that all tokens must be issued for.
+                      A client ID that all tokens must be issued for.
+                    type: string
+                  oidcEnabled:
+                    description: |-
+                      Enable OIDC for the k8s cluster.
+                      Disable or enable OIDC
+                    type: boolean
+                  oidcGroupsClaim:
+                    description: |-
+                      JWT claim to use as the user's group.
+                      JWT claim to use as the user's group.
+                    type: string
+                  oidcGroupsPrefix:
+                    description: |-
+                      Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+                      Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+                    type: string
+                  oidcIssuerUrl:
+                    description: |-
+                      URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+                      URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+                    type: string
+                  oidcRequiredClaim:
+                    description: |-
+                      A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2.
+                      A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2
+                    type: string
+                  oidcSigningAlgs:
+                    description: |-
+                      The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+                      The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+                    type: string
+                  oidcUsernameClaim:
+                    description: |-
+                      JWT claim to use as the user name.
+                      JWT claim to use as the user name.
+                    type: string
+                  oidcUsernamePrefix:
+                    description: |-
+                      Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+                      Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+                    type: string
+                  release:
+                    description: |-
+                      The Kubernetes release of this instance. Define which release will be used to create the cluster. For convenience, please use gscloud to get the list of available releases. NOTE: Either gsk_version or release is set at a time.
+                      The k8s release of this instance.
+                    type: string
+                  securityZoneUuid:
+                    description: |-
+                      DEPRECATED  Security zone UUID linked to the Kubernetes resource. If security_zone_uuid is not set, the default security zone will be created (if it doesn't exist) and linked. A change of this argument necessitates the re-creation of the resource.
+                      Security zone UUID linked to PaaS service.
+                    type: string
+                type: object
+              managementPolicies:
+                default:
+                - '*'
+                description: |-
+                  THIS IS A BETA FIELD. It is on by default but can be opted out
+                  through a Crossplane feature flag.
+                  ManagementPolicies specify the array of actions Crossplane is allowed to
+                  take on the managed and external resources.
+                  This field is planned to replace the DeletionPolicy field in a future
+                  release. Currently, both could be set independently and non-default
+                  values would be honored if the feature flag is enabled. If both are
+                  custom, the DeletionPolicy field will be ignored.
+                  See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
+                  and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
+                items:
+                  description: |-
+                    A ManagementAction represents an action that the Crossplane controllers
+                    can take on an external resource.
+                  enum:
+                  - Observe
+                  - Create
+                  - Update
+                  - Delete
+                  - LateInitialize
+                  - '*'
+                  type: string
+                type: array
+              providerConfigRef:
+                default:
+                  name: default
+                description: |-
+                  ProviderConfigReference specifies how the provider that will be used to
+                  create, observe, update, and delete this managed resource should be
+                  configured.
+                properties:
+                  name:
+                    description: Name of the referenced object.
+                    type: string
+                  policy:
+                    description: Policies for referencing.
+                    properties:
+                      resolution:
+                        default: Required
+                        description: |-
+                          Resolution specifies whether resolution of this reference is required.
+                          The default is 'Required', which means the reconcile will fail if the
+                          reference cannot be resolved. 'Optional' means this reference will be
+                          a no-op if it cannot be resolved.
+                        enum:
+                        - Required
+                        - Optional
+                        type: string
+                      resolve:
+                        description: |-
+                          Resolve specifies when this reference should be resolved. The default
+                          is 'IfNotPresent', which will attempt to resolve the reference only when
+                          the corresponding field is not present. Use 'Always' to resolve the
+                          reference on every reconcile.
+                        enum:
+                        - Always
+                        - IfNotPresent
+                        type: string
+                    type: object
+                required:
+                - name
+                type: object
+              publishConnectionDetailsTo:
+                description: |-
+                  PublishConnectionDetailsTo specifies the connection secret config which
+                  contains a name, metadata and a reference to secret store config to
+                  which any connection details for this managed resource should be written.
+                  Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                properties:
+                  configRef:
+                    default:
+                      name: default
+                    description: |-
+                      SecretStoreConfigRef specifies which secret store config should be used
+                      for this ConnectionSecret.
+                    properties:
+                      name:
+                        description: Name of the referenced object.
+                        type: string
+                      policy:
+                        description: Policies for referencing.
+                        properties:
+                          resolution:
+                            default: Required
+                            description: |-
+                              Resolution specifies whether resolution of this reference is required.
+                              The default is 'Required', which means the reconcile will fail if the
+                              reference cannot be resolved. 'Optional' means this reference will be
+                              a no-op if it cannot be resolved.
+                            enum:
+                            - Required
+                            - Optional
+                            type: string
+                          resolve:
+                            description: |-
+                              Resolve specifies when this reference should be resolved. The default
+                              is 'IfNotPresent', which will attempt to resolve the reference only when
+                              the corresponding field is not present. Use 'Always' to resolve the
+                              reference on every reconcile.
+                            enum:
+                            - Always
+                            - IfNotPresent
+                            type: string
+                        type: object
+                    required:
+                    - name
+                    type: object
+                  metadata:
+                    description: Metadata is the metadata for connection secret.
+                    properties:
+                      annotations:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Annotations are the annotations to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.annotations".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      labels:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          Labels are the labels/tags to be added to connection secret.
+                          - For Kubernetes secrets, this will be used as "metadata.labels".
+                          - It is up to Secret Store implementation for others store types.
+                        type: object
+                      type:
+                        description: |-
+                          Type is the SecretType for the connection secret.
+                          - Only valid for Kubernetes Secret Stores.
+                        type: string
+                    type: object
+                  name:
+                    description: Name is the name of the connection secret.
+                    type: string
+                required:
+                - name
+                type: object
+              writeConnectionSecretToRef:
+                description: |-
+                  WriteConnectionSecretToReference specifies the namespace and name of a
+                  Secret to which any connection details for this managed resource should
+                  be written. Connection details frequently include the endpoint, username,
+                  and password required to connect to the managed resource.
+                  This field is planned to be replaced in a future release in favor of
+                  PublishConnectionDetailsTo. Currently, both could be set independently
+                  and connection details would be published to both without affecting
+                  each other.
+                properties:
+                  name:
+                    description: Name of the secret.
+                    type: string
+                  namespace:
+                    description: Namespace of the secret.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
+            required:
+            - forProvider
+            type: object
+            x-kubernetes-validations:
+            - message: spec.forProvider.name is a required parameter
+              rule: '!(''*'' in self.managementPolicies || ''Create'' in self.managementPolicies
+                || ''Update'' in self.managementPolicies) || has(self.forProvider.name)
+                || (has(self.initProvider) && has(self.initProvider.name))'
+            - message: spec.forProvider.nodePool is a required parameter
+              rule: '!(''*'' in self.managementPolicies || ''Create'' in self.managementPolicies
+                || ''Update'' in self.managementPolicies) || has(self.forProvider.nodePool)
+                || (has(self.initProvider) && has(self.initProvider.nodePool))'
+          status:
+            description: K8SStatus defines the observed state of K8S.
+            properties:
+              atProvider:
+                properties:
+                  changeTime:
+                    description: |-
+                      Defines the date and time of the last object change.
+                      Time of the last change
+                    type: string
+                  createTime:
+                    description: |-
+                      The time the object was created.
+                      Time this service was created.
+                    type: string
+                  gskVersion:
+                    description: |-
+                      The gridscale's Kubernetes version of this instance (e.g. "1.21.14-gs1"). Define which gridscale k8s version will be used to create the cluster. For convenience, please use gscloud to get the list of available gridscale k8s version. NOTE: Either gsk_version or release is set at a time.
+                      The gridscale k8s PaaS version (issued by gridscale) of this instance.
+                    type: string
+                  id:
+                    type: string
+                  k8sPrivateNetworkUuid:
+                    description: |-
+                      Private network UUID which k8s nodes are attached to. It can be used to attach other PaaS/VMs.
+                      Private network UUID which k8s nodes are attached to. It can be used to attach other PaaS/VMs.
+                    type: string
+                  labels:
+                    description: |-
+                      List of labels in the format [ "label1", "label2" ].
+                      List of labels.
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: set
+                  listenPort:
+                    description: The port number where this k8s service accepts connections.
+                    items:
+                      properties:
+                        name:
+                          description: The human-readable name of the object. It supports
+                            the full UTF-8 character set, with a maximum of 64 characters.
+                          type: string
+                        port:
+                          type: number
+                      type: object
+                    type: array
+                  name:
+                    description: |-
+                      The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                      The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                    type: string
+                  networkUuid:
+                    description: |-
+                      DEPRECATED  Network UUID containing security zone, which is linked to the k8s cluster.
+                      Network UUID containing security zone
+                    type: string
+                  nodePool:
+                    description: |-
+                      Node pool's specification. NOTE: The node pool's specification is not yet mutable (except node_count).
+                      Node pool's specification.
+                    items:
+                      properties:
+                        clusterCidr:
+                          description: |-
+                            (Immutable) The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If the cluster CIDR is not set, the cluster will use "10.244.0.0/16" as it default (even though the cluster_cidr in the k8s resource is empty).
+                            The cluster CIDR that will be used to generate the CIDR of nodes, services, and pods. The allowed CIDR prefix length is /16. If this field is empty, the default value is "10.244.0.0/16"
+                          type: string
+                        clusterTrafficEncryption:
+                          description: |-
+                            Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+                            Enables cluster encryption via wireguard if true. Only available for GSK version 1.29 and above. Default is false.
+                          type: boolean
+                        cores:
+                          description: |-
+                            Cores per worker node.
+                            Cores per worker node.
+                          type: number
+                        memory:
+                          description: |-
+                            Memory per worker node (in GiB).
+                            Memory per worker node (in GiB).
+                          type: number
+                        name:
+                          description: |-
+                            The human-readable name of the object. It supports the full UTF-8 character set, with a maximum of 64 characters.
+                            Name of node pool.
+                          type: string
+                        nodeCount:
+                          description: |-
+                            Number of worker nodes.
+                            Number of worker nodes.
+                          type: number
+                        rocketStorage:
+                          description: |-
+                            Rocket storage per worker node (in GiB).
+                            Rocket storage per worker node (in GiB).
+                          type: number
+                        storage:
+                          description: |-
+                            Storage per worker node (in GiB).
+                            Storage per worker node (in GiB).
+                          type: number
+                        storageType:
+                          description: |-
+                            Storage type (one of storage, storage_high, storage_insane).
+                            Storage type.
+                          type: string
+                        surgeNode:
+                          description: |-
+                            Enable surge node to avoid resources shortage during the cluster upgrade (Default: true).
+                            Enable surge node to avoid resources shortage during the cluster upgrade.
+                          type: boolean
+                      type: object
+                    type: array
+                  oidcCaPem:
+                    description: |-
+                      Custom CA from customer in pem format as string.
+                      Custom CA from customer in pem format as string.
+                    type: string
+                  oidcClientId:
+                    description: |-
+                      A client ID that all tokens must be issued for.
+                      A client ID that all tokens must be issued for.
+                    type: string
+                  oidcEnabled:
+                    description: |-
+                      Enable OIDC for the k8s cluster.
+                      Disable or enable OIDC
+                    type: boolean
+                  oidcGroupsClaim:
+                    description: |-
+                      JWT claim to use as the user's group.
+                      JWT claim to use as the user's group.
+                    type: string
+                  oidcGroupsPrefix:
+                    description: |-
+                      Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+                      Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
+                    type: string
+                  oidcIssuerUrl:
+                    description: |-
+                      URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+                      URL of the provider that allows the API server to discover public signing keys. Only URLs that use the https:// scheme are accepted.
+                    type: string
+                  oidcRequiredClaim:
+                    description: |-
+                      A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2.
+                      A key=value pair that describes a required claim in the ID Token. Multiple claims can be set like this: key1=value1,key2=value2
+                    type: string
+                  oidcSigningAlgs:
+                    description: |-
+                      The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+                      The signing algorithms accepted. Default is 'RS256'. Other option is 'RS512'.
+                    type: string
+                  oidcUsernameClaim:
+                    description: |-
+                      JWT claim to use as the user name.
+                      JWT claim to use as the user name.
+                    type: string
+                  oidcUsernamePrefix:
+                    description: |-
+                      Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+                      Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value - can be used to disable all prefixing.
+                    type: string
+                  release:
+                    description: |-
+                      The Kubernetes release of this instance. Define which release will be used to create the cluster. For convenience, please use gscloud to get the list of available releases. NOTE: Either gsk_version or release is set at a time.
+                      The k8s release of this instance.
+                    type: string
+                  securityZoneUuid:
+                    description: |-
+                      DEPRECATED  Security zone UUID linked to the Kubernetes resource. If security_zone_uuid is not set, the default security zone will be created (if it doesn't exist) and linked. A change of this argument necessitates the re-creation of the resource.
+                      Security zone UUID linked to PaaS service.
+                    type: string
+                  serviceTemplateUuid:
+                    description: |-
+                      PaaS service template that k8s service uses.g. the k8s service is upgraded by gridscale staffs).
+                      PaaS service template identifier for this service.
+                    type: string
+                  status:
+                    description: |-
+                      status indicates the status of the object.
+                      Current status of the service
+                    type: string
+                  usageInMinutes:
+                    description: |-
+                      The amount of minutes the IP address has been in use.
+                      Number of minutes that PaaS service is in use
+                    type: number
+                type: object
+              conditions:
+                description: Conditions of the resource.
+                items:
+                  description: A Condition that may apply to a resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        LastTransitionTime is the last time this condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        A Message containing details about this condition's last transition from
+                        one status to another, if any.
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        ObservedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: A Reason for this condition's last transition from
+                        one status to another.
+                      type: string
+                    status:
+                      description: Status of this condition; is it currently True,
+                        False, or Unknown?
+                      type: string
+                    type:
+                      description: |-
+                        Type of this condition. At most one of each condition type may apply to
+                        a resource at any point in time.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the latest metadata.generation
+                  which resulted in either a ready state, or stalled due to error
+                  it can not recover from without human intervention.
+                format: int64
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}