From 975b16d29f51768085eb317e30bd96b87c927e3c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Allamand?= Date: Mon, 18 Mar 2024 10:24:35 +0000 Subject: [PATCH 01/30] fix backstage secret creation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Sébastien Allamand --- terraform/scripts/backstage/install.sh | 2 +- terraform/scripts/backstage/output.yaml | 0 terraform/scripts/backstage/secret-integrations.yaml | 3 ++- 3 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 terraform/scripts/backstage/output.yaml diff --git a/terraform/scripts/backstage/install.sh b/terraform/scripts/backstage/install.sh index 49b23f38f..65ae0d3c0 100755 --- a/terraform/scripts/backstage/install.sh +++ b/terraform/scripts/backstage/install.sh @@ -7,7 +7,7 @@ export POSTGRES_PASSWORD=${1} export BACKSTAGE_DOMAIN_NAME=${2} export KEYCLOAK_DOMAIN_NAME=${3} export ARGO_WORKFLOWS_DOMAIN_NAME=${4} -export GITHUB_APP_YAML=$(cat ${REPO_ROOT}/private/github-integration.yaml | base64) +export GITHUB_APP_YAML_INDENTED=$(cat ${REPO_ROOT}/private/github-integration.yaml | base64 | sed 's/^/ /') kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/keycloak kubectl wait --for=condition=ready pod -l app=keycloak -n keycloak --timeout=30s diff --git a/terraform/scripts/backstage/output.yaml b/terraform/scripts/backstage/output.yaml new file mode 100644 index 000000000..e69de29bb diff --git a/terraform/scripts/backstage/secret-integrations.yaml b/terraform/scripts/backstage/secret-integrations.yaml index cff53847d..d192f1f98 100644 --- a/terraform/scripts/backstage/secret-integrations.yaml +++ b/terraform/scripts/backstage/secret-integrations.yaml @@ -4,4 +4,5 @@ metadata: name: integrations namespace: backstage data: - github-integration.yaml: ${GITHUB_APP_YAML} + github-integration.yaml: | +${GITHUB_APP_YAML_INDENTED} From 05b9c264005817d666469991d509452c2e5846a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Allamand?= Date: Tue, 19 Mar 2024 16:09:14 +0000 Subject: [PATCH 02/30] add configmap right for backstage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Sébastien Allamand --- packages/backstage/dev/sa-backstage.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/backstage/dev/sa-backstage.yaml b/packages/backstage/dev/sa-backstage.yaml index 02dc32706..63fbfe7e5 100644 --- a/packages/backstage/dev/sa-backstage.yaml +++ b/packages/backstage/dev/sa-backstage.yaml @@ -36,6 +36,9 @@ rules: - apiGroups: ["argoproj.io"] resources: ["workflows"] verbs: ["create"] +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["create"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding From 58c42d1e5c0022e5b98b0b448e9ac10b392cab8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Allamand?= Date: Tue, 19 Mar 2024 16:39:15 +0000 Subject: [PATCH 03/30] fix cnoe cli MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Sébastien Allamand --- demo.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/demo.md b/demo.md index d98a898e1..4bfe86704 100644 --- a/demo.md +++ b/demo.md @@ -9,7 +9,7 @@ For example, to generate input field from a terraform module in the Data on EKS ```bash git clone https://github.com/awslabs/data-on-eks.git /tmp/data-on-eks -cnoe-cli template tf -i /tmp/data-on-eks/analytics/terraform/spark-k8s-operator -o examples/template-generation -t examples/template-generation/data-on-eks.yaml -p '.spec.parameters[0].properties.tfVars +cnoe template tf -i /tmp/data-on-eks/analytics/terraform/spark-k8s-operator -o examples/template-generation -t examples/template-generation/data-on-eks.yaml -p '.spec.parameters[0].properties.tfVars' ``` The above command takes the terraform module available at `/tmp/data-on-eks/analytics/terraform/spark-k8s-operator` then inserts generated backstage fields into a partially configured template at `examples/template-generation/data-on-eks.yaml`. This partially configure template contains fields that are common to all modules in the Data on EKS repository. From f224e3f9e0e156dc422881d036e2cc483a1aab5e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Allamand?= Date: Tue, 26 Mar 2024 15:38:32 +0000 Subject: [PATCH 04/30] remove output.yaml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Sébastien Allamand --- terraform/scripts/backstage/output.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 terraform/scripts/backstage/output.yaml diff --git a/terraform/scripts/backstage/output.yaml b/terraform/scripts/backstage/output.yaml deleted file mode 100644 index e69de29bb..000000000 From 9c22c7829558451a7e240189cc3d86574e417dd2 Mon Sep 17 00:00:00 2001 From: Ela AWS <51791117+elamaran11@users.noreply.github.com> Date: Wed, 10 Apr 2024 12:39:31 -0400 Subject: [PATCH 05/30] Updating and Fixing EKS Cluster Config (#35) * Updating and Fixing EKS Cluster Config Signed-off-by: Elamaran Shanmugam --- eksctl.yaml | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/eksctl.yaml b/eksctl.yaml index 727937a7d..68d3b755c 100644 --- a/eksctl.yaml +++ b/eksctl.yaml @@ -3,7 +3,7 @@ kind: ClusterConfig metadata: name: cnoe-ref-impl region: us-west-2 - version: "1.27" + version: "1.28" managedNodeGroups: - name: managed-ng-1 instanceType: m5.large @@ -22,12 +22,6 @@ iam: withOIDC: true addons: - name: aws-ebs-csi-driver - version: "v1.20.0-eksbuild.1" + version: "v1.28.0-eksbuild.1" attachPolicyARNs: - - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy -# iamIdentityMappings: -# - arn: arn:aws:iam::000000000000:role/Admin -# groups: -# - system:masters -# username: admin -# noDuplicateARNs: true # prevents shadowing of ARNs \ No newline at end of file + - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \ No newline at end of file From c3a03f69f68c6fb1cf993387697701a9a1f12ae9 Mon Sep 17 00:00:00 2001 From: Ela AWS <51791117+elamaran11@users.noreply.github.com> Date: Thu, 11 Apr 2024 14:59:10 -0400 Subject: [PATCH 06/30] Fixing ReadMe Issues (#36) * Updating and Fixing EKS Cluster Config Signed-off-by: Elamaran Shanmugam --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 07bfbb710..89e43b3ec 100644 --- a/README.md +++ b/README.md @@ -119,7 +119,7 @@ Follow the following steps to get started. ```bash aws route53 list-hosted-zones-by-name --dns-name --query 'HostedZones[0].Id' --output text | cut -d'/' -f3 # in the setups/config file, update the zone id. - HOSTEDZONE_ID=ZO020111111 + hosted_zone_id:: ZO020111111 ``` 5. Update the [`setups/config`](setups/config.yaml) file with your own values. 6. Run `setups/install.sh` and follow the prompts. See the section below about monitoring installation progress. @@ -145,7 +145,7 @@ Go to [`http://localhost:8081`](http://localhost:8081) and login with the userna ### If you installed it without automatic DNS configuration. -If you set `MANAGED_DNS=false`, you are responsible for updating DNS records, thus external-dns is not installed. You have to set the following DNS records: +If you set `enable_dns_management: false`, you are responsible for updating DNS records, thus external-dns is not installed. You have to set the following DNS records: - `backstage.` - `keycloak.` - `argo.` From c6e7cb3737041dd0f01db76ba8bcc3d2e8efc819 Mon Sep 17 00:00:00 2001 From: Ela AWS <51791117+elamaran11@users.noreply.github.com> Date: Thu, 11 Apr 2024 20:48:55 -0400 Subject: [PATCH 07/30] Updating ReadMe for GitHub App Permissions (#38) * Updating and Fixing EKS Cluster Config Signed-off-by: Elamaran Shanmugam --- README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 89e43b3ec..15810b622 100644 --- a/README.md +++ b/README.md @@ -67,13 +67,19 @@ We strongly encourage you to create a **dedicated GitHub organization**. If you There are two ways to create GitHub integration with Backstage. You can use the Backstage CLI, or create it manually. See [this page](https://backstage.io/docs/integrations/github/github-apps) for more information on creating one manually. Once the app is created, place it under the private directory with the name `github-integration.yaml`. -To create one with the CLI, follow the steps below. +To create one with the CLI, follow the steps below. If you are using cli to create GitHub App, please make sure to select third option in the permissions prompt, if your GitHub App access needs publishing access to create GitHub repositories for your backstage templates. ```bash npx '@backstage/cli' create-github-app ${GITHUB_ORG_NAME} # If prompted, select all for permissions or select permissions listed in this page https://backstage.io/docs/integrations/github/github-apps#app-permissions # In the browser window, allow access to all repositories then install the app. +? Select permissions [required] (these can be changed later but then require approvals in all installations) (Press to select, to toggle all, to invert selection, +and to proceed) + ◉ Read access to content (required by Software Catalog to ingest data from repositories) + ◉ Read access to members (required by Software Catalog to ingest GitHub teams) +❯◯ Read and Write to content and actions (required by Software Templates to create new repositories) + # move it to a "private" location. mkdir -p private GITHUB_APP_FILE=$(ls github-app-* | head -n1) From c5f07481926d27ff93747a1a9d51ff1722e6ef41 Mon Sep 17 00:00:00 2001 From: "Elamaran (Ela) Shanmugam" <51791117+elamaran11@users.noreply.github.com> Date: Thu, 29 Aug 2024 15:11:14 -0700 Subject: [PATCH 08/30] Bug Fix to add Ingress for ArgoCD (#43) * add Ingress for ArgoCD Signed-off-by: Elamaran Shanmugam --- terraform/argocd-ingress.tf | 6 +++++ .../templates/manifests/ingress-argocd.yaml | 24 +++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 terraform/argocd-ingress.tf create mode 100644 terraform/templates/manifests/ingress-argocd.yaml diff --git a/terraform/argocd-ingress.tf b/terraform/argocd-ingress.tf new file mode 100644 index 000000000..dfd01d025 --- /dev/null +++ b/terraform/argocd-ingress.tf @@ -0,0 +1,6 @@ +resource "kubectl_manifest" "ingress_argocd" { + yaml_body = templatefile("${path.module}/templates/manifests/ingress-argocd.yaml", { + ARGOCD_DOMAIN_NAME = local.argocd_domain_name + } + ) +} diff --git a/terraform/templates/manifests/ingress-argocd.yaml b/terraform/templates/manifests/ingress-argocd.yaml new file mode 100644 index 000000000..9ffba3675 --- /dev/null +++ b/terraform/templates/manifests/ingress-argocd.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: argocd-server-ingress + namespace: argocd + annotations: + cert-manager.io/cluster-issuer: 'letsencrypt-prod' +spec: + ingressClassName: nginx + tls: + - hosts: + - ${ARGOCD_DOMAIN_NAME} + secretName: argocd-prod-tls + rules: + - host: ${ARGOCD_DOMAIN_NAME} + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: argocd-server + port: + name: https From f4bc16a5e6f91a307847e30871ade860bfee20ad Mon Sep 17 00:00:00 2001 From: Zach Jacobson Date: Fri, 30 Aug 2024 18:23:56 +0000 Subject: [PATCH 09/30] fix cert manager timeout Signed-off-by: Zach Jacobson --- terraform/cert-manager.tf | 10 ++++++---- terraform/versions.tf | 1 + 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/terraform/cert-manager.tf b/terraform/cert-manager.tf index 622e86e1d..f5548b243 100644 --- a/terraform/cert-manager.tf +++ b/terraform/cert-manager.tf @@ -2,17 +2,19 @@ resource "kubectl_manifest" "application_argocd_cert_manager" { yaml_body = templatefile("${path.module}/templates/argocd-apps/cert-manager.yaml", { REPO_URL = local.repo_url }) +} +resource "null_resource" "wait_for_cert_manager" { provisioner "local-exec" { command = "kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/cert-manager && kubectl wait --for=jsonpath=.status.sync.status=Synced --timeout=300s -n argocd application/cert-manager && sleep 60" - - interpreter = ["/bin/bash", "-c"] } + + depends_on = [kubectl_manifest.application_argocd_cert_manager] } resource "kubectl_manifest" "cluster_issuer_prod" { - depends_on = [ - kubectl_manifest.application_argocd_cert_manager, + depends_on = [ + null_resource.wait_for_cert_manager, kubectl_manifest.application_argocd_ingress_nginx ] yaml_body = templatefile("${path.module}/templates/manifests/cluster-issuer.yaml", { diff --git a/terraform/versions.tf b/terraform/versions.tf index c295c5dac..520e5093d 100644 --- a/terraform/versions.tf +++ b/terraform/versions.tf @@ -18,5 +18,6 @@ terraform { source = "alekc/kubectl" version = ">= 2.0.0" } + null = {} } } From 7d5b9dc0a56e1d6d5316701700d4b8157e9330f4 Mon Sep 17 00:00:00 2001 From: Zach Jacobson Date: Fri, 6 Sep 2024 18:06:56 +0000 Subject: [PATCH 10/30] fix deprecated null_resource with terraform_data Signed-off-by: Zach Jacobson --- terraform/cert-manager.tf | 6 +++--- terraform/versions.tf | 5 ++++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/terraform/cert-manager.tf b/terraform/cert-manager.tf index f5548b243..b4159b744 100644 --- a/terraform/cert-manager.tf +++ b/terraform/cert-manager.tf @@ -4,9 +4,9 @@ resource "kubectl_manifest" "application_argocd_cert_manager" { }) } -resource "null_resource" "wait_for_cert_manager" { +resource "terraform_data" "wait_for_cert_manager" { provisioner "local-exec" { - command = "kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/cert-manager && kubectl wait --for=jsonpath=.status.sync.status=Synced --timeout=300s -n argocd application/cert-manager && sleep 60" + command = "kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/cert-manager && kubectl wait --for=jsonpath=.status.sync.status=Synced --timeout=300s -n argocd application/cert-manager" } depends_on = [kubectl_manifest.application_argocd_cert_manager] @@ -14,7 +14,7 @@ resource "null_resource" "wait_for_cert_manager" { resource "kubectl_manifest" "cluster_issuer_prod" { depends_on = [ - null_resource.wait_for_cert_manager, + terraform_data.wait_for_cert_manager, kubectl_manifest.application_argocd_ingress_nginx ] yaml_body = templatefile("${path.module}/templates/manifests/cluster-issuer.yaml", { diff --git a/terraform/versions.tf b/terraform/versions.tf index 520e5093d..fde1b4f89 100644 --- a/terraform/versions.tf +++ b/terraform/versions.tf @@ -18,6 +18,9 @@ terraform { source = "alekc/kubectl" version = ">= 2.0.0" } - null = {} + http = { + source = "hashicorp/http" + version = ">= 3.4.4" + } } } From aa5ccd9142c4bc6883a528e14f30c4bf1912b361 Mon Sep 17 00:00:00 2001 From: Zach Jacobson Date: Fri, 6 Sep 2024 21:40:16 +0000 Subject: [PATCH 11/30] remove unneeded module Signed-off-by: Zach Jacobson --- terraform/versions.tf | 4 ---- 1 file changed, 4 deletions(-) diff --git a/terraform/versions.tf b/terraform/versions.tf index fde1b4f89..c295c5dac 100644 --- a/terraform/versions.tf +++ b/terraform/versions.tf @@ -18,9 +18,5 @@ terraform { source = "alekc/kubectl" version = ">= 2.0.0" } - http = { - source = "hashicorp/http" - version = ">= 3.4.4" - } } } From 93ef4c526bba1ccbed083c4c7dc3ae948ac73c06 Mon Sep 17 00:00:00 2001 From: Greg Haynes Date: Wed, 12 Mar 2025 13:59:29 -0700 Subject: [PATCH 12/30] Add notice about repository deprecation and stacks Signed-off-by: Greg Haynes --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 15810b622..abeb5c53c 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ ![overview](docs/images/overview.png) +> **_NOTE:_** This repository is no longer maintained and has been superceded by [stacks](https://github.com/cnoe-io/stacks). + > **_NOTE:_** Applications deployed in this repository are not meant or configured for production. From 95eb2db271933b94fa81b31f01cab1aa3ca30fe6 Mon Sep 17 00:00:00 2001 From: Greg Haynes Date: Wed, 12 Mar 2025 14:09:12 -0700 Subject: [PATCH 13/30] Move notice above diagram Signed-off-by: Greg Haynes --- README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/README.md b/README.md index abeb5c53c..3f483c63e 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,7 @@ -![overview](docs/images/overview.png) - > **_NOTE:_** This repository is no longer maintained and has been superceded by [stacks](https://github.com/cnoe-io/stacks). +![overview](docs/images/overview.png) > **_NOTE:_** Applications deployed in this repository are not meant or configured for production. From e52e4547207766ab0cfd3ca2825f3d7a764966d9 Mon Sep 17 00:00:00 2001 From: Greg Haynes Date: Wed, 12 Mar 2025 14:19:50 -0700 Subject: [PATCH 14/30] Trying out a caution block Signed-off-by: Greg Haynes --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3f483c63e..7ceec9bcf 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,6 @@ -> **_NOTE:_** This repository is no longer maintained and has been superceded by [stacks](https://github.com/cnoe-io/stacks). +> [!CAUTION] +> Don't execute the code without commenting the test cases. This repository is no longer maintained and has been superceded by [stacks](https://github.com/cnoe-io/stacks). ![overview](docs/images/overview.png) From 48877b8add6e49b13309892657465965a067c02a Mon Sep 17 00:00:00 2001 From: Greg Haynes Date: Wed, 12 Mar 2025 14:20:45 -0700 Subject: [PATCH 15/30] Remove copied text in caution block Signed-off-by: Greg Haynes --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7ceec9bcf..051074fde 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ > [!CAUTION] -> Don't execute the code without commenting the test cases. This repository is no longer maintained and has been superceded by [stacks](https://github.com/cnoe-io/stacks). +> This repository is no longer maintained and has been superceded by [stacks](https://github.com/cnoe-io/stacks). ![overview](docs/images/overview.png) From 8490fa90d8ebf54bb24bc845c8c7c6640d47f6b5 Mon Sep 17 00:00:00 2001 From: Pankaj Walke <126026317+punkwalker@users.noreply.github.com> Date: Thu, 29 May 2025 11:36:21 -0700 Subject: [PATCH 16/30] Update README.md with new version issue link --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 051074fde..cec2e777d 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ > [!CAUTION] -> This repository is no longer maintained and has been superceded by [stacks](https://github.com/cnoe-io/stacks). +> The current version of the AWS reference implementation is no longer maintained. A new version is currently work in progress. Find more information about the new version in #49. ![overview](docs/images/overview.png) From 4edf74a51bc94818381dd92da3e47ae47f1a9df2 Mon Sep 17 00:00:00 2001 From: Pankaj Walke <126026317+punkwalker@users.noreply.github.com> Date: Thu, 29 May 2025 11:36:49 -0700 Subject: [PATCH 17/30] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index cec2e777d..e4dab3add 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ > [!CAUTION] -> The current version of the AWS reference implementation is no longer maintained. A new version is currently work in progress. Find more information about the new version in #49. +> The current version of the AWS reference implementation is no longer maintained. A new version is currently work in progress. Find more information about the new version in issue #49. ![overview](docs/images/overview.png) From 93ee1b75c260488100a9aa200424f35b535fe884 Mon Sep 17 00:00:00 2001 From: Pankaj Walke <126026317+punkwalker@users.noreply.github.com> Date: Fri, 30 May 2025 10:40:25 -0700 Subject: [PATCH 18/30] Add issue link --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index e4dab3add..5d1cbddca 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ > [!CAUTION] -> The current version of the AWS reference implementation is no longer maintained. A new version is currently work in progress. Find more information about the new version in issue #49. +> The current version of the AWS reference implementation is no longer maintained. A new version is currently work in progress. Find more information about the new version in issue [#49](https://github.com/cnoe-io/reference-implementation-aws/issues/49). ![overview](docs/images/overview.png) From 8bbd0749ec694e7947b226cb9bf3a16ec644a9b1 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Thu, 24 Jul 2025 18:24:19 -0700 Subject: [PATCH 19/30] Improved version of CNOE AWS Reference Implementation (#52) WIP: Improved version of CNOE AWS Reference Implementation - New directory structure - Leverages ArgoCD Application Sets - Deploy the IDP to a remote EKS cluster from a kind cluster (ie. idpbuilder) Fixes: #49 --------- Signed-off-by: Pankaj Walke Signed-off-by: Carlos Santana Co-authored-by: Carlos Santana --- .gitignore | 3 +- README.md | 439 +- TROUBLESHOOTING.md | 72 - cluster/eksctl/README.md | 82 + cluster/eksctl/cluster-config-auto.yaml | 46 + cluster/eksctl/cluster-config.yaml | 69 + .../crossplane-permissions-boundry.json | 65 + cluster/iam-policies/external-secrets.json | 25 + cluster/terraform/README.md | 96 + cluster/terraform/main.tf | 242 + cluster/terraform/outputs.tf | 39 + cluster/terraform/variables.tf | 18 + cluster/terraform/versions.tf | 9 + config.yaml | 35 + .../examples/app-with-aws-resources.md | 0 demo.md => docs/examples/demo.md | 0 {examples => docs/examples}/spark/pi.yaml | 0 .../template-generation/data-on-eks.yaml | 0 docs/images/argocd-github-app.png | Bin 0 -> 48479 bytes docs/images/backstage-github-app.png | Bin 0 -> 74537 bytes docs/installation_flow.md | 88 + docs/installation_with_idpbuilder.md | 347 + docs/troubleshooting.md | 56 + eksctl.yaml | 27 - packages/addons/path-routing-values.yaml | 47 + packages/addons/values.yaml | 274 + packages/appset-chart/.helmignore | 23 + packages/appset-chart/Chart.yaml | 24 + packages/appset-chart/README.md | 185 + .../templates/_application_set.tpl | 59 + .../appset-chart/templates/_git_matrix.tpl | 34 + packages/appset-chart/templates/_helpers.tpl | 48 + .../appset-chart/templates/_pod_identity.tpl | 35 + .../templates/application-set.yaml | 189 + packages/appset-chart/values.yaml | 32 + .../manifests}/appproject-cnoe.yaml | 0 .../manifests}/appproject-demo.yaml | 0 .../argo-cd/manifests/argo-cd-github-app.yaml | 53 + .../argo-cd/manifests/hub-cluster-secret.yaml | 88 + .../default-cert-external-secret.yaml | 33 + packages/argo-cd/values.yaml | 158 + .../base/kustomization.yaml | 3 - .../dev/kustomization.yaml | 4 - .../argo-workflows/dev/values-no-sso.yaml | 8 - .../manifests/external-secrets.yaml | 25 + .../manifests}/sa-admin.yaml | 0 .../default-cert-external-secret.yaml | 33 + packages/argo-workflows/{dev => }/values.yaml | 12 +- packages/argocd/base/install.yaml | 18234 ---------------- packages/argocd/base/kustomization.yaml | 3 - packages/argocd/dev/argocd-cmd-params-cm.yaml | 9 - packages/argocd/dev/cm-argocd-cm.yaml | 129 - packages/argocd/dev/cm-argocd-rbac-cm.yaml | 8 - packages/argocd/dev/kustomization.yaml | 13 - packages/argocd/dev/service-argogrpc.yaml | 19 - .../backstage/base/install-backstage.yaml | 42 - .../backstage/base/install-postgresql.yaml | 72 - packages/backstage/base/kustomization.yaml | 3 - .../backstage/dev/cm-backstage-config.yaml | 122 - packages/backstage/dev/kustomization.yaml | 7 - .../dev/patches/deployment-backstage.yaml | 43 - packages/backstage/dev/sa-backstage.yaml | 54 - packages/backstage/dev/user-rbac.yaml | 36 - .../backstage/manifests/external-secrets.yaml | 133 + .../k8s-config-secret.yaml} | 3 +- .../default-cert-external-secret.yaml | 33 + packages/backstage/values.yaml | 132 + packages/bootstrap.yaml | 38 + packages/bootstrap/values-idpbuilder.yaml | 14 + packages/bootstrap/values.yaml | 34 + packages/cert-manager/base/crds.yaml | 4486 ---- packages/cert-manager/dev/values.yaml | 4 - .../path-routing/cluster-secret-store.yaml | 60 + packages/cert-manager/values.yaml | 38 + packages/crossplane-aws-upbound/values.yaml | 52 + .../base/kustomization.yaml | 3 - .../base/provider-aws-config.yaml | 7 - .../base/provider-aws.yaml | 8 - .../kustomization.yaml | 7 + .../s3/definition.yaml | 63 + .../s3/general-purpose.yaml | 129 + .../s3/kustomization.yaml | 3 + packages/crossplane/base/kustomization.yaml | 4 - .../crossplane/base/provider-aws-config.yaml | 10 - packages/crossplane/base/provider-aws.yaml | 20 - packages/crossplane/dev/kustomization.yaml | 2 - packages/crossplane/dev/values.yaml | 3 - packages/crossplane/values.yaml | 2 + packages/external-dns/{dev => }/values.yaml | 0 .../manifests/cluster-secret-store.yaml | 9 + .../external-secrets/{dev => }/values.yaml | 0 packages/ingress-nginx/{dev => }/values.yaml | 2 + packages/keycloak/base/install.yaml | 49 - packages/keycloak/base/kustomization.yaml | 2 - .../external-secrets.yaml | 70 - .../dev-external-secrets/kustomization.yaml | 3 - packages/keycloak/dev/cm-config.yaml | 26 - packages/keycloak/dev/kustomization.yaml | 19 - packages/keycloak/dev/ns.yaml | 4 - packages/keycloak/dev/patches/deployment.yaml | 39 - packages/keycloak/dev/patches/service.yaml | 6 - packages/keycloak/dev/postgres.yaml | 73 - packages/keycloak/dev/service-admin.yaml | 29 - .../keycloak/manifests/external-secrets.yaml | 95 + .../keycloak-cluster-secret-store.yaml | 60 + .../manifests/user-sso-config-job.yaml | 430 + .../default-cert-external-secret.yaml | 33 + packages/keycloak/values.yaml | 32 + private/argocd-github.yaml.template | 9 + private/backstage-github.yaml.template | 9 + scripts/cleanup-crds.sh | 91 + scripts/create-cluster.sh | 88 + scripts/create-config-secrets.sh | 92 + scripts/get-urls.sh | 37 + scripts/install-using-idpbuilder.sh | 69 + scripts/install.sh | 96 + scripts/template.sh | 56 + scripts/uninstall.sh | 78 + scripts/utils.sh | 192 + setups/argocd/application-set.yaml | 36 - setups/argocd/github-secret.yaml | 11 - setups/argocd/install.sh | 55 - setups/argocd/secret-argocd-secret.yaml | 8 - setups/argocd/uninstall.sh | 7 - setups/config.yaml | 19 - setups/install.sh | 34 - setups/uninstall.sh | 28 - setups/utils.sh | 45 - .../cluster-workflow-data-on-eks-cleanup.yaml | 0 .../base/cluster-workflow-data-on-eks.yaml | 0 .../base/cluster-workflow-spark-rbac.yaml | 0 .../argo-workflow}/base/kustomization.yaml | 0 .../base/sa-backstage-scaffolder.yaml | 0 .../argo-workflow}/base/sa-data-on-eks.yaml | 0 .../argo-workflow}/dev/kustomization.yaml | 0 templates/backstage/README.md | 3 + .../skeleton/catalog-info.yaml | 48 + .../skeleton/docs/idpbuilder.md | 46 + .../skeleton/docs/images/cnoe-logo.png | Bin 0 -> 58052 bytes .../app-with-bucket/skeleton/docs/index.md | 16 + .../backstage/app-with-bucket/skeleton/go.mod | 3 + .../skeleton/kustomize/base/cm-nginx.yaml | 200 + .../kustomize/base/kustomization.yaml | 4 + .../skeleton/kustomize/base/nginx.yaml | 83 + .../kustomize}/dev/kustomization.yaml | 0 .../kustomize/prod/kustomization.yaml | 35 + .../app-with-bucket/skeleton/main.go | 5 + .../app-with-bucket/skeleton/mkdocs.yml | 6 + .../backstage/app-with-bucket/template.yaml | 144 + .../argo-workflows/skeleton/catalog-info.yaml | 40 + .../skeleton/docs/argo-workflows.md | 160 + .../skeleton/docs/images/cnoe-logo.png | Bin 0 -> 58052 bytes .../argo-workflows/skeleton/docs/index.md | 9 + .../skeleton/docs/spark-operator.md | 86 + .../skeleton/manifests/deployment.yaml | 109 + .../argo-workflows/skeleton/mkdocs.yml | 8 + .../backstage/argo-workflows/template.yaml | 62 + templates/backstage/basic/mkdocs.yml | 6 + .../basic/skeleton/catalog-info.yaml | 36 + .../basic/skeleton/docs/idpbuilder.md | 46 + .../basic/skeleton/docs/images/cnoe-logo.png | Bin 0 -> 58052 bytes .../backstage/basic/skeleton/docs/index.md | 11 + .../basic/skeleton/manifests/deployment.yaml | 24 + templates/backstage/basic/template.yaml | 58 + templates/backstage/catalog-info.yaml | 20 + templates/backstage/organization/guests.yaml | 15 + .../ray-serve/sample/pytorch-sample.py | 154 + .../ray-serve/skeleton/catalog-info.yaml | 18 + .../skeleton/manifests/ray-serve.yaml | 92 + .../ray-serve/template-ray-serve.yaml | 58 + terraform/argo-workflows.tf | 135 - terraform/argocd-ingress.tf | 6 - terraform/aws-load-balancer.tf | 39 - terraform/backstage.tf | 80 - terraform/cert-manager.tf | 23 - terraform/crossplane.tf | 69 - terraform/data.tf | 14 - terraform/external-dns.tf | 71 - terraform/external-secrets.tf | 12 - terraform/ingress-nginx.tf | 15 - terraform/keycloak.tf | 239 - terraform/main.tf | 36 - .../config-payloads/client-payload.json | 28 - terraform/scripts/argo-workflows/install.sh | 56 - .../scripts/argo-workflows/secret-sso.yaml | 9 - terraform/scripts/argo-workflows/uninstall.sh | 49 - .../config-payloads/client-payload.json | 28 - terraform/scripts/backstage/install.sh | 82 - .../scripts/backstage/secret-env-var.yaml | 16 - .../backstage/secret-integrations.yaml | 8 - terraform/scripts/backstage/uninstall.sh | 44 - terraform/scripts/crossplane/uninstall.sh | 11 - .../client-scope-groups-payload.json | 12 - .../config-payloads/group-admin-payload.json | 1 - .../group-base-user-payload.json | 1 - .../config-payloads/group-mapper-payload.json | 12 - .../config-payloads/realm-payload.json | 1 - .../config-payloads/user-password.json | 5 - .../keycloak/config-payloads/user-user1.json | 12 - .../keycloak/config-payloads/user-user2.json | 12 - terraform/scripts/keycloak/install.sh | 97 - terraform/scripts/keycloak/uninstall.sh | 15 - .../argo-workflows-sso-config.yaml | 22 - .../argocd-apps/argo-workflows-templates.yaml | 22 - .../templates/argocd-apps/argo-workflows.yaml | 34 - .../argocd-apps/aws-load-balancer.yaml | 51 - .../templates/argocd-apps/backstage.yaml | 29 - .../templates/argocd-apps/cert-manager.yaml | 29 - .../argocd-apps/crossplane-compositions.yaml | 21 - .../argocd-apps/crossplane-provider.yaml | 21 - .../templates/argocd-apps/crossplane.yaml | 29 - .../templates/argocd-apps/external-dns.yaml | 34 - .../argocd-apps/external-secrets.yaml | 29 - .../templates/argocd-apps/ingress-nginx.yaml | 29 - terraform/templates/argocd-apps/keycloak.yaml | 22 - .../templates/manifests/cluster-issuer.yaml | 13 - .../crossplane-aws-controller-config.yaml | 12 - .../manifests/ingress-argo-workflows.yaml | 24 - .../templates/manifests/ingress-argocd.yaml | 24 - .../manifests/ingress-backstage.yaml | 24 - .../templates/manifests/ingress-keycloak.yaml | 45 - .../manifests/keycloak-secret-store.yaml | 14 - terraform/variables.tf | 56 - terraform/versions.tf | 22 - 224 files changed, 6594 insertions(+), 26103 deletions(-) delete mode 100644 TROUBLESHOOTING.md create mode 100644 cluster/eksctl/README.md create mode 100644 cluster/eksctl/cluster-config-auto.yaml create mode 100644 cluster/eksctl/cluster-config.yaml create mode 100644 cluster/iam-policies/crossplane-permissions-boundry.json create mode 100644 cluster/iam-policies/external-secrets.json create mode 100644 cluster/terraform/README.md create mode 100644 cluster/terraform/main.tf create mode 100644 cluster/terraform/outputs.tf create mode 100644 cluster/terraform/variables.tf create mode 100644 cluster/terraform/versions.tf create mode 100644 config.yaml rename setups/argocd/install-sso.sh => docs/examples/app-with-aws-resources.md (100%) rename demo.md => docs/examples/demo.md (100%) rename {examples => docs/examples}/spark/pi.yaml (100%) rename {examples => docs/examples}/template-generation/data-on-eks.yaml (100%) create mode 100644 docs/images/argocd-github-app.png create mode 100644 docs/images/backstage-github-app.png create mode 100644 docs/installation_flow.md create mode 100644 docs/installation_with_idpbuilder.md create mode 100644 docs/troubleshooting.md delete mode 100644 eksctl.yaml create mode 100644 packages/addons/path-routing-values.yaml create mode 100644 packages/addons/values.yaml create mode 100644 packages/appset-chart/.helmignore create mode 100644 packages/appset-chart/Chart.yaml create mode 100644 packages/appset-chart/README.md create mode 100644 packages/appset-chart/templates/_application_set.tpl create mode 100644 packages/appset-chart/templates/_git_matrix.tpl create mode 100644 packages/appset-chart/templates/_helpers.tpl create mode 100644 packages/appset-chart/templates/_pod_identity.tpl create mode 100644 packages/appset-chart/templates/application-set.yaml create mode 100644 packages/appset-chart/values.yaml rename packages/{argocd/dev => argo-cd/manifests}/appproject-cnoe.yaml (100%) rename packages/{argocd/dev => argo-cd/manifests}/appproject-demo.yaml (100%) create mode 100644 packages/argo-cd/manifests/argo-cd-github-app.yaml create mode 100644 packages/argo-cd/manifests/hub-cluster-secret.yaml create mode 100644 packages/argo-cd/path-routing/default-cert-external-secret.yaml create mode 100644 packages/argo-cd/values.yaml delete mode 100644 packages/argo-workflows-sso-config/base/kustomization.yaml delete mode 100644 packages/argo-workflows-sso-config/dev/kustomization.yaml delete mode 100644 packages/argo-workflows/dev/values-no-sso.yaml create mode 100644 packages/argo-workflows/manifests/external-secrets.yaml rename packages/{argo-workflows-sso-config/base => argo-workflows/manifests}/sa-admin.yaml (100%) create mode 100644 packages/argo-workflows/path-routing/default-cert-external-secret.yaml rename packages/argo-workflows/{dev => }/values.yaml (53%) delete mode 100644 packages/argocd/base/install.yaml delete mode 100644 packages/argocd/base/kustomization.yaml delete mode 100644 packages/argocd/dev/argocd-cmd-params-cm.yaml delete mode 100644 packages/argocd/dev/cm-argocd-cm.yaml delete mode 100644 packages/argocd/dev/cm-argocd-rbac-cm.yaml delete mode 100644 packages/argocd/dev/kustomization.yaml delete mode 100644 packages/argocd/dev/service-argogrpc.yaml delete mode 100644 packages/backstage/base/install-backstage.yaml delete mode 100644 packages/backstage/base/install-postgresql.yaml delete mode 100644 packages/backstage/base/kustomization.yaml delete mode 100644 packages/backstage/dev/cm-backstage-config.yaml delete mode 100644 packages/backstage/dev/kustomization.yaml delete mode 100644 packages/backstage/dev/patches/deployment-backstage.yaml delete mode 100644 packages/backstage/dev/sa-backstage.yaml delete mode 100644 packages/backstage/dev/user-rbac.yaml create mode 100644 packages/backstage/manifests/external-secrets.yaml rename packages/backstage/{dev/secret-k8s-config.yaml => manifests/k8s-config-secret.yaml} (96%) create mode 100644 packages/backstage/path-routing/default-cert-external-secret.yaml create mode 100644 packages/backstage/values.yaml create mode 100644 packages/bootstrap.yaml create mode 100644 packages/bootstrap/values-idpbuilder.yaml create mode 100644 packages/bootstrap/values.yaml delete mode 100644 packages/cert-manager/base/crds.yaml delete mode 100644 packages/cert-manager/dev/values.yaml create mode 100644 packages/cert-manager/path-routing/cluster-secret-store.yaml create mode 100644 packages/cert-manager/values.yaml create mode 100644 packages/crossplane-aws-upbound/values.yaml delete mode 100644 packages/crossplane-compositions/base/kustomization.yaml delete mode 100644 packages/crossplane-compositions/base/provider-aws-config.yaml delete mode 100644 packages/crossplane-compositions/base/provider-aws.yaml create mode 100644 packages/crossplane-compositions/kustomization.yaml create mode 100644 packages/crossplane-compositions/s3/definition.yaml create mode 100644 packages/crossplane-compositions/s3/general-purpose.yaml create mode 100644 packages/crossplane-compositions/s3/kustomization.yaml delete mode 100644 packages/crossplane/base/kustomization.yaml delete mode 100644 packages/crossplane/base/provider-aws-config.yaml delete mode 100644 packages/crossplane/base/provider-aws.yaml delete mode 100644 packages/crossplane/dev/kustomization.yaml delete mode 100644 packages/crossplane/dev/values.yaml create mode 100644 packages/crossplane/values.yaml rename packages/external-dns/{dev => }/values.yaml (100%) create mode 100644 packages/external-secrets/manifests/cluster-secret-store.yaml rename packages/external-secrets/{dev => }/values.yaml (100%) rename packages/ingress-nginx/{dev => }/values.yaml (72%) delete mode 100644 packages/keycloak/base/install.yaml delete mode 100644 packages/keycloak/base/kustomization.yaml delete mode 100644 packages/keycloak/dev-external-secrets/external-secrets.yaml delete mode 100644 packages/keycloak/dev-external-secrets/kustomization.yaml delete mode 100644 packages/keycloak/dev/cm-config.yaml delete mode 100644 packages/keycloak/dev/kustomization.yaml delete mode 100644 packages/keycloak/dev/ns.yaml delete mode 100644 packages/keycloak/dev/patches/deployment.yaml delete mode 100644 packages/keycloak/dev/patches/service.yaml delete mode 100644 packages/keycloak/dev/postgres.yaml delete mode 100644 packages/keycloak/dev/service-admin.yaml create mode 100644 packages/keycloak/manifests/external-secrets.yaml create mode 100644 packages/keycloak/manifests/keycloak-cluster-secret-store.yaml create mode 100644 packages/keycloak/manifests/user-sso-config-job.yaml create mode 100644 packages/keycloak/path-routing/default-cert-external-secret.yaml create mode 100644 packages/keycloak/values.yaml create mode 100644 private/argocd-github.yaml.template create mode 100644 private/backstage-github.yaml.template create mode 100755 scripts/cleanup-crds.sh create mode 100755 scripts/create-cluster.sh create mode 100755 scripts/create-config-secrets.sh create mode 100755 scripts/get-urls.sh create mode 100755 scripts/install-using-idpbuilder.sh create mode 100755 scripts/install.sh create mode 100755 scripts/template.sh create mode 100755 scripts/uninstall.sh create mode 100755 scripts/utils.sh delete mode 100644 setups/argocd/application-set.yaml delete mode 100644 setups/argocd/github-secret.yaml delete mode 100755 setups/argocd/install.sh delete mode 100644 setups/argocd/secret-argocd-secret.yaml delete mode 100755 setups/argocd/uninstall.sh delete mode 100644 setups/config.yaml delete mode 100755 setups/install.sh delete mode 100755 setups/uninstall.sh delete mode 100644 setups/utils.sh rename {packages/argo-workflows-templates => templates/argo-workflow}/base/cluster-workflow-data-on-eks-cleanup.yaml (100%) rename {packages/argo-workflows-templates => templates/argo-workflow}/base/cluster-workflow-data-on-eks.yaml (100%) rename {packages/argo-workflows-templates => templates/argo-workflow}/base/cluster-workflow-spark-rbac.yaml (100%) rename {packages/argo-workflows-templates => templates/argo-workflow}/base/kustomization.yaml (100%) rename {packages/argo-workflows-templates => templates/argo-workflow}/base/sa-backstage-scaffolder.yaml (100%) rename {packages/argo-workflows-templates => templates/argo-workflow}/base/sa-data-on-eks.yaml (100%) rename {packages/argo-workflows-templates => templates/argo-workflow}/dev/kustomization.yaml (100%) create mode 100644 templates/backstage/README.md create mode 100644 templates/backstage/app-with-bucket/skeleton/catalog-info.yaml create mode 100644 templates/backstage/app-with-bucket/skeleton/docs/idpbuilder.md create mode 100644 templates/backstage/app-with-bucket/skeleton/docs/images/cnoe-logo.png create mode 100644 templates/backstage/app-with-bucket/skeleton/docs/index.md create mode 100644 templates/backstage/app-with-bucket/skeleton/go.mod create mode 100644 templates/backstage/app-with-bucket/skeleton/kustomize/base/cm-nginx.yaml create mode 100644 templates/backstage/app-with-bucket/skeleton/kustomize/base/kustomization.yaml create mode 100644 templates/backstage/app-with-bucket/skeleton/kustomize/base/nginx.yaml rename {packages/crossplane-compositions => templates/backstage/app-with-bucket/skeleton/kustomize}/dev/kustomization.yaml (100%) create mode 100644 templates/backstage/app-with-bucket/skeleton/kustomize/prod/kustomization.yaml create mode 100644 templates/backstage/app-with-bucket/skeleton/main.go create mode 100644 templates/backstage/app-with-bucket/skeleton/mkdocs.yml create mode 100644 templates/backstage/app-with-bucket/template.yaml create mode 100644 templates/backstage/argo-workflows/skeleton/catalog-info.yaml create mode 100644 templates/backstage/argo-workflows/skeleton/docs/argo-workflows.md create mode 100644 templates/backstage/argo-workflows/skeleton/docs/images/cnoe-logo.png create mode 100644 templates/backstage/argo-workflows/skeleton/docs/index.md create mode 100644 templates/backstage/argo-workflows/skeleton/docs/spark-operator.md create mode 100644 templates/backstage/argo-workflows/skeleton/manifests/deployment.yaml create mode 100644 templates/backstage/argo-workflows/skeleton/mkdocs.yml create mode 100644 templates/backstage/argo-workflows/template.yaml create mode 100644 templates/backstage/basic/mkdocs.yml create mode 100644 templates/backstage/basic/skeleton/catalog-info.yaml create mode 100644 templates/backstage/basic/skeleton/docs/idpbuilder.md create mode 100644 templates/backstage/basic/skeleton/docs/images/cnoe-logo.png create mode 100644 templates/backstage/basic/skeleton/docs/index.md create mode 100644 templates/backstage/basic/skeleton/manifests/deployment.yaml create mode 100644 templates/backstage/basic/template.yaml create mode 100644 templates/backstage/catalog-info.yaml create mode 100644 templates/backstage/organization/guests.yaml create mode 100644 templates/backstage/ray-serve/sample/pytorch-sample.py create mode 100644 templates/backstage/ray-serve/skeleton/catalog-info.yaml create mode 100644 templates/backstage/ray-serve/skeleton/manifests/ray-serve.yaml create mode 100644 templates/backstage/ray-serve/template-ray-serve.yaml delete mode 100644 terraform/argo-workflows.tf delete mode 100644 terraform/argocd-ingress.tf delete mode 100644 terraform/aws-load-balancer.tf delete mode 100644 terraform/backstage.tf delete mode 100644 terraform/cert-manager.tf delete mode 100644 terraform/crossplane.tf delete mode 100644 terraform/data.tf delete mode 100644 terraform/external-dns.tf delete mode 100644 terraform/external-secrets.tf delete mode 100644 terraform/ingress-nginx.tf delete mode 100644 terraform/keycloak.tf delete mode 100644 terraform/main.tf delete mode 100644 terraform/scripts/argo-workflows/config-payloads/client-payload.json delete mode 100755 terraform/scripts/argo-workflows/install.sh delete mode 100644 terraform/scripts/argo-workflows/secret-sso.yaml delete mode 100755 terraform/scripts/argo-workflows/uninstall.sh delete mode 100644 terraform/scripts/backstage/config-payloads/client-payload.json delete mode 100755 terraform/scripts/backstage/install.sh delete mode 100644 terraform/scripts/backstage/secret-env-var.yaml delete mode 100644 terraform/scripts/backstage/secret-integrations.yaml delete mode 100755 terraform/scripts/backstage/uninstall.sh delete mode 100755 terraform/scripts/crossplane/uninstall.sh delete mode 100644 terraform/scripts/keycloak/config-payloads/client-scope-groups-payload.json delete mode 100644 terraform/scripts/keycloak/config-payloads/group-admin-payload.json delete mode 100644 terraform/scripts/keycloak/config-payloads/group-base-user-payload.json delete mode 100644 terraform/scripts/keycloak/config-payloads/group-mapper-payload.json delete mode 100644 terraform/scripts/keycloak/config-payloads/realm-payload.json delete mode 100644 terraform/scripts/keycloak/config-payloads/user-password.json delete mode 100644 terraform/scripts/keycloak/config-payloads/user-user1.json delete mode 100644 terraform/scripts/keycloak/config-payloads/user-user2.json delete mode 100755 terraform/scripts/keycloak/install.sh delete mode 100755 terraform/scripts/keycloak/uninstall.sh delete mode 100644 terraform/templates/argocd-apps/argo-workflows-sso-config.yaml delete mode 100644 terraform/templates/argocd-apps/argo-workflows-templates.yaml delete mode 100644 terraform/templates/argocd-apps/argo-workflows.yaml delete mode 100644 terraform/templates/argocd-apps/aws-load-balancer.yaml delete mode 100644 terraform/templates/argocd-apps/backstage.yaml delete mode 100644 terraform/templates/argocd-apps/cert-manager.yaml delete mode 100644 terraform/templates/argocd-apps/crossplane-compositions.yaml delete mode 100644 terraform/templates/argocd-apps/crossplane-provider.yaml delete mode 100644 terraform/templates/argocd-apps/crossplane.yaml delete mode 100644 terraform/templates/argocd-apps/external-dns.yaml delete mode 100644 terraform/templates/argocd-apps/external-secrets.yaml delete mode 100644 terraform/templates/argocd-apps/ingress-nginx.yaml delete mode 100644 terraform/templates/argocd-apps/keycloak.yaml delete mode 100644 terraform/templates/manifests/cluster-issuer.yaml delete mode 100644 terraform/templates/manifests/crossplane-aws-controller-config.yaml delete mode 100644 terraform/templates/manifests/ingress-argo-workflows.yaml delete mode 100644 terraform/templates/manifests/ingress-argocd.yaml delete mode 100644 terraform/templates/manifests/ingress-backstage.yaml delete mode 100644 terraform/templates/manifests/ingress-keycloak.yaml delete mode 100644 terraform/templates/manifests/keycloak-secret-store.yaml delete mode 100644 terraform/variables.tf delete mode 100644 terraform/versions.tf diff --git a/.gitignore b/.gitignore index a842621ad..730169633 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ -private +private/*.yaml + .DS_Store .idea .build diff --git a/README.md b/README.md index 5d1cbddca..2e1ac8c44 100644 --- a/README.md +++ b/README.md @@ -1,313 +1,282 @@ +# CNOE AWS Reference Implementation -> [!CAUTION] -> The current version of the AWS reference implementation is no longer maintained. A new version is currently work in progress. Find more information about the new version in issue [#49](https://github.com/cnoe-io/reference-implementation-aws/issues/49). +This project contains a [CNOE](https://cnoe.io) reference implementation for AWS. This project can bring up an Internal Developer Platform on EKS with all the tools configured and ready to use. It will install addons on an EKS cluster as Argo CD apps using GitOps Bridge App of ApplicationSets pattern. Check out the [Getting Started](#getting-started) guide for installing this solution on an EKS cluster. -![overview](docs/images/overview.png) +> [!NOTE] +> Applications deployed in this repository are not meant or configured for production. -> **_NOTE:_** Applications deployed in this repository are not meant or configured for production. +## Architecture Overview +![overview](docs/images/overview.png) -# Installation +## Addons -- Installation script must be used with a EKS cluster because we use IRSA to talk to AWS services. -- Components are installed as ArgoCD Applications. -- Files under the `/packages` directory are meant to be usable without any modifications. This means certain configuration options like domain name must be passed outside of this directory. e.g. use ArgoCD's Helm parameters. +All the addons are helm charts with static values configured in `packages//values.yaml` and dynamic values based on Argo CD cluster secret label/annotations values in `packages/addons/values.yaml`. -## Basic installation flow +| Name | Namespace | Purpose | Chart Version | Chart | +| ---------- | ---------- | ---------- | ---------- | ---------- | +| Argo CD | argocd | Installation and management of addon Argo CD application | 8.0.14 | [Link](https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd) | +| Argo Workflows | argo | Workflow tool for continuous integration tasks | 0.45.18 | [Link](https://github.com/argoproj/argo-helm/tree/main/charts/argo-workflows )| +| Backstage | backstage | Self-Service Web UI (Developer Portal) for developers | 2.6.0 | [Link](https://github.com/backstage/charts/tree/main/charts/backstage) | +| Cert Manager | cert-manager | Certificate manager for addons and developer applications using Let's Encrypt | 1.17.2 | [Link](https://cert-manager.io/docs/installation/helm/) | +| Crossplane | crossplane-system | IaC controller for provisioning infrastructure | 1.20.0 | [Link](https://github.com/crossplane/crossplane/tree/main/cluster/charts/crossplane) | +| External DNS | external-dns | Domain management using Route 53 | 1.16.1 | [Link](https://github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns) | +| External Secrets | external-secrets | Secret Management using AWS Secret Manager and AWS Systems Manager Parameter Store | Version | [Link](https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets) | +| Ingress NGINX | ingress-nginx | Ingress controller for L7 network traffic routing | 4.7.0 | [Link](https://github.com/kubernetes/ingress-nginx/tree/main/charts/ingress-nginx) | +| Keycloak | keycloak | Identity provider for User Authentication | 24.7.3 | [Link](https://github.com/bitnami/charts/tree/main/bitnami/keycloak) | -The installation process follows the following pattern. +Check out more details about the [installation flow](docs/installation_flow.md). -1. Create a GitHub App for Backstage integration. -2. Install ArgoCD and configure it to be able to monitor your GitHub Organization. -3. Run Terraform. Terraform is responsible for: - - Managing AWS resources necessary for the Kubernetes operators to function. Mostly IAM Roles. - - Install components as ArgoCD applications. Pass IAM role information where necessary. - - Apply Kubernetes manifests such as secrets and ingress where information cannot easily be passed to ArgoCD. - - Run all the above in an order because installation order matters for many of these components. For example, Keycloak must be installed and ready before Backstage can be installed and configured. +## Installation Flow Diagram +This diagram illustrates the high-level installation flow for the CNOE AWS Reference Implementation. It shows how the local environment interacts with AWS resources to deploy and configure the platform on an EKS cluster. ```mermaid ---- -title: Installation Process ---- -erDiagram - "Local Machine" ||--o{ "ArgoCD" : "1. installs" - "Local Machine" ||--o{ "Terraform" : "2. invokes" - "Terraform" ||--o{ "AWS Resources" : "3. creates" - "Terraform" ||--o{ "ArgoCD" : "4. create ArgoCD Apps" - "ArgoCD" ||--o{ "This Repo" : "pulls manifests" - "ArgoCD" ||--o{ "Components" : "installs to the cluster" +flowchart TD + subgraph "Local Environment" + config["config.yaml"] + secrets["GitHub App Credentials + (private/*.yaml)"] + create_secrets["create-config-secrets.sh"] + install["install.sh"] + helm["helm"] + end + + subgraph "AWS" + aws_secrets["AWS Secrets Manager + - cnoe-ref-impl/config + - cnoe-ref-impl/github-app"] + + subgraph "EKS Cluster" + eks_argocd["Argo CD"] + eso["External Secret Operator"] + appset["addons-appset + (ApplicationSet)"] + + subgraph "Addons" + backstage["Backstage"] + keycloak["Keycloak"] + crossplane["Crossplane"] + cert_manager["Cert Manager"] + external_dns["External DNS"] + ingress["Ingress NGINX"] + argo_workflows["Argo Workflows"] + end + end + end + + config --> create_secrets + secrets --> create_secrets + create_secrets --> aws_secrets + + config --> install + install --> helm + + helm -- "Installs" --> eks_argocd + helm -- "Installs" --> eso + helm -- "Creates" --> appset + + aws_secrets -- "Provides configuration" --> eso + + appset -- "Creates Argo CD Addon ApplicationSets" --> Addons + + eks_argocd -- "Manages" --> Addons + eso -- "Provides secrets to" --> Addons + + classDef aws fill:#FF9900,stroke:#232F3E,color:white; + classDef k8s fill:#326CE5,stroke:#254AA5,color:white; + classDef tools fill:#4CAF50,stroke:#388E3C,color:white; + classDef config fill:#9C27B0,stroke:#7B1FA2,color:white; + + class aws_secrets,EKS aws; + class eks_argocd,eso,appset,backstage,keycloak,crossplane,cert_manager,external_dns,ingress,argo_workflows k8s; + class helm,install,create_secrets tools; + class config,secrets config; ``` -This installation pattern where some Kubernetes manifests are handled in Terraform while others are handled in GitOps manner may not be suitable for many organizations. If you can be certain about parameters such as domain name and certificate handling, it is better to utilize GitOps approach where these information are committed to a repository. The reason it is handled this way is to allow for customization for different organizations without forking this repository and committing organization specific information into the repository. +## Getting Started -## Secret handling +### Step 1. ☸️ Create EKS Cluster -Currently handled outside of repository and set via bash script. Secrets such as GitHub token and TLS private keys are stored in the `${REPO_ROOT}/private` directory. +The reference implementation can be installed on a new EKS cluster which can be created with the following tools: -We may be able to use sealed secrets with full GitOps approach in the future. ++ **eksctl**: Follow the [instructions](cluster/eksctl) ++ **terraform**: Follow the [instructions](cluster/terraform/) -## Requirements +This will create all the prerequisite AWS Resources required for the reference implementation, which includes: -- Github **Organization** (free to create) -- An existing EKS cluster version (1.27+) -- AWS CLI (2.13+) -- eksctl (0.167.0+) -- Kubectl CLI (1.27+) -- jq -- git -- yq -- curl -- kustomize -- node + npm (if you choose to create GitHub App via CLI) ++ EKS cluster with Auto Mode or Without Auto Mode (Managed Node Group with 4 nodes) ++ Pod Identity Associations for following Addons: -## Create GitHub Apps for your GitHub Organization +| Name | Namespace | Service Account Name | Permissions | +| ----- | --------- | -------------------- | ---------- | +| Crossplane | crossplane-system | provider-aws | Admin Permissions but with [permission boundary](cluster/iam-policies/crossplane-permissions-boundry.json) | +| External Secrets | external-secrets | external-secrets | [Permissions](https://external-secrets.io/latest/provider/aws-secrets-manager/#iam-policy) | +| External DNS | external-dns | external-dns | [Permissions](https://kubernetes-sigs.github.io/external-dns/latest/docs/tutorials/aws/#iam-policy) | +| AWS Load Balancer Controller
(When not using Auto Mode) | kube-system | aws-load-balancer-controller | [Permissions](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) | +| AWS EBS CSI Controller
(When not using Auto Mode) | kube-system | ebs-csi-controller-sa | [Permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) | -GitHub app is used to enable integration between Backstage and GitHub. -This allows you for integration actions such as automatically importing Backstage configuration such as Organization information and templates. -We strongly encourage you to create a **dedicated GitHub organization**. If you don't have an organization for this purpose, please follow [this link](https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch) to create one. +> [!NOTE] +> **Using Existing EKS Cluster** +> +> The reference implementation can be installed on an existing EKS Cluster only if the above prerequisites are completed. -There are two ways to create GitHub integration with Backstage. You can use the Backstage CLI, or create it manually. See [this page](https://backstage.io/docs/integrations/github/github-apps) for more information on creating one manually. Once the app is created, place it under the private directory with the name `github-integration.yaml`. +### Step 2. 🏢 Create GitHub Organization -To create one with the CLI, follow the steps below. If you are using cli to create GitHub App, please make sure to select third option in the permissions prompt, if your GitHub App access needs publishing access to create GitHub repositories for your backstage templates. +Backstage and Argo CD in this reference implementation are integrated with GitHub. Both Backstage and ArgoCD use Github Apps for authenticating with Github. -```bash -npx '@backstage/cli' create-github-app ${GITHUB_ORG_NAME} -# If prompted, select all for permissions or select permissions listed in this page https://backstage.io/docs/integrations/github/github-apps#app-permissions -# In the browser window, allow access to all repositories then install the app. - -? Select permissions [required] (these can be changed later but then require approvals in all installations) (Press to select, to toggle all, to invert selection, -and to proceed) - ◉ Read access to content (required by Software Catalog to ingest data from repositories) - ◉ Read access to members (required by Software Catalog to ingest GitHub teams) -❯◯ Read and Write to content and actions (required by Software Templates to create new repositories) - -# move it to a "private" location. -mkdir -p private -GITHUB_APP_FILE=$(ls github-app-* | head -n1) -mv ${GITHUB_APP_FILE} private/github-integration.yaml -``` +Therefore, a GitHub Organization should be created in order to create GitHub Apps for these integrations. Follow the instructions in [GitHub documentation](https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch) to create new organization or visit [here](https://github.com/account/organizations/new). -**The file created above contains credentials. Handle it with care.** +> [!NOTE] +> It is recommended to use a Github Organization instead of a personal github ID as Backstage has certain [limitations](https://backstage.io/docs/integrations/github/github-apps/#caveats) for using personal account Github Apps for authenticating to Github. Also, the Github Organization is ***FREE***. -The rest of the installation process assumes the GitHub app credentials are available at `private/github-integration.yaml` +### Step 3. 🍴 Fork the Repository -If you want to delete the GitHUb application, follow [these steps](https://docs.github.com/en/apps/maintaining-github-apps/deleting-a-github-app). - -## Create a GitHub token +Once the organization is created, fork this repository to the new GitHub Organization by following instructions in [GitHub documentation](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo). -A GitHub token is needed by ArgoCD to get information about repositories under your Organization. +### Step 4. 💻 Create GitHub Apps -The following permissions are needed: - - Repository access for all repositories - - Read-only access to: Administration, Contents, and Metadata. -Get your GitHub personal access token from: https://github.com/settings/tokens?type=beta +There are two ways to create a GitHub App. You can use the Backstage CLI `npx @backstage/cli create-github-app ` as per instructions in the [Backstage documentation](https://backstage.io/docs/integrations/github/github-apps/#using-the-cli-public-github-only), or create it manually per these instructions in the [GitHub documentation](https://backstage.io/docs/integrations/github/github-apps). -Once you have your token, save it under the private directory with the name `github-token`. For example: +Create the following apps and store them in the corresponding file path. -```bash -# From the root of this repository. -$ mkdir -p private -$ vim private/github-token # paste your token -# example output -$ cat private/github-token -github_pat_ABCDEDFEINDK.... +| App Name | Purpose | Required Permissions | File Path | Expected Content | +| -------- | ------- | -------------------- | --------- | ---------------- | +| Backstage | Used for automatically importing Backstage configuration such as Organization information, templates and creating new repositories for developer applications. | For All Repositories
- Read access to members, metadata, and organization administration
- Read and write access to administration and code | **`private/backstage-github.yaml`** | ![backstage-github-app](docs/images/backstage-github-app.png) | +| Argo CD | Used for deploying resources to cluster specified by Argo CD applications.| For All Repositories
- Read access to checks, code, members, and metadata| **`private/argocd-github.yaml`** | ![argocd-github-app](docs/images/argocd-github-app.png) | + +The template files for both these Github Apps are available in `private` directory. Copy these template files to above mentioned file path by running following command: + +``` +cp private/argocd-github.yaml.template private/argocd-github.yaml +cp private/backstage-github.yaml.template private/backstage-github.yaml ``` -## Install +After this, update the values in these files by getting them from files created by `backstage-cli` _(if used)_ or get the values from Github page of App Overview. -Follow the following steps to get started. +Argo CD requires `url` and `installationId` of the GitHub app. The `url` is the GitHub URL of the organization. The `installationId` can be captured by navigating to the app installation page with URL `https://github.com/organizations//settings/installations/`. You can find more information [on this page](https://stackoverflow.com/questions/74462420/where-can-we-find-github-apps-installation-id). -1. Create GitHub apps and GitHub token as described above. -2. Create a new EKS cluster. We do not include EKS cluster in the installation module because EKS cluster requirements vary between organizations and the focus of this is integration of different projects. If you prefer, you can create a new basic cluster with the included [`eksctl.yaml`](./eksctl.yaml) file: - ```eksctl create cluster -f eksctl.yaml``` - You can get eksctl from [this link](https://eksctl.io/). -3. If you don't have a public registered Route53 zone, [register a Route53 domain](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-register.html) (be sure to use Route53 as the DNS service for the domain). We **strongly encourage creating a dedicated sub domain** for this. If you'd rather manage DNS yourself, you can set `enable_dns_management` in the config file. -4. Get the host zone id and put it in the config file. - ```bash - aws route53 list-hosted-zones-by-name --dns-name --query 'HostedZones[0].Id' --output text | cut -d'/' -f3 - # in the setups/config file, update the zone id. - hosted_zone_id:: ZO020111111 - ``` -5. Update the [`setups/config`](setups/config.yaml) file with your own values. -6. Run `setups/install.sh` and follow the prompts. See the section below about monitoring installation progress. -7. Once installation completes, navigate to `backstage.` and log in as `user1`. Password is available as a secret. You may need to wait for DNS propagation to complete to be able to login. May take ~10 minutes. - ```bash - kubectl get secrets -n keycloak keycloak-user-config -o go-template='{{range $k,$v := .data}}{{printf "%s: " $k}}{{if not $v}}{{$v}}{{else}}{{$v | base64decode}}{{end}}{{"\n"}}{{end}}' - ``` +> [!WARNING] +> **If the app is created using the Backstage CLI, it creates files in the current working directory. These files contain credentials. Handle them with care. It is recommended to remove these files after copying the content over to files in the `private` directory** +> [!NOTE] +> The rest of the installation process assumes the GitHub apps credentials are available in `private/backstage-github.yaml` and `private/argocd-github.yaml` -### Monitoring installation progress +### Step 5. ⚙️ Prepare Environment for Installation -Components are installed as ArgoCD Applications. You can monitor installation progress by going to ArgoCD UI. +#### 📦 Install Binaries -```bash -# Get the admin password -kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d +The installation requires the following binaries in the local environment: -kubectl port-forward svc/argocd-server -n argocd 8081:80 -``` ++ [**AWS CLI**](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) ++ [**kubectl**](https://kubernetes.io/docs/tasks/tools/) ++ [**yq**](https://mikefarah.gitbook.io/yq/v3.x) ++ [**helm**](https://helm.sh/docs/intro/install/) -Go to [`http://localhost:8081`](http://localhost:8081) and login with the username `admin` and password obtained above. In the UI you can look at resources created, their logs, and events. +#### 🔐 Configure AWS Credentials +Configure the AWS CLI with credentials of an IAM role which has access to the EKS cluster. Follow the instructions in the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-quickstart.html#getting-started-quickstart-new) to configure the AWS CLI. +If the installation steps are being executed on an EC2 instance, ensure that the EC2 IAM instance role has permissions to access the EKS cluster or the AWS CLI is configured as mentioned above. -### If you installed it without automatic DNS configuration. +#### ⚙️ Configure Reference Implementation -If you set `enable_dns_management: false`, you are responsible for updating DNS records, thus external-dns is not installed. You have to set the following DNS records: -- `backstage.` -- `keycloak.` -- `argo.` -- `argocd.` +The reference implementation uses **`config.yaml`** file in the repository root directory to configure the installation values. The **`config.yaml`** should be updated with appropriate values before proceeding. Refer to the following table and update all the values appropriately. All the values are required. -Point these records to the value returned by the following command. +| Parameter | Description | Type | +|-----------|-------------|------| +| `repo.url` | GitHub URL of the fork in the Github Org | string | +| `repo.revision` | Branch or tag which should be used for Argo CD Apps | string | +| `repo.basepath` | Directory in which the configuration of addons is stored | string | +| `cluster_name` | Name of the EKS cluster for reference implementation
**(The name should satisfy criteria of a valid [kubernetes resource name](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/))** | string | +| `auto_mode` | Set to "true" if EKS cluster is Auto Mode, otherwise "false" | string | +| `region` | AWS Region of the EKS cluster and config secret | string | +| `domain` | Base Domain name for exposing services
**(This should be base domain or sub domain of the Route53 Hosted Zone)** | string | +| `route53_hosted_zone_id` | Route53 hosted zone ID for configuring external-dns | string | +| `path_routing` | Enable path routing ("true") vs domain-based routing ("false") | string | +| `tags` | Arbitrary key-value pairs for AWS resource tagging | object | -```bash -k get svc -n ingress-nginx ingress-nginx-controller -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' -``` +> [!TIP] +> If these values are updated after installation, ensure to run the command in the next step to update the values in AWS Secret Manager. Otherwise, the updated values will not reflect in the live installation. + +#### 🔒 Create Secrets in AWS Secret Manager -### If you installed it without Cert Manager. +The values required for the installation are stored in AWS Secret Manager in two secrets: -If you set `MANAGED_CERT=false`, you are responsible for managing TLS certs, thus cert-manager is not installed. You must [create TLS secrets accordingly](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls). +1. **cnoe-ref-impl/config:** Stores values from **`config.yaml`** in JSON +2. **cnoe-ref-impl/github-app:** Stores GitHub App credentials with file name as key and content of the file as value from **private** directory. -Run the following command to find where to create secrets. +Run the command below to create new secrets or update the existing secrets if they already exist. ```bash -output=$(kubectl get ingress --all-namespaces -o json | jq -r '.items[] | "\(.metadata.namespace) \(.spec.rules[].host) \(.spec.tls[].secretName)"') -echo -e "Namespace \t Hostname \t TLS Secret Name" -echo -e "$output" +./scripts/create-config-secrets.sh ``` -Secret format should be something like: +> [!WARNING] +> **DO NOT** move to next steps without completing all the instructions in this step -```yaml -apiVersion: v1 -kind: Secret -metadata: - name: backstage. - namespace: backstage -data: - tls.crt: - tls.key: -type: kubernetes.io/tls +### Step 6. 🚀 Installation +> [!NOTE] +> Before moving forward, ensure that the kubectl context is set to the EKS cluster and the configured AWS IAM role has access to the cluster. -``` +#### ▶️ Start the Installation Process -## What was created? +All the addons are installed as Argo CD apps. At the start of the installation, Argo CD and External Secret Operator are installed on the EKS cluster as a helm chart. Once Argo CD on EKS is up, other addons are installed through it and finally the Argo CD on EKS also manages itself and External Secret Operator. Check out more details about the [installation flow](docs/installation_flow.md). Run the following command to start the installation. + ```bash + scripts/install.sh + ``` -The following components are installed if you chose the full installation option. +#### 📊 Monitor Installation Process -| Name | Version | -|---|---| -| argo-workflows | v3.4.8 | -| argocd | v2.7.6 | -| aws-load-balancer-controller | v2.5.3 | -| backstage | v1.16.0 | -| cert-manager | v1.12.2 | -| crossplane | v1.12.2 | -| external-dns | v0.13.5 | -| ingress-nginx | v1.8.0 | -| keycloak | v22.0.0 | -| external-secrets | v0.9.2 | +The installation script will continue to run until all the Argo CD apps for addons are healthy. To monitor the process, use the instructions below to access the instance of Argo CD running on EKS. -### Things created outside of the cluster +Check if the kubectl context is set to the EKS cluster and it can access the EKS cluster. Then, start the kubernetes port-forward session for the Argo CD service and access the Argo CD UI in a browser. In the Argo CD UI, monitor the health of all Argo CD Apps -If full installation is done, you should have these DNS entries available. They all point to the Network Load Balancer. + ```bash + kubectl port-forward -n argocd svc/argocd-server 8080:80 + ``` -- `backstage.` -- `argo.` -- `keycloak.` +Depending upon the configuration, Argo CD will be accessible at http://localhost:8080 or http://localhost:8080/argocd. -You can confirm these by querying at a register. +The credentials for Argo CD can be retrieved with the following command: ```bash -dig A `backstage.` @1.1.1.1 - -kubectl get svc -n ingress-nginx +kubectl get secrets -n argocd argocd-initial-admin-secret -oyaml | yq '.data.password' | base64 -d && echo ``` -A Network Load Balancer is also created. This is managed by the AWS Load Balancer Controller and points to ingress-nginx pod. This pod is responsible for routing requests to correct places. As a result, HTTPS endpoints are created with valid certificates. +### Step 7. 🌐 Accessing the Platform -```bash -openssl s_client -showcerts -servername id. -connect id.:443 <<< "Q" -curl https://backstage. +The addons with Web UI are exposed using the base domain configured in [Step 5](#️-configure-reference-implementation). The URLs can be retrieved by running the following command: +``` +scripts/get-urls.sh ``` +The URL depends on the setting for `path_routing`. Refer to following table for URLs: -## How to access the Backstage instance? +| App Name | URL (w/ Path Routing) | URL (w/o Path Routing) | +| --------- | --------- | --------- | +| Backstage | https://[domain] | https://backstage.[domain] | +| Argo CD | https://[domain]/argocd | https://argocd.[domain] | +| Argo Workflows | https://[domain]/argo-workflows | https://argo-workflows.[domain] | -When you open a browser window and go to `https://backstage.`, you should be prompted to login. -Two users are created during the installation process: `user1` and `user2`. Their passwords are available in the keycloak namespace. +All the addons are configured with Keycloak SSO USER1 and the user password for it can be retrieved using the following command: ```bash -k get secrets -n keycloak keycloak-user-config -o go-template='{{range $k,$v := .data}}{{printf "%s: " $k}}{{if not $v}}{{$v}}{{else}}{{$v | base64decode}}{{end}}{{"\n"}}{{end}}' +kubectl get secret -n keycloak keycloak-config -o jsonpath='{.data.USER1_PASSWORD}' | base64 -d && echo ``` +Once all the Argo CD apps on the EKS cluster are reporting healthy status, try out the [examples](docs/examples/) to create a new application through Backstage. +For troubleshooting, refer to the [troubleshooting guide](docs/troubleshooting.md). -## Uninstall -1. Run `setups/uninstall.sh` and follow the prompts. -2. Remove GitHub app from your Organization by following [these steps](https://docs.github.com/en/apps/maintaining-github-apps/deleting-a-github-app). -3. Remove token from your GitHub Organization by following [these steps](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization). -4. Remove the created GitHub Organization. - -
- Uninstall details - -### Resources deleted - -Currently resources created by applications are not deleted. For example, if you have Spark Jobs running, they are not deleted and may block deletion of the spark-operator app. - -
- -## What can you do in Backstage? -See [this doc](./demo.md) for demos! +## Cleanup +> [!WARNING] +> Before proceeding with the cleanup, ensure any Kubernetes resources created outside of the installation process such as Argo CD Apps, deployments, volumes etc. are deleted. -## Possible issues +Run the following command to remove all the addons created by this installation: -### Cert-manager -- by default it uses http-01 challenge. If you'd prefer using dns-01, you can update the ingress files. TODO AUTOMATE THIS -- You may get events like `Get "http:///.well-known/acme-challenge/09yldI6tVRvtWVPyMfwCwsYdOCEGGVWhmb1PWzXwhXI": dial tcp: lookup on 10.100.0.10:53: no such host`. This is due to DNS propagation delay. It may take ~10 minutes. - -## Troubleshooting - -See [the troubleshooting doc](TROUBLESHOOTING.md) for more information. - -## Creation Order notes -
- Click to expand - -## Things created outside of the cluster with Keycloak SSO enabled. - -- Route53 records. Route53 hosted zones are not created. You must also register it if you want to be able to access through public DNS. These are managed by the external DNS controller. - -- AWS Network Load Balancer. This is just the entrance to the Kubernetes cluster. This points to the default installation of Ingress Nginx and is managed by AWS Load Balancer Controller. - -- TLS Certificates issued by Let's Encrypt. These are managed by cert-manager based on values in Ingress. They use the production issuer which means we must be very careful with how many and often we request certificates from them. The uninstall scripts backup certificates to the `private` directory to avoid re-issuing certificates. - -These resources are controlled by Kubernetes controllers and thus should be deleted using controllers. - -### Keycloak SSO with DNS and TLS certificates - -If using keycloak SSO with fully automated DNS and certificate management, it must be: - -1. aws-load-balancer-controller -2. ingress-nginx -3. cert-manager -4. external-dns -5. keycloak -6. The rest of stuff - - -### Keycloak SSO with manual DNS and TLS Certificates - -If using keycloak SSO but manage DNS records and certificates manually. - -1. aws-load-balancer-controller -2. ingress-nginx -3. The rest of stuff minus cert-manager and external-dns - -In this case, you can issue your own certs and provide them as TLS secrets as specified in the `spec.tls[0].secretName` field of Ingress objects. -You can also let NLB or ALB terminate TLS instead using the LB controller. This is not covered currently, but possible. - -### No SSO +``` +scripts/uninstall.sh +``` -If no SSO, no particular installation order. Eventual consistency works. +This script will only remove resources other than CRDs from the EKS cluster so that the same cluster can be used for re-installation which is useful during development. To remove CRDs, use the following command: -
+``` +scripts/cleanup-crds.sh +``` diff --git a/TROUBLESHOOTING.md b/TROUBLESHOOTING.md deleted file mode 100644 index 2490bd1b4..000000000 --- a/TROUBLESHOOTING.md +++ /dev/null @@ -1,72 +0,0 @@ - -# Troubleshooting steps - -All applications are deployed as ArgoCD application. The best way is to navigate to ArgoCD UI and look at logs for each application. - -```bash -# Get the admin ArgoCD password -kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d -# Port forward to 8081. 8080 could be in-use by the install / uninstall scripts. -kubectl port-forward svc/argocd-server -n argocd 8081:80 - -Go to http://localhost:8081 -``` - - -# Common issues - -## Argo Workflows - -### Argo Workflows controller stuck in Crash Loop. - -You may see error message like: - -``` -Error: Get "https:///realms/cnoe/.well-known/openid-configuration": dial tcp: lookup on 10.100.0.10:53: no such host -``` - -This is due to DNS propagation delay in the cluster. Once DNS entries are propagated (may take ~10 min), pods should start running. - -## Backstage - -### Backstage pod stuck in crash loop - -You may see error message like: - -``` -Error: getaddrinfo ENOTFOUND keycloak.a2.mccloman.people.aws.dev - at GetAddrInfoReqWrap.onlookup [as oncomplete] (node:dns:107:26) { - errno: -3008, - code: 'ENOTFOUND', - syscall: 'getaddrinfo', - hostname: 'keycloak.' - -} -``` -This is due to DNS propagation delay in the cluster. Once DNS entries are propagated (may take ~10 min), pods should start running. - - -## Certificates - -General steps are [outlined here](https://cert-manager.io/docs/troubleshooting/). - -### Certificates not issued -You may see something like this - -```bash -$ kubectl -n argo get certificate -NAME READY SECRET AGE -argo-workflows-prod-tls FALSE argo-workflows-prod-tls 3m52s - -$ kubectl -n argo get challenge -NAME STATE DOMAIN AGE -argo-workflows-prod-tls-qxfjq-1305584735-1533108683 pending argo. 91s -``` - -If you describe the challenge, you may see something like this. - -``` -Reason: Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://argo.DOMAIN_NAME/.well-known/acme-challenge/6AQ5cRc7J6FNQ9xGOBDI5_G1lHsNM5J5ivbS3iSHd3c': Get "http://argo.DOMAIN_NAME/.well-known/acme-challenge/6AQ5cRc7J6FNQ9xGOBDI5_G1lHsNM5J5ivbS3iSHd3c": dial tcp: lookup argo.DOMAIN_NAME on 10.100.0.10:53: no such host -``` -This is due to DNS propagation delay in the cluster. Once DNS entries are propagated (may take ~10 min), certs should be issued. - diff --git a/cluster/eksctl/README.md b/cluster/eksctl/README.md new file mode 100644 index 000000000..23c8a481c --- /dev/null +++ b/cluster/eksctl/README.md @@ -0,0 +1,82 @@ +# EKS Cluster Setup with eksctl + +This directory contains the configuration to create an EKS cluster with pod identity associations for various AWS services. + +## Prerequisites + +- AWS CLI configured with appropriate permissions +- eksctl installed + +## Create Cluster +Run the following command and follow the instructions: + +```bash +export REPO_ROOT=$(git rev-parse --show-toplevel) +$REPO_ROOT/scripts/create-cluster.sh +``` + +## AWS Resources Created + +The cluster creation will provision the following AWS resources: + +### EKS Cluster +- EKS cluster with Kubernetes version 1.33 +- VPC with CIDR 10.0.0.0/16 +- Single NAT Gateway +- Public and private subnets across availability zones +- EKS cluster security groups +- OIDC identity provider + +### Managed Node Group _(For Non-Auto Mode cluster)_ +- Managed node group with 3-6 m5.large instances +- Desired capacity: 4 nodes +- 100GB EBS volumes per node +- Node IAM role with required policies + +### EKS Addons _(For Non-Auto Mode cluster)_ +- eks-pod-identity-agent +- aws-ebs-csi-driver with EBS CSI controller policies +- vpc-cni (default) +- coredns (default) +- kube-proxy (default) + +### Pod Identity Associations +- **crossplane-system/provider-aws**: AdministratorAccess + permissions boundary +- **external-secrets/external-secrets**: Secrets Manager access policies +- **kube-system/aws-load-balancer-controller**: AWS Load Balancer Controller policies +- **external-dns/external-dns**: Route 53 DNS management policies + +### IAM Resources +- IAM roles for pod identity associations +- IAM policies for service-specific permissions +- OIDC identity provider for the cluster + +## Cleanup + +> [!CAUTION] +> Ensure all workloads are removed from the cluster before destroying to avoid orphaned resources. + +To delete the cluster and all associated resources: + +```bash +# Delete the EKS cluster +export $CLUSTER_NAME="cnoe-ref-impl" +export AWS_REGION="us-west-2" +eksctl delete cluster --name $CLUSTER_NAME --region $AWS_REGION + +# Delete the permissions boundary policy +export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) +aws iam delete-policy --policy-arn arn:aws:iam::${AWS_ACCOUNT_ID}:policy/crossplane-permissions-boundary +``` + +This will automatically clean up the following: +- EKS cluster +- Managed node groups +- Pod identity associations +- IAM roles and policies created by eksctl +- VPC and networking resources (if created by eksctl) +- EKS addons +- Crossplane permissions boundary policy + +> [!NOTE] +> Manual cleanup may be required for any resources created outside of eksctl or if the deletion process encounters errors. diff --git a/cluster/eksctl/cluster-config-auto.yaml b/cluster/eksctl/cluster-config-auto.yaml new file mode 100644 index 000000000..ff9c19b2f --- /dev/null +++ b/cluster/eksctl/cluster-config-auto.yaml @@ -0,0 +1,46 @@ +apiVersion: eksctl.io/v1alpha5 +kind: ClusterConfig +metadata: + name: ${CLUSTER_NAME} + region: ${AWS_REGION} + version: "1.33" + tags: + githubRepo: "github.com/cnoe-io/reference-implementation-aws" + env: "dev" + project: "cnoe" +vpc: + cidr: "10.0.0.0/16" + nat: + gateway: Single +autoModeConfig: + enabled: true +iam: + withOIDC: true + podIdentityAssociations: + - namespace: crossplane-system + serviceAccountName: provider-aws + permissionPolicyARNs: + - "arn:aws:iam::aws:policy/AdministratorAccess" + permissionsBoundaryARN: "${CROSSPLANE_BOUNDARY_POLICY_ARN}" + - namespace: external-secrets + serviceAccountName: external-secrets + permissionPolicy: + Version: "2012-10-17" + Statement: + - Action: + - "secretsmanager:ListSecrets" + - "secretsmanager:BatchGetSecretValue" + Effect: "Allow" + Resource: "*" + - Effect: "Allow" + Action: + - "secretsmanager:GetResourcePolicy" + - "secretsmanager:GetSecretValue" + - "secretsmanager:DescribeSecret" + - "secretsmanager:ListSecretVersionIds" + Resource: + - "arn:aws:secretsmanager:us-west-2:${AWS_ACCOUNT_ID}:secret:cnoe-ref-impl/*" + - namespace: external-dns + serviceAccountName: external-dns + wellKnownPolicies: + externalDNS: true diff --git a/cluster/eksctl/cluster-config.yaml b/cluster/eksctl/cluster-config.yaml new file mode 100644 index 000000000..f5fcc5d0f --- /dev/null +++ b/cluster/eksctl/cluster-config.yaml @@ -0,0 +1,69 @@ +apiVersion: eksctl.io/v1alpha5 +kind: ClusterConfig +metadata: + name: ${CLUSTER_NAME} + region: ${AWS_REGION} + version: "1.33" + tags: + githubRepo: "github.com/cnoe-io/reference-implementation-aws" + env: "dev" + project: "cnoe" +vpc: + cidr: "10.0.0.0/16" + nat: + gateway: Single +managedNodeGroups: + - name: managed-ng-1 + instanceType: m5.large + minSize: 3 + maxSize: 6 + desiredCapacity: 4 + volumeSize: 100 + ssh: + allow: false + labels: + pool: system +addonsConfig: + autoApplyPodIdentityAssociations: true +addons: + - name: eks-pod-identity-agent + - name: aws-ebs-csi-driver + podIdentityAssociations: + - namespace: kube-system + serviceAccountName: ebs-csi-controller-sa + wellKnownPolicies: + ebsCSIController: true +iam: + withOIDC: true + podIdentityAssociations: + - namespace: crossplane-system + serviceAccountName: provider-aws + permissionPolicyARNs: + - "arn:aws:iam::aws:policy/AdministratorAccess" + permissionsBoundaryARN: "${CROSSPLANE_BOUNDARY_POLICY_ARN}" + - namespace: external-secrets + serviceAccountName: external-secrets + permissionPolicy: + Version: "2012-10-17" + Statement: + - Action: + - "secretsmanager:ListSecrets" + - "secretsmanager:BatchGetSecretValue" + Effect: "Allow" + Resource: "*" + - Effect: "Allow" + Action: + - "secretsmanager:GetResourcePolicy" + - "secretsmanager:GetSecretValue" + - "secretsmanager:DescribeSecret" + - "secretsmanager:ListSecretVersionIds" + Resource: + - "arn:aws:secretsmanager:us-west-2:${AWS_ACCOUNT_ID}:secret:cnoe-ref-impl/*" + - namespace: kube-system + serviceAccountName: aws-load-balancer-controller + wellKnownPolicies: + awsLoadBalancerController: true + - namespace: external-dns + serviceAccountName: external-dns + wellKnownPolicies: + externalDNS: true diff --git a/cluster/iam-policies/crossplane-permissions-boundry.json b/cluster/iam-policies/crossplane-permissions-boundry.json new file mode 100644 index 000000000..f7f6f3ded --- /dev/null +++ b/cluster/iam-policies/crossplane-permissions-boundry.json @@ -0,0 +1,65 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "DenyPermBoundaryIAMPolicyAlteration", + "Effect": "Deny", + "Action": [ + "iam:DeletePolicy", + "iam:DeletePolicyVersion", + "iam:CreatePolicyVersion", + "iam:SetDefaultPolicyVersion" + ], + "Resource": [ + "arn:aws:iam::${AWS_ACCOUNT_ID}:policy/crossplane-permissions-boundary" + ] + }, + { + "Sid": "DenyRemovalOfPermBoundaryFromAnyUserOrRole", + "Effect": "Deny", + "Action": [ + "iam:DeleteUserPermissionsBoundary", + "iam:DeleteRolePermissionsBoundary" + ], + "Resource": [ + "arn:aws:iam::${AWS_ACCOUNT_ID}:user/*", + "arn:aws:iam::${AWS_ACCOUNT_ID}:role/*" + ], + "Condition": { + "StringEquals": { + "iam:PermissionsBoundary": "arn:aws:iam::${AWS_ACCOUNT_ID}:policy/crossplane-permissions-boundary" + } + } + }, + { + "Effect": "Deny", + "Action": [ + "iam:CreateUser", + "iam:AddUserToGroup", + "iam:AttachUserPolicy", + "iam:ChangePassword", + "iam:CreateAccessKey", + "iam:*AccountAlias", + "iam:CreateGroup", + "iam:*LoginProfile", + "iam:*IDConnectProvider*", + "iam:*SAMLProvider*", + "iam:CreateServiceSpecificCredential", + "iam:*MFA*", + "iam:UpdateUser" + ], + "Resource": [ + "*" + ] + }, + { + "Effect": "Allow", + "Action": [ + "*" + ], + "Resource": [ + "*" + ] + } + ] + } \ No newline at end of file diff --git a/cluster/iam-policies/external-secrets.json b/cluster/iam-policies/external-secrets.json new file mode 100644 index 000000000..0b28c7584 --- /dev/null +++ b/cluster/iam-policies/external-secrets.json @@ -0,0 +1,25 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Action" : [ + "secretsmanager:ListSecrets", + "secretsmanager:BatchGetSecretValue" + ], + "Effect" : "Allow", + "Resource" : "*" + }, + { + "Effect": "Allow", + "Action": [ + "secretsmanager:GetResourcePolicy", + "secretsmanager:GetSecretValue", + "secretsmanager:DescribeSecret", + "secretsmanager:ListSecretVersionIds" + ], + "Resource": [ + "arn:aws:secretsmanager:us-west-2:${AWS_ACCOUNT_ID}:secret:cnoe-ref-impl/*" + ] + } + ] +} \ No newline at end of file diff --git a/cluster/terraform/README.md b/cluster/terraform/README.md new file mode 100644 index 000000000..926148a84 --- /dev/null +++ b/cluster/terraform/README.md @@ -0,0 +1,96 @@ +# EKS Cluster Setup with Terraform + +This directory contains Terraform configuration to create an EKS cluster with pod identity associations for various AWS services. The configuration supports both standard EKS clusters and EKS Auto Mode. + +## Prerequisites + +- AWS CLI configured with appropriate permissions +- Terraform >= 1.0 installed + +## Create Cluster +Run the following command and follow the instructions: + +```bash +export REPO_ROOT=$(git rev-parse --show-toplevel) +$REPO_ROOT/scripts/create-cluster.sh +``` + +## AWS Resources Created + +The Terraform configuration will provision the following AWS resources: + +### EKS Cluster +- EKS cluster with Kubernetes version 1.33 +- VPC with CIDR 10.0.0.0/16 +- Single NAT Gateway +- Public and private subnets across 3 availability zones +- EKS cluster security groups +- OIDC identity provider + +### Compute Resources + +#### Auto Mode (when `auto_mode = true`) +- EKS Auto Mode enabled with general-purpose node pools +- Automatic compute resource management + +#### Standard Mode (when `auto_mode = false`) +- Managed node group with 3-6 m5.large instances +- Desired capacity: 4 nodes +- 100GB EBS volumes per node +- Node IAM role with required policies + +### EKS Addons + +#### Auto Mode +- All addons managed automatically by EKS Auto Mode +- No explicit addon configuration required + +#### Standard Mode +- eks-pod-identity-agent +- aws-ebs-csi-driver with EBS CSI controller policies +- vpc-cni +- coredns +- kube-proxy + +### Pod Identity Associations + +#### Always Created (Both Modes) +- **crossplane-system/provider-aws**: AdministratorAccess + permissions boundary +- **external-secrets/external-secrets**: Secrets Manager access policies +- **external-dns/external-dns**: Route 53 DNS management policies + +#### Standard Mode Only +- **kube-system/aws-load-balancer-controller**: AWS Load Balancer Controller policies +- **kube-system/ebs-csi-controller-sa**: EBS CSI driver policies + +### IAM Resources +- IAM roles for pod identity associations +- IAM policies for service-specific permissions +- OIDC identity provider for the cluster +- Crossplane permissions boundary policy + +## Cleanup + +> [!CAUTION] +> Ensure all workloads are removed from the cluster before destroying to avoid orphaned resources. + +To delete the cluster and all associated resources: + +```bash +# Destroy the Terraform-managed resources +export REPO_ROOT=$(git rev-parse --show-toplevel) +export export TF_VAR_auto_mode="true" # set this to "false" if using non-auto mode +terraform -chdir=$REPO_ROOT/cluster/terraform destroy +``` + +This will clean up: +- EKS cluster +- Managed node groups (if using standard mode) +- Pod identity associations +- IAM roles and policies created by Terraform +- VPC and networking resources +- EKS addons +- Crossplane permissions boundary policy + +> [!NOTE] +> Manual cleanup may be required for any resources created outside of Terraform or if the deletion process encounters errors. \ No newline at end of file diff --git a/cluster/terraform/main.tf b/cluster/terraform/main.tf new file mode 100644 index 000000000..592fbd15c --- /dev/null +++ b/cluster/terraform/main.tf @@ -0,0 +1,242 @@ +provider "aws" { + region = var.region +} + +data "aws_eks_cluster_auth" "this" { + name = module.eks.cluster_name +} + +data "aws_caller_identity" "current" {} +data "aws_availability_zones" "available" {} + +data "template_file" "crossplane_boundary_policy" { + template = file("${path.module}/../iam-policies/crossplane-permissions-boundry.json") + vars = { + AWS_ACCOUNT_ID = data.aws_caller_identity.current.account_id + } +} + +data "template_file" "external_secret_policy" { + template = file("${path.module}/../iam-policies/external-secrets.json") + vars = { + AWS_ACCOUNT_ID = data.aws_caller_identity.current.account_id + } +} +locals { + name = var.cluster_name + region = var.region + + vpc_cidr = "10.0.0.0/16" + azs = slice(data.aws_availability_zones.available.names, 0, 3) + + tags = { + githubRepo = "github.com/cnoe-io/reference-implementation-aws" + env = "dev" + project = "cnoe" + } +} + +################################################################################ +# Cluster +################################################################################ + +module "eks" { + source = "terraform-aws-modules/eks/aws" + version = "~> 20.37" + + cluster_name = local.name + cluster_version = "1.33" + cluster_endpoint_public_access = true + + enable_cluster_creator_admin_permissions = true + + vpc_id = module.vpc.vpc_id + subnet_ids = module.vpc.private_subnets + + enable_irsa = true + + # EKS Auto Mode configuration + # When enabled, EKS automatically manages compute resources and core addons + # This eliminates the need for managed node groups and manual addon management + cluster_compute_config = var.auto_mode ? { + enabled = true + node_pools = ["general-purpose", "system"] + } : null + + # Only create managed node groups when not using Auto Mode + # Auto Mode handles compute resources automatically + eks_managed_node_groups = var.auto_mode ? {} : { + initial = { + instance_types = ["m5.large"] + + min_size = 3 + max_size = 6 + desired_size = 4 + + disk_size = 100 + + labels = { + pool = "system" + } + } + } + + # Conditional cluster addons based on Auto Mode + # Auto Mode automatically manages: CoreDNS, kube-proxy, VPC CNI, EBS CSI driver, AWS Load Balancer Controller, eks-pod-identity-agent + cluster_addons = var.auto_mode ? { + # Auto Mode manages all addons automatically - no explicit addon configuration needed + } : { + # Standard mode requires all addons to be explicitly managed + coredns = {} + eks-pod-identity-agent = {} + kube-proxy = {} + vpc-cni = {} + aws-ebs-csi-driver = {} + } + + tags = local.tags +} + + +################################################################################ +# IAM Policies +################################################################################ + +resource "aws_iam_policy" "crossplane_boundary" { + name = "crossplane-permissions-boundary" + policy = data.template_file.crossplane_boundary_policy.rendered + + tags = local.tags +} + +################################################################################ +# Pod Identity +################################################################################ + +# AWS Load Balancer Controller - Only needed when not using Auto Mode +module "aws_load_balancer_controller_pod_identity" { + count = var.auto_mode ? 0 : 1 + source = "terraform-aws-modules/eks-pod-identity/aws" + version = "~> 1.0" + + name = "aws_load_balancer_controller" + attach_aws_lb_controller_policy = true + associations = { + external_secrets = { + cluster_name = module.eks.cluster_name + namespace = "kube-system" + service_account = "aws-load-balancer-controller" + } + } + + tags = local.tags +} + +# External DNS - Required for both Auto Mode and standard mode +module "external_dns_pod_identity" { + source = "terraform-aws-modules/eks-pod-identity/aws" + version = "~> 1.0" + + name = "external-dns" + attach_external_dns_policy = true + external_dns_hosted_zone_arns = [ "*" ] + associations = { + external_secrets = { + cluster_name = module.eks.cluster_name + namespace = "external-dns" + service_account = "external-dns" + } + } + tags = local.tags +} + +# EBS CSI Driver - Only needed when not using Auto Mode +module "ebs_csi_driver_pod_identity" { + count = var.auto_mode ? 0 : 1 + source = "terraform-aws-modules/eks-pod-identity/aws" + version = "~> 1.0" + + name = "ebs-csi-driver" + attach_aws_ebs_csi_policy = true + associations = { + external_secrets = { + cluster_name = module.eks.cluster_name + namespace = "kube-system" + service_account = "ebs-csi-controller-sa" + } + } + tags = local.tags +} + +# Crossplane - Required for both Auto Mode and standard mode +module "crossplane_pod_identity" { + source = "terraform-aws-modules/eks-pod-identity/aws" + version = "~> 1.0" + + name = "crossplane-provider-aws" + + additional_policy_arns = { + admin = "arn:aws:iam::aws:policy/AdministratorAccess" + } + permissions_boundary_arn = aws_iam_policy.crossplane_boundary.arn + + associations = { + crossplane = { + cluster_name = module.eks.cluster_name + namespace = "crossplane-system" + service_account = "provider-aws" + } + } + + tags = local.tags +} + +# External Secrets - Required for both Auto Mode and standard mode +module "external_secrets_pod_identity" { + source = "terraform-aws-modules/eks-pod-identity/aws" + version = "~> 1.0" + + name = "external-secrets" + attach_custom_policy = true + override_policy_documents = [data.template_file.external_secret_policy.rendered] + associations = { + external_secrets = { + cluster_name = module.eks.cluster_name + namespace = "external-secrets" + service_account = "external-secrets" + } + } + + tags = local.tags +} + +################################################################################ +# VPC +################################################################################ + +module "vpc" { + source = "terraform-aws-modules/vpc/aws" + version = "~> 5.0" + + name = local.name + cidr = local.vpc_cidr + + azs = local.azs + private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)] + public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)] + + enable_nat_gateway = true + single_nat_gateway = true + enable_dns_hostnames = true + enable_dns_support = true + + public_subnet_tags = { + "kubernetes.io/role/elb" = 1 + } + + private_subnet_tags = { + "kubernetes.io/role/internal-elb" = 1 + } + + tags = local.tags +} \ No newline at end of file diff --git a/cluster/terraform/outputs.tf b/cluster/terraform/outputs.tf new file mode 100644 index 000000000..0873d1f22 --- /dev/null +++ b/cluster/terraform/outputs.tf @@ -0,0 +1,39 @@ +output "cluster_name" { + description = "EKS cluster name" + value = module.eks.cluster_name +} + +output "cluster_endpoint" { + description = "Endpoint for EKS control plane" + value = module.eks.cluster_endpoint +} + +output "cluster_security_group_id" { + description = "Security group ids attached to the cluster control plane" + value = module.eks.cluster_security_group_id +} + +output "region" { + description = "AWS region" + value = var.region +} + +output "cluster_arn" { + description = "The Amazon Resource Name (ARN) of the cluster" + value = module.eks.cluster_arn +} + +output "oidc_provider_arn" { + description = "The ARN of the OIDC Provider if enabled" + value = module.eks.oidc_provider_arn +} + +output "auto_mode_enabled" { + description = "Whether EKS Auto Mode is enabled" + value = var.auto_mode +} + +output "configure_kubectl" { + description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig" + value = "aws eks --region ${var.region} update-kubeconfig --name ${module.eks.cluster_name}" +} \ No newline at end of file diff --git a/cluster/terraform/variables.tf b/cluster/terraform/variables.tf new file mode 100644 index 000000000..446e13fc4 --- /dev/null +++ b/cluster/terraform/variables.tf @@ -0,0 +1,18 @@ +variable "cluster_name" { + description = "Name of the EKS cluster" + type = string + default = "cnoe-ref-impl" +} + +variable "region" { + description = "AWS region" + type = string + default = "us-west-2" +} + +variable "auto_mode" { + description = "Enable EKS Auto Mode. When enabled, EKS automatically manages compute resources and many addons." + type = bool + default = false +} + diff --git a/cluster/terraform/versions.tf b/cluster/terraform/versions.tf new file mode 100644 index 000000000..4c65a71d3 --- /dev/null +++ b/cluster/terraform/versions.tf @@ -0,0 +1,9 @@ +terraform { + required_version = ">= 1.0" + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.0" + } + } +} \ No newline at end of file diff --git a/config.yaml b/config.yaml new file mode 100644 index 000000000..59243137d --- /dev/null +++ b/config.yaml @@ -0,0 +1,35 @@ +### Config for CNOE AWS Reference Implementation ### +# Source: "https://github.com/cnoe/reference-implementation-aws" + +# Details of your repository fork +repo: + url: "https://github.com/cnoe-punkwalker/reference-implementation-aws" # This is the GITHUB URL of the fork in Github Org that you have created. + revision: "HEAD" # Branch or Tag which should be used for Argo CD Apps + basepath: "packages" # Directory in which configuration of addons is stored + +# The name of the EKS cluster you are installing the reference implementation on. +cluster_name: "cnoe-ref-impl" +# Set this to "true" if EKS cluster is Auto Mode othewise "false" +# !!! Note: This is a string value as it is passed on to the Argo CD cluster secret as label +auto_mode: "true" +# AWS Region of the EKS cluster and cnoe-reference-implementation-aws config secret +region: "us-west-2" + +# Base Domain name used for exposing services. It should be a subdomain or main domain of the Route53 hosted zone. +domain: + +# Route53 hosted zone ID for configuring external-dns +route53_hosted_zone_id: + +# Set this to "true" if you want to enable path routing othewise "false" for domain based routing. +# When enabled, the exposed addons will be accessible at https:/// +# When disabled, the exposed addons will be accessible at https://. +# !!! Note: This is a string value as it is passed on to the Argo CD cluster secret as label +path_routing: "true" + +# Tags for AWS resources +tags: + githubRepo: "github.com/cnoe-io/reference-implementation-aws" + env: "dev" + project: "cnoe" + \ No newline at end of file diff --git a/setups/argocd/install-sso.sh b/docs/examples/app-with-aws-resources.md similarity index 100% rename from setups/argocd/install-sso.sh rename to docs/examples/app-with-aws-resources.md diff --git a/demo.md b/docs/examples/demo.md similarity index 100% rename from demo.md rename to docs/examples/demo.md diff --git a/examples/spark/pi.yaml b/docs/examples/spark/pi.yaml similarity index 100% rename from examples/spark/pi.yaml rename to docs/examples/spark/pi.yaml diff --git a/examples/template-generation/data-on-eks.yaml b/docs/examples/template-generation/data-on-eks.yaml similarity index 100% rename from examples/template-generation/data-on-eks.yaml rename to docs/examples/template-generation/data-on-eks.yaml diff --git a/docs/images/argocd-github-app.png b/docs/images/argocd-github-app.png new file mode 100644 index 0000000000000000000000000000000000000000..8834ab6cb4a91558dcbbcf6dca910de14d5e026a GIT binary patch literal 48479 zcmZUa1z23Ywy<&6V#Qqw#ih7Qai_)I2X`+FMT@)B(hlzKPzEXPuElkrID`Dt@0@$@ z`S0D&lSy`DB|BNOce3&(T0>0%8-ol34h{}m@x81T92}wm92`6z8VW4Nf^ka*c4K5O zBcq`xBSWL%?qXvPu!e(UN%BgZVC!>xJ!ooaP>Yug?28W`&CUXDf6>6HPohS>Uh}Ch zbrKJHr^tR!&VU*McNP;X`wTCaI^*o_uF+o8l@Ez<+PS|v^SeHK3iS6c>@9thR)=_~ zGLEJm*PfpK!6=@DVo?^+mrtx5;p=3D?A_V5ZeU`?>{{aW!q%?C^La3YU+8qHRp`w7 zd2B(~<8A)jkC3RxHXe7gON_`S_u=2hTO2a!uhyFdHMa<2i-@{dZ1?)4whXtt#Y+3b zF@K)f#TArnc{*snEcY(2lTN&q{eBzepJkS;@5e#+Wi#d7C`D3;&Esws4LM5__eW-_ z7wTD~ma+5Bi0dQlbZl^11?z+^9$K0_9a9pZ|gJof9Fwy`G2oOnEPAiUp``T z1RN^t?iI}W79#vtZbX4X#QzGzAsp-`Bs|Y3*zOKQ%df{QI$B56Jm9g_E0ui}Sx_ z!-|UjjTP3g_q7J-%i24^`V3ZwIL|vC(SP#)pOpWp@jps_{GXD7JpW(G|48}YC3QWl z-DO;yU{!jG|Icv!yW0Ou{C7c7&c9FoA3gD}ZvH10*3aS?qMZLdX5tu77pocAFjCmd zs_Vdfn3DZ-MZtbqVD7IEbH4NSt7kB!m4s82mD2HrKQTrPB4*QxoXM6kM=hgo)XedCxsHd$k7EZwg12z3 zK2nk}!AS7`mpDm0mMb*0+Ba7T8qWWJ6aLA?a7<4!ujY^D$2 zo)qF|7MIv2Y_xZlk+DLR4Ht^*epuQ)RUz`(KHVfXp8>8q$=d~r?-p4MlIwD8Dp!dA z1SDg~L`oW|5K<~iNQG8}BpQjwk2`89^Z$+%VtYe>X>~vb=ATo2t3bkEEmN#k0Ga@C zfJRf6Xe&3W>K=55wG%*%bNmWw`m)UR>PyxmmkrZXNuH0g=?)6{rWJT5G}TZOsnG9E zd91S~4sybQk4R5#W~x&5=?z72^my(T+I3cnWqO@BjJoAgj7q76mI?`zfBHQzxR5?~ z+efqeYo1<0yxWt2Ir}q5rY7FX5;^GVMt<@Biq=+n-$f*z*h@gN3gOzHd1{Y<&6k@= zpN>lKNR+3xwmdUYx$aDjzB9ZKo3?&MO^c5y>m5> z1f6;0Ab&rw`(^ZoY8)2&-iK_yp&$= zet;PoO46iDKufB>bTxS}sWu&+_Ezd0*9Abch)4Geo7`QTWc-EM!^Yg3tIO57@Y~dP zt%dqdM;nzthW|_+bla&fYq~7WwMwo_bsEfX3kYcMo+7x%#c3c&ZLE zm1PIWs}&ZJX0=vML;moyGEF+|H-6vwb3sT-HNbGmM=6-B#=GELM4crVlPg7&+2sTB zd_LJC(QP!!ZChOL8w{h{!!@4I3Mq;%JNcv@JXR1fqKmG{HNt*I-(#^o$h zbg`1p#rI$I8;_@l4NAB+uB1aEC4%@l5xQ)X+d<=QuTgR zIv=}2F5ihhZ2Y)dsEdPtCl#gIlSl+bprsY4{h_3tap|x5E7{!n6Gp8YkYR#AcwHi0 zDMAjTwpL0wQR=hmg>=r<)Tecw2vsMw9lPO2N(xV>k9lWjQ+jK+?|9Rv3X}zQNKrDg zBAA?aZ-V&z?wJY}@GZ6pzDeh8b(v6>1m%?-QBgfVa4rW8H4A_X$m7v4i`36LbnKB5 zsd;~Ce{crHwd2--XyOeP)V?vzv6fz;cK@kjEYog%du>CYgf`k_CcLYR;D<^?Vga<} zao^lk)8Y+y63Fg1$o?MA<4NQg`!(lD^@Kcm7CUB{;zYyr57lR?!8mmhm3> z`%n`~-J+1(_L$&2NO#_!fTsXWp__nErx)YCkfIaqXRU7?gYTnM*DV8^s^DH?63z}( z8SgeC)=IA)6K166Q_Ds8K;oxlWe@WZaY@elrJ_dDzN_61CjP_D4H*}CO4!h~;E~_q zuLU||UaQztttk~ecJ|zNl-ItQVS8s(_<%4P38Cbl@>BE15J31!BY+IW`Qe3(ADW1l zGwp^x+aM=m(C+YtQncp7+P=`fslnT5)m`pxK2hA4h&v2Yue8<@qXUuax1L;C!LHZZ~FC)3o1ul;VMt zf|6t(%HLlLN$gPPFTHc>*|KsRKiDc-{A$9VMiOEsfn(@D`m9oKWP9Hv*5JGkZ@X@g zHmr4Qpm?PJ_|vK|Xsrw>StIVWTlU- zgevIzvm;JK$Im6c^|jI59;rEd{nEW?rvC9emovq*ZRM$7+QkP|>Vw*PO(8f#V@tQ2 zTO(~HBMGK0^OiNJi$AyT`L+u2TvJUuEhWZ2*6WU$G;b}r3~h`Ev>KBDKL}nKTC+jV zE6lW|M9`b43#-haRA;z|DnqN-D{J{uOIqCH(4Num!*=V3MYE<0(flBQUT5+jT*E#= z)vZS;F7*em{eJ39BQJZ6JO^DRnnz-_n(AR3f!gejKzgTDkI9?lbFolUT_7tFOEeU6 zL68+=WQGzHaAe-hL(;gpVdF{2zS0(1xK*C z!279>)iW_0=!%a4O&IHP-s4ZLeyIAFW+x(186??7 zFr;kv5m13(^mCD!c*2Qyf6C&zwint&={TOu24;I{>wnXpDj>Iy+ppJMq>+)wImH{) zUK;%Qa^i_=t`ag(=VHPcJRyC4wlui$DznL}s-U8a-TtwwU;<*4x%r#iTuJ6^|1NHJ zOA@AD_l88!sU(zY7#`JVFk|#%=iKRS+=feJ+g$1ZQa58J1H?vx=P`Z% zvU%bxs1Sm`5Nm041$o_-awm`(wr_5$vXX({4B=VaQULjbsx!z!lpq$kxwtkO!O6`fPQ@Xymg_u^oRt%?FA)5m@q z2e-@i;fm30w-7%) z0ZQyGcX62;{6GcIy9>(at>@kqv>h4ox6E31XLf-(3E1(2A)QeJ;{6MAEswMczLkxv-?Wc zJi(EmH$i%9A5RVa%e;esO~4_((v}R4ygB=xZ1S`#ks+1HBw(0X5xPT{_~}j04gbw` z9Zv43Xzy8H^^u-8U_tF--XB!C^DKU?5;EwwdOY)?K-srS4<7%{c>v?V@|S;xc78rO z3dZYP8k%t8kVicY8zkt@uWQdc3tq?U!(KbM?@-QMr6YS(un3qkb6X(4aaf&pZ#u6+ zx{=OoZ$l`;Wkh7lW89y8F{l!Ad=mAEyNxU7xTVu$X zj*sZJH4qwOpTZ#AT@+83%7%nC9CgFv_OaO}Ushh5d5r8Kpr!VeShjus%|u>4fG2^faAP{*6enqpP1Sj|RD<=zS-HVU+BN%e!iecqtz zOzH?=}ELfQA; zqL_*EOuyo7fmgWCxym4r7H**%&O)hH)t4D&1p5`=frht^@vcron-ffbzFea>y4()( z5nb|~*Rn+>ykVjfzC3A9lk9>*0R}Dh8Dv*x=ZI2wR(6XBL=Dv@$=gfjO;o|=c(O9AMGF}8{iWFk z6Z^%M*4u-TrVEV%p*P@9R;~8hQC~ZJC^F5A-+b_n)xvQ$7-iYlj`gB_Img?`Ug5k` zQept>`d0LHq$K9&UNR)Vul7>!%{MW|!ihyJikRQJva1-Jhx-@$=dKUUu)5n8#aqtWS*V#s+wM&v>^%cdw-@g0{T!cV>4`Q*f0t zhc-JWlcVFCzH>7>Tm<<+nquc}jZ6_Itn7!Weu8Cd$b5}6sw?rxP0^5j#Z$p38R9*T zQx(uBcHz7ro?=GE5~Z9G`q~DgzpFb~}q3lLOp53xta%XB#*5-=h+8D6}&$sJR zB!k#Sg%N69-bG^vgVp1*P6E06b};q`e77tj5WkjR1CXmC;qN{J@{#=@2|^8@R8LfT zPsB``)@_c)GVq5{lmO?+{<{xUM|G|PPj=IR_2?$I1zl}9Jhy!#2kV;M<=0{r$XsxD zrtu(zE)346t7`ux+JgI}-df69skS%wL`2vNSl=O^V;0}8)kV?=Kg#7RKP&0f z20unEK0uTIdbHQ*eJqt^5pKu%w&z^6M9b+bFEXp6Qf}>3#UV5ScwkQmLNK8>0EZYKMzEXGz*67?SxiCF7L6?ghxSrEn!rPV8P(Gdk9 zr4^H47wJvtjdRH0CVco3*@2`)#ws59<8#4taM=tWGBC5*x$C|Cmg|{w{@Y$8DQ6^* ze{~%(R#-49Hb{5WC(Bq?Ic2f%?fEANp-pU~Sre(#{KR9PA*bGVLVGmM>aj%gt}7YzaL677t7$4d747kFn`F$v7Bc=5E*GP%o-gm70{d&t{p)s}#s=%1WNv@>N zADL~W?^R}zAMa9f98qR&uRhYnE_`o$vW%R=Yxw=T+YB)C(&zSttQ3MW`aw0>0tN4< z%a+&tvx6$b`oe^1fcVxesvm;o_uO5YbDY6ob*K-*{X<6Y z-}7SydO?{XY|DvBR*U|RdM)1L9P~2VY(mi7jhW+`*Xam_gX!_!lHIQ$1dLUUS2yof z1B1aPTlH@ra~?KUGrn&ORH|8{&0(9CcaE^Zx`2(#T4Tbi}BfU}W3 zFPPySX9-W>8~tQPg@|3Mn|~URKmC!GlA+fK6*D-%pR0VNa;0%YF~&2y6&tp&ep?%g zzS+#1o|93$Uwv40vUd8A5X{j^E8yK7A{%;~QG|VU^VXQ`XcsOV5uzL=RLB!+_Ue7g zt`q9CuQZ^}&j7ok;SCu|({0dA`@+6W*Y-&l|M^q4rQ%dYs)U&Gv%$(qS_CG zU-d$T*f5Q44Ht&ZBM<#IIWL(AbRNAWGru~8hse?J-2J{$y9CTUu2j%>N5z#+)z^n} zsTLLL2B$wYG=%@jIuH(Wx;)Cxf5?BfZ&dAu`NKvxxp8)aXGW%fS=|aCcryTcPLGKDiqPB$|dDoP}AT+bzu-i^@-2 z?U{wcW)Wm+dj_5%^Mi{9PdK9iMdq~r6dNHt3(L7L%f>5w zGSI66yH>W9(%~0`G=)jWsJb{=7p4Or@yw8qIWQ6b7jikXK467-xfN zGDj_ij=c_lu_5*PK0x0bCHp61Aib7CP^v*0WkrKSzOYhq*c+6Uhs}gE&>mv1PitWsuB~tAJn_oFK^{#od2nzdpps_|IRmYjx z%JJYL^Dryujj0r!K3~*tOiM$|^>loA4esA8x66 z3z~yYA!ZMk`cGY+es%{YmLef&bdH@oXQn|)PO92`#|$aT1Gzx9v4MpfaI66j>1M|GpzRGkNo#v@175jk(2>ct>4)AM=oryiJqwmJZTn|3*=2# z+B#D*5Qew{jj!(?=>)hYq`@jtYt3Yb1~TxKXO#f|AB>r{7AU(@*LTa==A*z?P?bbx zS8;Tl0ExWuxjqmy!odB~-ar72W-J}bq7m7LH4s7L*AdIJyJu%|Op7Ti-JO{!x6J8{DlQ(#|iK%S9)3v}9w4i7$Uk1I^F- z?bXFP&@cSdQn8onFG+qN^1gXx6-5T1(k*UECL>ES6Dn{HHK^Z)%WPA`*QzN@I@Zy+Ab9hHVd&jk4s+{G=iFMJ(2kh5N?i5R3H z=zWDO#S(_T_w87qSsI|iCtb5)e*T)M5zBG0;^AH>gRGCvvb3*rql_=)r`W{P0m`sA z{vB2o9y!UPG0xSekp*SS&nj_|DqBEH4RbdI8GjOaklcUN#IoGw(27XVE5dqy01+B6P`i;5DUz`iBjr`~uyR*Ut>W z#$Ji(WZC=%k&=5NTfO<05`e0sq29yzbvZ8fktAVVfW9S8Z4=`nd}Z0_AJ|;T^2QNq zuSaAlXYSLP#GP0#1F5wN>1@g`SuxZs!4>d8u53M2uV{@cO_qUcHGxz>ICTOH9$X2o zS-@(7AS(k#Z^P$U`&XW__RWyPeu-3U*{I3W;&$<8V)bRe&u1zcZF^iJvDoI+3f^-J znXto1;E)--asK{eL-ata%+o^5A^3@$m7OzMHL`buyEW$P)vQy)-3ZiZdGpY0D3LZb zF|kn1GIV^wG$e0&WKNH4tT(s z7;k(a6FKZo>oCVFCw9t@=UOs2u*Gvxg+hIk!eDPnXamL{&m@ti1_{3*nmM~w)}brlfd&8&bhn55-1M=#k zi}<>ux#EMNs5I+Qag<4e6&K1B@>CWIJhRboFLu0gguo`8ZW8S)6`tvnZz`~*)u_+A zzd@G0e$B<>9pu8a!akDTrBS6 zi^l3FyvlI!+sOBk=ZE3G{t`#Gsa|v(i;ytCC&^o2r%g=|=SK@5bQ(TSG%I&yO=N&N z^UJ}n*muW`U{CQ5AN)GX@ByWCul!Z#&x!tSS8`8&7J!W zb;-X6ui_1v9tJ9U#N%MLdZrx;+v~)eEv{v*6z)br|4_AA$5#^VB_^;pIBer+H)7Fl zERQmjSJkHj_Q6Kh8Y`snCW|%8&m;XcAq_rv9MSyykk)&S%mp+niA6`0mA@-E z4Q;;F8IOhBeIt)kp?Ic!dv_vBG$(O@{MVV5o>4+8`JC;;tB%EpFN?B+V6D<=w{d|c zyR~RKx}t*}MUzq6-mFIQcuFx9(!{RMG#c{uhGYY}! zoh9D4?YWf`$`;ztu=Y2#t(F?-W17R=rdsmZeNDWVL-2bd#kr@GBA=rdGda2M@M$Qx zr6>Hg%a5V6_(iUd+qt^KAOcOT6EH=~_9M8zqlLU08ak0F~dEG|aiVKlJ|7^Qx)W`8iu zQ{$pfjrtbu-gR2kFr?fp3j2sx5p5YGu*@d@<~_QoZqTMF_Z}$3 zL|5fia_kH8`&x^>Lzzl$VTpn_Wq|&gUz(tT{{7Z-Cq8+ug1)R5IAGXl=4XLdgvL5G zH&kdn_M-aT9ILaQdrZ(2s6tWO%R5tPN~r0Vy{#`s@4%a?v1%5H91R~R6K3lo!wnf}*bApU7v zmICyu(*&e|F*9g>@E~jsG78(c&+gq>H!37O);OGmay|;G;!~>v@Oo@8Bx0ju=U1ve z@8jzA?x2&_maY_%&XsO}ZOH{HjMc~&TC?5n-s(j0fKw}_D<48ULH+&$k*Imh>J&fD zSq3GUIHR!x{g$yG!(bcB`SuFq>oL^%-}_e9E;v=dD9ztgeOH|m2~-9pkNu8SQvBB2 zSV|ND=e7Mgnx^pdIoql{-{w%#a+X1RR@&^*yBCZJbY;&8cr z!3CWmzQ#LPd|Z#h9+oeU5Paz3e#Dg?3%ta~o~N&pq?A`aUwL=^zc zs2+A2AguJwxxBdYy3<0<`zzME-(58n4yE$WMiTb!bD5YsTPam#(d`$1&UDlaeY9Yw zf69?B5X%Z$-hHx`XPVL7-)k>CM)M>;;Rl`u_`k)+s_pH}3T1G`0;pSAx5wEx$fIVD z_$%&qa7f1c|51{b2OQ11D0z|dT`!GaJEl*8uFC`W*hWcT<=lQ>-pAeH9Lnl-(eo!` zhwjljcnqR>IodV|RrzGY$Q`9K&rYRWC@m`P5SCgyk$#&ff6Em1)EH^wDb&fwUr2qOKL*U7elVxHv3eCW>k6Wv%lqn&1|}AuSL;MV>IA9 z3!t!>DRy_1f5#lB)b{{-0WQBj$@kr}Nz_2`3WfyS0^M`EgZ@~CBa&`Es$H0^-fJHbSGn%olQmVAKyN9>&xyZ5 z`cw_At~K+=M)pqeT?xu7v&F~4LS4Hw*^^xczfM;OYyym-vI|59#M#Nm_nppNwwkDq z;duGv5CM_iLgHWpJjW>O_D5mt?q2~*=v_kHeOyBD6h2f|r`QU{GX#itrv`nK(gD%P zqGRY7v(Xxd=L=JywE3okXM)jN^^7^E+a`W!zCh4bI`zJIK~pBEV(}#T6eXDW0BG|9 z-`XpJ3$do;$2Q+}Q}+(job0FIA#=>=@mqb|TgE5X*0%akkY!^$42S>rVyz)rS9F0J z;1pUCtvA(za;Z|`bsv!XZ+q!atX3WQEfNC7}x021lSW*JP z31_Q-sZ-Ir3q~&Wk^ySt4m<90ROrSj1(nXqw+B`T#INJTlY#28Xiwemls*jF9=kw) zPUJPBoyVpBb5oMwwb;SW$VsDjJ=*s_6LGLH^b8{QESA#6%G8mjo$zd-g4=)M`JqX&THx+ zb3_hJAd^SXXUQWpIg?H8dJFxs@!NJ_-;(pXM--~lGkZ9B%<;Y#<$*`0*ykHhQcj*+ z@749Ic|(yx{8HoA+#}TIj@yp8-3cMPKaxYWpN?q;POt- z^4rgi=&rC}7rTw6lK|g>*|O9g%%*fr16LJk=tKU_JCHQs54l^b$yceK_(j6m0Y_C5 zlvT9hO+`dAr;w5CXe0vED9#x{M}5;l>e@a|n*+0CfxG&RAnT0Fek^#^K)03i{iPuw z6TVa-4UO5uE5AP>Y-p#c0)G)l5d>+#Dt8j0lq9W2W)ybVE7{MH+N?R~$UH?T*s^gL z@mw2Gi^!F#G}FzN1SXv=VOkfQs!K&SZQMnO^_BCD$vV2;w3dji5j*VJXgz@?Mu#8g z_DAj9L!cJ8GEZl%!;o>XdIh@-xTg z$zJt_LTERseIYr*a96j=p1sQOhLFr|Z~Z zx55m9)n*(DbdFc{Ut9IYuQ`cq*Y23?(Hz-8VElQ&XA37%fVS zfC(ao=ayq@NKhl=_}g9oA>)5BtznWTbTILpQ)zAg2Wq7;#ly2m;p7^T`#&ry4JWMq zDH#V!YyY(2zY$s3T_PupdHqF_xl8wdlQRA$DSQ5K{y(Jb5DDxlb}&cX@&9j<^4}!J zHm&CWgmM27zJrP2Ck^=d^Jf$c4?Rg?zT9QP_#>wjp`aC4)yyJ#QAlvC%t`IAuSUDraBQ)XH(Pekca=XElvI$H$)-9H*NkzKXGwU@>mx z(6tY0^~WM-4pCXkIz&E9dT)pn`U(GFszRW#%DBIBb;9Gr6bx{4J`|=ErprA$o(q+T zW%Nv5K2sG@GF37Boveq4yF6bi9apCJy>C!`vKn)q5X_|XSJfr)H2xxZ;gONr7IS1e zmHw2h1SIN=$~?8^LSC#n@f6~+j(Qv*nNp~(fg6+nKS%QP>{)v4CjF)BJ0<1-(R;LS zzgh9$E5N1_)|Bca^#bzgtjbQ1hte8+6X^Jq)0UCQR3 z)Vx|;XN{${K*y}_SH5!#?PE-Fx~W}7BvlXx2bWsG6a>$QIHS{35eGqp$1 z-bghT4K~p*c)E0^*nYp4-p_w2lH*vK-9g8@eZW?mWM(!kXKmU`TDsKkVY5m3>Z?b< zi7YWT1^2pNE{RB?mhMP@Y1u86xO^6KJ!03WOorDUR87YkHSmvP&n~7#=wF`jOx585 zupBOTd@#XCo_kLP@xa;EAMgtly<|B39o*~{LRPujl`((9l5a`LOjAdXmTQe9Ee#O% zJe5MXX7lY#8zWzsY|}*!u^B#AMRKd7!L=J(Ipp&FLMIT}^!BT+goJHA#$j-DjceKR zjgoDiB0J~TsKvS++*-wwsbnSQd2MTY<%}ZmUgvCZFkTK*kZIxF&YlWj+WxHOIPdh< zrZ%K-HLT5>(;^h(k3ZGG0Z8rxY8PldC0>Ud>5H(E(0U)Qd zI^~hxC3^41mxT{sa?){8uRtxCEI|iN#*IPLLFfBM!r4iO-fFL4>PiE_M?&0xglrJyBmMZCSZwx;hT)(_$Bto&!PJ~JU?vHeSI8ifq>>f1~ zpO;J@`MxZ_9O!tbFH1D}@SYl+yqvhhTD~t(Cgo!?IS@_cz5W!0!@jC>x8XSFtM`&T zA0Lgl`r+6>w?sz=$=iPX;WRbvH1lwyjx&ylU5po4$&=eJajys%T~SeCQFU4MOj7zI z2N-o<3^^+ED3waX_#Cn5>1d>FUxq_D;!3(>2r1{HY%bSMGniBI6litqJJJbzk-B{6 zajIwgaN@OMe?KoaZmA03D!sU^Q`Jd|wzQBYEu%1vQQFHS%NO;Ei3q-DhUfhIQX4Y; zt9h`+LD|sg`kKh9LBU7HEQ5x_Z_~Gs6;;fA6^{{mbX#iJ2XMVW%9&qa-I4R7ZH@_) zCuNMOOw&W6L)>m7^V@qse#;+xf3GFt`gjxf5uzJvD<=wy5j-v)E0!AxvW!nNlM&hfyDT1_PF z{%j%won?gl6W;`8F&H5%MHBLO$S>x0Fau1B9-ZrW)F)FFk!J?M3t~v_T{`^+gr-HG z4U>T6`<@O6X|RpisrY*dO_f#$ov*eXsMwu~ab628uyH18;C zfE;qf3CEVP?!t3N1(lfNPl^zaZMBaET0MoKqdl^w>I=G!Pje@WWb#>qTK15b5YM`0 zs^z*x`57JQ#>&7a4#Jc~S^OWbSS}Bwh$!Ii&8PPgb}|M~y2Oac^AxPh_`a94#2lF< zP%kPe_*54Kl^55$OqplwN%v{RaZhQrE`1)hI=eaqEOSGc^D3HrK~Oz)55+zyt|!S4 zT47JKtnVO-Zn|WpU7u`AS7N+Z(4&y@p-Fj;EKX32GxdFq*5%WdKwaUc5X@5(o~b>d zwgp0#S}8LmBN6ddQn_@F>W8CsUF}j8i=gg6z{Aa{GVDZ48STMKkwStVndxo%ZV<*J zzVK|hd|a9C_lYH!pM<&4-|K8dS^90(xM}h6W~MprCQmpV_PPlcbo6%o(BD1XTO9+9 zC4SdRWup#F{RMRv^_7P@>;gUx#;`v;Zg5t2#PUL=lIv!bo_M|%3>3C>7OTS3}Zp^C`Q^43&1 zLXFEUTyZJJDZqYy*~!^P?7_dJhFhZiL2*}i?d9#pPBKY7WP7jG@z>VnbebyU$gTB{ zwZ&al`uEdP`v&_7sr$g5o8un zcHE9R=BUrBd98Xfc<~AP$kbS)?C5j0zrTHi_`4LBP6MIJ31hVU*|@V`rEYC-v&#c$ zW!*$VNvgJjOR?ujU1)z2X=U4h?nE2xlej@#@q_iGFH9V%yP80s*&aKi-(%E9^}UIr zb2RqyXCEXL-J(S+qCef$OjF{|YcgkMst}8Oq&FDL#$Gai6!2II(RMIvTQ`%tL}5Gb zSy`lfUej5m@dz=BRXMu#D^3*HM;Oii9mu#P(|Z_YerHZ)qkE`SRH^46MY_`_iAtAUV1CcGS zYFRA(OW+~{k5oxeubB6kj(u?*ul@A|Cksy@uiW4V(0p@1!ZhfTE)ykH=f&Q=_}`mD2dzAaxom`<3+4I&SOow%v> zZiw`x*YNyPb@yHu82)_&7L{n`4aA2s@X*7rvA^PGSF|Rg03F4{y9@Wc+IPo2^2YCO z=d%uzaB>x7T800xl^QfHPeo|BJ3>L1S_esV-;6h7Pk57g9dy4R(h4ZcQd#hH__hoL zw~{xlz)1a#7NEEpb8vg;H)U%nDkN#ZRUzIpvUOG_Lv2>Nu4tBHFT+8X$!QvCVk1^O z?j_bkXF928kXZZUd_zv;(@C;t@Qi`yieIJC^eCce%Ddp4Qnc(W=d}r3m?7D)Vqsy> z(x$R7`ef5NX8!HJ>CM>m?G#=l-pt<;yf=Qb*XHDJeS zipbl9gO$$_+wND1o%>-&l-M>noL(KK(`KNzsUw%yPGvwAew5A>V1%M}?e8N_T?0#0 zZQTXUw}e*|v5gY|uvs#VAkv@Qe@xHKR2k*-r|Ye0=^VL4M#`9)rGLCcG%YYA>unU{ z`Sh4dLmfK1!6;c@N#C#3>DW6C&)E-7B~c=Fv-5UY#Kj*+3U?W3JGhT2ACa;604C&# zo&`nQutZiCeq`3orOpq0u_OA>n1p$+WuA)vP2^JWhm$erXgcJkGOKF%*b*S}ud^wv z*b^5)Zz`gfdu59W)2y-Kt1uN;+EVqNuPT;rub3sGROh@u2uVBhz7cG*1v(u6`a(}= z_!TtGbI`>8?9TP0*!e@Gxn`{nHAU?!Y~-vMIz;;_Xy7MqQsej~sWs$+2pu7Q($9=p9|k(h`cSx;~&S$3wxL zcF~(Z;N@{TRu6M(fJMrc`z4M;DWlfMOzA~Mhgr@bspj(@5+sbUhpi1bDV;LUJ}VsF z$G+#>;_*X?jHXic1uuu;@N+&VnAyOaQuteg=o}3G=atEWOu0PYkXf@!M8)}G%dUrc z@AV{kvJM)6nkc*tpq_zG8$2Z4#h4#g5S&nv$f&{{A_`xeEKj4~y!M5Nd(Nt8L2-?y zHLu+$BzdEINV}rq6v;v%b?gC$chM?dL3Y1rX!z0on8hdp665!AohaYK@r7(LQW79+ zOqhH{3)L6UfoA*eq%Rguh_Bp=&b^(Xz}CFrLunf`{FozTzGaX-A`Y+(CVHs&N0(p! z)#V01BX{K3BeR9M;$F#IL*s%wnR0y?yXAb z4t^s6NZRj)IucxLQd;P%^uH86(g+A=FOPo~E%_bV`6kK}<%Kj#x7>Pfq%t9{`>AJ^ zgK~Ko|0vi$KWFQ1r(f4mS{2F@x(hF)fcMUQF~GJaa>FZ&hixTfr^Ov>U@Rzb@CP87SkZov*Y4c5TLkg}@|SRkwM@=1 zU3%Ob6k_w@CW*sF@%sy*QY8LNe;LaOC<|rEO_d^6t4pVyef75X-eruK?0G`k*5hpd z+ORM!v_mMEn0@WHZ}rw|ChuG0Rrq#3%Q3wN81Cd?`U2ndx{%&Clo@??P+ma*3ZwH$ zc%mQ7=ObLZ@a%>wzQ4~Ky0=WmQD0`^?QX5EZJfc%zIT0DsJp@0i<ZSR6d9P!LejaNM0rf5M%Y{3#nVAeFZ% zLGy*H_0emKY&qnvMJ>G&wn#?`mCS#Y17@8Qa+S25s|X4Z(m7cT0oqw?ar}mSnr9FY zA$d}IGb7>Cda<|A{Z*RMk}|Ee@1ZrF3Dg+N0<`I#* z-))-6=)%4oQ4xyC%)f9gwhxzuJJ)(R=g9a;BfZ@Ow*x%uMg+Q}RLh_HQX{ZQ3SR6( zOtcRY9Yv~w^MCuTkq%8)N7gmj)nCGP)hCx}85-^D&_W7`-*p!Kan2VQcJ$;8iH-~Q zE}4yQ@qGPA8HwjJTDFq6fIWe$-N2Q9AtzgJa&l?GpMszn>N2oHlp`uU)Q7q`NA6$3 zl(S{3%07-4ALjY#n5UmX;Py-I=I@u#-u04zDh)*KN7qE6lDHUBKP#4t$tuwOU}qf4{Pe~U9tE9G=e6=My(cMIYBfnN|0sw=uGpWB zTHH$kMvs?Hb7*5LnS6vpU<;}g!k;SBZS$Ip^JSg=;S>m_Als!t?N~*Cq+oYmtxEe)0gNwD=;9{p;Vqc3+9+_$EI;LEm|!jbl}K$kf%h9PoV_sQL0*6ujJ(9 zghqZhhoe3Gmm7bJ0 z_56TFQ`MQBZutue58Ue5yoQb&xppxIL%M;AF9>m@V_hRdvA)*KTrpfmEiCwA%=_Ym z;O!7$unZVjwy5%(EaJ6PUq4#0nKz^!K_3xq?ySlzQBv>fkp2zTtxj?hV(gKN@oL+V zPq7E;Z zy<4%eD~!y?MYQQq`vV!;J^5EC_{*0D9UFKhCcO(3%gJz_WkxSr3J1VlxACaUHoM)) z9;i-m{_wIX=Y4u=)A{Hi-w){NJ=%IXFQroo4OIu*?x3OHcY*J0ht-=eSb^Kt{f%F{ z{wYz|J)pa?E1_H4d2cQxtpvFCxPb-sJ90duY7X*9yMu3=5s<|wjE3_q$0f)I;>XS@ zz9sCDF~4M4pqK@|QML}5wl0~(1f~xz8m?o_*4z<<9WJPJ==B*~p=941A0wb=eJS>D zF4*L>q<7FE~l+;ymje&uIM-_k*y-dT6+JJGs{5<6POI z=ZM|=FXs^^4k)1UyjCf1=YRMnfTsHzE~&?SUBb6AQiUQ{ies)pl+L1XXh8S6@8nyt zcPgO|jwX;;D7cP!6S$MMUKB()BNVG0qklrFZ4{h-7-cU2Qa}I^@6k|E#nQ%`6SH&h zz*qh33Z`FMn}cb`KonTWZfkvlU>~|fXA-~w3}31XCLjNKH~)f>0?LhfcP=ta2(3#r zC_DYms_jLzF8auR$TgPb8*#caKyD+cwMfN7T^6bv`M~KzhloKf6GLsflNRka8DZfIhW4U=1NfQWjMr2 z%DY{$L_MJBdPTysKuW=%>&iqAe3~!ugBsaPk4OwdVs|Ia81?MZUEZOlmHeP_%7RWG z<|{5Cp&Ck)D>M)Fdf7VQ{`x`vgFp%|b-KmOzBMR_NFm{ zp2@Fl3c;#U@@%^U&;VB zy^5zu>aXNFJ5H7cFo;F#k+0g>FR9KkC3G|LZREO1y$g-Dr zFJ7({8L^Q7itWQ5xd(Z9P83@md0Bo$6ugol7hQq6I#D-8po8H< zg9wDV>%1}bpRPr6z=zW5$c)d7JbmA657>~Y5k~o7kF}>0Un~fz-aJk}-Ey>pka(`` zO4wX7Ms`NBAvIDKUYJlwiE?d~&X$HqJ}k6>pCQ+sS) z3kS_b9P!<21$$ohjJWj50FJm%N{=|g2{pYj@I7J*=N|}^61!E|pQwZG?M+Z9`%&jc zWGSIa@GB(vN6<4lK>1#6?UwN=mb7S_EGMASk*qga7|&c!Kg`N7LG?-b7xu&)r}YQ2 zx+Y2V8(|Ap^loi)4nU){>R)0V_9A`NX}pg}MXfy<4zI7mo5pgOEc8NPC$d zy~%rGKee>U7d&~$E>TqUkoTJs$j$PjfTMdpc_SID5AF?w0_q*avs z@xuf5Ud&er8Kst5P*aG6{AC4y>(61q+qbu1gVt*VeyVM{jB>f7dJL)_sq!8jG zaLP1S9%{UXb0T^r-+q-=vl$a_Wz)mkINjI%ER|**-7zR?8xv+db16}AzI~hi_)!b%F2jz8 zG%@+cN;4z*0<3k;35l3|lPwe$<*!sP-n*Iv49Y~kf)lk$TeR6|)2xK)mH%v`xhg8v z2`B^(4aNwiN~ZX8c+-+W4H%OPQO`C>GGtM`s9nfS!hGe1LGk){vW)!L7>UYWq<rPVHVI3E0&K9y3}UjVhk~ zBvCT=45Qu+TS#OddstUX2-Kf5U&4C=BG(S$9R9fIjxj^Tsc8c^g|2r%qbo(%Wo)xm zF)~&~_f-yjIb_&ZFKEnW(~BXHo0LQtb-!2liq)|xg(hLI2!b(E5nZus#18xct#8DW zvF+Ok$p|JesrEt2BJ%EmpkNY83n(07x@mMX&KNXW4{mzh;}qk-SjWoBLtlfngbfgd zuS>Pm1Ml~^$K^jJHavJ@y=vvLtyf#o%&4)-LKGzB3dB=A1XjUnPS$&Ko`ozB#sI2> zNK5+LUPR-r_96}$o}=@|jgRxCP8$R6OSg+Gt-EA#1QZQpkN&qbZy`Cpd5gQ2(K)RhVkQ#xV~^6b z$FQ_;MhB=wQX%wu;FgHB02KB!5;e?P5fCF?x52@9CMcCJ9{^`QVUfb6T(`v{x-rcw zetu`l+_4b=Mmun5OJCe8A?Fvw5#EZLLT&jZJ8Jhxk`m0`V0zgf8&#hWaeSeO6~^~^ z3(ic#Ea*!Ac8UsS>+>cBszp&=2`ZZJiGm`^pun&_Kk*bUb@=LnjE%nbfFfZ%+smG) z7kh&}tW8t1(TO?3HQrndcE}=Ak8Yf?%2`TvSx`bXAF}>Jr4j=gUZ-nKZ$0p0CdnP@ zRCnzoOqYNsrqX?EE2$7hShr=lNa<9YUIiwV}xF=sO(#bPJ3Z5jZwux1Gp083?S?#;{r%+zl?6eFqp4@~LryK#ud{(7re~Iv2wT`a}wv0R?4z zJy3=j2g6yfc5}r^Lm_jUcfZZ&iWQYjzc|d$PiG+PNFHAe_d~fOzz>*pp5eY~b$Ix0 z0KsU3v08+nkvrU5d2|6v(v*2%#I>bS`_&%`W^s|nKVWx0;5ZgK1XV5+zrQYg@!v&H zu3WXmP@|Bvk+h|r_aX?Wp0=^})U+Sqfe$?xt%bJ_PEWHI%r0>p1NCD)IZW1_;Mdq} zkJ*c=2cI#{=8CBD@wWWo z+f9xS0XBAzqTK`KthPD=@1k7jt%-SIq~{;HyO~S}i5}EEm1L0ojR-Y4KbmY&4(;A% zRiU6d)_)MEs>&=oHSQ`rO-u_UVsHa!*@UH50Wy|^>d&s?B7O-kga1Q}2uhF?Ed)Z7 zU?MvxZtht35ov`SUJ1}~jCcg0G0aYTXd3l(@mtutX5|$nC`$XKx+g+sj5?#hIVa^L zmu>7DIqI1qj`-n8>E#UTt{WhIKQU^M(gU|6ODxwJUYRB1j2Fwcf9bT6QXsZ=(7AaG z5P92)7Di45Cj;c$aZ^J8DnCqs>*OwKA|K?pfLQIUzW~$MZ3nsGEDC6T`Vc5E$lzT_ zp)y7p%JX*t3tljXkUVk;7~Ef(-5R9X8kP_yCA-^9=b$#7-kIw(UnI9Ye@Pd*L>ivh zpMqTPEB)BePsiiONUdLU$@8aQLQGG$_q8Jp$l-p}d>6F=N5YoTblhDkyB=JFzs_1p zN7U1o7Wu={_fw}_-A^HT;YT$GvOwaR;b_*4=0~QGLhnUMmv=k{;Tg(%L3XtUSy+S< zs;(_rZ3cuYl~~u`jKE#2^N){kmNYDzdSohI9F-fh((U8KTpj-SkxmiZ_J|WOh*zPo z1l>F_{N?jm;u~`SB>q;77^rZTjjd^&&7_3QS!P^AORBQSZFcA0r-9eb8*ZQuyj!7+J>XeE3B0*EY2K-#FlCw^*^2G1ePInWEj z!`5s1Dm{rg2N&i`-Ie-IYT!W6pOYRyH(Wik`>aUM@4GMuIJ7O1;gN^!vyBy+kenHW zjq@gOKX#Y}1573e#igWX3&szXkrx;fkH>Y>c@Fj@*AOiG{Qb@Kd?H6C0$B>>J9j+d zuSOo!w~QMR9VPX^uZo{I2E6b`vcVAgvMejh?>6L}y`b|Qht%boQR>xdD(#1@@~W!i z=gHM~Gx40&&S~zvuGAY7KORCfF}D{XyT0CY`w1lqe*kKkHh$mm36K4kE@~U(Hxv*1M-l zolBm8gRyYi?r=z3rqIDlR{Bq#m8R7MA5a)#%2|Hcvd1^4e(9W5Ybe<2w1^I@^L7hj z{oth)BAOtSf|7>>flHpnH>!DZ>pJIb_>Q!4j^KaSbYfE|Uq=RGKn$kMDD9%n&_f)$ zP}JHFC-H`?mM!3$pLFK`F0N9XQ%eiV+fV5N6oyL756pLs;N6B8yuFKNvdSbZ2L-GS zk=++R!2y|q9F!9(1WyeBP`L`0(rqRX^K6F?Q<3fVzGH@zS@@FdgbJ>(AcLJpCE7 zTSipW+MiEahI*L6E?3z|*D0L1=V05W-RX);eff@%nw9DBzwHT|@E&QNBe|szK3}^= z-NJ(2{2KzG#p{N%@{~NNVozxRV-gkyV&DMQ!WZt-2L>e#LM*XoMdJO1WfBYlA<`x`sp|f7`YH%lwS|bsLGc$hiw@-; z#2??e<}-eAd<5b4+s&DBewY&Aw8Kk?{B;4)Y|l&tp|tW7d4Dxp{`;qYsRCwF5`p$m z@<=se{@*?S@0|C3i=^lwr{PW&XUL?GNvFxL#5e=e{R`R!rn|KrLB++~`u)QvG#n{i zU9yAysI8AHGK0}%R9SAgd3pF*$H&KBL+PUIe+Wu;(7z)) zHqnL@>aZOOH6Fx2qp1gr$9^ay;shbNpuGc3R}S;+b=Iufu}PCIk-ZPotTTs3>8_nS z@vc1c(?a^5Mhcio>yD-Bn%0VtFvFWdq;XeEWYTUdAH)rd*3uFb;;@5?X@@aOvlzQQ z>nv3c{>a;3%8`IU$x&kMT3XN9GVrA*V z#hI|CelmSc0aO6RwcXE2@WgpaW8AII+%J`jJ8uN$=+?gHtm1De8x34J$;KVVtxS#j zQlS}5W$;Nc$7tNrH&x>}v}GbTaHV&3;hprooGvzMYuer2GLK(osX)o+Yp!?`qI}Yu&a{;%RxQYyKeAeDic+RaJ7bMV9npq(PZtl(pKV@c zHz!EuN-2omgSz7LH@%oxjimDSC%9rIK2lo$3H!CPCHpG3RUoOk2se) zJ)52_n}!@5MR?2!r>fUFuj{iZY$@NQn$D%2@xH_vNolQ1dYsfyP}bXrUM&E}g8j@7 zrsvyk3{Q(z%O}N zDSo9lZ&lG_#EzEYJ2mv#d?i>aw%P*+k1ttz6v&$GPkYE&@^lcgX1a7%lh&WSfXfvv zP1#^~WX0*WPswUI?RCgjBqhffMQv>)g27{d6cT!8YOH!BZJ-G8vQ|hzNzAnDJcL;_ z$mr6u2?{Bk7m?y0jCIw})|)m!Z))nx8c94()Fj`I~>>JwTySWs*!vTdbp| zYol@CY$)KY^E{(dW4{~mTBK{wP2+*!T)pFoLx{*Oy=F-U<>3X`ax+m=fc_eyWn64Z zcQwZS9?9&EOeD2E9rk;yW%=g7P3~3Q%vN6goW5C#h#p zGzA89k?2!d0^x?f1IwO`KAF{KD^M^WoZq6?x-OCqal3TXmnMPKGpVrf#RwTM21hBY z?VUli5wa6a*0>?kxx3;1eCxHg&jbV&$sfvk_a}3xzJ9$9Kb%MU6Kcj8?t(41p z;bO%jAKbbqMTAF@;_(Uib+KaU&(a7R?Fh!w;Wk2C$`GZZa z_Up@*6)5+fkW#4T8bAOE6Pk85?0r*Xdg43ZsHQTVCoSZm2hY^!bS4r^l`%4Qh@?Q_ z{-Us$RQvN-!QSAGGtHnG(RaaXpcVv?2@a$^Ql8I>6^@mysT04$;9mbrEG|5=!0>#% zv)1#?!#&X$2r7c!wYh3RLV3mO?}v>)tgPakHAZtfI<4!o>QBe5J6#V>iQ-hkqtW=L>Ru?le?>>0U{>#F%fC$z4v?o7S89axq38JvcBdgC4;sW z+935jWg!#6&6_xfghS&BcB!2$&PYb<`*}rGOhcQC|CLB3{RBRG*-01g9@Bxx*Zt@!rK%so;dD3(t(PN0avLPY)nCj-$9k( zH_`q(Yq@jb9&*_uAYXoE;1|bZUNJlWo1E!I<2e|nASn<)v39pXMTz5?@o0tj40?(4 z3TKbwC>#Xv`Bw4{GS~zGu%?FyG8~na>Q3Smw^G&9`i0{bxNpY56&s7YZC?{AC?>bp zjM&c>mmAkF%V)~X;dks5;$O^upyogzy>5xTnVR2120Rz6y7TX(F?r+oJEs~h_?}zpC<@-EMj~D=7fC0BT%4x}kc54w| zWSC#mjZ%+iaW9pDCWj0QRj&i- zJ256(d<0z9qojmS^P`y#XlwTA-O?bD#n|Pl3~?aCf%~mt(k8d{rxa&`HAxEQaQ5*y zO1bEFwOm$+4PGBG5cZ;084k0GgbokNv*3GT!Bvy3-|S~Zb0Faqw!s<*B;EyncBuXn zsP}@!{2QBzU*YQYD%}T)`>FG-P;jTZ)L}4F)Y?;Z_JF>M3Qb$QjKj|6jR+6}pVL!} zPSvJ?W!#KX_~9db?YAoBz0ry>6op&@4*SrY>@p>^&$L_sqHXW{qloJ=&Sf*s{iKtk%y`*?9 z{C@w4jEqd~a{%OgbaZsK)0KS+4nYcMm|3OJ8=iQ|PwJ=7JY4s*oc0}8f+-9~zx&8j zyIK2t6CC|r`Ve1VhCQ!=4W5n5N012)dAw|Qil!MYoN9iWecqs~R3}t@>DpL(74s5z ztfi-wMAN})iBgK~b0>U8iR{<{eYd5HVNcG264-QAf`8i?3m15ib5ggK`OmAR9D+t+ z$!Wu?lbKe;6&o3XID>}1h$NN&nT79`MFB9{LbfRmeEmxEtmys(9jz{bpxWAt#EbxQ-et+WfiRoBos6=+)Y!4I9cw3X_blm>4)SqEPF33sBEIG6L(wqnmXE5c< z_{M(q3s|JYm-Ko!rAZy)EJeD%Zw13?fzrqTP8SsoV)$ z;}IsVVqO(*%;U_ATy^m=c6d%(Z+c_ZnksaD^upj#x%nwAcHjue9}Iep`R{?Gt%JhD z>Dm_=!-f@j8A{9Dr6dF)ILAYy;FTgUu8P$ z`K33uOymcF@z@g*VyvnhD5%(toR?CJX47Lf7(fyKuJcBM!JgRuS4Gdtn!JF?Z(oKm z-{i}AcM^g0L*yIzXiim5-(E4<2I|JUr!D40BH$F4S>0g}JGN7h;VdwQ1~#E4lKg(L zCnRK1O;QaG++PQ)_Y3U-XeKMXL6^%>fhK1bsm_}z%BP@$f@v%{&k$9NOu!w1!m zrrwfI?f|0enza4ONs~4GhIYaJh@F?3TJwP1|E|UOFTN3y_K>t)bn(hC{j#${Co9VeqAxa@UDxNbGP zoP>tSpA+FxIjNXv6sL-6Uk=0-WZ0)yC(>G3{rwg{nLzNIX+67DZ?8dRD6&h1{bLR2 zqR;?RQh&Jl%4X-wGVc&{Ontkf?^B;%3xUXR#0Br}Hf@nzZ!b>{ zAhI;I>*fHj8vCVmUBz2s4>{M>pG()l??53Cx_D-@uYrn_SI$uL3ivg)$u^x%q-v++ zt5mpj;k-Fail|?aFgM$?gHh*Tjw_&Adn`!@Dk^Un4P)O|he$qgOqWPLGI^J+C99UB zY3#S41$INJ=ni$f(r9pS5UGhMVSqgHG-yRq;{L44ZR|JQuyer%1xlO5&2rq=N#Y)L zK8GrOetTgZ#}Ye!HMTBTLM)yR7Cth$jrGGNcWy4O5x*I-H*LqCsg(lXyWvKKH105qgR}ra|;EFNw5m8fKCZe7y5uc-XG4ENjmfgf}CJ zYUMK)_p1wbC1|>^+uN4n6f@!7AR3q4x8c~dw6y7B<`hwmLczM^aF5%aC%%c_Si@tf zu{{5D1(zSaBT;d*EqQu9@ZO}7zGEF2<7T_ZQCaM52u)k9CycRbOn4wXZxC!P$T+26 ziCgFl`^4coyCzFhRcBGJ^C=_3PJv1xS81Hizfnf`L(=N=1%03`)wL-MEbixg>}HjwGv;mD?Jpwu0Uol|qFxkEc{-mn2Os z=97z$6;qSA#-1QQC1sXWV0ouPzrs(@dOVT8XvFXd^zQs&*O!v1?*8a$EciXe8TAHX za=g}SJrg+_#|(@4nJxKY+|7M|nK&8vm4raWndjkvoq0I?pTU^3FUVLCE#6WZPQRg3 zli6h_C5>hY9<28h@?HHv37<(>IG%<=h_h6P_Z&J8UupJuQw?t-=blmfwnnK-h@)1jE@27-yhTco% z#es&loIE>~A{v)0G3$q$#{R^GeM+M}?KwZXrcDiMbj%W&W{VmonW@~2f{V8Ux`S0D zV$i%g!EH}Hu{gX*?wx_}fe7(GWSE+3s*Kz}XKTw_0p6*}a70wCA`;iA9`UIh8iy2*8 zl_fVZG_T*~WJ-eBSaRO$3A=IFWUmxZbTb6=e$O-LbA@rNoS;w53f$ZqK9* zYijXoo#tP;eTbU3ByhsiLjgn{mXG^sLXb(ki zsN0H{h`E>7`1W4XjQ@LE15oB(!2myR`MnDJKUZ~ozp7hC>vH4&-Shv>A(Z`BAM7OI zyr-sEn^pxCvms72Ig-LpR_u3kk72<)2+uo&k!8RAfOx6DXH#o%O(P&94f$tZ8e_hP z(1_R#xxsNIgoDnxEhu8q{B(q8(|zs1TlUQb*TLNAM3BM)>C~CT#7U-xM#^&tJ0%Iyi`|p82dq+c`D$CWKl_y9 zRj-*8rb*578{$o+0=?+9ej|UTBgB-ufFnlU7;C?~!F_$&jM9)gd!4^bcYodESevYS z9dEt6W1Gdoy$o&Zv_DVxTjfbRTt(r8^AiO>G^a=2!f_>rUmo0u>INO|6>k@2(?o-O&5@E>b?dv*E{FdyYaJ5+6)Hj! zYiRKyEF|TR3`F~YdB;iv!KiB09!|$OZR4-|0I%^5_Qv4j!)!@*b@!R#wur=v0&RxW zk_x|^=Jr}M73#+bX{hTDv-n?s#{@9Nn%T|<-UWlV2UcBctZ=*ax+=xUb{0kRD31q# z+wy3rPzmT+h4rChkEiJL@$TKm6oruy{o=%lo5#e#qGoSY2E|k4BR6OJ5icG%6~p*-JdFdgh-$KU$q~ zJA3+~_Ai(JYisK;5KXBI8ay6Mznq^0O~p_@@1Fd|u}%^hKcVR%H=Pt&D$PLs*0Ey! z;m;pOwkIpv(Xhz&4d=qD92QnWQ~!nYu}nr+-ehQ7;STp-3yZX!}`!E<#s&cDVGtweM`+A$3%= zs*e5VVD0VZ6EpI6o#zvV{UwfgP0Ll4-Iou-d@Y8v{subyQ<5bvr6%m|2$ukEXhc>e zvu0X7G{zlRfzUp=jK1WpO5<5K6RTpC{sAcJ5#iOxQ1Rc}fZ7tsDyrv4B?dr-LJEU% zfpLZaarP(-)>k6|yDil^DaPlnXu`{S<;qNnq{T$d^vX1HB*LtUN~Gw=!B5mdJLR5G3>4p}{>Yu; zuq9b(err}~|6YB9inIJ{3ko;HKy`d028*we_RmA5GMd&nj#jpOZW`0eL%kkL2&2AB-wH<1WMxdkshd4 z3_tC*Y!C1CsyqI-NvEmS*0;QbAVf!QTS`16w`Rpl7!yJU4{F@Cx002}`tagxGVbbN zz}}ytzR@~EteSNNxMo2am`^y3z8Y+p;h4`B-B-EZ8+WuhmCVQ1*3;pZX@gahE)PP_ z;Afvu1)cYgXG6ZhsIy878Lt0%A~KmF7@&K&(We}LOtnZdSa+q)g~xGfyYtdSsKOIV zBklq@AJidB`XYSFu#m4kV}cvrD96--ix>hc7kbrlv4pmrF2o-DJWDsP8pSFe8p4Ho zo7@{&sBg+<)NteQ7?fpYD&&B&AC(go0ovATAI~56yNsW`d$CHY28W*Opzup~pfR0ZSsa zJ-q9~q=f&5!w&;JeE|QmV$hW;l1KYUwOXspuU};LM~flc=J&LWGU9ZrF9BVZ%@_)C zdGiuTH{G%gH59`$Spu-0EO?pJW^nD#1*6Z{$0I!=exZo}_UP}9eMvY|B2bEdjqpp9 z&XDTD>o9pCW8y2tN>UIa9Q5()Icf>Am%&Fd@Lg>S&y{W6NUp)2-E$eL%yB@}w?-LP zN6{ce|HiOn^P!YZ(mSD)RoQ~@d{ zq~Pf)eo^k{&GS83iS30X206?Gv$UkI15bniL%p&o)f$MIk zqT5@GWo{C<$pqrxqv7uL_C>{k8p1uYR{_CSjL-{5VaGin*)0B`$P0?0vz7w|H_E5+bH zbQdpCe~&+=@^SEApmYbSNmxl}$4lz!GgWnJ?sXOb}u71p) zU~`@VSd0X8O#m7Rs|0@g9G(6GhYdxQowV$E87@lU-Q!|!Arr>GY_3XLc(&q&;R&f^zd<8edZ2~xSTo{O zEK?dl=9S#Jzh=u@UKRh6i45GYX|G!pE&5hup}9n{IcI_qoDY136*JN2<8WSMdLRJG zxe*!lm6*Wk`Z5tYwE9@M@==~>m=dY3u-%fwv~I{@|K0@qBfXIOfWlx;JbUt}Q;uR# zSk1OWR%WbcC$_QIi}fBL{TI%~{`^Ao$On}Qc81)*<$#_a1_JP+XGXfByWeKm-d zIGvk@7U8)j+Sy)b7{1Gdc;n0H7cQ(h!HgbDqy2Iz!lATTnyyB4mR56WDhq)%mQI7t zG!4(mwIh5q-m{x6FbdE3@31nIACu_4Stk52zQVl=Zn%oyr_EN15MiZ+x>ecdXL5t# z7jW&9RH%EP^1PW)Yw~z7*zt4a_{e*}?O3=^fe0`oJ*3NQ*(SuUAwm4?1I0*AB8x-EH&8JY*ua@t@-B z0}<;>0!-m>kbyM!6=FLGKs{qRR0C=-sSFuF4G+%aiKOsuE2#79|za>fiUrxwsj!{!b5QL6D$7>1I?|02R&pJXb~YW^;?nE z7%F3YTdoP7wuSYpSz&Tv*}@h2etkublW<&}?leZpS)k7nF`)bO5&G91fr#BveMO!| zdOj!kiux;|bB7HJTN#DlK-}5#_akZuC@~V3phv_EK@N7Z_VO&MB@)2p13NoExm|TN zR&f#DXM9YAc?EHqb{)=y0s5abX~GI6e1$AYn&@B!iqu4&L#?e}(QsS`YU0v1Jn^{?XDQlU9)m1~IGgqfEdleNWmA5A2 zqKcB$l3Z+7v(#wr>g{cV1DD=2`x9V;Rcr?4$Vd)zuT0$u{=Hgsw7ej8Y+Mr2V3D7X zspy?mv>(Bnw$0jV;p8cK(c~?88jJDz*^Yrolly{0^Uvv1`GPCW^8VByXaH@zcDu_` z63w3GU1)6iB28kO@vNjO<73`>TdQ1)9-gVou(@M&Dz~kq{8aFM?MP^MwAvrvRV|(k zsl|t*?Z_6Rf^R#IQ`@@&8awpH`FxshX9IUjYmcuO-2Hn@= z_KR?c^zn}ge1#2cWA}=H@fXfq>0?E6_p+I$eLz~e!{wh5*9MtLu2aZUu?gw4=$NEK zHHFzaax%ym%(p#Mjuv;N_hv0!QWvdMSu>bkU?LBLIGH|A8vrer1F|C38l&^`1Z@v0 zkdAumOD6)aRSR%WQxiDBA!ImIO~pGmQvBTu;$It~H4N!aUZt3P*KYN6mk}@?vHHG1 z)!7c+R%_WJB+Kz0gPAB2dn@%f}RHH7|U6O&2PmgtL%u(y0YO~fT*Cqg682d<)^M!x*jn?;=B>0CF|P2B(pa&JRUo@98h}!<@E6v~*e3cB z)Deso<)rtKI-A3HSp!A(hMbwR*T}JI-KG9&!`E{iN7o$TH39itd-SwgryC1Z-b252 z-P(&~tq2LVN%>BenvauB)-N*EMw|SD+>QgJ0d7Jw^)KzZoF_e#;7n&}K%wvepz}p9 zW}b4HT4#5+KVr;A_X?0;WP2LQFHD9|6%jV_!(SVJ8|r|9Zj7}Gswf2GQsg>)cwdOQP-{NGtLc0)~O_U8m*2~ znS1)24%4Ms)uy+yqT%^E|LU9=>b@CZ&nsqn8l-e97c&KV84 zCP|0HX5UQ5GSz=iFK<2wQdw+1oK{+r@`L@oSwT=*EEjGQhjo!-p2Nw?NhW>OD6Uqt zwrh>$XwGY^c0a<{Hw_H3N%{;3vPoDF`9%2f?=9tnUzk*PfF&Fb0U?GL^%5UD@isNe zw$6s=-QY#HtKig@LqHd~))@j&_+PgoMG61lC&kW$KMh=Yiz6i~7&=9tHrQEE;hF2w z3zF`D!TF}jRc)8%fx(1yDw#N(T`88R-s>Oz?-r(lTG%b>4e^~2$6M5eo7j}flu54> zMzzVow0=wS-_P}l(EAq&s4J|Ud{2n}^{oGT=mEx$a4EPX`v3du|G(q6rtun|FNYnZ zw)(=ZibRx!{@uvGI~L_D=vF_(ga<`+(I8QfWB%QScT3{O|CCvI0ZaG4#`V_`zX~DTqr%~^QA?8i^Fh6zi9q|%jNx!H_^Yx1GYs$lob!8i^?|cA5Pt?(DJF{i&yzd| zf%Z|1eFpG)8?gRo)ZhPE_Xdq1w277Qy8$qal1HY-lJ$l>IuY;=FZ#?=lR|>+Y{;?2Fs*p%F4|~uYULB}Gsw66Xl4awP4$KhoM5uWG{p_U z)W^)cNf*7HaJfl}jHuJ`720J~i>GPlWG}DO#l>y5HU0$RKioOlU3a#xOo+jgA6qQh z@vna20@h7zsc4h#j8oI~Gs_I2y$!xtU%cX5=6UQ?6YULgI*8xm^HOsm<3@?Km&V1Z z-}&M;I7QD$M_}v?ppPC&1ZDfN;NXhl0dEQ78%qGgP9e&}a%7HOi#{r~(-yXF2l1Lr zHqR|Ksyqb=vU=BkYud?W&#+`2x47a7Cx>eNv>Ie7clZc{cFr{}Kl7S+firo7AIU77 z@VJRX=ByKnB<6tuK0vK>AL+2M_#--#!lQe=zE4SwdJ2`idwmiOTI9WOc|&a^{o6&l zYh1_@;y)je0O^7XzRL0}+sXij$KN_^8vOCLLH5LZda#7S@ zMtJbbO)+=z!AFgmhA(P#Gg8MU6U%4;<%Z%Zi$f689zrCw+vK`0<3l@XtYQ&UhnPBC;Sl2`baGtaoK5*Jvjvup6=Vs zA#w!z(w|(4`S00JTAN*{yc3FJT-$HLu57~Zv=7{q6seVn^%@I0b=Z(We75YI$4|5I z;I_YYQLP@NTQDno2eIdeC%1XBdM6t2O#5?pkN2-(@#6Zp<~Mq4nX}RY`2+5|q!7%*qzAPUK_AT7k3{fMZ@l z9H%p6d^;=2d*`sywHx3CXf6&hvuS)9@kg3URZ@re4S_d-v^OW8o%sj5N|l~K@_{N5 z^vT9(v(GsmHtoHON_oFFSX%ki!*teZ*(|!t!I@t7W?g_(786Jf4d>2O7Lw}0=yas4 zLvgW7=;BB98~PiMmX}NWs-5l@-1dfCrdrLx(n8RfIhZvwI41_I^0EbbSdH5)OF!e2 zlQF~=>@9vsoE}dx<*t5z5MtWZ=|7#o|ISDL2e~r37p|l}e)eusF(4|eVh`eVY_SV! zKEO32pYu;#+!u=(0(d6aL6&t!nZyF?EqGTWQu(HG*x{CiCB2 z>MSy+35$u!)BGp@D4X?60Z2rSSz!D`Sg9Ap4xMR9QA8LtfZ2$kXhF!yqcGhWMpk`c zM6*ViX{H8cj8{G<`yO$xj~EuG1^3r&pR|05+xntrt9!*KcRmPF#gn~`lcrZ9oJ7@ExsMeA+ z365L2R$ovUeiv}3mB)4a6pkAQJ*$2kqq_KFwv?eDq}AM+0LSGCh;dxEqJ?Tp_BSzLdFAe1L2Hd^66>a12F&Q3kfj zoW@iHM3=rumzrpGI;i^g2+HvUCyA(JuD$bi$@QFQ#Ya`)SUPAym$RK3E3{Il2t z+ON7FoV6kgnF@$L1mjGzK^|HT`If^nx;|IgHU82#$6;qi!_TZA339KBRU-McR|E=> zGnysaCQx7YuRphB#L)`|5t|PEf8CvBP+Uvb?~|Z`0D%C(-4iUp;I4rT1h*g) z2s*eE++BhMhd^)}g1aWT+u#t~2?V#hNzQYgJm(;jQ=ERPCAByVvesz1I5w zx_dGQ+7TU+lGeTwnJs=1PG^j>QYhD-!;NP? z_2-PqC*JDwh&w~Rx4-wMbrKZR9JyDoB}{$bU#Az2%exEZdV8|7&$ns#s;oisd{`g1 zYd6t0{;LNS8u6v(+$Xo3o2##%7dP^1ziFf)#7v%BaQNTCv(k}rqN&oaPuH>Insi8W ze@C2mG1hXpc9jw?Xez1$EJg!C5Ds^`JRP&T7_c~Hf-YV~a<{_{5M6gAMaB9j7`jmGD^X|h3Kn* z>z37~`F!wx55D64`}5o62mC&sqocQ}I7+lvkj1A6$$2>$?r+bX62sh8TEbY?QQUkf ze%`_xi_OekuIo3BP7W5wp2sYlr<$~_HCbBt+<#1Q!ZzZ+87&{W%4;28cDief=qsmUCapEy}mr{3aEUxVrX>Y$uOH7n~;wS`tg1t z4A#2Qy_~Kvg27yr`B_!Hi6W@S@Je)zVIjEs+aSiBR~}-&wVAqDWPgt!gpgoo^{9!9 zK+tQ|(G~ohR7)E!@L38yEUSLBnzq?LT#&hktc)?+O?iIH$$!lk)dZCV)Gka(TpWk^(UtW&;2vCW-_G$4eZ^#NJhVt{l!&9j!dcTLndg;?oio+hjd+Zu5g60 zkz`ne@p^d0Zb}HUFuz2MFR4oNlC+8lrXPtD$0e^u4%I=U#dWduny~#(=L4i*UgUIk z*w;M5oZIUk?fX97NC!#}?jy`1#xV|B{R(ZpHxS*Pf-G|-7QG~ojJwiwKFNQ!ba}!B zq$wWzDcGQBt)OV%YWhBmACNMB`{j`d*;Ychz2XZkQzmYY#FtjHSd1IS zAhzSh&Sm=vQO_Esz!iVrTQ5ojYP`W=_ImMcP@CU|)4?E{Bd{Gn;Dj^|C{FHUlqW-= zjYO|c>!(@fl^UTup|>uWujYwo(#aoj?1n|1vaVkG$k@w!zEH-ej0hJ=se}49luEV3 znucba5dHF$uaa#~s?{L|lS{J$yRq`h>C8|Hmc?zuN27-aBmsa8Q9pKmZhm2w;~HOn z``&2|X}x>AcyN3QdYf%6O7hD6itbmk5ESlJ+O{_I>DpF*fs8jTno=?p?;~1VA!F`* z%LYc9ph7CA(u)ZH+d%3nx=v#jwB)k}Ruk3dZODpYj|(O}47OC^30*3dsh#l-1$o?6 z-J%)?p{*6!)|4Rzz<{F$JqF>$#T*v)Xc7j<7$DI1jn25xLSLVU6yNW3mPme<%h&15 zZ_(Gk+0fvsd{d<5**Rc*Xdp|Gv+2h3PBDn!MJG1Lt*3+>(B&Y_2AbzsP{@#B)JlLOv?O$HUws)D_)@p z7}7f4VK49rh@hA-53wfLKFD^-Ej7i#HvPB5=ew`x2bMJ}z-4(OF+vJSW2Y^C8Cs=O zX1hp!qr+d-qhKdanv})O&TgB+2=T3yKznvmMwGd?NUmf5;71OxnmEdp2baTx(Q2|? z2gRbV_D#WZ6J1^B&jz}9hwo8C59r93ydWDZOU373*T*sCCB^+%USY8tp%Xus=W#m5 zw_{kjT*)tr@@EJi5~*O}U$OkablmM_F5dIDlT6iyEDRX91IFn2^d*~l*HqREY+644 z7)MHQo|$m>pnHCURqgsS=a0LK-j`pDRK84IME&Sa^2zfylS+azDb*sO$=~!1+k1%z znLoVAcJ1qumm7o@m#8N&nfdapZ$Om67La8}t=UphS$nZZlI6f8P>*R>x+~+QA@ij9 zJ;4LK4C;MOjt>FrIfFCQKGeq7tQPs=vDCu&PLg9V>orw)1FvO7(nzA981aB_e%b)i z>-JP(r8>d4zHT+@sO%AosBA@yex^p2M#3m({1@jH2cZ^i&D|a^-%c6}=gL&4L-@&W zZr+SDvDF#mN>6*(U6EW@cWpPL2RjbPJa-O5lv(tQ0n$%89KN75ITmH}XAIFXaSlp! z5$7+IPW%KNbNs?LD>~5z?B~HKbQ88+fs7!GG2*S}Jb63$z9K9;x`ALvA}L4uK}%tL zD$Z@oM`;xzIm`;|!y1 zUb}7v#}MJG4+ZaJO>Q5N1cqzYCbGZl zrCzVYTTblzn#fjxBFw%9i55Jc;x{2h zh-TO`y`bw4w!9wR0r|~T`D6IeUb$|mu~47dTNH(2 zo8kvCBI|f-xiA|v9sz3By!^LD;qlg1pB=>C2o14+BVtXc zLJ+sUXU_wvYDPIpEv#wx>`0jL`LL!T-_+=6vilwy_&z`nqfKYB@QoU`!I%%8&mwO0 z^W3%^)wu%O<`5&~_Bx@nYeI6GSE27!ByVhqq*!l zM{!y*$J&({Ogs78Eb(?@ZM87oLek!O#lLlV z+n=Hu1yezH9;jrmyh`}Bv_SQxfK9tzpMZk5qZ4}G^wI)4DdU3EXW+*tL@NL^} z@mo;aw{W!4yAnIaDWV%T=%rcG13s{&T3t~Hk^NHk#nA9i>ciy~MawB1p}QEy3c?97 z7<^XUKIMuBqJUgZT^%GIB3w%w!kKv=$NQ|#WGLX05=w>K=oulwN+t?{qSzn9GJU;S3571)d;D5AOr?f`Y(Q<(*8B~P*yvIdgIU(YM zTD}?rys#97pR!Twu z?!dd+EhINQK54vo3x)XJL$xNrG!D9FBpuS0>3Kc&Hi*q0hV6E5yP`#tU@3uo*Wr^2 z6P`5{H>uOg*I0rhHIhs2JnjoTIsDF?6PvbVLxL+3n3iB4GgFd~^##KA2ZCGFm^AV> zdD-_t!qriACwWtmAtZqoY;9q&tcmkK$?$5J5fB==~Swgqvo?=Hd$?)cOi3^ z;9cZWoyIL`(H*gy{BF2mN7*(L|5enZyObj<3>G}mwp5Vi!`Au@3NaXIb8qJ*R?dN5 zUQ32M@EGu8kcvI|fxfvhyO5g_7;e`v_v1@1Z}qMS>abrp>DuI2j9we^c0&S#t5LKh zHBip!tB%1KNk6v@DN@YBV5@%uy`0Uf zm=d|o{i(K50Oh2%zlxBT^YWxZC?>$_2|JbrtX*Kn1vYm(qQ}wzJ+cTmh|*&P=7`@CSno ze+vP6sAp7At?K>f?|PBuVSL(gE-#ehnKdc2xr^<{m|kDr*@VCSA+dyqPdiA;L|taPoTWB#@{L z559;XJ&F=|n|nX%Q5c#Hc@3{oybII*XxR!Da4nrj z8GeTNVf@bvQC=tya6x1lwRoTY_8xz$XI3?WRQNoCaD)7%acpr*l5&3M&YJIO%o@cl@KTcuUYPCd2Y4Gs?yUbEDV1v6GI?)w_VLc4-+IU&_WaJ>xQ; zjFCh)>d{3@mhd!!d;Ia+`#3@TcWTGV3hw5}wN~rtkL6ColgKBl8^hF;06=E9HI^S$ z;ZxC$o$O=J4b+DJC8h!&f~A0QqFnCiZVIo-ZaPU{yJDz!v;=cv)>^XqgG;c#Jot|r z9lQd*KDyS%qLc$g;jZb%4E(D*M?v97R zlY9Dde5*41?dsNtoHjvnz8VF`{b`nD?xL6WYS=RhkSEw!SbyuMzeY(K&VeM{zVSQq zu3kC#VKN$CAtK;?nT4J8OZ(CVRU^0Hn@I1H+j25yU+SX#(Vs-9aJnjCFXiRqOVqDe zR;ICb7M{&iL5Hx17d@3LG;G}6dUG5Odoy_{UC?_l{lTKOF%6i1G}T*zCdwS*E6G!D z-^}8?%kKn@2KGKiI;C`D*|L{>J$uDts!|nX+S>Q9K@<|x!W{{w|JR@g`lgKYgIatL z#Zd7&SoATlxHr~7derw4o~N}8HJ#mgkXmJOV?R}9Vb}G;2PO_te!NFj3h2cDW*!vp zELZolMpsE$2?^a!p5*8q2;Vr4iF%jcadfjVo;4oWhSI1vX5%5ylRQwS{_G9j5_F3| ztOU=_O*0Gl%9|TT9vv=S_MP^#`1&)4i#o2}ciAB+YD3S-{JD9mzkp~Z$URPKL2*5VUBD4ube==9VPC>06th(LiHSr49!RH&^kirdgE`^{d@=Pi2FgtLTi%cO@U`;#=C z`m)<@m`KSa%?vEw$d2L5qLXP=c+@xWxf)rg6aU#uX`;yQZi>gG8iQ}aw{gPqJ31pD zIgtX-$Q&m**iX+A#=KjY*P-l0Z<7}QmJqt?Fo4a}(7p?}UitkbC((hwDe&vx#e{I^ zcM4=tuX}fssi(_9kD}!E|CP zbMfV4845;5&C+)UIO~IHRPP;k+3JzDlH2I4`5B>TV+Q@9|8`>Dew2VuXvO=;s4klH z%qB)H&l=S$EG)~+B6-tR|28e^r%%NbthN9l5YlGw_sTzg=E|M(`IbV^mZP%y#r1Tk z_4z!eNOo-i0V| z{R2~=@YVpP=nh#XSs}D!1~2D?KSrn*;$hUCQLO*pCOLk8u#{AQ0$2Hef)NznCcvDP zi5>ET#~&P)k?@ac)$8t#um7)i)XKzRP-6gpS&1b9&I-u;*y8v%&T$oqediTrWj~xQ zceZG6eYZEK=!WO< zbFJ>>!$pqoYAeN+8~GiVWY2FtI=Eiep%28!hnposZND4F@9m1)tj8pamfWuH9n0PpkKlJo8Y`fwc7W31$>PVXj5e<; z7i3>XlEnBITsfhucb{AbrhfIg#L^v>-%?}BI{j!lMT^imh)#B7o+S}2cG$Mh+OI}R zu+JOI0vrVvZBvl?3vN)Z7c+IKF}{rA+#%t&QCc9L{m3p{ta3T!|He%A%hh&O@AyIu z^s6||PymWBS?(ww7oT=XJ;lKzcXor|zBgrzG^LG4BgG$ImWkzmQLynagP)#IHl}_^ zp(*{jM`v0<3d25%@BK_`4wO)A%me90syv{BwTywrE1wj;6&nBiTv4Q~dZ9bgM-p;& zy@VBN*g9Q|eI&u}>=7Pf>olpxr_CefucW-vZO$({g(KyetVg%W=!2k`8!|z8$fXc z7?ecZS#IKwT*c2C70{D|LnpiFg>QLwt=O}8vxY3+HV zm0j2|uSn}xVyCWNYGVdS!Y{~S(c}C7203)|P@XmkYkkSM_g9Q*qX4`HWNI!f;VYQP zqF?!1fAY4t=2p1T{)}ty%VS4a2H~%Y!e4s)oB5vP3D3{-5_)qNvyUOZ1`4-MAw@H_ zgNCCEWvIkq11(I21DbIowD!5O^m&ooP07qhlPi10)%m^nAcE9ZRK=vN7F8BiF(Nfq z)|XqJY(dGw9zRnJ3l=ij!&rW9+h1@O@LBhcnV`?x?hCr9n5i<*?hfWt0&v3znYJ8* zb}d`ukMTLO*VlD8__gkZDf4N^2+4? zG;8t+BI4GMz8IhNPB7&`nPTj)Nugc4} zEKtFy^6+f~<9uW1yzX59QoM$y+|&2b(p= zkNuKA9CdJ!R)~nulUYpMe15XWbsdOOT$+ZpZlV;gOF z*sV*Y8_2>2M&j3-Ub;ttQ4l|ADqJ{l`^-#&IR(j zKt>>1mX5%Gbi}P!AYt$_)jpDlkjHJO#$Ch8paM1PQ36iTc3|V}wSrGUC=v&f60ZGc28qtUK{{R|pP=QhEvX!6vSusoMq9@&DjZm}6&E-n*;FBbf z_=)soG1*c>7r7yB#3`wxDQLuYE>ej43yd#brKNZPQfFRaXp+&``cF>kGlm9pFyp0R z3zw?|iU*yiDrsX15nm?xoKrYHhww8!KOD)C*i!IR5H%jJU|=`7T;Pc+?RTd5M`5!9 zXWcwg?rb^$E;FVh8-CU>zK`Zk6s9s)DplF0S=9E8jP%TC?*(DWO*zK*{jAH9iJkV; zqn(gBSZA{IxC$iImM-xfeYr& z)k#%9ZkAId6T8);QIc?Hzpls?Wuu;hzvvDR)RlbLOF6k11)*~Zg>xANg^wQB7hebC zE@yFo+}Zm=L&p+eWA?;b^qD4cxUyHXtvrw74w#?=iZ@RcQcs#&ICJQ4ICv-3iNSFF zIy^)?=xUYV;q0XHF-W4D9-(A>=77HDvQg2MpPszR#4GDq)68&v4V`$KDaES8PN`IT z9sowLbf)B!CQC9yn{%YX@C%};>%#}IiS5X!4=9W-F^C`^%H2Depdoo)_x6vm&PX9d z)Hxi}$esjeUt6H$%=}nVXLTuh()19C^~kxIg6OhCSNr0@nRZ|0@|_najzD33W)l4^ z7VDGQ2YeleByf_HnG=q~{r$Br0WQgL{M+ap9lq`Fzi~2=tH%K0Y}d~<*%i(`pI7SG z=J)W0VOP{yt!=tCkoR-ECNC`a$C$q%hO)P zbbg)EYPisx1L;EH<}307Q?Q37fI7@bKR6}E9?5)|d}!7)(JZepg~sjrwuDj*;(KK@ z{Ul{DRqS)=q4`$PRkHpP;-dDoYu@l@Dpw++2iow_uexMh)H`D$I{6pCJ6r6#UH)>M zlN4ojwyIC`&a$5u593Du;M9jykI>MP>qo7BLHYn9`W8(*O;MN%L zE2<8bU{BD(BDwGt3xUSHHvBtQK@}cz@Vne1^5)KJM+5x(GMgj!*9U>ayLwxFKT&Ed z`*g&teOF{{8lNw7qAH6lX2TTNtd*x!aJjI~HLPnESh1 z{qHTAKfv;feDJTtc_rEv5Rd~+dE|-36BaGO+lj!bH@>%MH@@kQI&^6`+EB4`UezrB zSCqn*zN- z_lr_MH+rOepOURT@fvW81|v(XNX?A7l+XDe__zGV6H-=d6@DdxkAWR1U%|&pbhLGy zmyq1QYF9y{g|9aiemETqRRJ1`bb^q2oHpcW_iFVpFX_dY2AI@G{KB0)Y}~5I4k$b4 z;(v5q*T=Ku{)i5lZZk>_+3@F{M^*D0DAPnhTu;iL*eBqDkb!)W*U#xo8#T66S%_b8 z5ZBBD#P5cQ-asWJDi@#@4+lrLd*Gw_JBlRlV|&N8k7xFVEETEQ^#&iF6}L#Qz2TDV z#VilsluR%}ESH831xsm4*h|!+^^kWK%^)~>Dq=2cOwy*TO2FZ6JB-$j&d?_jaF?b+ zmE23$@$-Pjyc`j#x~F|%-}NQ#4-ZpmW}*_WbMZ*yrFH@wpi5sZxjcL^4NK)ggY%Ne zYmC@Xkk)!p^5tJKrzFLoU%x@5ARS%b(fj>I`WX84`ACYUA^)niS3teGf+>XvRh4*} z>QqqTqE-0khV%Db$D#nty=${NDF?jP&0*d9&0ZS4@^8LKNe$@PNDTyo04A>A#x9nj zo6H66oUIW#)oDEl!w;;AH-Gw7yN)V3p?bX*8&u_c>CW_m$WO+y4d6}ch zu&DnLcVhN>=He`pyVP3yQ4-Igsk2jZxFB_t*i1fTEYu-8r zB)hfg4k{SUztEdj;!Dw%Gw!^Q4I;uHXh0)=es8N`a*c#u;hkxj`AMV43^gbZ;gm@; z7>X$E1?i`K#bF149W4tLgSpH$y*Z^Lj)yaqHgdw5Ujzu7{1Wklms7-dDhO)@{h<({2}=xgRp|C3^e%V&@y*_vSxn zYMDyJ0ew@ao_t+093DkL0ZMXhZ2~N%2T6~;Egbv>F#xz_y(HG9^18EmvcD`adnlj$C)fs${ zM$3|1z0?s}E9z4bzx(rJH!JM#%c6tAV{ zdpyuN=^o)A{?(^{Q3b5`l_}Wywm_}`&ta*IV}U$e1w2P(gd0Kk0!Ehi`Lz=k_Q4Kg z=5Pr@Czt}U^p=GuH+yX*rEKLL*|J;PGWXuY^{3KdO3+?*)}Jyb}Dl#DQyn`d@?0#Lw84GIg0i$ zI}bE43M-qfd$U^)x`SLn;Pdw_P*1EKes!C`+aUI8B-;M66gNOk4S0g^a%*K$JJj$k zq=!CGicDu9A7-jrT`*gknb-;g2u<{FC=Znv$W)`7QyhP|RIXyBYHzIc6%{=$L!vaw zc`B967st@H_N+2$tJ+Ldm4FJF%9a8;V74m#Sqd!`(9W$VeBI0CUw?MU9_UyQl;}5K z$OzDmY0rTel28^j-qc4W+XYzQV*M)S3gL7;fgG(RTgm#P;r)Ck@T23&7suUcw}#Ig zb_E=?(1E^jx(Q9d9yMm=8B~19dWFLz<*&1L^>D!OmRtmMqqdZ7lMM+h@+Civ0-qWe zbxEOiT=K9Y3N-CHv|W=@Cb`hrQ5SOE?ZYU)MkvQmYe=7FFT82frTb-rXM zC|((25UC64nHoxz^D$p@E9A@6>mOj@On;q~Nx&8Q75Nb%HOk0b?hCpQm^VCNBS4g` z*@f>d;mO=y;3S~p@iOB>mY=t~|0wz&d*> zGV~V}aM<}U>|%*8C4kZ5u_O#n+o=~=I53<@+j$9~0f5Ts9`0z*U5&h^0?)vtPGRfE zP$sr%*0&55d5hcq+&N^^M)_lj^u*&r#gf=XO+O6PCQ*a7Gi2IKSS#0*d5<9ja!`@+ zWw$ec@>h>CKvN`YeocA7axG4fqZR}#nVBkY)2GzZ5wWaIXH+(uD;cY}AYQMyLCtGi zkV)O{nH3AI8U!Kt$NT!qi6(l2<61eexZQ<%0-xO>DWKpRwgd};&zo8%m*-DAQQgq= zHzWp>MenyEvB7*9-8dbhU#Uf`CS;zp3O4?9kidEH?IS9+q&v#Z+P(A`^YSCt-61JJ zLG9ElZKmOQH~4(VG<^p89vjrC#T7+7jqJAyoL%))$3H2+Zk zuFX@%=`RaHM*KDIJIxL&jEo|L64LSH=Jn^ofhrh~d)l?7a0u zFhap%JJ+7bFQD>3>ZpH-P7k#fLVe1U&;43)!%Y3GzqEVM1TyT0G40~JDtG8hgmfly z{;CzZz(G+Kmzl;+-D23hrbUy~B48hX;=Cr)MV}OZWoMT$5cSOaYU$C^7iviZboBxG>a5Hu<>6Ok71w&zPNUxmO-mzFnb9YZ&!z|O z`zVJc5TjmN04SHUE;tX$KL=HY6X5)UJH0#T7YkvVWBD<&4wE`bJr~E@z)|$%3T|TT zy7%wOn*$;sZMX!#pqnUD921!$JR<_A3%yqC3_&aeOzA^dgb}9eCS*~DkF91~0y4k` z9aOgFVWbQW6G|C!pG}Lv^=TbvfL_Af_ZcfWyN!|+)la-C@kSiXu3eIo1T_0WyTi&{ zkH1_wFkbk!97%y{%1U(>QWKwR&fcsqF<*0;#%KR$sVQKJ`^JrQ0-Sr%q-#@&rMKC| zD)9A|*l(gw*1P-gl2bGfq2BU{A|jV|2Eg0gYWlLuYim${bZq*V*TM@eJgww`C45k{ z0we+#i3;REOSU#lkiY9!!O|`25Z?{sN;9Mhb?4=9Zo`S9+3WU?GCaVl##2kd+44rt zVpZN8WU4LoY$e(;Eldo1k8192o}o_==FNrdcQE<)m9CfJ_1)GI4}<0cBf7rLp{S~S z(G$yjlPFMozE_;NOu0p}Q)@Mbc50>w=H8ykueG?j`F$D#|FLWS$N*QK5Qd{Mo)ude^+mz7MQAr3kQ~eF ziwB|b?w|$w%gZ;9YOQ$v!Fz;X0yyOEndhn~en(F2dTYjYl8O@1g^x!@VopB%Z$XM; z9;nfu*#|QGHxZk^18W*x{;{T!CW;#<>$`oI1=d5#{A1-M8R~1ev)7uM-`{xBzg0j_ z;M!S7;{Q>0377o09e(}ldnmAA)ol)|>OX0Mf649|e*d9h$WSx^H|UtW);Ish|NO=e t{-^!DRlX|Dy?gf*?oKQI|7NH&&-^oZgIgB&5b)RcUP{VKl!)p3{4eUtwiEyW literal 0 HcmV?d00001 diff --git a/docs/images/backstage-github-app.png b/docs/images/backstage-github-app.png new file mode 100644 index 0000000000000000000000000000000000000000..1bc87dfc6f10e65a2dd9420dbd49a9f7bab75754 GIT binary patch literal 74537 zcmdS>gmnek~OS{bcAff(^} z*`vP9PSB4_hVhnw0x+c0pSlVtj_Pxk;59D2iFbOn8Z>sAx+#WYgkbQIPEkR+dU#{dTZ_i zWqrXY-A9%&xut8a)@siST?>#mV+`Vj*Wun7?-O;rn8>16lemW8CIpy2Y-NxT&@{f& zrWQ%emPhPWDGWy$ix=ttq&F9)#csWPca2(M*pBnPx1my_%@HvhBC_Z*v(NWwROBlY z&B(YvlMVesy$yLga#Ob0RG?KmV^9IHY+UiJzkOyAxutJV#X7anqRAJJJ{eD_xFgN9 zWy}>6VCbOF02l;Ve3%!|Cs^nu2utwaXGvHZ82G=!;b36GtY8rSiK7U;|Ng~8uit6@ zzQZSm!XQH5Frk;{XSn~whS&WJ|DR`AS?D(y5j8Ox8R%Wj#M#Wu-o?_v^^zjl92$V+ zD6QiH1A|NX`+}8Gr8t4+|IPd|>!Jd7+PXX09Jd zJnd}lU3fhO$o`7K3w{0_%uGh|R}@zp0Wxg`WfCz5XEPE`CKe_ZGC^b#5)yuAQ*&Nb zamjy@L*E3*EL~k4d6}6#JUo~@*q9ugEtuc&@bECRurjlwZ`KMDDnf4BS(N&GG5ze1sM7DVP}{%@ZNB9Az;*+IMU zt(CZvI`j@5WPkmNpnqwg*Y7*@0$av@y?zY?BMc)WE~4%UdtiX*tKK);wwr>U~r0yJ2k0M1?> zT!kuJHS%wi=#TUm@AJ20*_#<9SHF|4;^N@+5mgd|30)8W5$W$-DS@z5x|AnHXUVT& zB|l=kNBH-)`kky(eE<9USR31a3ja@4gptHQMrb1Wmhn^mpF|%qzSaU*CR%E5T#o+} z`@i*9hJ)5i1I~y}DdK-h`dzL)1DrhAp5bYU@6Xo$l|`~JLb_#2XPT~hF}8LUuLS2I zV;I&qQ?f17GuUXDo}QjhvLOiLedjWY9pxWYpEkF*CDRgBv#T~DgLcl(%miV(akQNY z{;iFp3#qcD_|Wol4xMJXOi*~MpnHJ1bCxD8HBoUt)gf=CWQ1$dajI0qVDD$e zCx+w0ea5F(8FkFR42!4btS+vr_Xt+e7!hMd; zy6{CvYQBi^7aRo6_9wyQtR%T#8_eTp0Y4`LP<|3@O^=|MgsOSovRv+*w3r=^!fhPX zh>V*4(aWF1$yS~7x7K!LQs`zsmvihVl!TSMJG{71*R8dzIvwVcKn&CsFe^3~}7k0>j9JSQJ`}W#*9Kt(p-mF zkx=0&(BItZipbp_BDLasQ_yCsXz^!Ddr4MR^S6kB(ucg4Bpx37FDS7p^Y3$zDkefj zD;il|zBVjj>k4tcbwYPuF`@pR2P&0bMZA=eck-jQv(J~VZidqJuT5j4E$ zN}kx<%DEN`63EASjV)|K6+_15ktBx<$}`Zrnu;JVDbqK7V?9^LbbEIRuno^-QzCUX5W8?V)@(>UFW-W&DTIJg%6i~dTP6!RXwk@U;-X8H3kqWCdr%X=gRL@%>u$buisScHAV_a{n@3$_ml z1_c`{7tPpOfgc*1o14wK@9%Dvy>&x%GQCSzzHp)v%qR(hV&pzIV78&L$) z8Qb89;%_MSs+I69{NR@oNBI!X9Q}rB$bdUd`q^g>%Ov1u4!Uc>ksse+D>%uHtUln~Qam<87^w^EZF2UNjhhugR7#UWOm=Y>>eC#8DrSAfBnvd42M}%(U9y# z{qvDd?5?}KiRzg(WoI%&Tb3J~FnVlccRqwS|6qT1aaGd0!AC3bPVwj)a)iBT^L$3K zt1)%op|)^F+UVk!3ToVB%Vr;MENKl#b@(&1R|SPh-)Q`=S?O?8rpg3#uOU9nFAx!j zNQFH=++FM@r=%324^UoTqaR6VSZgHu1jiEbivZJa-Vf5(*;zzrUbdv{W^f@6@vit^ zu%UXLe(-XLvJ|;kPug{mPJ~sxn(VyRXGLdcJu2ZcqcPSr=X_itcgSeCpF~s&7YdMZ z1`R}{mD*Haxq3Vw)kTx%UvBQes+TyS>ew&f)em1ew_T6WAS0tDdyzOYzw*ptWjhOy zBJuPi{wDTQug#Ktr84RNrDwHG(6)r z66dsR`Us?E<=jL+y0~fh$NnMZ^v*+ftpLjs+;82az zxEH|dag^=N0Jaf{z{S3Sg6a@WC> zfzm3T`}k1&O3L-S+$O_>s!yeGA;{-OVQ^p|VWR=Zna6EOet|BS@vOe-yO2^*kHUSg zB>HW<@Wb4{8WO7P-TRP>CuFyRMcQ_KsK$HnsF`o0LjX~NI~=!kB$}CpP!%1 zD_DkFxAdc*Dju3cDul(e1vrVw*I>p(sPj$(Qh_c3o_4wGQ%m+VPCF^pDDDI#mB1b5 zjV;+Oey}Rl1Ln{8{=nYt6BUT>?=|707@*f^$4z`ik0iby*zYsYCae79<2I)~C_UyV z4YuE(O7Iq#RxmzUlfx?fDv`vAx(Q(jegWcfOWl5IjR!{l`jQd@NFsZiVv|0N=HVb9 zjJ5LI^})>|0{2H&SV@>V$6Jmc6r->&x;?1dE#rAhf!$9xPOyv_-v&Q)yxu1;;-?>a zA2-i8=6_VfZ^8P9ZJ?a^w=~%5te6L76$JFv~wzN8vX=5^id1MiWy%NcC8PY9?!b? zWqM+=>@oi}PZ34Q!j}rn97A?zind?R| zqg_^dXe|3cdoN(z1zk0X^V0M-V`a2JBkC-zK+9yC{!go>j}U5fajl|yd)}&6U=*{Z zjrKBpp6kPkQP~OJS$fg{KRZkXY2k!hpOZ*5_$vz%>7Rtmp){zQWnfgIV%@8`d)FoW z+TK>I%ze`Eq~brvX?9Gtq^&08t(7R$jk%FX6!p2acI+c{Jqa*+B2K{&r@mC>jlnlv zut_1Fz`y-29JCH%jW2IoL#`5@y{lHTLTf^8KMMUhX=v7<79!my-Yb#t&!u;p1gfCc5UI!|dBRZ5cLQa5 ziL^PEhZ*Ob2EhAl*K;J~67x^g0~Bvbd|fpR=hDwCMF1v4(`()wUPi}|rjYj`%AHvB zPaL_IwS!tnqnMT3aZ0IV#8=ZuHdnrZgVVOmSq&1s>H%9rY1G8TYSQ?Vv2S_u>yR(^ z4u}|YN_Qr=Z!s#LeWZSTu`%7NxGqM@cNSd9AfjF7&AT?l4Li>D5Z#0Ft?#nQIIu0>mKZF>u8iv##!YI5>x)x~A3Y+>LH;!JF&oSMPgR0AHQ`G*Ese_N=!Q6?vhHogn|@lDRSu0bP}qg z+hDJRJaD~edX{<|s&?1MJw$dkuaiG>rBgeOYYLlqxftL(TFzKXZ7f)`E(<0i^5<&U zos=K_urYXOexJu5;)sBD7D8I+*b|^ibEGBUV?9=BBYH=bc zN_yV~whGwSC4NG8)5MKjZLJ8d$2&}QPqp;BI@e27-rn9shC5_h%z9iF0vkW+daX2D z=y`F!BibI*l{|@^XU$#I7P-r=$KyG zC>CV5#3u*V6}V*c3U~Q-5JIPU$RAABd#n3f02lCKs2|@h?F5(EI5_#wkT09uLI*Wiy!=6aG)k(=b=g}k&lrAXTZ}PgXXr+wRPn+-+YA$To(ub%8)+UC zFlcW6TH$syQ+)#d4|^WE9mW-dtltFBHU*~3)vz*(gT;oCPvHMt9Jyej8$skX%6(FA z8=-Gfp7hQm-bm%zaeFHknCgz=U}HR`&us6uqs~IfSMnE~&ah(Xb~5 zN56^_P^I(Bc=yNL2QZ-t#-GzJ{B#}M z+a}{SiZS7RHE%&nK_RZ$7uaXgA6o=wU;Gf`eLw4cEWbk%t{QekRh?`W0C+qixdau4|AnbuW)*d zLhe>%^WZGUpcAs%mp_P%J|$^HxcjNHq<`Y}hCgm^5zFxNIBOT{^9V+6=GLxXz*!H$ z=HWhNn=3O)hG#Hg-Mc@utz$iDr+5Vr;yJtpFmQjj))6%LwNQjLjH#XEE3JRrKe@8G3{rN$ArcI=(%lK%oV#e!3MbygVl%)x0Z zV8zB{_y@*>XkJp*_V`4KQ24hY^(ud^a`%0J4j1_?gB^%p9BPf_SZCeT#yifN1L~c6K=F+b$Y70W_75b8R;acWyec`FeP%5yQ_Z<;$8;M(=7mNPNEl0I) zQ>2f(=5^?&42-?-PZ=V0_<|1!7w%=<5+Rl|cKTum5y&Y$qUqVlhu_lU#ZmnA@e)#D?H${p?LGY$gcOYuY1~iAs!50LUM)F^< zr%q5#aNuy$}SQdTN+}He;v~+h~0Ejfi+n$DnJj z`6dsA?%WA{T>MwVVtpBZQ~33s$xp$qIhJM4>%oY2e~TXh<|+oeBnES8bES34~} z6^jkEa|~7cF9MLOXGf2uQXaq>CLCx_JOdd2Oh=WGp1VzXrQW{|D{*; z759W$En{!#k?uB`&W1B&I2j@G)(o42kX?m{$d-1Zssiok@m!#M#wMAe1i#C_RKNv- zLl^oJ1SbI=FHQ@HuN9J=X@lYm6qc!EukXCH%D+_Z?^Xs(tZgM#*5xl=WhKc8&SZ#ml=(Z>9dm;2={7Yz7FzeU!Zr~g2_r> zlSRg2YVrrhvT82Txh1}D{$di+ijj&3G}Q0}Ptu%fM{|E0boyGT2>$7J`|;I^*rV`i zz}fC&viDPZTh*($pSO<{5?|M)SWQ{L&T12q#U$oC-%iAl9NV?xfqN%NOj0DSzc0ZCR`C^o5ZJ51+15{~u)ZGdDDYitx6EQciRgb(<+3 z@%{EzqoZnQsdk_Y#t^pALp_=M=iA#Mapdm6r3n&r5Ir)cyaIBoDsf`)@1$E%0O1 zZ&=${xS8kwi1v4$>6WJ+|F=timy1WPTq-^U#fX25#5mX08}QrOkK)3m@S%}8JOf)C zJ+X3@?{h23IH$Vz-HPI6V`#{EK(SSK6XqHD$=X$2cG&v0f@VdOlWSXQk(1+JzN^yJ zp+Prgopb_gtGbbkwVia2l2qz(Gzv`|UnHB;n5U-A^k~`meo3N*-J2s+@xgg;R?6fB z`n#@PcVOQQ^;VA;)tg6a3P@p`;}D^KZh<=Q>vpj&6;v8(`k0?_0Y7%Vxys*vLWEEQ z)0eX4b+7v#6;XSb*%S9xo1}^NTatpppM`@ZNX96cm z5j753hszg2dI+q>h>K6P%^;tHiDGQVdkzVHK&1Sy(GBEfm`|jA+xW}mX#-?_DjG;L zDL=A`JZ;iHp~=V&#XsYfI=^E&VDgW~KX>FpzBtWqD;b@*3E<)u$Qr#YS6olTy)+;biq2n*NXs^88*dFM{POMphxu-Y?X;8?W-8TDXVeDv41Ej_E<(H_OI z!+p{=8et$fIhq0g>5#u<-$`TCj+QBC?5rhfo6FuWq*!VU*Hmc<+GLRskt1@JbV=Bk|^fi8+$O>ZEbT>hr zS;9sRnJ1n~&REZc(NKKYoS7MOV_oE*Ne^{zK|A~wb?YbSdcaRlC*uv+wJZA}5^v~1 z)=t7Qoh4kQkaDvlgSXDg;p_sn5Q?tuuB)8K%L3GcHSH8hkd8ot$<9=%n8veF0@?(2 z#syfFJ#rmIjD=>6g7Y= zd%k(D90XEs(UlWz`&g%8dRBDv$@mMw?s@{F_qz%oW>N^OQpSJL`l?WNSauH#hr4 z{?f$OtPr>jNygLen}8YudTmmElY4|Xy#+IQVu4(A*%g6#<7nHhkx>;b5D~&j$us54YC1GMo?P) z#dw#*nsPzw=Ql6LZhy)HRK525aM{$^^bHHkjvb>nxW&r^8fkIQhdi>Ru|+VZ=vcTw@*3`eY0w(3Z+sQ_}JBn$wzC0bFu*#ka%PWLvVqjy)h zGYSwyeiNs+E?-vjiixj}6}N)mY4qOnUSxSCr)*@y$n@+uUl=n_p=+IU9v2wR9(A+W z>Y7^8wiL*qMgouuNlq2jdih`_35=B{Q+rBi`KXWm$~}UvadVSJ1tbKxP8Cy+c}3~3 ziHht|%Vo1w5RYd;?-3wzzQpU_lttc$Jbj$VC#*$ta>HV?G@{P5mPk!Frc?va_I)?_ z{4Bl_Qv3XBqgCRNUdN85Xpo^7DXiJBVydLVcFG=0?)^l$7I|= zcrcnVep2IBuBRh-j7LV;*lsbW73%SdkMT;fYCb?8;sJC)K}U`cxH=J- zSZQD&5zN$xN!H%*a*}7DEH=mfCU_72LjHUt{WV!~$bBBItuIa(RuFO)hV&k`!XWR} zOvP)aW3590Nej%%=aC2|EcuaYPkfBYh~sx(xG!lDhlzjN;bOqARpJ%yM}~uB(j_QFTn>6taXuI=6;+!1ql}G^aOc0vWFPZuZBrGQPve;bAWK zS`$wlLXGmc2;*7S*F*}W6ET%%@s3ZOx(m-^{jNHId~N(~t#8-#i8b2WTjmzyM?4NF zL6&VF!BSvh=q`vo6|TEtV0#p)?pwf9$r%KPs1j-nA;0KCH1pBx2uQ@gd>%$NF+IB3 zl4!y95KgUsP(Cgt5w|&*t5q*kr7S4ZsW+c+=y){e|F$PdtvmI+sQBn$Wje!-%gQWo zWGM+Ke$^4xDxlEKrHR9Uc^CJ*EIo10hIzR3(NjUErSC^2CXuYe%8HJlgMf2praF_u zW?7btvD5S2a1kfo6=QF=m1$h+|PSGREC6)_k{)&{$o^%JZdRGSpE_^=`G2 zG}&0A4LeE-G-e)pSx)={8Z8K{NrLHZ=OsmqJ9KL%NGG%|$A2~%2ax%j!pL~p6CYaMeS2eaXZ++{-*_n` zb(65xZ1pTVX6dwl9%5)mxz@Ky#W*id-xtT+vWA#)zc`&FbK|sH@q()B%|i{#_FC21 zabWMXtM|6gu+VWBV)(r;&kkBQPQcF-j}@I$c!d8QruO1Pvtzlu?)!|?Z#?#1+pXxc za@}zfvxc<7_x#5H7dRi^gfZg~edhJ(pc*=OIt*||`!-JaiTO|^F@tfQ43mD^c(lgKFVC<(&iWK zL3i=8)zM*b9r1o+uS^pBBb(U;)~0PwD9BNJDWHJqZCWKmtFeZ{E_BJK7NDAb#*A_PS}Oq-zJbC5;=o}Voh$ia zxJU#3iPB%z`6*tzt-fQ*g7O`Xna=fW1I!Gv-jl}W(fOupDfMR1#oR4Fq}Jp^pwZ>p zh_z}FzgJ5Z?kL;rQDFz?F;_8{FpyQ+xF^3ms3`2^^$A^(*)|3Y!+Tc=0S0F`OqgRB z(UM8l`c0xY;JjBvR1DZDyC~u*p?yyJ#>gCBuod%Qi%+w$QD)QZ81$*pxfpF#@XSbl z#oS7UyudI$VlFb9ObU?)L%cpmT~NF~<@cR5N~YUBjNWx=qWJ9n$cr;Lxg$tuin;C1 z{S@@TL49r6a>H&AGY`Uu&`U~dV&wc@JcT4qh)!;$)KtpZiohPn)l%FcB@fU@LV~`@5`m#-P zDh>qHWsvz=p_4r7_`ScloRR6qSik$)NH7-~h1%mzjrYpCJMRgq0y`frKfRfvZ+huh zEbwygt*v-T$B{4wch_3>UqrkP2oW#kGz5aiB)j2}r%rpg`%y4q9bUH+&*9-RKRwXU zEBfvA0$nDMF!)uE`R63swd4+1v~r^NC|-GyJl!aEo-my%rr$(e(rhj)wvHLr*6^Id%BgvG=}=C^Y+Po zwMIqia;N)xR#Z^Qaz}@m=cmH{?X|d=lUAs`jT3wnJ`twdOAbrwa{{2PnA`JL{ScE1 z;moltGU8`MA`6FSXtl>Hhdf$&1yGsikuYOz3JAK^1+!H)`adU&tO7CTTvrj!POhlC zFe?E`isO#BxcuIOs~kbsfMTB_^>)gMAd8v_@{J!_!N*-dCQsKbb`5<)0|oH-ju(b% z^K-5e`&fP!K<_}|*HtAM@SR>UL`8*KS6ev_6G4KpwFYmezTZAA3MV*O;JF7*Z;DOt z0;hQIvmz%;{6P0&gYh*650&Rj2quIn7@-?-P*BJj7=Iq?%+U4jKOp(N~Vc1uUnBwdB!N3OHs{0gl7!i(BzX7?c!l!xBTTM^Xb}R_MBU zKje-XNo5%;W#EWOlZrBlSSIhDci)GJKSu>|b6_JN7uURX@{zOFXvQspa0VT|&gDjS83M1Op}Ycq-~oODu=(o~u?~Rl6wh zzMDT=#zI(!tC%^LaK;N>o!%CT85f9$Kd>5<7L?1PMo-w%eRUt(`XCk(M)8SL{(xD4 zl67NHO1aNl{ki>mQ|%vuPK<3sxKwws3_LB{R!~A%)=zQ^S!OJLrTzY_@K=*=`3>i@ zTD|_Y0@9pcM%e1jJdN^Cz8+$NxXd(o1(?FubIwjzgP5U21=SSFYLWz!q?(O=^YPP$ zVip3hhWU!7rY zx7IZyPR~Xu@}B=kdF}(|G#}lbxXn`|{Ka|s>-ybRHzSL3T_$z!uS9rzo{jR)Zjas= zjKL4l>DKMSebsZvf^!;Z6O%Rt%tRPfVKr?*nTpcNO`pa0x4tbB5P^bLgZ(tMfAnw? z@=D}B*DFF6@5bAh#(afxfma#1yXUGOKnYWuL1SFzD%u)LWBQ{fQmHU}~cnd$H z^QrA^NQWMouGV+&Pfhc0lu6@ANaJF2$rsP?h*BJSZ#8PfESSch%^8!f?+{~Ob$Xy& z<;6dFm_H{QuFU&DeO{v0wagftR|=_vwVZ5(=Z+kw)kY|&kj1u@98s?X{1Mt0M^Qp^#{E(4jwKTg1{Mf`OA%DRH z$>+M>AJwD?_z<9v?)#JY2MPeCf2}*GEBa*(%cnG@H~jd66?u~f2Bh{U87JeN$lm62 zF2+Vc(cSlBQSf#t{VG)2zWj4l?ZA2#jKV2Vx`&b!J_?bE>(AQi@A%!czY5)@>=M$e z7Ikdg6Y6vi-&pg!# z1+#8Ai00L@48O@Q!a{$K@XEEv1O6WO!)?NAH#Gciv)b9wR?0SwsWwHxg}$fRT8^73 zNm%MVlLAGzuTi2IL0_fP<6~*_<~5PBB6UGI5#&%#NcT8G?RHN$`%e9DqJcg!0&%3OoUXuutM6Jfzqz8VykGZEv31wzRiO@nqE#Vyhjuzg zJLSYXo8MPP_Et$-9$^CK1z7#=m7b+&Ps5^FUrw;9%5z!aDTbfM)JSs(v}9WHEQFc4 zz-VF4@X-M#oTowb=dSseOX$y&&4udq+r-BU(Y%H#mTC~Rdbss9Ng(5pG8+dKWkBo+ z)6k>lV154JdZbu@$J?kR5I=)3%8;Zh-Ukn@X6%9wYUv!OTxPSg2PJG+*`syp`(q!r`QD=rtZ+kzZ z*FBM4ik4MsFw9>fg$8mpcAaapW zG+UB^R+Q(#;R44!>U``|-Z9eDfE>|;EEZ`9`mV-in*fxOw4;88M#H!{rDpZ0g|0Uv z7KE>MCxO9wmt)lq_2vvH%We|u-Zh-OdW_OztC*`}*07#6Dn5LARA3u$Wy_}o@QX6n z8oe?fs|W!q1Y38ndoUJ%Lg^p!d4!jZ`@pgAgCZxqoV8_d^?NlUz#-EG#Z-e>D?|!v zt<2FI%Wy{0O=LD2XC>p$I(>hnhHsIxvdL!SxY-vPsjH3KZH;AIHLEn_6+31R49s#-Ip* zvL^r=dE)HkqL8!6wdCVRRp(8<#xF%v)P(&YJP3Amz)-@-aq%D_Q4*mEvpRITlY06o zMzM4wkKB(#sZ=43V!_xWAIn!mk>Y;T0b@UMy?Uv0;V0VNMpBG>no8 zuUCN8YHXmM-F#Gb$aZq(joo1wxZIHv7Uga%geHc!NioGG6u5d{d1Y4SeN%rL(Ct$R z>5!eR?yDU8b!;maLoc zuiG&}AESBsjb6NK2p=1$JIt`A!A5}}ia_03PaEdQ{ScQrP?c&avI-BOO=mnsU5S@2 z;}3se6pM>NWIe6lu9j8r32V5G5g1hgHgAEhTAu zebwfxPMSlfWUznf7ZpU$kr-#w@l{I=i#=srKvzo+ocsf^@SsVNpsdB+^Kh|=nZt6t zljai}*x1-O+Cpo2C+}0$iRELi@}sK7C^ws=1o(ha@siUuKg0zr_-IoJVx0cI1TcKT z(C*Z^qgS7nwYBIY%>CAXCUhRlRTxynExJ1Y}`b07;f04@q(xRKm^i_eA zALg^kWaySvy$y@_TFN=!hM1SPMOya%%*8UO=>E zp^C_(w_cDWGk#u;XU`gJa7JDLRR}{~=WNi9#}@nzjnCaIwJKQ95t<`!EOc1#5eixw zIhCE1cx-qp2O|}}6sli;OY5mB%t9hnb#QVvAiD6td`W}8q+wym!+V3PdYl>tL!Te= z-F?J622<&Pec|!~>2s=5Ccl)jXfRoR9dyc*#6x{$i6c9ROcm~=DCjtnb6p{#DUMno zy1Z^!2umpF<2xx-ybzYScECE(lLXVN>ZO(Fk;>8~bEqgSkE1dcf&t*S- z7D4=DO6x70jm207eYj>)e>npB#;$vEidDm1~X8jI_7rTTPVv zi{l2c27`MxM?(qn`$!ii{`ck9^w)58OSGE4lf`N#nb0~tpz54NW>?Ur|kNL>cb(_Z~QRMEKXYIZ0pl=;hky+PcHCk zI>WIr5_EFRejDME2~4!QOXs+>YA0C5luU zG-n3uwrmoThanbF9dOBWF7VIXmj#ooq0xHG6>W+yH2GvL>m*-1>e78tg#Da+Zhh?^ zBCBOnlsLf3pm+@@!oBe^ULnjlm-V?uR=sws4eD+n>>KvXAo0zUr`A2OhEj69psF(& zd)spQ*aV~MHEq<<^Dh&xpGoB&4dN)K=y|cqcnD7Mrq0L6^S0tWN9qj~5yKf*j+a=w zUWNHkUS4mrp)~pK+T!UD&2Avvgw@T7)Fy!~@}u%#Ox~?PeCcD>B&e2+OnvKk zrtX;`IeZc#l|VNRGAhZW9CP&Ew z?&ZmsKtN|j2v1pkiMpSZRy5vy`ukXla>m7vCxN*Do?zJ(_cf=UT)}Ag`-b>1pVb1> zpDIQp`_|#Od;2Iq3DCS6=!zk5|6Tnpl?G)Yx$pXo4e|5Z2bUlcB z_JB#Hx|{@8woq(FV|E{kD_#lzU?JXp1R~C_3)`g=fh?3{PB@%W)6eSW?nJ~!q&oIc zyu%y$8LyPfk1PFGYb(z|7i{_dx(%P6mfe*(QFZ*ni{2BFOvIuwFzxvT$(NtkohTaS zl43Jf`v$D~`9FeUoktsglroLQiv1M2F-d`KL&lN_qI|<>?}wkXP5|{$ey#fLn0DKR zgtfNzZh#vygIN;m{^}K$wW7T5?)sC$f2j7W}5Gp zHxG00aDQ3yQs!8`&?ptVJPt4tb#&gawwQYAVs_FyRTu7&+R}M zsN4973niMN)ucOcXjkiE;H1W4B=x`<*W zd5Ip?6XB*>yw{Bd7)zjZ(!8ZRP!jlct$1-htWM~omE&2?dP5`vgAnDod=gu00rWv- zJbZ(pxu_pJ+r26hiKV@1aR*}Yxqm6*C<6FMAWh6)Oj5c*bjY*Yj2=tw)!;@{KmDj8ftN!2yEhXPJ6t( z@pOkr)H_6<5DCThwI2}$b^j3=NA)zndmMGkoAX)r2H>q2!e@++P+3tzs%iCL75u9uebFZb3Hc~#9m9Sb5 z!Z1Pbu)u?YdNb|uIAY&03PJAV+rxQ!TbvE{e`q0?!7x~rm=~;GbkUt7K_40OHPnAq zjmiZj^LCGA&sT>w3+Ln4O|T3Bg))8+_aVb>VSN9Lva$2g_{B@~)ZdJ;z$}E{2TKN` zwyjv>{yzOHfds9Y#ID_m_Uk}`j~@%f-aB+UewF(-xAzFL z2v81>Y_H9x3=5oATxX}E!lp=t)(YJ0f9O(?fM}q_C(2^oTofJb{y`IC1X;4*N!InY zc;3Oi5QZK}hV5L>|BFP1O%AO-PC;6q7-PckY9>^tQ1=12<6y$jc;j%={yYKOsRND5 z6NUZ%!TFQyl==M)2^;VKgF^TJN9mwwpqHn2V%BRJclXBnjWuVuK4c=DJ2aM=1 zS7TNEP}fT(B7Vx3`LhtDV6FT)x9LV?XK+Qs_*DtBVLmGKwCsZ&BCSGvwR2bCMSke+ z*>YIl!?oTe;$Pbk@fLzZAwLimBg9nWC6Y&^|KiWc{P1|y?|dVpBSrA}qsP#r43MN> z(cXDb_Wme*&er+avXoULN#%=oMh;51M46hjO8yW-Ney3Ov>chwGxxDk*Iskd*Vrqy zPVn|=p7uPxnZ-9gh?&f=3X+)%>HT^Y91tL36}$^epp!0vlnfN`}q%<|5Q#GvfyLJ@ z++L&^hEG-rr(ag4tCT|x4_%@_rsw|uc%-ttprFf-r&ZWm3lk_=G2O)Cz$}SPyuzST z)?9q3?j6Ili003T7cBzkjvgh)x!`9|Zq5~RP7_IrArTS#Re~Or9=T7tv&WX*oPdvH1w#hdg_*|717+j zqBj6yjcyF<+(+Cn$bE07C>w{^|7M?(uIJMdoNpk+Z`LGqhg1!A2LA?I2K(`fK6J_o z`!jZ2FC$SZuKtanzPC31^3dscMgXT>q}HOF+NtYH^^~#eTJ*kr&5Pcv$l3ODsrffR z%mWR@Obftf&@8I6rKQ{S5G*JtjA@KUOJE?C+T5kb(+fFGn^#&X`N0F-F)uiP#B|0M z_#T>wBm)waF<*HrC+a<{u%|oR$+RF*1ac~&=kD&EkxMWPje%Skv6cN_WTc0H1-}PW zhMV)Qgn0z~QJEeKMSGb_C67}C0IJuevBviJS7SP9B;Y|5IMs3bCH=)7cVk-$TL%6s zT7vn(i1++-kU#BgUK@8#uaio#>x=aZuMyT4dId&f5o{{#Fw6N^dE@>kZss6ZG z(%a^g6+-J$L7;||q*wXy`y+>+Q@y0D>ytQ?+}alxRxyH0;a;fM5@SQWdayhZSKUJf zxX|mS`0X)*T#EozbaMT8Y^r)fcRQ&0pYt#KH^pBz0W(fF0v5~Y z3T0%Im?Z3;Gy^mKsah$eCs4V>eaJfyertSsxo+&8$csH&AP^pQ@a6E`swhz4`)>Q& zRDl=v=2%!!-B&s{JKuB1+}q;AA z3(ksb)Dp0pKv!_uV;F;kUe-dJBMdcck{_K^7F-ePN#k<(qod5jf(Ncw{Xt}WB4!dN zU@0(3bqs$Zo8jLBUk}0Q5!!Z>1BiT+7e5qZ&rQh8c5On90`CSA)+?ReDFSN2%A$aM zY`D=&W-$Zc!two1eCMu^_rIxdYJ6}3z2e0OT*R=xy1Ofgh~NZtTui)#B_(^W&A*-ThxL42Ei;>_c zcw$Z%OONa2&zs;xfVeSs;MS03 zp*QP3)JfojAq$T}1oPR!%RF67Rw4w_q~X;ZCZiZrrP?)&?RL)ai=#v}q)6_$R~#9p zMb733B@sI0OfdZ5QjUHwG>NoAkz-L>k=q zGZrq=E+YunH|%B{V(0|V!Ep(?Tw64|`wMOcdp@4DhW8skeC2RUCtURoqiiiccQg|x z=G+A-{l$?&@UIW6I4hE|B5g27`;BW4@9IDm#O8GJtyHZfPT6~|T zHrwL0w6=hj=3Pqh-joTa%m|?eBifT|Kt_j51nlFYAbfnWnPdME&vIif9hoa{o}`b6 z7LwPl{F(Z6&p)_z=t7d|>)H}l?_jiP_cpt$i_PJzANqjLr9ER>!{bSa>0u^yzz44@ z&9@zSuo4GF;efg6g+AP+$Fw_LD-GHRe6iagwkyAoiF!FBP1|lraH*HHP}-+qAH}i~ zpA^S!tDcRPVUWvJuk*lbUu(=eIeK`MJe*a1y-N6dFZf#_`4ozvgPXg1x-H9f%$bj* zTnM|pxgZ4czQ2nLDOyZ-!1VdxQUxYq&?v5}sFixigJBg|Yw=^C{b=XWqeC=UY5;I{ zSxGW)*$C@Qd{O}n27FncT5NaC zG3K9&!|s#5I`oW>b@}Wz`!~dA_uqZx(vXYfSvE?4Fl-|Z^M)^_B;Lg`SQ(Y);QYn6 z-q`HPKg!lC#~;WQh%PpPYjiu3WPbooUH2d-Ddec9$totAH-5sXxb#1ZDfKq@U6U_< z6mpXqJI`}1GaFF07emT0Wx_r35ec~v`9_yh9xS8*Ex<)yyxmR1yz<53_ZpSakH7=J zt1m+IUx)^E#6IZ76YR>4&?_COe#ZjuOp}v%);u!wKBKwN65TV0**umGtvXEHDir?Kc|yzx^}Oub;Cg!QhHQ zs~sATFC7v`x>_n*uuIj(h`aF@b@ieu=wU%Iye^JT?{_rRnF}QbF`6!|9)6Tmi0mVi zB;a!zRJv2%=3XJ7pIc2p0~wH4=9T@6@LFxK?Zv+!onKIhPwNl_+@b`BfE{S!sHc{| zVE}&bNy#uWz?8?JAzP3VUq09NQ%Koq;PdTL9=Jhiv&*MNg|i@F+-4YHwWZ5N%&UxP z@S&j?Tv^=g_&%YW+Gbey(e=T+I`q@Rl6xK&6JlE=TEGX2lQFw!TyZ1}00IQEHEyYx*G(p z5zgP;#^}NL#!}U+ACxdWN8a2Ql))eEEF^}&^&3opx1`7Lnoajy22}B%hT+NkpD#Ow zc11Ew7YTo5>M7;ko>s5z9Pb{+ohJ*UcKizl3ZsAu6bGTxxGZO&eH*(!Nl^t^P1BPn z1KS^0N`JB`7K70h7fUyZb-WEv(il!W&!xs{3zEq0B>rjLQ2RelY~k*78o z?obk}i-E1u1POY2$z$f4fjzxVYCq41eflL=LA^Bw7Tk~5*}}zX9FoY-5jX?C0Yj|} zHvYS7OzoZ~=ekm$ASa8@#OBf?*0fA(a^N)lm@@(xXaMfz+%&{k%qO6z=fzmBe=?lu z)NYUuf}>c)nQEy3aviaZ1LBK%J`F|>OzJ3%+pCpm}O=rq0ZvH9gmSm$h^B^A% z4dI$?9~HzW7*#d}w#6CVp1UXc(a+&3q>q5^!rcQkM;Zuzc-b>s=3+DUe^ZRWhGPrc zQ5An28{?#R3@Izpr^7hYRHPAK*?L&g-)UC>DcC%xp|U*Bsa+16EG`k3e2(7VQ5_vk zl3I2jyPEC2B?BOol!MEbCx0|Ta$1WTd9#i+Q_e&FCqyKDczAd;RiL@++WnS4(DBrJ z0Xo?Eal;aR*u=Y`nW6w9BZEXk@_G<$GLRxa_j2Dp3c7hb@*FrgmP%7oPZi!GaXm*; z=hehu@~oP29%;nvxx1=+0n7c{26`b@qK;_K6^u+0F$`LytF_?^NZ4kQRfC?80UB(@14KnZ>yPJ;$}@|(VN_^vK(aPlv` zrq|}yI#Qq;j;g;=E?(#122C~6Jg|qxa?a92O^Aenp3V?h_T;-+%sYR~CDvex!8FrZ z)_lQ>gbCf-{GApn&XVL?#Px3yO9n3o3~u*T>nHnPr=&!Nkm1o5)Brd81&(>S!GXpy zY$>HWHEzwpqY2EbC)Ny8-4WluyF1g8m=V8_v|`);bu?Q4JsJx{%@!*e0uz}TNRyb7 zB~ntT@8{(lX|VFgcsvEZi79PZ0I~jpGY~wxFi{Z^T`-^y2AN4#f#@_Dro;g5(5;4) zvJ!0S+`zg9vUJGh%WGtZ!%?v^vj(px&63n_A44<-!1Sg|X8Bz_jPb%jbWG924Iy8k z_Y}waMAH2OcrwU|P(Y^%_0(tRdt*r^nJXau&cK2Eut}eLI}WWIA(7~)a$w2}K8W44 zfqoGl^y8SS`_3rXP(-mgzBh#kTmgqB(cKK(W~MfD_g*UL_*@zR&VPGXS_2UV8XRJ@qHehFnkwfg#|KWVD9{Fr9fsSrho3vfAihu}g*>YCgeK zy+lvC7%laV%ko=$05jFj`>}&9Z0FFA?I9Kr#qOTrpB9$0&Lgvr+*3$Z%YmiNJf{`4 z*ed&`8(_^)%q8D^o_5FKZqzl68KF;1*5WyRC|vbp$lQT&;}?AA5w;~a61H0#89A<3 z)6EZ4=34Dgk!`D>!MS$)s#SaB*)T@RRu_vqJAS+*gEE1lKj5Vk?*hf|nE2A};p|?j zIYpK2>u)PYh4h`}&RQC!&$qMsK7bymp%5jX8~6ghJX-|TN47N1W>uPwBxPx3VH3FK zkFC+&2RhO__3n1V&;l#Ybm_sPlLk=$3MR6E=Ot$Q&9=Cvod5sGQ(=sM--cOq%yad! zG;u5L3T=h`iGFM?gGxt(diQp@g0jZMG0RN$c=ouhs?wpWNOzTlaS20RcXFFM0;kW8 zlVIkU`O5l7Bp36MEC<6r=eyK88E39389@?>R^v|V+2}kNligMSJOY(=_w_{iML{ga z{5CZbNl0nQGMn{|nQY%fblvzqd;l98Ta#l7Fnr}+)9W#KBd~yI46}NI$qT>O{rN{?7s=~r$Y5>CJ%jc6>Kll&s_3`=O9r!|6%)B}ad9U0A z)d=~QX}haFEe4Jj-~?h+Ag`P?bPgZeGCbbkIUX4t zOuPE$Q~`WdOTbIKne6^Aw?}%gc}b;NRi7%oBq1ZSoTQ?XU+mK-47(sxu^?h#6t5}X zS|bV;Ne)=0EVCtpG;&l%)5Q3T`uWRnqr!)!V+!Gu1?9JFVTlY0eLD=b1sNUvtg|k4 zbdMY6YLYMHqX5ircYXIn!%@2<%Qi53a#e~s^|I>6)cOt1VM=lAb{MQi>a5*Q|uMkOOjulvul1zUOz3*p8iYo65%Qb~x3T4Yi{3b|>GgY42WWT#?I z@D1x!p+@o8m*E-oJ;05s=K~W;KzZ$gfFrno5$jkl$)GYgulW(rn%Cuzscffjgvic% zyW~S2v$Fm-$uh^tup7gB9J_ZyaiA>?!1!(!5$5oE!~I`L;S=Qs`(H_6v+=GidK{5u z_L34FVc*CozbF*8Em+A6IS)(#R575N-lC>s^PPLsyz2c7mPaLp#R}1BPP}`3JNZ(~ zuAU*9FH^TJRz_tJQPCLhE`nZKLdiA+D}SZEWj|zu2P6Y4Eg1w}<5tg;z#~e6ZI|sV zGtCwx;+>Fpn{>&3)S%Pq$_ibRibN^6?0^(eY>fkVNS|x;i8G8Oy5cbuOuou5pOIYb zybUG{oDIk=XdR`eL?zeA?0s0>QktXGHsT+DQZaEW;m+nqxE1@h67}d{Iz(mboZ{dp zxwC4T%asf61W@A?vW75jSkh_-1=__ZB|y^=2-;SDu$>N_tHiqG^e!`FAsF|d$Hn}T z@q3M>z7tszCdcu~uhID$;Glo(Rx6NB3(IGh&IZf(lW{F)1|C*OdRu%KY|^G9HhjHN zRdzX|M^bJ7T_b|b%!_Z{_`kiDqSumQG z$7=i_0*uJpqMOegsh}8b;1$Up(&D|CIJr{BGOXfUNXh#GcCXT@_>^tWwh#&iO1?HG zQ^s!!@AVS+6yp3~-qaj+z^kpnrrAcL$duYz__q*}Be>n(bKS@Pw{L4TawOs985 z%uk*`$J{k=udt^sL5f6=1}$Gk`&mmrPYe7R?g}B8xyXr*aJnUosRZBrBdCbdSKM~w zwilT}nZ~=?l7^vv%t4ew$m*lH)rb6B(+U7cZ(L{%i zOy}ywKUx6^2%Cmcmf(w<--#9Z>T`ZbqTYm^$Dq6N31k?SyRU<)q^x3Zd&Lv@u0nIs z9K$jt{#pdX7c~Dlg?dVyzs<1f_Vg2C4!y}@m5~q_Zo(f`Nw21Y!PH)Eq(9i3Vy1{( zl|ivwNda){JR&i?qs@s4y>9)NBo5tC@g9LL{1X!-EL-$<@{!<&ZqcTv2^&kkw5$U}ce=v2ZiRZ+_c(bN37Ou+80v zV3_;P0&?=-qkqVF-WNrV584)f<;&q_E1BI@%51e+jeYWim*I)PIQ_1OBd7qckTqYo z+n#h0hjy}(oShE8WoVX6iHgxc4IACA_R7zhuOW_3wIFgX4bzS?YIF66$w5sA7$ffe z{5F2Imbt?>zV-Co08I;yw5abvzqY36gUS`ljkWA7rA!)z=8SLfB^vqb+x*_EOT2No zTB)G6rW9zS!cR&1$0oj-doSZiZ}>y6_wv|y?VnJbHtTaFHgwtP-LoV_Y$+EZU<<9r zEM%-eQo8uSIQ3Lj&vS8^Nh$l^ZqR?BKEMM#GbMmuw4>uKz(35>!?Tazj=i8zC+@vB z&9RQ)j^{Bcv`}<&cNk~Wzr+MhbtzC)3KR9*M+t-Gn?Jf+GFWB7Y#EJ5ma;3?6!>)B z#fnri6T%)hq5Nk^*VuicvSBRl+r<3xFY^Qz%3hRBD?XY#f8W86*w7esEIae$BdC5( z;sKE2@jdvxTHlMqxi^OVF-gXI>_GRUDNY$o{z{_+yS)f1`((yX-P7X@n{s@`uifB0 zY{3)1<7V6kF2_RQq<^;*Jl`^jY^9L7S(HGFf1QVaBNtTj+}M|3RN*BmAXlA+&!WLHggm^*_(Ye*n9{2@&^$b^rcx|9Re*;;(5>al`KN z>HmHy@K68${Btu(;7Q8Q!*94mdivIm`84Am5?t?2EfR3CyT2&}Uy4FjRz7*nW6Fez z>|{G!j`au%wRzAnFqJ$g_(?NkeA?ZYz}H%gPsvc-!npkDoCiT_BO^2N)2$NhAwF!& zmEdbB%qznx^9ax;)!HFNRUE`Imj#7g%=WJ88XT#U$;~>1Z9B6}&TGH84$(~t+}`}8 z)n`#`i9dVkq(;gsYuB^Nn!obwT&l?>>0fRz{-_T2YQ?tBsTLk(%{cAH6kKi2q1SU{ zwuw=NZ!5#*-a?#3v{AVU$$T0U1ZOU z`n|q-F?pZs2AegPhZEl3ch@Uyw4hf290^qy?PBf9ixf!;7G7H`9apGZyuj&v8Z;a4 zGCu1UH&NfgfFy5(dT?gia{pl1%)xG&sEj*Y+)q*I0XsMTi&jaf0?H5%Rh+p4=~u{2 zZ~}k&292D4&#>@MU*0mE^|ObJU`KCBgN!vf&lOsD+_bEsAmx{qYviZnz_0Ug>Lv1# zVQS5m2#+CsS+yrCI{aSDv4xDQ;?jLwA{IP9AkGH-rw$W<} zdRwFt(%j$_JHI3OqA>>JZ<6yr@nC1Oz`$ESPwu-p|7+_j*=xOPXKYYf3-*XgbU&Bj zqo{}t80*n($D&^dQ*!|}57hjptjw=b+nNJliKtXtAOtT zo;duW`+GT8-*=>N`CEm5#wTK4V3|NtK2Z6_VEIW+h(fNR(dpgx$?DZQ&C0*Lp%Oz1 z46Mit1G?J(?zvV0(7e_giHzZH*Vo6lC7!R=F1BNRIdPEY>ebO)3W)suHMMH`^3srs<~vm6Yu&u&q+>!02-muMb$Vi^m&ZP z6@DnHb%!1()Cq~gy<+dE6I@zB%>_4?c=j%rMhhI+s9yoWDK@X-w1Av~5tR`q-ALcx z8T_A@d8*hlANvV>|J%SHMF0b{#juZtpTYbcKx8s`=p1+jo8F(>0HD9eLV1*~^7l~8 zzOemw1JQL${tgCe8C=ZgJMJCnD41S;W41%^V5^1?gnQs4ng?Moo7zUy^WbN?Jm;0kGlX)v0hUak;4^51w=acdxdP)83qp2e5_%LbBRuk7BMKSLwwnEm!b zh_7i~_}-X-a~4uB*HO5Cu>s+hFCk&B(%hycupFJ46TM%-Evt$a?PMvpdZjhmM_Vu{ zE5eK!KBuEDuUEC(>ddqbT_+Y2?E5`-O)7@gh-`waE-~o*ImUXd#Qz)bQr*OURi1oJ z(P%BDIMiXUS0e$kUEL@H8iNyQ&d`=Liss_%oh#G2vu5P$Dts&ETX~PD8){}VnP4|x zoZ#j;#p;=jYP4G@smsY?hw46+Z}klU&=#e(vdyUBXxsgH>n89@8e8Z+k$=h#SXrdC z=FR5aPUS{Vyq-aN_1KDR_*#!Id(cE?5ha(!F{oQk_HfY^aufjD@O0Uq;#~3s$p`(l z&g6Y!O{>dF-O$_PASV6{Cnn~jGP;}^y5nj8Z-Aq&#cOMs#qkkAINm}{WoX3$Bt?M( z_`6IVMb=$;lU(=O6-AoD*Ls8Ro1M>AQkw1e$J5tKzBVendp$jt$VQ|2P}`rR@0M9{ z?fnh9{el3N}hZRKK*i(7wBPe}SBg8)>`WXqHYh-yL~S@5`XfwySUS zdBm*}q+?dB{pIb&IrAcDp^u@?`#na$VlV_)47#wes~fHOt90Nzsvz$HO&9P|Q}%!5G-a zXOHdYDF#dtEi@&Tkbj^E2zc1j?EI8X?RFKnU6GPJw)46;EsET4@W;$S+woMsc4 zTDsI`grm{qk{dmH z2?{-Xlc`m|nVFV5MtR%pe7v5E4rR*tQ!!mtq*XDz_pZP{L(?f@9@duk+wtMv*e>%F z;P840f1Vk>o6$xE#W*Vc$c)`JJ%KCqn921#$GyvbPB*zkW4t4xkX9ts|B9N}Y?M37 zBojeePKY$}6dTgQU1q`p*};-{_tX<8c~31nvG4IyXPIViR07baexC*bkWXy{e*?q0 z4R^V|#T}jMxUc~XXlu=W_?M24#&FL&n7RlBA|RQXSF`afw|WFAl5mgEcx!Lag@tpY zSJxZ9;KEkEW@6sKWy9vRYK>C$97IR}QZudY>yp-p*_wSGli4L%vA%4u4yZ!Z6#3$G zLDxk&Aj-=}LlZ2YnC^QF@!~>AGnO)w$Eq6-$?rF5$pb0g(0@=EvuInr(Ho=7=t>=V zmL%ti0x>(a6^_iuLYks*P~hYcufyCY`2S?~B)?1fBsUzHvP}szT6{o{#IVnU7kLn~ z89Bs_fnD%p_3c$d$3g=yNd7h>Xw|Qxzunn|U%bT2uDbZ7wF=|Cg!GfelkD)_kwEOk z@Yb(H3}oF7YVu!ueQ>r7MAz4xA`CPFhDNq#kGI2QIlVI5Phirbg_|xA@v<|zJ(Fvk zmODFy6gipwN6knk=l)rEMT?;L#Yt8nFJ;9v7Rzy41Smk!(LYrrEFh7c10g-^D~KGks6r`J2x){%5#4q)rn zVsu<8ld(4KbuaAd@)AwHTczZw9Ia4VJpx0-TWdc6udC1SrJR|~;G*rJqq)$dc@+Fc zpnuV2A;|EEVPGZT_Ut&kH)~U3SmwXtA|*@r08P|5y-9Xur|z_qm_nAf5ILovuIH?K z8}mCye)aN-2Jc9nGS_E?a`pX%@eiXXD-C^?0KN%EOp)B%aOBjGCVzHtXHhW$uF#_$ zk8&rm&bol+kB zBeAC2qOqRDW-Yz_=m6hIT@ypMB)9<{MMuNQyfbR(C`6D7bD^KD*Q)2oqL|3vupQA@ zu?d}6jY@fH-b@J-M_Cz6K5#IYL|vrOc&>NHS71QX_Q@pi%mQw!UFVpS4d%w9llGWM z1d6*_r=VJ$zyPUb77bK0eXqxY6e0Hpy*G6)U^Xd+nP5Qs{p&eOR9RA}ear*bCFxEriON5P6n6>&rDDaWosMkPs&!>a-+d3ZJQCa3Q?-`#RpX=vj8;@m! z>=*-v=0fVm&c}LFWX(hB=kWf0)JqB91CbZM_@^)saVH!C8Em%7AE{LP{0Cg2ORpZ$ z4~*8yLfplGZiqF6B?$Y6f-f7dcj;7nSrF24n6VALgWWn}Lq3UPF*_3(MWoiR?}Jdi zNZYBX1qAMk5zw7_RCCFaUJh<%kMH-6^8sf}7@x@uehyV!-{x#1KX|mbuKoxRMexr~>cp)xxWrK1 zT9zuSoN1L%UFP=C?!fq^nk0-~5i5YRVsTc3%x=u2YxH*4KYwNC2f+9=KZZ5}vWv{l&RIH7SSd4kCoI=%yX6}O zGOAohKGN&Vl&8PtEw(w8wB@bAURi$Qo{n(cZ6V7r4U>0YHT1QJIUp*>%;tLReI8>G zaIy#hq}vtI>C@7{+Sdk=D7f7-*O|`^PFkP|Uig$~^YmN(+8pCq=d|f0et(m&8U2wv zQe8kvJ@U~MgAIA829Eq9Eh;*|W;hAOKN6asfa*X5v;Kr~s$VPd+jxP^;9h_0H)`NxH$(v2gl|x&tC7e=Tb#r2gMF1hbeBx3EbEsfk!v72A_u8s z%kHsl?PaAa-aKx|Vy5{a=j!Y2>w?Z{W!i+uoj>r?uYGTKH+^_E=(fED|C5p`VpSBB z^@TpgGww@Dj%y6#{uq|zZo!yyB&Z#9#zE?&%`upmR){DcdJ(xrlpWo%Fm25R+m`i( zL(G#x&DLZxv|oDq#R;+*rm9l``MHwathHLWFD-wx!lTTl7t&X$;jAyMdfS$1A&A5@ z9{N2Z+p^|`6uHlL2~97@gq$A{oht7K${G$8YsVX~#N;WyTeoai*dQZ_VeZljWjy+L zl)~<5ODs4oi7|N*ik4Zw(iFNf#Lk?r06R!-DqmlPpeg{w3hcKnnG>xI0e47Qxw+IM zfC`CA_Jn{bVk4S%_abAui!{2)(wU~Z5-(9XWTkK7nMoBG_A~Nuph=KJ+ldr1jA_^2 zEV7gYhu)G_|H<+}7uhP$ti5j{x5sKOopHEilSG+DxteQQ1dhoIVWTO|R5DjIwEr_V zrYZt(Fa)p3_{@5UpT~fp>HE^;#@Zh38y5u0&FT)?StK-pSbvPaW!A4;By2i!)V3FF zLXf}xvc}YRtL3Jpr=T1waR#2P5@GI0L1ysu)?g+-$zpnOz>q7ESgzFTH#NngPq;GI zpeUkR`du!r$#cZ5&V28SE$^CHmj1I--we6&u=G2^+2*QdF`;%y_@KM`WS_ullb{zx z7RN(D0AT!`ds5tdd}ovbTIlLB8rDP6FL=!{W_+vge&Zx+x)n1U>79gvSe3_^6G$U6 zY>+4BcSs$#ZWqeR?Y&EI{T4!}L6~QB#Nx$OTG6zbFd?TpwX*RekQ?}F919BXoa+Mq z5>T^v)>iTtG?XfCLCbS4JSky_aRZ|JFdc4*rTAo@U|3CQ6a+xgYo? z$k#7cC6#W8lPW3RS0A5@GGP(e;gcwge2&zWf?B|FSBnpCz3MG;%Q~$DDmEwh{OQtA zR91d$vi8Hn6|KG6aS$AeD&3SZGbSR_>tpvIT@J*DY}f~1YuD3ovIWRgjojneGM#R{ zYx%J+RP1ZNdTuNvl{yeXf@M;zy*yB4Mshm0E7DL%4GVS;zhpDS$j8M>FDtcduvGya zEC_oJwID}d(=TPnUse_SNhUVIWXNu1&$J6ONmi&!>y<9_pP_O=&9}~$5GKHoyhJ>d_#WgkWgN` zp4626q869aEgGX_uFGo&b(=0jy-w4QrVj7<~ zzE?Q7uW(&m2OlX=Oi$@-V{N19B=0q%~Az|PV+pu*r@UE!iUbG)ll6ei74pn z^lx71+m9+W!y%-IcPhRjhvV=N)&V##xvm57XQd>$p34O}s}@`UYMFS>)hK?kJ&Kr42CP|nvt z^O1!rzx+=tSl5w1w_$zsf5eYHX2n{mv8uy=`^^Vged#+Fk9NkxP&go}oYNyE7c85J zfv!B2c-z}cJ7n`f8y_02@yK5xAFg_auoR4AR^cN)dH_MJ&GS3$3oQOF+46pVL{P9U z1wm_OL(^=XH~X)(R_(Q8RQGXGknZzs+nSu$d1gKV)79BZ&8(c;epJ(?XwwtY?Q(M8 zcP|8>d8w})f~v@6MkoC3RAa@2+oS;v66AP~oPho1)Kk4L4)V(4_ZFxhnw>IIBa92d zzeIYeO@DV%g=x^snAlFUJJf6n%K7`KUBj@&UV6sFchA|q=&!qG99M#p0~zI(Q2no$ zHZJELS6P19--z>MEJ!8i^dxp0*{VT(TD@9Ivi%Tc!5^Z9y2r=dO!K2-F(;L)S(xlW zwmV`=_QLN0S%)qhdxxc*nXH%b$oD?zBSN)LLpXx}J3gieY0K#d{3J!&4PC}vV_#G} z1Vl8_H?%ynmOJ&+2S2Usm*pn1nxDl*{ZZH^=O0NK#&IssHN!>09 z{t0LQW1patG)VaHbcI-ANgN4L^*ne6U8%5L+v<6Ym{xSxj;<+T43|J)JBK25~Z>E~Tr* zTV*gOi<$1EMLyjg2~Z3Da_nZI&8QzFt^)eLy}w)p z2Xsuo30b>(Qpbb|pqYYIUoqi@(%yZjsUurr85rKW6tqu@V%QMp>{Bgu(fNh8o>j1b zQvpYggt9r-PX_3nlI6XZu$Xo7P*ONO7H9)cC&JD_?a`{}jy0)r+wuMZ*wr_Y zw|~fJz2oTrMNYe|Cza6@zr+hzodT+12*wca`B1k5MVjC8r8;3HG=o!gHfHF0^m}YF z&&P^H3l-n~5j49lA;uQqrsEXOs?bF%)MzpxRH~^l>mYOUo(gN2d7|GAn%Sp(Pye}y zgKy~WtJU9t*Qk$svS+!6vPY*VW^Y5-rZu>KJWWW=Qoi8LGDvOb#(8%lE=IIl_Cww# zGU}-jZMbV?bE;8z-I8+laMR*X+O3B+5Th^_dLeMOp6iR?c?(NaJx)2Tuxvi5*A*PT z&~UJ+PRf&FPIkj;S>po-7U#Zdr9?TOO$|B_G5GBAVu3gI=4+I_ECl8F$&WepEKRoCGq#hpel_L%Ny zxmI7K7X3(==4TtGH9Xi=l^Yz5p+I)v>FBQY2PKB69dy-(K+t1_Y{#Qva#clI*0#f* zkPk*I+oiI0t(!l#_11JT1{ocE%s38YNr;ccJMX?}n*4mY+Wo`)<7b2$Xlf+p_%RP3 z#l%Y0O4rg>lJf-7GV@zNq18Y#OAp#Q3j6Wg@BHFU>Fn97nO3>xrSHO&SnHDm3PZ_k z^W9BFz8bD(KakBB0_c`o0>Ag5WBr8vCs;6y(z zjJ_P1xu*}2!UB?spk`EJp#(rV3?>L14aXTjvt-Ebt%&O0^*aq)@So3*kw2y&PnIg> z_-%In+3E`)+Z#)}jO>0cVw=F0|mbwgj zn#T{R>3135*d?DRyPN@%k&Nf_&GPz7KeHVm==fRk%W8F`K#4zsKkJ++O=-wZMjyPm zj4Yn{s7QR%=NS$NWXUGIyLP{3fgA~rR=&c$z#;ysECg`LI^u{Fs?IsHi;h5R80}!Qkvy#?X^b~pk2o(PmLc<% z6~Y^QEq+$`1Pyn1&K`7Q0TBZHo^P-Ye+&a7>Yu$0dx~hVxC%iSNecLJPbhKxMMS&< zF->0Xigua5eo$^e;J&0eKJ|yWR>})__2|(2x_s+L!?OGt=xOvu@h2n5xyVZnoo!hS z>H;(3^F6wupyf*K>CNLXQaJ_pNz25SB@Boik~r|HaMILa8l z7$WCSn0W*VMcyaFc&39KIZjtay`_;#U~jQmn?)|(at&%9FDvDICL@D`^drsHdoG{dE)jmlCQiF z)nR~w9Pd3zU)$1un6I=s8MUe-h|BC66%)$r(54=Gbm;_#GFkYr>@1Y|YQ*MB$vd;* zGXg-#TC6sO_#$qNpEvIjK>Rva<=yZMy8TO0wJ{>@1g04Akdf*wAj>~I#!E%f3n$Ez zsjsK@#+!=g1K9rFnssZ93m`i%;R>?TQ}l&_A#+J|bdx>5CvJO@7zSX!0Ow!99vdd!Z`#K6_gR$iSMFmz z<#lUJds-+6(T>p6J$vtI-4&fsW=JX>pRL5CL)%>Rp|dw>A6$`I!f*skAv{vKYi6wL za5Wfv`DXf*&vlMz$&t+gEU=!r;VJGYK?DOvctUtKJTIWsK46`Q)XQ8*&mI)CX78@_ z$RAMxuN3RmLn0Go5X8}armG~Y^#!iMiJ|yngizy)@f__B!H#a16y* zf>-Mjc7C7b0@8N30K9|wpiQzK1YXDYnDiRQ2NS-n{-_vYE^RY2A0aw+X+=0XL69}QN^1Z}t{ z!H7|iKowpSa0Nhh5r{LMWi{;;?#-`zn+l`w$tZ6tkgfYr_!@iy-?pTi6hi~}RK>f( z5e?V@LME0F$vW9w*T+TB?-cFt^H2Z)X{UTt^XHc|)Vi+^;hQ{gyI1M6%S0vwBu*tv zCSj6~_Wt$@zd7GNO#-+q0$@Z!Q(mZBA|Yrh#zX4er%NBXRe-r|`8Im(ybcr9?f9mb zI;?(*AsRu5Ld5+-t9>Zm33HeL+#bX6gstV@jPFfy0VByR+}EKvEJowHrz-qolco+k zDB2-f8zGW#22v^tkM>Db3Gzw2#{zsq{)O= z1YHPur*MC&@i|_8p-lRHeLbejm0I7u--0I_%tuU#5^6k=+}^0 zc$mz^r-MjD)q_xa`A5glb6|5&kNDZIvsAH`4k-dPA3{+c^ zZ|EQfVSIi}zlU%vmr^RV-FQl+Nwa{IivB7}f(=3Dll-Zpkbx>B-h5W!qc`AF3QNV< z#_Ly3(qcshaW#F3Wvh2L$c?<{OEaSm`2owhGU3x{amS+>W#j;m4bsR$_0U`4*Sa}i zlK8Y&EbMk2nm$_loi-R9V+$kva9J~5>yI^e5qvrS(d1(tgMF z)d=Cy>4JdZB>E~TrWR_aPURv!8W7t)?B#VCedlWDsxW^tiG~wrZ9)egDpOs8tfAP^9g$3Ds*aa)HOhr37I|3-3othCIW`ko|7u3NsQq$<^tamfy)g)?j?- z`C204xc!V~IyqFho&l_&TtZ4y;yfg59Ygr7+epciDK~LHZu_WeHI5}EKepdC z@GvVM|LVGKRw&da%?KZIgn$8p?N-8Tz9!EO=9;9=)Oz&;FVxUIXyOrTp`obWr36Or z!ucyWFj>INfPlvW8z6Gm3%>2v&O?0DZa|1zZD2x3#BiI|%Un2l0ADC3Bi!y(7H6Ey zG!)e&C|0>*LYyZbc;2hJ3hRcDyGeDexF_k zA5mPDQI-lHXR=YA9s|oPF`5NwftzS;Tk6`VX();w`*#s(1y(ZfrpirwXvpkw*1OCH z>94ETLG9yz3VtaHFM`bLpWThoDr~p=3*6n;u7nr~amuPBNL!0k+jN_?m0QBokUdnS zaO_7E9X))LuS#yFV1<}_69yMGvp7_J>@G1*<#|FW;9ifXflhh5YNtE=UIe(ZJM4p8 zx?3v=snEk0d0lc}hhRT+;EZ{~d%GQ~ww6?^B@NjWijJTpMXKIq)Y8gUVoG|_f&^w4 z?6a7rcnw%e3%?g)f9?xdR5~U1M9ofRG%kFg5g-0(d*VkvP7VS-K#5m=#c?csm!QZ( z<}qIgRBXeAF(6BZU1I+93&Fm5#*9JsigwXOlQs2gvT0|jj&GuN=5gAgd6rK9wGiU* zTVjCo{ZQoH0o?pl^+70ST6~^yVTx%2o6xl9tp`fudV{4{v;eaQWTbwucjn(kQsGgF zd?t7>5&Kq0&F@?f3Wbv2abL60tx9d)e2}pG6?f_wGDPW>qeL$neG9FDuC%bSYYzNp zVfcG(Wff%4YMi`?`4{iqKz#Ekfk(|sXWgo@x0nldg$4`(F5GXXO6RV=Odk~E{mP2q zGf}KKP3xtGyeT0Z7gQySN1dcl<28=5l@K% zF!-pH8o?^PQfuA3SnXhJ$~}KFzWRe6e4)#QX7OG;^X|V?oX`i}6KpR~LoD7g5mJ|s zg%@?v>1NM9jl#>N96c{?g~EK59Av#(4^0cU0ITTBG)%)sLiU77KRpp8>PZGcur3_J1haI+@KHcTsFIC3GGIpw{F!mlgX zMSkWETM@w5Scgz;?jFGStk|)nVTV)@$EBDnm@5%Wjj_TTVW`{^b~DYRe7hVP$rKo zj2ICud=7f~x|_F~Y7t~6rAsph`&fyeXQ5Iozaezf*;M42<(2Gx^~q(EH#VMBwBajf z!4vGRib<_)ta)2&7fmcgptEMV=_VNh;>4~>hYyYdICZncbR$qgxp{ZKSRb5KR`0O9 z>F3e7?)c7ig=rP<*`ouc#(_h|jcFobJLoOVJ@qKzldg)ov|gCML?lc&2|fKhYSeD! zO*K8vD<38>TBv|D2xDs0%KV$lVg75SD6)N5T88}oxyQaXhvQ~gQ)z9=ecYJt$1@~d z9sP->u-)I-FfZ;GP5+0kuZ(K@+1AFjcyTR7io1J(7Fyh03j`~rxI2{M#e%zAf#8zj z7Tld8p+IpB65jmJd++^l?ztbb)~wjbZ}!YQdq2bcdmo+@d;tceF zJ%0Kn6nXgHd1<3plO#+}bRlE}lW=XIi`<<|{qNKGnykM*72kzyHcP1cqa1B!@M3Bx zDOXX|WF~!cV5wt2@urT|bfNE~C0E7r3*XLfG>| zyUGyZevxl)|3qm{-iXlQVR@6;HjdRU1k>Nz1*`1T(xejI!3=L%1rZ3c z|8~x&gjk?D^vb()AccJdxVg)4Fnzu4l34nz@qrFVOhycuT1)H*PVOacIwj!?0y3yT zW`w9YmqOYOW@}UlfAc_`j^`%0Lf>cs#|e)KBT*}up@Nl7ZUMP-#i8ZOydzHKDmh41 zh$U)CDx{SjCz-uByYW|ms6%B2+XFz8&TolO2Z;eS;+o@tswd8x!cW-m6Uo%7+6i4a zmO6;ALxnL3XPH`2zKW#cxYAlYI?_oyL~3+tv0}S+zi0A@czQuDrk@F2TcyO+Z5ff? zQ|g#4>vdkequZxP=_QC))|DegJ!a|&U+TYXBD^UEq$3*xND|Gh$|Ixpt{SoZhc}V` zB1Im|YwPv%vN^FzwIt|_WJc8}=|dmH-eCWy>rv=uP|aV(chcXGUf#Lp_$YBKFWv9t zyEN7aES|@o67=FjtX>H=Asl=2H|T6N3PwQ#)0it)JT~3fMJgeBc_+?JeCDw^Y}D`T zlD}1y;K?bd$+SkGlbT#LiGb9@u)fefr|oycm+z|>kXm<#Jxkq^#ZA~5EDpIIzUHt$ zxXB?|Ly4g1SmVF0Q5tm4w(p~@CYGB6@dONRYI>ubyRn#%hIGf$`G#WX^Cluvc2GPf z0!A^eT7&nGup9qg-tVzUOqQyRx*d50tP{_tjDI z9lo26>+gf!IPFW_=zl75^2dl$H@Dc=`xJ{M^f26>pM^=15-qD4jTUn+4b8Cs2|W|Hj?9(;vP!_t1(WzI6ow?ERHIzagzzs3${?jM zzRk9PEVQd{d|xw#uac6l$&z{UbxVCoX73?EXnXCL!L^j;{YaPx2&cGY_*6?J5i5~w z56iT)4I)1JZq`gh*}V_w6R(==>oxq~{s8FL4!A%8y~&drUW(ylFy6G)E-vp(Hie)q z{;=;nbeEou>>(Kag3p52`5GxktwHLsDVQuNSBr>+cd<+G&6n)?$In+1s<;n$xVI3d z_$#$O4mbKhf)~u_UWmOt^(JCoo(e*M+m3=f9wi9>oMfe+`t&iy!la3N<`G?&oN7Gp z4|&Z?;R`t2IFJJH3|H{`l0<;gJTem~iY52)b zLNhog!<5P25@c0E`WTZ!XD?O!dlwhV4&;{=wto6NL*s{>pL+by(*M#)my;RckxsAT z+ReV55X`sbEsj91`65!sLI9a=K9<-~arBnam%4Qgas3#`NYD-;ymcXs)S&deFkya3 zVf(fxnI-NEI#C<5noaM<4B~;-V%I(My$yqkukW!vr5|isnJVQ*kcAGeMB7-VAII0 zp}zFMw9XpD^%b?~&PNRMY>nkK>A_^wbK?^Hu|-7+`p|uJeEOHB&i;gF+Nn;8dk|9< z2%f`XTR(#H1$=iYc)+uws=17M2#7@H0!uziPT%kE&t7hFPO&o`-WU1h+UB`Uhl<($ zRp;w)3pm@naGCyL;{-Un@Gv6vhB#*}EJC zoFIbNZk|&9t@X+yhQ(O*TNai^)#h=is73jr{ZWJR=68Zcw@jv$_Vo}}+raDMzkH;p z-p2KEn6r=l2%Z(T%Z9^00h_fW`jnbw6Gqfr>(K=#vS5viJ6T-qQSlsgo<#LA`J*A| z6k?~Kw1bu}!p5(}*8QpkC3IBY)`5%|MQHH@5HuU-{Ft0oudFP4Iw4w!U@Q95O!e)! z>#6A&8mLG&>)hv=30fARGJeDFDXuivptZMsFHAYr{tSOm?ee__v0vUF)n$dCTKjRK zM~l(Tk&t9|zxNPq;z*6NCTlWad7M<#db}st*-=@&^5ux8@h(yzR8a&de16HWO`;+* zb4TY)MOsczcy;i{eqmGbw2v3q38XBrgMg^`WnJbteZ}kB9&D+vY}e>EnqMa{`Le~R&nAMV2a?E zwZ(`1^epu0@5jIqz?<`%%Dqqvh@`QNP_1Y(7nA`5+~Ub<77q$xZasBS%NKZws?9_I zCdS|`#X|I(BOA%soW?na_O<#f)tt6?FK3C<8>4f5ZLa##%NTq6prmrv6{bZYdbg&r z&y*+i)UrLQQAz%0peUqtg>cV|fNv(23D5!c@4+mUH8bvkmIlidoyIY~=uobWAvKzn>h^=*gYl+80c$9VNT**n6xF!}ZZ=(HozFKhkYF(OasO8TeELJ# zEAX`>usIdMluaSxTJ+?Dt+qO)A>hyN=Ur>^&9XuuwlE)%?z3TIKT3NIwce9@Q!1QO zw?2)H4MD^(r}R@s#8k{zIt+N#ReIAad)g%J>Sy*;4bKbMSpu5u=TVLXN^J`&4#%P5 zEX6jJLc%3CHTKQ5$#$k~40Gz7Sq;ytw?BW*|M=O!`wpn}>znmT=u36g{2O;_OAIR9 ze9Ny<*jXL^9)NY;L=Q!4c?pi;!5-dpx3rpOqVySO4qFR_AH5LQp2{ZMo0)m+o(yS` zV`~E9L&ebd&s(okvE~i}K;-$6BXm!(Fq+Ip6)b3DM0n7k6H(b;_q=3r?}e3%Y(U%8 z#W<;elKEwtvhhWZ$ZCChf@|Vfd1>Pd`&zuq?lRQG;Aiygw{*jN##W3H_=fr7%~; zxPpji!v?>dWN;&cyjcOWcY{l^UQN!iPu(_uK%gta-#%}mpqYmcjwnht%6+2XE%H1{M znbthgx8Yj)9P##GLTY70Wf5$$npOAkIzP28H+D4Im*Fs^9J7$_+rJe&uVv9dg$0Dy zvU8}K1PW6BUf6BJWXw<9$B+9S^KZZWpZ{XaCyo1$|NXCTOiB?V*GPH+bWHwp1&At< zYXC3)cg_Fxj?YO57GSSUzG(Y@D*X2X7C_PZ|L9&J-LM;hf-J`*Efp#G|J6st=T!f( z^Z#l>t{(%6kigjT zG5!itiTiZlg7tDG1lhU&^CLvm6s#wR@jn&*dqMIR@rWZ zYV5k5z$8lx;m;$VXeNhSC=f8*a%?SJg7A|TK=tV;Gg`w z+`R6zp1bUy_%Ww#W3@EUW48Dmvo_)uN{PTXJoDa@O%q+m@J^JPfYB5IX9-W`6-?un z&q94s{z-!B?tC3|qJIuWRDLrKjE`pYjql!`D0d{1m95#2F5268I<0<+yp|9+et;WO z8s`Mou^BhEEw@=$!4Pgxey4Y@w5$4}OG_Vl^cu43*S@Emjqyl8pt`u@7Zvi5Ud_`i z1ZTt6;KYSP0tsYLaly|boW4B&rS+UC9R+sd>6a+k3q1j!>xMg?DXu@r`0k$FK4b_ z)$J8V-R@I*8{@#Xj}WjlrQQ~u$nSiXCe^wdRj-g?bI7LIv-m5*TD|UAv1Vs$H;W=8 zIk46OVn&RsAcvrKKPsak9j$L4pTnD~ux2;<1uOOVPNX+RMz6CVj`D*Uzh}u`woa-B zM|T+9NAi!Rb5oiaHM%y!+#&8hb=qNq_!pXG#umo`V;Na$e+sp0+pe$cAcuHaVVu0D z38r66zDTtuZf%WBzRx^ISxTP%%|#8Ap;=n9HDva9(mlLl%d?*3dib*t_hM7(sw`bv zXl&0>#UwN6V&Y60T6NwS zy6c}1=Dwfrv^j#;MZkB>o=&im_jd~c2Y15#-Vd*B7(x^787bK7KVl6$t+Y%AUMFX~ z4tNAB1wZ;tO1@nHHK1qSmXX_Z)~!ly;C@OB*SVBik~%2OnX1na`*1HzYxMJLPTTGJ z>Fh|RM=oNvshP&BtN_hFS>FBaTTF&VbK5Q=mc9=gE)g+gBF+zzpFgD3{1Dth zIN^mj%2@4ce~_I~w=Qj`NTB(*Y&ib%Vljm~qHRVZ2XHGSJ1fb{Z5%hRRheZ`dak`%xnty`4LbK^I0eihasUpx1Y7jiiV_Z6|!z}B+8guPx6RT zP9bJa@$5p0qX>}N9A*OAlXzlbmQ+UvOk7&MdV*<5Qp4szC5&t7!Nw)iErY#?P4#XLab0_hdm@sM#X zuxl%Th~F#aiBys$KccqR1;GTS4Nfp#@#5zwTu3S2`}KC(=p99fy<7ne7V^pNV0AI5 zWZ+sT%X8fK4|JjY3JLe`k3~m$yJ)mE>jM@Sp3F0+Qn(5JS|RY}(_)XSa~4p5z@9Yy zFDh3qQk?Q{)6!hm46ht_XT3?fo+VSxe71~(V=n$1ULrk2pkt5!21NIyih$bU_`IhQ zg*Nh4rf_9hC`gf`8e8yfQtojk+FLw96@+%IR#h36g#&2Y#I`=G!fvca`csUWg>HR1 z(E=9IE|EfzYTsHv?10W-*aavn4kiBaVJc7tbfb)J62WI7d64+MB(0)f4a+P%8*OTv zDwGwHS+BKaO81Y@PV*Iug}jCPWtBNFqH4iD>6rw4n-h>y!8|$cKfiw-;(DZ4iBT#* zU(Eh``T7RW5r}xPKxPaO%!Qy$YO#UNYwPVMHp^F(CQH_`jzA!0tyzXQ(L{cn=7Qiq zN3&>&N{!!)rI+(AhT1(fNBTg`Ni&DQWy2}__79En#L z+Oi)h*4>~gr`YxGu}OS|61zrB4{!B|krI0NbOXGJO0v;C~#Um9yX zxSWFTROsj*x1z#z+k?l0xSv_b0TK3zkB`w4buw@ZN0j01pl(k1$goZC6w?MAx`^)o zI|{(3p$ z&j^mQ6+)kazrp}eN_6{V<4Pk}Dh&tV_)VA`x+CmQdS%}L_v#E=eijWTJJ!Yew>2KH zcOtff+V+bxAQ{UA1|rE4UZjK%CWm$XsGhyemOH+zz_s7xRu8FcHQvxvdTB6tb- zP2krB;JuW~h($bp#NMLZV7J}j3vD2&{_?#(Xs?lez(&29JKI(1<7}fdB>UdfXY&~^ zXuEaLmsLHc2_-Pg(k(t+=tR)`QqH7+GS^}tKeUEpH;3WVYVu12NVxsH9yZy)OdM-9 zJNl)=re!qq*f$HoLkA*spPBP++vKt+Iyz2Eav&~MmEVQTkVs|$$S7rBKc-{2vBHDDem;SekOQ%HKcE6d6{~a_#(OR1Ch+N&R5o72<#~HAR&eHNv+9SDV@{aAi7>#le;Ch0VkV?87rSiFToogNo27{JsILQyS~egOA5X*%hkx&P@D?Vm zLg;+H1A0|~L6>Vx#%mQ;IBJ!!)Ay<#A=*wONN0OXInRsFc-nFh>(XdgA7RqZNWR|B zuaNMoR0*}40tT?XyMaxrW(+^f&V{h7A?tom)`GmeeN$tbG1&2F&PwULO;&vB{R&$6 zQ0Y513qAdhz*15xc0SYGOEX_1_%v`lR2{pW|#vJ`2I!tCT0Z`NS=AOnAeC2cU~AX+g)Q!BiqemhSI5phXcq7vWg7&a`^xNO zHz|sucouXg187Xft{F6Q0^5L`{P-5bY2Om)GsWI$=X=caVXow}uf+tBZ+cPiu@I6W z)mmtHs4(5XYoPTr61k>j-l3ycfud}zTTGAk4l`d&&-nEPx=~`r(w{_4eUF4a6kxk> z1a~(h>HAkteJ&hO-7T8G9me;B=c}M`Ah9!}Yh|N4Ji%n^_DKLGRG7;Xa`!5h;N|XQ zgeI3Soqm3rEQ8GeMMLH*obSfWpXfBm<%_|rlM%}iy$F(L`>^OwInGhy{=%P-ILGS9 zfNuux!jTD(S^_&#rV*;Ej+-qz*m(ak6MA_5nPs)TuS0l>K?GevsYo>=^c&_3TDd4Scw@F1S`P~iA$)5nSa-bV$KWiX%fa>$E0$&n ziouJKP2(++bUC#&by}y=z^nW`PNbi$_6rYW+687=D2qx4e9q+=_vc{+E3b3w3{SxZ zXIq<{ZVzMvu3NMygt(RNB*qRmY7rP$zt55~LlBBG zu1?kiQk%VERkkdm7*svH;``Zd zDs^UEp&w_<)J0l0d>y~!o}$uxZBS!S@+Nb)HJ@Z;B1s1gL@$_p`-Mj?@uGPlE)AV99~ziB!2^~2 zhg97fjFLK*Dol_^ZoEcfk7qJCwx}b;F=I?Isk4jOH=MRy!)P1y{PGg)KJ0a&U!zl+ z&r)6Mk2tGj0z_VcgL)6=1cQZlg3Zkx@GpbLluex%p1;vU-WLXpVKP_Ea?z8N%h1h^ z@c-t8m(k8KS}gD*8~N`~ng)gj4C(}HJ_#V*00@x?gHNT9K}dRc0_{DDSFoWE45SeC zS27flQ0#|sPa2Ihj*8o+>8sxe6e7&!pwFejWr0f~GW@JImw?6KfshcQx~b}0m!YFz ztRXSOFpLgj!<_aR0wRBIBA|;DF=t^s8dnH+5VTL!Qrkf4GnH)4EjDvzOrznm30EH1 z+CyLaS;B1;P#HIE!1NWxq@n5dc+d{NC@Xwv_Tw@Hvzk?(ewFPf#Z8@HQrK701< z#!r`Y{GML%Ntip&`W@I`bp~39>=0-bi=A_Ky*puL(x&Q-yD zVEk()&7*!K#cO@{PgR)T=%R!yD0F*^12$FI4w4&v%R%uDEIie&t5TZz{orLd8EVZ8 z%CwOVdE9K^c1Nhr>aDS6e#!CBGjM#nuHEp6?9clKo?Z{Fb+tm;WDWP`Myq>xdYG5=QKcml$M5 z*vVc+3jJD)lO{(k@{3Z(l+1kD?jVJgp!2zOl@HzMX9QJAG!91 zwdGl)Wl0o^tFobbAz461Dq-=c1?F$(0+eQ z@PS%#9jyjh_Po2iZn`UIMKV3YdKkx?I%Lx%pCn{KDpUnBl`>KUK;F+go%>A>N*|-W za~=Qa;=L#EP?H}$K=A3wcKUwQn?lq{E4!3uQT#fPg6SS;4l3hO{uN&3`%RA>H!kgg zW(1|)qSvPbz+QkEZulwtIyso)0HsD{kj~=`)^CbeV`$To`9gy(6D2CadjBX`v=WIh z*y}{wi+bn@-VTSeAU#WYP3&Y6fIuqHHiYOboYS+`-voq$b23lk{wuu*;x*BXhXVp~ zoNMlN$W#2HQMJH&rf!O0g(Xjj4twH%(5kru+uS-A!Xl@(HsMf_8_^sYz!ZG0v2i}} z$8%Cb5D4A{?^>=7x=YE~Xe-HiZO3KEmGo)R5XnGaFdIRH{Y*@vxya)L&P;XM)$WS- z;dW#`+D982ia$~h;;WS9jdj`&!|c~FeNDYRBxw{(x>FHXo#P;tg!RqAc-{QE4qan= zU)j(v^M+yy$5Awd_gw;wl^&-tjVDYbso8w;NOkY2{Tqf|2j%@AHs!nux!V|(xaOf% zNqKsyWrqM>F2}EsCSkns*?uoL9U!cF5L%6idfAE44{`*5_SA?%@P{P<;VBMY;^XCp zMRm?@Aqxm_!6_Ra9mOlggamRMnkG`0fU;T^1bz=C+Hd|XJaCq95j97bQ zgLuyRC-S#wlFYf=w=WXM(D+Z{jL|gIa4I?UJ0k3T98|KR+77+j=-w^g1D-Nv$Iyv+ zkz2aXRkJfJG_m==zzdw6?%YE)-n7ZaDAFr;yi@A!KUhd6Xu|#GauUim)VF{8bCI{E zRnfn2?QE`A_321HLi48AM*F#7{K!y%h9Z8Yut!5{IxQl5B&&*q*kRDD zFYV|ZvSX@?)+fv~ogHUKLbta(te#DlBLO7hA_PO+^3n<@7Of$QYn@1EQOxb8?4zUr zWPD^aEDUe+MeI8~+ysbU*Fisb?-p6}uUyw+g}_4oLj#ue`Ly1pNc+Hw)25!Can_=~ z@pOS2?Nvl_W#=Os#&OJF4pct;(*U-|gP*>;pcOJvommWt`HHLQSw`uXmZd{`!ZNCUh@K zE4Y1Ktym9j8^$!MgrSFTa6&{BfPvvuyxly*be8%!!IA!if4fDpdL9In(X0XUFtgcL zEu9FaIu~oQ*l^dR)Wl5=(j6~b1pNBoXYnczA!!O1i$UX|eg%bH2(Jk!&eB-rQwQAD zT%HJY*7X1l0Qw0;y{-5alZoHRx{ay~p>npocn^M3fugEx)aM6d0YlFeitHK7A0O<2 z^+PEH)kDBume+%v*5pT=QfX zu=l3Za_7OKcei;LJ~{C5>T!=)=M@W)%gQB&wgFNP!aa>%>KBaapE<=I>kB1bU5F3J zYw6|#P9PAXNmbJq`d*t9@|e1DNF63xx@o@9#Q`p40k105k%s1KXt5>@dwlk1ARmK# zJ1%Gtd`>!TyxQbB z+;YTR`SlVBM5LZur-%X0sr4Oq(CJ00!UesPTpj|6oob$+epj}F;svN4`bxbSl0u?r zmOi2n(VOaeCj}HMM8CY9LYUysXu&}5skK*iKv>`A*D6&X1n5LWNHdev&4E{Rp+16Q zH{w~CG9cb@Z6wh>i3)?F=d zJ>X|GYhE`=WSr;6Ca|^luGCCbWMRg=Z|fV$Q!>TcWpTOCsJN6K=#JTr!iOuX!4e$suC{tmDg6uvnRSxHkMjj6>f=A=O71)uEcgH(H z4}8~(B0rz`aO^(m5x{WF^9*Nvt=es@RyyQ^Zlu^RSECU9!?uWgftI9q;TWG^w`vIT zJB`Z_5J&|#Ep=Y!xFF}yRTISFS#F+qyti-kz8bP>XPvm&Hb!k@vBHTpnH5K8;Dw_l zCuRsRqz0aHAUK29A4{|9pSz`7YxfE&C}EHRxpul%qhfkGY2_c*dEL06K<_&R#9mRD z)bnXtBx=pvKbQR*522tAg{S%J@B@Y|{I9CC*f`U_XZD@j>zEs(FWw7D=zFb&8Ogynkz0j*MvRSB(#$@UlpdpwmW+p0E*6G9r-Cw0!un|LkF_ZVV zPHfgjH4L}4n;h_d={7=R3n<_Ad%cZ^@^vD1av0_A zyNWTd-pIDzmrnFa!}8IxMO|-#++V4dOm9p5^r<8E3)O7?f%}F82DUc~bVD|BQo@@G z*NU@|wqbm6!Oa&{#VGB8gEifmAL2fQLPbulV%d#0TeaKm7;L*Vn3J)f?6(BQu^lHU z|A9AU)#r$Jbn;+)==KXDW=1@yLnD7`*M?^+TuIE!2fI+;Pgv`9lYx*j&;8g`=lnLFKBdU zqWfd(^*8ogzZr1`IuvJxM!kWwKH;)f%F0?ig>T`TY{Dfbp#v5gIHUs_klZ7snu)D ze!+LU`uPzAggr$54&Dmp+FjT6!aj42=}T|iv)@cz2$}i@J;Y!d#7&p#;#T|QmsV{O zOUuhhduFl>J+Ujf%Dtlg?SS@6EX$@!b8ZuCtYa55!x=F5=BAecwBqjy&Qn7Fnn@#PD0nazpjuiu+_e`uol zw=@r=vG-%^lqu?6e~Npv&fe^f?gG|p1qF5ASO%Qv$d09s79lfe8R@&E!3A2b6jsLaTLt#D+QvmZS+yN>MUT4;sUsFtrm-7qKudusrH~dajWe>g!4s6uN zNRIj4lt~8#-1|#+eEW_k!OlKYd`sqgN{doJ!jOsvzg*wL_p)F(DNk+TY& z@M7(_&C>p?fLP!rwDFazZcHouBiIie8cQG5>?TX0Q>kt@{Bcp8Z<(uFisuA|0I>aA z%__fl8U?msK(+Ko*zCc=Ub&xX*3$ct1f=1{Vm&B zO-G~gz8Db|2L(pzmhD)B%i%k>H6?h~=FJx#g$ug3nk9Oua|fC9a5d~GuS)l1YO^BZ z`Ap6GWv1_xu2r?4X;;^t#Yo@i#s5(2pQ)TqFoHSLKYqU;XHz|>h<(aP;M9RyVcnk8MTCZp0>Ih#93)0pB0j(BdYCQ zEuH`Ioflt!J1@RbsFoh!OP-@DUJ~<2XS@NECgnEPP95N;K5B{2pltD^LL|>}vaR^1 zPkVNSZ94+LXBnadK9I2~(c>ML)wX{bGrM=czsP@oc7dm_)%D%x&7Kq0`t!1Po+n;a zN=cB}qUv6PadSps%yRk6CO$Zx@eW)(*C=S6v+pugb{-My_E>Yj`UCGJB;9eRa_%h;;PY=qdiK*UkHqD$C;yS9h6oCWPv#b&fY;O8@p2W3QS5kFvHoJ3G5ZQZR+pr%O(Y6|YjGuzWPD-Bx0NwX}TS z?lvje?D|T1A7lPc(#G-J!Q;3eU@n%leOP>f-Tb>*S4D^T5KYbM(Nln@>BGC1v>6E# z=Pmvb<;Tt)AN+UOxl&I7KlcHWU81(7>iVdw!uiw^!kRGkK#76<(~lxp*J9tc z@XgxKOe4Fq&*U<4tu4OX4t2YkWaQ;MUkISVEPIUVd>#&ydT?YUi|(ky{rR0KxmMcM zOF9Ir)d;Q~s%ADJra8a8iYkZcy`j9^O8KW!DVUcu`MIWVpYU-!)V@4fJxWPkbUV&# z#OJCNvx3h}Hvi>Z_NsJJ%IGeH_y2`9WIY^u(?5 zb7E>H$*a6Q35M&oPOp2v)I0#PDU5Qjh-Hu#tWcJ0kJ1aeZB>u))t6D*qw)z%w36;l zjSjc_O@hez>-r#}Q|wPG9wePZ2A1jH_Z|N8xGS1U4|btV2B+(^E5TOgwr{+2eV=E{ z?N58@bygnB*PoCpmu4<)nl7rM-iX1sttOa^sDmEJbK+M&Fa$6NCSHT#$!f=&7M|of z?dKjm+9R1Yx~A*z_4fOjmOn~&vX#36Q&kE{1%8Z}f4{X_s*Z6FgHLK@_~z)`{7Cp* z>SoV&!!DPz?^zg;HHDkQg&98s4$32+3n=)(Vx)#U*6hJPyR+!7^JHlmh5iCfCijkL z0OewuhqXeoMf$3X21?%<!@4( zxp)rbZklpn{iz#E@#L!49gAlT^Ad&bBH^@j#u6TK$y&hu_3`@p02OsE0X+LwvjrQG zu#@O=IV?9_jrx|p;5jy{uH$Dsi!yAhjv3@1bx9Cl8%;KhOeV>|)LNz=m?O{NU+`TS zM{chEON6_lP8i*v<##2=xPa6VdIN}sCTg4AE`3UT3!2=wS)uDj8U^x7oMDPVs5*ok zV-n7rgMSt}#tn@j^2?Zo9X$rrXMjaQiOTF;UdqVab-3SWbyXST_7;+ED}WjfR-(j=aO+{{W#=!nB)1sAfotX>R?5OA=G|)V zCdH@ac!T@1I-u-0N?JxSmw-3=UqO-xu@4||&tp~Q4{4fxS;7b8;*%~)7lkj`O;e55 zrQWWugrx3Nd_4+r|9bmjMao66sq;wwgLrqsg(A6*Q6Wi(-c+e;oguHguRo{aZcJgn zwO=Z9j2(-yAUZACwi4#-qCJh{5uHKA<@+pNHKY+u2GW{RlS@mW`cQ$rfg2IZ%%Oc$ z@LCsEa6M~3bd{hh{^PW(?~IQiIo$Ws8OaUO1P5{d^@U9+lv5 zW%t*;4^%RNogOE)+sO|P+S8%1)SGR&1vBqw6H#+z60W(kGJC#gG_sclXtMCr!4sX1 zw`@(k-M7iEay&}9J4p0Nk7?e5j!q2T9Jeo%$+a)uD^|9Q+r*ISErWU16@t#dvY{<^ ziAyx0vwOhk4=aNz7Afm_Pv zB--8w7Iwli#cuZ91PCD)fWXWy?llON;bAJxIUeuxbX}dDOs4e{;KK{9b-Jp`xi|Vh z-~ny~sgVm8N6S@zRS&v4>R2R=f$EZrJ>O@A-mk4DoI&oBLt#ZJ7z8#9&j+0tch(2C z_m0=Xd50x2WQ7DLZSVFlGriV!WDEuVFd3o7eg$AKFc?iK*f53UO4Ure^&Sr#b!di- z+RQUQ64g{oV)osGiqx*FD!N++Xp0sHC-Cl`yjYXFrOB1@z;-Yr7K|2Nx!|SfG#~mq z;~@Vlb2F+{5knHafdpY)53;QypE#VWE2PPL%ZbSKtG&OefsU9DGJO4JlJ)6^C7OGBU`~k0`FlvcwumUB#HU{IbJwB#! zf26HFE00blCIM_fu-o6L(_L@V6h|IU16EUR4~9#{zFPzX0Lw!AxZ9?>*bMxZ6r=uhtV%>bKCVJ>J4RfC4u&sZ> zA4Z&1K#1%@=Y`q)WREThU@@DgMmni{^_Gu)bLsLmIAA5p-Mf#oiberfRF)dUZNSZ* zd|Z?f_owYC5go^lr!ZS?T7YlMJU(_1B299s{cgol90;CHo>+tCt?M8qYZ)NDUc|U) zbHB75e_O89W^_2m6mOW3jHBwOnX}QSo5vdzPFXAy&2A7o^CMt$!8Q$$vC=D0ePH}B zD*)#%yLgn6Z~rQl+wqkg`g!ENh|hRJ?arz95UrQSGyJKh@OZUlHioAgkkgUjeX*i8 z*RIDrUy>Y&iCglg+}}*blLcWxGq;yro25abS5)k}#fe5}GIx~E8W#kV{Y*TRNwg;V z&u_?VXFG~h8sl*b~REFm-k#!iNkEIiWY z9Y23j*7Y<`Y8YrH5Hu5a&4_ z#6k#b!1W7tPv|w9vzzKgt;u%oB8TPVDxx86sU!soK0g(3!!cNlGQV{SxDwTD98XIZ z(6jd7qSt7G7Lk1@dt3@E2T}P{FIIjeusWvlIw6x*U0O_TsEoY$QqaX8>0uo-Wcqg zqp(7x9+1ZTGsdJk^`Z0XQe_BCI~N7AY+PVn>LlGxnCt8_iod8nMi>uSxAnOxZoOmf zC>c++AXBUQgOzB}DJkGj6XgMUqn>zXfX$xRFvLqk52_H-M_+17Xj|la0;8ePio!Db9w9I$DZz!DuNZ2DJKcq2GFKvpYDB2TN)25#CgM&!I+%2U+Jjhw2|&`dzC1bK(Kh69i+Lh(bN~G z(;}D;HEGnt=6Fx`ddT=WLu=AS3E%e6ugxUs{NW0mV z()@ItYtw94u47X9<+$!psY`npPMp1S^c6ebbe*?TDh=*cX3t z=>E2Qlkn`l5q;*-QdyR(@;6{}yBvX@JQbxu`u>-3&)58^GI-7UDLjUeO z+;fl!gR)w!sxCHX(2#cy#sZbQvgY*yalo86z&dbb6P9UjoeLOvVCs7o= zGGoGCNghu(nw&WgUfU1725dtAUuxOPi~u}ek-Bl*F{(GvqwKP%`qAS)0tT>!6yW0xmxhO7tQX8L$s9o;*Jt zfi{Sm{0<9xI2MJ;hWEnkg_HF$6GTX^I#Y+^y_c6`g-U?NVjgt=-Axm~!OmUXD}BSs+#JsJ0Gp53v;uBVYS-C)lNhHtattR2 z8>2I!%x9b8D)rYfY#v02={PC(^IvC6>+;b>GU-CX2d_3mf&&h!pDxCy!XVGdSJ!^^ z`%0Y`)?AvcNFKjW4Gr{uwGg6gzTR^D@CF>jFnGGY=Tncewwe2L>OPR)yzsYpTL|E{ z$X1Zom1axaY4xNn=k5JOcpX<@-`NFpzTWMTnD3G@*afN|2)bvfT~6{uEDp3=e1_#zrNrjD~Flu zx)%`VzJP-ggs!hNjo<^QCRW_^IYLH%%4J>g9b8W%^2uUX4^Q(L?yBtzBgD@*b-gaA ztJAGOVqROGSnvx^0KQ0c`e`1;$xjlMP-tytP^vWJQ3_L$_c!gq+9r89tLY zX(D$id|dxs#TkSDc+;o7(6lJRAJCNB+FW$~RDN{$S|!;s-rnKkc~|V|zHI2}kDzDa z$!U;S)ql_CfFN(!#X;E9|6}hh!>Zi2uwm(vF6k1GZji18NOvt-1QsA6-6<_44N{A4 zkp&1!D(WP`XV#c=jQhUFn1r$_fypjLp~b8E7yIq*_4-VSi{hgM1is7PsF_DjXTz>uDT-G$BlI6qpQZ~{pgGF6 zak}{WcbPV0D=Ffg1#%UBQr;w1F2`MafW5T-u5{Y_0k+l1Q6CF+aR zH3m*OPh4Ch+^94Bz0+Fr>sK7kJj$?`!|-J!Cm7+BWW6+Rd$j*|1-DVb{n%9kQ8n8) zIB4(2A+aQ%4)En5s-$QBol!$HRN&hFJ%5XIPFfQTqSGU@5x5sFVliEH9EBAL3+G(1 zptSQvC)(1&24kD{ck5Mzxbd+zPGdj6{1(=9S=QLWfe@3l1HH{luGWiPIJ&%$f z^~UTQZ~t@Wxzo=WaJrmfgQvdZ8?Ve5(0FG}t54}$j@`U0m%WesTG^A`#@=E$j}I1B zEg?^G>FlXn&&Z7_Dke+CpY@#WwSvoOU%M1^|OU4X?g1%v-8bZ4=7tui%<7tt(>q-T5`D< zN}C^wg@wwQo^mt}%p-5Jd_u-A_R`NcoX$pvO|$RNo#%6Avs)2*F&zBi^R&A=1R9@m z6O`Yg*5?tn)Js2H_XTPB{U=iwB`rlWCt8$k_2^Lg^sg<2o*jU3rRrtUgYHJvk%O(t6ew8xqIe|V3oevQDKqDL za^3|v5?1KNN-ycEOG*ro&m2f22X8Y@2@PEWU`L2DJj*+LtjYd-y6q`3!q?)dVqdr! zsU<>sCvu?W>k6yIu@U9k3PSIwQ+q@8!st4aO7o9G&RHXrepXxG^5tNCDT&dN_&MA(EUkldv%8g%j;k{>}q1Q(G5}==xfcCT# z<@5{pPjn`Yckeq&f}iXlrH;DJb$5BUpuY_bq*B9)d^rJof#3P0(4W&R(9?*7pH0~D zmbYztVbMTapfgM?ClDdo(GMlJ6`PL8{G3X)zS8OtWl&l4UJ_+E)Wkr=Xi_XjVpH#B zYZcNnN$&u`_YO)qA*s_;S+0FdSshdOMUac-1d_V`9lrkE%?THsY*8FdR^;AlYohkv zS-$0l{pPac3mv0-_Nf8?(LkklchO{vD9U;@*r(b)KLAkk(UpJtIP zCu@6Bv@9E*aTvdu=DTb-rZi*(HykrqCMs7Mnt2m0!;t-7Am}8L;z03 zCy+rU{r@~l0aA)!>`~Uq83h0M7GmHhkVLqS3Y2XU?|&Zk!UGLS`N`X>jQ(H!0(vQ- zLQ4%|VH{4jMf>NYR*OKOA-%8D*BOxht6xALs2Oo_ph*dk-rE1}GVrIRFA@^r6BbY>!#_qeE&&*=9(mY0_QhsLcE6-rHpu^d4F7n2w>&Uf>(6JL*#76yS5};E zTqq%7X7)fq(J*ia8asxXbFcD7RF5iOvOm!2F1!m|S!dz~ZsbsoEUJk(p62fSIBuZUWSgbt zdzdAh9`iP9*E!Qi9jSO*xk@wewS~y<4PW4b$o}IJcR>puw?V5Nx2_)_a;GyaO;qaH zFPQ(f0wj`gx{09LE$=W&wTt3cTa!7ml)GXmomf-g-EmNfq2p$k&tzaK2l~on{{BBR zGXRRIayUuraEDR*U?F62_`aaUb38o!12oyaSv5pKTl?zRdvYjr@qS%<(@6vu>MA(U zI9K!60{` zEFhLirI4qfzs#fkDV%PEPP0$^*lGGMTG!av8!)$n5IsG;ha`Nv>-~3D((M z;YhWOpr2*DIyG?~F4z@U%ZDymCV1gEXu}_i{$_%RfkQZsNf4l|v7~&qd9q))Eh#Ak zeW+pT>w!8+vsi`2w;@b^i(U#bv3cnIUYfs1E4B>5%$YMSSt}DN1wgn=eh32y5v@Xd zIT?kEu3IVGE9m8S01+4pK~E~rzZUswgV#1UkVw03qaH!Z*2kJ8R&CBipLvuS`(@5# znR}dx?dmCop5Q`J=0Nd`AF8CZ+r|-=P_wA4)hSodVHr|ViGK*Gu1ow!9}`BcrRW52 zovRPnnD0albrlH@glU6*dA7e3`tBDxpd)v-oFBoW)mXYyq*oByQ^kC|WgHnhFA+AO zWH$F5q3UHC7C-4NUQ+40r)7dFW&Zf0Xyrz?ElwwzPm{v9y`l`ugr>)H^4B76KZcGo zdq04)-mFg`FqN9BD~OTEg$WFtFkQR>snx~^oZfEa@r2bmn<)D3xbDv+?MzlVtPg$? zOmI6~u*)MC^{m$PfySHah2hQUs0)LA z#<+VwOPI#`L~yxtrXzZ&di|lfR`WY-ZM*f!j#Prnk6dw)8};|9&#+c5L%E-?#gMu4&2Nr?TBs2OH` z$MKM#I4W1}ptZ0h8DUI?*kxUs z2n`PN)wXVyIZmg)4fM!*ExRDQUD6C^+B3Ef!bBD+OW!lOX4yBo47RtYSoGRuD>ZIv zbiLoLY8i28@w`dZ4`F9~4{3N>?85k$g{NS`1Ae}J6S79GR0z{StMSa2cYNBF;DjFC za)n{?g}bv7e3!FVhe=Z#F;7nLHAAHmZ~As+voU zP{vI1{{ykwGgk5L)7l4>NgSh>TkNft^bTX``rV-x6g@9>_NS^iATdMgd8H`W@x!KJ zBwdn>$f)?ejnms*sTuBH(y!vpj7QNPECn9IBDK#EWAv|oWtQuU>^pnXfW_ioh5ogf zp~5#%KJF}swhmhN`Y1qMOcs-0=)3k%N9OyNY$n{g)=ho4-;?!GXh=Z@~2 zr1tD$&Oj#Y8N;yDPxD#g(TQJ&&qxzcOXn=9DdxYl4kL0+6$kHA-pj@#v7S^<)hl+j z+?DsOSGsE^)lHV1Wg#tU?0s3(o_Q|%RaF^Y{p;=N4LKJ`@KqreGhT}Wo1E;e zxS}+1+kJSygEVzCxVWbNJ@1wIE6krQtp}I*uYd&YFx``3@{DjqcppJ{O+@f9Vh^tNc z&4IYW#P0gagRd8#kzx2t!c*4PT(qD?!tVAjs)y$dRtXSE1DFp1j3+I@G$L7E1qZc# zZt5$jc4KTURChe&g8eqD0~(9zg|klT^y;^*2+g>_{V{XqT+@idEP#n$Pm0M{?0VmR zoA7yfPES6)KF+9gEA;e1KFv-l3f1{lxIFAT>CrFT1uC1_MC`rk3D0j~&4pX-1&JHD z&S>JonvuG8QpyfKMi$exL50=~O85yehxO??*6vMK($)jh05{iiuV2gx>J3uD`@8e; z9y z-59T)-ntVt9S*lX(%QAo6IKNE8yqz+i(LTx-ZH|D>Qdu(L=NU`kssvuqT|wOzS7N0 zt8GU2;v5p4+@$cF5!YFk3Y9iILVbfZnlWld8J02aS^%nLcfb=Fv@v6NL>BSIEHs|I zt1d#t>Vsoa&nw_Ad#}H|av?gHp9yI*#GiQ)XVeXlI&Ve?ely!WY~3Q>kkNuS8h9C` zdtdrihc;VUV;RCrN<`I)i&<#D(EGw&ODUw0Ig4hLaU;G-O}S1GXmB#zuS4byee>(% zdw=lC%E}8tfFVq)T%Az&fz3&2T;u-7l??2~gqsW}3fL8H#s3bs-N4hS>GZLFP;uR+ zwpd^Byvt0#$p?-?$m4jwxu;K>Djkv;Io};fVtmw41Beg?z{v;9;v1_5zVP&^px%S9 z_0cqGSzxI84Y2RtqdW0RBL;_)4^m)eGe7bj5E z?VUygZnV#_O|ys+e+KQlRe~a!)Q>NUsr+P~sOPmm!ZtXc78RQ*h5y;>twh+bf{?$g zilPb9lz>Tmb)2WC3R25t1S!3By+GAwv)?y?Id525CKx6VL6d9?rI2a=+KJ6V1Ij>U zRxM;Nn7JcAs~?}qw_Ho8mxGvg<|?Xs7VA9O_UGz`i&Tt%4S_H=oH#RT6f=!G%1xiL zwD{?TJQ3JU1=&s)xmQOlGd(T|%W$IGbWE<5Xjn_}+UmYh_#PdLekcFI2ZbyS9tz2pblUx8xh&X5~= z=KZrkwS%y?G&?N(hl;h{V$gJIJ>*Kw`awtL#r%{WgX47sa?`bN&6E^glkf@p5EFLx zzYWTV$3Za|gzMqO$sioe5*k2BZkLJFn54{ty!+<%wy=Ucjk79}0gQUsybiKiuTXdlVP6Qm8cB*>L)aDMe2JE^T#H8l#Ap%QD{Bd0SPY zDslSsp)^vt#~D03`JE$1nB!o1D@grn?bz7N>gA`0nd~eY3e)G?mtt5f5A}U+Y39E} zAnVV@oM`?ED!R>4zXF$PyKi+4BeSrC7b@STO>Sll&5+iNSoCOq8xS4a4z2AyaVd5O zHUo5@?QUUS#EI(lO!D|x>G+OAt78-ay(^*kQ4q$Y-JdcWixnb3lo$Ebly3RbcNfwz zm2x&zZa#a{l5_jBr?fxe?kab@aYqcRLrh{EI}{>l)YVAM_&J-neYNAk=2w^iQ;kH; z9Me7srbe}VWP5RRIo#&rbY*qnv0pU4eO%q+!+ktu%rEHEw~YsPN@jQin;9cXGL?;> zCW)gMmAizrY6Tv1z3IlWnJ7<73KoS;R2W$Ozq@eSl~RN@^UY=Lw)3U*E~XFm9DC_7 zh^ltkq>iT|@jyO)mvd1=;$)7r$S`2M`(ipnP?+}?*?3KY?5YM%#fh>Pvp>tzJ%F7~ zo?hHQdoW87TznC)!z*?!8hN!v#2~&oCc2C;{O~!gdf|;A&hW_lev?a&vJMP1=e!l) zD1WH0qFk`u=v_Zmr6bx6RN!tf_>^` zDK@gwk99HQidY=(;|L+6(bJf9JYOT^X>hX4^GkNg_IzO%x8b2qLyk0iorah z*v@@fvELIa&^d0lwX;XQ{1BS`vRDo}W7q&hbp{vVjR5sBO7@`qvy5Mc?_d>W9m9>E z%Q$mZT*A^+?3s2>F}L*xqx+1;N(L?J>LIAM&9v&3vqUK$_XY6d@2n8oH~$A8BjGh=%mw zul?vrr5e3;S-vrjF|E(01kj%=^`6kzY){2YU-PO`Dnkn#aH7tDVDyaXuw-p78y|hR zbZUi^KhV2-M_dh_?9l$%%@@_APHE#@AczHDb=9%GZpp7Ncjn0rGUK%7MJjZUA4bw9 z>SG|JS*Zc0sxW{P?Tit%HBf@QkebzRmFD5gZK+!5?#3z`vguASz1y@NdNL$8x}l1Y z7LgX+>>6qDs||$%O^R7j%S$|X zG++{%=j;E~Q!zvUw)y%~!=gu>g~4F>isK{tT2cP<;{`Cri~BXMPaD?2I`tNnA!b(r zg2m%T6VTKw?*U>iLQyRS944Qc+SfF<<8#Fx51UnL0R(D>YG}7$TNJKiUmy_o;gPcFF14>a2*!BQK-ng;^_hX!|zjK zrh-niY;Gzuy!SV=d>1THXNk5`(b5eMM%wc{4`h)>1K#FWxD*?dGU1$GJ=-&M*gjM* zw{E^@R6}D?Wt4!bI==q}nC^+Od68?~BUBdDYxeMki=?h$j1WM#c1YrO z{}v*CrH!iqu^39eGoN#VuFGbR$a&BW?PTF<6>Dj)8xWoT+E3PhZQsm718(qid-L|M zX^zWy#F~_A=s+wP0hl%RW-EFD2-#WyFMlXFAsc=Fqmr=aEibvfOt{X=zKz zTEwh_3tkyH+0n0rtB}>e=my9eZi2rK8XQC?fk#a7;;(2fM)gzSTfIBY3!NeBOES0E<1G-WUWU0fAp#y=kc?u>Hn9X9TJ%`Y7R$b*5DM+R8ja9?4I)5fZ4eC z34LK!0qo3K|4_;6?+EP@9?cT-aN|m;?TaAd__prraW0pWAJwL%q1qI{8gy@5Xs+QP z{19_Svh?c*L8S1zbW6J_89)Sj%;cc?jT^J6v_Q4FG^A~zR zM;sX!v-B`<>d!dveDteDhBcPS&G+F_>)Mku$HO|=n1{8A;I6HXme*R#5A#z-xGz8L z2@|PODH*TS4?72cQ=5J*^Ma2p)A-UlbWtenm(O<-xl-L~m~Mje=HTctkG#uEu|Ui6 zMR^14mk$-IWO*jL*DiKtURp3UzYt6zX(|-etlWax^HGzsdQH3p4n|Kv6oqb(=Q zimr&=xs=q&Po1I5VPT@T=uV&EeU}QO2KnM{qV_E0;aJnywbEWc<@)q4t-W6MSP2&U zNg-$a+bZOsbKbH#32R+&YayQqb9?C3@8i{WR~V#MtW4Z{r9${xZTVK+g_b7G_}VkM zDV6qA2It-$N_SeqEmFoav42+LE;qR`R&A`EeJerIx^%dxQc$zK?c$xXF;?Q|xSxGx zCPZKOQXC_&vZPnZFq5-~icp@zcrjXmm@Pj&S|650^mai}WiaqyR)l?_G22h?bMnk& zg_OIiZEhry-Mk#2xw6tZRajii5Ux8l?N;WB2Y^~GimiF3B`KKaQ^#^(61kyEU#Ctdsi@d z&3+P99Y9m{n%kzdn6;JGGhQO!kmoGVG=**XuM(du`aSo(mhgx7>^Qx;a3~y6XV`Qr z>2wa-mBLF^!n%14opg_HYX0=+p|EC;Xh;XRDPEWvC}WWE(p}Hq^yDnrn)~bMfz>2S zO8iGFl;Rr>VzA=3jiW~Lh&QhEFtgDr_#~r2WIwH#tzu$758wjlH-*^M9L|hCgCrgrYjJeK08DgJlKReP|7B zU^tPn&UY_o_fqwV(>?oG;eqEaF$M4Vvl09+EMjc$nmdwZhkaCX1s?{#URi1j2vHsJ_}f z>9?%YC1p^;)Z;<+G$pWw)9@vR0=WW>93Rr;Z&JzAKN^8B9Ci*#kHb8fWEg7QkdO-b zX+K7^PIe$OLEq8RL}abi-)?XE+ABok8TrEe7*iRMsE5U! zBL9NHGeOATjwiv2{j+51LfY5vvIhBXWmYBV?`x`4i1VI$8AadFLQ@$BVb3AWaGpM$ z&}gi6mOW0Nb3h{}ww=a!o|#uNpBjoDzD0_F{eA&(_Y9R;|F5()EpNi>lVwQ-3;P;c=w=->|E^KTzTKPrDE;>ctmlgw2=03`Tu111?5?b$3;00x2 zq)eyXujI)?ET`I|xXeu3I7LOfBHN{{&*3uT`4FEroU6q3m)fzH)-tB zPq0h@m#h2yE<9i+W2mmLp(294xzA$qHuw}qH_V+qF1_b`aU09Sx?kPgWtxRxH0j67 z74opmv*_LDr#^Ul@0otO`ql7H>WTV0F2EupJyaOq*_%4&yps7W0Xr!LsLCcDvT#V- z;ARa9$_u+!q_)}zH*2cB0<>Dt5K|%#XRIr~dvNa$4ubbV`lhx}r06*({+68|>D1lg z%^5odm_2~HO9IW;U`*Sb>&~oC;F82zM9W;9s(-3#ljQs`klIm#YXWE9ONPhQe)3sy zAFB^yO)I}L&7wv04D&=e(g?)tC8t4%4iK3V}Bput@<%$D8bQ&PNuf+mhs=BK?iGSi-(KTzB1cO8%doB;c$HO2L?Q zDrMPbJcy*pCM$A$ztykXYklDqq59Vw{qn3T)z=dX6`$M0d zH<56;mhh1#KmuR%&BA7xdGL<}0|!HiE-fX$!T%~1)Z)Z=n*h1XtYs2%44xNYE{aID z?zFUlDSUPq4fht^_z}(-Zb~wHi+DKXaV?x4wTdFAY>NN=#r0B_t(G<@{x)4%bp9i- zstRKeq{hV{jIWt0&6n=^$ezn|eEWv2TM3r)64u|gsc(64D{!46A40P?p72b) zZp}^|Y-5OVysADn0&YGKVjA}{%j;coMtz&B{k~zt+~mOmsi##D53%(~?#RXaKgNjt zID|qj+cNZup0|pY_k77CBR-3Gq1bN%<(NS%oMI_owD2n=%mXafSFIJBd~*7bEOY8! z@Z??k{-Ij`floTqH&~4Azn(@9KH}n8{FKqG4(M=kNFUI!il4LvJuDA0da)%ges2=c zZorwwbj^{MaFI-ft6UAYgW$iCttP^|R}Nn~UlY*O8dp6ytder1GyQo~H8+}-f$`R# z^d%_ey?<=-x0g^lS*mb|HmiQ3@#YiMa9I?|07QR-r^QnDs2hSqt_}xtW9Tdnu@YC5 zH!3tEdGl22^)j!VmGw65XQWL&*Wuh``1)jrJ)1R=-E!OD(t=u?o2gojBkEpQ;jzV0 zT=rN8lF(;KGje4k6bT7E0Lht``sY~iL0@PnNJp34FtzzcANrYIL>#Eb{M&O2k*LG3 z2nsJChU=0cLAPH(}9;Hj+Z+Hzz*5Izd7xhX)1BB`ekt_UK2Tcbu%9RP+J9n3zRN!7)t0(J06zm;<=a|kmz z94BHdocLw@tPkG6WbnBghvB61)wtXkAEPwmLw`w8~f*KQ&~;~ilDjY z;CuF{tLyjjoZb4eczw>M=ee6RA7ByDA;<36l1rF47~deubXghRVw6_aL{xj@vUc(T z*He3>>Q|qhYe9bxCqCnE`yCw+zT3(>*-Qf){f)4mLCQAPVQ8iZhj+j!bd7&1 z*m|*reVQpi73%-#YNT^-&_^ZSL9D}4)aT);&F-*Y+Ew5Pm2$NDqD<~R`}2o0)iY*|%NaWUjyw76H8Uvr{BmeFLh7DzE6-1JZ}0j((qy^dn1?RhC& zOWOk@#|jUfmw&0^JLM0W=5N@A`j5@cb(#(bi%D1@_Zy<6Q_sO^5kfCN_Lt|Bw7njG z>YbGU>V0Y;4(PDkDM4Px(HXs^@^sgn0<7n(Ds;t8CD5K0l=V3IvbvGfkX=zmI5CVG z64O)QIvB-{ot^OR2ps?A%GxWkK8(YSrKeztxn{2)`1}jj!A3>`JaW!~c6A-M42AjC z9GZA2BGb$G_lwWL&jy(ouIZ=qVR-mHY}C0N4M(vM7j0s-e8@|Ad(+5T5^*3uiu}z#HHW%RX%yb9QJr; zDCS+}W>rj!$lW&_`^htRj*ovZ>k{@7)CLhc4d_WFuHJ*MeJ0P9VXmX;bB=@4LZON> zu!EfmDH&3rpfnb_xH7)3eSuj2u3G;|RgLffH`2Wv_}1=o zSueNqQ`bPdfohTk3O{{R2b22O)_fn(Sn6j2JG9#1*GDOSu+|HEn6yv-9c)6iNRN#it6vxXW8G|c-IPObTxbzUXkO~WCpJ& z>6ead$Q2I;PKT-N`u60MAhew^hT}{(1TqE{w>bHGekPajxK#5eZr@M8=Zq8i1Nm`6 zfS*=?&A9ETSoG+qT?jfbaD2qWcj^$e+I_}OINURl(LUB;jaC%*U=1as&-!kcO_ZURpa)#|ju1$i0aidOP%MU)`e4+=<)>OU z0=_^dRw!h<@!uQ*syO18XvjK;T3qABF)LX0CsonUQ+E5lXMUVW;;(7IZRSa%d_1&Z z%dhW7*I0q>r8E93>fR(n?KFIEMLY~Y;PB3+MS*-C+frlGQ?e>=&Z0d{eh5rx zlstUgcpkmwb&tX|dw-Kmsg+kQhmV2J|1E&me1RHuC~)XlKS_;vYJ>bS7Uj)RMrbV2 z#OD*CSRS-42W)LiF6>j7<<8)GMiLR>)jj{ukOMV`Czy*+AoD!0G(|!&s=tuNoT#Em zzMSNOarqU@k!mAL=Lj3LrZ76lJhs_NB`XEH&87AHW4l_TcRGR{-d|#jrOij zDW>XK4s(c>RNh07o^0X~TYz9nEr>imu7I~xZ+mThx0@n}xapzUC*$FU$L8#8dU`D= z3A0IL%O$$`T1gTr`Y{;Wly24fyBWJr*lh#@+KbUk5CC+f#6Ep$YZ?%_ zgRDF}6ia3?qn;9n$Y+E^;w`3m&0- z#9{LmmV4RoTo*rf3|mM= zM~X6gCgH@!BKA9;UM~??&Q3gEvM$Eh`w&jV9(hI4ozB)xK0)jI%P%fYEem0M=#mpH zcEIgKoOECqRoGEWDm9kT}uMqc3#{&%L5xZXoM}@Qe;8{ zZBH<+=Iq;atev`NH{R|S+HWX5!!;sX48pI-B~C@{OBnlFm|?z4hlXLD^@JswG~j!+ z_)QZR)SHr0Kh-)b)?KFmwo>aq_Ahg&!@O2N3FY~c~vLX(DZ?w3OF+k?@WqEn(zreV9j06iMpx#kVyYcs7uPHXnhJhWJr zR&6+JsZLU5A*T3W{Q(p&akKS%or-OLshB`Nrz>TQ5G{SDX{f8fF7=&hRUP?8Q)AEl zn`>?`%p$u9JwyTKBlN}M>$0=e%1$g~`QzQ}SW$*BpSEt-;-=&MjnbMa>xQ!_S^A)L z4kYMNe}cmO>kk;3T9qb_4OHftF`!lQWmE2@S@&s#_qJljw|>M;8IfdV#XT5x!I z=o7>t(>s`BX5@rL%-Gp9=jmNRKP1G`^P74#;j-WeMRh^c)LlR3Flc!Gt_j1p-yWubL2T+Nj{lS2Q{$ElN z{~s|R|NmzJ2JHVpGX=h71P>2iF|qBlW{UfZJzf5F8y5nxpyaXs6TtkB@PCaD@k>k(ag$qsUWdMcJ{Uy`+SLgx%r~oMB zx7{t|gW29N>?YIF(UolS3FsBRA7!}z#CTWt9-^#U&WAopz@ZaSK|$e&c@P8GvrpPtdqn>`QvwxUU;6P4FbkAYjf!N_ z;Sm|0?H|>2#(BFVt6*l0{M4Qdv2EQTPcvfx-uJYVUHAJZ&Dci=&~nV0m9(|{9!aD! zb8Wsbx1Y4VBA@jlG{zbXOtjrjeyB(4bJCsWVFnWcG_2{zH{pK*1^@n$;D3BcyWZ}Y zgOn>7uVzPR=Z>RcIeKVdz%v{Wg`tQ$Iz7WD^-a%x>2Mw64D|-8e+&fmDe6}h80Y&) z?NZICiA-PFgv7+|^zvDxP|A8Uayybuqu91J66tVz z=#QrB`QiXUr>!RyhC+iV`788_nnjhqTK5BXWY)7AwPLRAqI3c{6{yHuCSpEb@7Z2% zlZyq#y~?8~Ey~8IG!mQ8I(bO`wCdJY3rl|`^$+H`n+Nr)EDV}=stJV3x~=4*K5;rf z`hLTeyeZ)x%T;tpYH`2dpMlwjsAf72c4LBeOW-m~WTGR96498fwgK2nZ&M{AtKVi+ zRJZPoneu%7xlm@}O48=xo3UVoVzqln8RYlDOE0Sx+Fir{G1c|=kF;RU?>%<}85voo z7S>DCf}#RXGqf7XRBWkKtgqw^=MuyKIAZFM2 z@IYvB+NPzT^iuhkd_?2RK}u(Y;hvhMp6Gw(6qyA{)ZtceHuz75F@btrUlsh%dfNj; z6zeC6{~yW-{{KVt|9pu4pS2p)vk^KjE`CDZ{CrPy(d@dVU{W2*;B^&5^v&2pXP2yx znxjsePb{?ly;DCX+pTFl9=6&Q#$h(&cAyY+;#}ac6>?|KRLOcN`_27rE?wAbXC{J! zr;6dp!Y?i5IO^T4RWf&UF-v!?{8CjaY_*|n`=t86TT*L-_`4`;2V9{R{gEzmlSDf% zC#4mM?YBP&fLNs=K%=d6f1zpp$H*}zow%fA}yC$DTgw98ug`p3;^76X_alf82m3}As zZD1p7I&u8y!*A4&xnVKVQ{i)<$eKrcI_&Lk)W2vg*5Aa<8Oqp_20dvMD3OsC^2o}i zBCgDnF*x@e=Tlv1%)=%epps#HwwdCWWkFQp0@O7FY8*Bb^sfed04gO~md}=qY;*xx z$C_PUZK9iv6j|{t{=!Mw!!9;|YFOCOJ#M`QY{1p060Jfcg!~mcSwJGYj<$3A3xBQW zO&-1i%to-dQUS|hFYsqi4na|r`^p9nplT{mpU=jm9$kDft7THg;9@uyW8$i;^5o!f zIQ{4XlZ4M1sbb#wRl&OSzc+hSWMI$G*~OYKHoWSInOyj4kF-DA)L$(!2RKCQ3nV^X zON3+Jy+U%3FYBuqHM2KdArcwLI(NQZD#IA!{hxtpRgDsI*+hc!`R-#~yDgAv^WN^9 zkL6aL23>%p@a`PiX=l2A^s+VF^dyg!>F)>3XIhT@{zDppN-8>2?;9F*cJ;lLg3r8R z(U#yt40Mo+6p|E}gGnJ6Gcwqq$fWqMQj}IkT};)Vi2$^hW@-y!Nxx6aTaQD{&84ZY+S&7b`r;;?bUJLaklXl$uDE+P9IV&@Do+feh|Y*UiZ&mbp!+q@j4mwpTpHi;~fnY+4qHWmtM z)X?z?bxf}uE3)|lq2@slV;LB`3hU~Jp=lQ*!{|qhOCk=#0GkvJWkLml>U4>JX({aS zDuTDCr6wzGw1|E0A!f-iZ9iMZxv*mLs)WLY-7GYp!%g50MP zhCsO%D@*lw_^YH)qO{bTai7J)02F^w?*iH%48t=W9B}89qSiXU6;ussf*lX_;{o2C zbX?crK!vX-Su16V(*2YC7I_v$Z0cZO%MEu|t>2=VVje`S=+CNy4m#S_I3_rz-8Tuu zr#wDtf43{5$4Q-}yen~xhwjWc7e2@{{gR(}X(~HavH8RmNZl!-HPbPpRCwgG6Rhzn z%uG}?Fb05H*%8Dog|Zl~ch+Pww7O z=kvO+Jznqm7_B~P_P08w<_x`k=r0r z4d>-oAIsDye!{mx1;;_zBP|}wX@4jy@+O&_YD0bXBZ)p(npBLy@d>6ig;rAa!QW6Y zB&|nz^BMqkRzqU46!L*}=9^*~Jr(X_ROPC#`gy{qQdIgofvk zFLkrE+@VleDRSqBwE;F|-lShf*$A~fP!-s?U^({WXcJ#ch=+Sf+v z6{UJGOB+eE>vQ>v%QmWuvxd(haEtT;Z9|ar-RGiyt2IFH2_eZK$l#!ZPy01<^U?X= z?s#iVD?J^!muL{WDu+GWg@3*Y2!js^(g8(Nmnvh?CB<8t89@aFQN_aTr73!{5}_NW z+A2+%TF;=o9-2l9fPD(7^HRswJ3|S)T@4qpaT~s@cIs z+=U&J-s&qejB;U^cb)ok!^)(FB;5e74}SKny3L0U-b@x$#+otJl0)A&nk1 zlxl$La+hYxby?ww3S+@FV$BO3 zRMI{_1&pYcHlT=dFM1*zH2TT2d(^B|nf(7`b93T2MniH{dtHu>B*D0=o|^WCQLt_5 zlZi@0B^2|E)SsTTY>%duCl7;xhD>%xr901&R!!bkLD@T1B&#((N2sP5g4zSUsVnMo{>g>OG>5G4Ls zFdq2t9SPMfFo!s9dbCsBM&XOA5zjMZZUF~98E-eQu;W_huy;Tn_d(|Oa=Z%h6o*2q zsUKw|8D2E4?Ew9%<8W3Z1v{f9D;DL9?69?ZXKtDRp;!y|973hOL?+tx!lpH}GHWSzS!x6Kqn!&8nhK0_}nl&`HpfAtn1xyMLyNLx2Xcc za2ES$f=a-&goYRFMq;B8UPFxn=+7DJx~ zY}pzrCwM{~uCDU~kTqNfPORZG=uuOt1ohkBI2XU8n3*XLyQ1QWE zt!!hm?`}cj$=lMM6eBSqc&U4Q9JO?%Dod{f>tB zetwbVgj=kV&HCd4ty_4rtt-JdZ{@!S>#D2lmI933-iaCRTNv`0L*{h&nL$4^ANO5? zq^Mj*UN3Q|A&p}LCB;|tKlug~kWyEc`6M(vQuzry^(6isY6AR>(_P@F|L{p>q0^8H z_rSS4jYh@yui4hLl);6$1qK&``0^eQzbwH*tHuJ^i;=xm=w+~hTD9fT3x~hAK`x?&pO7YFY-yB@QlX>-eG9&w1qPxIYs+5?!Fg zoZR84Qkb8Hzk4)i6`y@`e#vUycUr=!95h>II!jxVV(ZB1X|*5O>Qe}{b7dfYCU&Q? zmR6$Dm-O`n|D-R+se&s8i6=dgdQ-zYFe2m^^YS+@>MyX4^R7hju86-H zC9XJ!7L4miIndSZ^@~sKvJp%_V{p=D$iZ9Q-DK*Nk;$}5-8j*}Wz2E`+Llgpp1ZSR>AcwT5=M!_P3lQiOay(D#~jQUagvB09li7+ z$DmkmD@j`(v%uG~zXh^kVscdHzK}94tQb*kGSN=dd`o2Up#?<^lLJbz7PaOmGZgIp zlDi!pH1QC9tr=gMfi~SS2Pw7TA+$jAF)j#rwQ_xhU_<}`s92d*y zi?Ev7yAjJTqf5GuB#Cy@t6T`gm}xCU7&7&frO-RYu{Ef4kapcuVd|ey4MKK@XByNf z480!g*O}geZt^RmyhrWqA!vihi$KSPG$2UbB1Hz2bvxo3&&U;>C2_S$1({_$hizW z_ec!&bT|gU^hq^&b|9DF_LST#yL>w5dUZ4eZY+O$uc|rTj^{QRXIFeNI=yPU~}BOzqkgiBa-HhTZ>L%XDd zD{JKM+F$CuXl=y5c&A;~d+2b+`~I&sr2eLAfiJDG(zLq8Zoa2ivXem>^K_41sc(B- z7}k6Gg&8829|MYvgk0wi7NhtLRsjB}D1PIaugsIX%Iei~rU2bB-DJhf&~A!K1rvv_NPOn#WkdMEI?8h}0~tD!Z= zq?2%guTV%)aZz(h02cT~^w8i1cS*iGFy8tUWHdiZn)O1GY&L66D6PtYg z3iGk|Y24S3_q2&tIk8T>jo5iN1jlu@2pYz?>;X)KO&SG90iJxYw8eGj$_e`|J zQHT19u=_f{G`ZHmO}QbE?5Y640$q~MrtnteDZe{4N!tvsSPPOn0sxQV`)8MzNS0sbOan1Jp7&wn@)3{WE=%;4@yGoXv$#o(d{g&0W?XMMKdhHV*0gqib%HYAf zF%bl8;(2B4r;<$Dhc!)Iq+`@T9`j0@QF7~A*Xxr}9vlX0t)U5sLu*5S_J?TAY)yMD zP!)6v>*_~B>xXVr@5b>>D>Eq!8hm5MuKbTzSe~UOc7;4}rdS$o{5`O?#@5ycih@aX zU6xb4%>i9BY{!9RF@DG~MYGBW@d@{SooGUAguOCxRbTzYQ{eWD8^`m`Wj*QZkg&nF zK(oqUChr`7yI8i|Mz+zvHPCY#g%zG&4HG%(uK|s-=oroLt^78WzyHKQMNHqDy$Y+| znu3IGaS>{_)QL<)K-|Oee8RVSTKiWc2g8xK3}xXy;U7cu-iKEW*SA;ZWS&RLMsY9b zc7ep?8Nuh}ZYe5GUqG6XIoYruXMBdO#(m@%F5$)%1Beqta`^cCOROU^ts+}N5tj?uUlr5vTV>)`y31EcD z{qVlg{g0`Ko}d3&@XWt@;;g{h4SJTkbktV%)xORo`xyP>#pN%qP}l_Tbq_SQ??GA6 zMqU2*GCP84pX!;ZWe`*UasAO+yimpaK81!&l2!vgKzeijV1E(pApJ0X@)+IaoN*`z zCl?Q|hibfZ<#@1Lfcapfk4^X|i!?fca?P}n(zxuK{!Npo=v(*Xa8O*?U8b|Z={|I3o~4F#H`tiIBK+T>0TiNp2<6`5h;-*l zRN>);?2Y(3BDzoGOCP0xpGxhlWcPW9;69$B&$)b%%;*mKgQnltL@uGJA?SB literal 0 HcmV?d00001 diff --git a/docs/installation_flow.md b/docs/installation_flow.md new file mode 100644 index 000000000..49e97cc46 --- /dev/null +++ b/docs/installation_flow.md @@ -0,0 +1,88 @@ +# Installation Flow + +This document describes the installation flow for the CNOE AWS Reference Implementation. + +## Overview + +The CNOE AWS Reference Implementation uses a GitOps approach to deploy and manage addons on an EKS cluster. The installation process uses `helm` to bootstrap the EKS cluster. Detailed installation sequence is described below. + +## Installation Process + +1. **User Approval** + - User starts by executing the `scripts/install.sh` script which displays details such as target EKS cluster and AWS Region etc. It also requests approval from the user to proceed with installation. + +2. **Setup Configuration**: + - AWS Secrets Manager secrets are created to store configuration and GitHub App credentials using `create-config-secrets.sh` script. These secrets are fetched into the cluster by External Secret Operator. + - The `config.yaml` file is used to configure the installation. + - `install.sh` script reads the `config.yaml` and based on the specified cluster name, fetches kubeconfig of EKS cluster using AWS CLI. This kubeconfig is used for helm installation by overriding default kubeconfig. + +3. **EKS Cluster Bootstrap**: + - The script first performs helm installation of Argo CD and External Secret Operator (ESO) on the EKS cluster. It will use the temporary kubeconfig for accessing the EKS cluster. The values used for installation are static values from `packages//values.yaml` which are the same files used by addons later. + - Then the script applies custom manifests for these addons from the directory `packages//manifests/`. For ESO, this directory contains the AWS Secret Manager ClusterStore manifest and for Argo CD, it contains manifests for External Secrets of in-cluster Argo CD secret and Github App Argo CD repository credentials. These External Secrets use AWS Secret Manager ClusterStore. + - Then ESO will create corresponding kubernetes secrets for Argo CD cluster secret and repository credentials by fetching values from AWS Secret Manager which were created earlier. + +4. **Addons Deployment**: + - The script will wait 10 seconds and install the AppSet chart on the EKS cluster which creates ApplicationSets for all the enabled addons based on values in `packages/addons/values.yaml`. + - Each ApplicationSet will use [Argo CD Cluster Generator](https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/Generators-Cluster/) to create respective Argo CD Application. The Cluster Generator will generate one Argo CD Application for each enabled addon as there is only one Argo CD cluster secret. + - Although the Argo CD Applications for each addon are created, each addon will take some time to reach Healthy state due to dependencies explained in the [dependency section](#addons-dependencies). + +5. **Addon Configuration**: + - Addons are configured using helm values + - Static values are stored in `packages//values.yaml` + - Dynamic values from Argo CD cluster secret labels/annotations depend on configuration from AWS Secrets Manager. + +7. **Monitoring and Verification**: + - The installation script waits for all Argo CD applications to become healthy + - Addons can be accessed through the configured domain based on path routing settings + +## Addons Dependencies + The following is the order for addons reaching healthy state when using Path Routing. + ```mermaid + flowchart LR + ESO["ESO"] --> ArgoCD["ArgoCD"] + ArgoCD --> AWSLB["AWS Load Balancer Controller"] & ExternalDNS["External DNS"] & CertManager["Cert Manager"] & Crossplane["Crossplane"] & CrossplaneComp["Crossplane Compositions"] & Keycloak["Keycloak"] + AWSLB --> NGINX["NGINX"] + ExternalDNS --> Backstage["Backstage"] & ArgoWorkflows["Argo Workflows"] + CertManager --> Backstage & ArgoWorkflows + NGINX --> Backstage & ArgoWorkflows + Keycloak --> Backstage & ArgoWorkflows + + linkStyle 0 stroke:#2962FF + linkStyle 1 stroke:#00C853,fill:none + linkStyle 2 stroke:#00C853,fill:none + linkStyle 3 stroke:#00C853,fill:none + linkStyle 4 stroke:#00C853,fill:none + linkStyle 5 stroke:#00C853,fill:none + linkStyle 6 stroke:#00C853,fill:none + linkStyle 7 stroke:#E1BEE7,fill:none + linkStyle 8 stroke:#FF6D00,fill:none + linkStyle 9 stroke:#FFD600,fill:none + linkStyle 10 stroke:#FF6D00,fill:none + linkStyle 11 stroke:#FFD600,fill:none + linkStyle 12 stroke:#FF6D00,fill:none + linkStyle 13 stroke:#FFD600,fill:none + linkStyle 14 stroke:#FF6D00,fill:none + linkStyle 15 stroke:#FFD600,fill:none + ``` + - The colors of edges in this diagram indicate the parallel progress of addons to reach healthy state. As seen in the diagram, all the addons will reach the Healthy state in parallel except Cert Manager, Keycloak, Backstage and Argo Workflows. + - Both Backstage and Argo Workflow addons depend on the Healthy status of External DNS, Cert-Manager, NGINX and Keycloak. + - This sequential order for these addons is due to dependency of Keycloak Client creation for Backstage and Argo Workflows and both these addons also need to reach Keycloak using external URL to verify SSO configuration. Therefore, both Backstage and Argo Workflows will stay unhealthy until Keycloak reaches healthy state. + - The Keycloak client creation is done using a Job pod _(`packages/keycloak/manifests/user-sso-config-job.yaml`)_. This job pod creates the Keycloak clients for Argo CD, Backstage and Argo Workflows. It also creates the kubernetes secret `keycloak-clients` containing client secrets. + - Once the client creation is successful, The ClusterSecretStore _(`packages/keycloak/manifests/keycloak-cluster-secret-store.yaml`)_ is created so that ESO can create kubernetes secrets for Client Secrets in Backstage and Argo Workflows namespace. + - When the kubernetes secrets for Keycloak Client Secrets are created in Backstage and Argo Workflows namespace, these addons will reach Healthy state. + +## Uninstallation Process + +The uninstallation process follows these steps: + +1. **Remove idpbuilder Local Cluster**: + - The local Kind cluster created by idpbuilder is deleted + +2. **Remove Addons**: + - Addons are removed in a specific order to handle dependencies + - ApplicationSets are deleted with orphan deletion policy + - PVCs for stateful applications are cleaned up + +3. **CRD Cleanup (Optional)**: + - Custom Resource Definitions can be cleaned up using the `cleanup-crds.sh` script + - This is optional and useful when you want to completely remove all traces of the installation diff --git a/docs/installation_with_idpbuilder.md b/docs/installation_with_idpbuilder.md new file mode 100644 index 000000000..bbfecb9bc --- /dev/null +++ b/docs/installation_with_idpbuilder.md @@ -0,0 +1,347 @@ + +## Installation Flow Diagram +This diagram illustrates the high-level installation flow for the CNOE AWS Reference Implementation using **`idpbuilder`**. It shows how the **`idpbuilder`** and local environment interact with AWS resources to deploy and configure the platform on an EKS cluster. + +```mermaid +flowchart TD + subgraph "Local Environment" + config["config.yaml"] + secrets["GitHub App Credentials + (private/*.yaml)"] + create_secrets["create-config-secrets.sh"] + install["install-using-idpbuilder.sh"] + idpbuilder["idpbuilder + (Local Kind Cluster)"] + local_argocd["Argo CD + (Kind Cluster)"] + local_gitea["Gitea + (Kind Cluster)"] + end + + subgraph "AWS" + aws_secrets["AWS Secrets Manager + - cnoe-ref-impl/config + - cnoe-ref-impl/github-app"] + + subgraph "EKS Cluster" + eks_argocd["Argo CD"] + eso["External Secret Operator"] + appset["addons-appset + (ApplicationSet)"] + + subgraph "Addons" + backstage["Backstage"] + keycloak["Keycloak"] + crossplane["Crossplane"] + cert_manager["Cert Manager"] + external_dns["External DNS"] + ingress["Ingress NGINX"] + argo_workflows["Argo Workflows"] + end + end + end + + config --> create_secrets + secrets --> create_secrets + create_secrets --> aws_secrets + + config --> install + install --> idpbuilder + + idpbuilder --> local_argocd + idpbuilder --> local_gitea + + local_argocd -- "Installs" --> eks_argocd + local_argocd -- "Installs" --> eso + local_argocd -- "Creates" --> appset + + aws_secrets -- "Provides configuration" --> eso + + appset -- "Creates Argo CD Addon ApplicationSets" --> Addons + + eks_argocd -- "Manages" --> Addons + eso -- "Provides secrets to" --> Addons + + classDef aws fill:#FF9900,stroke:#232F3E,color:white; + classDef k8s fill:#326CE5,stroke:#254AA5,color:white; + classDef tools fill:#4CAF50,stroke:#388E3C,color:white; + classDef config fill:#9C27B0,stroke:#7B1FA2,color:white; + + class aws_secrets,EKS aws; + class eks_argocd,eso,appset,backstage,keycloak,crossplane,cert_manager,external_dns,ingress,argo_workflows k8s; + class idpbuilder,local_argocd,local_gitea,install,create_secrets tools; + class config,secrets config; +``` + +## Getting Started + +> [!NOTE] +> The installation requires AWS credentials to access the EKS cluster to deploy kubernetes resources. Therefore, the installation steps can be executed on local machine or on an EC2 instance with IAM instance role. If using local machine, please use [`aws-vault`](https://github.com/99designs/aws-vault) command to run local EC2 credentials server. Find more information about this requirement in [installation flow](docs/installation_flow.md) document. + +### Step 1. ☸️ Create EKS Cluster + +The reference implementation can be installed on new EKS cluster which can be created with following tools: + ++ **eksctl**: Follow the [instructions](cluster/eksctl) ++ **terraform**: Follow the [instructions](cluster/terraform/) + +This will create all the pre-requisite AWS Resources required for the reference implementation. Which includes: + ++ EKS cluster with Auto Mode or Without Auto Mode (Managed Node Group with 4 nodes) ++ Pod Identity Associations for following Addons: + +| Name | Namespace | Service Account Name | Permissions | +| ----- | --------- | -------------------- | ---------- | +| Crossplane | crossplane-system | provider-aws | Admin Permissions but with [permission boundary](cluster/iam-policies/crossplane-permissions-boundry.json) | +| External Secrets | external-secrets | external-secrets | [Permissions](https://external-secrets.io/latest/provider/aws-secrets-manager/#iam-policy) | +| External DNS | external-dns | external-dns | [Permissions](https://kubernetes-sigs.github.io/external-dns/latest/docs/tutorials/aws/#iam-policy) | +| AWS Load Balancer Controller
(When not using Auto Mode) | kube-system | aws-load-balancer-controller | [Permissions](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) | +| AWS EBS CSI Controller
(When not using Auto Mode) | kube-system | ebs-csi-controller-sa | [Permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) | + + +> [!NOTE] +> **Using Existing EKS Cluster** +> +> The reference implementation can be installed on existing EKS Cluster only if above pre-requisites are completed. + +### Step 2. 🏢 Create GitHub Organization + +Backstage and Argo CD in this reference implementation are integrated with GitHub. Therefore, a GitHub Organization should be created in order to create GitHub Apps for these integrations. Follow the instructions in [GitHub documentation](https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch) to create new organization. + +### Step 3. 🍴 Fork the Repository + +Once the organization is created, fork this repository to the new GitHub Organization by following instructions in [GitHub documentation](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo). + +### Step 4. 💻 Create GitHub Apps + +There are two ways to create GitHub App. You can use the Backstage CLI `npx @backstage/cli create-github-app ` as per instructions in [Backstage documentation](https://backstage.io/docs/integrations/github/github-apps/#using-the-cli-public-github-only), or create it manually per these instructions in [GitHub documentation](https://backstage.io/docs/integrations/github/github-apps). + +Create following apps and store it in corresponding file path. + +| App Name | Purpose | Required Permissions | File Path | Expected Content | +| -------- | ------- | -------------------- | --------- | ---------------- | +| Backstage | Used for automatically importing Backstage configuration such as Organization information, templates and creating new repositories for developer applications. | For All Repositories
- Read access to members, metadata, and organization administration
- Read and write access to administration and code | **`private/backstage-github.yaml`** | ![backstage-github-app](docs/images/backstage-github-app.png) | +| Argo CD | Used for deploying resources to cluster specified by Argo CD applications.| For All Repositories
- Read access to checks, code, members, and metadata| **`private/argocd-github.yaml`** | ![argocd-github-app](docs/images/argocd-github-app.png) | + +Argo CD requires `url` and `installationId` of the GitHub app. The `url` is the GitHub URL of the organization. The `installationId` can be captured by navigating to the app installation page with URL `https://github.com/organizations//settings/installations/`. You can find more information [on this page](https://stackoverflow.com/questions/74462420/where-can-we-find-github-apps-installation-id). + +> [!WARNING] +> **If the app is created using backstage CLI, it creates files in current working directory. These files contains credentials. Handle it with care. It is recommended to remove these files after copying the content over to files in `private` directory** + +> [!NOTE] +> The rest of the installation process assumes the GitHub apps credentials are available in `private/backstage-github.yaml` and `private/argocd-github.yaml` + +### Step 5. ⚙️ Prepare Environment for Installation + +#### 📦 Install Binaries + +The installation requires following binaries in the local environment: + ++ [**AWS CLI**](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) ++ [**Docker**](https://docs.docker.com/engine/install/) ++ [**yq**](https://mikefarah.gitbook.io/yq/v3.x) ++ [**helm**](https://helm.sh/docs/intro/install/) _(Required only if using plain shell script for installation)_ ++ [**IDPBuilder**](https://github.com/cnoe-io/idpbuilder) _(Required only if using ipdbuilder for installation)_ ++ [**AWS Vault**](https://github.com/99designs/aws-vault?tab=readme-ov-file#installing) _(Required only for local machine installation)_ + +#### 🔐 Configure AWS Credentials + +If the installation steps are being executed on EC2 instance, just ensure that the EC2 IAM instance role has permissions to access EKS cluster. No other configuration is required in this case. + +If the steps are being executed on a laptop/desktop, follow below steps: + +1. Configure the AWS CLI with credentials of an IAM role which has access to the EKS cluster. Follow instructions in [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-quickstart.html#getting-started-quickstart-new) to configure AWS CLI. +2. Once AWS CLI is configured, install and start the EC2 credentials server. + + ```bash + aws-vault exec --ec2-server + ``` + +3. Verify that the EC2 credentials server is started. + + ```bash + curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/local-credentials + ``` + +#### ⚙️ Configure Reference Implementation + +The reference implementation uses **`config.yaml`** file in the repository root directory to pass values. Refer to following table and update all the values appropriately. All the values are required. + +| Parameter | Description | Type | +|-----------|-------------|------| +| `repo.url` | GitHub URL of the fork in Github Org | string | +| `repo.revision` | Branch or Tag which should be used for Argo CD Apps | string | +| `repo.basepath` | Directory in which configuration of addons is stored | string | +| `cluster_name` | Name of the EKS cluster for reference implementation
**(The name should satisfy criteria of a valid [kubernetes resource name](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/))** | string | +| `auto_mode` | Set to "true" if EKS cluster is Auto Mode, otherwise "false" | string | +| `region` | AWS Region of the EKS cluster and config secret | string | +| `domain` | Base Domain name for exposing services
**(This should be base domain or sub domain of the Route53 Hosted Zone)** | string | +| `route53_hosted_zone_id` | Route53 hosted zone ID for configuring external-dns | string | +| `path_routing` | Enable path routing ("true") vs domain-based routing ("false") | string | +| `tags` | Arbitrary key-value pairs for AWS resource tagging | object | + +#### 🔒 Create Secrets in AWS Secret Manager + +The values required for the installation to work are stored in AWS Secret Manager in two secrets: + +1. **cnoe-ref-impl/config:** Stores values from **`config.yaml`** in JSON +2. **cnoe-ref-impl/github-app:** Stores GitHub App credentials with file name as key and content of the file as value from **private** directory. + +Run below command to create new secrets or update the existing secrets if already exists. + +```bash +./scripts/create-config-secrets.sh +``` + +> [!WARNING] +> **DO NOT** move to next steps without completing all the instructions in this step + +### Step 6. 🚀 Installation + +#### ▶️ Start the Installation Process + +The installation can be done using plain shell script or `idpbuilder`. All the addons are installed as Argo CD apps. When using bash script, Argo CD and External Secret Operator are installed on EKS cluster as helm chart. When installing with `idpbuilder`, the Argo CD in `idpbuilder` is used install these initial addons. Once Argo CD on EKS is up, other addons are installed through it and finally the Argo CD on EKS also manages itself. Check out more details about the [installation flow](docs/installation_flow.md). + ++ **Install using script:** + ```bash + ./scripts/install.sh + ``` + ++ **Install using `idpbuilder`:** + ```bash + ./scripts/install-using-idpbuilder.sh + ``` + +#### 📊 Monitor Installation Process + +The installation script will continue to run until all the addon Argo CD apps are healthy. To monitor the process, use below instructions to access Argo CD instances. _(If using EC2 instance, make sure the port-forward from EC2 to local machine is set up)_ + ++ **`idpbuilder` Argo CD:** `idpbuilder` exposes its Argo CD instance at `https://cnoe.localtest.me:8443/argocd` which can be accessed through browser. + ++ **EKS Argo CD:** Start the kubernetes port-forward session for Argo CD service and access the Argo CD UI in browser. In Argo CD UI, monitor the health of all Argo CD Apps + + ```bash + kubectl port-forward -n argocd svc/argocd-server 8080:80 + ``` + +Depending upon the configuration, Argo CD will be accessible at http://localhost:8080 or http://localhost:8080/argocd. + +Switch between the kubernetes context of idpbuilder or EKS and retrieve the credentials for Argo CD can be retrieved with following command: + +```bash +kubectl get secrets -n argocd argocd-initial-admin-secret -oyaml | yq '.data.password' | base64 -d + +# OR + +idpbuilder get secrets -p argocd -o yaml +``` + +### Step 7. 🌐 Accessing the Platform + +The addons are exposed using the base domain configured in [Step 5](#️-configure-reference-implementation). The URL depends on the setting for `path_routing`. Refer to following table for URLs: + +| App Name | URL (w/ Path Routing) | URL (w/o Path Routing) | +| --------- | --------- | --------- | +| Backstage | https://[domain] | https://backstage.[domain] | +| Argo CD | https://[domain]/argocd | https://argocd.[domain] | +| Argo Workflows | https://[domain]/argo-workflows | https://argo-workflows.[domain] | + +All the addons are configured with Keycloak SSO USER1 and the user password for it can be retrieved using following command: + +```bash +kubectl get secrets -n keycloak keycloak-config -o go-template='{{range $k,$v := .data}}{{printf "%s: " $k}}{{if not $v}}{{$v}}{{else}}{{$v | base64decode}}{{end}}{{"\n"}}{{end}}' +``` +Once, all the Argo CD apps on EKS cluster are reporting healthy status, try out [examples](docs/examples/) to create new application through Backstage. +For troubleshooting, refer to the [troubleshooting guide](docs/troubleshooting.md). + +## Cleanup +> [!WARNING] +> Before proceeding with the cleanup, ensure any Kubernetes resource created outside of the installation process such as Argo CD Apps, deployments, volume etc. are deleted. + +Run following command to remove all the addons created by this installation: + +``` +./scripts/uninstall.sh +``` + +This script will only remove resources other than CRDs from the EKS cluster so that the same cluster can used for re-installation which is useful during development. To remove CRDs, use following command: + +``` +./scripts/cleanup-crds.sh +``` + +# Installation Flow + +This document describes the installation flow for the CNOE AWS Reference Implementation. + +## Overview + +The CNOE AWS Reference Implementation uses a GitOps approach to deploy and manage addons on an EKS cluster. The installation process uses `helm` to bootstrap the EKS cluster with Argo CD and other addons. Detailed installation sequence is described below. + +## Installation Sequence + +1. **Configuration Setup**: + - The `config.yaml` file is used to configure the installation + - AWS Secrets Manager secrets are created to store configuration and GitHub App credentials using `create-config-secrets.sh` script + +2. **Local Environment Preparation**: + + Using plain shell script: + - `install.sh` script reads the `config.yaml` and based on the specified cluster name, performs helm installation on EKS cluster. + + Using idpbuilder: + - `install-using-idpbuilder.sh` script reads the `config.yaml` and based on the specified cluster name, builds a Argo CD cluster secret from eks kubeconfig. + - `idpbuilder` creates a local Kind cluster with Argo CD, Gitea and Argo CD cluster secret for EKS cluster. + - This local environment serves as a bootstrap mechanism for the remote EKS cluster using Argo CD in Kind cluster. + +3. **EKS Cluster Bootstrap**: + + Using plain shell script: + - The script performs helm installation of Argo CD and External Secret Operator on the EKS cluster. It will use the temporary kubeconfig for accessing EKS cluster. + + Using idpbuilder: + - `idpbuilder` applies Argo CD applications from the root of `packages` directory to the local Kind cluster, mainly `boostrap.yaml` and `addons-appset.yaml`. + - Argo CD in the Kind cluster installs Argo CD and External Secret Operator on the EKS cluster. It will use AWS credentials to authenticate with EKS cluster. + +4. **Addons Deployment**: + - The `addons-appset.yaml` creates an ApplicationSet in the EKS cluster's Argo CD + - This ApplicationSet creates individual Argo CD applicationSet for each addon using [cluster generator](https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/Generators-Cluster/). + - Addons are installed in a specific order to handle dependencies + +5. **Addon Configuration**: + - Addons are configured using helm values + - Static values are stored `packages//values.yaml` + - Dynamic values from Argo CD cluster secret labels/annotations which depend on configuration from AWS Secrets Manager. + +6. **Monitoring and Verification**: + - The installation script waits for all Argo CD applications to become healthy + - Addons can be accessed through the configured domain based on path routing settings + +## Uninstallation Process + +The uninstallation process follows these steps: + +1. **Remove idpbuilder Local Cluster**: + - The local Kind cluster created by idpbuilder is deleted + +2. **Remove Addons**: + - Addons are removed in a specific order to handle dependencies + - ApplicationSets are deleted with orphan deletion policy + - PVCs for stateful applications are cleaned up + +3. **CRD Cleanup (Optional)**: + - Custom Resource Definitions can be cleaned up using the `cleanup-crds.sh` script + - This is optional and useful when you want to completely remove all traces of the installation + +## Key Components + +1. **helm** _(if using `install.sh`)_: Bootstraps EKS cluster through helm chart installation. +2. **idpbuilder** _(if using `install-using-idpbuilder.sh`)_: Creates a local Kind cluster with Argo CD and Gitea, which bootstraps the EKS cluster +3. **Argo CD**: Manages the deployment of addons on the EKS cluster using GitOps +4. **External Secret Operator**: Manages secrets from AWS Secrets Manager +5. **Addons**: Various tools and services that make up the Internal Developer Platform + +## AWS Resources + +The installation relies on these AWS resources: + +1. **EKS Cluster**: The Kubernetes cluster where the platform is deployed +2. **AWS Secrets Manager**: Stores configuration and GitHub App credentials +3. **IAM Roles**: For pod identity associations required by various addons +4. **Route53**: For DNS management via External DNS diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md new file mode 100644 index 000000000..9b1dc038b --- /dev/null +++ b/docs/troubleshooting.md @@ -0,0 +1,56 @@ + +# Troubleshooting +The installation process would take 30-35 minutes depending upon path_routing configuration. If the installation is not complete within this time, cancel the `install.sh` script execution and follow instruction in this document to troubleshoot the issues.] + +## Investigating Failures +All adoons are deployed as ArgoCD application in a two-step process. ++ Bootstraping the EKS cluster with Argo CD and External Secret Operator using idpbuilder ++ Creating rest of the addons through Argo CD on EKS cluster. + +Therefore, the best way to investigate and issue is to navigate to respective ArgoCD UI and review any errors in Argo CD application or in logs of the specific addon. + +First, switch context to `kind-localdev` cluster (idpbuilder) or EKS cluster and run following command to retrieve passwordof Argo CD. + +```bash +kubectl get secrets -n argocd argocd-initial-admin-secret -oyaml | yq '.data.password' | base64 -d + +# OR + +idpbuilder get secrets -p argocd -o yaml +``` + +**To Access **`idpbuilder`** Argo CD:** + +In a web browser, Visit `https://cnoe.localtest.me:8443/argocd`. + +**To Access **`EKS Cluster`** Argo CD:** +Verify if the Argo CD, Ingress NGINX and Cert-Manager addons on EKS cluster are healthy. + +``` +kubectl get applications -n argocd +``` + +If these addons are healthy then the EKS cluster Argo CD can be accessed directly in web browser using URL `https://argocd.[domain_name]` or `https://[domain_name]/argocd` + +Otherwise, start a kubernetes port forward session for Argo CD: + +``` +kubectl port-forward -n argocd svc/argocd-server 8080:80 +``` +After this, visit `https://localhost:8080` or `https://localhost:8080/argocd` in a web browser. + + +## Common issues + +### DNS Records not updated after reinstallation +External DNS does not delete DNS records during uninstallation. After reinstallation, External DNS might not be able to update the records with new values. in such cases, delete A, AAAA and TXT records from the Route 53 Hosted Zone and restart the external DNS pods. This will trigger a creation of new records. + +### Certificate not issued by Cert Manager ++ Describe the pending certificate challenge. If it shows message similar to: + +``` +Reason: Waiting for HTTP-01 challenge propagation: failed to perform self check GET request 'http://DOMAIN_NAME/.well-known/acme-challenge/6AQ5cRc7J6FNQ9xGOBDI5_G1lHsNM5J5ivbS3iSHd3c': Get "http://DOMAIN_NAME/.well-known/acme-challenge/6AQ5cRc7J6FNQ9xGOBDI5_G1lHsNM5J5ivbS3iSHd3c": dial tcp: lookup argo.DOMAIN_NAME on 10.100.0.10:53: no such host +``` +This is due to DNS propagation delay in the cluster. Once DNS entries are propagated (may take ~10 min), certificate should be issued. + ++ The reference implentation uses Lets Encrypt production API for requesting certificates. This API has certain limits on number of certificates issued. Due to these rate limits certificates may not be issued. Refer to [Lets Encrypt documentation](https://letsencrypt.org/docs/rate-limits/) for more information about this API throttling. diff --git a/eksctl.yaml b/eksctl.yaml deleted file mode 100644 index 68d3b755c..000000000 --- a/eksctl.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: eksctl.io/v1alpha5 -kind: ClusterConfig -metadata: - name: cnoe-ref-impl - region: us-west-2 - version: "1.28" -managedNodeGroups: - - name: managed-ng-1 - instanceType: m5.large - minSize: 3 - maxSize: 6 - desiredCapacity: 4 - volumeSize: 100 - ssh: - allow: false - iam: - withAddonPolicies: - autoScaler: true - labels: - role: general-purpose -iam: - withOIDC: true -addons: -- name: aws-ebs-csi-driver - version: "v1.28.0-eksbuild.1" - attachPolicyARNs: - - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \ No newline at end of file diff --git a/packages/addons/path-routing-values.yaml b/packages/addons/path-routing-values.yaml new file mode 100644 index 000000000..f5f7d5570 --- /dev/null +++ b/packages/addons/path-routing-values.yaml @@ -0,0 +1,47 @@ +# This file contains overriding values for addons based on "path_routing" label on cluster secret +argocd: + enabled: true + additionalResources: + - path: true # This duplciation is required as helm values for slices are not merged + manifestPath: "manifests" + type: "manifests" + - path: true + manifestPath: "path-routing" + type: "manifests" + +cert-manager: + enabled: true + additionalResources: + - path: true + manifestPath: "path-routing" + type: "manifests" + +keycloak: + enabled: true + additionalResources: + - path: true + manifestPath: "manifests" + type: "manifests" + - path: true + manifestPath: "path-routing" + type: "manifests" + +backstage: + enabled: true + additionalResources: + - path: true + manifestPath: "manifests" + type: "manifests" + - path: true + manifestPath: "path-routing" + type: "manifests" + +argo-workflows: + enabled: true + additionalResources: + - path: true + manifestPath: "manifests" + type: "manifests" + - path: true + manifestPath: "path-routing" + type: "manifests" \ No newline at end of file diff --git a/packages/addons/values.yaml b/packages/addons/values.yaml new file mode 100644 index 000000000..fcf69f5c8 --- /dev/null +++ b/packages/addons/values.yaml @@ -0,0 +1,274 @@ +argocd: + enabled: true + chartName: argo-cd + namespace: argocd + releaseName: argocd + defaultVersion: "8.0.14" + chartRepository: "https://argoproj.github.io/argo-helm" + valuesObject: + cnoe_ref_impl: # Specific values for reference CNOE implementation to control extraObjects. + auto_mode: '{{ if eq .metadata.labels.auto_mode "true" }}true{{ else }}false{{ end }}' + global: + domain: '{{ if eq .metadata.labels.path_routing "true" }}{{ .metadata.annotations.domain }}{{ else }}argocd.{{ .metadata.annotations.domain }}{{ end }}' + server: + ingress: + annotations: + cert-manager.io/cluster-issuer: '{{ if eq .metadata.labels.path_routing "false" }}letsencrypt-prod{{ end }}' + path: '/{{ if eq .metadata.labels.path_routing "true" }}argocd{{ end }}' + configs: + cm: + oidc.config: | + name: Keycloak + issuer: https://{{ if eq .metadata.labels.path_routing "false" }}keycloak.{{ .metadata.annotations.domain }}{{ else }}{{ .metadata.annotations.domain }}/keycloak{{ end }}/realms/cnoe + clientID: argocd + enablePKCEAuthentication: true + requestedScopes: + - openid + - profile + - email + - groups + params: + 'server.basehref': '/{{ if eq .metadata.labels.path_routing "true" }}argocd{{ end }}' + 'server.rootpath': '{{ if eq .metadata.labels.path_routing "true" }}argocd{{ end }}' + additionalResources: + - manifestPath: "manifests" + type: "manifests" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane-bootstrap', 'control-plane'] + +aws-load-balancer-controller: + enabled: true + # enableAckPodIdentity: true + namespace: kube-system + defaultVersion: "1.13.2" + chartRepository: "https://aws.github.io/eks-charts" + valuesObject: + serviceAccount: + name: "aws-load-balancer-controller" + # vpcId: '{{.metadata.annotations.aws_vpc_id}}' + clusterName: '{{ .metadata.labels.clusterName }}' + ignoreDifferences: + - kind: Secret + name: aws-load-balancer-tls + jsonPointers: [/data] + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: ['.webhooks[].clientConfig.caBundle'] + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: ['.webhooks[].clientConfig.caBundle'] + selector: + matchExpressions: + - key: auto_mode + operator: In + values: ['false'] + - key: environment + operator: In + values: ['control-plane'] + +ingress-nginx: + enabled: true + chartName: ingress-nginx + namespace: ingress-nginx + releaseName: ingress-nginx + defaultVersion: "4.7.0" + chartRepository: "https://kubernetes.github.io/ingress-nginx" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +external-dns: + enabled: true + releaseName: external-dns + namespace: external-dns + chartName: external-dns + chartRepository: https://kubernetes-sigs.github.io/external-dns + defaultVersion: "1.16.1" + valuesObject: + zoneIdFilters: + - '{{ .metadata.annotations.route53_hosted_zone_id }}' + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +external-secrets: + enabled: true + enableAckPodIdentity: false + namespace: external-secrets + chartName: external-secrets + defaultVersion: "0.17.0" + chartRepository: "https://charts.external-secrets.io" + additionalResources: + - manifestPath: "manifests" + type: "manifests" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane-bootstrap', 'control-plane'] + +cert-manager: + enabled: true + chartName: cert-manager + namespace: cert-manager + releaseName: cert-manager + defaultVersion: "1.17.2" + chartRepository: "https://charts.jetstack.io" + valuesObject: + global: + domainName: '{{ if eq .metadata.labels.path_routing "true" }}{{ .metadata.annotations.domain }}{{ end }}' + pathRouting: '{{ if eq .metadata.labels.path_routing "true" }}true{{ else }}false{{ end }}' + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +keycloak: + enabled: true + chartName: keycloak + namespace: keycloak + releaseName: keycloak + defaultVersion: "24.7.3" + chartRepository: "https://charts.bitnami.com/bitnami" + valuesObject: + httpRelativePath: '/{{ if eq .metadata.labels.path_routing "true" }}keycloak/{{ end }}' + ingress: + hostname: '{{ if eq .metadata.labels.path_routing "false" }}keycloak.{{ .metadata.annotations.domain }}{{ else }}{{ .metadata.annotations.domain }}{{ end }}' + annotations: + cert-manager.io/cluster-issuer: '{{ if eq .metadata.labels.path_routing "false" }}letsencrypt-prod{{ end }}' + extraTls: + - hosts: + - '{{ if eq .metadata.labels.path_routing "false" }}keycloak.{{ .metadata.annotations.domain }}{{ else }}{{ .metadata.annotations.domain }}{{ end }}' + secretName: keycloak-server-tls + additionalResources: + - manifestPath: "manifests" + type: "manifests" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +backstage: + enabled: true + chartName: backstage + namespace: backstage + releaseName: backstage + defaultVersion: "2.6.0" + chartRepository: "https://backstage.github.io/charts" + valuesObject: + ingress: + host: '{{ if eq .metadata.labels.path_routing "false" }}backstage.{{ .metadata.annotations.domain }}{{ else }}{{ .metadata.annotations.domain }}{{ end }}' + annotations: + cert-manager.io/cluster-issuer: '{{ if eq .metadata.labels.path_routing "false" }}letsencrypt-prod{{ end }}' + backstage: + appConfig: + catalog: + locations: + - type: url + target: '{{ .metadata.annotations.addons_repo_url }}/blob/{{ .metadata.annotations.addons_repo_revision }}/templates/backstage/catalog-info.yaml' + extraEnvVars: + - name: BACKSTAGE_FRONTEND_URL + value: 'https://{{ if eq .metadata.labels.path_routing "false" }}backstage.{{ .metadata.annotations.domain }}{{ else }}{{ .metadata.annotations.domain }}{{ end }}' + - name: KEYCLOAK_NAME_METADATA + value: 'https://{{ if eq .metadata.labels.path_routing "false" }}keycloak.{{ .metadata.annotations.domain }}{{ else }}{{ .metadata.annotations.domain }}/keycloak{{ end }}/realms/cnoe/.well-known/openid-configuration' + - name: ARGO_WORKFLOWS_URL + value: 'https://{{ if eq .metadata.labels.path_routing "false" }}argo-workflows.{{ .metadata.annotations.domain }}{{ else }}{{ .metadata.annotations.domain }}/argo-workflows{{ end }}' + - name: ARGO_CD_URL + value: 'https://{{ if eq .metadata.labels.path_routing "false" }}argocd.{{ .metadata.annotations.domain }}{{ else }}{{ .metadata.annotations.domain }}/argocd{{ end }}' + additionalResources: + - manifestPath: "manifests" + type: "manifests" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +argo-workflows: + enabled: true + chartName: argo-workflows + namespace: argo + releaseName: argo-workflows + defaultVersion: "0.45.18" + chartRepository: "https://argoproj.github.io/argo-helm" + valuesObject: + server: + baseHref: '/{{ if eq .metadata.labels.path_routing "true" }}argo-workflows/{{ end }}' + sso: + issuer: '{{ if eq .metadata.labels.path_routing "true" }}https://{{ .metadata.annotations.domain }}/keycloak{{ else }}https://keycloak.{{ .metadata.annotations.domain }}{{ end }}/realms/cnoe' + redirectUrl: '{{ if eq .metadata.labels.path_routing "true" }}https://{{ .metadata.annotations.domain }}/argo-workflows{{ else }}https://argo-workflows.{{ .metadata.annotations.domain }}{{ end }}/oauth2/callback' + ingress: + annotations: + cert-manager.io/cluster-issuer: '{{ if eq .metadata.labels.path_routing "false" }}letsencrypt-prod{{ end }}' + nginx.ingress.kubernetes.io/rewrite-target: '{{ if eq .metadata.labels.path_routing "true" }}/$2{{ end }}' + hosts: + - '{{ if eq .metadata.labels.path_routing "true" }}{{ .metadata.annotations.domain }}{{ else }}argo-workflows.{{ .metadata.annotations.domain }}{{ end }}' + paths: + - '/{{ if eq .metadata.labels.path_routing "true" }}argo-workflows(/|$)(.*){{ end }}' + tls: + - hosts: + - '{{ if eq .metadata.labels.path_routing "true" }}{{ .metadata.annotations.domain }}{{ else }}argo-workflows.{{ .metadata.annotations.domain }}{{ end }}' + secretName: argo-workflows-server-tls + additionalResources: + - manifestPath: "manifests" + type: "manifests" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +crossplane: + enabled: true + chartName: crossplane + namespace: crossplane-system + releaseName: crossplane + defaultVersion: "1.20.0" + chartRepository: "https://charts.crossplane.io/stable" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +crossplane-upbound-providers: + enabled: true + chartName: crossplane-aws-upbound + namespace: crossplane-system + releaseName: crossplane-upbound-providers + defaultVersion: "3.0.0" + chartRepository: "https://gitops-bridge-dev.github.io/gitops-bridge-helm-charts" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +crossplane-compositions: + enabled: true + namespace: crossplane-system + type: manifest + path: packages/crossplane-compositions + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + +syncPolicy: + automated: + selfHeal: true + allowEmpty: true + prune: false + +syncPolicyAppSet: + preserveResourcesOnDeletion: false # Set to false so that cleanup script removes all the deployed resources \ No newline at end of file diff --git a/packages/appset-chart/.helmignore b/packages/appset-chart/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/packages/appset-chart/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packages/appset-chart/Chart.yaml b/packages/appset-chart/Chart.yaml new file mode 100644 index 000000000..3546ee5e8 --- /dev/null +++ b/packages/appset-chart/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: application-sets +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" diff --git a/packages/appset-chart/README.md b/packages/appset-chart/README.md new file mode 100644 index 000000000..7234aa892 --- /dev/null +++ b/packages/appset-chart/README.md @@ -0,0 +1,185 @@ +# Application Sets Helm Chart + +This Helm chart deploys ApplicationSets for managing various addons in a Kubernetes cluster using Argo CD. + +## Overview + +The Application Sets chart is designed to deploy and manage multiple Kubernetes addons across clusters using Argo CD's ApplicationSet controller. It provides a standardized way to deploy common addons such as: + +- Argo CD +- AWS Load Balancer Controller +- Ingress NGINX +- External DNS +- External Secrets +- Cert Manager +- Keycloak +- Backstage + +## Prerequisites + +- Kubernetes cluster +- Argo CD installed +- Helm 3.x + +## Installation + +```bash +helm install application-sets ./chart -n argocd +``` + +## Configuration + +### Global Configuration + +| Parameter | Description | Default | +|-----------|-------------|---------| +| `syncPolicy` | Default sync policy for all applications | See values.yaml | +| `syncPolicyAppSet` | Sync policy for ApplicationSets | `{ preserveResourcesOnDeletion: true }` | +| `useSelectors` | Whether to use selectors for targeting clusters | `true` | +| `repoURLGit` | Git repository URL for addons | `'{{.metadata.annotations.addons_repo_url}}'` | +| `repoURLGitRevision` | Git repository revision for addons | `'{{.metadata.annotations.addons_repo_revision}}'` | +| `repoURLGitBasePath` | Base path in Git repository for addons | `'{{.metadata.annotations.addons_repo_basepath}}'` | +| `useValuesFilePrefix` | Whether to use a prefix for values files | `false` | +| `valuesFilePrefix` | Prefix for values files | `''` | +| `appsetPrefix` | Prefix for ApplicationSet names | `''` | + +### Addon Configuration + +Each addon is configured as a top-level key in the values file. The following parameters are available for each addon: + +| Parameter | Description | Default | +|-----------|-------------|---------| +| `enabled` | Whether to enable the addon | `false` | +| `namespace` | Namespace to deploy the addon | Varies by addon | +| `chartName` | Name of the Helm chart | Same as addon key | +| `releaseName` | Name of the Helm release | Same as addon key | +| `defaultVersion` | Default version of the chart | Varies by addon | +| `chartRepository` | Repository URL for the chart | Varies by addon | +| `chartNamespace` | Namespace in the chart repository | `''` | +| `enableAckPodIdentity` | Whether to enable AWS Controller for Kubernetes Pod Identity | `false` | +| `selector` | Selector for targeting clusters | `{}` | +| `selectorMatchLabels` | Match labels for targeting clusters | `{}` | +| `valuesObject` | Values to pass to the Helm chart | `{}` | +| `ignoreDifferences` | Resources to ignore differences for | `[]` | +| `additionalResources` | Additional resources to deploy | `{}` | +| `syncPolicy` | Sync policy for the addon | Same as global `syncPolicy` | +| `annotationsAppSet` | Annotations for the ApplicationSet | `{}` | +| `annotationsApp` | Annotations for the Application | `{}` | +| `labelsAppSet` | Labels for the ApplicationSet | `{}` | +| `environments` | Environment-specific configurations | `[]` | + +## Values File Structure + +```yaml +# Global configuration +syncPolicy: + automated: + selfHeal: false + allowEmpty: true + prune: false + retry: + limit: -1 + backoff: + duration: 5s + factor: 2 + maxDuration: 10m + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + +syncPolicyAppSet: + preserveResourcesOnDeletion: true + +useSelectors: true +repoURLGit: '{{.metadata.annotations.addons_repo_url}}' +repoURLGitRevision: '{{.metadata.annotations.addons_repo_revision}}' +repoURLGitBasePath: '{{.metadata.annotations.addons_repo_basepath}}' + +# Addon configurations +argocd: + enabled: true + chartName: argo-cd + namespace: argocd + releaseName: argocd + defaultVersion: "8.0.14" + chartRepository: "https://argoproj.github.io/argo-helm" + additionalResources: + path: true + manifestPath: "manifests" + type: "manifests" + +aws-load-balancer-controller: + enabled: true + namespace: kube-system + defaultVersion: "1.13.2" + chartRepository: "https://aws.github.io/eks-charts" + valuesObject: + serviceAccount: + name: "aws-load-balancer-controller" + clusterName: '{{.name}}' + ignoreDifferences: + - kind: Secret + name: aws-load-balancer-tls + jsonPointers: [/data] + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: ['.webhooks[].clientConfig.caBundle'] + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: ['.webhooks[].clientConfig.caBundle'] + +# Additional addons follow the same pattern +``` + +## Advanced Features + +### Pod Identity + +For addons that require AWS IAM roles, you can enable Pod Identity: + +```yaml +addon-name: + enabled: true + enableAckPodIdentity: true + # other configuration +``` + +### Additional Resources + +You can deploy additional resources alongside an addon: + +```yaml +addon-name: + enabled: true + additionalResources: + path: true + manifestPath: "manifests" + type: "manifests" +``` + +### Environment-Specific Configurations + +You can specify different chart versions for different environments: + +```yaml +addon-name: + enabled: true + environments: + - selector: + environment: staging + tenant: tenant1 + chartVersion: "1.2.3" +``` + +## Templates + +The chart includes several helper templates: + +- `_helpers.tpl`: Common helper functions +- `_application_set.tpl`: ApplicationSet generation +- `_git_matrix.tpl`: Git matrix generator +- `_pod_identity.tpl`: Pod identity configuration + +## License + +This chart is licensed under the Apache License 2.0. \ No newline at end of file diff --git a/packages/appset-chart/templates/_application_set.tpl b/packages/appset-chart/templates/_application_set.tpl new file mode 100644 index 000000000..0c63b0ea7 --- /dev/null +++ b/packages/appset-chart/templates/_application_set.tpl @@ -0,0 +1,59 @@ +{{/* +Template to generate additional resources configuration +*/}} +{{- define "application-sets.additionalResources" -}} +{{- $chartName := .chartName -}} +{{- $chartConfig := .chartConfig -}} +{{- $valueFiles := .valueFiles -}} +{{- $values := .values -}} + +{{- range $resource := $chartConfig.additionalResources }} +- repoURL: {{ $values.repoURLGit | squote }} + targetRevision: {{ $values.repoURLGitRevision | squote }} + path: {{- if eq $resource.type "manifests" }} + '{{ $values.repoURLGitBasePath }}/{{ $chartName }}{{ if $values.useValuesFilePrefix }}{{ $values.valuesFilePrefix }}{{ end }}/{{ $resource.manifestPath }}' + {{- else }} + {{ $resource.path | squote }} + {{- end}} + {{- if $resource.helm }} + helm: + releaseName: '{{`{{ .name }}`}}-{{ $resource.helm.releaseName }}' + {{- if $resource.helm.valuesObject }} + valuesObject: + {{- $resource.helm.valuesObject | toYaml | nindent 6 }} + {{- end }} + ignoreMissingValueFiles: true + valueFiles: + {{- include "application-sets.valueFiles" (dict + "nameNormalize" $chartName + "valueFiles" $valueFiles + "values" $values + "chartType" $resource.type) | nindent 6 }} + {{- end }} +{{- end }} +{{- end }} + + +{{/* +Define the values path for reusability +*/}} +{{- define "application-sets.valueFiles" -}} +{{- $nameNormalize := .nameNormalize -}} +{{- $chartConfig := .chartConfig -}} +{{- $valueFiles := .valueFiles -}} +{{- $chartType := .chartType -}} +{{- $values := .values -}} +{{- with .valueFiles }} +{{- range . }} +- $values/{{ $values.repoURLGitBasePath }}/{{ $nameNormalize }}{{ if $chartType }}/{{ $chartType }}{{ end }}/{{ if $chartConfig.valuesFileName }}{{ $chartConfig.valuesFileName }}{{ else }}{{ . }}{{ end }} +{{- if $values.useValuesFilePrefix }} +- $values/{{ $values.repoURLGitBasePath }}/{{ if $values.useValuesFilePrefix }}{{ $values.valuesFilePrefix }}{{ end }}{{ . }}/{{ $nameNormalize }}{{ if $chartType }}/{{ $chartType }}{{ end }}/{{ if $chartConfig.valuesFileName }}{{ $chartConfig.valuesFileName }}{{ else }}values.yaml{{ end }} +{{- end }} +{{- end }} +{{- end }} +{{- with $chartConfig.valueFiles }} +{{- range . }} +- $values/{{ $values.repoURLGitBasePath }}/{{ $nameNormalize }}{{ if $chartType }}/{{ $chartType }}{{ end }}/{{ if $chartConfig.valuesFileName }}{{ $chartConfig.valuesFileName }}{{ else }}{{ . }}{{ end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/packages/appset-chart/templates/_git_matrix.tpl b/packages/appset-chart/templates/_git_matrix.tpl new file mode 100644 index 000000000..61353d3bf --- /dev/null +++ b/packages/appset-chart/templates/_git_matrix.tpl @@ -0,0 +1,34 @@ + {{/* +Template creating git matrix generator +*/}} +{{- define "application-sets.git-matrix" -}} +{{- $chartName := .chartName -}} +{{- $chartConfig := .chartConfig -}} +{{- $repoURLGit := .repoURLGit -}} +{{- $repoURLGitRevision := .repoURLGitRevision -}} +{{- $selectors := .selectors -}} +{{- $useSelectors := .useSelectors -}} +generators: +- matrix: + generators: + - clusters: + selector: + matchLabels: + argocd.argoproj.io/secret-type: cluster + {{- if $selectors }} + {{- toYaml $selectors | nindent 16 }} + {{- end }} + {{- if $chartConfig.selectorMatchLabels }} + {{- toYaml $chartConfig.selectorMatchLabels | nindent 18 }} + {{- end }} + {{- if and $chartConfig.selector $useSelectors }} + {{- toYaml $chartConfig.selector | nindent 16 }} + {{- end }} + values: + chart: {{ $chartConfig.chartName | default $chartName | quote }} + - git: + repoURL: {{ $repoURLGit | squote }} + revision: {{ $repoURLGitRevision | squote }} + files: + - path: {{ $chartConfig.matrixPath | squote }} +{{- end }} \ No newline at end of file diff --git a/packages/appset-chart/templates/_helpers.tpl b/packages/appset-chart/templates/_helpers.tpl new file mode 100644 index 000000000..c7056130c --- /dev/null +++ b/packages/appset-chart/templates/_helpers.tpl @@ -0,0 +1,48 @@ +{{/* +Expand the name of the chart. Defaults to `.Chart.Name` or `nameOverride`. +*/}} +{{- define "application-sets.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Generate a fully qualified app name. +If `fullnameOverride` is defined, it uses that; otherwise, it constructs the name based on `Release.Name` and chart name. +*/}} +{{- define "application-sets.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name (default .Chart.Name .Values.nameOverride) | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version, useful for labels. +*/}} +{{- define "application-sets.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels for the ApplicationSet, including version and managed-by labels. +*/}} +{{- define "application-sets.labels" -}} +helm.sh/chart: {{ include "application-sets.chart" . }} +app.kubernetes.io/name: {{ include "application-sets.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Common Helm and Kubernetes Annotations +*/}} +{{- define "application-sets.annotations" -}} +helm.sh/chart: {{ include "application-sets.chart" . }} +{{- if .Values.annotations }} +{{ toYaml .Values.annotations }} +{{- end }} +{{- end }} diff --git a/packages/appset-chart/templates/_pod_identity.tpl b/packages/appset-chart/templates/_pod_identity.tpl new file mode 100644 index 000000000..065f7c922 --- /dev/null +++ b/packages/appset-chart/templates/_pod_identity.tpl @@ -0,0 +1,35 @@ +{{/* +Template to generate pod-identity configuration +*/}} +{{- define "application-sets.pod-identity" -}} +{{- $chartName := .chartName -}} +{{- $chartConfig := .chartConfig -}} +{{- $valueFiles := .valueFiles -}} +{{- $values := .values -}} +{{- with merge (default dict $values.ackPodIdentity) (default dict $chartConfig.ackPodIdentity) }} +{{- if .path }} +- repoURL: '{{ $values.repoURLGit }}' + targetRevision: '{{ $values.repoURLGitRevision }}' + path: {{default "charts/pod-identity" $values.ackPodIdentity.path }} +{{- else if .repoURL }} +- repoURL: '{{ $values.ackPodIdentity.repoURL }}' + chart: '{{ $values.ackPodIdentity.chart }}' + targetRevision: '{{ $values.ackPodIdentity.chartVersion }}' +{{- end }} +{{- end }} + helm: + releaseName: '{{`{{ .name }}`}}-{{ $chartConfig.chartName | default $chartName }}' + valuesObject: + create: '{{`{{default "`}}{{ $chartConfig.enableAckPodIdentity }}{{`" (index .metadata.annotations "ack_create")}}`}}' + region: '{{`{{ .metadata.annotations.aws_region }}`}}' + accountId: '{{`{{ .metadata.annotations.aws_account_id}}`}}' + podIdentityAssociation: + clusterName: '{{`{{ .name }}`}}' + namespace: '{{ default $chartConfig.namespace .namespace }}' + ignoreMissingValueFiles: true + valueFiles: + {{- include "application-sets.valueFiles" (dict + "nameNormalize" $chartName + "valueFiles" $valueFiles + "values" $values "chartType" "pod-identity") | nindent 6 }} +{{- end }} diff --git a/packages/appset-chart/templates/application-set.yaml b/packages/appset-chart/templates/application-set.yaml new file mode 100644 index 000000000..aad60d536 --- /dev/null +++ b/packages/appset-chart/templates/application-set.yaml @@ -0,0 +1,189 @@ +{{- $values := .Values }} +{{- $chartType := .Values.chartType }} +{{- $namespace := .Values.namespace }} +{{- $syncPolicy := .Values.syncPolicy -}} +{{- $syncPolicyAppSet := .Values.syncPolicyAppSet -}} +{{- $goTemplateOptions := .Values.goTemplateOptions -}} +{{- $repoURLGit := .Values.repoURLGit -}} +{{- $repoURLGitRevision := .Values.repoURLGitRevision -}} +{{- $repoURLGitBasePath := .Values.repoURLGitBasePath -}} +{{- $valueFiles := .Values.valueFiles -}} +{{- $valuesFilePrefix := .Values.valuesFilePrefix -}} +{{- $useValuesFilePrefix := (default false .Values.useValuesFilePrefix ) -}} +{{- $useSelectors:= .Values.useSelectors -}} +{{- $globalSelectors := .Values.globalSelectors -}} +{{- $appsetPrefix := .Values.appsetPrefix -}} + +{{- range $chartName, $chartConfig := .Values }} +{{- if and (kindIs "map" $chartConfig) (hasKey $chartConfig "enabled") }} +{{- if eq (toString $chartConfig.enabled) "true" }} +{{- $nameNormalize := printf "%s" $chartName | replace "_" "-" | trunc 63 | trimSuffix "-" -}} +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: {{ if $appsetPrefix }}{{ $appsetPrefix | default "" }}{{ end }}{{ $nameNormalize }} + namespace: {{ default "argocd" $namespace }} + annotations: + {{- include "application-sets.annotations" $ | nindent 4 }} + {{- if $chartConfig.annotationsAppSet }}{{- toYaml $chartConfig.annotationsAppSet | nindent 4 }}{{- end }} + labels: + {{- include "application-sets.labels" $ | nindent 4 }} + {{- if $chartConfig.labelsAppSet }}{{- toYaml $chartConfig.labelsAppSet | nindent 4 }}{{- end }} + # finalizers: + # - resources-finalizer.argocd.argoproj.io +spec: + goTemplate: true + {{- if $chartConfig.goTemplateOptions }} + goTemplateOptions: + {{ toYaml $chartConfig.goTemplateOptions | nindent 2 }} + {{- else }} + goTemplateOptions: {{ default (list "missingkey=error") $goTemplateOptions }} + {{- end }} + {{- if $chartConfig.syncPolicyAppSet }} + syncPolicy: + {{- toYaml $chartConfig.syncPolicyAppSet | nindent 4 }} + {{- else }} + syncPolicy: + {{- toYaml $syncPolicyAppSet | nindent 4 }} + {{- end }} + {{- if $chartConfig.gitMatrix }} + {{ include "application-sets.git-matrix" (dict + "chartName" $nameNormalize "chartConfig" $chartConfig + "repoURLGit" $repoURLGit "repoURLGitRevision" $repoURLGitRevision + "selectors" $globalSelectors "useSelectors" $useSelectors + ) | nindent 2 }} + {{- else }} + generators: + {{- if $chartConfig.environments }} + - merge: + mergeKeys: [server] + generators: + {{- end }} + - clusters: + selector: + matchLabels: + argocd.argoproj.io/secret-type: cluster + {{- if $globalSelectors }} + {{- toYaml $globalSelectors | nindent 12 }} + {{- end }} + {{- if $chartConfig.selectorMatchLabels }} + {{- toYaml $chartConfig.selectorMatchLabels | nindent 12 }} + {{- end }} + {{- if and $chartConfig.selector $useSelectors }} + {{- toYaml $chartConfig.selector | nindent 10 }} + {{- end }} + {{- if not $chartConfig.resourceGroup }} + values: + addonChart: {{ $chartConfig.chartName | default $nameNormalize | quote }} + {{- if $chartConfig.defaultVersion }} + addonChartVersion: {{ $chartConfig.defaultVersion | quote }} + {{- end }} + {{- if $chartConfig.chartRepository }} + addonChartRepository: {{ $chartConfig.chartRepository | quote }} + {{- end }} + {{- if $chartConfig.chartNamespace }} + addonChartRepositoryNamespace: {{ $chartConfig.chartNamespace | quote }} + chart: {{ printf "%s/%s" $chartConfig.chartNamespace ($chartConfig.chartName | default $nameNormalize) | quote }} + {{- else }} + chart: {{ $chartConfig.chartName | default $nameNormalize | quote }} + {{- end }} + {{- end }} + {{- if $chartConfig.environments }} + {{- range $chartConfig.environments }} + - clusters: + selector: + matchLabels: + {{- toYaml .selector | nindent 18 }} + values: + addonChartVersion: {{ .chartVersion | default $chartConfig.defaultVersion | quote }} + {{- end }} + {{- end }} + {{- end }} + template: + metadata: + {{- if $chartConfig.appSetName }} + name: {{ $chartConfig.appSetName }} + {{- else }} + name: '{{ $nameNormalize }}-{{`{{ .name }}`}}' + {{- end }} + labels: + {{- if $chartConfig.path }} + addonVersion: {{ $repoURLGitRevision | squote }} + {{- else }} + addonVersion: '{{`{{.values.addonChartVersion }}`}}' + {{- end }} + addon: 'true' + addonName: {{ $nameNormalize }} + environment: '{{`{{.metadata.labels.environment}}`}}' + clusterName: '{{`{{.name}}`}}' + kubernetesVersion: '{{`{{default "v1.32.0" (index .metadata.labels "kubernetesVersion")}}`}}' + {{- if $chartConfig.annotationsApp }} + annotations: + {{- toYaml $chartConfig.annotationsApp | nindent 8 }} + {{- end }} + spec: + project: default + sources: + - repoURL: {{ $repoURLGit | squote}} + targetRevision: {{ $repoURLGitRevision | squote }} + ref: values + {{- if eq (toString $chartConfig.enableAckPodIdentity) "true" }} + {{ include "application-sets.pod-identity" (dict + "chartName" ($chartConfig.chartName | default $nameNormalize) + "valueFiles" $valueFiles + "chartConfig" $chartConfig "values" $values ) | nindent 6 }} + {{- end }} + {{- if $chartConfig.path }} + - repoURL: {{ $repoURLGit | squote }} + path: {{$chartConfig.path | squote }} + targetRevision: {{ $repoURLGitRevision | squote }} + {{- else }} + - repoURL: '{{`{{ .values.addonChartRepository }}`}}' + chart: '{{`{{ .values.chart }}`}}' + targetRevision: '{{`{{.values.addonChartVersion }}`}}' + {{- end }} + {{- if ne (default "" $chartConfig.type) "manifest" }} + helm: + releaseName: {{ default "{{ .values.addonChart }}" $chartConfig.releaseName | squote }} + ignoreMissingValueFiles: true + {{- if $chartConfig.valuesObject }} + valuesObject: + {{- $chartConfig.valuesObject | toYaml | nindent 12 }} + {{- end }} + {{- if $valueFiles }} + valueFiles: + {{- include "application-sets.valueFiles" (dict + "nameNormalize" ($chartConfig.chartName | default $nameNormalize) + "chartConfig" $chartConfig + "valueFiles" $valueFiles "values" $values) | nindent 12 }} + {{- end }} + {{- if $chartConfig.additionalResources}} + {{- include "application-sets.additionalResources" (dict + "chartName" ($chartConfig.chartName | default $nameNormalize) + "valueFiles" $valueFiles + "chartConfig" $chartConfig + "values" $values) | nindent 6 }} + {{- end}} + {{- end }} + destination: + namespace: '{{ $chartConfig.namespace }}' + name: '{{`{{ .name }}`}}' + {{- if $chartConfig.syncPolicy }} + syncPolicy: + {{- toYaml $chartConfig.syncPolicy | nindent 8 }} + {{ else }} + syncPolicy: + {{- toYaml $syncPolicy | nindent 8 }} + {{- end }} + {{- with $chartConfig.ignoreDifferences }} + ignoreDifferences: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if $chartConfig.ignoreDifferences}} + ignoreDifferences: + {{- $chartConfig.ignoreDifferences | toYaml | nindent 8 }} + {{- end }} +--- +{{- end }} +{{- end }} +{{- end }} diff --git a/packages/appset-chart/values.yaml b/packages/appset-chart/values.yaml new file mode 100644 index 000000000..6f9cab836 --- /dev/null +++ b/packages/appset-chart/values.yaml @@ -0,0 +1,32 @@ +valueFiles: + - "values.yaml" + +syncPolicy: + automated: + selfHeal: false + allowEmpty: true + prune: false + retry: + limit: -1 # number of failed sync attempt retries; unlimited number of attempts if less than 0 + backoff: + duration: 5s # the amount to back off. Default unit is seconds, but could also be a duration (e.g. "2m", "1h") + factor: 2 # a factor to multiply the base duration after each failed retry + maxDuration: 10m # the maximum amount of time allowed for the backoff strategy + syncOptions: + - CreateNamespace=true + - ServerSideApply=true # Big CRDs. +syncPolicyAppSet: + preserveResourcesOnDeletion: true +useSelectors: true +repoURLGit: '{{.metadata.annotations.addons_repo_url}}' +repoURLGitRevision: '{{.metadata.annotations.addons_repo_revision}}' +repoURLGitBasePath: '{{.metadata.annotations.addons_repo_basepath}}' +# valueFiles: +# - default/addons +# - clusters/{{.metadata.labels.environment}}/addons +# - clusters/{{.nameNormalized}}/addons +useValuesFilePrefix: false +# valuesFilePrefix: '{{.metadata.labels.tenant}}/' +# ackPodIdentity: +# path: "charts/pod-identity" +#appsetPrefix: "appset-" \ No newline at end of file diff --git a/packages/argocd/dev/appproject-cnoe.yaml b/packages/argo-cd/manifests/appproject-cnoe.yaml similarity index 100% rename from packages/argocd/dev/appproject-cnoe.yaml rename to packages/argo-cd/manifests/appproject-cnoe.yaml diff --git a/packages/argocd/dev/appproject-demo.yaml b/packages/argo-cd/manifests/appproject-demo.yaml similarity index 100% rename from packages/argocd/dev/appproject-demo.yaml rename to packages/argo-cd/manifests/appproject-demo.yaml diff --git a/packages/argo-cd/manifests/argo-cd-github-app.yaml b/packages/argo-cd/manifests/argo-cd-github-app.yaml new file mode 100644 index 000000000..77dcaa871 --- /dev/null +++ b/packages/argo-cd/manifests/argo-cd-github-app.yaml @@ -0,0 +1,53 @@ +# Github App Secret for ArgoCD +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: github-app-org + namespace: argocd +spec: + refreshInterval: "15m" + secretStoreRef: + name: aws-secretsmanager + kind: ClusterSecretStore + target: + name: github-app-org + template: + metadata: + labels: + argocd.argoproj.io/secret-type: repo-creds + data: + type: git + url: '{{ .repoURL }}' + githubAppID: "{{ .appId }}" + githubAppInstallationID: "{{ .installationId }}" + githubAppPrivateKey: "{{ .privateKey }}" + data: + - secretKey: appId + remoteRef: + conversionStrategy: Default # TODO: Remove when figured out how to avoid Diffs for CR defaults + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: argocd-github.appId + - secretKey: installationId + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: argocd-github.installationId + - secretKey: privateKey + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: argocd-github.privateKey + - secretKey: repoURL + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: argocd-github.url \ No newline at end of file diff --git a/packages/argo-cd/manifests/hub-cluster-secret.yaml b/packages/argo-cd/manifests/hub-cluster-secret.yaml new file mode 100644 index 000000000..166e72c43 --- /dev/null +++ b/packages/argo-cd/manifests/hub-cluster-secret.yaml @@ -0,0 +1,88 @@ +# in-cluster ArgoCD cluster Secret for passing metadata to ApplicationSets +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: hub-cluster-secret + namespace: argocd +spec: + refreshInterval: "15m" + secretStoreRef: + name: aws-secretsmanager + kind: ClusterSecretStore + target: + name: hub-cluster + template: + metadata: + labels: + argocd.argoproj.io/secret-type: cluster + clusterClass: "control-plane" + clusterName: '{{ .clusterName }}' + environment: "control-plane" + path_routing: '{{ .pathRouting }}' + auto_mode: '{{ .autoMode }}' + annotations: + route53_hosted_zone_id: '{{ .route53HostedZoneID }}' + addons_repo_url: '{{ .repoURL }}' + addons_repo_revision: '{{ .repoRevision }}' + addons_repo_basepath: '{{ .repoBasePath }}' + domain: '{{ .domain }}' + data: + name: '{{ .clusterName }}' + server: https://kubernetes.default.svc + data: + - secretKey: clusterName + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: cluster_name + - secretKey: pathRouting + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: path_routing + - secretKey: repoURL + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: repo.url + - secretKey: repoRevision + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: repo.revision + - secretKey: repoBasePath + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: repo.basepath + - secretKey: domain + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: domain + - secretKey: autoMode + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: auto_mode + - secretKey: route53HostedZoneID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: route53_hosted_zone_id \ No newline at end of file diff --git a/packages/argo-cd/path-routing/default-cert-external-secret.yaml b/packages/argo-cd/path-routing/default-cert-external-secret.yaml new file mode 100644 index 000000000..e04b45e9e --- /dev/null +++ b/packages/argo-cd/path-routing/default-cert-external-secret.yaml @@ -0,0 +1,33 @@ + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: argocd-server-tls + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + refreshInterval: "0" + secretStoreRef: + name: default-cert + kind: ClusterSecretStore + target: + name: argocd-server-tls + template: + type: kubernetes.io/tls + data: + - secretKey: tls.key + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: default-tls-prod + property: tls.key + - secretKey: tls.crt + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: default-tls-prod + property: tls.crt \ No newline at end of file diff --git a/packages/argo-cd/values.yaml b/packages/argo-cd/values.yaml new file mode 100644 index 000000000..304f52d59 --- /dev/null +++ b/packages/argo-cd/values.yaml @@ -0,0 +1,158 @@ +# Ref: https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd +cnoe_ref_impl: + auto_mode: '"true"' +dex: + enabled: false +server: + ingress: + enabled: true + ingressClassName: "nginx" + tls: true + annotations: + argocd.argoproj.io/sync-wave: "20" +configs: + cm: + accounts.backstage: apiKey + accounts.backstage.enabled: "true" + application.resourceTrackingMethod: annotation + resource.exclusions: | + - kinds: + - ProviderConfigUsage + apiGroups: + - "*" + resource.customizations: | + "awsblueprints.io/*": + health.lua: | + health_status = { + status = "Progressing", + message = "Provisioning ..." + } + + if obj.status == nil or obj.status.conditions == nil then + return health_status + end + + for i, condition in ipairs(obj.status.conditions) do + if condition.type == "Ready" then + if condition.status == "True" then + health_status.status = "Healthy" + health_status.message = "Resource is up-to-date." + return health_status + end + end + + if condition.type == "LastAsyncOperation" then + if condition.status == "False" then + health_status.status = "Degraded" + health_status.message = condition.message + return health_status + end + end + + if condition.type == "Synced" then + if condition.status == "False" then + health_status.status = "Degraded" + health_status.message = condition.message + return health_status + end + end + end + return health_status + "*.aws.upbound.io/*": + health.lua: | + health_status = { + status = "Progressing", + message = "Provisioning ..." + } + + if obj.status == nil or obj.status.conditions == nil then + return health_status + end + + for i, condition in ipairs(obj.status.conditions) do + if condition.type == "Ready" then + if condition.status == "True" then + health_status.status = "Healthy" + health_status.message = "Resource is up-to-date." + return health_status + end + end + + if condition.type == "LastAsyncOperation" then + if condition.status == "False" then + health_status.status = "Degraded" + health_status.message = condition.message + return health_status + end + end + + if condition.type == "Synced" then + if condition.status == "False" then + health_status.status = "Degraded" + health_status.message = condition.message + return health_status + end + end + end + + return health_status + "*.aws.crossplane.io/*": + health.lua: | + health_status = { + status = "Progressing", + message = "Provisioning ..." + } + + if obj.status == nil or obj.status.conditions == nil then + return health_status + end + + for i, condition in ipairs(obj.status.conditions) do + if condition.type == "Ready" then + if condition.status == "True" then + health_status.status = "Healthy" + health_status.message = "Resource is up-to-date." + return health_status + end + end + + if condition.type == "LastAsyncOperation" then + if condition.status == "False" then + health_status.status = "Degraded" + health_status.message = condition.message + return health_status + end + end + + if condition.type == "Synced" then + if condition.status == "False" then + health_status.status = "Degraded" + health_status.message = condition.message + return health_status + end + end + end + return health_status + params: + server.insecure: true + rbac: + policy.csv: | + g, superuser, role:admin + g, backstage, role:readonly + +extraObjects: +- | + # Creates a gp3 storageClass for EBS CSI. + # Sets different provisioner value for EKS Auto Mode based on auto_mode parameter in config file. + apiVersion: storage.k8s.io/v1 + kind: StorageClass + metadata: + name: gp3 + annotations: + storageclass.kubernetes.io/is-default-class: "true" + argocd.argoproj.io/sync-wave: "-10" + provisioner: {{ if eq .Values.cnoe_ref_impl.auto_mode "true"}}ebs.csi.eks.amazonaws.com{{ else }}ebs.csi.aws.com{{ end }} + volumeBindingMode: WaitForFirstConsumer + parameters: + type: gp3 + encrypted: "true" diff --git a/packages/argo-workflows-sso-config/base/kustomization.yaml b/packages/argo-workflows-sso-config/base/kustomization.yaml deleted file mode 100644 index 61d345753..000000000 --- a/packages/argo-workflows-sso-config/base/kustomization.yaml +++ /dev/null @@ -1,3 +0,0 @@ -namespace: argo -resources: - - sa-admin.yaml \ No newline at end of file diff --git a/packages/argo-workflows-sso-config/dev/kustomization.yaml b/packages/argo-workflows-sso-config/dev/kustomization.yaml deleted file mode 100644 index b504b21bb..000000000 --- a/packages/argo-workflows-sso-config/dev/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -namespace: argo -resources: - - ../base/ - \ No newline at end of file diff --git a/packages/argo-workflows/dev/values-no-sso.yaml b/packages/argo-workflows/dev/values-no-sso.yaml deleted file mode 100644 index bd99fa4cc..000000000 --- a/packages/argo-workflows/dev/values-no-sso.yaml +++ /dev/null @@ -1,8 +0,0 @@ -workflow: - serviceAccount: - create: false - rbac: - create: false -server: - extraArgs: - - --auth-mode=client diff --git a/packages/argo-workflows/manifests/external-secrets.yaml b/packages/argo-workflows/manifests/external-secrets.yaml new file mode 100644 index 000000000..9e9cc968c --- /dev/null +++ b/packages/argo-workflows/manifests/external-secrets.yaml @@ -0,0 +1,25 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: keycloak-oidc + namespace: argo + annotations: + argocd.argoproj.io/sync-wave: "-10" +spec: + secretStoreRef: + name: keycloak + kind: ClusterSecretStore + target: + name: keycloak-oidc + template: + data: + ARGO_WORKFLOWS_CLIENT_ID: "argo-workflows" + ARGO_WORKFLOWS_CLIENT_SECRET: '{{ .clientSecret }}' + data: + - secretKey: clientSecret + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: keycloak-clients + property: ARGO_WORKFLOWS_CLIENT_SECRET diff --git a/packages/argo-workflows-sso-config/base/sa-admin.yaml b/packages/argo-workflows/manifests/sa-admin.yaml similarity index 100% rename from packages/argo-workflows-sso-config/base/sa-admin.yaml rename to packages/argo-workflows/manifests/sa-admin.yaml diff --git a/packages/argo-workflows/path-routing/default-cert-external-secret.yaml b/packages/argo-workflows/path-routing/default-cert-external-secret.yaml new file mode 100644 index 000000000..6a0b325a7 --- /dev/null +++ b/packages/argo-workflows/path-routing/default-cert-external-secret.yaml @@ -0,0 +1,33 @@ + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: argo-workflows-server-tls + namespace: argo + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + refreshInterval: "0" + secretStoreRef: + name: default-cert + kind: ClusterSecretStore + target: + name: argo-workflows-server-tls + template: + type: kubernetes.io/tls + data: + - secretKey: tls.key + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: default-tls-prod + property: tls.key + - secretKey: tls.crt + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: default-tls-prod + property: tls.crt \ No newline at end of file diff --git a/packages/argo-workflows/dev/values.yaml b/packages/argo-workflows/values.yaml similarity index 53% rename from packages/argo-workflows/dev/values.yaml rename to packages/argo-workflows/values.yaml index affc327d7..7ca2edcc5 100644 --- a/packages/argo-workflows/dev/values.yaml +++ b/packages/argo-workflows/values.yaml @@ -4,14 +4,18 @@ workflow: rbac: create: false server: + ingress: + enabled: true + ingressClassName: 'nginx' + pathType: ImplementationSpecific sso: enabled: true - clientId: + clientId: # Required for sso configuration name: keycloak-oidc - key: client-id + key: ARGO_WORKFLOWS_CLIENT_ID clientSecret: name: keycloak-oidc - key: secret-key + key: ARGO_WORKFLOWS_CLIENT_SECRET scopes: - openid - profile @@ -21,4 +25,4 @@ server: enabled: true extraArgs: - --auth-mode=client - - --auth-mode=sso + - --auth-mode=sso # Required for sso configuration diff --git a/packages/argocd/base/install.yaml b/packages/argocd/base/install.yaml deleted file mode 100644 index f94da3e72..000000000 --- a/packages/argocd/base/install.yaml +++ /dev/null @@ -1,18234 +0,0 @@ -# This is an auto-generated file. DO NOT EDIT -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - labels: - app.kubernetes.io/name: applications.argoproj.io - app.kubernetes.io/part-of: argocd - name: applications.argoproj.io -spec: - group: argoproj.io - names: - kind: Application - listKind: ApplicationList - plural: applications - shortNames: - - app - - apps - singular: application - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.sync.status - name: Sync Status - type: string - - jsonPath: .status.health.status - name: Health Status - type: string - - jsonPath: .status.sync.revision - name: Revision - priority: 10 - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - description: Application is a definition of Application resource. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - operation: - description: Operation contains information about a requested or running - operation - properties: - info: - description: Info is a list of informational items for this operation - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - initiatedBy: - description: InitiatedBy contains information about who initiated - the operations - properties: - automated: - description: Automated is set to true if operation was initiated - automatically by the application controller. - type: boolean - username: - description: Username contains the name of a user who started - operation - type: string - type: object - retry: - description: Retry controls the strategy to apply if a sync fails - properties: - backoff: - description: Backoff controls how to backoff on subsequent retries - of failed syncs - properties: - duration: - description: Duration is the amount to back off. Default unit - is seconds, but could also be a duration (e.g. "2m", "1h") - type: string - factor: - description: Factor is a factor to multiply the base duration - after each failed retry - format: int64 - type: integer - maxDuration: - description: MaxDuration is the maximum amount of time allowed - for the backoff strategy - type: string - type: object - limit: - description: Limit is the maximum number of attempts for retrying - a failed sync. If set to 0, no retries will be performed. - format: int64 - type: integer - type: object - sync: - description: Sync contains parameters for the operation - properties: - dryRun: - description: DryRun specifies to perform a `kubectl apply --dry-run` - without actually performing the sync - type: boolean - manifests: - description: Manifests is an optional field that overrides sync - source with a local directory for development - items: - type: string - type: array - prune: - description: Prune specifies to delete resources from the cluster - that are no longer tracked in git - type: boolean - resources: - description: Resources describes which resources shall be part - of the sync - items: - description: SyncOperationResource contains resources to sync. - properties: - group: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - type: array - revision: - description: Revision is the revision (Git) or chart version (Helm) - which to sync the application to If omitted, will use the revision - specified in app spec. - type: string - revisions: - description: Revisions is the list of revision (Git) or chart - version (Helm) which to sync each source in sources field for - the application to If omitted, will use the revision specified - in app spec. - items: - type: string - type: array - source: - description: Source overrides the source definition set in the - application. This is typically set in a Rollback operation and - is nil during a Sync operation - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded from - being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included during - manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable to - be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level Arguments - items: - description: JsonnetVar represents a variable to - be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters to the - helm template - items: - description: HelmFileParameter is a file parameter that's - passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally by - not appending them to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters which - are passed to the helm template command upon manifest - generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to tell - Helm to interpret booleans and numbers as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all domains - (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to use. - If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block - type: string - version: - description: Version is the Helm version to use for templating - ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels - to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources for - Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to force - applying common labels to resources for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize image - definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, usually - expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type - parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string type - parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` - tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or - Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the source - to sync the application to. In case of Git, this can be - commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Sources overrides the source definition set in the - application. This is typically set in a Rollback operation and - is nil during a Sync operation - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded from - being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included during - manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters to the - helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally - by not appending them to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to - tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to - use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block - type: string - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels - to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type - parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` - tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or - Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the - source to sync the application to. In case of Git, this - can be commit, tag, or branch. If omitted, will equal - to HEAD. In case of Helm, this is a semver tag for the - Chart's version. - type: string - required: - - repoURL - type: object - type: array - syncOptions: - description: SyncOptions provide per-sync sync-options, e.g. Validate=false - items: - type: string - type: array - syncStrategy: - description: SyncStrategy describes how to perform the sync - properties: - apply: - description: Apply will perform a `kubectl apply` to perform - the sync. - properties: - force: - description: Force indicates whether or not to supply - the --force flag to `kubectl apply`. The --force flag - deletes and re-create the resource, when PATCH encounters - conflict and has retried for 5 times. - type: boolean - type: object - hook: - description: Hook will submit any referenced resources to - perform the sync. This is the default strategy - properties: - force: - description: Force indicates whether or not to supply - the --force flag to `kubectl apply`. The --force flag - deletes and re-create the resource, when PATCH encounters - conflict and has retried for 5 times. - type: boolean - type: object - type: object - type: object - type: object - spec: - description: ApplicationSpec represents desired application state. Contains - link to repository with application definition and additional parameters - link definition revision. - properties: - destination: - description: Destination is a reference to the target Kubernetes server - and namespace - properties: - name: - description: Name is an alternate way of specifying the target - cluster by its symbolic name - type: string - namespace: - description: Namespace specifies the target namespace for the - application's resources. The namespace will only be set for - namespace-scoped resources that have not set a value for .metadata.namespace - type: string - server: - description: Server specifies the URL of the target cluster and - must be set to the Kubernetes control plane API - type: string - type: object - ignoreDifferences: - description: IgnoreDifferences is a list of resources and their fields - which should be ignored during comparison - items: - description: ResourceIgnoreDifferences contains resource filter - and list of json paths which should be ignored during comparison - with live state. - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - description: ManagedFieldsManagers is a list of trusted managers. - Fields mutated by those managers will take precedence over - the desired state defined in the SCM and won't be displayed - in diffs - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - description: Info contains a list of information (URLs, email addresses, - and plain text) that relates to the application - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - description: Project is a reference to the project this application - belongs to. The empty string means that application belongs to the - 'default' project. - type: string - revisionHistoryLimit: - description: RevisionHistoryLimit limits the number of items kept - in the application's revision history, which is used for informational - purposes as well as for rollbacks to previous versions. This should - only be changed in exceptional circumstances. Setting to zero will - store no history. This will reduce storage used. Increasing will - increase the space used to store the history, so we do not recommend - increasing it. Default is 10. - format: int64 - type: integer - source: - description: Source is a reference to the location of the application's - manifests or chart - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match paths - against that should be explicitly excluded from being used - during manifest generation - type: string - include: - description: Include contains a glob pattern to match paths - against that should be explicitly included during manifest - generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External Variables - items: - description: JsonnetVar represents a variable to be - passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level Arguments - items: - description: JsonnetVar represents a variable to be - passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters to the helm - template - items: - description: HelmFileParameter is a file parameter that's - passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally by not - appending them to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters which - are passed to the helm template command upon manifest generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to tell - Helm to interpret booleans and numbers as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all domains - (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to use. - If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition installation - step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files to - use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed to - helm template, typically defined as a block - type: string - version: - description: Version is the Helm version to use for templating - ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional annotations - to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether to - apply env variables substitution for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels to - add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether to force - applying common annotations to resources for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to force - applying common labels to resources for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize image - definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize adds - to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas override - specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize to - use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, usually - expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or Helm) - that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the source - to sync the application to. In case of Git, this can be commit, - tag, or branch. If omitted, will equal to HEAD. In case of Helm, - this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Sources is a reference to the location of the application's - manifests or chart - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match paths - against that should be explicitly excluded from being - used during manifest generation - type: string - include: - description: Include contains a glob pattern to match paths - against that should be explicitly included during manifest - generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External Variables - items: - description: JsonnetVar represents a variable to be - passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level Arguments - items: - description: JsonnetVar represents a variable to be - passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters to the helm - template - items: - description: HelmFileParameter is a file parameter that's - passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally by not - appending them to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters which - are passed to the helm template command upon manifest - generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to tell - Helm to interpret booleans and numbers as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all domains - (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to use. - If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition installation - step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files to - use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed to - helm template, typically defined as a block - type: string - version: - description: Version is the Helm version to use for templating - ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional annotations - to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels - to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether to - force applying common annotations to resources for Kustomize - apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to force - applying common labels to resources for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize image - definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas override - specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, usually - expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string type - parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` - tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or Helm) - that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the source - to sync the application to. In case of Git, this can be commit, - tag, or branch. If omitted, will equal to HEAD. In case of - Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - description: SyncPolicy controls when and how a sync will be performed - properties: - automated: - description: Automated will keep an application synced to the - target revision - properties: - allowEmpty: - description: 'AllowEmpty allows apps have zero live resources - (default: false)' - type: boolean - prune: - description: 'Prune specifies whether to delete resources - from the cluster that are not found in the sources anymore - as part of automated sync (default: false)' - type: boolean - selfHeal: - description: 'SelfHeal specifes whether to revert resources - back to their desired state upon modification in the cluster - (default: false)' - type: boolean - type: object - managedNamespaceMetadata: - description: ManagedNamespaceMetadata controls metadata in the - given namespace (if CreateNamespace=true) - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - description: Retry controls failed sync retry behavior - properties: - backoff: - description: Backoff controls how to backoff on subsequent - retries of failed syncs - properties: - duration: - description: Duration is the amount to back off. Default - unit is seconds, but could also be a duration (e.g. - "2m", "1h") - type: string - factor: - description: Factor is a factor to multiply the base duration - after each failed retry - format: int64 - type: integer - maxDuration: - description: MaxDuration is the maximum amount of time - allowed for the backoff strategy - type: string - type: object - limit: - description: Limit is the maximum number of attempts for retrying - a failed sync. If set to 0, no retries will be performed. - format: int64 - type: integer - type: object - syncOptions: - description: Options allow you to specify whole app sync-options - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - status: - description: ApplicationStatus contains status information for the application - properties: - conditions: - description: Conditions is a list of currently observed application - conditions - items: - description: ApplicationCondition contains details about an application - condition, which is usally an error or warning - properties: - lastTransitionTime: - description: LastTransitionTime is the time the condition was - last observed - format: date-time - type: string - message: - description: Message contains human-readable message indicating - details about condition - type: string - type: - description: Type is an application condition type - type: string - required: - - message - - type - type: object - type: array - health: - description: Health contains information about the application's current - health status - properties: - message: - description: Message is a human-readable informational message - describing the health status - type: string - status: - description: Status holds the status code of the application or - resource - type: string - type: object - history: - description: History contains information about the application's - sync history - items: - description: RevisionHistory contains history information about - a previous sync - properties: - deployStartedAt: - description: DeployStartedAt holds the time the sync operation - started - format: date-time - type: string - deployedAt: - description: DeployedAt holds the time the sync operation completed - format: date-time - type: string - id: - description: ID is an auto incrementing identifier of the RevisionHistory - format: int64 - type: integer - revision: - description: Revision holds the revision the sync was performed - against - type: string - revisions: - description: Revisions holds the revision of each source in - sources field the sync was performed against - items: - type: string - type: array - source: - description: Source is a reference to the application source - used for the sync operation - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded from - being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included during - manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters to the - helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally - by not appending them to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to - tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to - use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block - type: string - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels - to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type - parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` - tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or - Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the - source to sync the application to. In case of Git, this - can be commit, tag, or branch. If omitted, will equal - to HEAD. In case of Helm, this is a semver tag for the - Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Sources is a reference to the application sources - used for the sync operation - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded - from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included - during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters to - the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block - type: string - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying a - parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used with - a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the - source to sync the application to. In case of Git, this - can be commit, tag, or branch. If omitted, will equal - to HEAD. In case of Helm, this is a semver tag for the - Chart's version. - type: string - required: - - repoURL - type: object - type: array - required: - - deployedAt - - id - type: object - type: array - observedAt: - description: 'ObservedAt indicates when the application state was - updated without querying latest git state Deprecated: controller - no longer updates ObservedAt field' - format: date-time - type: string - operationState: - description: OperationState contains information about any ongoing - operations, such as a sync - properties: - finishedAt: - description: FinishedAt contains time of operation completion - format: date-time - type: string - message: - description: Message holds any pertinent messages when attempting - to perform operation (typically errors). - type: string - operation: - description: Operation is the original requested operation - properties: - info: - description: Info is a list of informational items for this - operation - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - initiatedBy: - description: InitiatedBy contains information about who initiated - the operations - properties: - automated: - description: Automated is set to true if operation was - initiated automatically by the application controller. - type: boolean - username: - description: Username contains the name of a user who - started operation - type: string - type: object - retry: - description: Retry controls the strategy to apply if a sync - fails - properties: - backoff: - description: Backoff controls how to backoff on subsequent - retries of failed syncs - properties: - duration: - description: Duration is the amount to back off. Default - unit is seconds, but could also be a duration (e.g. - "2m", "1h") - type: string - factor: - description: Factor is a factor to multiply the base - duration after each failed retry - format: int64 - type: integer - maxDuration: - description: MaxDuration is the maximum amount of - time allowed for the backoff strategy - type: string - type: object - limit: - description: Limit is the maximum number of attempts for - retrying a failed sync. If set to 0, no retries will - be performed. - format: int64 - type: integer - type: object - sync: - description: Sync contains parameters for the operation - properties: - dryRun: - description: DryRun specifies to perform a `kubectl apply - --dry-run` without actually performing the sync - type: boolean - manifests: - description: Manifests is an optional field that overrides - sync source with a local directory for development - items: - type: string - type: array - prune: - description: Prune specifies to delete resources from - the cluster that are no longer tracked in git - type: boolean - resources: - description: Resources describes which resources shall - be part of the sync - items: - description: SyncOperationResource contains resources - to sync. - properties: - group: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - type: array - revision: - description: Revision is the revision (Git) or chart version - (Helm) which to sync the application to If omitted, - will use the revision specified in app spec. - type: string - revisions: - description: Revisions is the list of revision (Git) or - chart version (Helm) which to sync each source in sources - field for the application to If omitted, will use the - revision specified in app spec. - items: - type: string - type: array - source: - description: Source overrides the source definition set - in the application. This is typically set in a Rollback - operation and is nil during a Sync operation - properties: - chart: - description: Chart is a Helm chart name, and must - be specified for applications sourced from a Helm - repo. - type: string - directory: - description: Directory holds path/directory specific - options - properties: - exclude: - description: Exclude contains a glob pattern to - match paths against that should be explicitly - excluded from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to - match paths against that should be explicitly - included during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to - Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet - External Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan - a directory recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters - to the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm - parameter - type: string - path: - description: Path is the path to the file - containing the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents - helm template from failing when valueFiles do - not exist locally by not appending them to helm - template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command - upon manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and - numbers as strings - type: boolean - name: - description: Name is the name of the Helm - parameter - type: string - value: - description: Value is the value for the - Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials - to all domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application - name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value - files to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be - passed to helm template, typically defined as - a block - type: string - version: - description: Version is the Helm version to use - for templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies - whether to apply env variables substitution - for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies - whether to force applying common annotations - to resources for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether - to force applying common labels to resources - for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image - override specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that - Kustomize adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of - Kustomize to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git - repository, and is only valid for applications sourced - from Git. - type: string - plugin: - description: Plugin holds config management plugin - specific options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in - the application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying - a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used - with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository - (Git or Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of - the source to sync the application to. In case of - Git, this can be commit, tag, or branch. If omitted, - will equal to HEAD. In case of Helm, this is a semver - tag for the Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Sources overrides the source definition set - in the application. This is typically set in a Rollback - operation and is nil during a Sync operation - items: - description: ApplicationSource contains all required - information about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must - be specified for applications sourced from a Helm - repo. - type: string - directory: - description: Directory holds path/directory specific - options - properties: - exclude: - description: Exclude contains a glob pattern - to match paths against that should be explicitly - excluded from being used during manifest generation - type: string - include: - description: Include contains a glob pattern - to match paths against that should be explicitly - included during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific - to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet - External Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan - a directory recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters - to the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm - parameter - type: string - path: - description: Path is the path to the file - containing the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents - helm template from failing when valueFiles - do not exist locally by not appending them - to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command - upon manifest generation - items: - description: HelmParameter is a parameter - that's passed to helm template during manifest - generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and - numbers as strings - type: boolean - name: - description: Name is the name of the Helm - parameter - type: string - value: - description: Value is the value for the - Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials - to all domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release - name to use. If omitted it will use the application - name - type: string - skipCrds: - description: SkipCrds skips custom resource - definition installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value - files to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to - be passed to helm template, typically defined - as a block - type: string - version: - description: Version is the Helm version to - use for templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific - options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of - additional annotations to add to rendered - manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies - whether to apply env variables substitution - for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies - whether to force applying common annotations - to resources for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether - to force applying common labels to resources - for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image - override specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended - to resources for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended - to resources for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that - Kustomize adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize - Replicas override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version - of Kustomize to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the - Git repository, and is only valid for applications - sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin - specific options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry - in the application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the - variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an - array type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map - type parameter. - type: object - name: - description: Name is the name identifying - a parameter. - type: string - string: - description: String_ is the value of a - string type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source - within sources field. This field will not be used - if used with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository - (Git or Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision - of the source to sync the application to. In case - of Git, this can be commit, tag, or branch. If - omitted, will equal to HEAD. In case of Helm, - this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - syncOptions: - description: SyncOptions provide per-sync sync-options, - e.g. Validate=false - items: - type: string - type: array - syncStrategy: - description: SyncStrategy describes how to perform the - sync - properties: - apply: - description: Apply will perform a `kubectl apply` - to perform the sync. - properties: - force: - description: Force indicates whether or not to - supply the --force flag to `kubectl apply`. - The --force flag deletes and re-create the resource, - when PATCH encounters conflict and has retried - for 5 times. - type: boolean - type: object - hook: - description: Hook will submit any referenced resources - to perform the sync. This is the default strategy - properties: - force: - description: Force indicates whether or not to - supply the --force flag to `kubectl apply`. - The --force flag deletes and re-create the resource, - when PATCH encounters conflict and has retried - for 5 times. - type: boolean - type: object - type: object - type: object - type: object - phase: - description: Phase is the current phase of the operation - type: string - retryCount: - description: RetryCount contains time of operation retries - format: int64 - type: integer - startedAt: - description: StartedAt contains time of operation start - format: date-time - type: string - syncResult: - description: SyncResult is the result of a Sync operation - properties: - resources: - description: Resources contains a list of sync result items - for each individual resource in a sync operation - items: - description: ResourceResult holds the operation result details - of a specific resource - properties: - group: - description: Group specifies the API group of the resource - type: string - hookPhase: - description: HookPhase contains the state of any operation - associated with this resource OR hook This can also - contain values for non-hook resources. - type: string - hookType: - description: HookType specifies the type of the hook. - Empty for non-hook resources - type: string - kind: - description: Kind specifies the API kind of the resource - type: string - message: - description: Message contains an informational or error - message for the last sync OR operation - type: string - name: - description: Name specifies the name of the resource - type: string - namespace: - description: Namespace specifies the target namespace - of the resource - type: string - status: - description: Status holds the final result of the sync. - Will be empty if the resources is yet to be applied/pruned - and is always zero-value for hooks - type: string - syncPhase: - description: SyncPhase indicates the particular phase - of the sync that this result was acquired in - type: string - version: - description: Version specifies the API version of the - resource - type: string - required: - - group - - kind - - name - - namespace - - version - type: object - type: array - revision: - description: Revision holds the revision this sync operation - was performed to - type: string - revisions: - description: Revisions holds the revision this sync operation - was performed for respective indexed source in sources field - items: - type: string - type: array - source: - description: Source records the application source information - of the sync, used for comparing auto-sync - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded - from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included - during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters to - the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block - type: string - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying a - parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used with - a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the - source to sync the application to. In case of Git, this - can be commit, tag, or branch. If omitted, will equal - to HEAD. In case of Helm, this is a semver tag for the - Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Source records the application source information - of the sync, used for comparing auto-sync - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be - specified for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific - options - properties: - exclude: - description: Exclude contains a glob pattern to - match paths against that should be explicitly - excluded from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to - match paths against that should be explicitly - included during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a - directory recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters - to the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm - parameter - type: string - path: - description: Path is the path to the file - containing the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template - --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command - upon manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm - parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to - all domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application - name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value - files to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be - passed to helm template, typically defined as - a block - type: string - version: - description: Version is the Helm version to use - for templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies - whether to apply env variables substitution for - annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether - to force applying common labels to resources for - Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image - override specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git - repository, and is only valid for applications sourced - from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying - a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used - with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of - the source to sync the application to. In case of - Git, this can be commit, tag, or branch. If omitted, - will equal to HEAD. In case of Helm, this is a semver - tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - required: - - revision - type: object - required: - - operation - - phase - - startedAt - type: object - reconciledAt: - description: ReconciledAt indicates when the application state was - reconciled using the latest git version - format: date-time - type: string - resourceHealthSource: - description: 'ResourceHealthSource indicates where the resource health - status is stored: inline if not set or appTree' - type: string - resources: - description: Resources is a list of Kubernetes resources managed by - this application - items: - description: 'ResourceStatus holds the current sync and health status - of a resource TODO: describe members of this type' - properties: - group: - type: string - health: - description: HealthStatus contains information about the currently - observed health state of an application or resource - properties: - message: - description: Message is a human-readable informational message - describing the health status - type: string - status: - description: Status holds the status code of the application - or resource - type: string - type: object - hook: - type: boolean - kind: - type: string - name: - type: string - namespace: - type: string - requiresPruning: - type: boolean - status: - description: SyncStatusCode is a type which represents possible - comparison results - type: string - syncWave: - format: int64 - type: integer - version: - type: string - type: object - type: array - sourceType: - description: SourceType specifies the type of this application - type: string - sourceTypes: - description: SourceTypes specifies the type of the sources included - in the application - items: - description: ApplicationSourceType specifies the type of the application's - source - type: string - type: array - summary: - description: Summary contains a list of URLs and container images - used by this application - properties: - externalURLs: - description: ExternalURLs holds all external URLs of application - child resources. - items: - type: string - type: array - images: - description: Images holds all images of application child resources. - items: - type: string - type: array - type: object - sync: - description: Sync contains information about the application's current - sync status - properties: - comparedTo: - description: ComparedTo contains information about what has been - compared - properties: - destination: - description: Destination is a reference to the application's - destination used for comparison - properties: - name: - description: Name is an alternate way of specifying the - target cluster by its symbolic name - type: string - namespace: - description: Namespace specifies the target namespace - for the application's resources. The namespace will - only be set for namespace-scoped resources that have - not set a value for .metadata.namespace - type: string - server: - description: Server specifies the URL of the target cluster - and must be set to the Kubernetes control plane API - type: string - type: object - source: - description: Source is a reference to the application's source - used for comparison - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded - from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included - during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters to - the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block - type: string - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying a - parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used with - a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the - source to sync the application to. In case of Git, this - can be commit, tag, or branch. If omitted, will equal - to HEAD. In case of Helm, this is a semver tag for the - Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Sources is a reference to the application's multiple - sources used for comparison - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be - specified for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific - options - properties: - exclude: - description: Exclude contains a glob pattern to - match paths against that should be explicitly - excluded from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to - match paths against that should be explicitly - included during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a - directory recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - fileParameters: - description: FileParameters are file parameters - to the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm - parameter - type: string - path: - description: Path is the path to the file - containing the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template - --values - type: boolean - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command - upon manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm - parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to - all domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application - name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value - files to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be - passed to helm template, typically defined as - a block - type: string - version: - description: Version is the Helm version to use - for templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies - whether to apply env variables substitution for - annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether - to force applying common labels to resources for - Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image - override specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - path: - description: Path is a directory path within the Git - repository, and is only valid for applications sourced - from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying - a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used - with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of - the source to sync the application to. In case of - Git, this can be commit, tag, or branch. If omitted, - will equal to HEAD. In case of Helm, this is a semver - tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - required: - - destination - type: object - revision: - description: Revision contains information about the revision - the comparison has been performed to - type: string - revisions: - description: Revisions contains information about the revisions - of multiple sources the comparison has been performed to - items: - type: string - type: array - status: - description: Status is the sync state of the comparison - type: string - required: - - status - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true - subresources: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - labels: - app.kubernetes.io/name: applicationsets.argoproj.io - app.kubernetes.io/part-of: argocd - name: applicationsets.argoproj.io -spec: - group: argoproj.io - names: - kind: ApplicationSet - listKind: ApplicationSetList - plural: applicationsets - shortNames: - - appset - - appsets - singular: applicationset - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - generators: - items: - properties: - clusterDecisionResource: - properties: - configMapRef: - type: string - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - name: - type: string - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - clusters: - properties: - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - git: - properties: - directories: - items: - properties: - exclude: - type: boolean - path: - type: string - required: - - path - type: object - type: array - files: - items: - properties: - path: - type: string - required: - - path - type: object - type: array - pathParamPrefix: - type: string - repoURL: - type: string - requeueAfterSeconds: - format: int64 - type: integer - revision: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - repoURL - - revision - type: object - list: - properties: - elements: - items: - x-kubernetes-preserve-unknown-fields: true - type: array - elementsYaml: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - elements - type: object - matrix: - properties: - generators: - items: - properties: - clusterDecisionResource: - properties: - configMapRef: - type: string - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - name: - type: string - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - clusters: - properties: - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - git: - properties: - directories: - items: - properties: - exclude: - type: boolean - path: - type: string - required: - - path - type: object - type: array - files: - items: - properties: - path: - type: string - required: - - path - type: object - type: array - pathParamPrefix: - type: string - repoURL: - type: string - requeueAfterSeconds: - format: int64 - type: integer - revision: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - repoURL - - revision - type: object - list: - properties: - elements: - items: - x-kubernetes-preserve-unknown-fields: true - type: array - elementsYaml: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - elements - type: object - matrix: - x-kubernetes-preserve-unknown-fields: true - merge: - x-kubernetes-preserve-unknown-fields: true - pullRequest: - properties: - bitbucketServer: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - project: - type: string - repo: - type: string - required: - - api - - project - - repo - type: object - filters: - items: - properties: - branchMatch: - type: string - type: object - type: array - gitea: - properties: - api: - type: string - insecure: - type: boolean - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - - repo - type: object - github: - properties: - api: - type: string - appSecretName: - type: string - labels: - items: - type: string - type: array - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - owner - - repo - type: object - gitlab: - properties: - api: - type: string - labels: - items: - type: string - type: array - project: - type: string - pullRequestState: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - project - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - scmProvider: - properties: - azureDevOps: - properties: - accessTokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - allBranches: - type: boolean - api: - type: string - organization: - type: string - teamProject: - type: string - required: - - accessTokenRef - - organization - - teamProject - type: object - bitbucket: - properties: - allBranches: - type: boolean - appPasswordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - owner: - type: string - user: - type: string - required: - - appPasswordRef - - owner - - user - type: object - bitbucketServer: - properties: - allBranches: - type: boolean - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - project: - type: string - required: - - api - - project - type: object - cloneProtocol: - type: string - filters: - items: - properties: - branchMatch: - type: string - labelMatch: - type: string - pathsDoNotExist: - items: - type: string - type: array - pathsExist: - items: - type: string - type: array - repositoryMatch: - type: string - type: object - type: array - gitea: - properties: - allBranches: - type: boolean - api: - type: string - insecure: - type: boolean - owner: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - type: object - github: - properties: - allBranches: - type: boolean - api: - type: string - appSecretName: - type: string - organization: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - type: object - gitlab: - properties: - allBranches: - type: boolean - api: - type: string - group: - type: string - includeSubgroups: - type: boolean - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - group - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - type: object - type: array - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - generators - type: object - merge: - properties: - generators: - items: - properties: - clusterDecisionResource: - properties: - configMapRef: - type: string - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - name: - type: string - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - clusters: - properties: - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - git: - properties: - directories: - items: - properties: - exclude: - type: boolean - path: - type: string - required: - - path - type: object - type: array - files: - items: - properties: - path: - type: string - required: - - path - type: object - type: array - pathParamPrefix: - type: string - repoURL: - type: string - requeueAfterSeconds: - format: int64 - type: integer - revision: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - repoURL - - revision - type: object - list: - properties: - elements: - items: - x-kubernetes-preserve-unknown-fields: true - type: array - elementsYaml: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - elements - type: object - matrix: - x-kubernetes-preserve-unknown-fields: true - merge: - x-kubernetes-preserve-unknown-fields: true - pullRequest: - properties: - bitbucketServer: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - project: - type: string - repo: - type: string - required: - - api - - project - - repo - type: object - filters: - items: - properties: - branchMatch: - type: string - type: object - type: array - gitea: - properties: - api: - type: string - insecure: - type: boolean - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - - repo - type: object - github: - properties: - api: - type: string - appSecretName: - type: string - labels: - items: - type: string - type: array - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - owner - - repo - type: object - gitlab: - properties: - api: - type: string - labels: - items: - type: string - type: array - project: - type: string - pullRequestState: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - project - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - scmProvider: - properties: - azureDevOps: - properties: - accessTokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - allBranches: - type: boolean - api: - type: string - organization: - type: string - teamProject: - type: string - required: - - accessTokenRef - - organization - - teamProject - type: object - bitbucket: - properties: - allBranches: - type: boolean - appPasswordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - owner: - type: string - user: - type: string - required: - - appPasswordRef - - owner - - user - type: object - bitbucketServer: - properties: - allBranches: - type: boolean - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - project: - type: string - required: - - api - - project - type: object - cloneProtocol: - type: string - filters: - items: - properties: - branchMatch: - type: string - labelMatch: - type: string - pathsDoNotExist: - items: - type: string - type: array - pathsExist: - items: - type: string - type: array - repositoryMatch: - type: string - type: object - type: array - gitea: - properties: - allBranches: - type: boolean - api: - type: string - insecure: - type: boolean - owner: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - type: object - github: - properties: - allBranches: - type: boolean - api: - type: string - appSecretName: - type: string - organization: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - type: object - gitlab: - properties: - allBranches: - type: boolean - api: - type: string - group: - type: string - includeSubgroups: - type: boolean - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - group - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - type: object - type: array - mergeKeys: - items: - type: string - type: array - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - generators - - mergeKeys - type: object - pullRequest: - properties: - bitbucketServer: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - project: - type: string - repo: - type: string - required: - - api - - project - - repo - type: object - filters: - items: - properties: - branchMatch: - type: string - type: object - type: array - gitea: - properties: - api: - type: string - insecure: - type: boolean - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - - repo - type: object - github: - properties: - api: - type: string - appSecretName: - type: string - labels: - items: - type: string - type: array - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - owner - - repo - type: object - gitlab: - properties: - api: - type: string - labels: - items: - type: string - type: array - project: - type: string - pullRequestState: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - project - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - scmProvider: - properties: - azureDevOps: - properties: - accessTokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - allBranches: - type: boolean - api: - type: string - organization: - type: string - teamProject: - type: string - required: - - accessTokenRef - - organization - - teamProject - type: object - bitbucket: - properties: - allBranches: - type: boolean - appPasswordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - owner: - type: string - user: - type: string - required: - - appPasswordRef - - owner - - user - type: object - bitbucketServer: - properties: - allBranches: - type: boolean - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - project: - type: string - required: - - api - - project - type: object - cloneProtocol: - type: string - filters: - items: - properties: - branchMatch: - type: string - labelMatch: - type: string - pathsDoNotExist: - items: - type: string - type: array - pathsExist: - items: - type: string - type: array - repositoryMatch: - type: string - type: object - type: array - gitea: - properties: - allBranches: - type: boolean - api: - type: string - insecure: - type: boolean - owner: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - type: object - github: - properties: - allBranches: - type: boolean - api: - type: string - appSecretName: - type: string - organization: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - type: object - gitlab: - properties: - allBranches: - type: boolean - api: - type: string - group: - type: string - includeSubgroups: - type: boolean - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - group - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - type: object - type: object - type: object - type: array - goTemplate: - type: boolean - preservedFields: - properties: - annotations: - items: - type: string - type: array - type: object - strategy: - properties: - rollingSync: - properties: - steps: - items: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - type: object - type: array - maxUpdate: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - type: array - type: object - type: - type: string - type: object - syncPolicy: - properties: - preserveResourcesOnDeletion: - type: boolean - type: object - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - version: - type: string - type: object - kustomize: - properties: - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - generators - - template - type: object - status: - properties: - applicationStatus: - items: - properties: - application: - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - status: - type: string - step: - type: string - required: - - application - - message - - status - - step - type: object - type: array - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - message - - reason - - status - - type - type: object - type: array - type: object - required: - - metadata - - spec - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - labels: - app.kubernetes.io/name: appprojects.argoproj.io - app.kubernetes.io/part-of: argocd - name: appprojects.argoproj.io -spec: - group: argoproj.io - names: - kind: AppProject - listKind: AppProjectList - plural: appprojects - shortNames: - - appproj - - appprojs - singular: appproject - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: 'AppProject provides a logical grouping of applications, providing - controls for: * where the apps may deploy to (cluster whitelist) * what - may be deployed (repository whitelist, resource whitelist/blacklist) * who - can access these applications (roles, OIDC group claims bindings) * and - what they can do (RBAC policies) * automation access to these roles (JWT - tokens)' - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: AppProjectSpec is the specification of an AppProject - properties: - clusterResourceBlacklist: - description: ClusterResourceBlacklist contains list of blacklisted - cluster level resources - items: - description: GroupKind specifies a Group and a Kind, but does not - force a version. This is useful for identifying concepts during - lookup stages without having partially valid types - properties: - group: - type: string - kind: - type: string - required: - - group - - kind - type: object - type: array - clusterResourceWhitelist: - description: ClusterResourceWhitelist contains list of whitelisted - cluster level resources - items: - description: GroupKind specifies a Group and a Kind, but does not - force a version. This is useful for identifying concepts during - lookup stages without having partially valid types - properties: - group: - type: string - kind: - type: string - required: - - group - - kind - type: object - type: array - description: - description: Description contains optional project description - type: string - destinations: - description: Destinations contains list of destinations available - for deployment - items: - description: ApplicationDestination holds information about the - application's destination - properties: - name: - description: Name is an alternate way of specifying the target - cluster by its symbolic name - type: string - namespace: - description: Namespace specifies the target namespace for the - application's resources. The namespace will only be set for - namespace-scoped resources that have not set a value for .metadata.namespace - type: string - server: - description: Server specifies the URL of the target cluster - and must be set to the Kubernetes control plane API - type: string - type: object - type: array - namespaceResourceBlacklist: - description: NamespaceResourceBlacklist contains list of blacklisted - namespace level resources - items: - description: GroupKind specifies a Group and a Kind, but does not - force a version. This is useful for identifying concepts during - lookup stages without having partially valid types - properties: - group: - type: string - kind: - type: string - required: - - group - - kind - type: object - type: array - namespaceResourceWhitelist: - description: NamespaceResourceWhitelist contains list of whitelisted - namespace level resources - items: - description: GroupKind specifies a Group and a Kind, but does not - force a version. This is useful for identifying concepts during - lookup stages without having partially valid types - properties: - group: - type: string - kind: - type: string - required: - - group - - kind - type: object - type: array - orphanedResources: - description: OrphanedResources specifies if controller should monitor - orphaned resources of apps in this project - properties: - ignore: - description: Ignore contains a list of resources that are to be - excluded from orphaned resources monitoring - items: - description: OrphanedResourceKey is a reference to a resource - to be ignored from - properties: - group: - type: string - kind: - type: string - name: - type: string - type: object - type: array - warn: - description: Warn indicates if warning condition should be created - for apps which have orphaned resources - type: boolean - type: object - permitOnlyProjectScopedClusters: - description: PermitOnlyProjectScopedClusters determines whether destinations - can only reference clusters which are project-scoped - type: boolean - roles: - description: Roles are user defined RBAC roles associated with this - project - items: - description: ProjectRole represents a role that has access to a - project - properties: - description: - description: Description is a description of the role - type: string - groups: - description: Groups are a list of OIDC group claims bound to - this role - items: - type: string - type: array - jwtTokens: - description: JWTTokens are a list of generated JWT tokens bound - to this role - items: - description: JWTToken holds the issuedAt and expiresAt values - of a token - properties: - exp: - format: int64 - type: integer - iat: - format: int64 - type: integer - id: - type: string - required: - - iat - type: object - type: array - name: - description: Name is a name for this role - type: string - policies: - description: Policies Stores a list of casbin formatted strings - that define access policies for the role in the project - items: - type: string - type: array - required: - - name - type: object - type: array - signatureKeys: - description: SignatureKeys contains a list of PGP key IDs that commits - in Git must be signed with in order to be allowed for sync - items: - description: SignatureKey is the specification of a key required - to verify commit signatures with - properties: - keyID: - description: The ID of the key in hexadecimal notation - type: string - required: - - keyID - type: object - type: array - sourceNamespaces: - description: SourceNamespaces defines the namespaces application resources - are allowed to be created in - items: - type: string - type: array - sourceRepos: - description: SourceRepos contains list of repository URLs which can - be used for deployment - items: - type: string - type: array - syncWindows: - description: SyncWindows controls when syncs can be run for apps in - this project - items: - description: SyncWindow contains the kind, time, duration and attributes - that are used to assign the syncWindows to apps - properties: - applications: - description: Applications contains a list of applications that - the window will apply to - items: - type: string - type: array - clusters: - description: Clusters contains a list of clusters that the window - will apply to - items: - type: string - type: array - duration: - description: Duration is the amount of time the sync window - will be open - type: string - kind: - description: Kind defines if the window allows or blocks syncs - type: string - manualSync: - description: ManualSync enables manual syncs when they would - otherwise be blocked - type: boolean - namespaces: - description: Namespaces contains a list of namespaces that the - window will apply to - items: - type: string - type: array - schedule: - description: Schedule is the time the window will begin, specified - in cron format - type: string - timeZone: - description: TimeZone of the sync that will be applied to the - schedule - type: string - type: object - type: array - type: object - status: - description: AppProjectStatus contains status information for AppProject - CRs - properties: - jwtTokensByRole: - additionalProperties: - description: JWTTokens represents a list of JWT tokens - properties: - items: - items: - description: JWTToken holds the issuedAt and expiresAt values - of a token - properties: - exp: - format: int64 - type: integer - iat: - format: int64 - type: integer - id: - type: string - required: - - iat - type: object - type: array - type: object - description: JWTTokensByRole contains a list of JWT tokens issued - for a given role - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/component: repo-server - app.kubernetes.io/name: argocd-repo-server - app.kubernetes.io/part-of: argocd - name: argocd-repo-server ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller -rules: -- apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - get - - list - - watch -- apiGroups: - - argoproj.io - resources: - - applications - - appprojects - verbs: - - create - - get - - list - - watch - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller -rules: -- apiGroups: - - argoproj.io - resources: - - applications - - applicationsets - - applicationsets/finalizers - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - argoproj.io - resources: - - appprojects - verbs: - - get -- apiGroups: - - argoproj.io - resources: - - applicationsets/status - verbs: - - get - - patch - - update -- apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - watch -- apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - get - - list - - watch -- apiGroups: - - apps - - extensions - resources: - - deployments - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server -rules: -- apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller -rules: -- apiGroups: - - argoproj.io - resources: - - applications - - appprojects - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - "" - resources: - - configmaps - - secrets - verbs: - - list - - watch -- apiGroups: - - "" - resourceNames: - - argocd-notifications-cm - resources: - - configmaps - verbs: - - get -- apiGroups: - - "" - resourceNames: - - argocd-notifications-secret - resources: - - secrets - verbs: - - get ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server -rules: -- apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - create - - get - - list - - watch - - update - - patch - - delete -- apiGroups: - - argoproj.io - resources: - - applications - - appprojects - - applicationsets - verbs: - - create - - get - - list - - watch - - update - - delete - - patch -- apiGroups: - - "" - resources: - - events - verbs: - - create - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller -rules: -- apiGroups: - - '*' - resources: - - '*' - verbs: - - '*' -- nonResourceURLs: - - '*' - verbs: - - '*' ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server -rules: -- apiGroups: - - '*' - resources: - - '*' - verbs: - - delete - - get - - patch -- apiGroups: - - "" - resources: - - events - verbs: - - list -- apiGroups: - - "" - resources: - - pods - - pods/log - verbs: - - get -- apiGroups: - - argoproj.io - resources: - - applications - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-application-controller -subjects: -- kind: ServiceAccount - name: argocd-application-controller ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-applicationset-controller -subjects: -- kind: ServiceAccount - name: argocd-applicationset-controller ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-dex-server -subjects: -- kind: ServiceAccount - name: argocd-dex-server ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-notifications-controller -subjects: -- kind: ServiceAccount - name: argocd-notifications-controller ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-redis -subjects: -- kind: ServiceAccount - name: argocd-redis ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-server -subjects: -- kind: ServiceAccount - name: argocd-server ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: argocd-application-controller -subjects: -- kind: ServiceAccount - name: argocd-application-controller - namespace: argocd ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: argocd-server -subjects: -- kind: ServiceAccount - name: argocd-server - namespace: argocd ---- -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/name: argocd-cm - app.kubernetes.io/part-of: argocd - name: argocd-cm ---- -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/name: argocd-cmd-params-cm - app.kubernetes.io/part-of: argocd - name: argocd-cmd-params-cm ---- -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/name: argocd-gpg-keys-cm - app.kubernetes.io/part-of: argocd - name: argocd-gpg-keys-cm ---- -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-cm ---- -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/name: argocd-rbac-cm - app.kubernetes.io/part-of: argocd - name: argocd-rbac-cm ---- -apiVersion: v1 -data: - ssh_known_hosts: | - # This file was automatically generated by hack/update-ssh-known-hosts.sh. DO NOT EDIT - [ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= - [ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl - [ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= - bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE= - bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO - bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw== - github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= - github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl - github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= - gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY= - gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf - gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9 - ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H - vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/name: argocd-ssh-known-hosts-cm - app.kubernetes.io/part-of: argocd - name: argocd-ssh-known-hosts-cm ---- -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/name: argocd-tls-certs-cm - app.kubernetes.io/part-of: argocd - name: argocd-tls-certs-cm ---- -apiVersion: v1 -kind: Secret -metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-secret -type: Opaque ---- -apiVersion: v1 -kind: Secret -metadata: - labels: - app.kubernetes.io/name: argocd-secret - app.kubernetes.io/part-of: argocd - name: argocd-secret -type: Opaque ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller -spec: - ports: - - name: webhook - port: 7000 - protocol: TCP - targetPort: webhook - - name: metrics - port: 8080 - protocol: TCP - targetPort: metrics - selector: - app.kubernetes.io/name: argocd-applicationset-controller ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server -spec: - ports: - - name: http - port: 5556 - protocol: TCP - targetPort: 5556 - - name: grpc - port: 5557 - protocol: TCP - targetPort: 5557 - - name: metrics - port: 5558 - protocol: TCP - targetPort: 5558 - selector: - app.kubernetes.io/name: argocd-dex-server ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/component: metrics - app.kubernetes.io/name: argocd-metrics - app.kubernetes.io/part-of: argocd - name: argocd-metrics -spec: - ports: - - name: metrics - port: 8082 - protocol: TCP - targetPort: 8082 - selector: - app.kubernetes.io/name: argocd-application-controller ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller-metrics - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller-metrics -spec: - ports: - - name: metrics - port: 9001 - protocol: TCP - targetPort: 9001 - selector: - app.kubernetes.io/name: argocd-notifications-controller ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis -spec: - ports: - - name: tcp-redis - port: 6379 - targetPort: 6379 - selector: - app.kubernetes.io/name: argocd-redis ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/component: repo-server - app.kubernetes.io/name: argocd-repo-server - app.kubernetes.io/part-of: argocd - name: argocd-repo-server -spec: - ports: - - name: server - port: 8081 - protocol: TCP - targetPort: 8081 - - name: metrics - port: 8084 - protocol: TCP - targetPort: 8084 - selector: - app.kubernetes.io/name: argocd-repo-server ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server -spec: - ports: - - name: http - port: 80 - protocol: TCP - targetPort: 8080 - - name: https - port: 443 - protocol: TCP - targetPort: 8080 - selector: - app.kubernetes.io/name: argocd-server ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server-metrics - app.kubernetes.io/part-of: argocd - name: argocd-server-metrics -spec: - ports: - - name: metrics - port: 8083 - protocol: TCP - targetPort: 8083 - selector: - app.kubernetes.io/name: argocd-server ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller -spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-applicationset-controller - template: - metadata: - labels: - app.kubernetes.io/name: argocd-applicationset-controller - spec: - containers: - - args: - - /usr/local/bin/argocd-applicationset-controller - env: - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_LEADER_ELECTION - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.leader.election - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_NAMESPACE - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.namespace - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER - valueFrom: - configMapKeyRef: - key: repo.server - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_POLICY - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.policy - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_DEBUG - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.debug - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_LOGLEVEL - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_DRY_RUN - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.dryrun - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_GIT_MODULES_ENABLED - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.git.submodule - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_PROGRESSIVE_SYNCS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.progressive.syncs - name: argocd-cmd-params-cm - optional: true - image: quay.io/argoproj/argocd:v2.7.6 - imagePullPolicy: Always - name: argocd-applicationset-controller - ports: - - containerPort: 7000 - name: webhook - - containerPort: 8080 - name: metrics - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /app/config/ssh - name: ssh-known-hosts - - mountPath: /app/config/tls - name: tls-certs - - mountPath: /app/config/gpg/source - name: gpg-keys - - mountPath: /app/config/gpg/keys - name: gpg-keyring - - mountPath: /tmp - name: tmp - serviceAccountName: argocd-applicationset-controller - volumes: - - configMap: - name: argocd-ssh-known-hosts-cm - name: ssh-known-hosts - - configMap: - name: argocd-tls-certs-cm - name: tls-certs - - configMap: - name: argocd-gpg-keys-cm - name: gpg-keys - - emptyDir: {} - name: gpg-keyring - - emptyDir: {} - name: tmp ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server -spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-dex-server - template: - metadata: - labels: - app.kubernetes.io/name: argocd-dex-server - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - containers: - - command: - - /shared/argocd-dex - - rundex - env: - - name: ARGOCD_DEX_SERVER_DISABLE_TLS - valueFrom: - configMapKeyRef: - key: dexserver.disable.tls - name: argocd-cmd-params-cm - optional: true - image: ghcr.io/dexidp/dex:v2.36.0 - imagePullPolicy: Always - name: dex - ports: - - containerPort: 5556 - - containerPort: 5557 - - containerPort: 5558 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /shared - name: static-files - - mountPath: /tmp - name: dexconfig - - mountPath: /tls - name: argocd-dex-server-tls - initContainers: - - command: - - /bin/cp - - -n - - /usr/local/bin/argocd - - /shared/argocd-dex - image: quay.io/argoproj/argocd:v2.7.6 - imagePullPolicy: Always - name: copyutil - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /shared - name: static-files - - mountPath: /tmp - name: dexconfig - serviceAccountName: argocd-dex-server - volumes: - - emptyDir: {} - name: static-files - - emptyDir: {} - name: dexconfig - - name: argocd-dex-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-dex-server-tls ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller -spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-notifications-controller - strategy: - type: Recreate - template: - metadata: - labels: - app.kubernetes.io/name: argocd-notifications-controller - spec: - containers: - - args: - - /usr/local/bin/argocd-notifications - image: quay.io/argoproj/argocd:v2.7.6 - imagePullPolicy: Always - livenessProbe: - tcpSocket: - port: 9001 - name: argocd-notifications-controller - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /app/config/tls - name: tls-certs - - mountPath: /app/config/reposerver/tls - name: argocd-repo-server-tls - workingDir: /app - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - serviceAccountName: argocd-notifications-controller - volumes: - - configMap: - name: argocd-tls-certs-cm - name: tls-certs - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis -spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-redis - template: - metadata: - labels: - app.kubernetes.io/name: argocd-redis - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: argocd-redis - topologyKey: kubernetes.io/hostname - weight: 100 - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - containers: - - args: - - --save - - "" - - --appendonly - - "no" - image: redis:7.0.11-alpine - imagePullPolicy: Always - name: redis - ports: - - containerPort: 6379 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - securityContext: - runAsNonRoot: true - runAsUser: 999 - seccompProfile: - type: RuntimeDefault - serviceAccountName: argocd-redis ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app.kubernetes.io/component: repo-server - app.kubernetes.io/name: argocd-repo-server - app.kubernetes.io/part-of: argocd - name: argocd-repo-server -spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - template: - metadata: - labels: - app.kubernetes.io/name: argocd-repo-server - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - topologyKey: kubernetes.io/hostname - weight: 100 - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - automountServiceAccountToken: false - containers: - - args: - - /usr/local/bin/argocd-repo-server - env: - - name: ARGOCD_RECONCILIATION_TIMEOUT - valueFrom: - configMapKeyRef: - key: timeout.reconciliation - name: argocd-cm - optional: true - - name: ARGOCD_REPO_SERVER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: reposerver.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_LOGLEVEL - valueFrom: - configMapKeyRef: - key: reposerver.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_PARALLELISM_LIMIT - valueFrom: - configMapKeyRef: - key: reposerver.parallelism.limit - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_DISABLE_TLS - valueFrom: - configMapKeyRef: - key: reposerver.disable.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_MIN_VERSION - valueFrom: - configMapKeyRef: - key: reposerver.tls.minversion - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_MAX_VERSION - valueFrom: - configMapKeyRef: - key: reposerver.tls.maxversion - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_CIPHERS - valueFrom: - configMapKeyRef: - key: reposerver.tls.ciphers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: reposerver.repo.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: REDIS_SERVER - valueFrom: - configMapKeyRef: - key: redis.server - name: argocd-cmd-params-cm - optional: true - - name: REDIS_COMPRESSION - valueFrom: - configMapKeyRef: - key: redis.compression - name: argocd-cmd-params-cm - optional: true - - name: REDISDB - valueFrom: - configMapKeyRef: - key: redis.db - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_DEFAULT_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: reposerver.default.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_OTLP_ADDRESS - valueFrom: - configMapKeyRef: - key: otlp.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE - valueFrom: - configMapKeyRef: - key: reposerver.max.combined.directory.manifests.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS - valueFrom: - configMapKeyRef: - key: reposerver.plugin.tar.exclusions - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS - valueFrom: - configMapKeyRef: - key: reposerver.allow.oob.symlinks - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE - valueFrom: - configMapKeyRef: - key: reposerver.streamed.manifest.max.tar.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE - valueFrom: - configMapKeyRef: - key: reposerver.streamed.manifest.max.extracted.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_GIT_MODULES_ENABLED - valueFrom: - configMapKeyRef: - key: reposerver.enable.git.submodule - name: argocd-cmd-params-cm - optional: true - - name: HELM_CACHE_HOME - value: /helm-working-dir - - name: HELM_CONFIG_HOME - value: /helm-working-dir - - name: HELM_DATA_HOME - value: /helm-working-dir - image: quay.io/argoproj/argocd:v2.7.6 - imagePullPolicy: Always - livenessProbe: - failureThreshold: 3 - httpGet: - path: /healthz?full=true - port: 8084 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - name: argocd-repo-server - ports: - - containerPort: 8081 - - containerPort: 8084 - readinessProbe: - httpGet: - path: /healthz - port: 8084 - initialDelaySeconds: 5 - periodSeconds: 10 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /app/config/ssh - name: ssh-known-hosts - - mountPath: /app/config/tls - name: tls-certs - - mountPath: /app/config/gpg/source - name: gpg-keys - - mountPath: /app/config/gpg/keys - name: gpg-keyring - - mountPath: /app/config/reposerver/tls - name: argocd-repo-server-tls - - mountPath: /tmp - name: tmp - - mountPath: /helm-working-dir - name: helm-working-dir - - mountPath: /home/argocd/cmp-server/plugins - name: plugins - initContainers: - - command: - - /bin/cp - - -n - - /usr/local/bin/argocd - - /var/run/argocd/argocd-cmp-server - image: quay.io/argoproj/argocd:v2.7.6 - name: copyutil - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /var/run/argocd - name: var-files - serviceAccountName: argocd-repo-server - volumes: - - configMap: - name: argocd-ssh-known-hosts-cm - name: ssh-known-hosts - - configMap: - name: argocd-tls-certs-cm - name: tls-certs - - configMap: - name: argocd-gpg-keys-cm - name: gpg-keys - - emptyDir: {} - name: gpg-keyring - - emptyDir: {} - name: tmp - - emptyDir: {} - name: helm-working-dir - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls - - emptyDir: {} - name: var-files - - emptyDir: {} - name: plugins ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server -spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-server - template: - metadata: - labels: - app.kubernetes.io/name: argocd-server - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - topologyKey: kubernetes.io/hostname - weight: 100 - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - containers: - - args: - - /usr/local/bin/argocd-server - env: - - name: ARGOCD_SERVER_INSECURE - valueFrom: - configMapKeyRef: - key: server.insecure - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_BASEHREF - valueFrom: - configMapKeyRef: - key: server.basehref - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_ROOTPATH - valueFrom: - configMapKeyRef: - key: server.rootpath - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: server.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_LOG_LEVEL - valueFrom: - configMapKeyRef: - key: server.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_REPO_SERVER - valueFrom: - configMapKeyRef: - key: repo.server - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_DEX_SERVER - valueFrom: - configMapKeyRef: - key: server.dex.server - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_DISABLE_AUTH - valueFrom: - configMapKeyRef: - key: server.disable.auth - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_ENABLE_GZIP - valueFrom: - configMapKeyRef: - key: server.enable.gzip - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_REPO_SERVER_TIMEOUT_SECONDS - valueFrom: - configMapKeyRef: - key: server.repo.server.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_X_FRAME_OPTIONS - valueFrom: - configMapKeyRef: - key: server.x.frame.options - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_CONTENT_SECURITY_POLICY - valueFrom: - configMapKeyRef: - key: server.content.security.policy - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_REPO_SERVER_PLAINTEXT - valueFrom: - configMapKeyRef: - key: server.repo.server.plaintext - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_REPO_SERVER_STRICT_TLS - valueFrom: - configMapKeyRef: - key: server.repo.server.strict.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT - valueFrom: - configMapKeyRef: - key: server.dex.server.plaintext - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_DEX_SERVER_STRICT_TLS - valueFrom: - configMapKeyRef: - key: server.dex.server.strict.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_MIN_VERSION - valueFrom: - configMapKeyRef: - key: server.tls.minversion - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_MAX_VERSION - valueFrom: - configMapKeyRef: - key: server.tls.maxversion - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_CIPHERS - valueFrom: - configMapKeyRef: - key: server.tls.ciphers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_CONNECTION_STATUS_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.connection.status.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_OIDC_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.oidc.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_LOGIN_ATTEMPTS_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.login.attempts.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_STATIC_ASSETS - valueFrom: - configMapKeyRef: - key: server.staticassets - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APP_STATE_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.app.state.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: REDIS_SERVER - valueFrom: - configMapKeyRef: - key: redis.server - name: argocd-cmd-params-cm - optional: true - - name: REDIS_COMPRESSION - valueFrom: - configMapKeyRef: - key: redis.compression - name: argocd-cmd-params-cm - optional: true - - name: REDISDB - valueFrom: - configMapKeyRef: - key: redis.db - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_DEFAULT_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.default.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_MAX_COOKIE_NUMBER - valueFrom: - configMapKeyRef: - key: server.http.cookie.maxnumber - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_OTLP_ADDRESS - valueFrom: - configMapKeyRef: - key: otlp.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_NAMESPACES - valueFrom: - configMapKeyRef: - key: application.namespaces - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_ENABLE_PROXY_EXTENSION - valueFrom: - configMapKeyRef: - key: server.enable.proxy.extension - name: argocd-cmd-params-cm - optional: true - image: quay.io/argoproj/argocd:v2.7.6 - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /healthz?full=true - port: 8080 - initialDelaySeconds: 3 - periodSeconds: 30 - timeoutSeconds: 5 - name: argocd-server - ports: - - containerPort: 8080 - - containerPort: 8083 - readinessProbe: - httpGet: - path: /healthz - port: 8080 - initialDelaySeconds: 3 - periodSeconds: 30 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /app/config/ssh - name: ssh-known-hosts - - mountPath: /app/config/tls - name: tls-certs - - mountPath: /app/config/server/tls - name: argocd-repo-server-tls - - mountPath: /app/config/dex/tls - name: argocd-dex-server-tls - - mountPath: /home/argocd - name: plugins-home - - mountPath: /tmp - name: tmp - serviceAccountName: argocd-server - volumes: - - emptyDir: {} - name: plugins-home - - emptyDir: {} - name: tmp - - configMap: - name: argocd-ssh-known-hosts-cm - name: ssh-known-hosts - - configMap: - name: argocd-tls-certs-cm - name: tls-certs - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls - - name: argocd-dex-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-dex-server-tls ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - serviceName: argocd-application-controller - template: - metadata: - labels: - app.kubernetes.io/name: argocd-application-controller - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - topologyKey: kubernetes.io/hostname - weight: 100 - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - containers: - - args: - - /usr/local/bin/argocd-application-controller - env: - - name: ARGOCD_CONTROLLER_REPLICAS - value: "1" - - name: ARGOCD_RECONCILIATION_TIMEOUT - valueFrom: - configMapKeyRef: - key: timeout.reconciliation - name: argocd-cm - optional: true - - name: ARGOCD_HARD_RECONCILIATION_TIMEOUT - valueFrom: - configMapKeyRef: - key: timeout.hard.reconciliation - name: argocd-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER - valueFrom: - configMapKeyRef: - key: repo.server - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS - valueFrom: - configMapKeyRef: - key: controller.repo.server.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_STATUS_PROCESSORS - valueFrom: - configMapKeyRef: - key: controller.status.processors - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_OPERATION_PROCESSORS - valueFrom: - configMapKeyRef: - key: controller.operation.processors - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: controller.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_LOGLEVEL - valueFrom: - configMapKeyRef: - key: controller.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_METRICS_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: controller.metrics.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_TIMEOUT_SECONDS - valueFrom: - configMapKeyRef: - key: controller.self.heal.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT - valueFrom: - configMapKeyRef: - key: controller.repo.server.plaintext - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_STRICT_TLS - valueFrom: - configMapKeyRef: - key: controller.repo.server.strict.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH - valueFrom: - configMapKeyRef: - key: controller.resource.health.persist - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APP_STATE_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: controller.app.state.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: REDIS_SERVER - valueFrom: - configMapKeyRef: - key: redis.server - name: argocd-cmd-params-cm - optional: true - - name: REDIS_COMPRESSION - valueFrom: - configMapKeyRef: - key: redis.compression - name: argocd-cmd-params-cm - optional: true - - name: REDISDB - valueFrom: - configMapKeyRef: - key: redis.db - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_DEFAULT_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: controller.default.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_OTLP_ADDRESS - valueFrom: - configMapKeyRef: - key: otlp.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_NAMESPACES - valueFrom: - configMapKeyRef: - key: application.namespaces - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_KUBECTL_PARALLELISM_LIMIT - valueFrom: - configMapKeyRef: - key: controller.kubectl.parallelism.limit - name: argocd-cmd-params-cm - optional: true - image: quay.io/argoproj/argocd:v2.7.6 - imagePullPolicy: Always - name: argocd-application-controller - ports: - - containerPort: 8082 - readinessProbe: - httpGet: - path: /healthz - port: 8082 - initialDelaySeconds: 5 - periodSeconds: 10 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /app/config/controller/tls - name: argocd-repo-server-tls - - mountPath: /home/argocd - name: argocd-home - workingDir: /home/argocd - serviceAccountName: argocd-application-controller - volumes: - - emptyDir: {} - name: argocd-home - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: argocd-application-controller-network-policy -spec: - ingress: - - from: - - namespaceSelector: {} - ports: - - port: 8082 - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - policyTypes: - - Ingress ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: argocd-applicationset-controller-network-policy -spec: - ingress: - - from: - - namespaceSelector: {} - ports: - - port: 7000 - protocol: TCP - - port: 8080 - protocol: TCP - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-applicationset-controller - policyTypes: - - Ingress ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: argocd-dex-server-network-policy -spec: - ingress: - - from: - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - ports: - - port: 5556 - protocol: TCP - - port: 5557 - protocol: TCP - - from: - - namespaceSelector: {} - ports: - - port: 5558 - protocol: TCP - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-dex-server - policyTypes: - - Ingress ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller-network-policy -spec: - ingress: - - from: - - namespaceSelector: {} - ports: - - port: 9001 - protocol: TCP - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-notifications-controller - policyTypes: - - Ingress ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: argocd-redis-network-policy -spec: - egress: - - ports: - - port: 53 - protocol: UDP - - port: 53 - protocol: TCP - ingress: - - from: - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - ports: - - port: 6379 - protocol: TCP - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-redis - policyTypes: - - Ingress - - Egress ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: argocd-repo-server-network-policy -spec: - ingress: - - from: - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-notifications-controller - ports: - - port: 8081 - protocol: TCP - - from: - - namespaceSelector: {} - ports: - - port: 8084 - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - policyTypes: - - Ingress ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: argocd-server-network-policy -spec: - ingress: - - {} - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - policyTypes: - - Ingress diff --git a/packages/argocd/base/kustomization.yaml b/packages/argocd/base/kustomization.yaml deleted file mode 100644 index e351502ef..000000000 --- a/packages/argocd/base/kustomization.yaml +++ /dev/null @@ -1,3 +0,0 @@ -namespace: argocd -resources: - - install.yaml diff --git a/packages/argocd/dev/argocd-cmd-params-cm.yaml b/packages/argocd/dev/argocd-cmd-params-cm.yaml deleted file mode 100644 index c6e7b0040..000000000 --- a/packages/argocd/dev/argocd-cmd-params-cm.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: argocd-cmd-params-cm - labels: - app.kubernetes.io/name: argocd-cmd-params-cm - app.kubernetes.io/part-of: argocd -data: - server.insecure: "true" diff --git a/packages/argocd/dev/cm-argocd-cm.yaml b/packages/argocd/dev/cm-argocd-cm.yaml deleted file mode 100644 index 11a35ba98..000000000 --- a/packages/argocd/dev/cm-argocd-cm.yaml +++ /dev/null @@ -1,129 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/name: argocd-cm - app.kubernetes.io/part-of: argocd - name: argocd-cm -data: - accounts.backstage: apiKey - accounts.backstage.enabled: "true" - application.resourceTrackingMethod: annotation - resource.exclusions: | - - kinds: - - ProviderConfigUsage - apiGroups: - - "*" - resource.customizations: | - "awsblueprints.io/*": - health.lua: | - health_status = { - status = "Progressing", - message = "Provisioning ..." - } - - if obj.status == nil or obj.status.conditions == nil then - return health_status - end - - for i, condition in ipairs(obj.status.conditions) do - if condition.type == "Ready" then - if condition.status == "True" then - health_status.status = "Healthy" - health_status.message = "Resource is up-to-date." - return health_status - end - end - - if condition.type == "LastAsyncOperation" then - if condition.status == "False" then - health_status.status = "Degraded" - health_status.message = condition.message - return health_status - end - end - - if condition.type == "Synced" then - if condition.status == "False" then - health_status.status = "Degraded" - health_status.message = condition.message - return health_status - end - end - end - return health_status - "*.aws.upbound.io/*": - health.lua: | - health_status = { - status = "Progressing", - message = "Provisioning ..." - } - - if obj.status == nil or obj.status.conditions == nil then - return health_status - end - - for i, condition in ipairs(obj.status.conditions) do - if condition.type == "Ready" then - if condition.status == "True" then - health_status.status = "Healthy" - health_status.message = "Resource is up-to-date." - return health_status - end - end - - if condition.type == "LastAsyncOperation" then - if condition.status == "False" then - health_status.status = "Degraded" - health_status.message = condition.message - return health_status - end - end - - if condition.type == "Synced" then - if condition.status == "False" then - health_status.status = "Degraded" - health_status.message = condition.message - return health_status - end - end - end - - return health_status - "*.aws.crossplane.io/*": - health.lua: | - health_status = { - status = "Progressing", - message = "Provisioning ..." - } - - if obj.status == nil or obj.status.conditions == nil then - return health_status - end - - for i, condition in ipairs(obj.status.conditions) do - if condition.type == "Ready" then - if condition.status == "True" then - health_status.status = "Healthy" - health_status.message = "Resource is up-to-date." - return health_status - end - end - - if condition.type == "LastAsyncOperation" then - if condition.status == "False" then - health_status.status = "Degraded" - health_status.message = condition.message - return health_status - end - end - - if condition.type == "Synced" then - if condition.status == "False" then - health_status.status = "Degraded" - health_status.message = condition.message - return health_status - end - end - end - return health_status diff --git a/packages/argocd/dev/cm-argocd-rbac-cm.yaml b/packages/argocd/dev/cm-argocd-rbac-cm.yaml deleted file mode 100644 index d05221405..000000000 --- a/packages/argocd/dev/cm-argocd-rbac-cm.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: argocd-rbac-cm -data: - policy.csv: | - g, superuser, role:admin - g, backstage, role:readonly diff --git a/packages/argocd/dev/kustomization.yaml b/packages/argocd/dev/kustomization.yaml deleted file mode 100644 index 9f4ad8913..000000000 --- a/packages/argocd/dev/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ -namespace: argocd -resources: - - ../base/ - - service-argogrpc.yaml - - appproject-cnoe.yaml - - appproject-demo.yaml -patchesStrategicMerge: - - cm-argocd-cm.yaml - - argocd-cmd-params-cm.yaml - - cm-argocd-rbac-cm.yaml -images: - - name: quay.io/argoproj/argocd:v2.7.6 - newTag: v2.7.6 diff --git a/packages/argocd/dev/service-argogrpc.yaml b/packages/argocd/dev/service-argogrpc.yaml deleted file mode 100644 index 25152fdc2..000000000 --- a/packages/argocd/dev/service-argogrpc.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - annotations: - alb.ingress.kubernetes.io/backend-protocol-version: HTTP2 - labels: - app: argogrpc - name: argogrpc - namespace: argocd -spec: - ports: - - name: "8080" - port: 8080 - protocol: TCP - targetPort: 8080 - selector: - app.kubernetes.io/name: argocd-server - sessionAffinity: None - type: ClusterIP diff --git a/packages/backstage/base/install-backstage.yaml b/packages/backstage/base/install-backstage.yaml deleted file mode 100644 index 286fc9fda..000000000 --- a/packages/backstage/base/install-backstage.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backstage - namespace: backstage -spec: - replicas: 1 - selector: - matchLabels: - app: backstage - template: - metadata: - labels: - app: backstage - spec: - containers: - - name: backstage - image: abc/abc:abc - ports: - - name: http - containerPort: 7007 - envFrom: - - secretRef: - name: postgresql-config ---- -apiVersion: v1 -kind: Service -metadata: - name: backstage - namespace: backstage -spec: - selector: - app: backstage - ports: - - name: http - port: 7007 - targetPort: http ---- -apiVersion: v1 -kind: Namespace -metadata: - name: backstage diff --git a/packages/backstage/base/install-postgresql.yaml b/packages/backstage/base/install-postgresql.yaml deleted file mode 100644 index 73e4cbcf5..000000000 --- a/packages/backstage/base/install-postgresql.yaml +++ /dev/null @@ -1,72 +0,0 @@ -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - name: postgresql - namespace: backstage - labels: - app: postgresql -spec: - storageClassName: gp2 - capacity: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: postgresql - namespace: backstage - labels: - app: postgresql -spec: - serviceName: service-postgresql - replicas: 1 - selector: - matchLabels: - app: postgresql - template: - metadata: - labels: - app: postgresql - spec: - containers: - - name: postgres - resources: - limits: - memory: 500Mi - requests: - cpu: 100m - memory: 300Mi - image: docker.io/library/postgres:15.3-alpine3.18 - envFrom: - - secretRef: - name: postgresql-config - ports: - - containerPort: 5432 - name: postgresdb - volumeMounts: - - name: data - mountPath: /var/lib/postgresql/data - subPath: postgress - volumes: - - name: data - persistentVolumeClaim: - claimName: postgresql ---- -apiVersion: v1 -kind: Service -metadata: - name: postgresql - namespace: backstage - labels: - app: postgresql -spec: - ports: - - port: 5432 - name: postgres - clusterIP: None - selector: - app: postgresql diff --git a/packages/backstage/base/kustomization.yaml b/packages/backstage/base/kustomization.yaml deleted file mode 100644 index f86dc525f..000000000 --- a/packages/backstage/base/kustomization.yaml +++ /dev/null @@ -1,3 +0,0 @@ -resources: - - install-postgresql.yaml - - install-backstage.yaml diff --git a/packages/backstage/dev/cm-backstage-config.yaml b/packages/backstage/dev/cm-backstage-config.yaml deleted file mode 100644 index 03950ed69..000000000 --- a/packages/backstage/dev/cm-backstage-config.yaml +++ /dev/null @@ -1,122 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/name: backstage - name: backstage-config -data: - app-config.yaml: | - app: - title: CNOE Backstage - baseUrl: ${BACKSTAGE_FRONTEND_URL} - organization: - name: CNOE - backend: - # Used for enabling authentication, secret is shared by all backend plugins - # See https://backstage.io/docs/tutorials/backend-to-backend-auth for - # information on the format - # auth: - # keys: - # - secret: ${BACKEND_SECRET} - baseUrl: ${BACKSTAGE_FRONTEND_URL} - listen: - port: 7007 - # Uncomment the following host directive to bind to specific interfaces - # host: 127.0.0.1 - csp: - connect-src: ["'self'", 'http:', 'https:'] - # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference - # Default Helmet Content-Security-Policy values can be removed by setting the key to false - cors: - origin: ${BACKSTAGE_FRONTEND_URL} - methods: [GET, HEAD, PATCH, POST, PUT, DELETE] - credentials: true - database: - client: pg - connection: - host: ${POSTGRES_HOST} - port: ${POSTGRES_PORT} - user: ${POSTGRES_USER} - password: ${POSTGRES_PASSWORD} - cache: - store: memory - # workingDirectory: /tmp # Use this to configure a working directory for the scaffolder, defaults to the OS temp-dir - - integrations: - github: - - host: github.com - apps: - - $include: github-integration.yaml - # - host: github.com - # # This is a Personal Access Token or PAT from GitHub. You can find out how to generate this token, and more information - # # about setting up the GitHub integration here: https://backstage.io/docs/getting-started/configuration#setting-up-a-github-integration - # token: ${GITHUB_TOKEN} - ### Example for how to add your GitHub Enterprise instance using the API: - # - host: ghe.example.net - # apiBaseUrl: https://ghe.example.net/api/v3 - # token: ${GHE_TOKEN} - - proxy: - '/argo-workflows/api': - target: ${ARGO_WORKFLOWS_URL} - changeOrigin: true - secure: true - headers: - Authorization: - $env: ARGO_WORKFLOWS_AUTH_TOKEN - '/argocd/api': - target: ${ARGO_CD_URL} - changeOrigin: true - headers: - Cookie: - $env: ARGOCD_AUTH_TOKEN - - # Reference documentation http://backstage.io/docs/features/techdocs/configuration - # Note: After experimenting with basic setup, use CI/CD to generate docs - # and an external cloud storage when deploying TechDocs for production use-case. - # https://backstage.io/docs/features/techdocs/how-to-guides#how-to-migrate-from-techdocs-basic-to-recommended-deployment-approach - techdocs: - builder: 'local' # Alternatives - 'external' - generator: - runIn: 'docker' # Alternatives - 'local' - publisher: - type: 'local' # Alternatives - 'googleGcs' or 'awsS3'. Read documentation for using alternatives. - - auth: - environment: development - session: - secret: MW2sV-sIPngEl26vAzatV-6VqfsgAx4bPIz7PuE_2Lk= - providers: - keycloak-oidc: - development: - metadataUrl: ${KEYCLOAK_NAME_METADATA} - clientId: backstage - clientSecret: ${KEYCLOAK_CLIENT_SECRET} - scope: 'openid profile email groups' - prompt: auto - - scaffolder: - # see https://backstage.io/docs/features/software-templates/configuration for software template options - - catalog: - import: - entityFilename: catalog-info.yaml - pullRequestBranchName: backstage-integration - rules: - - allow: [Component, System, API, Resource, Location, Template] - locations: - # Examples from a public GitHub repository. - - type: url - target: https://github.com/awslabs/backstage-templates-on-eks/blob/main/catalog-info.yaml - ## Uncomment these lines to add an example org - # - type: url - # target: https://github.com/backstage/backstage/blob/master/packages/catalog-model/examples/acme-corp.yaml - # rules: - # - allow: [User, Group] - kubernetes: - serviceLocatorMethod: - type: 'multiTenant' - clusterLocatorMethods: - - $include: k8s-config.yaml - argoWorkflows: - baseUrl: ${ARGO_WORKFLOWS_URL} diff --git a/packages/backstage/dev/kustomization.yaml b/packages/backstage/dev/kustomization.yaml deleted file mode 100644 index 2e6b6b789..000000000 --- a/packages/backstage/dev/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ -resources: - - ../base - - sa-backstage.yaml - - cm-backstage-config.yaml - - secret-k8s-config.yaml -patchesStrategicMerge: - - patches/deployment-backstage.yaml diff --git a/packages/backstage/dev/patches/deployment-backstage.yaml b/packages/backstage/dev/patches/deployment-backstage.yaml deleted file mode 100644 index 7745c8074..000000000 --- a/packages/backstage/dev/patches/deployment-backstage.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backstage - namespace: backstage -spec: - template: - spec: - serviceAccountName: backstage - volumes: - - name: backstage-config - projected: - sources: - - secret: - name: integrations - items: - - key: github-integration.yaml - path: github-integration.yaml - - configMap: - name: backstage-config - items: - - key: app-config.yaml - path: app-config.yaml - - secret: - name: k8s-config - items: - - key: k8s-config.yaml - path: k8s-config.yaml - containers: - - name: backstage - image: public.ecr.aws/cnoe-io/backstage:v0.0.2 - command: - - node - - packages/backend - - --config - - config/app-config.yaml - volumeMounts: - - name: backstage-config - mountPath: "/app/config" - readOnly: true - envFrom: - - secretRef: - name: backstage-env-vars diff --git a/packages/backstage/dev/sa-backstage.yaml b/packages/backstage/dev/sa-backstage.yaml deleted file mode 100644 index 63fbfe7e5..000000000 --- a/packages/backstage/dev/sa-backstage.yaml +++ /dev/null @@ -1,54 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: backstage - namespace: backstage - ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: read-all -rules: -- apiGroups: ["*"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: backstage-read-all -subjects: -- kind: ServiceAccount - name: backstage - namespace: backstage -roleRef: - kind: ClusterRole - name: read-all - apiGroup: rbac.authorization.k8s.io ---- -# These are needed for the argo workflow plugin to create workflows during scaffolding. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: backstage-argo-worfklows -rules: -- apiGroups: ["argoproj.io"] - resources: ["workflows"] - verbs: ["create"] -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: backstage-argo-worfklows -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: backstage-argo-worfklows -subjects: -- kind: ServiceAccount - name: backstage - namespace: backstage diff --git a/packages/backstage/dev/user-rbac.yaml b/packages/backstage/dev/user-rbac.yaml deleted file mode 100644 index c6fa4c59f..000000000 --- a/packages/backstage/dev/user-rbac.yaml +++ /dev/null @@ -1,36 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: keycloak-superuser-group -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: superuser - ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: keycloak-write-workflows -rules: -- apiGroups: ["argoproj.io"] - resources: ["workflows"] - verbs: ["*"] - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: keycloak-backstage-users-group -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: keycloak-write-workflows -subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: backstage-users diff --git a/packages/backstage/manifests/external-secrets.yaml b/packages/backstage/manifests/external-secrets.yaml new file mode 100644 index 000000000..32c093537 --- /dev/null +++ b/packages/backstage/manifests/external-secrets.yaml @@ -0,0 +1,133 @@ + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: backstage-env-vars + namespace: backstage + annotations: + argocd.argoproj.io/sync-wave: "-10" +spec: + refreshInterval: "0" + secretStoreRef: + name: keycloak + kind: ClusterSecretStore + target: + name: backstage-env-vars + # creationPolicy: "Owner" + template: + data: + ARGOCD_ADMIN_PASSWORD: "{{ .ARGOCD_ADMIN_PASSWORD }}" + ARGOCD_AUTH_TOKEN: "argocd.token={{.ARGOCD_SESSION_TOKEN}}" + POSTGRES_PASSWORD: "{{ .password }}" + BACKSTAGE_CLIENT_SECRET: "{{ .BACKSTAGE_CLIENT_SECRET }}" + dataFrom: + - sourceRef: + generatorRef: + apiVersion: generators.external-secrets.io/v1alpha1 + kind: Password + name: "postgres-password" + data: + - secretKey: ARGOCD_SESSION_TOKEN + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: keycloak-clients + property: ARGOCD_SESSION_TOKEN # Note: Read-Only non-expiring token + - secretKey: BACKSTAGE_CLIENT_SECRET + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: keycloak-clients + property: BACKSTAGE_CLIENT_SECRET + - secretKey: ARGOCD_ADMIN_PASSWORD + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: keycloak-clients + property: ARGOCD_ADMIN_PASSWORD +--- +apiVersion: generators.external-secrets.io/v1alpha1 +kind: Password +metadata: + name: postgres-password + namespace: backstage + annotations: + argocd.argoproj.io/sync-wave: "-20" +spec: + length: 48 + digits: 5 + symbols: 5 + symbolCharacters: "/-+" + noUpper: false + allowRepeat: true +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: integrations + namespace: backstage + annotations: + argocd.argoproj.io/sync-wave: "-10" +spec: + refreshInterval: "0" + secretStoreRef: + name: aws-secretsmanager + kind: ClusterSecretStore + target: + name: integrations + template: + data: + github-integration.yaml: | + appId: {{ .appId }} + clientId: {{ .clientId }} + clientSecret: {{ .clientSecret }} + webhookUrl: {{ .webhookUrl }} + webhookSecret: {{ .webhookSecret }} + privateKey: | {{ .privateKey | nindent 2}} + data: + - secretKey: "appId" + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: backstage-github.appId + - secretKey: "clientId" + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: backstage-github.clientId + - secretKey: "clientSecret" + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: backstage-github.clientSecret + - secretKey: "webhookSecret" + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: backstage-github.webhookSecret + - secretKey: "privateKey" + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: backstage-github.privateKey + - secretKey: "webhookUrl" + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/github-app + metadataPolicy: None + property: backstage-github.webhookUrl \ No newline at end of file diff --git a/packages/backstage/dev/secret-k8s-config.yaml b/packages/backstage/manifests/k8s-config-secret.yaml similarity index 96% rename from packages/backstage/dev/secret-k8s-config.yaml rename to packages/backstage/manifests/k8s-config-secret.yaml index 2e0394d2e..0b99e6fec 100644 --- a/packages/backstage/dev/secret-k8s-config.yaml +++ b/packages/backstage/manifests/k8s-config-secret.yaml @@ -3,6 +3,7 @@ kind: Secret metadata: name: k8s-config namespace: backstage +type: Opaque stringData: k8s-config.yaml: | type: 'config' @@ -15,4 +16,4 @@ stringData: serviceAccountToken: $file: /var/run/secrets/kubernetes.io/serviceaccount/token caData: - $file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + $file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt \ No newline at end of file diff --git a/packages/backstage/path-routing/default-cert-external-secret.yaml b/packages/backstage/path-routing/default-cert-external-secret.yaml new file mode 100644 index 000000000..1b6ac611b --- /dev/null +++ b/packages/backstage/path-routing/default-cert-external-secret.yaml @@ -0,0 +1,33 @@ + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: backstage-server-tls + namespace: backstage + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + refreshInterval: "0" + secretStoreRef: + name: default-cert + kind: ClusterSecretStore + target: + name: backstage-server-tls + template: + type: kubernetes.io/tls + data: + - secretKey: tls.key + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: default-tls-prod + property: tls.key + - secretKey: tls.crt + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: default-tls-prod + property: tls.crt diff --git a/packages/backstage/values.yaml b/packages/backstage/values.yaml new file mode 100644 index 000000000..7c2fafc6b --- /dev/null +++ b/packages/backstage/values.yaml @@ -0,0 +1,132 @@ +# Ref: https://github.com/backstage/charts/tree/main/charts/backstage +ingress: + enabled: true + className: "nginx" + extraHosts: [] + path: "/" + tls: + enabled: true + secretName: "backstage-server-tls" +backstage: + replicas: 1 + image: + registry: ghcr.io + repository: cnoe-io/backstage-app + tag: 135c0cb26f3e004a27a11edb6a4779035aff9805 + pullPolicy: IfNotPresent + command: ["node", "packages/backend"] + extraEnvVarsSecrets: + - backstage-env-vars + extraVolumeMounts: + - name: backstage-config + mountPath: "/app/config" + readOnly: true + extraVolumes: + - name: backstage-config + projected: + sources: + - secret: + name: integrations + items: + - key: github-integration.yaml + path: github-integration.yaml + - secret: + name: k8s-config + items: + - key: k8s-config.yaml + path: k8s-config.yaml + appConfig: + app: + title: CNOE Backstage + baseUrl: ${BACKSTAGE_FRONTEND_URL} + organization: + name: CNOE + backend: + baseUrl: ${BACKSTAGE_FRONTEND_URL} + csp: + connect-src: ['self', 'http:', 'https:'] + cors: + origin: ${BACKSTAGE_FRONTEND_URL} + methods: [GET, HEAD, PATCH, POST, PUT, DELETE] + credentials: true + database: + client: pg + connection: + host: ${POSTGRES_HOST} + port: ${POSTGRES_PORT} + user: ${POSTGRES_USER} + password: ${POSTGRES_PASSWORD} + cache: + store: memory + integrations: + github: + - host: github.com + apps: + - $include: /app/config/github-integration.yaml + proxy: + '/argo-workflows/api': + target: ${ARGO_WORKFLOWS_URL} + changeOrigin: true + secure: true + headers: + Authorization: + $env: ARGO_WORKFLOWS_AUTH_TOKEN + '/argocd/api': + target: ${ARGO_CD_URL} + changeOrigin: true + headers: + Cookie: + $env: ARGOCD_AUTH_TOKEN + techdocs: + builder: 'local' + generator: + runIn: 'docker' + publisher: + type: 'local' + auth: + environment: development + session: + secret: "MW2sV-sIPngEl26vAzatV-6VqfsgAx4bPIz7PuE_2Lk=" + providers: + keycloak-oidc: + development: + metadataUrl: ${KEYCLOAK_NAME_METADATA} + clientId: backstage + clientSecret: ${BACKSTAGE_CLIENT_SECRET} + additionalScopes: 'openid profile email groups' + prompt: auto + scaffolder: + catalog: + import: + entityFilename: catalog-info.yaml + pullRequestBranchName: backstage-integration + rules: + - allow: [Component, System, API, Resource, Location, Template] + kubernetes: + serviceLocatorMethod: + type: multiTenant + clusterLocatorMethods: + - $include: /app/config/k8s-config.yaml + argocd: + username: admin + password: ${ARGOCD_ADMIN_PASSWORD} + appLocatorMethods: + - type: 'config' + instances: + - name: in-cluster + url: ${ARGO_CD_URL} + username: admin + password: ${ARGOCD_ADMIN_PASSWORD} + argoWorkflows: + baseUrl: ${ARGO_WORKFLOWS_URL} +postgresql: + enabled: true + auth: + username: "backstage" + existingSecret: "backstage-env-vars" + secretKeys: + adminPasswordKey: POSTGRES_PASSWORD + userPasswordKey: POSTGRES_PASSWORD + architecture: standalone +serviceAccount: + create: true \ No newline at end of file diff --git a/packages/bootstrap.yaml b/packages/bootstrap.yaml new file mode 100644 index 000000000..d6cf878f9 --- /dev/null +++ b/packages/bootstrap.yaml @@ -0,0 +1,38 @@ +# This installs ArgoCD and ESO on hub cluster +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: bootstrap-appset + namespace: argocd + labels: + env: dev +spec: + project: default + destination: + server: https://kubernetes.default.svc + namespace: argocd + sources: + - repoURL: cnoe:// + targetRevision: HEAD + path: "appset-chart" + helm: + valueFiles: + - $values/addons/values.yaml + - $values/bootstrap/values-idpbuilder.yaml + - repoURL: cnoe:// + targetRevision: HEAD + ref: values + syncPolicy: + automated: + selfHeal: true + allowEmpty: true + prune: true + retry: + limit: -1 + backoff: + duration: 5s + factor: 2 + maxDuration: 10m + syncOptions: + - CreateNamespace=true + - ServerSideApply=true \ No newline at end of file diff --git a/packages/bootstrap/values-idpbuilder.yaml b/packages/bootstrap/values-idpbuilder.yaml new file mode 100644 index 000000000..4688f8976 --- /dev/null +++ b/packages/bootstrap/values-idpbuilder.yaml @@ -0,0 +1,14 @@ +# Used for bootstraping hub cluster with Addon Appset chart +# Only used when using idpbuilder for installation +addons-appset: # for non-path routing + enabled: true + chartName: bootstrap + namespace: argocd + releaseName: bootstrap + type: chart + path: appset-chart + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane-bootstrap'] \ No newline at end of file diff --git a/packages/bootstrap/values.yaml b/packages/bootstrap/values.yaml new file mode 100644 index 000000000..76416ae57 --- /dev/null +++ b/packages/bootstrap/values.yaml @@ -0,0 +1,34 @@ +# Used for bootstraping hub cluster with Addon Appset chart +addons-appset: # for non-path routing + enabled: true + chartName: addons + namespace: argocd + releaseName: addons + type: chart + path: packages/appset-chart # This path is relative to Github repo root + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + - key: path_routing + operator: In + values: ['false'] + +addons-appset-pr: # for path routing + enabled: true + chartName: addons + namespace: argocd + releaseName: addons + type: chart + path: packages/appset-chart # This path is relative to Github repo root + valueFiles: + - "path-routing-values.yaml" + selector: + matchExpressions: + - key: environment + operator: In + values: ['control-plane'] + - key: path_routing + operator: In + values: ['true'] \ No newline at end of file diff --git a/packages/cert-manager/base/crds.yaml b/packages/cert-manager/base/crds.yaml deleted file mode 100644 index f23de4bf4..000000000 --- a/packages/cert-manager/base/crds.yaml +++ /dev/null @@ -1,4486 +0,0 @@ -# Copyright 2022 The cert-manager Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: certificaterequests.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.12.2" -spec: - group: cert-manager.io - names: - kind: CertificateRequest - listKind: CertificateRequestList - plural: certificaterequests - shortNames: - - cr - - crs - singular: certificaterequest - categories: - - cert-manager - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Approved")].status - name: Approved - type: string - - jsonPath: .status.conditions[?(@.type=="Denied")].status - name: Denied - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - type: string - - jsonPath: .spec.username - name: Requestor - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used." - type: object - required: - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Desired state of the CertificateRequest resource. - type: object - required: - - issuerRef - - request - properties: - duration: - description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. - type: string - extra: - description: Extra contains extra attributes of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. - type: object - additionalProperties: - type: array - items: - type: string - groups: - description: Groups contains group membership of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. - type: array - items: - type: string - x-kubernetes-list-type: atomic - isCA: - description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`. - type: boolean - issuerRef: - description: IssuerRef is a reference to the issuer for this CertificateRequest. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to `cert-manager.io` if empty. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - request: - description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing. - type: string - format: byte - uid: - description: UID contains the uid of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. - type: string - usages: - description: Usages is the set of x509 usages that are requested for the certificate. If usages are set they SHOULD be encoded inside the CSR spec Defaults to `digital signature` and `key encipherment` if not specified. - type: array - items: - description: "KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 \n Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\"" - type: string - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - username: - description: Username contains the name of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. - type: string - status: - description: Status of the CertificateRequest. This is set and managed automatically. - type: object - properties: - ca: - description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available. - type: string - format: byte - certificate: - description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field. - type: string - format: byte - conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`. - type: array - items: - description: CertificateRequestCondition contains condition information for a CertificateRequest. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string - format: date-time - message: - description: Message is a human readable description of the details of the last transition, complementing reason. - type: string - reason: - description: Reason is a brief machine readable explanation for the condition's last transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failureTime: - description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off. - type: string - format: date-time - served: true - storage: true ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: certificates.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.12.2" -spec: - group: cert-manager.io - names: - kind: Certificate - listKind: CertificateList - plural: certificates - shortNames: - - cert - - certs - singular: certificate - categories: - - cert-manager - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .spec.secretName - name: Secret - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: "A Certificate resource should be created to ensure an up to date and signed x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)." - type: object - required: - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Desired state of the Certificate resource. - type: object - required: - - issuerRef - - secretName - properties: - additionalOutputFormats: - description: AdditionalOutputFormats defines extra output formats of the private key and signed certificate chain to be written to this Certificate's target Secret. This is an Alpha Feature and is only enabled with the `--feature-gates=AdditionalCertificateOutputFormats=true` option on both the controller and webhook components. - type: array - items: - description: CertificateAdditionalOutputFormat defines an additional output format of a Certificate resource. These contain supplementary data formats of the signed certificate chain and paired private key. - type: object - required: - - type - properties: - type: - description: Type is the name of the format type that should be written to the Certificate's target Secret. - type: string - enum: - - DER - - CombinedPEM - commonName: - description: 'CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs. This value is ignored by TLS clients when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4' - type: string - dnsNames: - description: DNSNames is a list of DNS subjectAltNames to be set on the Certificate. - type: array - items: - type: string - duration: - description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. If unset this defaults to 90 days. Certificate will be renewed either 2/3 through its duration or `renewBefore` period before its expiry, whichever is later. Minimum accepted duration is 1 hour. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration - type: string - emailAddresses: - description: EmailAddresses is a list of email subjectAltNames to be set on the Certificate. - type: array - items: - type: string - encodeUsagesInRequest: - description: EncodeUsagesInRequest controls whether key usages should be present in the CertificateRequest - type: boolean - ipAddresses: - description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. - type: array - items: - type: string - isCA: - description: IsCA will mark this Certificate as valid for certificate signing. This will automatically add the `cert sign` usage to the list of `usages`. - type: boolean - issuerRef: - description: IssuerRef is a reference to the issuer for this certificate. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the Certificate will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - keystores: - description: Keystores configures additional keystore output formats stored in the `secretName` Secret resource. - type: object - properties: - jks: - description: JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource. - type: object - required: - - create - - passwordSecretRef - properties: - create: - description: Create enables JKS keystore creation for the Certificate. If true, a file named `keystore.jks` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will be updated immediately. If the issuer provided a CA certificate, a file named `truststore.jks` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority - type: boolean - passwordSecretRef: - description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - pkcs12: - description: PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource. - type: object - required: - - create - - passwordSecretRef - properties: - create: - description: Create enables PKCS12 keystore creation for the Certificate. If true, a file named `keystore.p12` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will be updated immediately. If the issuer provided a CA certificate, a file named `truststore.p12` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority - type: boolean - passwordSecretRef: - description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - literalSubject: - description: LiteralSubject is an LDAP formatted string that represents the [X.509 Subject field](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6). Use this *instead* of the Subject field if you need to ensure the correct ordering of the RDN sequence, such as when issuing certs for LDAP authentication. See https://github.com/cert-manager/cert-manager/issues/3203, https://github.com/cert-manager/cert-manager/issues/4424. This field is alpha level and is only supported by cert-manager installations where LiteralCertificateSubject feature gate is enabled on both cert-manager controller and webhook. - type: string - privateKey: - description: Options to control private keys used for the Certificate. - type: object - properties: - algorithm: - description: Algorithm is the private key algorithm of the corresponding private key for this certificate. If provided, allowed values are either `RSA`,`Ed25519` or `ECDSA` If `algorithm` is specified and `size` is not provided, key size of 256 will be used for `ECDSA` key algorithm and key size of 2048 will be used for `RSA` key algorithm. key size is ignored when using the `Ed25519` key algorithm. - type: string - enum: - - RSA - - ECDSA - - Ed25519 - encoding: - description: The private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 and PKCS#8, respectively. Defaults to `PKCS1` if not specified. - type: string - enum: - - PKCS1 - - PKCS8 - rotationPolicy: - description: RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. If set to Never, a private key will only be generated if one does not already exist in the target `spec.secretName`. If one does exists but it does not have the correct algorithm or size, a warning will be raised to await user intervention. If set to Always, a private key matching the specified requirements will be generated whenever a re-issuance occurs. Default is 'Never' for backward compatibility. - type: string - enum: - - Never - - Always - size: - description: Size is the key bit size of the corresponding private key for this certificate. If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified. If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, and will default to `256` if not specified. If `algorithm` is set to `Ed25519`, Size is ignored. No other values are allowed. - type: integer - renewBefore: - description: How long before the currently issued certificate's expiry cert-manager should renew the certificate. The default is 2/3 of the issued certificate's duration. Minimum accepted value is 5 minutes. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration - type: string - revisionHistoryLimit: - description: revisionHistoryLimit is the maximum number of CertificateRequest revisions that are maintained in the Certificate's history. Each revision represents a single `CertificateRequest` created by this Certificate, either when it was created, renewed, or Spec was changed. Revisions will be removed by oldest first if the number of revisions exceeds this number. If set, revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`), revisions will not be garbage collected. Default value is `nil`. - type: integer - format: int32 - secretName: - description: SecretName is the name of the secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer. - type: string - secretTemplate: - description: SecretTemplate defines annotations and labels to be copied to the Certificate's Secret. Labels and annotations on the Secret will be changed as they appear on the SecretTemplate when added or removed. SecretTemplate annotations are added in conjunction with, and cannot overwrite, the base set of annotations cert-manager sets on the Certificate's Secret. - type: object - properties: - annotations: - description: Annotations is a key value map to be copied to the target Kubernetes Secret. - type: object - additionalProperties: - type: string - labels: - description: Labels is a key value map to be copied to the target Kubernetes Secret. - type: object - additionalProperties: - type: string - subject: - description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name). - type: object - properties: - countries: - description: Countries to be used on the Certificate. - type: array - items: - type: string - localities: - description: Cities to be used on the Certificate. - type: array - items: - type: string - organizationalUnits: - description: Organizational Units to be used on the Certificate. - type: array - items: - type: string - organizations: - description: Organizations to be used on the Certificate. - type: array - items: - type: string - postalCodes: - description: Postal codes to be used on the Certificate. - type: array - items: - type: string - provinces: - description: State/Provinces to be used on the Certificate. - type: array - items: - type: string - serialNumber: - description: Serial number to be used on the Certificate. - type: string - streetAddresses: - description: Street addresses to be used on the Certificate. - type: array - items: - type: string - uris: - description: URIs is a list of URI subjectAltNames to be set on the Certificate. - type: array - items: - type: string - usages: - description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. - type: array - items: - description: "KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 \n Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\"" - type: string - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - status: - description: Status of the Certificate. This is set and managed automatically. - type: object - properties: - conditions: - description: List of status conditions to indicate the status of certificates. Known condition types are `Ready` and `Issuing`. - type: array - items: - description: CertificateCondition contains condition information for an Certificate. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string - format: date-time - message: - description: Message is a human readable description of the details of the last transition, complementing reason. - type: string - observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Certificate. - type: integer - format: int64 - reason: - description: Reason is a brief machine readable explanation for the condition's last transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`, `Issuing`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failedIssuanceAttempts: - description: The number of continuous failed issuance attempts up till now. This field gets removed (if set) on a successful issuance and gets set to 1 if unset and an issuance has failed. If an issuance has failed, the delay till the next issuance will be calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - 1). - type: integer - lastFailureTime: - description: LastFailureTime is set only if the lastest issuance for this Certificate failed and contains the time of the failure. If an issuance has failed, the delay till the next issuance will be calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - 1). If the latest issuance has succeeded this field will be unset. - type: string - format: date-time - nextPrivateKeySecretName: - description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False. - type: string - notAfter: - description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`. - type: string - format: date-time - notBefore: - description: The time after which the certificate stored in the secret named by this resource in spec.secretName is valid. - type: string - format: date-time - renewalTime: - description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled. - type: string - format: date-time - revision: - description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field." - type: integer - served: true - storage: true ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: challenges.acme.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.12.2" -spec: - group: acme.cert-manager.io - names: - kind: Challenge - listKind: ChallengeList - plural: challenges - singular: challenge - categories: - - cert-manager - - cert-manager-acme - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.dnsName - name: Domain - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: Challenge is a type to represent a Challenge request with an ACME server - type: object - required: - - metadata - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - type: object - required: - - authorizationURL - - dnsName - - issuerRef - - key - - solver - - token - - type - - url - properties: - authorizationURL: - description: The URL to the ACME Authorization resource that this challenge is a part of. - type: string - dnsName: - description: dnsName is the identifier that this challenge is for, e.g. example.com. If the requested DNSName is a 'wildcard', this field MUST be set to the non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. - type: string - issuerRef: - description: References a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - key: - description: 'The ACME challenge key for this challenge For HTTP01 challenges, this is the value that must be responded with to complete the HTTP01 challenge in the format: `.`. For DNS01 challenges, this is the base64 encoded SHA256 sum of the `.` text that must be set as the TXT record content.' - type: string - solver: - description: Contains the domain solving configuration that should be used to solve this challenge resource. - type: object - properties: - dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. - type: object - properties: - acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. - type: object - required: - - accountSecretRef - - host - properties: - accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - host: - type: string - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - properties: - accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - serviceConsumerDomain: - type: string - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID - properties: - clientID: - description: if both this and ClientSecret are left unset MSI will be used - type: string - clientSecretSecretRef: - description: if both this and ClientID are left unset MSI will be used - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - environment: - description: name of the Azure environment (default AzurePublicCloud) - type: string - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID - type: object - properties: - clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID - type: string - resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID - type: string - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: when specifying ClientID and ClientSecret then this field is also needed - type: string - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project - properties: - hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - type: object - properties: - apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - email: - description: Email of the account, only required when using API key based authentication. - type: string - cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. - type: string - enum: - - None - - Follow - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef - properties: - tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. - type: object - required: - - nameserver - properties: - nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. - type: string - tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' - type: string - tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object - required: - - region - properties: - accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: string - accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: Always set the region when using AccessKeyID and SecretAccessKey - type: string - role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. - type: object - required: - - groupName - - solverName - properties: - config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. - type: string - solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. - type: string - http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object - properties: - gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. - type: object - properties: - labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. - type: object - additionalProperties: - type: string - parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' - type: array - items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." - type: object - required: - - name - properties: - group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" - type: string - default: gateway.networking.k8s.io - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - kind: - description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" - type: string - default: Gateway - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - name: - description: "Name is the name of the referent. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" - type: string - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " - type: integer - format: int32 - maximum: 65535 - minimum: 1 - sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object - properties: - class: - description: This field configures the annotation `kubernetes.io/ingress.class` when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - ingressClassName: - description: This field configures the field `ingressClassName` on the created Ingress resources used to solve ACME challenges that use this challenge solver. This is the recommended way of configuring the ingress class. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the create ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object - properties: - affinity: - description: If specified, the pod's scheduling constraints - type: object - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array - items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight - properties: - preference: - description: A node selector term, associated with the corresponding weight. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - type: array - items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - x-kubernetes-map-type: atomic - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - type: array - items: - description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - x-kubernetes-map-type: atomic - nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - additionalProperties: - type: string - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - type: array - items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object - properties: - effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer - format: int64 - value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. - type: object - properties: - dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. - type: object - additionalProperties: - type: string - token: - description: The ACME challenge token for this challenge. This is the raw value returned from the ACME server. - type: string - type: - description: The type of ACME challenge this resource represents. One of "HTTP-01" or "DNS-01". - type: string - enum: - - HTTP-01 - - DNS-01 - url: - description: The URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge. - type: string - wildcard: - description: wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'. - type: boolean - status: - type: object - properties: - presented: - description: presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured). - type: boolean - processing: - description: Used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action. - type: boolean - reason: - description: Contains human readable information on why the Challenge is in the current state. - type: string - state: - description: Contains the current 'state' of the challenge. If not set, the state of the challenge is unknown. - type: string - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - served: true - storage: true - subresources: - status: {} ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: clusterissuers.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: "cert-manager" - # Generated labels - app.kubernetes.io/version: "v1.12.2" -spec: - group: cert-manager.io - names: - kind: ClusterIssuer - listKind: ClusterIssuerList - plural: clusterissuers - singular: clusterissuer - categories: - - cert-manager - scope: Cluster - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. - type: object - required: - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Desired state of the ClusterIssuer resource. - type: object - properties: - acme: - description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. - type: object - required: - - privateKeySecretRef - - server - properties: - caBundle: - description: Base64-encoded bundle of PEM CAs which can be used to validate the certificate chain presented by the ACME server. Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. - type: string - format: byte - disableAccountKeyGeneration: - description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. - type: boolean - email: - description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. - type: string - enableDurationFeature: - description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. - type: boolean - externalAccountBinding: - description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. - type: object - required: - - keyID - - keySecretRef - properties: - keyAlgorithm: - description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' - type: string - enum: - - HS256 - - HS384 - - HS512 - keyID: - description: keyID is the ID of the CA key that the External Account is bound to. - type: string - keySecretRef: - description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - preferredChain: - description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' - type: string - maxLength: 64 - privateKeySecretRef: - description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - server: - description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' - type: string - skipTLSVerify: - description: 'INSECURE: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have the TLS certificate chain validated. Mutually exclusive with CABundle; prefer using CABundle to prevent various kinds of security vulnerabilities. Only enable this option in development environments. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. Defaults to false.' - type: boolean - solvers: - description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' - type: array - items: - description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. - type: object - properties: - dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. - type: object - properties: - acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. - type: object - required: - - accountSecretRef - - host - properties: - accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - host: - type: string - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - properties: - accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - serviceConsumerDomain: - type: string - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID - properties: - clientID: - description: if both this and ClientSecret are left unset MSI will be used - type: string - clientSecretSecretRef: - description: if both this and ClientID are left unset MSI will be used - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - environment: - description: name of the Azure environment (default AzurePublicCloud) - type: string - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID - type: object - properties: - clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID - type: string - resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID - type: string - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: when specifying ClientID and ClientSecret then this field is also needed - type: string - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project - properties: - hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - type: object - properties: - apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - email: - description: Email of the account, only required when using API key based authentication. - type: string - cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. - type: string - enum: - - None - - Follow - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef - properties: - tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. - type: object - required: - - nameserver - properties: - nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. - type: string - tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' - type: string - tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object - required: - - region - properties: - accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: string - accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: Always set the region when using AccessKeyID and SecretAccessKey - type: string - role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. - type: object - required: - - groupName - - solverName - properties: - config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. - type: string - solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. - type: string - http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object - properties: - gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. - type: object - properties: - labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. - type: object - additionalProperties: - type: string - parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' - type: array - items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." - type: object - required: - - name - properties: - group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" - type: string - default: gateway.networking.k8s.io - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - kind: - description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" - type: string - default: Gateway - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - name: - description: "Name is the name of the referent. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" - type: string - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " - type: integer - format: int32 - maximum: 65535 - minimum: 1 - sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object - properties: - class: - description: This field configures the annotation `kubernetes.io/ingress.class` when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - ingressClassName: - description: This field configures the field `ingressClassName` on the created Ingress resources used to solve ACME challenges that use this challenge solver. This is the recommended way of configuring the ingress class. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the create ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object - properties: - affinity: - description: If specified, the pod's scheduling constraints - type: object - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array - items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight - properties: - preference: - description: A node selector term, associated with the corresponding weight. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - type: array - items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - x-kubernetes-map-type: atomic - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - type: array - items: - description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - x-kubernetes-map-type: atomic - nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - additionalProperties: - type: string - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - type: array - items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object - properties: - effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer - format: int64 - value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. - type: object - properties: - dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. - type: object - additionalProperties: - type: string - ca: - description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. - type: object - required: - - secretName - properties: - crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. - type: array - items: - type: string - ocspServers: - description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". - type: array - items: - type: string - secretName: - description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. - type: string - selfSigned: - description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. - type: object - properties: - crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. - type: array - items: - type: string - vault: - description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. - type: object - required: - - auth - - path - - server - properties: - auth: - description: Auth configures how cert-manager authenticates with the Vault server. - type: object - properties: - appRole: - description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. - type: object - required: - - path - - roleId - - secretRef - properties: - path: - description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' - type: string - roleId: - description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. - type: string - secretRef: - description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - kubernetes: - description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. - type: object - required: - - role - properties: - mountPath: - description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. - type: string - role: - description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. - type: string - secretRef: - description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - serviceAccountRef: - description: A reference to a service account that will be used to request a bound token (also known as "projected token"). Compared to using "secretRef", using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. - type: object - required: - - name - properties: - name: - description: Name of the ServiceAccount used to request a token. - type: string - tokenSecretRef: - description: TokenSecretRef authenticates with Vault by presenting a token. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by Vault. Only used if using HTTPS to connect to Vault and ignored for HTTP connections. Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - type: string - format: byte - caBundleSecretRef: - description: Reference to a Secret containing a bundle of PEM-encoded CAs to use when verifying the certificate chain presented by Vault when using HTTPS. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - namespace: - description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' - type: string - path: - description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' - type: string - server: - description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' - type: string - venafi: - description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. - type: object - required: - - zone - properties: - cloud: - description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. - type: object - required: - - apiTokenSecretRef - properties: - apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - url: - description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". - type: string - tpp: - description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. - type: object - required: - - credentialsRef - - url - properties: - caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. - type: string - format: byte - credentialsRef: - description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. - type: object - required: - - name - properties: - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - url: - description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' - type: string - zone: - description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. - type: string - status: - description: Status of the ClusterIssuer. This is set and managed automatically. - type: object - properties: - acme: - description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. - type: object - properties: - lastPrivateKeyHash: - description: LastPrivateKeyHash is a hash of the private key associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer - type: string - lastRegisteredEmail: - description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer - type: string - uri: - description: URI is the unique account identifier, which can also be used to retrieve account details from the CA - type: string - conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. - type: array - items: - description: IssuerCondition contains condition information for an Issuer. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string - format: date-time - message: - description: Message is a human readable description of the details of the last transition, complementing reason. - type: string - observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. - type: integer - format: int64 - reason: - description: Reason is a brief machine readable explanation for the condition's last transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - served: true - storage: true ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: issuers.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: "cert-manager" - # Generated labels - app.kubernetes.io/version: "v1.12.2" -spec: - group: cert-manager.io - names: - kind: Issuer - listKind: IssuerList - plural: issuers - singular: issuer - categories: - - cert-manager - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. - type: object - required: - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Desired state of the Issuer resource. - type: object - properties: - acme: - description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. - type: object - required: - - privateKeySecretRef - - server - properties: - caBundle: - description: Base64-encoded bundle of PEM CAs which can be used to validate the certificate chain presented by the ACME server. Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. - type: string - format: byte - disableAccountKeyGeneration: - description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. - type: boolean - email: - description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. - type: string - enableDurationFeature: - description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. - type: boolean - externalAccountBinding: - description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. - type: object - required: - - keyID - - keySecretRef - properties: - keyAlgorithm: - description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' - type: string - enum: - - HS256 - - HS384 - - HS512 - keyID: - description: keyID is the ID of the CA key that the External Account is bound to. - type: string - keySecretRef: - description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - preferredChain: - description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' - type: string - maxLength: 64 - privateKeySecretRef: - description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - server: - description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' - type: string - skipTLSVerify: - description: 'INSECURE: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have the TLS certificate chain validated. Mutually exclusive with CABundle; prefer using CABundle to prevent various kinds of security vulnerabilities. Only enable this option in development environments. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. Defaults to false.' - type: boolean - solvers: - description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' - type: array - items: - description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. - type: object - properties: - dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. - type: object - properties: - acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. - type: object - required: - - accountSecretRef - - host - properties: - accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - host: - type: string - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - properties: - accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - serviceConsumerDomain: - type: string - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID - properties: - clientID: - description: if both this and ClientSecret are left unset MSI will be used - type: string - clientSecretSecretRef: - description: if both this and ClientID are left unset MSI will be used - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - environment: - description: name of the Azure environment (default AzurePublicCloud) - type: string - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID - type: object - properties: - clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID - type: string - resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID - type: string - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: when specifying ClientID and ClientSecret then this field is also needed - type: string - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project - properties: - hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - type: object - properties: - apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - email: - description: Email of the account, only required when using API key based authentication. - type: string - cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. - type: string - enum: - - None - - Follow - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef - properties: - tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. - type: object - required: - - nameserver - properties: - nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. - type: string - tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' - type: string - tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object - required: - - region - properties: - accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: string - accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: Always set the region when using AccessKeyID and SecretAccessKey - type: string - role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. - type: object - required: - - groupName - - solverName - properties: - config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. - type: string - solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. - type: string - http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object - properties: - gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. - type: object - properties: - labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. - type: object - additionalProperties: - type: string - parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' - type: array - items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." - type: object - required: - - name - properties: - group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" - type: string - default: gateway.networking.k8s.io - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - kind: - description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" - type: string - default: Gateway - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - name: - description: "Name is the name of the referent. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" - type: string - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " - type: integer - format: int32 - maximum: 65535 - minimum: 1 - sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object - properties: - class: - description: This field configures the annotation `kubernetes.io/ingress.class` when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - ingressClassName: - description: This field configures the field `ingressClassName` on the created Ingress resources used to solve ACME challenges that use this challenge solver. This is the recommended way of configuring the ingress class. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. Only one of `class`, `name` or `ingressClassName` may be specified. - type: string - podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the create ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object - properties: - affinity: - description: If specified, the pod's scheduling constraints - type: object - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array - items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight - properties: - preference: - description: A node selector term, associated with the corresponding weight. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - type: array - items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - x-kubernetes-map-type: atomic - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - type: array - items: - description: LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - x-kubernetes-map-type: atomic - nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - additionalProperties: - type: string - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - type: array - items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object - properties: - effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer - format: int64 - value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. - type: object - properties: - dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. - type: object - additionalProperties: - type: string - ca: - description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. - type: object - required: - - secretName - properties: - crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. - type: array - items: - type: string - ocspServers: - description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". - type: array - items: - type: string - secretName: - description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. - type: string - selfSigned: - description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. - type: object - properties: - crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. - type: array - items: - type: string - vault: - description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. - type: object - required: - - auth - - path - - server - properties: - auth: - description: Auth configures how cert-manager authenticates with the Vault server. - type: object - properties: - appRole: - description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. - type: object - required: - - path - - roleId - - secretRef - properties: - path: - description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' - type: string - roleId: - description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. - type: string - secretRef: - description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - kubernetes: - description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. - type: object - required: - - role - properties: - mountPath: - description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. - type: string - role: - description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. - type: string - secretRef: - description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - serviceAccountRef: - description: A reference to a service account that will be used to request a bound token (also known as "projected token"). Compared to using "secretRef", using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. - type: object - required: - - name - properties: - name: - description: Name of the ServiceAccount used to request a token. - type: string - tokenSecretRef: - description: TokenSecretRef authenticates with Vault by presenting a token. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by Vault. Only used if using HTTPS to connect to Vault and ignored for HTTP connections. Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - type: string - format: byte - caBundleSecretRef: - description: Reference to a Secret containing a bundle of PEM-encoded CAs to use when verifying the certificate chain presented by Vault when using HTTPS. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - namespace: - description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' - type: string - path: - description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' - type: string - server: - description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' - type: string - venafi: - description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. - type: object - required: - - zone - properties: - cloud: - description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. - type: object - required: - - apiTokenSecretRef - properties: - apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - url: - description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". - type: string - tpp: - description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. - type: object - required: - - credentialsRef - - url - properties: - caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. - type: string - format: byte - credentialsRef: - description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. - type: object - required: - - name - properties: - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - url: - description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' - type: string - zone: - description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. - type: string - status: - description: Status of the Issuer. This is set and managed automatically. - type: object - properties: - acme: - description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. - type: object - properties: - lastPrivateKeyHash: - description: LastPrivateKeyHash is a hash of the private key associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer - type: string - lastRegisteredEmail: - description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer - type: string - uri: - description: URI is the unique account identifier, which can also be used to retrieve account details from the CA - type: string - conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. - type: array - items: - description: IssuerCondition contains condition information for an Issuer. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string - format: date-time - message: - description: Message is a human readable description of the details of the last transition, complementing reason. - type: string - observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. - type: integer - format: int64 - reason: - description: Reason is a brief machine readable explanation for the condition's last transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - served: true - storage: true ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: orders.acme.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.12.2" -spec: - group: acme.cert-manager.io - names: - kind: Order - listKind: OrderList - plural: orders - singular: order - categories: - - cert-manager - - cert-manager-acme - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: Order is a type to represent an Order with an ACME server - type: object - required: - - metadata - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - type: object - required: - - issuerRef - - request - properties: - commonName: - description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR. - type: string - dnsNames: - description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. - type: array - items: - type: string - duration: - description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec. - type: string - ipAddresses: - description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. - type: array - items: - type: string - issuerRef: - description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - request: - description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order. - type: string - format: byte - status: - type: object - properties: - authorizations: - description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order. - type: array - items: - description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource. - type: object - required: - - url - properties: - challenges: - description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process. - type: array - items: - description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process. - type: object - required: - - token - - type - - url - properties: - token: - description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented. - type: string - type: - description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored. - type: string - url: - description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server. - type: string - identifier: - description: Identifier is the DNS name to be validated as part of this authorization - type: string - initialState: - description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created. - type: string - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - url: - description: URL is the URL of the Authorization that must be completed - type: string - wildcard: - description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'. - type: boolean - certificate: - description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state. - type: string - format: byte - failureTime: - description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off. - type: string - format: date-time - finalizeURL: - description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed. - type: string - reason: - description: Reason optionally provides more information about a why the order is in the current state. - type: string - state: - description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final' - type: string - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - url: - description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set. - type: string - served: true - storage: true diff --git a/packages/cert-manager/dev/values.yaml b/packages/cert-manager/dev/values.yaml deleted file mode 100644 index ef2c2e1e9..000000000 --- a/packages/cert-manager/dev/values.yaml +++ /dev/null @@ -1,4 +0,0 @@ -installCRDs: true -global: - leaderElection: - namespace: cert-manager diff --git a/packages/cert-manager/path-routing/cluster-secret-store.yaml b/packages/cert-manager/path-routing/cluster-secret-store.yaml new file mode 100644 index 000000000..355626323 --- /dev/null +++ b/packages/cert-manager/path-routing/cluster-secret-store.yaml @@ -0,0 +1,60 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: eso-store + namespace: cert-manager +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: cert-manager + name: eso-store +rules: + - apiGroups: [""] + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - authorization.k8s.io + resources: + - selfsubjectrulesreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: eso-store + namespace: cert-manager +subjects: + - kind: ServiceAccount + name: eso-store + namespace: cert-manager +roleRef: + kind: Role + name: eso-store + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: default-cert + annotations: + # argocd.argoproj.io/sync-wave: "60" +spec: + provider: + kubernetes: + remoteNamespace: cert-manager + server: + caProvider: + type: ConfigMap + name: kube-root-ca.crt + namespace: cert-manager + key: ca.crt + auth: + serviceAccount: + name: eso-store + namespace: cert-manager \ No newline at end of file diff --git a/packages/cert-manager/values.yaml b/packages/cert-manager/values.yaml new file mode 100644 index 000000000..ef27fd736 --- /dev/null +++ b/packages/cert-manager/values.yaml @@ -0,0 +1,38 @@ +installCRDs: true +global: + leaderElection: + namespace: cert-manager +extraObjects: + - | + apiVersion: cert-manager.io/v1 + kind: ClusterIssuer + metadata: + name: letsencrypt-prod + spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + ingressClassName: nginx + - | + {{ if eq .Values.global.pathRouting "true"}} + # This resource is to create default certificate of the base domain + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + name: default-cert + namespace: cert-manager + annotations: + argocd.argoproj.io/sync-wave: "1" + spec: + secretName: default-tls-prod + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + dnsNames: + - {{ .Values.global.domainName }} + {{ end }} + \ No newline at end of file diff --git a/packages/crossplane-aws-upbound/values.yaml b/packages/crossplane-aws-upbound/values.yaml new file mode 100644 index 000000000..9292e4d74 --- /dev/null +++ b/packages/crossplane-aws-upbound/values.yaml @@ -0,0 +1,52 @@ +# Ref: https://github.com/gitops-bridge-dev/gitops-bridge-helm-charts/tree/main/charts +global: + enabled_aws_upbound: true + +deploymentRuntimeConfig: + enabled: true + metadata: + name: "upbound-aws-runtime-config" + role_arn: "" + annotations: {} + labels: {} + spec: + deploymentTemplate: + spec: + selector: {} + template: + spec: + containers: + - name: package-runtime + args: + - --debug + securityContext: + fsGroup: 2000 + serviceAccountTemplate: + metadata: + annotations: {} + labels: {} + name: provider-aws + +provider: + enabled: true + metadata: + annotations: {} + labels: {} + package: + registry: xpkg.crossplane.io/crossplane-contrib + version: v1.23.0 + +providerConfig: + enabled: true + default: true + metadata: + name: "aws-provider-config" + annotations: {} + labels: {} + spec: + credentials: + source: PodIdentity + +providers: +- dynamodb +- s3 diff --git a/packages/crossplane-compositions/base/kustomization.yaml b/packages/crossplane-compositions/base/kustomization.yaml deleted file mode 100644 index 3f1ca64d0..000000000 --- a/packages/crossplane-compositions/base/kustomization.yaml +++ /dev/null @@ -1,3 +0,0 @@ -namespace: crossplane-system -resources: - - https://github.com/awslabs/crossplane-on-eks/compositions/upbound-aws-provider/s3 diff --git a/packages/crossplane-compositions/base/provider-aws-config.yaml b/packages/crossplane-compositions/base/provider-aws-config.yaml deleted file mode 100644 index 42789b3f9..000000000 --- a/packages/crossplane-compositions/base/provider-aws-config.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: aws.upbound.io/v1beta1 -kind: ProviderConfig -metadata: - name: provider-aws-config -spec: - credentials: - source: IRSA diff --git a/packages/crossplane-compositions/base/provider-aws.yaml b/packages/crossplane-compositions/base/provider-aws.yaml deleted file mode 100644 index 240822e66..000000000 --- a/packages/crossplane-compositions/base/provider-aws.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-aws-s3 -spec: - package: xpkg.upbound.io/upbound/provider-aws-s3:v0.41.0 - controllerConfigRef: - name: provider-aws-config diff --git a/packages/crossplane-compositions/kustomization.yaml b/packages/crossplane-compositions/kustomization.yaml new file mode 100644 index 000000000..36574aa11 --- /dev/null +++ b/packages/crossplane-compositions/kustomization.yaml @@ -0,0 +1,7 @@ +namespace: crossplane-system +resources: + - s3 + +commonAnnotations: + argocd.argoproj.io/compare-options: ServerSideDiff=true + \ No newline at end of file diff --git a/packages/crossplane-compositions/s3/definition.yaml b/packages/crossplane-compositions/s3/definition.yaml new file mode 100644 index 000000000..12daa7fe0 --- /dev/null +++ b/packages/crossplane-compositions/s3/definition.yaml @@ -0,0 +1,63 @@ +# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +# SPDX-License-Identifier: Apache-2.0 + +apiVersion: apiextensions.crossplane.io/v1 +kind: CompositeResourceDefinition +metadata: + name: xobjectstorages.awsblueprints.io +spec: + claimNames: + kind: ObjectStorage + plural: objectstorages + group: awsblueprints.io + names: + kind: XObjectStorage + plural: xobjectstorages + versions: + - name: v1alpha1 + served: true + referenceable: true + schema: + openAPIV3Schema: + properties: + spec: + description: ObjectStorageSpec defines the desired state of ObjectStorage + properties: + resourceConfig: + description: ResourceConfig defines general properties of this AWS + resource. + properties: + deletionPolicy: + description: Defaults to Delete + enum: + - Delete + - Orphan + type: string + name: + description: Set the name of this resource in AWS to the value + provided by this field. + type: string + providerConfigName: + type: string + region: + type: string + tags: + additionalProperties: + type: string + type: object + required: + - providerConfigName + - region + type: object + required: + - resourceConfig + type: object + status: + description: ObjectStorageStatus defines the observed state of ObjectStorage + properties: + bucketName: + type: string + bucketArn: + type: string + type: object + type: object diff --git a/packages/crossplane-compositions/s3/general-purpose.yaml b/packages/crossplane-compositions/s3/general-purpose.yaml new file mode 100644 index 000000000..c1b40ad6d --- /dev/null +++ b/packages/crossplane-compositions/s3/general-purpose.yaml @@ -0,0 +1,129 @@ +# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +# SPDX-License-Identifier: Apache-2.0 + +apiVersion: apiextensions.crossplane.io/v1 +kind: Composition +metadata: + name: s3bucket.awsblueprints.io + labels: + awsblueprints.io/provider: aws + awsblueprints.io/environment: dev + s3.awsblueprints.io/configuration: standard +spec: + writeConnectionSecretsToNamespace: crossplane-system + compositeTypeRef: + apiVersion: awsblueprints.io/v1alpha1 + kind: XObjectStorage + patchSets: + - name: common-fields + patches: + - type: FromCompositeFieldPath + fromFieldPath: spec.resourceConfig.deletionPolicy + toFieldPath: spec.deletionPolicy + - type: FromCompositeFieldPath + fromFieldPath: spec.resourceConfig.region + toFieldPath: spec.forProvider.region + - type: FromCompositeFieldPath + fromFieldPath: spec.resourceConfig.providerConfigName + toFieldPath: spec.providerConfigRef.name + - type: FromCompositeFieldPath + fromFieldPath: spec.resourceConfig.tags + toFieldPath: spec.forProvider.tags + policy: + mergeOptions: + keepMapValues: true + - type: FromCompositeFieldPath + fromFieldPath: spec.resourceConfig.name + toFieldPath: metadata.annotations[crossplane.io/external-name] + - fromFieldPath: "metadata.name" + toFieldPath: "metadata.name" + transforms: + - type: string + string: + fmt: "bucket-%s" + type: Format + type: FromCompositeFieldPath + resources: + - name: s3-bucket + connectionDetails: + - type: FromFieldPath + name: bucketName + fromFieldPath: status.atProvider.id + base: + apiVersion: s3.aws.upbound.io/v1beta1 + kind: Bucket + spec: + deletionPolicy: Delete + forProvider: + region: us-west-2 + forceDestroy: true # be careful with this + writeConnectionSecretToRef: + namespace: crossplane-system + patches: + - type: PatchSet + patchSetName: common-fields + - type: ToCompositeFieldPath + fromFieldPath: status.atProvider.id + toFieldPath: status.bucketName + - type: ToCompositeFieldPath + fromFieldPath: status.atProvider.id + toFieldPath: status.bucketArn + transforms: + - type: string + string: + fmt: "arn:aws:s3:::%s" + type: Format + readinessChecks: + - matchCondition: + status: 'True' + type: Ready + type: MatchCondition + - name: s3-blockpublicaccess + base: + apiVersion: s3.aws.upbound.io/v1beta1 + kind: BucketPublicAccessBlock + spec: + deletionPolicy: Delete + forProvider: + bucketSelector: + matchControllerRef: true + blockPublicAcls: true + blockPublicPolicy: true + ignorePublicAcls: true + restrictPublicBuckets: true + patches: + - fromFieldPath: spec.resourceConfig.region + toFieldPath: spec.forProvider.region + type: FromCompositeFieldPath + - fromFieldPath: spec.resourceConfig.providerConfigName + toFieldPath: spec.providerConfigRef.name + type: FromCompositeFieldPath + readinessChecks: + - matchCondition: + status: 'True' + type: Ready + type: MatchCondition + - name: s3-serversideencryption + base: + apiVersion: s3.aws.upbound.io/v1beta1 + kind: BucketServerSideEncryptionConfiguration + spec: + deletionPolicy: Delete + forProvider: + bucketSelector: + matchControllerRef: true + rule: + - applyServerSideEncryptionByDefault: + - sseAlgorithm: AES256 + patches: + - fromFieldPath: spec.resourceConfig.providerConfigName + toFieldPath: spec.providerConfigRef.name + type: FromCompositeFieldPath + - fromFieldPath: spec.resourceConfig.region + toFieldPath: spec.forProvider.region + type: FromCompositeFieldPath + readinessChecks: + - matchCondition: + status: 'True' + type: Ready + type: MatchCondition diff --git a/packages/crossplane-compositions/s3/kustomization.yaml b/packages/crossplane-compositions/s3/kustomization.yaml new file mode 100644 index 000000000..2f9fb9565 --- /dev/null +++ b/packages/crossplane-compositions/s3/kustomization.yaml @@ -0,0 +1,3 @@ +resources: + - definition.yaml + - general-purpose.yaml \ No newline at end of file diff --git a/packages/crossplane/base/kustomization.yaml b/packages/crossplane/base/kustomization.yaml deleted file mode 100644 index 8aac27668..000000000 --- a/packages/crossplane/base/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -namespace: crossplane-system -resources: - - provider-aws.yaml - - provider-aws-config.yaml diff --git a/packages/crossplane/base/provider-aws-config.yaml b/packages/crossplane/base/provider-aws-config.yaml deleted file mode 100644 index e053859e1..000000000 --- a/packages/crossplane/base/provider-aws-config.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: aws.upbound.io/v1beta1 -kind: ProviderConfig -metadata: - name: provider-aws-config - annotations: - argocd.argoproj.io/sync-wave: "20" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - credentials: - source: IRSA diff --git a/packages/crossplane/base/provider-aws.yaml b/packages/crossplane/base/provider-aws.yaml deleted file mode 100644 index 3578c229d..000000000 --- a/packages/crossplane/base/provider-aws.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: provider-family-aws -spec: - package: xpkg.upbound.io/upbound/provider-family-aws:v0.41.0 - ---- -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-aws-s3 - annotations: - argocd.argoproj.io/sync-wave: "10" -spec: - package: xpkg.upbound.io/upbound/provider-aws-s3:v0.41.0 - controllerConfigRef: - name: provider-aws-config diff --git a/packages/crossplane/dev/kustomization.yaml b/packages/crossplane/dev/kustomization.yaml deleted file mode 100644 index 6f69d81f4..000000000 --- a/packages/crossplane/dev/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: - - ../base diff --git a/packages/crossplane/dev/values.yaml b/packages/crossplane/dev/values.yaml deleted file mode 100644 index 28a80497a..000000000 --- a/packages/crossplane/dev/values.yaml +++ /dev/null @@ -1,3 +0,0 @@ -args: - - --debug - - --enable-environment-configs diff --git a/packages/crossplane/values.yaml b/packages/crossplane/values.yaml new file mode 100644 index 000000000..fe0466353 --- /dev/null +++ b/packages/crossplane/values.yaml @@ -0,0 +1,2 @@ +args: + - --debug diff --git a/packages/external-dns/dev/values.yaml b/packages/external-dns/values.yaml similarity index 100% rename from packages/external-dns/dev/values.yaml rename to packages/external-dns/values.yaml diff --git a/packages/external-secrets/manifests/cluster-secret-store.yaml b/packages/external-secrets/manifests/cluster-secret-store.yaml new file mode 100644 index 000000000..ea97ec221 --- /dev/null +++ b/packages/external-secrets/manifests/cluster-secret-store.yaml @@ -0,0 +1,9 @@ +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: aws-secretsmanager +spec: + provider: + aws: + service: SecretsManager + region: us-west-2 \ No newline at end of file diff --git a/packages/external-secrets/dev/values.yaml b/packages/external-secrets/values.yaml similarity index 100% rename from packages/external-secrets/dev/values.yaml rename to packages/external-secrets/values.yaml diff --git a/packages/ingress-nginx/dev/values.yaml b/packages/ingress-nginx/values.yaml similarity index 72% rename from packages/ingress-nginx/dev/values.yaml rename to packages/ingress-nginx/values.yaml index 387e01b4b..95ea2e473 100644 --- a/packages/ingress-nginx/dev/values.yaml +++ b/packages/ingress-nginx/values.yaml @@ -4,6 +4,8 @@ controller: service: type: LoadBalancer annotations: + argocd.argoproj.io/sync-wave: '-1' # Adding to ensure service is created before actual deployment + service.beta.kubernetes.io/aws-load-balancer-internal: 'false' service.beta.kubernetes.io/aws-load-balancer-name: cnoe service.beta.kubernetes.io/aws-load-balancer-type: external service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing diff --git a/packages/keycloak/base/install.yaml b/packages/keycloak/base/install.yaml deleted file mode 100644 index 8d7ec4fc2..000000000 --- a/packages/keycloak/base/install.yaml +++ /dev/null @@ -1,49 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: keycloak - labels: - app: keycloak -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - selector: - app: keycloak - type: LoadBalancer ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: keycloak - labels: - app: keycloak -spec: - replicas: 1 - selector: - matchLabels: - app: keycloak - template: - metadata: - labels: - app: keycloak - spec: - containers: - - name: keycloak - image: quay.io/keycloak/keycloak:22.0.0 - args: ["start-dev"] - env: - - name: KEYCLOAK_ADMIN - value: "admin" - - name: KEYCLOAK_ADMIN_PASSWORD - value: "admin" - - name: KC_PROXY - value: "edge" - ports: - - name: http - containerPort: 8080 - readinessProbe: - httpGet: - path: /realms/master - port: 8080 diff --git a/packages/keycloak/base/kustomization.yaml b/packages/keycloak/base/kustomization.yaml deleted file mode 100644 index 4283b9254..000000000 --- a/packages/keycloak/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: - - install.yaml \ No newline at end of file diff --git a/packages/keycloak/dev-external-secrets/external-secrets.yaml b/packages/keycloak/dev-external-secrets/external-secrets.yaml deleted file mode 100644 index aef8d9354..000000000 --- a/packages/keycloak/dev-external-secrets/external-secrets.yaml +++ /dev/null @@ -1,70 +0,0 @@ ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: keycloak-config - namespace: keycloak -spec: - refreshInterval: 5m - secretStoreRef: - name: keycloak - kind: SecretStore - target: - name: keycloak-config - creationPolicy: Owner - data: - - secretKey: KC_HOSTNAME - remoteRef: - key: cnoe/keycloak/config - property: KC_HOSTNAME - - secretKey: KEYCLOAK_ADMIN_PASSWORD - remoteRef: - key: cnoe/keycloak/config - property: KEYCLOAK_ADMIN_PASSWORD - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: postgresql-config - namespace: keycloak -spec: - refreshInterval: 5m - secretStoreRef: - name: keycloak - kind: SecretStore - target: - name: postgresql-config - creationPolicy: Owner - data: - - secretKey: POSTGRES_DB - remoteRef: - key: cnoe/keycloak/config - property: POSTGRES_DB - - secretKey: POSTGRES_PASSWORD - remoteRef: - key: cnoe/keycloak/config - property: POSTGRES_PASSWORD - - secretKey: POSTGRES_USER - remoteRef: - key: cnoe/keycloak/config - property: POSTGRES_USER ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: keycloak-user-config - namespace: keycloak -spec: - refreshInterval: 5m - secretStoreRef: - name: keycloak - kind: SecretStore - target: - name: keycloak-user-config - creationPolicy: Owner - data: - - secretKey: user1-password - remoteRef: - key: cnoe/keycloak/config - property: user1-password diff --git a/packages/keycloak/dev-external-secrets/kustomization.yaml b/packages/keycloak/dev-external-secrets/kustomization.yaml deleted file mode 100644 index f2c8a5582..000000000 --- a/packages/keycloak/dev-external-secrets/kustomization.yaml +++ /dev/null @@ -1,3 +0,0 @@ -resources: - - ../dev - - external-secrets.yaml diff --git a/packages/keycloak/dev/cm-config.yaml b/packages/keycloak/dev/cm-config.yaml deleted file mode 100644 index 902c80d55..000000000 --- a/packages/keycloak/dev/cm-config.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: keycloak-config -data: - keycloak.conf: | - # Database - # The database vendor. - db=postgres - - # The username of the database user. - db-username=keycloak - db-url-host=postgresql.keycloak - - # Observability - - # If the server should expose healthcheck endpoints. - #health-enabled=true - - # If the server should expose metrics endpoints. - #metrics-enabled=true - - # The proxy address forwarding mode if the server is behind a reverse proxy. - proxy=edge - - hostname-strict-backchannel=true diff --git a/packages/keycloak/dev/kustomization.yaml b/packages/keycloak/dev/kustomization.yaml deleted file mode 100644 index 7b48966e9..000000000 --- a/packages/keycloak/dev/kustomization.yaml +++ /dev/null @@ -1,19 +0,0 @@ -resources: - - ../base - - ns.yaml - - cm-config.yaml - - postgres.yaml -namespace: keycloak -patchesStrategicMerge: - - patches/service.yaml - - patches/deployment.yaml -patchesJson6902: - - target: - version: v1 - kind: Deployment - group: apps - name: keycloak - namespace: keycloak - patch: |- - - op: remove - path: /spec/template/spec/containers/0/env/2 diff --git a/packages/keycloak/dev/ns.yaml b/packages/keycloak/dev/ns.yaml deleted file mode 100644 index 80e7888e0..000000000 --- a/packages/keycloak/dev/ns.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: keycloak diff --git a/packages/keycloak/dev/patches/deployment.yaml b/packages/keycloak/dev/patches/deployment.yaml deleted file mode 100644 index 8f07c85b6..000000000 --- a/packages/keycloak/dev/patches/deployment.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: keycloak - labels: - app: keycloak -spec: - replicas: 1 - selector: - matchLabels: - app: keycloak - template: - metadata: - labels: - app: keycloak - spec: - volumes: - - name: keycloak-config - configMap: - name: keycloak-config - containers: - - name: keycloak - env: - - name: KEYCLOAK_ADMIN - value: 'cnoe-admin' - - name: KC_DB_PASSWORD - valueFrom: - secretKeyRef: - name: postgresql-config - key: POSTGRES_PASSWORD - envFrom: - - secretRef: - name: keycloak-config - args: - - start - volumeMounts: - - name: keycloak-config - mountPath: "/opt/keycloak/conf" - readOnly: true diff --git a/packages/keycloak/dev/patches/service.yaml b/packages/keycloak/dev/patches/service.yaml deleted file mode 100644 index df374f686..000000000 --- a/packages/keycloak/dev/patches/service.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: keycloak -spec: - type: ClusterIP diff --git a/packages/keycloak/dev/postgres.yaml b/packages/keycloak/dev/postgres.yaml deleted file mode 100644 index 774dac9db..000000000 --- a/packages/keycloak/dev/postgres.yaml +++ /dev/null @@ -1,73 +0,0 @@ -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - name: postgresql - namespace: keycloak - labels: - app: postgresql -spec: - storageClassName: gp2 - capacity: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: postgresql - namespace: keycloak - labels: - app: postgresql -spec: - serviceName: service-postgresql - replicas: 1 - selector: - matchLabels: - app: postgresql - template: - metadata: - labels: - app: postgresql - spec: - containers: - - name: postgres - resources: - limits: - memory: 500Mi - requests: - cpu: 100m - memory: 300Mi - image: docker.io/library/postgres:15.3-alpine3.18 - envFrom: - - secretRef: - name: postgresql-config - ports: - - containerPort: 5432 - name: postgresdb - volumeMounts: - - name: data - mountPath: /var/lib/postgresql/data - subPath: postgress - volumes: - - name: data - persistentVolumeClaim: - claimName: postgresql - ---- -apiVersion: v1 -kind: Service -metadata: - name: postgresql - namespace: keycloak - labels: - app: postgresql -spec: - ports: - - port: 5432 - name: postgres - clusterIP: None - selector: - app: postgresql diff --git a/packages/keycloak/dev/service-admin.yaml b/packages/keycloak/dev/service-admin.yaml deleted file mode 100644 index 23cf5fb5f..000000000 --- a/packages/keycloak/dev/service-admin.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# apiVersion: v1 -# kind: Service -# metadata: -# name: keycloak-admin -# labels: -# app: keycloak -# spec: -# ports: -# - name: http -# port: 8080 -# targetPort: 8080 -# selector: -# app: keycloak -# type: ClusterIP -# --- -# apiVersion: v1 -# kind: Service -# metadata: -# name: keycloak-dummy -# labels: -# app: keycloak -# spec: -# ports: -# - name: dummy -# port: 8081 -# targetPort: 8081 -# selector: -# app: keycloak -# type: ClusterIP \ No newline at end of file diff --git a/packages/keycloak/manifests/external-secrets.yaml b/packages/keycloak/manifests/external-secrets.yaml new file mode 100644 index 000000000..5cc15b7e4 --- /dev/null +++ b/packages/keycloak/manifests/external-secrets.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: keycloak-config + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "-10" +spec: + refreshInterval: "0" + secretStoreRef: + name: aws-secretsmanager + kind: ClusterSecretStore + target: + name: keycloak-config + template: + data: + # ARGO_CD_SESSION_URL: "http://argocd-server.argocd.svc.cluster.local:443{{ if .pathRouting }}/argocd{{ end }}/api/v1/session" + KEYCLOAK_URL: "http://keycloak.keycloak.svc.cluster.local{{ if .pathRouting }}/keycloak{{ end }}" + POSTGRES_PASSWORD: "{{ .postgresPassword }}" + KEYCLOAK_ADMIN_PASSWORD: "{{ .keycloakAdminPassword }}" + USER1_PASSWORD: "{{ .keycloakUserPassword }}" + ARGO_CD_URL: "{{ if .pathRouting }}{{ .domainName }}/argocd{{ else }}argocd.{{ .domainName }}{{ end }}" + BACKSTAGE_URL: "{{ if .pathRouting }}{{ .domainName }}{{ else }}backstage.{{ .domainName }}{{ end }}" + ARGO_WORKFLOW_URL: "{{ if .pathRouting }}{{ .domainName }}/argo-workflows{{ else }}argo-workflows.{{ .domainName }}{{ end }}" + dataFrom: + - sourceRef: + generatorRef: + apiVersion: generators.external-secrets.io/v1alpha1 + kind: Password + name: "postgres-keycloak-password" + rewrite: + - transform: + template: "postgresPassword" + - sourceRef: + generatorRef: + apiVersion: generators.external-secrets.io/v1alpha1 + kind: Password + name: "postgres-keycloak-password" + rewrite: + - transform: + template: "keycloakAdminPassword" + - sourceRef: + generatorRef: + apiVersion: generators.external-secrets.io/v1alpha1 + kind: Password + name: "keycloak-user-password" + rewrite: + - transform: + template: "keycloakUserPassword" + data: + - secretKey: domainName + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: domain + - secretKey: pathRouting + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: cnoe-ref-impl/config + metadataPolicy: None + property: path_routing +--- +apiVersion: generators.external-secrets.io/v1alpha1 +kind: Password +metadata: + name: postgres-keycloak-password + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "-20" +spec: + length: 32 + digits: 5 + symbols: 5 + symbolCharacters: "/-+" + noUpper: false + allowRepeat: true +--- +apiVersion: generators.external-secrets.io/v1alpha1 +kind: Password +metadata: + name: keycloak-user-password + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "-20" +spec: + length: 32 + digits: 5 + symbols: 5 + symbolCharacters: "-" # No Special character as Argo CD does not support it. + noUpper: false + allowRepeat: true diff --git a/packages/keycloak/manifests/keycloak-cluster-secret-store.yaml b/packages/keycloak/manifests/keycloak-cluster-secret-store.yaml new file mode 100644 index 000000000..6013797a2 --- /dev/null +++ b/packages/keycloak/manifests/keycloak-cluster-secret-store.yaml @@ -0,0 +1,60 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: eso-store + namespace: keycloak +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: keycloak + name: eso-store +rules: + - apiGroups: [""] + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - authorization.k8s.io + resources: + - selfsubjectrulesreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: eso-store + namespace: keycloak +subjects: + - kind: ServiceAccount + name: eso-store + namespace: keycloak +roleRef: + kind: Role + name: eso-store + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: keycloak + annotations: + argocd.argoproj.io/sync-wave: "60" +spec: + provider: + kubernetes: + remoteNamespace: keycloak + server: + caProvider: + type: ConfigMap + name: kube-root-ca.crt + namespace: keycloak + key: ca.crt + auth: + serviceAccount: + name: eso-store + namespace: keycloak \ No newline at end of file diff --git a/packages/keycloak/manifests/user-sso-config-job.yaml b/packages/keycloak/manifests/user-sso-config-job.yaml new file mode 100644 index 000000000..c743f29c0 --- /dev/null +++ b/packages/keycloak/manifests/user-sso-config-job.yaml @@ -0,0 +1,430 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: keycloak-config + namespace: keycloak +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "create", "update", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: keycloak-config + namespace: keycloak +subjects: + - kind: ServiceAccount + name: keycloak-config + namespace: keycloak +roleRef: + kind: Role + name: keycloak-config + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: keycloak-config + namespace: argocd +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: keycloak-config + namespace: argocd +subjects: + - kind: ServiceAccount + name: keycloak-config + namespace: keycloak +roleRef: + kind: Role + name: keycloak-config + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: keycloak-config-job + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "40" +data: + client-scope-groups-payload.json: | + { + "name": "groups", + "description": "groups a user belongs to", + "attributes": { + "consent.screen.text": "Access to groups a user belongs to.", + "display.on.consent.screen": "true", + "include.in.token.scope": "true", + "gui.order": "" + }, + "type": "default", + "protocol": "openid-connect" + } + group-admin-payload.json: | + {"name":"admin"} + group-base-user-payload.json: | + {"name":"base-user"} + group-mapper-payload.json: | + { + "protocol": "openid-connect", + "protocolMapper": "oidc-group-membership-mapper", + "name": "groups", + "config": { + "claim.name": "groups", + "full.path": "false", + "id.token.claim": "true", + "access.token.claim": "true", + "userinfo.token.claim": "true" + } + } + user1-payload.json: | + { + "username": "user1", + "email": "", + "firstName": "user", + "lastName": "one", + "requiredActions": [], + "emailVerified": false, + "groups": [ + "/admin" + ], + "enabled": true, + "credentials": + [ + { + "type": "password", + "value": "${USER1_PASSWORD}", + "temporary": false + } + ] + } + user2-payload.json: | + { + "username": "user2", + "email": "", + "firstName": "user", + "lastName": "two", + "requiredActions": [], + "emailVerified": false, + "groups": [ + "/base-user" + ], + "enabled": true, + "credentials": [ + { + "type": "password", + "value": "${USER1_PASSWORD}", + "temporary": false + } + ] + } + argocd-client-payload.json: | + { + "protocol": "openid-connect", + "clientId": "argocd", + "name": "ArgoCD Client", + "description": "Used for ArgoCD SSO", + "publicClient": true, + "authorizationServicesEnabled": false, + "serviceAccountsEnabled": false, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "standardFlowEnabled": true, + "frontchannelLogout": true, + "attributes": { + "saml_idp_initiated_sso_url_name": "", + "oauth2.device.authorization.grant.enabled": false, + "oidc.ciba.grant.enabled": false + }, + "alwaysDisplayInConsole": false, + "rootUrl": "https://${ARGO_CD_URL}", + "baseUrl": "/applications", + "redirectUris": [ + "https://${ARGO_CD_URL}/auth/callback", + "https://${ARGO_CD_URL}/pkce/verify", + "http://localhost:8085/auth/callback" + ], + "adminUrl": "https://${ARGO_CD_URL}", + "webOrigins": [ + "https://${ARGO_CD_URL}" + ] + } + backstage-client-payload.json: | + { + "protocol": "openid-connect", + "clientId": "backstage", + "name": "Backstage Client", + "description": "Used for Backstage SSO", + "publicClient": false, + "authorizationServicesEnabled": false, + "serviceAccountsEnabled": false, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "standardFlowEnabled": true, + "frontchannelLogout": true, + "attributes": { + "saml_idp_initiated_sso_url_name": "", + "oauth2.device.authorization.grant.enabled": false, + "oidc.ciba.grant.enabled": false + }, + "alwaysDisplayInConsole": false, + "rootUrl": "", + "baseUrl": "", + "redirectUris": [ + "https://${BACKSTAGE_URL}/api/auth/keycloak-oidc/handler/frame" + ], + "webOrigins": [ + "https://${BACKSTAGE_URL}" + ] + } + argo-client-payload.json: | + { + "protocol": "openid-connect", + "clientId": "argo-workflows", + "name": "Argo Workflows Client", + "description": "Used for Argo Workflows SSO", + "publicClient": false, + "authorizationServicesEnabled": false, + "serviceAccountsEnabled": false, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "standardFlowEnabled": true, + "frontchannelLogout": true, + "attributes": { + "saml_idp_initiated_sso_url_name": "", + "oauth2.device.authorization.grant.enabled": false, + "oidc.ciba.grant.enabled": false + }, + "alwaysDisplayInConsole": false, + "rootUrl": "", + "baseUrl": "", + "redirectUris": [ + "https://${ARGO_WORKFLOW_URL}/oauth2/callback" + ], + "webOrigins": [ + "https://${ARGO_WORKFLOW_URL}" + ] + } +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: keycloak-config + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "50" +spec: + template: + metadata: + generateName: keycloak-config + spec: + serviceAccountName: keycloak-config + restartPolicy: Never + volumes: + - name: config-payloads + configMap: + name: keycloak-config-job + containers: + - name: keycloak-config + image: docker.io/library/ubuntu:22.04 + volumeMounts: + - name: config-payloads + readOnly: true + mountPath: "/var/config/" + envFrom: + - secretRef: + name: keycloak-config + command: ["/bin/bash", "-c"] + args: + - | + #! /bin/bash + set -ex -o pipefail + apt -qq update && apt -qq install curl jq gettext-base -y + + # Define helper functions + keycloak_post() { + local endpoint=$1 + local payload=$2 + local resource_name=$3 + + envsubst < ${payload} > /tmp/payload-env.json + + HTTP_STATUS=$(curl -sS -w "%{http_code}" -o /tmp/response.txt -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/tmp/payload-env.json \ + ${KEYCLOAK_URL}${endpoint}) + + if [ "$HTTP_STATUS" -eq 409 ]; then + echo "${resource_name} already exists, continuing..." + elif [ "$HTTP_STATUS" -ne 201 ] && [ "$HTTP_STATUS" -ne 200 ]; then + echo "Error creating ${resource_name}: HTTP status $HTTP_STATUS" + cat /tmp/response.txt + fi + } + + keycloak_put() { + local endpoint=$1 + local resource_name=$2 + + HTTP_STATUS=$(curl -sS -w "%{http_code}" -o /tmp/response.txt -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X PUT ${KEYCLOAK_URL}${endpoint}) + + if [ "$HTTP_STATUS" -ne 204 ] && [ "$HTTP_STATUS" -ne 200 ]; then + echo "Error updating ${resource_name}: HTTP status $HTTP_STATUS" + cat /tmp/response.txt + fi + } + + keycloak_get() { + local endpoint=$1 + local jq_filter=$2 + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X GET ${KEYCLOAK_URL}${endpoint} | jq -e -r "${jq_filter}" + } + + # Get Keycloak token for initial Admin user + # ADMIN_PASSWORD=$(cat /var/secrets/KEYCLOAK_ADMIN_PASSWORD) + # USER1_PASSWORD=$(cat /var/secrets/USER1_PASSWORD) + HTTP_STATUS=$(curl -sS -w "%{http_code}" -o /tmp/response.txt -X POST -H "Content-Type: application/x-www-form-urlencoded" \ + --data-urlencode "username=cnoe-admin" \ + --data-urlencode "password=${KEYCLOAK_ADMIN_PASSWORD}" \ + --data-urlencode "grant_type=password" \ + --data-urlencode "client_id=admin-cli" \ + ${KEYCLOAK_URL}/realms/cnoe/protocol/openid-connect/token) + if [ "$HTTP_STATUS" -ne 200 ]; then + echo "Error getting Keycloak token: HTTP status $HTTP_STATUS" + cat /tmp/response.txt + exit 1 + fi + KEYCLOAK_TOKEN=$(cat /tmp/response.txt | jq -e -r '.access_token') + + HTTP_STATUS=$(curl -sS -w "%{http_code}" -o /tmp/response.txt -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe") + if [ "$HTTP_STATUS" -ne 200 ]; then + echo "Error validating Keycloak token: HTTP status $HTTP_STATUS" + cat /tmp/response.txt + exit 1 + fi + + # Download kubectl + curl -sS -LO "https://dl.k8s.io/release/v1.28.3//bin/linux/amd64/kubectl" + chmod +x kubectl + + echo "creating client scopes" + keycloak_post "/admin/realms/cnoe/client-scopes" "/var/config/client-scope-groups-payload.json" "Client scope" + + echo "creating admin group" + keycloak_post "/admin/realms/cnoe/groups" "/var/config/group-admin-payload.json" "Admin group" + + echo "creating base-user group" + keycloak_post "/admin/realms/cnoe/groups" "/var/config/group-base-user-payload.json" "Base-user group" + + echo "adding group claim to tokens" + CLIENT_SCOPE_GROUPS_ID=$(keycloak_get "/admin/realms/cnoe/client-scopes" '.[] | select(.name == "groups") | .id') + + keycloak_post "/admin/realms/cnoe/client-scopes/${CLIENT_SCOPE_GROUPS_ID}/protocol-mappers/models" \ + "/var/config/group-mapper-payload.json" "Protocol mapper" + + # Create users function + create_user() { + local user_num=$1 + local payload_file=$2 + + echo "creating user${user_num}" + jq --arg pwd "$USER1_PASSWORD" '.credentials[0].value = $pwd' ${payload_file} > user${user_num}-payload-with-password.json + keycloak_post "/admin/realms/cnoe/users" "user${user_num}-payload-with-password.json" "User${user_num}" + } + + create_user "1" "/var/config/user1-payload.json" + create_user "2" "/var/config/user2-payload.json" + + USER1ID=$(keycloak_get "/admin/realms/cnoe/users?lastName=one" ".[0].id") + USER2ID=$(keycloak_get "/admin/realms/cnoe/users?lastName=two" ".[0].id") + + echo "USER1 ID: ${USER1ID}" + echo "USER2 ID: ${USER2ID}" + + # Create client function + create_client() { + local client_name=$1 + local payload_file=$2 + + echo "creating ${client_name} client" + keycloak_post "/admin/realms/cnoe/clients" "${payload_file}" "${client_name} client" + } + + create_client "ArgoCD" "/var/config/argocd-client-payload.json" + + # Add client scope function + add_client_scope() { + local client_id_name=$1 + local client_name=$2 + + CLIENT_ID=$(keycloak_get "/admin/realms/cnoe/clients" ".[] | select(.clientId == \"${client_id_name}\") | .id") + CLIENT_SCOPE_GROUPS_ID=$(keycloak_get "/admin/realms/cnoe/client-scopes" '.[] | select(.name == "groups") | .id') + keycloak_put "/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}" "${client_name} client scope" + } + + add_client_scope "argocd" "ArgoCD" + + create_client "Backstage" "/var/config/backstage-client-payload.json" + + add_client_scope "backstage" "Backstage" + + # Get client secret function + get_client_secret() { + local client_id_name=$1 + local var_name=$2 + + CLIENT_ID=$(keycloak_get "/admin/realms/cnoe/clients" ".[] | select(.clientId == \"${client_id_name}\") | .id") + local secret=$(keycloak_get "/admin/realms/cnoe/clients/${CLIENT_ID}" ".secret") + eval "${var_name}=${secret}" + } + + get_client_secret "backstage" "BACKSTAGE_CLIENT_SECRET" + + create_client "Argo Workflows" "/var/config/argo-client-payload.json" + + add_client_scope "argo-workflows" "Argo Workflows" + get_client_secret "argo-workflows" "ARGO_WORKFLOWS_CLIENT_SECRET" + + echo "Creating ArgoCD session token for backstage" + ARGOCD_PASSWORD=$(./kubectl -n argocd get secret argocd-initial-admin-secret -o go-template='{{.data.password | base64decode }}') + + ARGOCD_SESSION_TOKEN=$(curl -k -sS http://argocd-server.argocd.svc.cluster.local:443/argocd/api/v1/session -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token) + + echo "Creating keycloak-clients secret" + + echo \ + "apiVersion: v1 + kind: Secret + metadata: + name: keycloak-clients + namespace: keycloak + type: Opaque + stringData: + ARGO_WORKFLOWS_CLIENT_SECRET: ${ARGO_WORKFLOWS_CLIENT_SECRET} + ARGOCD_SESSION_TOKEN: ${ARGOCD_SESSION_TOKEN} + BACKSTAGE_CLIENT_SECRET: ${BACKSTAGE_CLIENT_SECRET} + ARGOCD_ADMIN_PASSWORD: ${ARGOCD_PASSWORD} + " > /tmp/secret.yaml + + ./kubectl apply -f /tmp/secret.yaml + echo "Configuration Done!!" + + diff --git a/packages/keycloak/path-routing/default-cert-external-secret.yaml b/packages/keycloak/path-routing/default-cert-external-secret.yaml new file mode 100644 index 000000000..679d000ab --- /dev/null +++ b/packages/keycloak/path-routing/default-cert-external-secret.yaml @@ -0,0 +1,33 @@ + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: keycloak-server-tls + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + refreshInterval: "0" + secretStoreRef: + name: default-cert + kind: ClusterSecretStore + target: + name: keycloak-server-tls + template: + type: kubernetes.io/tls + data: + - secretKey: tls.key + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: default-tls-prod + property: tls.key + - secretKey: tls.crt + remoteRef: + conversionStrategy: Default + decodingStrategy: None + metadataPolicy: None + key: default-tls-prod + property: tls.crt \ No newline at end of file diff --git a/packages/keycloak/values.yaml b/packages/keycloak/values.yaml new file mode 100644 index 000000000..85f7580f3 --- /dev/null +++ b/packages/keycloak/values.yaml @@ -0,0 +1,32 @@ +adminRealm: "cnoe" +production: true +usePasswordFiles: false +proxyHeaders: "forwarded" + +global: + defaultStorageClass: gp3 + +auth: + adminUser: cnoe-admin + adminPassword: cnoe-admin + existingSecret: keycloak-config + passwordSecretKey: KEYCLOAK_ADMIN_PASSWORD + +ingress: + enabled: true + ingressClassName: nginx + hostnameStrict: true + servicePort: http + annotations: + argocd.argoproj.io/sync-wave: "20" + tls: false + +postgresql: + enabled: true + auth: + username: keycloak + database: keycloak + existingSecret: "keycloak-config" + secretKeys: + userPasswordKey: POSTGRES_PASSWORD + architecture: standalone diff --git a/private/argocd-github.yaml.template b/private/argocd-github.yaml.template new file mode 100644 index 000000000..4d9b735f4 --- /dev/null +++ b/private/argocd-github.yaml.template @@ -0,0 +1,9 @@ +url: https://github.com/ +appId: "123abc" +# get it from https://github.com/organizations//settings/installations/ +installationId: "123abc" +privateKey: | + -----BEGIN RSA PRIVATE KEY----- + ... + -----END RSA PRIVATE KEY----- + diff --git a/private/backstage-github.yaml.template b/private/backstage-github.yaml.template new file mode 100644 index 000000000..774ee0db7 --- /dev/null +++ b/private/backstage-github.yaml.template @@ -0,0 +1,9 @@ +appId: 1234 +webhookUrl: https://... +clientId: ABC.. +clientSecret: 1234abc +webhookSecret: 123abc +privateKey: | + -----BEGIN RSA PRIVATE KEY----- + ... + -----END RSA PRIVATE KEY----- diff --git a/scripts/cleanup-crds.sh b/scripts/cleanup-crds.sh new file mode 100755 index 000000000..ba392589b --- /dev/null +++ b/scripts/cleanup-crds.sh @@ -0,0 +1,91 @@ +#!/bin/bash + +set -e -o pipefail + +export REPO_ROOT=$(git rev-parse --show-toplevel) +PHASE="crd-uninstall" +source ${REPO_ROOT}/scripts/utils.sh + +echo -e "\n${BOLD}${BLUE}🧹 Starting CRD cleanup process...${NC}" + +CRDS=( + "external-secrets.io" + "argoproj.io" + "cert-manager.io" + "crossplane.io" + "externaldns.k8s.io" +) + +TIMEOUT=60 + +cleanup_resources() { + local crd=$1 + local kind=$(kubectl get crd $crd -o jsonpath='{.spec.names.kind}' --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || echo "") + + if [[ -z "$kind" ]]; then + return + fi + + echo -e "${CYAN}🔄 Cleaning up resources for CRD:${NC} ${BOLD}$crd${NC} ${CYAN}(Kind: $kind)${NC}" + + # Get all resources of this kind + local resources=$(kubectl get $kind --all-namespaces -o name --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true) + + if [[ -z "$resources" ]]; then + return + fi + + # Delete resources + echo "$resources" | while read resource; do + if [[ -n "$resource" ]]; then + echo -e "${YELLOW}🗑️ Deleting${NC} $resource" + kubectl delete $resource --timeout=${TIMEOUT}s --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || { + echo -e "${YELLOW}⏳ Timeout reached, force deleting${NC} $resource" + kubectl patch $resource -p '{"metadata":{"finalizers":[]}}' --type=merge --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true + kubectl delete $resource --force --grace-period=0 --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true + } + fi + done +} + +delete_crd() { + local crd=$1 + echo -e "${RED}🗑️ Deleting CRD:${NC} ${BOLD}$crd${NC}" + kubectl delete crd $crd --timeout=${TIMEOUT}s --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || { + echo -e "${YELLOW}⏳ Timeout reached, removing finalizers for CRD${NC} ${BOLD}$crd${NC}" + kubectl patch crd $crd -p '{"metadata":{"finalizers":[]}}' --type=merge --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true + kubectl delete crd $crd --force --grace-period=0 --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true + } +} + +main() { + echo -e "${PURPLE}📋 Starting CRD cleanup for groups:${NC} ${BOLD}${CRDS[@]}${NC}" + + for group in "${CRDS[@]}"; do + echo -e "\n${CYAN}🔍 Processing CRD group:${NC} ${BOLD}$group${NC}" + + # Find CRDs with the group suffix + crds=$(kubectl get crd -o name --kubeconfig $KUBECONFIG_FILE | grep "\.$group$" | cut -d'/' -f2 || true) + + if [[ -z "$crds" ]]; then + echo -e "${YELLOW}⚠️ No CRDs found for group:${NC} $group" + continue + fi + + echo "$crds" | while read crd; do + if [[ -n "$crd" ]]; then + cleanup_resources "$crd" + delete_crd "$crd" + echo -e "${GREEN}✅ Successfully processed CRD:${NC} $crd" + fi + done + done + + echo -e "\n${BOLD}${GREEN}🎉 CRD cleanup completed successfully! 🎉${NC}" +} + +main + +# Remove secrets created by the reference implementation +# echo -e "${CYAN}🔐 Cleaning up secrets...${NC}" +# kubectl get secrets -A --no-headers --kubeconfig $KUBECONFIG_FILE | awk '{ print $1, $2}' | xargs -n 2 kubectl delete secrets --kubeconfig $KUBECONFIG_FILE -n \ No newline at end of file diff --git a/scripts/create-cluster.sh b/scripts/create-cluster.sh new file mode 100755 index 000000000..743dab2d0 --- /dev/null +++ b/scripts/create-cluster.sh @@ -0,0 +1,88 @@ +#!/bin/bash +set -e -o pipefail + +export REPO_ROOT=$(git rev-parse --show-toplevel) +PHASE="create-cluster" +echo -e "\n${BOLD}${BLUE}🚀 Starting EKS cluster creation process...${NC}" + +source ${REPO_ROOT}/scripts/utils.sh + +# Check required tools based on deployment choice +if [ "$DEPLOYMENT_TOOL" = "eksctl" ]; then + if ! command -v eksctl >/dev/null 2>&1; then + echo -e "${RED}❌ eksctl command is not installed. Please install it to continue.${NC}" + echo -e "${CYAN}💡 Installation instructions: https://eksctl.io/installation/${NC}" + exit 1 + fi +elif [ "$DEPLOYMENT_TOOL" = "terraform" ]; then + if ! command -v terraform >/dev/null 2>&1; then + echo -e "${RED}❌ terraform command is not installed. Please install it to continue.${NC}" + echo -e "${CYAN}💡 Installation instructions: https://terraform.io/downloads${NC}" + exit 1 + fi +fi + +echo -e "\n${BOLD}${BLUE}🚀 Creating EKS cluster...${NC}" +echo -e "${YELLOW}⏳ This process may take 15-20 minutes...${NC}" + +# Create the cluster based on deployment tool +if [ "$DEPLOYMENT_TOOL" = "eksctl" ]; then + echo -e "\n${BOLD}${BLUE}🔧 Creating Crossplane permissions boundary policy...${NC}" + + # Create temporary file for policy document + TEMPFILE=$(mktemp) + sed "s/\${AWS_ACCOUNT_ID}/${AWS_ACCOUNT_ID}/g" ${REPO_ROOT}/cluster/iam-policies/crossplane-permissions-boundry.json > "$TEMPFILE" + + echo -e "${CYAN}📋 Creating IAM policy crossplane-permissions-boundary...${NC}" + + # Create the permissions boundary policy (ignore error if it already exists) + if aws iam create-policy \ + --policy-name crossplane-permissions-boundary \ + --policy-document file://"$TEMPFILE" > /dev/null 2>&1; then + echo -e "${GREEN}✅ Created crossplane-permissions-boundary policy${NC}" + else + echo -e "${YELLOW}⚠️ Policy crossplane-permissions-boundary already exists, continuing...${NC}" + fi + + # Get the policy ARN + export CROSSPLANE_BOUNDARY_POLICY_ARN=$(aws iam get-policy \ + --policy-arn arn:aws:iam::${AWS_ACCOUNT_ID}:policy/crossplane-permissions-boundary \ + --query 'Policy.Arn' --output text) + + echo -e "${CYAN}🔗 Policy ARN:${NC} ${CROSSPLANE_BOUNDARY_POLICY_ARN}" + + # Clean up temp file + rm -f "$TEMPFILE" + echo -e "${CYAN}🔧 Using eksctl for cluster creation...${NC}" + + # Create the cluster with eksctl + sed -e "s/\${CLUSTER_NAME}/${CLUSTER_NAME}/g" \ + -e "s/\${AWS_REGION}/${AWS_REGION}/g" \ + -e "s/\${AWS_ACCOUNT_ID}/${AWS_ACCOUNT_ID}/g" \ + -e "s/\${CROSSPLANE_BOUNDARY_POLICY_ARN}/${CROSSPLANE_BOUNDARY_POLICY_ARN//\//\\/}/g" \ + "$EKSCTL_CONFIG_FILE_PATH" | eksctl create cluster -f - + +elif [ "$DEPLOYMENT_TOOL" = "terraform" ]; then + echo -e "${CYAN}🔧 Using terraform for cluster creation...${NC}" + + # Set terraform variables + export TF_VAR_cluster_name="$CLUSTER_NAME" + export TF_VAR_region="$AWS_REGION" + export TF_VAR_auto_mode="$AUTO_MODE" + + # Initialize and apply terraform + terraform -chdir="$REPO_ROOT/cluster/terraform" init + terraform -chdir="$REPO_ROOT/cluster/terraform" apply -auto-approve +fi + +echo -e "\n${BOLD}${GREEN}🎉 EKS cluster created successfully! 🎉${NC}" +echo -e "${CYAN}📊 Cluster Details:${NC}" +echo -e "${CYAN}🔶 Name:${NC} ${BOLD}${CLUSTER_NAME}${NC}" +echo -e "${CYAN}🔶 Region:${NC} ${AWS_REGION}" +echo -e "${CYAN}🔶 Type:${NC} ${CLUSTER_TYPE}" +echo -e "${CYAN}🔶 Tool:${NC} ${DEPLOYMENT_TOOL}" + +echo -e "\n${BOLD}${BLUE}🔧 Updating kubeconfig...${NC}" +aws eks update-kubeconfig --region ${AWS_REGION} --name ${CLUSTER_NAME} --alias ${CLUSTER_NAME} + +echo -e "\n${BOLD}${GREEN}✅ Cluster is ready for CNOE reference implementation installation!${NC}" \ No newline at end of file diff --git a/scripts/create-config-secrets.sh b/scripts/create-config-secrets.sh new file mode 100755 index 000000000..83d9b54c9 --- /dev/null +++ b/scripts/create-config-secrets.sh @@ -0,0 +1,92 @@ +#!/bin/bash +set -e -o pipefail + +export REPO_ROOT=$(git rev-parse --show-toplevel) +SECRET_NAME_PREFIX="cnoe-ref-impl" +PHASE="create-update-secrets" +source ${REPO_ROOT}/scripts/utils.sh + +PRIVATE_DIR="$REPO_ROOT/private" + +echo -e "\n${BOLD}${BLUE}🔐 Starting secret creation process...${NC}" +echo -e "${CYAN}📂 Reading files from:${NC} ${BOLD}${PRIVATE_DIR}${NC}" + +if [ ! -d "$PRIVATE_DIR" ]; then + echo -e "${RED}❌ Directory $PRIVATE_DIR does not exist${NC}" + exit 1 +fi + +# Create or update secret +create_update_secret() { + echo -e "\n${PURPLE}🚀 Creating/updating Secret for $1...${NC}" + TAGS=$(get_tags_from_config) + if aws secretsmanager create-secret \ + --name "$SECRET_NAME_PREFIX/$1" \ + --secret-string file://"$TEMP_SECRET_FILE" \ + --description "Secret created for $1 of CNOE AWS Reference Implementation" \ + --tags $TAGS \ + --region $AWS_REGION >/dev/null 2>&1; then + echo -e "${GREEN}✅ Secret '${BOLD}$SECRET_NAME_PREFIX/$1${NC}${GREEN}' created successfully!${NC}" + else + echo -e "${YELLOW}🔄 Secret exists, updating...${NC}" + if aws secretsmanager update-secret \ + --secret-id "$SECRET_NAME_PREFIX/$1" \ + --secret-string file://"$TEMP_SECRET_FILE" \ + --region $AWS_REGION >/dev/null 2>&1; then + echo -e "${GREEN}✅ Secret '${BOLD}$SECRET_NAME_PREFIX/$1${NC}${GREEN}' updated successfully!${NC}" + else + echo -e "${RED}❌ Failed to create/update secret${NC}" + rm "$TEMP_SECRET_FILE" + exit 1 + fi + fi + + # Cleanup + rm "$TEMP_SECRET_FILE" + echo -e "${CYAN}🔐 Secret ARN:${NC} $(aws secretsmanager describe-secret --secret-id "$SECRET_NAME_PREFIX/$1" --region $AWS_REGION --query 'ARN' --output text)" +} + +echo -e "\n${YELLOW}📋 Processing files...${NC}" +TEMP_SECRET_FILE=$(mktemp) + +# Start building JSON for Github App secrets +echo "{" > "$TEMP_SECRET_FILE" + +first=true +file_count=0 +for file in "$PRIVATE_DIR"/*.yaml; do + if [ -f "$file" ]; then + filename=$(basename "$file" .yaml) + echo -e "${CYAN} 📄 Adding:${NC} ${filename}" + + # Add comma if not first entry + if [ "$first" = false ]; then + echo "," >> "$TEMP_SECRET_FILE" + fi + first=false + + # Add key-value pair with properly escaped content + echo -n " \"$filename\": " >> "$TEMP_SECRET_FILE" + yq -o=json eval '.' "$file" >> "$TEMP_SECRET_FILE" + file_count=$((file_count + 1)) + fi +done + +if [ $file_count -eq 0 ]; then + echo -e "${RED}❌ No files found in $PRIVATE_DIR${NC}" + rm "$TEMP_SECRET_FILE" + exit 1 +fi + +echo "" >> "$TEMP_SECRET_FILE" +echo "}" >> "$TEMP_SECRET_FILE" + +create_update_secret "github-app" + +# Build JSON for Config secret +TEMP_SECRET_FILE=$(mktemp) +yq -o=json eval '.' "$CONFIG_FILE" > "$TEMP_SECRET_FILE" +create_update_secret "config" + +echo -e "\n${BOLD}${GREEN}🎉 Process completed successfully! 🎉${NC}" + diff --git a/scripts/get-urls.sh b/scripts/get-urls.sh new file mode 100755 index 000000000..6106a1d40 --- /dev/null +++ b/scripts/get-urls.sh @@ -0,0 +1,37 @@ +#!/bin/bash + +# Colors +RED='\033[38;5;160m' +GREEN='\033[38;5;34m' +PURPLE='\033[38;5;98m' +NC='\033[0m' +BLUE='\033[38;5;33m' +YELLOW='\033[38;5;178m' +CYAN='\033[38;5;37m' +BOLD='\033[1m' +ORANGE='\033[38;5;172m' + +# Get the path_routing value from config.yaml +PATH_ROUTING=$(yq '.path_routing' config.yaml) +# Get the domain from config.yaml +DOMAIN=$(yq '.domain' config.yaml) + +echo -e "\n${BOLD}${ORANGE}✨ ========================================== ✨${NC}" +echo -e "${BOLD}${CYAN}🌐 Platform Access URLs 🌐${NC}" +echo -e "${BOLD}${ORANGE}✨ ========================================== ✨${NC}\n" + +echo -e "${BOLD}${PURPLE}🔗 URLs for accessing the platform:${NC}" +echo -e "${YELLOW}----------------------------------------------------${NC}" + +if [ "$PATH_ROUTING" == "\"true\"" ] || [ "$PATH_ROUTING" == "true" ]; then + echo -e "${CYAN}🔶 Backstage: ${BOLD}https://$DOMAIN${NC}" + echo -e "${CYAN}🔶 Argo CD: ${BOLD}https://$DOMAIN/argocd${NC}" + echo -e "${CYAN}🔶 Argo Workflows: ${BOLD}https://$DOMAIN/argo-workflows${NC}" +else + echo -e "${CYAN}🔶 Backstage: ${BOLD}https://backstage.$DOMAIN${NC}" + echo -e "${CYAN}🔶 Argo CD: ${BOLD}https://argocd.$DOMAIN${NC}" + echo -e "${CYAN}🔶 Argo Workflows: ${BOLD}https://argo-workflows.$DOMAIN${NC}" +fi + +echo -e "${YELLOW}----------------------------------------------------${NC}" +echo -e "\n${BOLD}${GREEN}✅ Use the URLs above to access the platform services${NC}\n" \ No newline at end of file diff --git a/scripts/install-using-idpbuilder.sh b/scripts/install-using-idpbuilder.sh new file mode 100755 index 000000000..db9c86a0f --- /dev/null +++ b/scripts/install-using-idpbuilder.sh @@ -0,0 +1,69 @@ +#!/bin/bash +set -e -o pipefail + +export REPO_ROOT=$(git rev-parse --show-toplevel) +PHASE="install" +source ${REPO_ROOT}/scripts/utils.sh + +echo -e "\n${BOLD}${BLUE}🚀 Starting installation process...${NC}" + +SERVER_URL=$(cat "$KUBECONFIG_FILE" | yq -r '.clusters[0].cluster.server') +CA_DATA=$(cat "$KUBECONFIG_FILE" | yq -r '.clusters[0].cluster."certificate-authority-data"') + +echo -e "${CYAN}📝 Creating cluster secret file...${NC}" +CLUSTER_SECRET_FILE=$(mktemp) +cat << EOF > "$CLUSTER_SECRET_FILE" +# Remote EKS cluster Argo CD secret +apiVersion: v1 +kind: Secret +metadata: + name: "$CLUSTER_NAME-cluster-secret" + namespace: argocd + labels: + argocd.argoproj.io/secret-type: cluster + clusterClass: "control-plane" + clusterName: "$CLUSTER_NAME" + environment: "control-plane-bootstrap" + path_routing: "$PATH_ROUTING" + auto_mode: "$AUTO_MODE" + annotations: + addons_repo_url: "http://cnoe.localtest.me:8443/gitea/giteaAdmin/idpbuilder-localdev-bootstrap-appset-packages.git" + addons_repo_revision: "HEAD" + addons_repo_basepath: "." + domain: "$DOMAIN_NAME" +type: Opaque +stringData: + name: "$CLUSTER_NAME" + server: $SERVER_URL + clusterResources: "true" + config: | + { + "execProviderConfig": { + "command": "argocd-k8s-auth", + "args": ["aws", "--cluster-name", "$CLUSTER_NAME"], + "apiVersion": "client.authentication.k8s.io/v1beta1" + }, + "tlsClientConfig": { + "insecure": false, + "caData": "$CA_DATA" + } + } +EOF + +echo -e "${BOLD}${GREEN}🔄 Running idpbuilder to apply packages...${NC}" +idpbuilder create --use-path-routing --protocol http --package "$REPO_ROOT/packages" -c "argocd:${CLUSTER_SECRET_FILE}" > /dev/null 2>&1 + +echo -e "${YELLOW}⏳ Waiting for local addons-appset to be healthy...${NC}" +# sleep 60 # Wait 1 minute before checking the status +kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd applications/addons-appset-$CLUSTER_NAME --timeout=15m +echo -e "${GREEN}✅ local addons-appset is now healthy!${NC}" + +# Wait for Argo CD applications to sync +wait_for_apps + +# Delete idpbuilder local kind cluster instance +echo -e "${CYAN}🔄 Deleting idpbuilder local kind cluster instance...${NC}" +idpbuilder delete cluster --name localdev > /dev/null 2>&1 + +echo -e "\n${BOLD}${BLUE}🎉 Installation completed successfully! 🎉${NC}" +echo -e "${CYAN}📊 You can now access your resources and start deploying applications.${NC}" \ No newline at end of file diff --git a/scripts/install.sh b/scripts/install.sh new file mode 100755 index 000000000..4c16b83ba --- /dev/null +++ b/scripts/install.sh @@ -0,0 +1,96 @@ +#!/bin/bash +set -e -o pipefail + +export REPO_ROOT=$(git rev-parse --show-toplevel) +PHASE="install" +source ${REPO_ROOT}/scripts/utils.sh + +echo -e "\n${BOLD}${BLUE}🚀 Starting installation process...${NC}" + +# Static helm values files +ARGOCD_STATIC_VALUES_FILE=${REPO_ROOT}/packages/argo-cd/values.yaml +EXTERNAL_SECRETS_STATIC_VALUES_FILE=${REPO_ROOT}/packages/external-secrets/values.yaml +ADDONS_APPSET_STATIC_VALUES_FILE=${REPO_ROOT}/packages/bootstrap/values.yaml + +# Chart versions for Argo CD and ESO +ARGOCD_CHART_VERSION=$(yq '.argocd.defaultVersion' ${REPO_ROOT}/packages/addons/values.yaml) +EXTERNAL_SECRETS_CHART_VERSION=$(yq '.external-secrets.defaultVersion' ${REPO_ROOT}/packages/addons/values.yaml) + +# Custom Manifests Paths +ARGOCD_CUSTOM_MANIFESTS_PATH=${REPO_ROOT}/packages/argo-cd/manifests +EXTERNAL_SECRETS_CUSTOM_MANIFESTS_PATH=${REPO_ROOT}/packages/external-secrets/manifests + +# Build Argo CD dynamic values +ARGOCD_DYNAMIC_VALUES_FILE=$(mktemp) +ISSUER_URL=$([[ "${PATH_ROUTING}" == "false" ]] && echo "keycloak.${DOMAIN_NAME}" || echo "${DOMAIN_NAME}/keycloak") +cat << EOF > "$ARGOCD_DYNAMIC_VALUES_FILE" +cnoe_ref_impl: # Specific values for reference CNOE implementation to control extraObjects. + auto_mode: $([[ "${AUTO_MODE}" == "true" ]] && echo '"true"' || echo '"false"') +global: + domain: $([[ "${PATH_ROUTING}" == "true" ]] && echo "${DOMAIN_NAME}" || echo "argocd.${DOMAIN_NAME}") +server: + ingress: + annotations: + cert-manager.io/cluster-issuer: $([[ "${PATH_ROUTING}" == "false" ]] && echo '"letsencrypt-prod"' || echo "") + path: /$([[ "${PATH_ROUTING}" == "true" ]] && echo "argocd" || echo "") +configs: + cm: + oidc.config: | + name: Keycloak + issuer: https://$ISSUER_URL/realms/cnoe + clientID: argocd + enablePKCEAuthentication: true + requestedScopes: + - openid + - profile + - email + - groups + params: + 'server.basehref': /$([[ "${PATH_ROUTING}" == "true" ]] && echo "argocd" || echo "") + 'server.rootpath': $([[ "${PATH_ROUTING}" == "true" ]] && echo "argocd" || echo "") +EOF + +echo -e "${BOLD}${GREEN}🔄 Installing Argo CD...${NC}" +helm repo add argo "https://argoproj.github.io/argo-helm" > /dev/null +helm repo update > /dev/null +helm upgrade --install --wait argocd argo/argo-cd \ + --namespace argocd --version $ARGOCD_CHART_VERSION \ + --create-namespace \ + --values "$ARGOCD_STATIC_VALUES_FILE" \ + --values "$ARGOCD_DYNAMIC_VALUES_FILE" \ + --kubeconfig $KUBECONFIG_FILE > /dev/null + +echo -e "${YELLOW}⏳ Waiting for Argo CD to be healthy...${NC}" +kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=300s --kubeconfig $KUBECONFIG_FILE > /dev/null + + +echo -e "${BOLD}${GREEN}🔄 Installing External Secrets...${NC}" +helm repo add external-secrets "https://charts.external-secrets.io" > /dev/null +helm repo update > /dev/null +helm upgrade --install --wait external-secrets external-secrets/external-secrets \ + --namespace external-secrets --version $EXTERNAL_SECRETS_CHART_VERSION \ + --create-namespace \ + --values "$EXTERNAL_SECRETS_STATIC_VALUES_FILE" \ + --kubeconfig $KUBECONFIG_FILE > /dev/null + +echo -e "${YELLOW}⏳ Waiting for External Secrets to be healthy...${NC}" +kubectl wait --for=condition=available deployment/external-secrets -n external-secrets --timeout=300s --kubeconfig $KUBECONFIG_FILE > /dev/null + + +echo -e "${BOLD}${GREEN}🔄 Applying custom manifests...${NC}" +# sleep 60 +kubectl apply -f "$ARGOCD_CUSTOM_MANIFESTS_PATH" --kubeconfig $KUBECONFIG_FILE > /dev/null +kubectl apply -f "$EXTERNAL_SECRETS_CUSTOM_MANIFESTS_PATH" --kubeconfig $KUBECONFIG_FILE > /dev/null + +echo -e "${BOLD}${GREEN}🔄 Installing Addons AppSet Argo CD application...${NC}" +helm upgrade --install --wait addons-appset ${REPO_ROOT}/packages/appset-chart \ + --namespace argocd \ + --values "$ADDONS_APPSET_STATIC_VALUES_FILE" \ + --kubeconfig $KUBECONFIG_FILE > /dev/null + +# Wait for Argo CD applications to sync +sleep 10 +wait_for_apps + +echo -e "\n${BOLD}${BLUE}🎉 Installation completed successfully! 🎉${NC}" +echo -e "${CYAN}📊 You can now access your resources and start deploying applications.${NC}" diff --git a/scripts/template.sh b/scripts/template.sh new file mode 100755 index 000000000..2bfd67228 --- /dev/null +++ b/scripts/template.sh @@ -0,0 +1,56 @@ +#!/bin/bash + +CONFIG_FILE="config.yaml" + +# Check if config file exists +if [ ! -f "$CONFIG_FILE" ]; then + echo "Error: $CONFIG_FILE not found" + exit 1 +fi + +# Process only YAML files in packages directory +find packages -type f -name "*.yaml" -o -name "*.yml" | while read -r file; do + # Check if file contains any template pattern {{ .key_name }} + if grep -q "{{" "$file"; then + echo "Processing $file" + + # Use grep to find lines with templates (excluding commented lines) + grep -n "{{.*}}" "$file" | grep -v "^[[:space:]]*#" | while IFS=: read -r line_num line_content; do + # Skip commented lines + if [[ "$line_content" =~ ^[[:space:]]*# ]]; then + continue + fi + + # Extract template pattern from the line + template=$(echo "$line_content" | grep -o "{{[[:space:]]*\.[a-zA-Z0-9_\.]*[[:space:]]*}}") + + # Skip if no valid template found + if [ -z "$template" ]; then + continue + fi + + # Extract key from template + key=$(echo "$template" | sed 's/{{[[:space:]]*\.\([a-zA-Z0-9_\.]*\)[[:space:]]*}}/\1/') + + # Skip if key is empty + if [ -z "$key" ]; then + continue + fi + + # Get value using yq + value=$(yq eval ".$key" "$CONFIG_FILE" 2>/dev/null) + if [ "$value" = "null" ] || [ -z "$value" ]; then + echo " Warning: No value found for key '$key' in $CONFIG_FILE" + continue + fi + + echo " Replacing '$key' with '$value'" + # Replace template with value (escape special characters in template and value) + escaped_template=$(echo "$template" | sed 's/[\/&]/\\&/g') + escaped_value=$(echo "$value" | sed 's/[\/&]/\\&/g') + sed -i "s/$escaped_template/$escaped_value/" "$file" + done + fi +done + +echo "Done!" \ No newline at end of file diff --git a/scripts/uninstall.sh b/scripts/uninstall.sh new file mode 100755 index 000000000..4406f423f --- /dev/null +++ b/scripts/uninstall.sh @@ -0,0 +1,78 @@ +#!/bin/bash +set -e -o pipefail + +export REPO_ROOT=$(git rev-parse --show-toplevel) +PHASE="uninstall" +source ${REPO_ROOT}/scripts/utils.sh + +echo -e "\n${BOLD}${BLUE}🚀 Starting uninstallation process...${NC}" + +# Addons to be deleted +ADDONS=( + crossplane-compositions + crossplane-upbound-providers + crossplane + argo-workflows + backstage + keycloak + cert-manager + external-dns + external-secrets + ingress-nginx + aws-load-balancer-controller +) + +# Remove addons-appset applicationset and corresponding appset-chart applicationset with orphan deletion policy. +# The addons will be removed in specific order later. +echo -e "${CYAN}🗑️ Deleting ${BOLD}addons-appset${NC} ${CYAN}ApplicationSet...${NC}" +kubectl delete applicationsets.argoproj.io -n argocd addons-appset --cascade=orphan --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true +kubectl delete applicationsets.argoproj.io -n argocd addons-appset-pr --cascade=orphan --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true + +echo -e "${CYAN}🗑️ Deleting ${BOLD}appset-chart${NC} ${CYAN}ApplicationSet...${NC}" +kubectl delete applications.argoproj.io -n argocd -l addonName=$APPSET_ADDON_NAME --cascade=orphan --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true + +# Start removing addons in order +echo -e "${BOLD}${YELLOW}📦 Removing add-ons in sequence...${NC}" +# Delete all addon application sets except argocd +for app in "${ADDONS[@]}"; do + echo -e "${CYAN}🗑️ Deleting ${BOLD}$app${NC} ${CYAN}AppSet...${NC}" + kubectl delete applicationsets.argoproj.io -n argocd $app --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true + # Wait for AppSet deletion to complete before moving to next AppSet + while [ $(kubectl get applications.argoproj.io -n argocd -l addonName=$app --no-headers --kubeconfig $KUBECONFIG_FILE 2>/dev/null | wc -l) -ne 0 ]; do + echo -e "${YELLOW}⏳ Waiting for ${BOLD}$app${NC} ${YELLOW}AppSet to be deleted...${NC}" + sleep 10 + done + echo -e "${GREEN}✅ ${BOLD}$app${NC} ${GREEN}successfully removed!${NC}" +done + +# Delete ArgoCD App +echo -e "${CYAN}🗑️ Deleting ${BOLD}argocd${NC} ${CYAN}AppSet...${NC}" +kubectl delete applicationsets.argoproj.io -n argocd argocd --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true + +# Wait for ArgoCD to be deleted +echo -e "${YELLOW}⏳ Waiting for ${BOLD}argocd${NC} ${YELLOW}AppSet to be deleted...${NC}" +START_TIME=$(date +%s) +TIMEOUT=120 # 2 minutes timeout +while [ $(kubectl get applications.argoproj.io -n argocd -l addonName=argocd --no-headers --kubeconfig $KUBECONFIG_FILE 2>/dev/null | wc -l) -ne 0 ]; do + CURRENT_TIME=$(date +%s) + ELAPSED_TIME=$((CURRENT_TIME - START_TIME)) + + if [ $ELAPSED_TIME -ge $TIMEOUT ]; then + echo -e "${YELLOW}⚠️ Timeout reached. Patching ${BOLD}argocd${NC} ${YELLOW}applications to remove finalizers...${NC}" + kubectl patch applications.argoproj.io -n argocd "argocd-$CLUSTER_NAME" --type json -p='[{"op": "remove", "path": "/metadata/finalizers"}]' --kubeconfig $KUBECONFIG_FILE || true + break + fi + + echo -e "${YELLOW}⏳ Still waiting for ${BOLD}argocd${NC} ${YELLOW}AppSet to be deleted... (${ELAPSED_TIME}s elapsed)${NC}" + sleep 10 +done +echo -e "${GREEN}✅ ${BOLD}argocd${NC} ${GREEN}successfully removed!${NC}" + +# Remove PVCs for keycloak +echo -e "${CYAN}🗑️ Deleting PVCs for ${BOLD}keycloak${NC}...${NC}" +kubectl delete pvc -n keycloak data-keycloak-postgresql-0 --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true +kubectl delete pvc -n backstage data-postgresql-0 --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 || true +echo -e "${GREEN}✅ Keycloak & Backstage Postgres PVCs removed!${NC}" + +echo -e "\n${BOLD}${GREEN}🎉 Uninstallation Complete! 🎉${NC}" +echo -e "${CYAN}🧹 All resources have been successfully removed.${NC}" \ No newline at end of file diff --git a/scripts/utils.sh b/scripts/utils.sh new file mode 100755 index 000000000..39c605620 --- /dev/null +++ b/scripts/utils.sh @@ -0,0 +1,192 @@ +set -e + +# Colors +export RED='\033[38;5;160m' +export GREEN='\033[38;5;34m' +export PURPLE='\033[38;5;98m' +export NC='\033[0m' +export BLUE='\033[38;5;33m' +export YELLOW='\033[38;5;178m' +export CYAN='\033[38;5;37m' +export BOLD='\033[1m' +export ORANGE='\033[38;5;172m' + +# Extract tags from config file +get_tags_from_config() { + yq eval '.tags | to_entries | map("Key=" + .key + ",Value=" + .value) | join(" ")' "$CONFIG_FILE" +} + +# Generate kubeconfig for the EKS cluster +get_kubeconfig() { + export KUBECONFIG_FILE=$(mktemp) + echo -e "${PURPLE}🔑 Generating temporary kubeconfig for cluster ${BOLD}${CLUSTER_NAME}${NC}...${NC}" + aws eks update-kubeconfig --region $AWS_REGION --name $CLUSTER_NAME --kubeconfig $KUBECONFIG_FILE > /dev/null 2>&1 +} + +# Wait for all Argo CD applications to report healthy status +wait_for_apps(){ + + echo -e "${YELLOW}⏳ Waiting for addons-appset to be healthy...${NC}" + kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd applications/$APPSET_ADDON_NAME-$CLUSTER_NAME --timeout=15m --kubeconfig $KUBECONFIG_FILE + echo -e "${GREEN}✅ addons-appset is now healthy!${NC}" + + START_TIME=$(date +%s) + TIMEOUT=600 # 5 minute timeout for moving to checking the status as the apps on hub cluster will take some time to create + while [ $(kubectl get applications.argoproj.io -n argocd --no-headers --kubeconfig $KUBECONFIG_FILE 2>/dev/null | wc -l) -lt 2 ]; do + CURRENT_TIME=$(date +%s) + ELAPSED_TIME=$((CURRENT_TIME - START_TIME)) + + if [ $ELAPSED_TIME -ge $TIMEOUT ]; then + echo -e "${YELLOW}⚠️ Timeout reached while waiting for applications to be created by the AppSet chart...${NC}" + break + fi + + echo -e "${YELLOW}⏳ Still waiting for ${BOLD}argocd apps from Appset chart${NC} ${YELLOW}to be created on hub cluster... (${ELAPSED_TIME}s elapsed)${NC}" + sleep 30 + done + + echo -e "${YELLOW}⏳ Waiting for all Argo CD apps on the hub Cluster to be Healthy... might take up to 30 minutes${NC}" + kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd --all applications --kubeconfig $KUBECONFIG_FILE --timeout=-30m + echo -e "${BOLD}${GREEN}✅ All Argo CD apps are now healthy!${NC}" +} + +# Check if required binaries binaries exists +clis=("aws" "kubectl" "yq") +for cli in "${clis[@]}"; do + if command -v "$cli" >/dev/null 2>&1 ; then + continue + else + echo -e "${RED}❌ $cli command is not installed. Please install it to continue.${NC}" + exit 4 + fi +done + +export CONFIG_FILE="$REPO_ROOT/config.yaml" + +# Check if config file exists +if [ ! -f "$CONFIG_FILE" ]; then + echo -e "${RED}❌ File $CONFIG_FILE does not exist${NC}" + exit 1 +fi + +# Fetch config values +export CLUSTER_NAME=$(yq '.cluster_name' "$CONFIG_FILE") +export AWS_REGION=$(yq '.region' "$CONFIG_FILE") +export DOMAIN_NAME=$(yq '.domain' "$CONFIG_FILE") +export PATH_ROUTING=$(yq '.path_routing' "$CONFIG_FILE") +export AUTO_MODE=$(yq '.auto_mode' "$CONFIG_FILE") +export APPSET_ADDON_NAME=$([[ "${PATH_ROUTING}" == "true" ]] && echo "addons-appset-pr" || echo "addons-appset") +export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) + +# Header +echo -e "${BOLD}${ORANGE}✨ ========================================== ✨${NC}" +echo -e "${BOLD}${CYAN}📦 CNOE AWS Reference Implementation 📦${NC}" +echo -e "${BOLD}${ORANGE}✨ ========================================== ✨${NC}\n" + +echo -e "${BOLD}${PURPLE}\n🎯 Targets:${NC}" +echo -e "${CYAN}🔶 AWS account number:${NC} ${AWS_ACCOUNT_ID}" +echo -e "${CYAN}🔶 AWS profile (if set):${NC} ${AWS_PROFILE:-None}" +echo -e "${CYAN}🔶 AWS region:${NC} ${AWS_REGION}" +echo -e "${CYAN}🔶 Kubernetes cluster:${NC} ${BOLD}$CLUSTER_NAME${NC}" + +if [ $PHASE = "create-cluster" ]; then + # Ask user for deployment tool + echo -e "\n${BOLD}${YELLOW}❓ Which tool would you like to use for cluster creation?${NC}" + echo -e "${CYAN}1) eksctl (YAML-based configuration)${NC}" + echo -e "${CYAN}2) terraform (Infrastructure as Code)${NC}" + read -p "Enter your choice (1 or 2): " tool_choice + + case $tool_choice in + 1) + export DEPLOYMENT_TOOL="eksctl" + echo -e "${GREEN}✅ Selected: eksctl${NC}" + ;; + 2) + export DEPLOYMENT_TOOL="terraform" + echo -e "${GREEN}✅ Selected: terraform${NC}" + ;; + *) + echo -e "${RED}❌ Invalid choice. Please select 1 or 2.${NC}" + exit 1 + ;; + esac + + # Ask user for cluster type + echo -e "\n${BOLD}${YELLOW}❓ Which type of EKS cluster would you like to create?${NC}" + echo -e "${CYAN}1) Auto Mode cluster (Recommended for new users)${NC}" + echo -e "${CYAN}2) Non-Auto Mode cluster (Managed Node Groups)${NC}" + read -p "Enter your choice (1 or 2): " cluster_choice + + case $cluster_choice in + 1) + export CLUSTER_TYPE="auto" + export AUTO_MODE="true" + export EKSCTL_CONFIG_FILE_PATH="${REPO_ROOT}/cluster/eksctl/cluster-config-auto.yaml" + echo -e "${GREEN}✅ Selected: Auto Mode cluster${NC}" + ;; + 2) + export CLUSTER_TYPE="standard" + export AUTO_MODE="false" + export EKSCTL_CONFIG_FILE_PATH="${REPO_ROOT}/cluster/eksctl/cluster-config.yaml" + echo -e "${GREEN}✅ Selected: Non-Auto Mode cluster${NC}" + ;; + *) + echo -e "${RED}❌ Invalid choice. Please select 1 or 2.${NC}" + exit 1 + ;; + esac + echo -e "\n${BOLD}${GREEN}❓ Are you sure you want to create the EKS cluster?${NC}" + read -p '(yes/no): ' response + if [[ ! "$response" =~ ^[Yy][Ee][Ss]$ ]]; then + echo -e "${YELLOW}⚠️ Cluster creation cancelled.${NC}" + exit 0 + fi +fi + +if [ $PHASE = "install" ]; then + echo -e "${CYAN}📋 Configuration Details:${NC}" + echo -e "${YELLOW}----------------------------------------------------${NC}" + yq '... comments=""' "$CONFIG_FILE" + echo -e "${YELLOW}----------------------------------------------------${NC}" + + echo -e "\n${BOLD}${GREEN}❓ Are you sure you want to continue with installation?${NC}" + read -p '(yes/no): ' response + if [[ ! "$response" =~ ^[Yy][Ee][Ss]$ ]]; then + echo -e "${YELLOW}⚠️ Installation cancelled.${NC}" + exit 0 + fi + get_kubeconfig +fi + +if [ $PHASE = "uninstall" ]; then + echo -e "\n${BOLD}${RED}⚠️ WARNING: This will remove all deployed resources!${NC}" + echo -e "${BOLD}${RED}❓ Are you sure you want to continue with uninstallation?${NC}" + read -p '(yes/no): ' response + if [[ ! "$response" =~ ^[Yy][Ee][Ss]$ ]]; then + echo -e "${YELLOW}⚠️ Uninstallation cancelled.${NC}" + exit 0 + fi + get_kubeconfig +fi + +if [ $PHASE = "crd-uninstall" ]; then + echo -e "\n${BOLD}${RED}⚠️ WARNING: This will remove all CRDs created by reference implementation!${NC}" + echo -e "${BOLD}${RED}❓ Are you sure you want to continue with uninstallation?${NC}" + read -p '(yes/no): ' response + if [[ ! "$response" =~ ^[Yy][Ee][Ss]$ ]]; then + echo -e "${YELLOW}⚠️ CRD Uninstallation cancelled.${NC}" + exit 0 + fi + get_kubeconfig +fi + +if [ $PHASE = "create-update-secrets" ]; then + echo -e "${CYAN}🔐 Secret names:${NC} ${BOLD}${SECRET_NAME_PREFIX}/config & ${SECRET_NAME_PREFIX}/github-app ${NC}" + echo -e "\n${BOLD}${RED}⚠️ WARNING: This will update the secrets if already they exists!!{NC}" + echo -e "${BOLD}${GREEN}❓ Are you sure you want to continue?${NC}" + read -p '(yes/no): ' response + if [[ ! "$response" =~ ^[Yy][Ee][Ss]$ ]]; then + echo -e "${YELLOW}⚠️ Secret creation cancelled.${NC}" + exit 0 + fi +fi diff --git a/setups/argocd/application-set.yaml b/setups/argocd/application-set.yaml deleted file mode 100644 index f15f01a87..000000000 --- a/setups/argocd/application-set.yaml +++ /dev/null @@ -1,36 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: ApplicationSet -metadata: - name: demo - namespace: argocd -spec: - generators: - - scmProvider: - cloneProtocol: https - filters: - - repositoryMatch: ^demo - pathsExist: [kustomize/dev/kustomization.yaml] - github: - allBranches: false - organization: ${GITHUB_ORG_NAME} - tokenRef: - key: password - secretName: github-token - requeueAfterSeconds: 180 - template: - metadata: - name: '{{ repository }}' - spec: - destination: - namespace: demo - server: https://kubernetes.default.svc - project: demo - source: - path: kustomize/dev - repoURL: '{{ url }}' - targetRevision: HEAD - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true - diff --git a/setups/argocd/github-secret.yaml b/setups/argocd/github-secret.yaml deleted file mode 100644 index c64ea764d..000000000 --- a/setups/argocd/github-secret.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: github-token - namespace: argocd - labels: - argocd.argoproj.io/secret-type: repo-creds -stringData: - url: $GITHUB_URL - username: unused - password: $GITHUB_TOKEN diff --git a/setups/argocd/install.sh b/setups/argocd/install.sh deleted file mode 100755 index 13af28c29..000000000 --- a/setups/argocd/install.sh +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -REPO_ROOT=$(git rev-parse --show-toplevel) - -if [ -f "${REPO_ROOT}/private/github-token" ]; then - GITHUB_TOKEN=$(cat ${REPO_ROOT}/private/github-token | tr -d '\n') -else - echo 'To get started grant the following permissions: - - Repository access for all repositories - - Read-only access to: Administration, Contents, and Metadata. - Get your GitHub personal access token from: https://github.com/settings/tokens?type=beta' - echo "Enter your token. e.g. github_pat_abcde: " - read -s GITHUB_TOKEN -fi - - -if [[ -z "${GITHUB_URL}" ]]; then - read -p "Enter GitHub repository URL e.g. https://github.com/cnoe-io/reference-implementation-aws : " GITHUB_URL - export GITHUB_URL -fi - -export GITHUB_TOKEN - -echo 'creating secret for ArgoCD in your cluster...' -kubectl create ns argocd || true -envsubst < github-secret.yaml | kubectl apply -f - - -echo 'creating Argo CD resources' -cd ${REPO_ROOT} -retry_count=0 -max_retries=2 - -set +e -while [ $retry_count -le $max_retries ]; do - kustomize build packages/argocd/dev | kubectl apply -f - - if [ $? -eq 0 ]; then - break - fi - echo "An error occurred. Retrying in 5 seconds" - sleep 5 - ((retry_count++)) -done - -if [ $? -ne 0 ]; then - echo 'could not install argocd in your cluster' - exit 1 -fi - -set -e -echo 'waiting for ArgoCD to be ready' -kubectl -n argocd rollout status --watch --timeout=300s statefulset/argocd-application-controller -kubectl -n argocd rollout status --watch --timeout=300s deployment/argocd-server - -cd - diff --git a/setups/argocd/secret-argocd-secret.yaml b/setups/argocd/secret-argocd-secret.yaml deleted file mode 100644 index 4de447c70..000000000 --- a/setups/argocd/secret-argocd-secret.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: argocd-secret - namespace: argocd -type: Opaque -stringData: - oidc.keycloak.clientSecret: ${KEYCLOAK_CLIENT_SECRET} diff --git a/setups/argocd/uninstall.sh b/setups/argocd/uninstall.sh deleted file mode 100755 index ac7c8a914..000000000 --- a/setups/argocd/uninstall.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -REPO_ROOT=$(git rev-parse --show-toplevel) -kustomize build ${REPO_ROOT}/packages/argocd/dev | kubectl delete -f - - -kubectl delete ns argocd || true diff --git a/setups/config.yaml b/setups/config.yaml deleted file mode 100644 index a52490426..000000000 --- a/setups/config.yaml +++ /dev/null @@ -1,19 +0,0 @@ -# This is the GITHUB URL where Kubernetes manifests are stored. -# If you forked this repo, you will need to update this. -repo_url: "https://github.com/cnoe-io/reference-implementation-aws" -# Tags to apply to AWS resources -tags: - env: "dev" - project: "cnoe" -region: "us-west-2" -# The name of the EKS cluster you are installing this under. -cluster_name: "cnoe-ref-impl" -# Set this to false if you want to manage DNS somewhere else. e.g. manually. -enable_dns_management: true -# If using external DNS, specify the Route53 hosted zone ID. Required if enable_dns_management is set to true -hosted_zone_id: Z0REPLACEME -# if external DNS is not used, this value must be provided. -domain_name: sudbomain.domain.root - -# If set to true, we will store secrets to AWS Secrets Manager, then sync it to the cluster using External Secrets Operator. -enable_external_secret: true diff --git a/setups/install.sh b/setups/install.sh deleted file mode 100755 index 65a1a7ead..000000000 --- a/setups/install.sh +++ /dev/null @@ -1,34 +0,0 @@ -#!/bin/bash -set -e -o pipefail -REPO_ROOT=$(git rev-parse --show-toplevel) - -source ${REPO_ROOT}/setups/utils.sh - -echo -e "${GREEN}Installing with the following options: ${NC}" -echo -e "${GREEN}----------------------------------------------------${NC}" -yq '... comments=""' ${REPO_ROOT}/setups/config.yaml -echo -e "${GREEN}----------------------------------------------------${NC}" -echo -e "${PURPLE}\nTargets:${NC}" -echo "Kubernetes cluster: $(kubectl config current-context)" -echo "AWS profile (if set): ${AWS_PROFILE}" -echo "AWS account number: $(aws sts get-caller-identity --query "Account" --output text)" - -echo -e "${GREEN}\nAre you sure you want to continue?${NC}" -read -p '(yes/no): ' response -if [[ ! "$response" =~ ^[Yy][Ee][Ss]$ ]]; then - echo 'exiting.' - exit 0 -fi - -export GITHUB_URL=$(yq '.repo_url' ./setups/config.yaml) - -# Set up ArgoCD. We will use ArgoCD to install all components. -cd "${REPO_ROOT}/setups/argocd/" -./install.sh -cd - - -# The rest of the steps are defined as a Terraform module. Parse the config to JSON and use it as the Terraform variable file. This is done because JSON doesn't allow you to easily place comments. -cd "${REPO_ROOT}/terraform/" -yq -o json '.' ../setups/config.yaml > terraform.tfvars.json -terraform init -upgrade -terraform apply -auto-approve diff --git a/setups/uninstall.sh b/setups/uninstall.sh deleted file mode 100755 index 3fb190a7b..000000000 --- a/setups/uninstall.sh +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -REPO_ROOT=$(git rev-parse --show-toplevel) -SETUP_DIR="${REPO_ROOT}/setups" -TF_DIR="${REPO_ROOT}/terraform" -source ${REPO_ROOT}/setups/utils.sh - -cd ${SETUP_DIR} - -echo -e "${PURPLE}\nTargets:${NC}" -echo "Kubernetes cluster: $(kubectl config current-context)" -echo "AWS profile (if set): ${AWS_PROFILE}" -echo "AWS account number: $(aws sts get-caller-identity --query "Account" --output text)" - -echo -e "${RED}\nAre you sure you want to continue?${NC}" -read -p '(yes/no): ' response -if [[ ! "$response" =~ ^[Yy][Ee][Ss]$ ]]; then - echo 'exiting.' - exit 0 -fi - -cd "${TF_DIR}" -terraform destroy - -cd "${SETUP_DIR}/argocd/" -./uninstall.sh -cd - diff --git a/setups/utils.sh b/setups/utils.sh deleted file mode 100644 index 29e2450b6..000000000 --- a/setups/utils.sh +++ /dev/null @@ -1,45 +0,0 @@ -set -e -export RED='\033[0;31m' -export GREEN='\033[0;32m' -export PURPLE='\033[0;35m' -export NC='\033[0m' - -check_command() { - command -v "$1" >/dev/null 2>&1 -} - -# Validation -clis=("aws" "kubectl" "jq" "kustomize" "curl" "yq") -for cli in "${clis[@]}"; do - if check_command "$cli"; then - continue - else - echo -e "${RED}$cli is not installed. Please install it to continue.${NC}" - exit 4 - fi -done - -DEFAULT_KUBECONFIG_FILE="$HOME/.kube/config" -# Check if the default kubeconfig file exists -if [ ! -f "${DEFAULT_KUBECONFIG_FILE}" ]; then - echo "${DEFAULT_KUBECONFIG_FILE} kubeconfig file does not exist. Exiting..." - exit 1 -fi - -if [ "$( grep -v "^$\|^ *$" -c "${DEFAULT_KUBECONFIG_FILE}" )" -eq "0" ]; then - echo -e "${RED}Error: ${DEFAULT_KUBECONFIG_FILE} kubeconfig file does not exist or is empty.${NC}" - echo -e "${PURPLE}Info: Please configure a valid kubeconfig file or set the KUBECONFIG environment variable.${NC}" - exit 1 -fi - -kubectl cluster-info > /dev/null -if [ $? -ne 0 ]; then - echo "Could not get cluster info. Ensure kubectl is configured correctly" - exit 1 -fi - -minor=$(kubectl version --client=true -o yaml | yq '.clientVersion.minor') -if [[ ${minor} -lt "27" ]]; then - echo -e "${RED} ${minor} this kubectl version is not supported. Please upgrade to 1.27+ ${NC}" - exit 5 -fi diff --git a/packages/argo-workflows-templates/base/cluster-workflow-data-on-eks-cleanup.yaml b/templates/argo-workflow/base/cluster-workflow-data-on-eks-cleanup.yaml similarity index 100% rename from packages/argo-workflows-templates/base/cluster-workflow-data-on-eks-cleanup.yaml rename to templates/argo-workflow/base/cluster-workflow-data-on-eks-cleanup.yaml diff --git a/packages/argo-workflows-templates/base/cluster-workflow-data-on-eks.yaml b/templates/argo-workflow/base/cluster-workflow-data-on-eks.yaml similarity index 100% rename from packages/argo-workflows-templates/base/cluster-workflow-data-on-eks.yaml rename to templates/argo-workflow/base/cluster-workflow-data-on-eks.yaml diff --git a/packages/argo-workflows-templates/base/cluster-workflow-spark-rbac.yaml b/templates/argo-workflow/base/cluster-workflow-spark-rbac.yaml similarity index 100% rename from packages/argo-workflows-templates/base/cluster-workflow-spark-rbac.yaml rename to templates/argo-workflow/base/cluster-workflow-spark-rbac.yaml diff --git a/packages/argo-workflows-templates/base/kustomization.yaml b/templates/argo-workflow/base/kustomization.yaml similarity index 100% rename from packages/argo-workflows-templates/base/kustomization.yaml rename to templates/argo-workflow/base/kustomization.yaml diff --git a/packages/argo-workflows-templates/base/sa-backstage-scaffolder.yaml b/templates/argo-workflow/base/sa-backstage-scaffolder.yaml similarity index 100% rename from packages/argo-workflows-templates/base/sa-backstage-scaffolder.yaml rename to templates/argo-workflow/base/sa-backstage-scaffolder.yaml diff --git a/packages/argo-workflows-templates/base/sa-data-on-eks.yaml b/templates/argo-workflow/base/sa-data-on-eks.yaml similarity index 100% rename from packages/argo-workflows-templates/base/sa-data-on-eks.yaml rename to templates/argo-workflow/base/sa-data-on-eks.yaml diff --git a/packages/argo-workflows-templates/dev/kustomization.yaml b/templates/argo-workflow/dev/kustomization.yaml similarity index 100% rename from packages/argo-workflows-templates/dev/kustomization.yaml rename to templates/argo-workflow/dev/kustomization.yaml diff --git a/templates/backstage/README.md b/templates/backstage/README.md new file mode 100644 index 000000000..632ba46ba --- /dev/null +++ b/templates/backstage/README.md @@ -0,0 +1,3 @@ +# idpbuilder-localdev-backstage-templates-entities + +created by Git Repository controller for backstage-templates-entities in idpbuilder-localdev namespace \ No newline at end of file diff --git a/templates/backstage/app-with-bucket/skeleton/catalog-info.yaml b/templates/backstage/app-with-bucket/skeleton/catalog-info.yaml new file mode 100644 index 000000000..c6789241e --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/catalog-info.yaml @@ -0,0 +1,48 @@ +apiVersion: backstage.io/v1alpha1 +kind: Resource +metadata: + name: ${{values.name}}-bucket + description: Stores things + annotations: + argocd/app-name: ${{values.name | dump}} +spec: + type: s3-bucket + owner: guests +--- +apiVersion: backstage.io/v1alpha1 +kind: Component +metadata: + name: ${{values.name | dump}} + description: This is for testing purposes + annotations: + backstage.io/techdocs-ref: dir:. + backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}' + backstage.io/kubernetes-namespace: default + argocd/app-name: ${{values.name | dump}} + links: + - url: ${{values.remoteUrl}} + title: Repo URL + icon: github +spec: + owner: guests + lifecycle: experimental + type: service + system: ${{values.name | dump}} + dependsOn: + - resource:default/${{values.name}}-bucket +--- +apiVersion: backstage.io/v1alpha1 +kind: System +metadata: + name: ${{values.name | dump}} + description: An example system for demonstration purposes + annotations: + backstage.io/techdocs-ref: dir:. + links: + - url: ${{values.remoteUrl}} + title: CNOE Repo + icon: github +spec: + owner: guests + lifecycle: experimental + type: service diff --git a/templates/backstage/app-with-bucket/skeleton/docs/idpbuilder.md b/templates/backstage/app-with-bucket/skeleton/docs/idpbuilder.md new file mode 100644 index 000000000..3ec74fb94 --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/docs/idpbuilder.md @@ -0,0 +1,46 @@ +[![Codespell][codespell-badge]][codespell-link] +[![E2E][e2e-badge]][e2e-link] +[![Go Report Card][report-badge]][report-link] +[![Commit Activity][commit-activity-badge]][commit-activity-link] + +# IDP Builder + +Internal development platform binary launcher. + +> **WORK IN PROGRESS**: This tool is in a pre-release stage and is under active development. + +## About + +Spin up a complete internal developer platform using industry standard technologies like Kubernetes, Argo, and backstage with only Docker required as a dependency. + +This can be useful in several ways: +* Create a single binary which can demonstrate an IDP reference implementation. +* Use within CI to perform integration testing. +* Use as a local development environment for platform engineers. + +## Getting Started + +Checkout our [documentation website](https://cnoe.io/docs/reference-implementation/installations/idpbuilder) for getting started with idpbuilder. + +## Community + +- If you have questions or concerns about this tool, please feel free to reach out to us on the [CNCF Slack Channel](https://cloud-native.slack.com/archives/C05TN9WFN5S). +- You can also join our community meetings to meet the team and ask any questions. Checkout [this calendar](https://calendar.google.com/calendar/embed?src=064a2adfce866ccb02e61663a09f99147f22f06374e7a8994066bdc81e066986%40group.calendar.google.com&ctz=America%2FLos_Angeles) for more information. + +## Contribution + +Checkout the [contribution doc](./CONTRIBUTING.md) for contribution guidelines and more information on how to set up your local environment. + + + +[codespell-badge]: https://github.com/cnoe-io/idpbuilder/actions/workflows/codespell.yaml/badge.svg +[codespell-link]: https://github.com/cnoe-io/idpbuilder/actions/workflows/codespell.yaml + +[e2e-badge]: https://github.com/cnoe-io/idpbuilder/actions/workflows/e2e.yaml/badge.svg +[e2e-link]: https://github.com/cnoe-io/idpbuilder/actions/workflows/e2e.yaml + +[report-badge]: https://goreportcard.com/badge/github.com/cnoe-io/idpbuilder +[report-link]: https://goreportcard.com/report/github.com/cnoe-io/idpbuilder + +[commit-activity-badge]: https://img.shields.io/github.amrom.workers.devmit-activity/m/cnoe-io/idpbuilder +[commit-activity-link]: https://github.com/cnoe-io/idpbuilder/pulse diff --git a/templates/backstage/app-with-bucket/skeleton/docs/images/cnoe-logo.png b/templates/backstage/app-with-bucket/skeleton/docs/images/cnoe-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..63b8f228ef58a42a758e570331053afc547df964 GIT binary patch literal 58052 zcmeFZ`9G9v{68*{rH~?`;&6(H5g|JjN+C3sFl5PYWFKpjQ_5N?`&L5P_pyzovSr`* zv9E)%jeYoDw@$s!`F`G?Kj8Ctocf`=d%2d^@_en=yt=QZOh?N`OGZXUcjxvkO)@fy zbuzM}CDg~jo%lXaEpUV0>gLV+HaC@TB5je5S`Lp)&6UmV%^j^wHI;9WkzEfCh8tR* zgEPs-l;rdO+2YrglJb^*U-Vspt!DdQ1GD?)`F2BB!fXo^UN%;21s zaK~R4U(pZ8T_nH4mL)LNIi6oP{r$V7bG3IHop+l6f5>~j_m_^aPkgN$SR`=P;(9kQ zn+F#7tozDGUJgI+%eel7Yuub{pSdQ_@F|7DZaqz}$rjCbDce}i@l)Rl$#hub8J6=} zquvO=G*Z06n-;YHeefmK4EM%E3M!}N!4PTD&zYCG8WkJF(xcV5JF$MdzD0_|Hs1&R z)I;-yyqQLh7H>rGIfjq7ums`ctXC9M#F9}#!N%po$BtH&NxUv*DvC62OD*IjMOMJu)l92$0srI7G z3qrh5PFxiA_*)5<<7`0}VcLZ&H|l+L3VA-AG%9lT4ILkc3D6%tFSeZ@uPZu=3J3PD-U^o3;Efn{4@Et9x`|-~ECY`f5nlmqVNwzRJVOE`D=2_KYYx=S0)V+Zc8t9M{`-ui8w;|iM;I{QZw z=UbizEwdoAc1aa_(YkOhC$qJZ_Ab;BZp{So!1BOZH-*}L3$w`4g4P<91o4x7t$nRF zKi>D+BP6};bpp$jv=hpDoaUVWv|zIqaIPQdigRo|_-ZuMn`1O1{_w;;mCsRM{Gc{Q z6o0Kro7TG&ssCMhO-9X3Hdz2}`zSx@qn@bt4mn37nRkhM8MVbR{k_S}2D!I34V!N{ zF8NO2CS}K3oDv)po{T)LHyjmoG;%b0!r_#lY~6(-T(eoqPRga7wu;agO1SZ`Pe7X2 z?77U>Z(q&ss?RdN_>1Nd%)?bY{d6#kVcD^|9Hd#gcg9neFHQ^g8Tmb9au1ZkkMVe= zOb|qls@YHc#eGNaEZ1|pGLOF&i7Bo=cVz~$(X~!1w$hX)UPfNmWSQi?I{2L(39Qgq zSm|<{%WI?`53-6YD2$#D_|`BvVM3cN%y;I*R8=A`zI3+iTzd+AVT9!rS&pah^{>b~ z`y`e@RI<5K!m;anJW`tvizFCEGmf_HS~iM3wV1#X$TDP8+&47cdA^&BkYDfi`&O-^ z&eodFfhX#_+h4?y^?6|t2fHK>@3o^{BV@&i2S*Psx*xAG?P&x6am!ry&SO!T&m!vb|GN$?7#)dO8; zUDbP%rbs)%M`lP9b3u1I2j~SdX?IC*X=m>Ih|}H9*4|0dU54xM4M}hf-G*^-9=_si zBg3VudY|(q($Sn#Oi)Nrh)b51lao{0(d@CL<}IbaKL`Jl;j(mgc94X@+}zv*-9!YD zjux=15)u+HAz_%XumE^NzzJpV{K#Fv-iiC?Aiu`BW$t9^XyxE+g|z2{#(iXhba9s9 z;({jn{paU8ovj}K&rJ4Ce{TzH5C%PgT@@69{coR{yIcKVK7*e8{OoXFKc|z129s2G zv@!<^hL$CJRr+v(f8G0^?{xT$u-J8J*#G+IfBjVNe?FBE z75V3v|9JBEm(nnZQ2!v@Pp%x^1#FR}m4^Lhu`I3Z(#0AwGI_E)w-g?@A6XcdvpuI% z%Dbhddc;P;JzQ+K%B$)a`xQ>y7Ugt};If#A%+cFl{~Z4m6Uina9(R|U&AsHy_tz9n zFX<5l$A{u=!~FS8#VegR#B^_~{3$1ISU57L9r*6M+;BI1xO=#g+)}J8O)YLM{Zi)s zj?~QE2BoKDN60CtPjbrtckv$){*#3NwBSE2_)iP|(}MrB;6E++PYeFjg8wJAfdAtC zj4sO)FaG7)mvZOqEgZDnM2g8w2=q~@qP1E#~+;a%GL)J2O56&?8mx~lZee=Q=6y30_UFj16ly*rV*cMp0tbDU|0kmvu;*(s=FxnK7- zdrHmL;m)QE#9NnPRtSKhb*b?yub~%P7+-&IqYp~`CoSYh&!LrinsAm{H%EK?u+-Du z-nH@l@o9WVu>BNqs!yxfXsBm1+ndE6{PXRmKOJ_*Tq)Krv~<;$@aP!Dl{L~s&$r~| z57#2rsra|5ZN5Q04YkoMgPy3wJQ4fBo`|@$`952 zpg<-x{|e=LOa6*9po1EXfdsMd=0Dc}1o2B1zFI-L-O18|^>CXEtWbLh4#Q893|2 z73Nk*d`*Fvg)08!;_pE(Pmwd*u~c7g)O!?^|3F&#DH)mp3@1CfeDt5AQGYU^Fui}_ z#jP?$p_Y%@zsEcZ#$>p@_fH)4G#;U8f9d7An*eXOVTt=}X77m;d- z4FN@pD>ggjnA6qeGo3EuUG0^rnObtF+mO(60P*pr7+3!1nlj#3<$PQm<*gmMr8uZ# zm4uOM%EB|(6`oJml+PB6KTUH|mkP~~7rJfw8)7UqIH``xHl;|Yg%U1c+!a+%bGE&c z-zRx%ZD_r(u>IUHyuLQ<7KOt4sQ3}^h5EKVQmuMmdAbaM%*5hWr8|FXrzL_@y`BBt z?i_Kn(>fBfbP%pd;Ds~tZh0jk1u~|$3vVYfqI>=PEN7Is?T7&!9TT1soyhX@p&a)} z*fg_Q)!=Cga*Cci@)|)drGvGmj z)1+^fM75g&aw_VTgQQQHF`Mb?@i7apblP!+4fHNdKwf&(<>is2r4q)|e=Ee}(~;Oy z)9JHS8uQGg`f+?rywu>LgBbcDxfazFtXM_x*^@$y_v1@T%~Yg!Y1x9;clQkWhU1Z@ z3`fXqV8%Zd2P!GZesMU3>GLsvt@xFdG1M4I>dhESl!D(odzmfKWa_1*47b5=MFC%P<|!7J~T=q?~C5wdRa9|o`1zbZX13{W)*&~b+N9R^x)P84xo8h{Oomdn~R60 z`?Spi`c#a#@M=E)Kzy(BunMN6uQtq6e?}CK0tC*;2iC-;Vz*Z9Z-LddN5i<}uSUn~ z(_N@Yh>zi)^{HqVmvJjWX5qyDY;zaN-ct7PK)R*jrm76$j7{R4QsyK50C41#lVhhA zOXGhD6!ppL7lq>EV>ClhX0UNzE~l?M&O6oe z4EYpG_{>T{jEDtzDwVtZ^4Cs{-%~ics=v4Y(rT9teD(x?(_9(xatZqd=X;!QaHQN-wZbv zpj7H~O8*=mgM+uK<}M+a@c~isW#O=w?>W|+cO@btQa_33Vu4FCPr0_*ZPCz{{v-C$ zU~6+9 z#^>8q?Ia?_8wrZ-p7Cj0GU@rua}VP>V}V6S!&!jP5T$Ir{uY`eY)`9rfKQb0+Wpxt)+RndbCJ%x$5ku+>uJl0vUiTun@;Rd@2F!v14n4QsK^yc8B`4Z6A@abT4T>uv?yMfC z3$!VZiQn~D?%bU#QGCK=Lm^nct?%wS$7jYHt;xDqbMBO86JDt{aZWMoaD>`n7J`@E78L~s8dU0|lZXWUH z_|0!gexc}iPgYW+5f2#XNpK1|)wdTcs|oGvLwq&YCStKH-A-C&OK|g%^`YlOq4tP^ zIb(!Mc1LZkT2iNN{!nJ+h3__-YT}H<03fF6f85Wg6$<(-vBrYr;vDOE%GLniTki)K zwRhdue3*J>Yecn;J(hUxk45Bfig9@Y?NoQ}8Gj}A3RlcCblD-aq zaJ*UTtPx#ZeVqEK89d_F7fPZFyM2Kc`*l{ixq!jHsYAFD&s}xf~VS zc^@I<=2+o+X-!l4W;WV!jdb%cYUB*>Im9byf7+^}1lYdTi8Nm7wC$J^xBSk_i&dVi`V=rNe;VRJD%bx5`}AZA*nNGYBW5&FeBUhSvFJ=mm@bX zrFbyp-_ozp!;br}Z{d6zb=sj=BV5Ti&v#O=*}?hUPkQRwpe1^Hl#JN!^#Og|h z(kA6vOGPNTheertI2pQ-85ov9edOpNkb_7h9$S0{9ZsU2^d4OLOtIZjO1UoUqcHXS zfJ#Hg?V60Zx}9NM=54^v63yiqcJEH787~{BihyKR{On|Hw8 zX*si;F_Wzf6j?Z{+S+`iq6>0#{U+;DX{WufIBv8`_^mg%#aIy5A;kK(lZ>7^6FIm( zP#fha|7UgsW=KKy2)4n972qM9e#zzPvh?~qcvaeFzBZpq^wW;*oUb;uhdxP;9QQ52cROuzA^36o$O6=Cb z$EwBkbVS2N1N(E3*SM|tQk93q#Fk~PosIO#KNvdXNxx`jjte=fTlU~F2rfj*;81Jd%Gx$w6ESUbb2nl1BEyv(R| zw}amai?YBswBa}I@=%!`JA^5>LZ58l@ivEevgwznObRH*rFjd_4wmP3mJ zYMmZydiE3Pasjp&toF00=FO7rA7$`Tu@{F)6}%wGH!fw9P4FDT*V>uc@$~@{UDQ?b zpj=%~Mx)CW;R0J4@R5|XzB{dm$wK1JT1947uLe47uEgrP%;qMbvyuZ$z1?ubc!xLA zo16BEmt1UojL4=3`|k0C=otR~it~G2U-`#1Ja&fdk1wWlc?rRi^M%)H<2cOqeI)kV z-JpOa5&<#*9wHWhyU8vTwVgJNA!^y@DXVulPS`Pd8GPh4BAQcNJh)gGm8rwj%H6l! zO{M0eOAna-*uTAhPn32X*j5030wkH{s0uf(VoaF5TwkEdXMfa7rxAO(`lz}QjKlC0 z?KCk!&L~n;kGXCoIz~28=Ru4>pY>ayJa;bxV!Xqs{!BPly``DV$jy^{iGcO4517-f zf{7#2L#LlncG{z?KV|BZbEvmsQF634>qXpcrxYrZ z=?z=$U78uy)j#q>On7Zzfsn`IZM9ePK>=`I56Ywbj&`U25TczXT?@TiBkB{H-I`LN z9q+j7j~~=Z5SJb656pCD?Q|Yd?$6*%tldBS#SuL=?y^%PDijsZlkQO5zeVu1sc4m0H^;Nb3z&H5rS5cH1_z$~+D({j#xzdx*qUR+ z+Cklqt~dr+YhlS?z^p)~<+)leqT$bkw!tNbevf+~6Q`mm2RHX!>TDFmd*TxK`%|=g z!X!&}J}1^7n4Y;`u&H~l7+hHOxVcSguDK>u_QdM&s|rNf)?Y6+&(tLG?!3uFv<$6& zI)WAx33`0tuVdCUlMH7O3`HOc;I8lW5=z&`$jV$6Mke3}_t&>y#5dHy2J}=Cx94+G z{iWv!OLIMb*@ zgstlr(D^Ep=C<=CUkM!-d!+ER5r+j{X8u-9yVfu<=OP-4^d2)Jm0x>EWv#B*d`LcS z)M1q{0bj~h?Ds07z?^Ou*ne?P_M>iZ>go@Wi| zuDzww@fypQsa)4|RDcX8JoL@39m##fpMQ`V&}-T`c>U$D(n{dDrm}%Sdpi#gooA@+ z_y;R)Uk|H4A|TV+{C&pkF!|B;Ox{PtfWE>maVqwrlf?sVxfCAX z{@vw+4cvZ+6OuL7fZ_6pSqNNJq8 zDvGH`mU=eBTbu1#c2b7d2R4jGRW0y^Bc?jK+URzFs@9}ks&9Wx%Im=wKRuWth_jv7 z)(FbFYLkSyuuwD7;GZw%G`;=p<5gb?X(yx8>RARt$d`Hj6v1MUcrSpEzR`z@2)RcT z+RB{js-7Z!Mr}_kSdZb-n9hpOfh^Uy>TXUmTN0Zfy_~^>K;<^35XPyW?QN>Fr8{co zVGnW^q@O;sR9V}PI*WvZwVe6+pywBB@l){bxHZ@VPj$2N$jNaQ(tv=0tI7V;*+ot& z(U>N_*b1^*b5gu2!wWyEi& ziWUl{%$?bt3++v9&HAD*A(q{|39vYVF1ejV+}#nA9^AiQv@c`HbjQ?2;B|f@a1Qx& zG(v*L8!-KTYDqR6V)3Gpb+6M2_P2zxvB~rwh3-(S{g_W}Xt*Tl=-S&EQG%+JBu#t| z^{*cA+&#@fkcU|HS$^<<)j&h+8`q&VraL}a)6-au_?9WwYY{J& zj%N~W#EcQYj;89jFPJC$7xguy1H{WbMc@eRu%; zKw63CjCM0=dZ+QaCqD`JHsy@13XSS@5^0Ds4s?>w0><#q`%IO}Vq#w)KBofa`7!OK73D%R{@9N%9C8z_O(S z7|y3e4M=SZfxNhfBf)s}wDq|X+v@UCEqkpiZGAcR^Hp0vVOA!JciY=h1MF`XoG*>ZE1(y$ognbzDP4!S&6wYNjtO<-jx)i%x>DZ_*C&OH(o)4Z=!`+!qxW9IMO{}pbe_+lZUGpuru3Tso0V^4W!cwacOHgIeYrO%VCMMU z-1hDtLTP`Mv7oU@?gHm(Z9W7yePUGfNis|ZLCVdY2_h+ZxxJyA#S#->w?)_6I9QVN z)$Q~TRNC^Of?Txq#Jh%8`_i(CFfHSlmAI6O7q*oyJ}ZHkHI%JEN8tk?}?Wc+@;q|d}@oO94}k{N&!6mP=@;z z$i0g|@?CMdJrIue3}hm7tU;}0p4=uLh!$LV6y-`_Rp zn;kLQJEcXtX`_C*2`}C(Y4};^+$~q!%5&15`;6t2jU;zT-^JvW^&!XWqHa9#HewSK z6ZqW{cJj5>9(L7jfN)R5$<|HmC{{;``BGBC--r&hg!A7aC_UESj~Q5U1yyLXX;Rmg z;*08XPyb+yl$D?2N_pYswy=%rClE-P98tXbD~9e-bc+d-OX=9=skaVM#L*A|{g9qn|Mrbf4n z&j=s)iM?A;#sv0dn2S)n7F(jeWbL?lyFawuxUK#_~sfwfl47@MXn3Gs6pTUzwl- z9j{@NR*vL!ELMA;-gjs&W^+w<$!l-DNe(6{f}B2Ld6?79d-^oK_XvbNSNyAZ8!d{A zbvwDwpJBZnb6PYe)%U$0l1Fl5$j@Yq7z-B<&77@y@VQz#YmzMxH2)-vC%vxmVQSi{ zc)#>c1BEJ&H|1w(n;kel`IQBE%s(@WK{8vu&$795Z%hSLKyef z1qY$T=tQK1)1S@fUVFVWgJ-O!m$RETcA6YGc=MmZ?0jH9-*KFrg?jQwHs-=Du_qFy z8*7xkya7fX-NBh9d!*(Gl-9e!N@rWN2;cF#>58*`(Gste*ldfn+8NU&pP`v_ksYDmFMK}Q+raGfA(3a(bvh4$ zpr6K`zsAwjcou_|p!`#PQW|no&=S?OmJ>+?S4Rsk8o25A9es0xDiFd2bAMkHKie@f2&V}sNuC8E7cSD`X&_xtx_`-|n z!&a25RDVv5qK@8WjrE;EspU3fi%G_EeEqbbcS?Byv~rN4oxrHSTY!Y#$iE3`ky#>+ za&9zhM`2VzC(?1-x*>|%ehRn8L=t|^`+MOPB|gs6@~a-VMRYD-*?$x7 zgWFA7SI zM{NYNuX6f4Ub_yy?sHFvTZ91G;Iy+v?7egwTtTPXwZVb3i48Sh4(63e(t%9s;QAp_ zO7e3i_V(*1nL_&C_6V)>MQ1_D6}Kh=%1rw$O*Ya~;!$!VGG!zY*!&$JS{W~^c=?fX zN+N@ADOsG#1BT1y8jL~&WizU=66p(e6l(*lI@w!J85oZ~W2ETe%FlxeGk%M%Lk2Pl zv+v{)rgOZ^R&vi!bu$|ox8J}WmvDDn%h?_W-E;h83ZW1m`I;U-tiVLVuhmn^sqshS zrUla{ufDID0Su8Jxd;eWKh@?~y3ly(p7fWFZS8HucwiLTnRswat6&{#5g(iDLF3Llw zA*_2*Oc&bjhpImnic@q~Z_H#WbFf9#Y(F9r3PiBLE3^Jnw=sIp^+O9ahd zA0#XT&p`96Wax}F($h|EZ~KbgTayZNIm~0wiEesooF$v8E|X$y_1ze#bx!RH1d{S}uq3cJ zG>{L`;)WN8jYv)>>jUE={G{>?FXKMxQCW%IumC+o-srteVVxX-boNYFF$?J#hC96BzFv_?1!CpqgS=tna0?~G4dcsDC3akF?kA%j za$1(&t=UR9^@^xAY!5sQUdRr~g1Y&$Phh9RCU!oP7Z?UOwGTm8}Z*Txi zpJPp4GOHMm(1#l-3uO=6Y3QL)*m7~dbMm&_x?kSfm1VPKLV#}t<+V3@=B^(~lM-j8 zMw~f6SEL1+phppR_o+M!rII3SM!z%xkAwS z`c>qygzXcXsVT%vqPc|o^+qzm>znX-yM>Hye`)hV6x!bqT80DE!*Nj_>VP@KE^ur4 zO_f(_Z%E#1R_#MnATQ^;x}6m1bK3Kymml76tUXL)zgm<)$m;i(u6b;YU4O#ucAFc5 zi%+0F%YzJ5`#U`k-TGW5o!XmH(3epzCo|;1(qzMP^r|`s;z43w5)3wcXs;T;MlLxy zLbYQ^77wWe>NMvk?-jyk$Tc8D>B=GUvGC-L^>)Z z9R@{jpT@HsdL@U0Kpn22YbYvBSSOpbv**V)r1fb;GdH&^hd7B-=gC^Sc0H|AwZ;Rb z$VA*~9Gl~jiNBwy0^^bHcm$TAYXyRn_Z8STj2A1fV*H;FL`((#l!9&=;wRS6G72;(S7-nW zY!KmmCUNDUdhyUDuzw)IgdOgY8L`>WERYuYgVc~8e@ILkFv_LB99h92J({Eafs1GA zykmj+8#39A2926z=sT3Fk|=W&Yo|?R^!mGFA)fDKNBZ|I=`{GM zxa7A9=?_KZ2m$dB@~S|{`*%2fjdOWHasRuQTpBCx)rsI^Y~_isKv_+IIR0?NK(2h0 zw+z})q5wKJZX;zNR33-1GaL_dWiebg8Tz2lu<yAf_I4c1L`yoIqk$GI2H|5-v~sQwLLm1lE(;)ZjV>sc!Vwt>Gq-DKap;2kv$rm7oJ*CS zCevY5gk2bsLGZdDxPhhy*m){6DeBA{^5z6WT2)mJb}@Z%Q4-RKyeg3F;EHrBZWEkN zM6{f|MsodtsjdNSrjO8%ssj}=!dUv-*9J<3v0|Z{Jw{1=%IR8x+()07@;nPCp;iPJ zU0&FT(T5l9N`j_5v><4+br}}cf9nj|?e9}pXP+Vw}q5Ul;UG!WM)L^>@>tYg^@dj!=xJy9slqNw9&AN}#v6S%l68xFi!g1h=|5zUw!f1>IlH9v+ z{@RL!y7ftz=eA>!1ogZ3zT8dd{)=F+3V;%ugf|x;_Ff?GoqqC$Cc8bk;$EM*KUi(z zP4c9uh*N8^~&%1UK-=t4dQx9CfMKzyqfVIn7$quKm--IfCL>7 zKwH6>^?RBlCt*;6VFu0@KmwWI>ey`0jVXKF$g8g`{<--z8Rd~CWsGoJ--_M61vMa0 zps!<`v;pPPtIWZ85j6dWCTs1?a>H(UjbSJmsO;CH%SRfq)Fz8H@&m_B;xgBHy(@Af z=m~=RNHj@i{hfTcnyOCu!gK_{hMZIeEkiSz=H8#)CP7P%clB&3lq5y~a7L!vqLmr<~bV?oBu@T&B zU%F-rw~Z+?$}jp;#8F#e<}_yx7uY7hBR8ENpxIs6>yay@v7P;n&~H$|sVxN@ZP+~? z{V*oKlb%b;uCjSdwR;2VbW=dFzV|}jbHNo*rJG1)_D$7ASnaO*ojVLOSirIjKbdlX z{Zcn68%KiP#?7^AS7y+^qB#m2m5kj)<52j(vZjjO}M1~^Y#mR za9j2y+l&uh>W9tvCn2^TgV>sL8@=U^GV`i$(w~%Zu!D%1(Ka!Y{wqaN%TBcWtt+&k ze;(Utrk+eRsEkS}xB(PVl!cXQ6~VAdbobgabO{Gf%bnSxP?X6nG=?*^GzNHoRS$gM+ML6_wRMSuY-D= zp_VO+a{>?67DnWe={n3(xB$3u@O!cF*j)=~9N#Y8v(LL3kKANe~ zhl@o4xV3>9$v1#h{Fi_SX(Ha`@LSm>F9}7Purk}QoUO+@hz(rl&yKyRjmT=LV6>Sc zdFdEiYE)hVy^Lw%u=#l?@I$|cI*+3CtvG*^JMI+gvDF_?lT%@_58Y9e1b232v8;i^ zRLrKE$^6QrbM5-)Ulcr0Rb*@0pW!<1HglhFgXK3TMcWE1baf&+v%dkk)_=ipM16Lmu)^H|$ni7w`14X9)|sJo2GF&7|RabTQEwsmo+`K@W9VMny+T zcW;6#0Y0LWY?Cf~YXZtYOGAd{!vfpyEv8?7Ez+E34ND1LswEpt5c7yPX}OW!f$;Dk z%$DCgv%hz!+Ge0=6D+Yl1vfAimmy`9U2u}0oxB*p=VLLyekD)M4jOJ5bOaD&p8o@G zFEP#D`VcsacaXHoIKH`s8~aNp;o#B4M;7GF{dKO;EMA{Gz;kgklR^u)OL|sHaPjn$!CRlHmWt4}brMmW>`0sq=2PD!h29ESsB%1y=3!PQK zX$$I6=8{u*oj^kGTZ&cT2d}VIGerGTBPL^_0c8lYi`X>_LD1?YKsJlWWTpOY}?TSOiC4!{(XQ3xH{6J*Axo}9Cb5Y zs}%)tQZPME!kFuW?BN7`;y_auzt3%uPc@su`Zix7_@$Ly9si(Ca=EV?DbUw#_HjU=L35g+83`_WRV{ijZe4Q==^nLJxf&Fjb}m3!>@-(@xK29i zflcuz3)Fxm2+_K6W18kM!#+72)#X^$;qp8-BSkV-IhhhShgYA68~>FOw;uo@X_7I1T7TLr$j~8WGWX^gNuEgGcT9rl%JpcJP(O(BO<=M$42ABE+ zuW8)R*4dNDTida7Htl|q%_)^K?mba3i{9I5oBXo0X>B&SUrr%gld)f1BRD_cu4@`;a zY>TeLPB~NN9TdePCM0Q|m z)$2BA80$Sz^E3S%A>?XO-!4ZXsl*>6bE?m*K4>?ndeq-j$9{V9N}U1LHO+;wj;D7& z-Y+3n4fi(lvaV;b+Buq7#=V5UF6l@WL7e$Njyo8epf#4WJ$b9

d(w5}BKBAr{wrzd*>V2kjkOcueVOl_vEG7B`N4Za1mCi(JQ%LO+x) z%LR9-%EYJbi4B+g3doS`-R7O*pvV_RJrqJ5OdESQfTD`J#BM0KqyhJzYj9Hzi)*V+ zQsQ7*WRRPUa@%~69fxsu%hu73Axia1W%*`_K$=_%SsqVha1e;XXeY0{>-Afl9cWp` zFLGLR6_yO&!Eme#NaHT$7SWuHR530WMC?oHYTF&q#irR1=tF|?>c8`IaU=CoyQk5y z53)!V^j~dfJ|m=JM)=|lZEL9_h{rbcmxX6S^E#T+h*)vU)5%Y=rs>LXi0MdAj+;g_ zHbAWxkp=)R9Ql=@cuW#4-F&$w`aZn;mEq*qrR{<3=Ji%L@2@h$=bf*iizq`T$c+lU z-#jn$-9e5Hx;4^V$q)gj>K;sv|ER6*I0!Z{@2aW?q*5s zf2}mM{vi=ehVF*WFp)fM{{lXbzVRD8bDVgO!5_U!PvtQb0iTC-6&YjZFiREH&Ata| zpVbDt$IqDJ;k=GlFWlYtk?P^{0<9|b{>rGhY7OGRM5p0uWYuMKvsP%Tr!MuZD%G?l zNORl)8;V;h%00!|mQ`ixU2dR|)55;)x|`wxtRb%hQ=H_>?70-hGvAy_MdHnA#)H3K zNXFGZ$_VZy(2t&wX+W2kXWY>9mbl3;svhjJ3c`Z-xfx$Z3+_-n{^Fp2Ufq%M(2F?_ zEJn{t7Q4t1^5(;{5jBDvNn>-kNb!-=0w9Teg?z-oHwq*Xf{mN<8_Ep!UW2rY^!AFt zd5LJ;Sw#WOb>Fr{t8eMy!4b$g5We*^*vv&(KaYt^{%Y5bw^v%F9TA4qN&?D(Ovuh% zJVI{BTpx8A;_JC`Q>A+|LX)W`Y26>c8*!nx=g2m} zFyLMcUs`9y1+U>Ab2e)?m!4WFy1aV%c$ZbR5t`6cM&5wTEw_$q7P05>Be0*nwWHiX zokHdJpk&G`N^mSHr0Jcsc@|y|6?#QecE!+z6TN+W@9Hz>R)ln@Ehf^(bGoa6T8(*^ zu?ZX*n<<;(#0h7-64ySflSayLE70`aJi}h!SbBKipWj^4r+EukArBw^jACTAxA_VQ z1rZ$m*ALybeMdokP2ly2!F#`iX#1k)8y{CkYkiI{f^JasB}&H>go-j_-(Wx$&Q-cX z%(jB%xkyC`jzc!S*Ed|?WrRpw0PYdr#~<^cV7_J&-RN@WLOpv{7^ciI%c%q~Kl;$=XhFra8o)6=!PA9?H;(!a>+DVmkX33cXTQb%j7u^DHCqtk}cyodMDFAfuv zE#Pp4R75RwCO!6#oNLwPZhFkmP!>bC)EPO2m{^akqz&t`AbGIoy-Jw)B--9}JSt^7 zivng*P%$BOZu09<)EuVXIp{~>CVlE$ktt0q?7nTSCix7Z!ctwY`QTe{;Lc&>EeS%1 z-dy&NQc$hM_?q3PyHO~VVP?CWYv2~*0c>KV31&Lq|7K3(ywCYLHnbv?&OaT&;f+1- z>`iLT?Xpx^RC>aCwl011nD2wD?yx*MZmHEKQKmY2J0FG#>Pg_!v`s4(U|*2K3*nw! zpxft{4L}1Mz&2!d^G~R*v-bi|%pp@c8mu~a%WN=t{yH&W;++SnD==}Gui{Hwc+Cn$ zG_x*NUSs1dWuWVe_f{Y$_qgGqz1{oNuK1xC?3QmMVz2n~sC7m@n+=0ckCbjhP+hpu z$LNGxi96PBlUk%}D_vU5R-jr%Ex=$?nh^lU4sWXPtGuq5gBR&9=hWaCXTwC6#JJpN zIPzJBnRlsUFTOtN)LDtXawf-qSPzRFFX_aOVG(bM%eYV}7|Tg5Yn@D$#od(}zd;R& z>+j2s(@!csb0gF_i{`CrKbc>(LWZ*N2MsBq?joLPqzs=92YcsklL<)MMtFBO9U8RaS>|ZRt4`Q$z7o@;`Pm(8* zDdaQZSC19xiDohu8;r)_>*feBpCDrWC5Cxoz;Gk`QXiwl^#_Vq1DTGLcWPOshY;7w zmrfiUtMy1oFBQbiJqgWwXW}i5F7Lc@AsbADpJApo$*AW4eiE204FIA_@~I$SG)^vo zPgXG!6aOI{m%+kJLD-0~(Ygzrty}iTdop&Fok3?cihS^>N#K@(sed8-f9!qrTa;bb zwvM2Lq9`RuE8U1R3@V|5bT^`ufOLZ+jXk&Mf zL2EkPk=S{B-r&F#%sfsGDIrn4O%YV`b(Fh3IgV+zEzuaa!Pz+uUYX4p7H20c zV&fJscy%r0gR5}(!7g$hFR`1z^+f9YLWbxMr_d5xxZrAm^WtGv5nK4ID zWozUGy?@bwiWO8{5QLob9`BWBdD(jw9ny=}S6%$t0pNP7K0?w!@+0BBbbyMg-c?nV z9q$165#Z23t%dbXB~J9T{R}?m5~JIF`S#d$mHa1_`WOqt$_0)JG7op{0q}wjhPlTe0V#?ZxEq%mQzB4fC}R*2KNhb}cV0L+N%AwB zeNhZNTplcKmreD|Z8{!*xIvy}^s@B_H&r9i$i{fQ)8!cr%Ii~0EmJXUW;2{Zcn>2^ z^3+JqjH5PszBM+3&J_NNN_pl*_*?aj=CcIxV2=em!arT|*@y+)m!;pbY>{jy11W#5 zL#|;8Pz%SC4vc`?LIn|*TejydA9i6cw48AdG&cni{JCD3h|rYT;!@1;LjJy7=NU1? ze}_9v%(iI{qeAp&l0v+s?SkMBr^-|X_nqt&#hP_%v4(u76UaNKdvIC22#S&unU&NM zcyAPeOx7ByFN+v%A&4 zFyT8j8-e5imm&B_?eb2o7Ru0dLwMmv^b$aIl8Ccay8OH5x`sp)#8*3S41AWsrI}jK zN;q(!GpoJSQj5BaWO=W7a0MY_YueSa?Iq6}`bg1BH)f@rR(0N@VxA7><||6Osngj5 za|^a}8O*_z=^&8z8e8&v>};SQoJCAm>?OoL?s?HZ_Y48f0>e8J%{Z=D zWs*RL<N$vR*$26BRVHvcQ;Zo68X9=^N@ZHt?C|_uurWFVy#e*%NlyQ?@miqd2j~B z|3!OV7Cjmr)&ze(NIF%0tE#7E`Yqr9s#^XRbYQNSdYm$DrQ3n6)BAM6nn_(xy*rmn zeoc6rq$?D?(XS}jGr$oj&7tBMcFADUDHWEVHh!#;DZUy2*{8UF+;rB5&DISX9n$s) zaJR|en_oilI!nC`HsA&u-?97V4p=jVpMU7UN6SChl9YEU_r-VArc*>sgsx=_`zE@% zpm)b*mn}_qILF663$y3ldn@fc=8Ush$@pYd=5%5nsa#|`)O6Bo4YhlE+#Pitv>}l= z=BxLq_TiO8JqNWju`{)A8)Snq_Jf54ot55b$yyPPGmyRnNoSnhT35~8e=Z?D;gN99 zDV$g2h^l7vs2KQy^k7p?j}r`p2O+TQ$mRW}Gvj@o=Lt0MZFp$|TWUKnN zIgUYk@p)CU1vY6HTs*z(&p<6bWI8owwYjlY-PXKXNK*6Bd)~;(z=cmyoxDxA!0`JX zb(iz{*Ms~N&2gxnJwF3lY_zj4*lP?322|);sJm{IcSuf959)Ja>tg;Vf{-CC(KYi; zi8YPneRY|wLN;(<3c+lqixXxC_%BH~$ z^1~K=Q<^6(X<927MepsXcwREb;yO^L8B?Y`9awReEkl#ei;|)0yp^dN!_*zCVFk_= zZEYsy#9GCTt}Ac3Ke)`dT1^dxwsX76N9akAm$zxVqVT2*_NU^WJ(Lj33?6lDqLEoJ zEs7!3-<4b|PJt@r_jWXJOp6QHAfmA`+o_xE+t<}`DfpQ=gbsN*+$dQ_nt zC7RUHLglot3@AY8w%iwzcK+nzX-V3uZ=~CS`0hT~nlJ3r93w6vaPfBCFN8DAy#(i? z98zbru_5fBNkiGdbdcjM#0T3f8Y}Kn-&)kX#mAkIZ6_J2jGV$Z?tT7xtM}?WZocBI zJ0MvUUoyxTvr|m__HL7Bs7>@^NZlMJqW%uR!q&%Lm3bRjivaq7VhDy`_1Fwe1f3l? z5-)lNRy&B|-}$I}C!o`lSfcy71R_8bk$8SS+nT*EB&`Gt()`Xs$$X=6Tz$&1iZpN0 z`&aedNvtOa?d3>SlR1G+6_N=G#RUDBPNeE};?pAm70mHxiy^}go#+Aal+8KgM+W)9 zn)7=YhFEmy^9n{^WAz!lS^ZF>jPy|YT9ljR zB%V!dRoqdv%p*b6an-+>we`p)!ZGQo_e$2cL-f@~U8s0ODmLuYm;a^f(F9F`f2p+) zzi@JQi|nQ~BdEoe0ochKbzsnlcsyu!>77F>U`fs5*_L7(`{~IXqx9-NR>N(sC9N!>_m={-0d#9=E5cEN-wKLYfHbzHO7j_ZEwgD zsJeH(3LD**gEb!r5>AHT7?z;Kl6`e{-@^WwzJ0~zg)`q7kr!0W#>`~$7q4(ulTkt; z7Ga_#co%O%#7lEbj_p8CU}n9y!`W-kl#6{RTq*kX;Z5_q$r4nJGpNRE!dsC(W#e7Uk?UfvUQ8##S6O^{u00^H2p!%(=DEd7utI`axWG)Ff2(~o z;MA)6I?tZH^dX~>rgethv`uD!=7#Czy4otoLu5qW?}fJ$TrYFFt_0sCbjJvaT-yRE zi4dF>4pF zqPP}O8J=q0uZ)6r28woD7b^L8Uv53G))k`N36pr0R;y zEOMJ297tEw9AD2hPR)`<383mAI+K_6e||DId6KTaY`HMQrY`@dlH2GE#|B*_!n4#z z)ox(m!JfIU?UHw;%JdnMr@Nf}T3V_;m;C3T!=Mmka27$UjV{ip4`I%X?J1UVGOBNNN;l)s3vO^x3ClKM+Sgo;HDob zOwJC!J7$R7{K-6B!s40#BAU=L#Fs#N^QiyjoE|2o`$vGF-T;>&YJz6}t9;s~@W94i zj?;R(UB3INmuvY&B3WBpsrsH6AKA%=9;ebpw8+s5d#r+vPfT3Azq^CkhM(A z_VBXNq{iuP^R=i~Q)VMK!gfe2>yPON@Ad~j|< zlgT_q?N!$S8t3Kj7xVWin^8ydr{ebZe8B*=85}0S@s#lKmlQD1Rq*p&*R3-Z$`Jme z_T9nki_bNCA~chADS6)|!uA>sS~Q8YS`OM)R-0XLh2l|zo4$@Uqb{mOd7v_$*#142 z&69j%!Q_7Z_I#@N@|~1ED+zMN&tAiITPnC1le_-kghFl#na&AZJnx;Y#V09Af1>Wv z>&AKoo6PtP@Q1v=p1&-eS@}HOh^2Ljw|e(duvBQ-O$QCbyOKAvHd_v6#*CZZPq8cs zQeI$qI=CebvZkl1!+*BXC89|qT`zX3i=T=qKUE*et>s1UNy$u}Fe{=?g!i`2Y;IEC zauviywXIG`7we?fULFXG*UF?b*r!evnEt@uHag&g*8%_{3}IdhX7bUFQ*v$>OK;J%^b z&_DNb^7Fhai>u(piDRwE`nZ(ofwOn;^5C*u##r|hGqs*O!rm-^{$AI+LRD;B0>Z|+ z>tH+b#K9$rPTWhMP)omu^TV<-yB0ohfd-QV3r%)%g6mnatyFuZW1r@>srFyv%}NW- z?e)J1TrNX@{vr9@m=Tm=3KMHn9 zQX+wk*I`+Cyo<{t0GBCn6ZADpQni(wxJPE4!|?vVy;zLa;Lq?U7`f9%wF5{t^SEmM z$+2NivE5xwUI8&7-Yp7zttUO~2rw%V02ng#@m?6%3~~gG68TM42U6eto)xVN!PptM zxK_E;TbuSa?EB&X*_q}W*N%tbiN>ljOa?@=Ndm9yk*|0&Dv<{=Jwwt!Umd3Is9nys zXh|acEmjj#=7UWo^Z0^V*t=Va&)+x3OhuT91 zbR!zdbTAiT^I`T+Y4`0VWn!~BTV9Pn#%)=hA+_+xT!{>(cuE8#;Z^8~9Ftx`G9m6D z68m(CR?a+Fs=oMy{e4*(@QgeCD1p1;g%jkB!(w@U#aT$;L3h|X#ADRp(Nu&Xl?nx3v}=wVH3zjyfvh<4|WTR+>mB+5tWw-v-LecQZQ{b7A1|oN?VCt!O0B|(q3;>G zwjGJ)6?IP?*z{z7Fq8BidqMkV5HvLz{)`EQd%&`Moz-zR?dd57OviU@O6S8a3?hAB zpL$@}3>*S2(uCA*W&9!!ti*fB!DHp5J77&!PY?RsjFNCknza^@wrfD|alczVw_9JU zLAOZCRzCAN4sN;I2kM0ee|C~g;9K|I@a&^UZ(28N;u>uIn6%k z5|$Mv?|`km1r^9L--pU68*yPMmJnr)J(&AqL7L0=`R+*p9iL3vlbvC6s%uBNd@#@E z1)c=%Ysd1#)JGf#K8hclq%mTogB=vzb~tOF7+nwgNt);DYs~h~=Pb%?W9%u{UClqZ zLKr4T8QdVH>|SSS%jOK=gh&eBmVV89h984kkR8)9keS=I)ucRK1-?nvb91 z3sB$!`;yS~-jI0e^#k`Q{|)3q^sM!)c+S?Bc$)SjNHGWJ~1&Wyg*20Yve z**3`BqU&?utq9<~5dL%l9JJADM$t~Y_DtQSHq5H-t&B?$)uy=O<>Z5XZ8c}=P-C>F zGs=miEv{(ZXw~Z~dIe`|n`&puPIZJmQjS;oyA^cKKxk6us0jt zXKqCaT%|@4ybyHuh3@)S?|M6Zqnt`WG3uylB;+Jss?lmST`+bWDI6>yt(+PS}8bD?xY*c+uirz@J#79PI@64 z2%!;wI0lTRmsyOIr5CK-atW*lKTC8^glgU4Q;c9|D0}lzz-NI>01SwaAQH*HSDQ;@ zCNlL4C=a@KnLyy$8GP8TymK|a23`*)q{*XWF?#D^XmHd}Ppgx5~0M#Th&q3sp zdiRy0&PMdPQ)Axf1ulH^9tEJ_8Z4^}1gsuz;uNpvqS+(dT}&P(KerOEyK^TDP(~70 zyZL18hxjS8e{f@thiG6@mB9{?5f%W6-!VMT`o1v1Bd5R<>EnSW&Q+zsc?TNARov}O z6K$J}+>b?iIc~4ZHedE`yKB^pRpyj4Gl56EOK$9T6J>Hg2N}$#t-@Gd$xKkDpAg@P z4<-W-Ax65s;OldJ>U8)rYvAgVc#%UcU~tZ6iPf4c zs!l4poj|=@3}GT^9Tj<@R&!1nZE)L<6Rn?+f5{F?!35V?X=x1Gx=(KXR0Lx)R|6e2 z$}dB)9xoNj+w|Z!mA(3;obYt2y{WjQ8L<%O)^ho1tjr15jt%t(mr;{CGJt*z6kQJk zFp9KMr3nSA{yKHHz1t$T{W=?9{nl4_ z^7)=eP{qb}yo(zOY2qNXe&%K5<)78%%|iSnEa$CyzHbbBf9B!4?}1ln36J6~A+&Mc za0YxX^HXn6o+lE5IJN%==El>b3!hTTQgiW&TNl!VbKiQ4BSB1IHknZ#*Iu3!WVz#2 zF?w*VNcj>diTvz89QO46O-+uQBaW73MY_GmAo0**HwZEKI^} zyjUsz1V6_S%`jVBL!B=72o|2;oY*tT<`=_>CQ#IGWiqu*C#CoGiKgdSmn(0voPTyd zdg5z*)xZ;q$&H9$X##Q=1^ZF@x>_82QBmorQAEH zfE#`1`3Y`kguW3uPY*NCl&N63Cl?*@%ZJ^M_}#K69J%6lnYUPkQ*ja*g(nj3iHxuH zYw1nD;ZCwH|8lznA%s%r|Mv97sUZI(|KyU+FGa(3+S?1dkWbb z`dc#s=<`>nBkNm~9%KISDqODT6G;+W<1sZGTL0yfcspgXl zmdaG`1^n@*j=VF}9D)n8@Q(Ee^ZvvbR9|Nl)-jcw?<`v9$((X~>0{%l@J7(P)ycF{ z^~1GE7~gFdGZ9tT=JkLWFxgUcXEYaQ_r<+rG4OM+RY6O4%(AIXb>bat^Y9RtmKxUNg&Jl_zS7zg~{s6%~It~I-hJeBAaBv zuageW14Y)XxCUWYF&_t6!$goLuT=j@oZo^-;k)qVmITc5Okp_gjDWYAXXjN_9(`BS z!S44R^gI0WGnmDBdSpJ5&0_dmE_(FGL9iCdyt1DE{=2wPWkDbhh0IFU`nC;(`)ry4 zyrJLOf0kGN z0o_+Y(wHR31w_D=TikYEzEN0mTib_e*!s}D6Dj3Fof((f)LA9Aa#?4ww`LA+esRP! zBZrr-j91{kl$|1NR@V9_Y=p|o#acuZ6ipB#x=^7)A}2e-Iwx$Nw~PF-Cajp}GCs;* zIq%~oL_Y3<*IFgZ)xK8$cSFp-9(+&wlufnCHx_%k=d3n)7GWc3L9?JFZ!Oqf=1Ef8d)HMiLv;?op z`E?HxFhbk_OvI?nvie{QeQ5pm2-?3o>1cZL!|g0i?}XGBlJ&a8&ZkZHpT!s?Q!B@K zdsjXCjY>0LllF9c6k3-jW4D2fDtB$Rd!^0_^-x-q$O%TF6Fqqi2ij*mTSc)44`h;t z_aA$UW-{@*Y}ZY0x#=`Nz1#zN6|S?xte+Eyp$CS394w#VI<+VT zG^rh0lu)z0JnUicC4@g=o$zRUS$C^VKqu?cJ0NO+nd7VAmG~!+O)YG!3!BvVI_hT- zPn$()-8?8SXmX-C)f}#ok@us+MKX(guJy*nZug(S@=NfV?M1Ji(e+8)GKs?2F_FD} zss8mfOjhvYL@#a>*X*kT3-#f$1iuOG(879&osqXf(RHhqf|fwyLkZIpw9+C@90na; zz4j@bqsA7{@#B;5Q-gdI_(CDWX>?j7Pr`c1xSC1LcFfqOeU_}7VOT(kzG3o|`R47V zVz^E*LzkQ8&zcP;e6z4F=W0=bBmjaFPIw802y}n$4Q5P9*?7xQJ(!El0}6%OQGw9kCJQ&8+pD^vG3Pcyn|~p%k^NreO8D_ zS3Kn8-mrxI-f0jDGFaz$AupX52_A)pJHL9(^%yHfG(d{ncJKYQX91Y?Q5vKI<8r^H z!^Mb%NW&5fa?x>`7=~Q0CFBqwG{9>WI#ZUcL-2@O3{vNL7 z-J~l1I&c4dtir6ty}!FcrVjOfGlfl_i|sIw44U5}UQ}F)YIfJV5BIsH6%LP|;wp?z zB+HTuYYX5LXY!~{ZCA(klMR#dh-}uX>_eDa9(a<@q&TJQd$<{H(3Y6mOvl~v2FgdY zH+~>Qr}&SB^Y0?67}q7_#=LIdacx=`+U~}t%aU&Kh!owKO#ckY`*UC#*yvNBO-F`M zY+tlHuRU{JdK*^vsU`T;b+eq~NnUmNx)D5iMnDYH^3?I(YfX8YFlu$#uX=74>5~sX z?n6r%jN31UvVFPHGx*qHv8#CzY-_yVKrLy;q}xNnuR#~8ReQ4K=4sUuys#1+PV>*R zu+8q;g2+J3H?N^I>X;0;jvs>!Ez?>^X-8=lF2uGCx`e_3U7@}jDH+{u%mw`vbo-Ztnl4FFZh}4KHb+UI`csgb3H*sKCL;}s*2S* zdYiels&y}o!)31dq`@qAN{W+Mh*~{{#-Ey7hu~W&2yIRV~pCNQ~F86Tj@ z{REG{X6v|}vgm2wRW-YmpCw8)JaIHT+5hU%;IDTJeILkUCKeUZ%nL09wzN)O%(oYL zJR6?%qN=vA43%V@?>3F&gJ#O&@;HCk&iwMNhzoO}!@h(IyhJny1_rQ&Xhg~OJW=;L z`i>mFz_hd*T6yI271#(;PTtj&$Q_!!RdTqv7JcODk(F1Sd_x!|p?`mN?IbI#BDsDM zGo*^|10?J{JO*b&d@N{~-ors)bg8c95KD#6gmZrvlpI2Qpxp!$Ua_~$d%Eid=2u&1 zmVLiRw*E$XP|mmvJ`$-RC4Z&WU|AI>alupLtWB@+7A4?znDps1pU_{3ZO2CnNeDHLLEhzNkgYX4Rl3*P9tX};!(I)Tj z|3rhICvS!KuF6PSfI7V-a+W{`f1cd?y9+Q!tPgf;DX!7{VWQ}4=|mFpIxe)Na7Lh2 zLW|j;hC*7rdv9r5U1)r^HXceA26V~#S`Zau*`2`GsUk3^s2wiHD49iT+I=;p5$MxU z@BIu`k#bk?Z?(y!>fP-oeWAYI?NkSm?L*r16u18|h4e^@Xm9DgPW=EFB%!IiKq0o6 zlR}Aun>hXY8{ZE1d|iqzUXe-=Mvyub`Gko7d$%`!x|_>@K$GYAoRG+-Ydym~z} zSQyVki;&-Fno+H3HWk0&lz7w3!S+?{t2OMCaqxB@r$+np1fB6rc#jftOM!qSwF%4* z^@f-NGdwj7_PS0f*^DaGc~N)*%YOpqF90^zT(+QxmxkBi@0&Dv-N_HC;8+9VRJy8i z8Mt@uK%*VqcK^ugmOz=Hj99J8$w6j zLgq1VuQiCbv!MP8DfqzB+pgl2Ev_1i!8wNy#JsjV>-ql9O7QLQUfsxYcW5tar0R`| zpUmwRh4v?)JBh*P1FY%^;$fAIx|gtv>1*NGe;2>;2N))qOaTLUVIr~6hy;-|W+%=i z)5jtbz5C`9G}Oy5Vf=Ji>%54W3Hqq!1A6_0zj+RRFfB>TY&Raj=|mA=1xELB-b3$s z-^hS#poz3YBYPHd`8fS}4^HbHDjL5-g8-1LANsmE5$NoMbHc8T2h#sMvRoJq=}(aD z`8%DdNZ6dLwd_VgfuHw*vXiIY80{(02+Au6`;&JJM6MR^Twbb>OiU= zj8Yr#_g=Pj{CU%33hl((AHc%-fDxXpI)LLtdYLY#?T-DX8UsCYU=C~Pm0Hs(>FWrj zYX(E#S3o46I1(h`y(dagjC)I~98R6KyCG3mw)6%B1z4%l`T#!`Y{;Ea9{)B{ajWI_ zv0@asGW!`2DkiyR@YzOh5F#?mq{coA$JAJI1yKI@gihR&>c_i{7P97|nO~o*0&D0= zp~asE;RI)oK^J&}D>u(33#$CbBuZ9ylW_MhS?{g3m(zRZ6t8rWL<^(rd0g%iU}Yu) z$USG2;XHI3yHYC)DtGKggy@0Rzq@4ur#}>#du+c^+&+7<6}FyM)1izVJcl~`v2D&N z8`Lj-7vUzmoFTgJ6B5!d`eX$t3GlSG$J48*z1Yt2B+=;I?Dg;6r}LeYx3Jowu?|e) z4uMEAc#;$TZ{Fv&YF^}z4u)1Nzd$Ax`WiC4MAzSyxTsVJs4$NL3L&rd31H<|LN$ik zpA$Q$VWfRFSug*+m;-0yte94I(M!UGgQg-WLFqDdQ$*wQ1j;l{@F%$GV#nvKVaDfd z>f$!_&|qig)L&`e7&R?#?977#>v1YorNyKX6~6^FKaW4AtwU<2Fz=mQ#R-% zY-hxWQWSp;JP_y@HMWTv5fO=Otch z9#o{*4Ows}yw^%U#vJOD>;}4Slv?t!L$|DI-F)9TYw_COV~Z%sfn$aTyrK9Nw|hj+ z0RmAOSf)Pn8t};-qH@T-s0gb=qq*45n?#U{Gl;+Qun;ax}{xYD0MTP71 zRVIISvmg%HY#O-MlVFwq1zM}r0vNlsb*wYi_r-->%r%_#Y&D$G`h=#O#}MvUZ;W3& zh~8m44ZGO)F+8|*0$m5@!T~Sc)Bx{bk!9xWt2D;JwRFd)-lvHjTA`(g_r&gAE7qVj zB0Q|I%l?*c+(qAb?iitkiVYV22f~w&75>yhQ*@EBJ!kLRgedIkKLsF2wz3{JhlnJ& zh_hGw#?}0fcDWGyfKLxRIa`YE!H&$JqCjM1kSnRiY$)ni1zbUz4SQl>E$~){D`*Cw zBu*khy0AmgcIyDG*|}&}*1<{JsVM&y5$pkTczO))4rY=lBi!uJby1=kxeY(ZWuamJ z1MiCv@&{Cb2r=CL=M_bYpB_JN??Pt$nT}|%?a~dwG74ffkA+UKAafulYfwkNeKz4; zF@JtWzFJ!uxs@@A<}c14GS;uzvJ+tHLf2nY1QglOy6|5rVCt0wd*Xbr2GG;ADHv_P zo@p4qtubjxVrdci7*cwG3j%lL<%0i~P@%bKw)E_1urB7!w2hwi!MIMls+jTNifOr9 zhBNU$!SV|?f?tZMEZ)>%W0Ai*ifpALquvYemae?~4(`xJ04L|xY_m7DuKPn4FXI2~ z)&aubNu4i#MJaZO4ha7Fz?gfem0^m;6++VxrtdH&F@wFU!wD8(Wus3BEPy;cPtAyr zKr=DtRMEH?jdGN>&F{)@>t*Dtym1Hf4~P#xHa?|GVqW$H@9Wh8 zGd1KK8UQJ<=ZKm84otg?Dvk5ThQ;U5;k2f3vPrCx1yZO<`0#TlvP8v@k6T))8JFiR zP9giWXH8+`86Jl;FpI2fY*6I*1kz$(St_kq#l>wte*wT4G&}HVd&F^so3Ura2JN_P zjHcLLmW-Z)!qDoKL~hiE_xCD&VE)&|)4jmOu^Q9Ay1nIB&cxP@7dKMAxVz92^_+Dk zV4w3IPSGQpu#j@YxZ=?#OzsYbDe3Qi)dSFs%jJ+Nu+Mre5DD{iOncr1tN|xq+y$Qf z7256F=BB0w7zLq`y9>AvAQN>fTNk|6MtL55ed-OEg#;=p_Vc% z%$y;P{Kp*d1+3LF@S0>gG+hl~-7$5?st-qjt$RJ30fX?{yNGf*nfSo0dIgmti5Cx` zEe~o?l+oTBmg>pL&tLf}I7 zSQzPG)g>9qxT-cE)f7}UX%YF&Cpw4iGSgy+hc_LFAI%CZbnHm%1B_!G#6(uIlIFOG zBS5F3bu(>C%x|Uah``>F8JCG%-`BOz$#cj(4tb zXEW2zODf4{E8=0#P~0!4wgnL-aLPE%pO;}@++O0r3dq3=yvQx+5bQWDzv@H>#O?m_+u8c8zG*g@=qeWKmbBCF9Hxlmg{<#v1r~1U+$hTEF5-;}Zg@vyt zcu=WQn?dJm0*QTtaJ;jIPFpPb$EjP2J#KhGVi?*uj&eXgpCo1E;7Ht-+tD4tOC*iu z2(sT#3Ny?~N4Gy0aWU{Zo$1`n59s^V@Fd=_?eARIa&37(J&CCZ_(D@Ape|jIP5{A6 zhPYz(804!S;}l-tImhp8w6x3Q*LHt)XZ>Qu|3t9K;jZ$9fdeL%;6exWyC`4N`7f&k_M|zs?Si$QS}tq!&=|Nk+}Vy zZWg9)>gxi%O26u^Dv@HDXzAsagbDE+wNvp<^lj=Z1?hNJh5O`HYz4ffY6swvK@f&_ z8McS_cB8-_C_F7K6yUTUBApKdV1<;s#ov!{0>R`UCz!HelEamK9*T@AIgInLI!S{c zFge{5Z3F2B#F-v%4@wC-OwLNfy#6jjG*fX+6|ttdWDw(yL=o!7Ym9>HwhQB+RiHW@ zWMdOS6q5A(FafTK8^rTbp~yqox6pF8YLc}?*Y8NSDI*=-73K8L?0NEY1`u$-xpBY; zrbYO)YON-7b4y$yjc@~4g@F(OHtLE7Cb{aNJL#S5XVZD(vX~#d4~)EXa-KFjDx|W| zw3?!2?j;?RMrYovG7LzV4@fuQj3>alu$A}|C&mq5kG2i`?dK)$?~D!2j6rA9iQxu` zHQgpfB!g3GN@!&4A~l|GjM$UA-p#GPBy%@__p{4{R`w4HZ#RBCqTj9om7(f0D*5qsA_6Jp_MO@@p9oe-o<4mK zSAdZ$RSgbJFuaq8hB%`E9rLRLg*>0NgeBr?8l=dLr8H{Mh!@WKO(M-~JEDfJ}ySl92b z*BOI9;iaX&kI6{MkY&|uM?}5lR*&~Q>><~+%N|1u?034vIM$!8@4MGu4gxLHuL)iM zIFE{_dP6Jy_X&WebIY|dXm*xdu;a$BI;$1ZnQnoDPM50Pr2@!k-+<7kk9nZO_rG`O z+*c}GYZ*#!eN)tc-Gki$QE!VB-}F?$dJHJOE}8;E{Xd}Be?|+>!y&2+YYL4D9m!n1 zzt=Be=+EpE78W)J5;j|d>uGmC+2et03qf@1!pS81uUiehHQXPrQ{k2PJ2qtl=FwEjaGNb2L!=XienVT(S}#Xc=I_31T9^Vw(RmSnjPov^z!U#%WH{>!S%h zH=o;a=YeM28$Z=;QWSiQWMoO2=c-v+=+Zv=J$?`G03L(R5PkfUX%)cqJM_a`?AKPo zi-XmJK<+1ZiF{@69ea^|gwO#nFs;JI27`P465Q97$$b79PHXL0$EmnO7hcvFn&^9n z3h@>g-)hp_V%kkdbPrP|)0Ml;KQ8uWW0d?5ggH!KqyELarN16>6Y>~|YeeRl1MxoLMXpTS- zs59?GGArgcXjTz3IRs<=RcEZ5kOjyF|1cUUhj<>V+^-=>7ftZ;)-$g6)~7annwg&c zZxjXG$`Y6bK_p*(pwipGZ--7LQQW1KvsDyRbFPfS;%`LtOuJSX;HeEzKvuOWjm8CY za}~ooo>JTU+qtUbP~voW9Jy|jHuS$%4YEJ0_!M7V#F;&awLZZ~7imfc>6EMol|C~3 zcXhCTz}cZm@4G=MH4Q`L9?yPItP@Xaw3KtG#>RnIee?IitH1@g>-g;!P*c(G-F6F` zO_~3fTmobT*%(?WsC4q5=c8`N<`cMOY4Q?+1GjAOBWGB+&bR7xLx*(0ZGV8I#c28j zF^M9oO*FD4I=DChdXVe+#07JT<)>&;@aA+ zSc1tvfY~`Z-qpN&v9dq&m<70X!40dbxBE7a{om*LT|$iEw$HLN?pbPL%@!AFF-uE^ zn8f{JQ$&$X!}Zs^TK4Q}5Jgln{?8mDnZbs+l@VWm90UJJtuRyc<6?Cn`;4$O%MrO6 z0tjFP8Q_p!WO&Op9G&}HYt2cA^Y#?Fe+UhOYo%2|goS`>pH}qAzGG%AG2Df#d<3(} zWfW81bV= z!%J#6N&tNU&M_m14^!&NSP>h9>7O~kxjhG0h=FaPzU@ldkWTYx3|;=kO9U~s0SdER@%mdgDQXW}-s)De9-BOjzV-q%BKdZ!#e zFmNY)l4fq+xGG{>&xe8nQu@~FK%#N@?y&F$%L;)MfYh`hcfi-&jRSf$UeF8m6!Fl~ zCed8ihziIU;h<}Jhx@7c!4b?#gB09W$iBt)iA^HppSrUaSsueGX>3yTCa}QnBg>DO z!u=b8H4ISlijn4kFljFkuVpt(KC03`ahD1H&$h(*_8yzOMr;ts%ao>bPf*E}I#y9t zB*Hy#W-ZI4<E&{|~B*v2G7oKhZooza9@GK|@#))R%0?q`z8nT2qufzJ| z*diGqS~p=ZdSPN~^9+~cF_4}8R}7ou(rSahM1p2px2nc52W9`YD|F=GL3-{g_i&;) zw~EM{4*ieMOB24H>);yrmyU%0&Kp!S27dd3zM`7Sru)nNe{n@T$EP5sVx-Q910V_* z0MgDB?NVTq*3!im{>6QjH^)WH>hdSX-dMPMr?c7_vSizVy_(~^X|AfqDcAL{m?7#3 zBE4?tO@OrReV%0gqHPvUg+xw{Hv-)+D#w2~Tiiyt($Zh&k*5z|pui@&u@YuV|Bf-3 z1xE@LXyR`CZ10Mz>ZCER-T0OE+ZQl*Ng#4?bJ@<$OY}7xKhO_H>8yE!srFCruc@mX z2^!Q$YwQ>a475|uF}{a;Qrcqw7iGZVBH3zN_kSn>5EdQSLN}63b1KeGEMh=`8O>Yk6T~srRDHXP=a)7P}rOJLKCtYn|u7vR;(S&V|C~hE?IZzf*W~%xuEqYMwf!N>dLGQWtxJ83=^!6U=g@H z(Njd6<{ETep@(bDI%QETkfp#m<^U>l5lt?N5WxXsz85rWM=i~omI0Fi=#oV85RGpbm;+=XTPp(M-1{7npK7^ z+`&|s7kk{n`5OA61a$;oM~E)=_HEKCSQ0@_Y5AaM%BHAwXYWKyP0ZHX45$C1bt=s3 zOGE)Dtb3qx*UuU2jU$K%NvLg*nIMBF1D!MRm{hh?jrTiwZqL}rQ|sENMqeVugYd`B zg!ncOzleK1O-+I=yC~rSl=WiQ#p7;!wbAFkigmFo=X85LhKvClv0w)ioCqON&okHFK~Q`i8$A+y;+@(r=dwVclX?gPvC90Bd7e2|9R$rFaE#wk5qq{ zG~swUgqeXV7NGsV66gX${q+5yH^awxxCX4~vGTnDhP6NdaJ(UnGy3nBN3#K(LCre~ z%KjICAZ4xfDY{Awgpg`r%YFI>B_+Rx>U{Xv_`mKththNlY*hua@POO_($uk?pw?Cv z%?PKv1AKBmKOr4%zdd<|+gB0Z;Fuaa_7D@5dORxLE!{JM`X_xFGj1$%DG;=uJs1yC zONcm}kluuUx}?C+0oE}ZENZMKo|p3wq>e#-0La%G+HO|X$5DdHSr5dohQX%8fMp(Z zUioR%R0ZcIT^A!f^(vw?fR6-AbX!KCX6!Qbgc{Ubk>lnTa8>Fg;O|0K?E5&C?H9Ks z5&YcE$L=ub5IjT(@LM~o9sB{cRR;iDwSoiAMX{XBWOh4a@B79- zQ_E>urKSc~>Ihj&IqHKNY*V6i=7uLKrQaBw9&(4-#qTV zpa{4NE>qglgPq!OU;1v3>Z$n!D@X@(fs7mS-{KgoRD+vT8$YPu-SybhhUC>3j;*;1 z1L2MY0|vVlz}r%#5PbIpwQ7O?nf(NQJDaH4Inr3oQS?}f9ZVjCxjU=i0vB^S9tLcF zh(~?x0@@j@3oW9_^D!|#;w`StYbxyv*gy<6`@iH5{8sK-?Qkpx&5~SIX-x?x;|%0W zUL>ZTRiA$V>KNVyQ|2&|M_Eo_?P+6A?iw_-zrXoi%&KyhgAbMW07 z&cQPO-3#D10z~BRydOMjz>1lN$>==*K5r1s&ji+5hz;PaODby#20h2p2C@B4Q9XMG2k1P>nRC~iFy zB4}EVDX`7D`jWZV-@&%_V>GhrLNR)EN^SjI(&D*BjWEIPJo4!$ud3--8;)v;L1L|X zcx@_0(geZl5}MpujqKdLXKA_IXn~EcU&t5(;Ds8go!$-`jXka|q~3Z{PWvP7!gg%@ zT+^7JY5Bq4*!UBt^0$uLn<7CLFPp`A#L>509b z?B2eJP2z5_U~kYYi@_YVKOfWaF^@<+vAI8#WCUjQ{%-Av)tF~}j!5X`v=%9e-ZEdM6B2i&BwEI5B{V5&b zX?jCeP5X$JI>0w+rt^VN_$9;!UixQO+n1FlzN&n-+js>D-jmA>N4oLHr{{+~uDb^E zYfj^fcONU*x?eQRdokd2JT6HT6L~Ak3r0b2gSD# zgF^O;JcXXfH;yfj>(n2o3L}2y?w?><4BgB7WsGzXCvy&q8%?bky9rQKv4JVa9l;(X zi^uV#5fAk`J8#Dx@z7$=^=UG4HRj0?II>)fn0eLEeW=?QiRWzsqSg1RBSA7~_4v;oYf^=oK0~+zLlbR!!2hr3Ex3s8x znqqApCK%ch$pm7zMg;J16js(L|_;hhuWF7slZjEQS7NjWFT^diqMjX<;WLg=94aC0KH}gLApBc zz~%$6mg{%qcH%RX-E7V)ifp%S`^Nj+?e13zYwm1X|DX20JD%$Hjla&9vMM7~X33s~ zc>vN8t=lT8j`}g;HJ^j_| z_>B8=-Pe8H*Lc6Ln-0bSCv*TTck0!v#6+GV?<>y? zekEZ{@(ms21-2KIHQC=;x{Bry<7Pa78E_f%SFfNP@^e3({6>v6K!U0A>{>@(&#R;T zPFH&)lrm8KZ=V@GKU3qH@r5c?nNv9P@iP&R5j!f0N}?n#B9izduxf+pteiPM@O$kX z0dZd?QP`1_A!=B&&f~{A0LL$;@oD+7QW2efeC^MMs7$L$e-$Uh(K-i{!tT9cpsaKG z;h^nhDx4Sm?UD8&njp5KF4k2dcWBqE*jnZUX3 z`^dfs?6$=L+f?I@1z3XyoOzi~vnc@nQYgLmQ&qhw)&Y{s2_0kjhAnb_q^|;GMj%lt zg?q}C&8VJXadI)+5Mi6l(w4iCsmjVI3;J_%KJC7((<1hv{gbEXlxM4KT-0yQ#MCu`|a?aeT8N9kB|@M-jypc01JE_D=voX2y@bbAGN z&ls^hg|zUwcg0qVV*;W|ul{7Jop4yCP68a{IWDo&)B4|wwT4&QJu}w(ySUB7<7ypq ze*EQpD(hw243Rpt2=moEK0Xl+<>V8FB|hzqc%-`ANXEk@7HB$cQs&^wON5pxFRSqO zdz=VHRKcyp$qxT{ra*efDdOG)w#sbiuW__ zL*4R=u$V^VAtDYHDjbHD+4lAq!|bU++`k}E)Kumc&(OQ3Q>h~M2CzQ{9SDX#)K8QO$UC?~zyRXT z(8^)_$OiT#18CZXSv}*eynp|SRRs7dRVmVdA^4yD&6mEsfy)u2qYx<#B$M8 z4tv4&qdF-wS#GJ!Pi%NOuFNGW`7eD-##&BG&LU-j7swQMSqi((bO%fq-CQ*vP}W9b z8sInXP5VTs*=RC4fw3UpIpT6xAn=Kk?~fDnM%G=)*cNicOp|C1g9>rm*MI5+q;8nM zLcjta-o{)tXyto&@lY^BxrMc-oAATjye6Mt{7?;?tDKD0zD$K=S$DyiUWI2z)LL>y zWqNLClhCCOneEf<>6!Sg$C?wE+KFpYst*2<>|Q0bLsaFHvzHJz`Oowk7G<=%7W`lo z0;ww;R%b}l9i!WxXHaC|bQgG}I{x(8$fdd=9Nj%BTyt4p5}t_z4Gi%N*O zT^>}|L_d`AZ`~%68suWT?C0NAqEEIlV>Ue=47{FyQRP?KIRFw@I6`c1^{vz&URV^>{8cX(252yJNiLf}uvOo(TTYD=C4(n{1 z9wpyww91EtJI&joZe*uf}ep_lY{92xJ!GRT=ZoyHO5v4qRmcK~xk(XgT8gyzDJ_4KKsisAwS^ z{M9-f$I0dEtDe{5$vf`t&T#Fw~in zb>~Ob2mu*2C>4*dL&GZQ^xB*ae&;#1u-mhB)T;}7F#}`|9x;8G7+Db@`^|Jgrh4Of z6mRX_Q>hBxvIBFyB{mC9cX^O}b}On{Ypb_Tml?juQhnrhIJrMaU;2tM+uhgF2h-(P zE7z3K3zOd&AU(o#q(08ACQ=Z+V`JX2dX+o%=Lux{^7V{aohqF?cKmQy`n_(-^v8uY zQv-to=HZne6f-^zWhBfW=<*LNxEy8s8%;lQuyrJL$643s%m%|Nb);f<1m><@di

j?(uvAoJz5HrVlgu07L?Tt}6q z|d9E+-oU!KR;*g-`K~iJwJhD6w>TKjpe83 z-`26&`t6OO_nSm*`?_)<425ACl;N`9+V(ZYIhpd7xs~H>aAHQRQ|O7v0a2rU^nTPb z)VxwM9fZbhX~Kl+kqB>_8-#H3uIdEGj+(sy$a9?%3N=TV2awqnfXuG*MUSjcd7jYO zXguNLrk3vpr)4I`IQX~$+GFxqx8naM9uVfjy#hyiT#q4z34O` z)od#FG+-9{h#vcwORV40jR)#N$l@)uhDjm6?Nd?V#d|7Bjl-&*T%?*(*LzO==gp0W zUwu)7%z!GY&%~!~V(#6l-H*!9*POT+z;an|D+mkio;o%FzaN$)IPHOd&mn%FPp8|$ z>-XkLi&?Ht%_phYs+{|ACY-oIC; z_g`5r8b=v6#xn9h9XCt2ll--=MBD>-GxOzm<9C=2el2f#)MZao|cwMn28Q1 z&juP4)cuaS&~LXw+=Nw;P54T4ahrb0x89FBv3^F6XPlWGr7>T~jp{zxOFug)zo>M# zn;8=+a#fFMh~;TF#!~_wgEnyMB5WN@c1nb*35E%_#gcN*zV70yc|k4}s^J|cKSRsJ zYk0}R8Rc8G9b_H3VFhYoTG-3=WK;A#1Ljz4PW_XMTlBGhmEn08UBsz>KKj~pMJDN~ zY#Rod8nFV<-l`CsOm&7&zp>Gr`q=W+c}5{9#b#!L`Kz1Tmo^F=zMa^-?onTlyM3^< za!C8xg^Z5xXqLR?%KxblH|s?xqBm!Bzp&|~Dzh8_Dn_!O<&3loPn#2%|Iz+ID{6}B zew5*U<8tBfAi*J@rD845sVudu%C~tp-}IUhEA%c1NcEhkSNZ|Vz>}QKNvqfFYN)IF zkdIcRe3(nPYT!2iVs%R?O%SCr(WhN&{5`f~S=qRyV6pEhdz{Y2S6(jI_x|09uW-m` zwIQ_Ql_ix*^V2euef546z;$xHln2{6(z9-gS8&Mc$4JHsm6xzaH0+IbWw`Oqo90HZ zX!0waoK~5Ebni^X4fd>ZD zexyPs%E2n=c;YnG;jX@$J}&Rjtr0CwXGOnu-I=reo%fBgf=D#lWpgd|o|x+x5qFrA z%UHZVZ3itD+Y~UxzYxyE=CN!QG7;LG_jb&I9SvovWkvdZ5*bRoYLm@JuyrtA1TsSJ zk5eSir)vMjA3M3}yu!?+qwi-p27;AD~loH%NF`+O`!i%Xrx?0ep| zh_P=wM$)sA*d;Q@p;~v})$uG>c;u`1l70g#<>Xfrk#)8~4wS`HFQsy7thwoPw5{_> zV-iJjgbpUL^1tQKW?t8oMqB~T|z<81S%^h~Qr zHoIE47m??^4SPjcpgBS#d3?h&!g1R)VV6cS_2>vPew>wZNfmKYZKM%W9N}W|Bz4b&X6>G(=Zo?S9Ws&*T{hzT9)d#L;>s9^3b_WN+FdrnlP=G##!MEIRYB} z^$ytkNC5K$K=Wl}UWR8*>M=GRh>v4xaQs!cn5gy*#JDie9Rgq7c%u z_Ueex&oK0TD|BL6L_JN6%JXaoi3Y_DF@-RtRmlO0@_ziD+!K`7PR={{@ph^e&Narl z`G`;Prvn04=$mZ&)^iDeECZXQ8rSjytM5S~9!Lb1{LS?EV&q&nvN2|LPl3G0w@uox z>(oxBlo?Z%fXOccY-xFqhBk89txxW1ZNc%Ex+BJVKTKV)M7 z82Q?DsG>}-bNC`1b&yYMV}mc7TZ(&P#cdrjjlB~H*^V%jE(gsoi}g~VcLhmriCKV0 zPD?I8eN~!RtN`tw1EYSk=8%fJ0Ng}mX^TYwFNmu()2f^UxY~)K@2iP|Bb64s&VeGb zY-b`AOwP8)weFj?Cj9%0*0y+b3vzLV>wNXsNeF1-J^vt);A*i9rDNX%Y;0{BGWvsh za{3NkCghb>Mw|V8b|KhD30Nsa-xWUT7o)lc?)4f^-5%q*q}V!uMnAdYjKsr#zE=yr z*UGyx4OyJS7Ql_Ua$zbcc+PGR?J0Q)Og}KfUBl9s|26uPdnx6|iHKQRX+ihGH!Q({ zfh&1JR>p{%obVM&J^wu251!uQla8E;sg&l8d2wi;Uw)u@5FM!Zx4A4OqR2^CGa(gD zJ=ZwoZZKl5PgwkTmfvr?6WWdJHqM?yhPONBHTB^JHG=OhP?F*bkPq_@${rErqkHdY zbP^IeXE<;)4lPO$EW)Vm%@D|Qry*aek}9e(zy0)7^S*P@ZBDet?L_H&AlA1#faTQ7 z)gf8-PmRqShMT8KGaf<9ZRCw`U{>tJx`J#LB<6hv1<#56XN?quM1p0U}&-K zUFd^-`U7%Kf8V0S08^-)BS37%^os$wei3KoTSN+TH{`b1WB;&wh}X*?n6sz(9S9Jc z)}*4gbN_8Q3gGX=&tdoeYvTUZzzE*tM*c4uKSA$u@`)3*4R4<%a0wGTZJeP5 z3m6Lg#iXTN?dIGpVUV!e)F3qYz5CCcaJD6YQM4&WdUfo90%phOGAW}orz6~sRO8KC zCC>a)m%-<#BFFVMfR~yvRu4S*Eb~ug4+z z3it&`L=Bnv)uYOdEJw-@CHLLP08dQQB{mXdX5rXiO@6uZ$dm6zLU zW8l_fvQ8Y`?xU>{bk);IRw9yx3{NE&B=+&fXg^fOMPg2UMQGH26s{QhJ{4GQr%NKg zLCPp;RP~7lj&?2#+6&}+hyUxu?~nTMX{0C|KFtcD#l8ZYx`3@W#=A!VDO1{jpi@`E zw+lBWj?@W>vlxgQIV?a;L>mE7Ex0;8c9570luF7+EZgp2egWjB39G0=%(pi&5!d$h z-e&u>ov!(@51-2p)Cv%ljCezBF=7ZF^pcXh7TiGNd#HgU6!hiYPAzDNbK_o?>G4P; zrl*iMJc@@YwA$t;a)WroYP7AI|dwaF|0b*&zf4Q@_*Kr(B=^yQ|m*Pec*{*LYmlvum?3jIgc@SWDj zVbloO3z?`Tqg^2$`Hh{S0b-;_CO&262R*`pB?$%d1aYXVZc7kZzo%){1&8n^y&pMa z7L|dTxcaSivo_!#`B6w9%jF@~fM`!@Q^^es3WTcH7n4l4ieV2jSw9n=Ptr_8;s7Rv zDoV%2J|bdjka<`A1`qwrpgH7>*hXo_>gPBoRQH;5&n=@In&pN|ABDJiyr{z&lK zY36^6?_<^Koqw!9^xUBL*BT`@-S~f!9;}*@OfCtcHTCCvWK@kSdL8ZXlc;;yMU=!B zlC;SHR^pS-1vijEP2j-ijDxLP=2d8H?D!QZpw;!B_Wfx zG=_mOR0@;6dDeiSn=-rqkIWzw2AZ+ki~{iVHOPkClxZcoamHEU*w;hZ=l{8K8-O0u zms7)$-d1FNLeMn$)fDevY<>$zAHgmNU-f2b^1`=&%TRVvV?&S~Ie#Nvp68sx4vH4u!#N<{)9 z#WY!vd1X;iRAuL|Q)zLo!l9Z}ll7HE3jmt@nI(54fR2GBCB8B(0`YQQTdbeCv-ur= zD8}DKZoHW2t|9|U>q1GH4a!99-pqrNYKmB}$#uA9u47IVs0`KQ0`Vk5ifaOTTQLsS z?@#E}DCx6yUCyD0#-wdcMaK2S`Cdo1lZLJ<`@z^>p>dVO?osQ~z2ZrbW_5ni1Bqy` zLrJxrDG>w8^uRI#l<9DEzwPR+4U%fyBySKL${%<;H%HF1maJ5BiVTw2(F; z^i__e>o1@j4x5_>igy;xD%eXVf5^mxv-k&hNfN{ps3w$cDYTIeixo>zN_5NT3r?O( zJ2+!`x3yuBOmpgH+8YU?n~c1~`YB9&(^q4pFCHKt4TnDsmHkMMvXieWY0OelL@V~X zxok=x2UC;Aq(lu9Z`MYMgh}w*b^0|gTfxKi1>$V|bGPTh0uam{#OJEBopw`nqy4ED^OH}#d5Nv`4K24gW9`1;S*Ap^aW zpkdJ0K;pom49gol^gvN@r!(NMEj`23u*ySWf89B;5AxvLdQT&5^}kLLBZj-M@`aNv z5Kac@?iGx#ajCNYR-e0Y6WlI>hD4i(GhPmKi75@2GDeQ6rw{@p zq+9xc0BNC6)58uOxA3{Ffa%i6kKCig2-jo4@0)~KlemaJj^R;pklJ^0;f#eF9BH~)M(l=sZV%BPMoK|>1r@_qHlNRm*xJJpOVJLO3c zHJM#dPhR~#A0r=l9vIJEprhXS{rINywGsFWG6qMGxpR*O7Xyl5gq&M(uCjd|iQ2bn zPmn2C_EJIAb|Tlzoo$ubB6aEpZH}tX4T^I#;}ioyJt@_*Emg7ON&&>Z>j_dIxv(wL zH5ey)YwW{hhiMj2MTE@$Syt_a*eE4x@-t>VJleTxX|j~K{4cVmx;1=6B)%gUFD#w- z^z+>L*DMQ$mlHT~Eb>_pxd~~2>uLn%sM^ec`chI^t%u!vY_6!KxL0;rwv#>GnQYlw zJV^lqVATvxiwjr7L2FTM7AikIAx*Mq%B08vIMwPtvODWNRum~B z&uzJwCL85hdHv%w%>_Z`7iup_cmG-UR-w`|N0&~!o`uN-906~zZbl-oMH99uErj&E z#(Au%u1fUbq?uB^G$CzKQaz*dtMVdmNCQ&u<^UmVPmHf;uo@0lNFVx+Uh{Vg+Nq6$ zb%$Yx-mI?~D_$r19jZ8YFP!Nfwd2v=8vCV<=_HHQ!GfA$9<3RZUzHkENDs1GwO`>; z7h{)~ZrvEQ9X}B)-bb)Vl0^3ICZhW%B&AG;HdkGq`f>sCFDcyP1YPT)2f_rTI2)<1_N^8ood}Nx`XCq^b2Md)2g^Gy8@z(@>wV zJ*+zH?BAs57>Hvo*sLhMd1~EaiSo*xJuEXC=g(dml(ZohAsb+DM}1uL(%GCjy3O#< zsj#`0QFsw5b9tn^ISh>$(ph2$v8P-x{L!k56R|HX4XVlUC| z4zL^meG6~?b{&R8Yaa&Qv+PDXOWwrTmL~T5H3=GU7Y3ESX~JKHOoy#E#Q>14<$8Cj zQrLaq``DpDiWxmZ)^sJfW<~W_Hpk`7Y^KrnO%9}!Du}5Q5=YwOU8}e#SxUr;0s~v8 z)G`B%c_9sw0pR=05wBk&BThRpm9s;+4TyppN0>jEG^O$WI(VFWv18fN-=YHB&wEz6 z02}mT5E&r`Mo2A_F0Rcd6W9(7C;)>YWl$h)mlO&NBxj=8*7mKMxt>##ff{7(3Vwh) zrpl|PI+b#xc%I<%smeE~dvMlJ-7|i-3E)GJqWJse#lpyz`<{KKhRdUCI{A%mx++@; z=c|bvu>pfRUo6;Db(0u!a`U6)WY}JowX?>=*wL$dj^QFHyS?6&cAB>@|5lU9D*$K# z?Z>kaorPIhSkN?vV{_9JJL-oByp0R`i4mcWdPvRn7oB>B8U)4Z6g8s^kJXt@=v|9` zrOvgy!*+&aR^-D4Ze!}qF6U0Jc1!e^6$wqjfoDJ?2XR9A6Ug#(`SD>{e|h{`Gmv_# zRI^%Ft>zx!$3qQ$I351pj~x!aacd>NkvJ0!U8r8nO5YH7zd!Dk*f~F!k?;|_a#gV6 z?Vg6Pz>JottJ`8HAk75I9s+JR6AgZQ>UBAsUJF>U*=xmCRf}_{2If)|Pr$5GYVV}D<`(#AgSnOz^J3(@Rr&9QgKWXP@(UfaU1_rTy@?3^SdPr~ zCtWBX6Hg&MbAzwv>%u7}llGHE%sL%5k~IzfVaMweRkIL81{{WkxCN_dlS2-7-b6qz zNQcNm{f|zUx+)VIGwQ4FX}nnC+gMyk)ipktXSQ+BeuJ6+zVTz0;}7Sqol?Wwq71i! z>qvb7#*j&2DD(+?LDv2Ahh)^cR?Bqlr(B1Ckq@>HO85?r3}8+bF*5|(`tpDBVNYCz zpeCXg`ryi$?hml)QuV#TTL`Af|t>V9R39^=Bkvy7K(f|5&*;f6#B#;uD7b-j>{ppXJ=unOO} zv04SiWE1n-F5mQZ+p3FOqib3k6)jbp^Da@>*ZK6(cGIU%XkulvGs7a3@=>Yz&fx1W zscbD;oI7lM05y4PcEAmV{wT2%{A2bvv*CsLZFV2^?gNu_O}WxL?yFYY7MD(8m=#!f z6^6*IZ~n2l=8gqgit}66P7;~S6qK_2dw41K*?{T zJ38@mc0CRs+O6HVsuceEywhHeUU5&+ue`3F$REv^yY`|nDVSx*8(npLph-U|KPg}< zxTfs|_O_J_dRBnu@I4wc6mHazXC-T4Udz0|wFDtT zGS%UoROzgFq6hv3`szugUJj1(_9?0f5=ElZWT3HRLU3v~^eYiw^C{zQ)X??}ImU|m zL!--~(x?D!PG7{V=4eA==gjA4j9!o!p$qtuYd0ujf!r_nXh$1tAhG>Th#E}_8Ce6$ z_DBqApf|yIc5(N%-jGx6Y(+C8Zn^?f!mAnQliwOo<*L~xR>B%;P=LLMpa6@*t z;7~8l-TVhm02+6ocOf1W79vp5HcGZx?gl)GgDClft36HSn3|GvDs7( zz!D3rTG4S&c+MU25TPZdHPulL)y2?JqTNI%EQ(sS}tR?-O?n4ysJL0dPcDzw@H!-rS%(XEL4{9Z{e>lGXhJ&onKIS(vD*^HKCC1+I<|uVE=)ch^I?S33kh zEv_^Vw@P2O-Xfe^A6e({F9RCzB+!5Z*oxczkgi3DBdGx^iRb3#C2xJ#Wqu3j!v%&? zlKk10{Pw2xT(Q#)+nOYO|6ZS>J*^an>syaU7?qN;x%-eBuF|Y+^hh|PAb#aF0U;M- zu!u`}I%ZQKlRfBJOBk(CVn>Du!6nDlceQky9Qc|T6^O-!mEVfqd_2k-I)%cCZVT(c zCt4W)?MBX4g!PEpV7wF(f~7_dGWD6H2~|gBEJiwjQG*9$!;2GRW^LY1KF<HX?Vu~&taunvtHx(T< znMEg0G?0v(!r`^X6@9)&4csBc1y2t0hcg75f>o}uxP^;?+xHCNAaF1{5+JOsb~_6X zef<6QqnKz9W@;oaAx@q7mvPgNBwDb*7qIr)Jt2=w|n!@uR$Bl8P=BlKr-XdhoQe z=*^;t$tFM<^weiNAtY%EAtgxJV9vLok}LJ zLvu=a#Rgv`RB5CKFR(`vmPrA;VWlZ()7Y;~=~DH`G;WZ0)G*NhwOr|4^kG5Zu`Ts_Tx^1|J_K_4;l@fF3!ex0^00|x*a!(C^e_qHC@3P#3!MtbF z#!lReyO|`2TOhg6!{2*G!$7n@pAl&*=SZi1Kbe-j+u(_Eh47;m@~Epmm4_Bxwy}Eo zTWSeg)t{v_qmk91G>zOlr1Dg9UgG6AwfS{6K~@;X*ON#hQY3rHQ#*@4y9xDz+BPAq ztO=K3+#f#QFWv6kQdPBKC;>8>$N?Ft$>w)9>uBIUF_+HjG^Qht76PPgKFz(1cFA_n z^40`jx7QJi!EA!?vt$0QRIaa|3`c-e$l+~>3y)t6iQWNS`)=AQB z9ddls*qN}tml~(W^@ZDIf95sZZ=HR+8a;HuI{HF}fzo z@aVhVVxQoqDC)}}JcUx6Vu#Lc$I&9q1fXFU%x8&ZXI*F(WoW9LiDxvvuA2EY{7Hn~ zcVpOZ%jbJixWWor7tmoZPe;y|eKgY5y`@@*mQyHu_}S^O>32kyVl`llw?Z{@%sDNU zf+}8*of@dP5(f!iOe7U7LYpQIpW@}jK`3voEciy}K{Fxcd(=!l6koV$ThqNnvhMbG zytO4MrZCdv%Wwa3sULx(ZabVV04GmPhFG^%RBTs!F#30>F%&{F>2@66g*<*(bS%H~ zsu{+s3<5>#jEyJo)>b@yL9I}D?xkZL-6p=V1o1dfN} zKN@RPCv3b!uNchwyGq7K(TzSKnPsxQujXOv(fe}a#QKky-mvQa{#T!Z4y$vmDEDyu z?nSy+#-0rf;@vTg2qxwO+xBCY+}?5Sun;>_cN2aqEUgQj(qWHh{opxjgq$((u;aZz z7xSCLqX}QgI_#@X$Q??3+*PyZB|`YxSZdFY}6VJS+~ z=j~Dv0HYw!ptM21bMwL!4myrjuHk~CV^{0??=*`U(A16L&2p~ZDA4Sti3z~T$n!*9 z;b?gKG&PB(z*t@sNj&a`l6LIYX4_&PWb?rJUVYCOiKkw0W1hZG1nUZsBgJtjdVc76 zW_vU>ZHhVJVPAg~IU!07_R-gLmxu0Wl$^O5LwK_xcRZ%2jOR4Hu4mTtg^Q`RKtBLI@XSRpe6Qbz~O> z*gF6&#RM|rP#ipK23))vK)`bpwpy#N2`|z6P&1ekbrM-}Tfb)q-)Yy09o}c%Xd&%Q zrfN-AI!qy3i=wGL$VzunOj-3KMM~QDUOIhhb;IZ!=OxnzQ)ljPtS)l&bk} zwD*wW@7c=J46`+*r|U#6J9nr0%p|(V>%E}H$jRM|zNn6Jp}64k;nBa!yvUj-ZubBE zhv+l@Ck@y){u9D~LO=q5|1{x0A^f*H{I?4JTLu5Eg8x>*|EH?}lS;0zN1*SsxtnCn R>pk#KLq+F&zOr@5{{e@yhEo6l literal 0 HcmV?d00001 diff --git a/templates/backstage/app-with-bucket/skeleton/docs/index.md b/templates/backstage/app-with-bucket/skeleton/docs/index.md new file mode 100644 index 000000000..ace444029 --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/docs/index.md @@ -0,0 +1,16 @@ +![cnoe logo](./images/cnoe-logo.png) + +# Example Basic Application + +Thanks for trying out this demo! In this example, we deployed a simple application with a S3 bucket using Crossplane. + + +### idpbuilder + +Checkout the idpbuilder website: https://cnoe.io/docs/reference-implementation/installations/idpbuilder + +Checkout the idpbuilder repository: https://github.com/cnoe-io/idpbuilder + +## Crossplane + +Checkout the Crossplane website: https://www.crossplane.io/ diff --git a/templates/backstage/app-with-bucket/skeleton/go.mod b/templates/backstage/app-with-bucket/skeleton/go.mod new file mode 100644 index 000000000..cc90c209a --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/go.mod @@ -0,0 +1,3 @@ +module ${{ values.name }} + +go 1.19 diff --git a/templates/backstage/app-with-bucket/skeleton/kustomize/base/cm-nginx.yaml b/templates/backstage/app-with-bucket/skeleton/kustomize/base/cm-nginx.yaml new file mode 100644 index 000000000..8f572d9c5 --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/kustomize/base/cm-nginx.yaml @@ -0,0 +1,200 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: ${{ values.name }}-custom +data: + index.html: | + + + + Welcome to ${{ values.name }} + + + +
+
+ CNOE Logo +

Welcome to ${{ values.name }}

+

This is a sample application for CNOE reference implementation!

+

Learn more at cnoe.io.

+
+
+ +
Loading environment variables...
+
+
+
+ + + + startup.sh: | + #!/bin/bash + ( + echo -n "{" + first=true + env | sort | while IFS= read -r line; do + # Skip empty lines + [ -z "$line" ] && continue + + # Split on first = only + key="${line%%=*}" + value="${line#*=}" + + # Skip if key is empty + [ -z "$key" ] && continue + + # Add comma for all but first entry + if $first; then + first=false + printf "\n " + else + printf ",\n " + fi + + # Properly escape JSON special characters + escaped_value=$(printf '%s' "$value" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\n/\\n/g; s/\r/\\r/g; s/\t/\\t/g') + printf '"%s": "%s"' "$key" "$escaped_value" + done + printf "\n}\n" + ) > /tmp/env.json + + nginx -g "daemon off;" +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: ${{ values.name }}-nginx-conf +data: + nginx.conf: | + server { + listen 80; + server_name localhost; + + location / { + root /usr/share/nginx/html; + index index.html; + } + + location /env.json { + alias /tmp/env.json; + default_type application/json; + } + } \ No newline at end of file diff --git a/templates/backstage/app-with-bucket/skeleton/kustomize/base/kustomization.yaml b/templates/backstage/app-with-bucket/skeleton/kustomize/base/kustomization.yaml new file mode 100644 index 000000000..c101707dc --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/kustomize/base/kustomization.yaml @@ -0,0 +1,4 @@ +resources: + - nginx.yaml + - cm-nginx.yaml + - ${{ values.name }}.yaml diff --git a/templates/backstage/app-with-bucket/skeleton/kustomize/base/nginx.yaml b/templates/backstage/app-with-bucket/skeleton/kustomize/base/nginx.yaml new file mode 100644 index 000000000..86e6423a8 --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/kustomize/base/nginx.yaml @@ -0,0 +1,83 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ${{ values.name }} + labels: + app: ${{ values.name }} +spec: + replicas: 3 + selector: + matchLabels: + app: ${{ values.name }} + template: + metadata: + labels: + app: ${{ values.name }} + spec: + containers: + - name: ${{ values.name }} + image: nginx:stable + command: ["/bin/bash"] + args: ["/startup.sh"] + ports: + - containerPort: 80 + volumeMounts: + - name: html-content + mountPath: /usr/share/nginx/html + - name: nginx-config + mountPath: /etc/nginx/conf.d/default.conf + subPath: nginx.conf + - name: startup-script + mountPath: /startup.sh + subPath: startup.sh + envFrom: + - secretRef: + name: ${{ values.secretName }} + volumes: + - name: html-content + configMap: + name: ${{ values.name }}-custom + - name: nginx-config + configMap: + name: ${{ values.name }}-nginx-conf + - name: startup-script + configMap: + name: ${{ values.name }}-custom + defaultMode: 0755 +--- +apiVersion: v1 +kind: Service +metadata: + name: ${{ values.name }} + labels: + app: ${{ values.name }} +spec: + ports: + - port: 80 + targetPort: 80 + selector: + app: ${{ values.name }} +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: ${{ values.name }} + annotations: + cert-manager.io/cluster-issuer: 'letsencrypt-prod' +spec: + ingressClassName: nginx + tls: + - hosts: + - ${{ values.name }}.advaitt.people.aws.dev + secretName: ${{ values.name }}-prod-tls + rules: + - host: ${{ values.name }}.advaitt.people.aws.dev + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: ${{ values.name }} + port: + number: 80 diff --git a/packages/crossplane-compositions/dev/kustomization.yaml b/templates/backstage/app-with-bucket/skeleton/kustomize/dev/kustomization.yaml similarity index 100% rename from packages/crossplane-compositions/dev/kustomization.yaml rename to templates/backstage/app-with-bucket/skeleton/kustomize/dev/kustomization.yaml diff --git a/templates/backstage/app-with-bucket/skeleton/kustomize/prod/kustomization.yaml b/templates/backstage/app-with-bucket/skeleton/kustomize/prod/kustomization.yaml new file mode 100644 index 000000000..8df05cf58 --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/kustomize/prod/kustomization.yaml @@ -0,0 +1,35 @@ +{%- if values.awsResources %} +resources: +{%- if 'Bucket' in values.awsResources %} + - ../base/ +{%- endif %} +{%- if 'Table' in values.awsResources %} + - ../base/table.yaml +{%- endif %} +{%- endif %} +namespace: default + +patches: + - target: + kind: Deployment + patch: | + apiVersion: apps/v1 + kind: Deployment + metadata: + name: not-used + labels: + backstage.io/kubernetes-id: ${{values.name}} + spec: + template: + metadata: + labels: + backstage.io/kubernetes-id: ${{values.name}} + - target: + kind: Service + patch: | + apiVersion: apps/v1 + kind: Service + metadata: + name: not-used + labels: + backstage.io/kubernetes-id: ${{values.name}} diff --git a/templates/backstage/app-with-bucket/skeleton/main.go b/templates/backstage/app-with-bucket/skeleton/main.go new file mode 100644 index 000000000..d3103f97e --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/main.go @@ -0,0 +1,5 @@ +package main + +func main() { + +} \ No newline at end of file diff --git a/templates/backstage/app-with-bucket/skeleton/mkdocs.yml b/templates/backstage/app-with-bucket/skeleton/mkdocs.yml new file mode 100644 index 000000000..c8ae22317 --- /dev/null +++ b/templates/backstage/app-with-bucket/skeleton/mkdocs.yml @@ -0,0 +1,6 @@ +site_name: 'Argo Spark Example' +nav: + - Home: index.md + - idpBuilder: idpbuilder.md +plugins: + - techdocs-core diff --git a/templates/backstage/app-with-bucket/template.yaml b/templates/backstage/app-with-bucket/template.yaml new file mode 100644 index 000000000..ce11d5cb1 --- /dev/null +++ b/templates/backstage/app-with-bucket/template.yaml @@ -0,0 +1,144 @@ +apiVersion: scaffolder.backstage.io/v1beta3 +kind: Template +metadata: + description: Adds a Go application with AWS resources + name: app-with-aws-resources + title: Add a Go App with AWS resources +spec: + owner: guests + type: service + parameters: + - properties: + name: + title: Application Name + type: string + description: Unique name of the component + ui:autofocus: true + labels: + title: Labels + type: object + additionalProperties: + type: string + description: Labels to apply to the application + ui:autofocus: true + repoUrl: + title: Repository Location + type: string + ui:field: RepoUrlPicker + ui:options: + allowedHosts: + - github.com + required: + - name + - repoUrl + title: Choose your repository location + - description: Configure your bucket + properties: + apiVersion: + default: awsblueprints.io/v1alpha1 + description: APIVersion for the resource + type: string + kind: + default: ObjectStorage + description: Kind for the resource + type: string + config: + description: ObjectStorageSpec defines the desired state of ObjectStorage + properties: + writeConnectionSecretToRef: + description: Name of the secret to store connection details + properties: + name: + type: string + default: connection-secret + resourceConfig: + description: ResourceConfig defines general properties of this AWS resource. + properties: + deletionPolicy: + description: Defaults to Delete + enum: + - Delete + - Orphan + type: string + region: + type: string + providerConfigName: + type: string + default: default + tags: + type: object + additionalProperties: + type: string + required: + - region + type: object + required: + - resourceConfig + title: Bucket configuration options + type: object + steps: + - id: create-repo + name: Create Repository + action: github:repo:create + input: + repoUrl: ${{ parameters.repoUrl }} + - id: template + name: Generating component + action: fetch:template + input: + url: ./skeleton + values: + name: ${{parameters.name}} + labels: ${{ parameters.labels }} + repoUrl: ${{ parameters.repoUrl }} + owner: ${{ parameters.owner }} + remoteUrl: ${{ steps['create-repo'].output.remoteUrl }} + secretName: ${{parameters.config.writeConnectionSecretToRef.name}} + - action: roadiehq:utils:serialize:yaml + id: serialize + input: + data: + apiVersion: awsblueprints.io/v1alpha1 + kind: ${{ parameters.kind }} + metadata: + name: ${{ parameters.name }} + spec: ${{ parameters.config }} + name: serialize + - action: roadiehq:utils:fs:write + id: write + input: + content: ${{ steps['serialize'].output.serialized }} + path: kustomize/base/${{ parameters.name }}.yaml + name: write-to-file + - id: init-repo + name: Initialize Repository + action: github:repo:push + input: + repoUrl: ${{ parameters.repoUrl }} + defaultBranch: main + - id: wait + name: Waiting for the repo to be ready + action: "roadiehq:utils:sleep" + input: + amount: 5 + - id: create-argocd-app + name: Create ArgoCD App + action: cnoe:create-argocd-app + input: + appName: ${{parameters.name}} + appNamespace: default + argoInstance: in-cluster + projectName: default + repoUrl: ${{ steps['create-repo'].output.remoteUrl }} + path: "kustomize/base" + - id: register + name: Register + action: catalog:register + input: + repoContentsUrl: ${{ steps['init-repo'].output.repoContentsUrl }} + catalogInfoPath: '/catalog-info.yaml' + output: + links: + - title: Open in catalog + icon: catalog + entityRef: ${{ steps['register'].output.entityRef }} diff --git a/templates/backstage/argo-workflows/skeleton/catalog-info.yaml b/templates/backstage/argo-workflows/skeleton/catalog-info.yaml new file mode 100644 index 000000000..e4bfdb6bc --- /dev/null +++ b/templates/backstage/argo-workflows/skeleton/catalog-info.yaml @@ -0,0 +1,40 @@ +--- +apiVersion: backstage.io/v1alpha1 +kind: Component +metadata: + name: ${{values.name | dump}} + description: This is an example Backstage component representing the use of Argo Workflows and Spark Operator. + annotations: + backstage.io/techdocs-ref: dir:. + backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}' + backstage.io/kubernetes-namespace: argo + argocd/app-name: ${{values.name | dump}} + argo-workflows.cnoe.io/label-selector: env=dev,entity-id=${{values.name}} + argo-workflows.cnoe.io/cluster-name: local + apache-spark.cnoe.io/label-selector: env=dev,entity-id=${{values.name}} + apache-spark.cnoe.io/cluster-name: local + links: + - url: https://github.com/cnoe-punkwalker + title: Repo URL + icon: github +spec: + owner: guests + lifecycle: experimental + type: service + system: ${{values.name | dump}} +--- +apiVersion: backstage.io/v1alpha1 +kind: System +metadata: + name: ${{values.name | dump}} + description: An example system for demonstration purposes + annotations: + backstage.io/techdocs-ref: dir:. + links: + - url: https://github.com/cnoe-punkwalker/my-reference-implementation-aws + title: CNOE Repo + icon: github +spec: + owner: guests + lifecycle: experimental + type: service diff --git a/templates/backstage/argo-workflows/skeleton/docs/argo-workflows.md b/templates/backstage/argo-workflows/skeleton/docs/argo-workflows.md new file mode 100644 index 000000000..1e01c2be3 --- /dev/null +++ b/templates/backstage/argo-workflows/skeleton/docs/argo-workflows.md @@ -0,0 +1,160 @@ + +[![Security Status](https://github.com/argoproj/argo-workflows/actions/workflows/snyk.yml/badge.svg?branch=main)](https://github.com/argoproj/argo-workflows/actions/workflows/snyk.yml?query=branch%3Amain) +[![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/3830/badge)](https://bestpractices.coreinfrastructure.org/projects/3830) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/argoproj/argo-workflows/badge)](https://api.securityscorecards.dev/projects/github.com/argoproj/argo-workflows) +[![FOSSA License Status](https://app.fossa.com/api/projects/git%2Bgithub.amrom.workers.dev%2Fargoproj%2Fargo-workflows.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.amrom.workers.dev%2Fargoproj%2Fargo-workflows?ref=badge_shield) +[![Slack](https://img.shields.io/badge/slack-argoproj-brightgreen.svg?logo=slack)](https://argoproj.github.io/community/join-slack) +[![Twitter Follow](https://img.shields.io/twitter/follow/argoproj?style=social)](https://twitter.com/argoproj) +[![LinkedIn](https://img.shields.io/badge/LinkedIn-argoproj-blue.svg?logo=linkedin)](https://www.linkedin.com/company/argoproj/) +[![Release Version](https://img.shields.io/github/v/release/argoproj/argo-workflows?label=argo-workflows)](https://github.com/argoproj/argo-workflows/releases/latest) +[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/argo-workflows)](https://artifacthub.io/packages/helm/argo/argo-workflows) + +## What is Argo Workflows? + +Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. +Argo Workflows is implemented as a Kubernetes CRD (Custom Resource Definition). + +* Define workflows where each step is a container. +* Model multi-step workflows as a sequence of tasks or capture the dependencies between tasks using a directed acyclic graph (DAG). +* Easily run compute intensive jobs for machine learning or data processing in a fraction of the time using Argo Workflows on Kubernetes. + +Argo is a [Cloud Native Computing Foundation (CNCF)](https://cncf.io/) graduated project. + +## Use Cases + +* [Machine Learning pipelines](use-cases/machine-learning.md) +* [Data and batch processing](use-cases/data-processing.md) +* [Infrastructure automation](use-cases/infrastructure-automation.md) +* [CI/CD](use-cases/ci-cd.md) +* [Other use cases](use-cases/other.md) + +## Why Argo Workflows? + +* Argo Workflows is the most popular workflow execution engine for Kubernetes. +* Light-weight, scalable, and easier to use. +* Designed from the ground up for containers without the overhead and limitations of legacy VM and server-based environments. +* Cloud agnostic and can run on any Kubernetes cluster. + +[Read what people said in our latest survey](https://blog.argoproj.io/argo-workflows-events-2023-user-survey-results-82c53bc30543) + +## Try Argo Workflows + +You can try Argo Workflows via one of the following: + +1. [Interactive Training Material](https://killercoda.com/argoproj/course/argo-workflows/) +1. [Access the demo environment](https://workflows.apps.argoproj.io/workflows/argo) + +![Screenshot](assets/screenshot.png) + +## Who uses Argo Workflows? + +[About 200+ organizations are officially using Argo Workflows](https://github.com/argoproj/argo-workflows/blob/main/USERS.md) + +## Ecosystem + +Just some of the projects that use or rely on Argo Workflows (complete list [here](https://github.com/akuity/awesome-argo#ecosystem-projects)): + +* [Argo Events](https://github.com/argoproj/argo-events) +* [Couler](https://github.com/couler-proj/couler) +* [Hera](https://github.com/argoproj-labs/hera-workflows) +* [Katib](https://github.com/kubeflow/katib) +* [Kedro](https://kedro.readthedocs.io/en/stable/) +* [Kubeflow Pipelines](https://github.com/kubeflow/pipelines) +* [Netflix Metaflow](https://metaflow.org) +* [Onepanel](https://github.com/onepanelio/onepanel) +* [Orchest](https://github.com/orchest/orchest/) +* [Piper](https://github.com/quickube/piper) +* [Ploomber](https://github.com/ploomber/ploomber) +* [Seldon](https://github.com/SeldonIO/seldon-core) +* [SQLFlow](https://github.com/sql-machine-learning/sqlflow) + +## Client Libraries + +Check out our [Java, Golang and Python clients](client-libraries.md). + +## Quickstart + +* [Get started here](quick-start.md) +* [Walk-through examples](walk-through/index.md) + +## Documentation + +You're here! + +## Features + +An incomplete list of features Argo Workflows provide: + +* UI to visualize and manage Workflows +* Artifact support (S3, Artifactory, Alibaba Cloud OSS, Azure Blob Storage, HTTP, Git, GCS, raw) +* Workflow templating to store commonly used Workflows in the cluster +* Archiving Workflows after executing for later access +* Scheduled workflows using cron +* Server interface with REST API (HTTP and GRPC) +* DAG or Steps based declaration of workflows +* Step level input & outputs (artifacts/parameters) +* Loops +* Parameterization +* Conditionals +* Timeouts (step & workflow level) +* Retry (step & workflow level) +* Resubmit (memoized) +* Suspend & Resume +* Cancellation +* K8s resource orchestration +* Exit Hooks (notifications, cleanup) +* Garbage collection of completed workflow +* Scheduling (affinity/tolerations/node selectors) +* Volumes (ephemeral/existing) +* Parallelism limits +* Daemoned steps +* DinD (docker-in-docker) +* Script steps +* Event emission +* Prometheus metrics +* Multiple executors +* Multiple pod and workflow garbage collection strategies +* Automatically calculated resource usage per step +* Java/Golang/Python SDKs +* Pod Disruption Budget support +* Single-sign on (OAuth2/OIDC) +* Webhook triggering +* CLI +* Out-of-the box and custom Prometheus metrics +* Windows container support +* Embedded widgets +* Multiplex log viewer + +## Community Meetings + +We host monthly community meetings where we and the community showcase demos and discuss the current and future state of the project. Feel free to join us! +For Community Meeting information, minutes and recordings, please [see here](https://bit.ly/argo-wf-cmty-mtng). + +Participation in Argo Workflows is governed by the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md) + +## Community Blogs and Presentations + +* [Awesome-Argo: A Curated List of Awesome Projects and Resources Related to Argo](https://github.com/terrytangyuan/awesome-argo) +* [Automation of Everything - How To Combine Argo Events, Workflows & Pipelines, CD, and Rollouts](https://youtu.be/XNXJtxkUKeY) +* [Argo Workflows and Pipelines - CI/CD, Machine Learning, and Other Kubernetes Workflows](https://youtu.be/UMaivwrAyTA) +* [Argo Ansible role: Provisioning Argo Workflows on OpenShift](https://medium.com/@marekermk/provisioning-argo-on-openshift-with-ansible-and-kustomize-340a1fda8b50) +* [Argo Workflows vs Apache Airflow](http://bit.ly/30YNIvT) +* [CI/CD with Argo on Kubernetes](https://medium.com/@bouwe.ceunen/ci-cd-with-argo-on-kubernetes-28c1a99616a9) +* [Define Your CI/CD Pipeline with Argo Workflows](https://haque-zubair.medium.com/define-your-ci-cd-pipeline-with-argo-workflows-25aefb02fa63) +* [Distributed Machine Learning Patterns from Manning Publication](https://github.com/terrytangyuan/distributed-ml-patterns) +* [Running Argo Workflows Across Multiple Kubernetes Clusters](https://admiralty.io/blog/running-argo-workflows-across-multiple-kubernetes-clusters/) +* [Open Source Model Management Roundup: Polyaxon, Argo, and Seldon](https://www.anaconda.com/blog/developer-blog/open-source-model-management-roundup-polyaxon-argo-and-seldon/) +* [Producing 200 OpenStreetMap extracts in 35 minutes using a scalable data workflow](https://www.interline.io/blog/scaling-openstreetmap-data-workflows/) +* [Argo integration review](http://dev.matt.hillsdon.net/2018/03/24/argo-integration-review.html) +* TGI Kubernetes with Joe Beda: [Argo workflow system](https://www.youtube.com/watch?v=M_rxPPLG8pU&start=859) + +## Project Resources + +* [Argo Project GitHub organization](https://github.com/argoproj) +* [Argo Website](https://argoproj.github.io/) +* [Argo Slack](https://argoproj.github.io/community/join-slack) + +## Security + +See [Security](security.md). + diff --git a/templates/backstage/argo-workflows/skeleton/docs/images/cnoe-logo.png b/templates/backstage/argo-workflows/skeleton/docs/images/cnoe-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..63b8f228ef58a42a758e570331053afc547df964 GIT binary patch literal 58052 zcmeFZ`9G9v{68*{rH~?`;&6(H5g|JjN+C3sFl5PYWFKpjQ_5N?`&L5P_pyzovSr`* zv9E)%jeYoDw@$s!`F`G?Kj8Ctocf`=d%2d^@_en=yt=QZOh?N`OGZXUcjxvkO)@fy zbuzM}CDg~jo%lXaEpUV0>gLV+HaC@TB5je5S`Lp)&6UmV%^j^wHI;9WkzEfCh8tR* zgEPs-l;rdO+2YrglJb^*U-Vspt!DdQ1GD?)`F2BB!fXo^UN%;21s zaK~R4U(pZ8T_nH4mL)LNIi6oP{r$V7bG3IHop+l6f5>~j_m_^aPkgN$SR`=P;(9kQ zn+F#7tozDGUJgI+%eel7Yuub{pSdQ_@F|7DZaqz}$rjCbDce}i@l)Rl$#hub8J6=} zquvO=G*Z06n-;YHeefmK4EM%E3M!}N!4PTD&zYCG8WkJF(xcV5JF$MdzD0_|Hs1&R z)I;-yyqQLh7H>rGIfjq7ums`ctXC9M#F9}#!N%po$BtH&NxUv*DvC62OD*IjMOMJu)l92$0srI7G z3qrh5PFxiA_*)5<<7`0}VcLZ&H|l+L3VA-AG%9lT4ILkc3D6%tFSeZ@uPZu=3J3PD-U^o3;Efn{4@Et9x`|-~ECY`f5nlmqVNwzRJVOE`D=2_KYYx=S0)V+Zc8t9M{`-ui8w;|iM;I{QZw z=UbizEwdoAc1aa_(YkOhC$qJZ_Ab;BZp{So!1BOZH-*}L3$w`4g4P<91o4x7t$nRF zKi>D+BP6};bpp$jv=hpDoaUVWv|zIqaIPQdigRo|_-ZuMn`1O1{_w;;mCsRM{Gc{Q z6o0Kro7TG&ssCMhO-9X3Hdz2}`zSx@qn@bt4mn37nRkhM8MVbR{k_S}2D!I34V!N{ zF8NO2CS}K3oDv)po{T)LHyjmoG;%b0!r_#lY~6(-T(eoqPRga7wu;agO1SZ`Pe7X2 z?77U>Z(q&ss?RdN_>1Nd%)?bY{d6#kVcD^|9Hd#gcg9neFHQ^g8Tmb9au1ZkkMVe= zOb|qls@YHc#eGNaEZ1|pGLOF&i7Bo=cVz~$(X~!1w$hX)UPfNmWSQi?I{2L(39Qgq zSm|<{%WI?`53-6YD2$#D_|`BvVM3cN%y;I*R8=A`zI3+iTzd+AVT9!rS&pah^{>b~ z`y`e@RI<5K!m;anJW`tvizFCEGmf_HS~iM3wV1#X$TDP8+&47cdA^&BkYDfi`&O-^ z&eodFfhX#_+h4?y^?6|t2fHK>@3o^{BV@&i2S*Psx*xAG?P&x6am!ry&SO!T&m!vb|GN$?7#)dO8; zUDbP%rbs)%M`lP9b3u1I2j~SdX?IC*X=m>Ih|}H9*4|0dU54xM4M}hf-G*^-9=_si zBg3VudY|(q($Sn#Oi)Nrh)b51lao{0(d@CL<}IbaKL`Jl;j(mgc94X@+}zv*-9!YD zjux=15)u+HAz_%XumE^NzzJpV{K#Fv-iiC?Aiu`BW$t9^XyxE+g|z2{#(iXhba9s9 z;({jn{paU8ovj}K&rJ4Ce{TzH5C%PgT@@69{coR{yIcKVK7*e8{OoXFKc|z129s2G zv@!<^hL$CJRr+v(f8G0^?{xT$u-J8J*#G+IfBjVNe?FBE z75V3v|9JBEm(nnZQ2!v@Pp%x^1#FR}m4^Lhu`I3Z(#0AwGI_E)w-g?@A6XcdvpuI% z%Dbhddc;P;JzQ+K%B$)a`xQ>y7Ugt};If#A%+cFl{~Z4m6Uina9(R|U&AsHy_tz9n zFX<5l$A{u=!~FS8#VegR#B^_~{3$1ISU57L9r*6M+;BI1xO=#g+)}J8O)YLM{Zi)s zj?~QE2BoKDN60CtPjbrtckv$){*#3NwBSE2_)iP|(}MrB;6E++PYeFjg8wJAfdAtC zj4sO)FaG7)mvZOqEgZDnM2g8w2=q~@qP1E#~+;a%GL)J2O56&?8mx~lZee=Q=6y30_UFj16ly*rV*cMp0tbDU|0kmvu;*(s=FxnK7- zdrHmL;m)QE#9NnPRtSKhb*b?yub~%P7+-&IqYp~`CoSYh&!LrinsAm{H%EK?u+-Du z-nH@l@o9WVu>BNqs!yxfXsBm1+ndE6{PXRmKOJ_*Tq)Krv~<;$@aP!Dl{L~s&$r~| z57#2rsra|5ZN5Q04YkoMgPy3wJQ4fBo`|@$`952 zpg<-x{|e=LOa6*9po1EXfdsMd=0Dc}1o2B1zFI-L-O18|^>CXEtWbLh4#Q893|2 z73Nk*d`*Fvg)08!;_pE(Pmwd*u~c7g)O!?^|3F&#DH)mp3@1CfeDt5AQGYU^Fui}_ z#jP?$p_Y%@zsEcZ#$>p@_fH)4G#;U8f9d7An*eXOVTt=}X77m;d- z4FN@pD>ggjnA6qeGo3EuUG0^rnObtF+mO(60P*pr7+3!1nlj#3<$PQm<*gmMr8uZ# zm4uOM%EB|(6`oJml+PB6KTUH|mkP~~7rJfw8)7UqIH``xHl;|Yg%U1c+!a+%bGE&c z-zRx%ZD_r(u>IUHyuLQ<7KOt4sQ3}^h5EKVQmuMmdAbaM%*5hWr8|FXrzL_@y`BBt z?i_Kn(>fBfbP%pd;Ds~tZh0jk1u~|$3vVYfqI>=PEN7Is?T7&!9TT1soyhX@p&a)} z*fg_Q)!=Cga*Cci@)|)drGvGmj z)1+^fM75g&aw_VTgQQQHF`Mb?@i7apblP!+4fHNdKwf&(<>is2r4q)|e=Ee}(~;Oy z)9JHS8uQGg`f+?rywu>LgBbcDxfazFtXM_x*^@$y_v1@T%~Yg!Y1x9;clQkWhU1Z@ z3`fXqV8%Zd2P!GZesMU3>GLsvt@xFdG1M4I>dhESl!D(odzmfKWa_1*47b5=MFC%P<|!7J~T=q?~C5wdRa9|o`1zbZX13{W)*&~b+N9R^x)P84xo8h{Oomdn~R60 z`?Spi`c#a#@M=E)Kzy(BunMN6uQtq6e?}CK0tC*;2iC-;Vz*Z9Z-LddN5i<}uSUn~ z(_N@Yh>zi)^{HqVmvJjWX5qyDY;zaN-ct7PK)R*jrm76$j7{R4QsyK50C41#lVhhA zOXGhD6!ppL7lq>EV>ClhX0UNzE~l?M&O6oe z4EYpG_{>T{jEDtzDwVtZ^4Cs{-%~ics=v4Y(rT9teD(x?(_9(xatZqd=X;!QaHQN-wZbv zpj7H~O8*=mgM+uK<}M+a@c~isW#O=w?>W|+cO@btQa_33Vu4FCPr0_*ZPCz{{v-C$ zU~6+9 z#^>8q?Ia?_8wrZ-p7Cj0GU@rua}VP>V}V6S!&!jP5T$Ir{uY`eY)`9rfKQb0+Wpxt)+RndbCJ%x$5ku+>uJl0vUiTun@;Rd@2F!v14n4QsK^yc8B`4Z6A@abT4T>uv?yMfC z3$!VZiQn~D?%bU#QGCK=Lm^nct?%wS$7jYHt;xDqbMBO86JDt{aZWMoaD>`n7J`@E78L~s8dU0|lZXWUH z_|0!gexc}iPgYW+5f2#XNpK1|)wdTcs|oGvLwq&YCStKH-A-C&OK|g%^`YlOq4tP^ zIb(!Mc1LZkT2iNN{!nJ+h3__-YT}H<03fF6f85Wg6$<(-vBrYr;vDOE%GLniTki)K zwRhdue3*J>Yecn;J(hUxk45Bfig9@Y?NoQ}8Gj}A3RlcCblD-aq zaJ*UTtPx#ZeVqEK89d_F7fPZFyM2Kc`*l{ixq!jHsYAFD&s}xf~VS zc^@I<=2+o+X-!l4W;WV!jdb%cYUB*>Im9byf7+^}1lYdTi8Nm7wC$J^xBSk_i&dVi`V=rNe;VRJD%bx5`}AZA*nNGYBW5&FeBUhSvFJ=mm@bX zrFbyp-_ozp!;br}Z{d6zb=sj=BV5Ti&v#O=*}?hUPkQRwpe1^Hl#JN!^#Og|h z(kA6vOGPNTheertI2pQ-85ov9edOpNkb_7h9$S0{9ZsU2^d4OLOtIZjO1UoUqcHXS zfJ#Hg?V60Zx}9NM=54^v63yiqcJEH787~{BihyKR{On|Hw8 zX*si;F_Wzf6j?Z{+S+`iq6>0#{U+;DX{WufIBv8`_^mg%#aIy5A;kK(lZ>7^6FIm( zP#fha|7UgsW=KKy2)4n972qM9e#zzPvh?~qcvaeFzBZpq^wW;*oUb;uhdxP;9QQ52cROuzA^36o$O6=Cb z$EwBkbVS2N1N(E3*SM|tQk93q#Fk~PosIO#KNvdXNxx`jjte=fTlU~F2rfj*;81Jd%Gx$w6ESUbb2nl1BEyv(R| zw}amai?YBswBa}I@=%!`JA^5>LZ58l@ivEevgwznObRH*rFjd_4wmP3mJ zYMmZydiE3Pasjp&toF00=FO7rA7$`Tu@{F)6}%wGH!fw9P4FDT*V>uc@$~@{UDQ?b zpj=%~Mx)CW;R0J4@R5|XzB{dm$wK1JT1947uLe47uEgrP%;qMbvyuZ$z1?ubc!xLA zo16BEmt1UojL4=3`|k0C=otR~it~G2U-`#1Ja&fdk1wWlc?rRi^M%)H<2cOqeI)kV z-JpOa5&<#*9wHWhyU8vTwVgJNA!^y@DXVulPS`Pd8GPh4BAQcNJh)gGm8rwj%H6l! zO{M0eOAna-*uTAhPn32X*j5030wkH{s0uf(VoaF5TwkEdXMfa7rxAO(`lz}QjKlC0 z?KCk!&L~n;kGXCoIz~28=Ru4>pY>ayJa;bxV!Xqs{!BPly``DV$jy^{iGcO4517-f zf{7#2L#LlncG{z?KV|BZbEvmsQF634>qXpcrxYrZ z=?z=$U78uy)j#q>On7Zzfsn`IZM9ePK>=`I56Ywbj&`U25TczXT?@TiBkB{H-I`LN z9q+j7j~~=Z5SJb656pCD?Q|Yd?$6*%tldBS#SuL=?y^%PDijsZlkQO5zeVu1sc4m0H^;Nb3z&H5rS5cH1_z$~+D({j#xzdx*qUR+ z+Cklqt~dr+YhlS?z^p)~<+)leqT$bkw!tNbevf+~6Q`mm2RHX!>TDFmd*TxK`%|=g z!X!&}J}1^7n4Y;`u&H~l7+hHOxVcSguDK>u_QdM&s|rNf)?Y6+&(tLG?!3uFv<$6& zI)WAx33`0tuVdCUlMH7O3`HOc;I8lW5=z&`$jV$6Mke3}_t&>y#5dHy2J}=Cx94+G z{iWv!OLIMb*@ zgstlr(D^Ep=C<=CUkM!-d!+ER5r+j{X8u-9yVfu<=OP-4^d2)Jm0x>EWv#B*d`LcS z)M1q{0bj~h?Ds07z?^Ou*ne?P_M>iZ>go@Wi| zuDzww@fypQsa)4|RDcX8JoL@39m##fpMQ`V&}-T`c>U$D(n{dDrm}%Sdpi#gooA@+ z_y;R)Uk|H4A|TV+{C&pkF!|B;Ox{PtfWE>maVqwrlf?sVxfCAX z{@vw+4cvZ+6OuL7fZ_6pSqNNJq8 zDvGH`mU=eBTbu1#c2b7d2R4jGRW0y^Bc?jK+URzFs@9}ks&9Wx%Im=wKRuWth_jv7 z)(FbFYLkSyuuwD7;GZw%G`;=p<5gb?X(yx8>RARt$d`Hj6v1MUcrSpEzR`z@2)RcT z+RB{js-7Z!Mr}_kSdZb-n9hpOfh^Uy>TXUmTN0Zfy_~^>K;<^35XPyW?QN>Fr8{co zVGnW^q@O;sR9V}PI*WvZwVe6+pywBB@l){bxHZ@VPj$2N$jNaQ(tv=0tI7V;*+ot& z(U>N_*b1^*b5gu2!wWyEi& ziWUl{%$?bt3++v9&HAD*A(q{|39vYVF1ejV+}#nA9^AiQv@c`HbjQ?2;B|f@a1Qx& zG(v*L8!-KTYDqR6V)3Gpb+6M2_P2zxvB~rwh3-(S{g_W}Xt*Tl=-S&EQG%+JBu#t| z^{*cA+&#@fkcU|HS$^<<)j&h+8`q&VraL}a)6-au_?9WwYY{J& zj%N~W#EcQYj;89jFPJC$7xguy1H{WbMc@eRu%; zKw63CjCM0=dZ+QaCqD`JHsy@13XSS@5^0Ds4s?>w0><#q`%IO}Vq#w)KBofa`7!OK73D%R{@9N%9C8z_O(S z7|y3e4M=SZfxNhfBf)s}wDq|X+v@UCEqkpiZGAcR^Hp0vVOA!JciY=h1MF`XoG*>ZE1(y$ognbzDP4!S&6wYNjtO<-jx)i%x>DZ_*C&OH(o)4Z=!`+!qxW9IMO{}pbe_+lZUGpuru3Tso0V^4W!cwacOHgIeYrO%VCMMU z-1hDtLTP`Mv7oU@?gHm(Z9W7yePUGfNis|ZLCVdY2_h+ZxxJyA#S#->w?)_6I9QVN z)$Q~TRNC^Of?Txq#Jh%8`_i(CFfHSlmAI6O7q*oyJ}ZHkHI%JEN8tk?}?Wc+@;q|d}@oO94}k{N&!6mP=@;z z$i0g|@?CMdJrIue3}hm7tU;}0p4=uLh!$LV6y-`_Rp zn;kLQJEcXtX`_C*2`}C(Y4};^+$~q!%5&15`;6t2jU;zT-^JvW^&!XWqHa9#HewSK z6ZqW{cJj5>9(L7jfN)R5$<|HmC{{;``BGBC--r&hg!A7aC_UESj~Q5U1yyLXX;Rmg z;*08XPyb+yl$D?2N_pYswy=%rClE-P98tXbD~9e-bc+d-OX=9=skaVM#L*A|{g9qn|Mrbf4n z&j=s)iM?A;#sv0dn2S)n7F(jeWbL?lyFawuxUK#_~sfwfl47@MXn3Gs6pTUzwl- z9j{@NR*vL!ELMA;-gjs&W^+w<$!l-DNe(6{f}B2Ld6?79d-^oK_XvbNSNyAZ8!d{A zbvwDwpJBZnb6PYe)%U$0l1Fl5$j@Yq7z-B<&77@y@VQz#YmzMxH2)-vC%vxmVQSi{ zc)#>c1BEJ&H|1w(n;kel`IQBE%s(@WK{8vu&$795Z%hSLKyef z1qY$T=tQK1)1S@fUVFVWgJ-O!m$RETcA6YGc=MmZ?0jH9-*KFrg?jQwHs-=Du_qFy z8*7xkya7fX-NBh9d!*(Gl-9e!N@rWN2;cF#>58*`(Gste*ldfn+8NU&pP`v_ksYDmFMK}Q+raGfA(3a(bvh4$ zpr6K`zsAwjcou_|p!`#PQW|no&=S?OmJ>+?S4Rsk8o25A9es0xDiFd2bAMkHKie@f2&V}sNuC8E7cSD`X&_xtx_`-|n z!&a25RDVv5qK@8WjrE;EspU3fi%G_EeEqbbcS?Byv~rN4oxrHSTY!Y#$iE3`ky#>+ za&9zhM`2VzC(?1-x*>|%ehRn8L=t|^`+MOPB|gs6@~a-VMRYD-*?$x7 zgWFA7SI zM{NYNuX6f4Ub_yy?sHFvTZ91G;Iy+v?7egwTtTPXwZVb3i48Sh4(63e(t%9s;QAp_ zO7e3i_V(*1nL_&C_6V)>MQ1_D6}Kh=%1rw$O*Ya~;!$!VGG!zY*!&$JS{W~^c=?fX zN+N@ADOsG#1BT1y8jL~&WizU=66p(e6l(*lI@w!J85oZ~W2ETe%FlxeGk%M%Lk2Pl zv+v{)rgOZ^R&vi!bu$|ox8J}WmvDDn%h?_W-E;h83ZW1m`I;U-tiVLVuhmn^sqshS zrUla{ufDID0Su8Jxd;eWKh@?~y3ly(p7fWFZS8HucwiLTnRswat6&{#5g(iDLF3Llw zA*_2*Oc&bjhpImnic@q~Z_H#WbFf9#Y(F9r3PiBLE3^Jnw=sIp^+O9ahd zA0#XT&p`96Wax}F($h|EZ~KbgTayZNIm~0wiEesooF$v8E|X$y_1ze#bx!RH1d{S}uq3cJ zG>{L`;)WN8jYv)>>jUE={G{>?FXKMxQCW%IumC+o-srteVVxX-boNYFF$?J#hC96BzFv_?1!CpqgS=tna0?~G4dcsDC3akF?kA%j za$1(&t=UR9^@^xAY!5sQUdRr~g1Y&$Phh9RCU!oP7Z?UOwGTm8}Z*Txi zpJPp4GOHMm(1#l-3uO=6Y3QL)*m7~dbMm&_x?kSfm1VPKLV#}t<+V3@=B^(~lM-j8 zMw~f6SEL1+phppR_o+M!rII3SM!z%xkAwS z`c>qygzXcXsVT%vqPc|o^+qzm>znX-yM>Hye`)hV6x!bqT80DE!*Nj_>VP@KE^ur4 zO_f(_Z%E#1R_#MnATQ^;x}6m1bK3Kymml76tUXL)zgm<)$m;i(u6b;YU4O#ucAFc5 zi%+0F%YzJ5`#U`k-TGW5o!XmH(3epzCo|;1(qzMP^r|`s;z43w5)3wcXs;T;MlLxy zLbYQ^77wWe>NMvk?-jyk$Tc8D>B=GUvGC-L^>)Z z9R@{jpT@HsdL@U0Kpn22YbYvBSSOpbv**V)r1fb;GdH&^hd7B-=gC^Sc0H|AwZ;Rb z$VA*~9Gl~jiNBwy0^^bHcm$TAYXyRn_Z8STj2A1fV*H;FL`((#l!9&=;wRS6G72;(S7-nW zY!KmmCUNDUdhyUDuzw)IgdOgY8L`>WERYuYgVc~8e@ILkFv_LB99h92J({Eafs1GA zykmj+8#39A2926z=sT3Fk|=W&Yo|?R^!mGFA)fDKNBZ|I=`{GM zxa7A9=?_KZ2m$dB@~S|{`*%2fjdOWHasRuQTpBCx)rsI^Y~_isKv_+IIR0?NK(2h0 zw+z})q5wKJZX;zNR33-1GaL_dWiebg8Tz2lu<yAf_I4c1L`yoIqk$GI2H|5-v~sQwLLm1lE(;)ZjV>sc!Vwt>Gq-DKap;2kv$rm7oJ*CS zCevY5gk2bsLGZdDxPhhy*m){6DeBA{^5z6WT2)mJb}@Z%Q4-RKyeg3F;EHrBZWEkN zM6{f|MsodtsjdNSrjO8%ssj}=!dUv-*9J<3v0|Z{Jw{1=%IR8x+()07@;nPCp;iPJ zU0&FT(T5l9N`j_5v><4+br}}cf9nj|?e9}pXP+Vw}q5Ul;UG!WM)L^>@>tYg^@dj!=xJy9slqNw9&AN}#v6S%l68xFi!g1h=|5zUw!f1>IlH9v+ z{@RL!y7ftz=eA>!1ogZ3zT8dd{)=F+3V;%ugf|x;_Ff?GoqqC$Cc8bk;$EM*KUi(z zP4c9uh*N8^~&%1UK-=t4dQx9CfMKzyqfVIn7$quKm--IfCL>7 zKwH6>^?RBlCt*;6VFu0@KmwWI>ey`0jVXKF$g8g`{<--z8Rd~CWsGoJ--_M61vMa0 zps!<`v;pPPtIWZ85j6dWCTs1?a>H(UjbSJmsO;CH%SRfq)Fz8H@&m_B;xgBHy(@Af z=m~=RNHj@i{hfTcnyOCu!gK_{hMZIeEkiSz=H8#)CP7P%clB&3lq5y~a7L!vqLmr<~bV?oBu@T&B zU%F-rw~Z+?$}jp;#8F#e<}_yx7uY7hBR8ENpxIs6>yay@v7P;n&~H$|sVxN@ZP+~? z{V*oKlb%b;uCjSdwR;2VbW=dFzV|}jbHNo*rJG1)_D$7ASnaO*ojVLOSirIjKbdlX z{Zcn68%KiP#?7^AS7y+^qB#m2m5kj)<52j(vZjjO}M1~^Y#mR za9j2y+l&uh>W9tvCn2^TgV>sL8@=U^GV`i$(w~%Zu!D%1(Ka!Y{wqaN%TBcWtt+&k ze;(Utrk+eRsEkS}xB(PVl!cXQ6~VAdbobgabO{Gf%bnSxP?X6nG=?*^GzNHoRS$gM+ML6_wRMSuY-D= zp_VO+a{>?67DnWe={n3(xB$3u@O!cF*j)=~9N#Y8v(LL3kKANe~ zhl@o4xV3>9$v1#h{Fi_SX(Ha`@LSm>F9}7Purk}QoUO+@hz(rl&yKyRjmT=LV6>Sc zdFdEiYE)hVy^Lw%u=#l?@I$|cI*+3CtvG*^JMI+gvDF_?lT%@_58Y9e1b232v8;i^ zRLrKE$^6QrbM5-)Ulcr0Rb*@0pW!<1HglhFgXK3TMcWE1baf&+v%dkk)_=ipM16Lmu)^H|$ni7w`14X9)|sJo2GF&7|RabTQEwsmo+`K@W9VMny+T zcW;6#0Y0LWY?Cf~YXZtYOGAd{!vfpyEv8?7Ez+E34ND1LswEpt5c7yPX}OW!f$;Dk z%$DCgv%hz!+Ge0=6D+Yl1vfAimmy`9U2u}0oxB*p=VLLyekD)M4jOJ5bOaD&p8o@G zFEP#D`VcsacaXHoIKH`s8~aNp;o#B4M;7GF{dKO;EMA{Gz;kgklR^u)OL|sHaPjn$!CRlHmWt4}brMmW>`0sq=2PD!h29ESsB%1y=3!PQK zX$$I6=8{u*oj^kGTZ&cT2d}VIGerGTBPL^_0c8lYi`X>_LD1?YKsJlWWTpOY}?TSOiC4!{(XQ3xH{6J*Axo}9Cb5Y zs}%)tQZPME!kFuW?BN7`;y_auzt3%uPc@su`Zix7_@$Ly9si(Ca=EV?DbUw#_HjU=L35g+83`_WRV{ijZe4Q==^nLJxf&Fjb}m3!>@-(@xK29i zflcuz3)Fxm2+_K6W18kM!#+72)#X^$;qp8-BSkV-IhhhShgYA68~>FOw;uo@X_7I1T7TLr$j~8WGWX^gNuEgGcT9rl%JpcJP(O(BO<=M$42ABE+ zuW8)R*4dNDTida7Htl|q%_)^K?mba3i{9I5oBXo0X>B&SUrr%gld)f1BRD_cu4@`;a zY>TeLPB~NN9TdePCM0Q|m z)$2BA80$Sz^E3S%A>?XO-!4ZXsl*>6bE?m*K4>?ndeq-j$9{V9N}U1LHO+;wj;D7& z-Y+3n4fi(lvaV;b+Buq7#=V5UF6l@WL7e$Njyo8epf#4WJ$b9

d(w5}BKBAr{wrzd*>V2kjkOcueVOl_vEG7B`N4Za1mCi(JQ%LO+x) z%LR9-%EYJbi4B+g3doS`-R7O*pvV_RJrqJ5OdESQfTD`J#BM0KqyhJzYj9Hzi)*V+ zQsQ7*WRRPUa@%~69fxsu%hu73Axia1W%*`_K$=_%SsqVha1e;XXeY0{>-Afl9cWp` zFLGLR6_yO&!Eme#NaHT$7SWuHR530WMC?oHYTF&q#irR1=tF|?>c8`IaU=CoyQk5y z53)!V^j~dfJ|m=JM)=|lZEL9_h{rbcmxX6S^E#T+h*)vU)5%Y=rs>LXi0MdAj+;g_ zHbAWxkp=)R9Ql=@cuW#4-F&$w`aZn;mEq*qrR{<3=Ji%L@2@h$=bf*iizq`T$c+lU z-#jn$-9e5Hx;4^V$q)gj>K;sv|ER6*I0!Z{@2aW?q*5s zf2}mM{vi=ehVF*WFp)fM{{lXbzVRD8bDVgO!5_U!PvtQb0iTC-6&YjZFiREH&Ata| zpVbDt$IqDJ;k=GlFWlYtk?P^{0<9|b{>rGhY7OGRM5p0uWYuMKvsP%Tr!MuZD%G?l zNORl)8;V;h%00!|mQ`ixU2dR|)55;)x|`wxtRb%hQ=H_>?70-hGvAy_MdHnA#)H3K zNXFGZ$_VZy(2t&wX+W2kXWY>9mbl3;svhjJ3c`Z-xfx$Z3+_-n{^Fp2Ufq%M(2F?_ zEJn{t7Q4t1^5(;{5jBDvNn>-kNb!-=0w9Teg?z-oHwq*Xf{mN<8_Ep!UW2rY^!AFt zd5LJ;Sw#WOb>Fr{t8eMy!4b$g5We*^*vv&(KaYt^{%Y5bw^v%F9TA4qN&?D(Ovuh% zJVI{BTpx8A;_JC`Q>A+|LX)W`Y26>c8*!nx=g2m} zFyLMcUs`9y1+U>Ab2e)?m!4WFy1aV%c$ZbR5t`6cM&5wTEw_$q7P05>Be0*nwWHiX zokHdJpk&G`N^mSHr0Jcsc@|y|6?#QecE!+z6TN+W@9Hz>R)ln@Ehf^(bGoa6T8(*^ zu?ZX*n<<;(#0h7-64ySflSayLE70`aJi}h!SbBKipWj^4r+EukArBw^jACTAxA_VQ z1rZ$m*ALybeMdokP2ly2!F#`iX#1k)8y{CkYkiI{f^JasB}&H>go-j_-(Wx$&Q-cX z%(jB%xkyC`jzc!S*Ed|?WrRpw0PYdr#~<^cV7_J&-RN@WLOpv{7^ciI%c%q~Kl;$=XhFra8o)6=!PA9?H;(!a>+DVmkX33cXTQb%j7u^DHCqtk}cyodMDFAfuv zE#Pp4R75RwCO!6#oNLwPZhFkmP!>bC)EPO2m{^akqz&t`AbGIoy-Jw)B--9}JSt^7 zivng*P%$BOZu09<)EuVXIp{~>CVlE$ktt0q?7nTSCix7Z!ctwY`QTe{;Lc&>EeS%1 z-dy&NQc$hM_?q3PyHO~VVP?CWYv2~*0c>KV31&Lq|7K3(ywCYLHnbv?&OaT&;f+1- z>`iLT?Xpx^RC>aCwl011nD2wD?yx*MZmHEKQKmY2J0FG#>Pg_!v`s4(U|*2K3*nw! zpxft{4L}1Mz&2!d^G~R*v-bi|%pp@c8mu~a%WN=t{yH&W;++SnD==}Gui{Hwc+Cn$ zG_x*NUSs1dWuWVe_f{Y$_qgGqz1{oNuK1xC?3QmMVz2n~sC7m@n+=0ckCbjhP+hpu z$LNGxi96PBlUk%}D_vU5R-jr%Ex=$?nh^lU4sWXPtGuq5gBR&9=hWaCXTwC6#JJpN zIPzJBnRlsUFTOtN)LDtXawf-qSPzRFFX_aOVG(bM%eYV}7|Tg5Yn@D$#od(}zd;R& z>+j2s(@!csb0gF_i{`CrKbc>(LWZ*N2MsBq?joLPqzs=92YcsklL<)MMtFBO9U8RaS>|ZRt4`Q$z7o@;`Pm(8* zDdaQZSC19xiDohu8;r)_>*feBpCDrWC5Cxoz;Gk`QXiwl^#_Vq1DTGLcWPOshY;7w zmrfiUtMy1oFBQbiJqgWwXW}i5F7Lc@AsbADpJApo$*AW4eiE204FIA_@~I$SG)^vo zPgXG!6aOI{m%+kJLD-0~(Ygzrty}iTdop&Fok3?cihS^>N#K@(sed8-f9!qrTa;bb zwvM2Lq9`RuE8U1R3@V|5bT^`ufOLZ+jXk&Mf zL2EkPk=S{B-r&F#%sfsGDIrn4O%YV`b(Fh3IgV+zEzuaa!Pz+uUYX4p7H20c zV&fJscy%r0gR5}(!7g$hFR`1z^+f9YLWbxMr_d5xxZrAm^WtGv5nK4ID zWozUGy?@bwiWO8{5QLob9`BWBdD(jw9ny=}S6%$t0pNP7K0?w!@+0BBbbyMg-c?nV z9q$165#Z23t%dbXB~J9T{R}?m5~JIF`S#d$mHa1_`WOqt$_0)JG7op{0q}wjhPlTe0V#?ZxEq%mQzB4fC}R*2KNhb}cV0L+N%AwB zeNhZNTplcKmreD|Z8{!*xIvy}^s@B_H&r9i$i{fQ)8!cr%Ii~0EmJXUW;2{Zcn>2^ z^3+JqjH5PszBM+3&J_NNN_pl*_*?aj=CcIxV2=em!arT|*@y+)m!;pbY>{jy11W#5 zL#|;8Pz%SC4vc`?LIn|*TejydA9i6cw48AdG&cni{JCD3h|rYT;!@1;LjJy7=NU1? ze}_9v%(iI{qeAp&l0v+s?SkMBr^-|X_nqt&#hP_%v4(u76UaNKdvIC22#S&unU&NM zcyAPeOx7ByFN+v%A&4 zFyT8j8-e5imm&B_?eb2o7Ru0dLwMmv^b$aIl8Ccay8OH5x`sp)#8*3S41AWsrI}jK zN;q(!GpoJSQj5BaWO=W7a0MY_YueSa?Iq6}`bg1BH)f@rR(0N@VxA7><||6Osngj5 za|^a}8O*_z=^&8z8e8&v>};SQoJCAm>?OoL?s?HZ_Y48f0>e8J%{Z=D zWs*RL<N$vR*$26BRVHvcQ;Zo68X9=^N@ZHt?C|_uurWFVy#e*%NlyQ?@miqd2j~B z|3!OV7Cjmr)&ze(NIF%0tE#7E`Yqr9s#^XRbYQNSdYm$DrQ3n6)BAM6nn_(xy*rmn zeoc6rq$?D?(XS}jGr$oj&7tBMcFADUDHWEVHh!#;DZUy2*{8UF+;rB5&DISX9n$s) zaJR|en_oilI!nC`HsA&u-?97V4p=jVpMU7UN6SChl9YEU_r-VArc*>sgsx=_`zE@% zpm)b*mn}_qILF663$y3ldn@fc=8Ush$@pYd=5%5nsa#|`)O6Bo4YhlE+#Pitv>}l= z=BxLq_TiO8JqNWju`{)A8)Snq_Jf54ot55b$yyPPGmyRnNoSnhT35~8e=Z?D;gN99 zDV$g2h^l7vs2KQy^k7p?j}r`p2O+TQ$mRW}Gvj@o=Lt0MZFp$|TWUKnN zIgUYk@p)CU1vY6HTs*z(&p<6bWI8owwYjlY-PXKXNK*6Bd)~;(z=cmyoxDxA!0`JX zb(iz{*Ms~N&2gxnJwF3lY_zj4*lP?322|);sJm{IcSuf959)Ja>tg;Vf{-CC(KYi; zi8YPneRY|wLN;(<3c+lqixXxC_%BH~$ z^1~K=Q<^6(X<927MepsXcwREb;yO^L8B?Y`9awReEkl#ei;|)0yp^dN!_*zCVFk_= zZEYsy#9GCTt}Ac3Ke)`dT1^dxwsX76N9akAm$zxVqVT2*_NU^WJ(Lj33?6lDqLEoJ zEs7!3-<4b|PJt@r_jWXJOp6QHAfmA`+o_xE+t<}`DfpQ=gbsN*+$dQ_nt zC7RUHLglot3@AY8w%iwzcK+nzX-V3uZ=~CS`0hT~nlJ3r93w6vaPfBCFN8DAy#(i? z98zbru_5fBNkiGdbdcjM#0T3f8Y}Kn-&)kX#mAkIZ6_J2jGV$Z?tT7xtM}?WZocBI zJ0MvUUoyxTvr|m__HL7Bs7>@^NZlMJqW%uR!q&%Lm3bRjivaq7VhDy`_1Fwe1f3l? z5-)lNRy&B|-}$I}C!o`lSfcy71R_8bk$8SS+nT*EB&`Gt()`Xs$$X=6Tz$&1iZpN0 z`&aedNvtOa?d3>SlR1G+6_N=G#RUDBPNeE};?pAm70mHxiy^}go#+Aal+8KgM+W)9 zn)7=YhFEmy^9n{^WAz!lS^ZF>jPy|YT9ljR zB%V!dRoqdv%p*b6an-+>we`p)!ZGQo_e$2cL-f@~U8s0ODmLuYm;a^f(F9F`f2p+) zzi@JQi|nQ~BdEoe0ochKbzsnlcsyu!>77F>U`fs5*_L7(`{~IXqx9-NR>N(sC9N!>_m={-0d#9=E5cEN-wKLYfHbzHO7j_ZEwgD zsJeH(3LD**gEb!r5>AHT7?z;Kl6`e{-@^WwzJ0~zg)`q7kr!0W#>`~$7q4(ulTkt; z7Ga_#co%O%#7lEbj_p8CU}n9y!`W-kl#6{RTq*kX;Z5_q$r4nJGpNRE!dsC(W#e7Uk?UfvUQ8##S6O^{u00^H2p!%(=DEd7utI`axWG)Ff2(~o z;MA)6I?tZH^dX~>rgethv`uD!=7#Czy4otoLu5qW?}fJ$TrYFFt_0sCbjJvaT-yRE zi4dF>4pF zqPP}O8J=q0uZ)6r28woD7b^L8Uv53G))k`N36pr0R;y zEOMJ297tEw9AD2hPR)`<383mAI+K_6e||DId6KTaY`HMQrY`@dlH2GE#|B*_!n4#z z)ox(m!JfIU?UHw;%JdnMr@Nf}T3V_;m;C3T!=Mmka27$UjV{ip4`I%X?J1UVGOBNNN;l)s3vO^x3ClKM+Sgo;HDob zOwJC!J7$R7{K-6B!s40#BAU=L#Fs#N^QiyjoE|2o`$vGF-T;>&YJz6}t9;s~@W94i zj?;R(UB3INmuvY&B3WBpsrsH6AKA%=9;ebpw8+s5d#r+vPfT3Azq^CkhM(A z_VBXNq{iuP^R=i~Q)VMK!gfe2>yPON@Ad~j|< zlgT_q?N!$S8t3Kj7xVWin^8ydr{ebZe8B*=85}0S@s#lKmlQD1Rq*p&*R3-Z$`Jme z_T9nki_bNCA~chADS6)|!uA>sS~Q8YS`OM)R-0XLh2l|zo4$@Uqb{mOd7v_$*#142 z&69j%!Q_7Z_I#@N@|~1ED+zMN&tAiITPnC1le_-kghFl#na&AZJnx;Y#V09Af1>Wv z>&AKoo6PtP@Q1v=p1&-eS@}HOh^2Ljw|e(duvBQ-O$QCbyOKAvHd_v6#*CZZPq8cs zQeI$qI=CebvZkl1!+*BXC89|qT`zX3i=T=qKUE*et>s1UNy$u}Fe{=?g!i`2Y;IEC zauviywXIG`7we?fULFXG*UF?b*r!evnEt@uHag&g*8%_{3}IdhX7bUFQ*v$>OK;J%^b z&_DNb^7Fhai>u(piDRwE`nZ(ofwOn;^5C*u##r|hGqs*O!rm-^{$AI+LRD;B0>Z|+ z>tH+b#K9$rPTWhMP)omu^TV<-yB0ohfd-QV3r%)%g6mnatyFuZW1r@>srFyv%}NW- z?e)J1TrNX@{vr9@m=Tm=3KMHn9 zQX+wk*I`+Cyo<{t0GBCn6ZADpQni(wxJPE4!|?vVy;zLa;Lq?U7`f9%wF5{t^SEmM z$+2NivE5xwUI8&7-Yp7zttUO~2rw%V02ng#@m?6%3~~gG68TM42U6eto)xVN!PptM zxK_E;TbuSa?EB&X*_q}W*N%tbiN>ljOa?@=Ndm9yk*|0&Dv<{=Jwwt!Umd3Is9nys zXh|acEmjj#=7UWo^Z0^V*t=Va&)+x3OhuT91 zbR!zdbTAiT^I`T+Y4`0VWn!~BTV9Pn#%)=hA+_+xT!{>(cuE8#;Z^8~9Ftx`G9m6D z68m(CR?a+Fs=oMy{e4*(@QgeCD1p1;g%jkB!(w@U#aT$;L3h|X#ADRp(Nu&Xl?nx3v}=wVH3zjyfvh<4|WTR+>mB+5tWw-v-LecQZQ{b7A1|oN?VCt!O0B|(q3;>G zwjGJ)6?IP?*z{z7Fq8BidqMkV5HvLz{)`EQd%&`Moz-zR?dd57OviU@O6S8a3?hAB zpL$@}3>*S2(uCA*W&9!!ti*fB!DHp5J77&!PY?RsjFNCknza^@wrfD|alczVw_9JU zLAOZCRzCAN4sN;I2kM0ee|C~g;9K|I@a&^UZ(28N;u>uIn6%k z5|$Mv?|`km1r^9L--pU68*yPMmJnr)J(&AqL7L0=`R+*p9iL3vlbvC6s%uBNd@#@E z1)c=%Ysd1#)JGf#K8hclq%mTogB=vzb~tOF7+nwgNt);DYs~h~=Pb%?W9%u{UClqZ zLKr4T8QdVH>|SSS%jOK=gh&eBmVV89h984kkR8)9keS=I)ucRK1-?nvb91 z3sB$!`;yS~-jI0e^#k`Q{|)3q^sM!)c+S?Bc$)SjNHGWJ~1&Wyg*20Yve z**3`BqU&?utq9<~5dL%l9JJADM$t~Y_DtQSHq5H-t&B?$)uy=O<>Z5XZ8c}=P-C>F zGs=miEv{(ZXw~Z~dIe`|n`&puPIZJmQjS;oyA^cKKxk6us0jt zXKqCaT%|@4ybyHuh3@)S?|M6Zqnt`WG3uylB;+Jss?lmST`+bWDI6>yt(+PS}8bD?xY*c+uirz@J#79PI@64 z2%!;wI0lTRmsyOIr5CK-atW*lKTC8^glgU4Q;c9|D0}lzz-NI>01SwaAQH*HSDQ;@ zCNlL4C=a@KnLyy$8GP8TymK|a23`*)q{*XWF?#D^XmHd}Ppgx5~0M#Th&q3sp zdiRy0&PMdPQ)Axf1ulH^9tEJ_8Z4^}1gsuz;uNpvqS+(dT}&P(KerOEyK^TDP(~70 zyZL18hxjS8e{f@thiG6@mB9{?5f%W6-!VMT`o1v1Bd5R<>EnSW&Q+zsc?TNARov}O z6K$J}+>b?iIc~4ZHedE`yKB^pRpyj4Gl56EOK$9T6J>Hg2N}$#t-@Gd$xKkDpAg@P z4<-W-Ax65s;OldJ>U8)rYvAgVc#%UcU~tZ6iPf4c zs!l4poj|=@3}GT^9Tj<@R&!1nZE)L<6Rn?+f5{F?!35V?X=x1Gx=(KXR0Lx)R|6e2 z$}dB)9xoNj+w|Z!mA(3;obYt2y{WjQ8L<%O)^ho1tjr15jt%t(mr;{CGJt*z6kQJk zFp9KMr3nSA{yKHHz1t$T{W=?9{nl4_ z^7)=eP{qb}yo(zOY2qNXe&%K5<)78%%|iSnEa$CyzHbbBf9B!4?}1ln36J6~A+&Mc za0YxX^HXn6o+lE5IJN%==El>b3!hTTQgiW&TNl!VbKiQ4BSB1IHknZ#*Iu3!WVz#2 zF?w*VNcj>diTvz89QO46O-+uQBaW73MY_GmAo0**HwZEKI^} zyjUsz1V6_S%`jVBL!B=72o|2;oY*tT<`=_>CQ#IGWiqu*C#CoGiKgdSmn(0voPTyd zdg5z*)xZ;q$&H9$X##Q=1^ZF@x>_82QBmorQAEH zfE#`1`3Y`kguW3uPY*NCl&N63Cl?*@%ZJ^M_}#K69J%6lnYUPkQ*ja*g(nj3iHxuH zYw1nD;ZCwH|8lznA%s%r|Mv97sUZI(|KyU+FGa(3+S?1dkWbb z`dc#s=<`>nBkNm~9%KISDqODT6G;+W<1sZGTL0yfcspgXl zmdaG`1^n@*j=VF}9D)n8@Q(Ee^ZvvbR9|Nl)-jcw?<`v9$((X~>0{%l@J7(P)ycF{ z^~1GE7~gFdGZ9tT=JkLWFxgUcXEYaQ_r<+rG4OM+RY6O4%(AIXb>bat^Y9RtmKxUNg&Jl_zS7zg~{s6%~It~I-hJeBAaBv zuageW14Y)XxCUWYF&_t6!$goLuT=j@oZo^-;k)qVmITc5Okp_gjDWYAXXjN_9(`BS z!S44R^gI0WGnmDBdSpJ5&0_dmE_(FGL9iCdyt1DE{=2wPWkDbhh0IFU`nC;(`)ry4 zyrJLOf0kGN z0o_+Y(wHR31w_D=TikYEzEN0mTib_e*!s}D6Dj3Fof((f)LA9Aa#?4ww`LA+esRP! zBZrr-j91{kl$|1NR@V9_Y=p|o#acuZ6ipB#x=^7)A}2e-Iwx$Nw~PF-Cajp}GCs;* zIq%~oL_Y3<*IFgZ)xK8$cSFp-9(+&wlufnCHx_%k=d3n)7GWc3L9?JFZ!Oqf=1Ef8d)HMiLv;?op z`E?HxFhbk_OvI?nvie{QeQ5pm2-?3o>1cZL!|g0i?}XGBlJ&a8&ZkZHpT!s?Q!B@K zdsjXCjY>0LllF9c6k3-jW4D2fDtB$Rd!^0_^-x-q$O%TF6Fqqi2ij*mTSc)44`h;t z_aA$UW-{@*Y}ZY0x#=`Nz1#zN6|S?xte+Eyp$CS394w#VI<+VT zG^rh0lu)z0JnUicC4@g=o$zRUS$C^VKqu?cJ0NO+nd7VAmG~!+O)YG!3!BvVI_hT- zPn$()-8?8SXmX-C)f}#ok@us+MKX(guJy*nZug(S@=NfV?M1Ji(e+8)GKs?2F_FD} zss8mfOjhvYL@#a>*X*kT3-#f$1iuOG(879&osqXf(RHhqf|fwyLkZIpw9+C@90na; zz4j@bqsA7{@#B;5Q-gdI_(CDWX>?j7Pr`c1xSC1LcFfqOeU_}7VOT(kzG3o|`R47V zVz^E*LzkQ8&zcP;e6z4F=W0=bBmjaFPIw802y}n$4Q5P9*?7xQJ(!El0}6%OQGw9kCJQ&8+pD^vG3Pcyn|~p%k^NreO8D_ zS3Kn8-mrxI-f0jDGFaz$AupX52_A)pJHL9(^%yHfG(d{ncJKYQX91Y?Q5vKI<8r^H z!^Mb%NW&5fa?x>`7=~Q0CFBqwG{9>WI#ZUcL-2@O3{vNL7 z-J~l1I&c4dtir6ty}!FcrVjOfGlfl_i|sIw44U5}UQ}F)YIfJV5BIsH6%LP|;wp?z zB+HTuYYX5LXY!~{ZCA(klMR#dh-}uX>_eDa9(a<@q&TJQd$<{H(3Y6mOvl~v2FgdY zH+~>Qr}&SB^Y0?67}q7_#=LIdacx=`+U~}t%aU&Kh!owKO#ckY`*UC#*yvNBO-F`M zY+tlHuRU{JdK*^vsU`T;b+eq~NnUmNx)D5iMnDYH^3?I(YfX8YFlu$#uX=74>5~sX z?n6r%jN31UvVFPHGx*qHv8#CzY-_yVKrLy;q}xNnuR#~8ReQ4K=4sUuys#1+PV>*R zu+8q;g2+J3H?N^I>X;0;jvs>!Ez?>^X-8=lF2uGCx`e_3U7@}jDH+{u%mw`vbo-Ztnl4FFZh}4KHb+UI`csgb3H*sKCL;}s*2S* zdYiels&y}o!)31dq`@qAN{W+Mh*~{{#-Ey7hu~W&2yIRV~pCNQ~F86Tj@ z{REG{X6v|}vgm2wRW-YmpCw8)JaIHT+5hU%;IDTJeILkUCKeUZ%nL09wzN)O%(oYL zJR6?%qN=vA43%V@?>3F&gJ#O&@;HCk&iwMNhzoO}!@h(IyhJny1_rQ&Xhg~OJW=;L z`i>mFz_hd*T6yI271#(;PTtj&$Q_!!RdTqv7JcODk(F1Sd_x!|p?`mN?IbI#BDsDM zGo*^|10?J{JO*b&d@N{~-ors)bg8c95KD#6gmZrvlpI2Qpxp!$Ua_~$d%Eid=2u&1 zmVLiRw*E$XP|mmvJ`$-RC4Z&WU|AI>alupLtWB@+7A4?znDps1pU_{3ZO2CnNeDHLLEhzNkgYX4Rl3*P9tX};!(I)Tj z|3rhICvS!KuF6PSfI7V-a+W{`f1cd?y9+Q!tPgf;DX!7{VWQ}4=|mFpIxe)Na7Lh2 zLW|j;hC*7rdv9r5U1)r^HXceA26V~#S`Zau*`2`GsUk3^s2wiHD49iT+I=;p5$MxU z@BIu`k#bk?Z?(y!>fP-oeWAYI?NkSm?L*r16u18|h4e^@Xm9DgPW=EFB%!IiKq0o6 zlR}Aun>hXY8{ZE1d|iqzUXe-=Mvyub`Gko7d$%`!x|_>@K$GYAoRG+-Ydym~z} zSQyVki;&-Fno+H3HWk0&lz7w3!S+?{t2OMCaqxB@r$+np1fB6rc#jftOM!qSwF%4* z^@f-NGdwj7_PS0f*^DaGc~N)*%YOpqF90^zT(+QxmxkBi@0&Dv-N_HC;8+9VRJy8i z8Mt@uK%*VqcK^ugmOz=Hj99J8$w6j zLgq1VuQiCbv!MP8DfqzB+pgl2Ev_1i!8wNy#JsjV>-ql9O7QLQUfsxYcW5tar0R`| zpUmwRh4v?)JBh*P1FY%^;$fAIx|gtv>1*NGe;2>;2N))qOaTLUVIr~6hy;-|W+%=i z)5jtbz5C`9G}Oy5Vf=Ji>%54W3Hqq!1A6_0zj+RRFfB>TY&Raj=|mA=1xELB-b3$s z-^hS#poz3YBYPHd`8fS}4^HbHDjL5-g8-1LANsmE5$NoMbHc8T2h#sMvRoJq=}(aD z`8%DdNZ6dLwd_VgfuHw*vXiIY80{(02+Au6`;&JJM6MR^Twbb>OiU= zj8Yr#_g=Pj{CU%33hl((AHc%-fDxXpI)LLtdYLY#?T-DX8UsCYU=C~Pm0Hs(>FWrj zYX(E#S3o46I1(h`y(dagjC)I~98R6KyCG3mw)6%B1z4%l`T#!`Y{;Ea9{)B{ajWI_ zv0@asGW!`2DkiyR@YzOh5F#?mq{coA$JAJI1yKI@gihR&>c_i{7P97|nO~o*0&D0= zp~asE;RI)oK^J&}D>u(33#$CbBuZ9ylW_MhS?{g3m(zRZ6t8rWL<^(rd0g%iU}Yu) z$USG2;XHI3yHYC)DtGKggy@0Rzq@4ur#}>#du+c^+&+7<6}FyM)1izVJcl~`v2D&N z8`Lj-7vUzmoFTgJ6B5!d`eX$t3GlSG$J48*z1Yt2B+=;I?Dg;6r}LeYx3Jowu?|e) z4uMEAc#;$TZ{Fv&YF^}z4u)1Nzd$Ax`WiC4MAzSyxTsVJs4$NL3L&rd31H<|LN$ik zpA$Q$VWfRFSug*+m;-0yte94I(M!UGgQg-WLFqDdQ$*wQ1j;l{@F%$GV#nvKVaDfd z>f$!_&|qig)L&`e7&R?#?977#>v1YorNyKX6~6^FKaW4AtwU<2Fz=mQ#R-% zY-hxWQWSp;JP_y@HMWTv5fO=Otch z9#o{*4Ows}yw^%U#vJOD>;}4Slv?t!L$|DI-F)9TYw_COV~Z%sfn$aTyrK9Nw|hj+ z0RmAOSf)Pn8t};-qH@T-s0gb=qq*45n?#U{Gl;+Qun;ax}{xYD0MTP71 zRVIISvmg%HY#O-MlVFwq1zM}r0vNlsb*wYi_r-->%r%_#Y&D$G`h=#O#}MvUZ;W3& zh~8m44ZGO)F+8|*0$m5@!T~Sc)Bx{bk!9xWt2D;JwRFd)-lvHjTA`(g_r&gAE7qVj zB0Q|I%l?*c+(qAb?iitkiVYV22f~w&75>yhQ*@EBJ!kLRgedIkKLsF2wz3{JhlnJ& zh_hGw#?}0fcDWGyfKLxRIa`YE!H&$JqCjM1kSnRiY$)ni1zbUz4SQl>E$~){D`*Cw zBu*khy0AmgcIyDG*|}&}*1<{JsVM&y5$pkTczO))4rY=lBi!uJby1=kxeY(ZWuamJ z1MiCv@&{Cb2r=CL=M_bYpB_JN??Pt$nT}|%?a~dwG74ffkA+UKAafulYfwkNeKz4; zF@JtWzFJ!uxs@@A<}c14GS;uzvJ+tHLf2nY1QglOy6|5rVCt0wd*Xbr2GG;ADHv_P zo@p4qtubjxVrdci7*cwG3j%lL<%0i~P@%bKw)E_1urB7!w2hwi!MIMls+jTNifOr9 zhBNU$!SV|?f?tZMEZ)>%W0Ai*ifpALquvYemae?~4(`xJ04L|xY_m7DuKPn4FXI2~ z)&aubNu4i#MJaZO4ha7Fz?gfem0^m;6++VxrtdH&F@wFU!wD8(Wus3BEPy;cPtAyr zKr=DtRMEH?jdGN>&F{)@>t*Dtym1Hf4~P#xHa?|GVqW$H@9Wh8 zGd1KK8UQJ<=ZKm84otg?Dvk5ThQ;U5;k2f3vPrCx1yZO<`0#TlvP8v@k6T))8JFiR zP9giWXH8+`86Jl;FpI2fY*6I*1kz$(St_kq#l>wte*wT4G&}HVd&F^so3Ura2JN_P zjHcLLmW-Z)!qDoKL~hiE_xCD&VE)&|)4jmOu^Q9Ay1nIB&cxP@7dKMAxVz92^_+Dk zV4w3IPSGQpu#j@YxZ=?#OzsYbDe3Qi)dSFs%jJ+Nu+Mre5DD{iOncr1tN|xq+y$Qf z7256F=BB0w7zLq`y9>AvAQN>fTNk|6MtL55ed-OEg#;=p_Vc% z%$y;P{Kp*d1+3LF@S0>gG+hl~-7$5?st-qjt$RJ30fX?{yNGf*nfSo0dIgmti5Cx` zEe~o?l+oTBmg>pL&tLf}I7 zSQzPG)g>9qxT-cE)f7}UX%YF&Cpw4iGSgy+hc_LFAI%CZbnHm%1B_!G#6(uIlIFOG zBS5F3bu(>C%x|Uah``>F8JCG%-`BOz$#cj(4tb zXEW2zODf4{E8=0#P~0!4wgnL-aLPE%pO;}@++O0r3dq3=yvQx+5bQWDzv@H>#O?m_+u8c8zG*g@=qeWKmbBCF9Hxlmg{<#v1r~1U+$hTEF5-;}Zg@vyt zcu=WQn?dJm0*QTtaJ;jIPFpPb$EjP2J#KhGVi?*uj&eXgpCo1E;7Ht-+tD4tOC*iu z2(sT#3Ny?~N4Gy0aWU{Zo$1`n59s^V@Fd=_?eARIa&37(J&CCZ_(D@Ape|jIP5{A6 zhPYz(804!S;}l-tImhp8w6x3Q*LHt)XZ>Qu|3t9K;jZ$9fdeL%;6exWyC`4N`7f&k_M|zs?Si$QS}tq!&=|Nk+}Vy zZWg9)>gxi%O26u^Dv@HDXzAsagbDE+wNvp<^lj=Z1?hNJh5O`HYz4ffY6swvK@f&_ z8McS_cB8-_C_F7K6yUTUBApKdV1<;s#ov!{0>R`UCz!HelEamK9*T@AIgInLI!S{c zFge{5Z3F2B#F-v%4@wC-OwLNfy#6jjG*fX+6|ttdWDw(yL=o!7Ym9>HwhQB+RiHW@ zWMdOS6q5A(FafTK8^rTbp~yqox6pF8YLc}?*Y8NSDI*=-73K8L?0NEY1`u$-xpBY; zrbYO)YON-7b4y$yjc@~4g@F(OHtLE7Cb{aNJL#S5XVZD(vX~#d4~)EXa-KFjDx|W| zw3?!2?j;?RMrYovG7LzV4@fuQj3>alu$A}|C&mq5kG2i`?dK)$?~D!2j6rA9iQxu` zHQgpfB!g3GN@!&4A~l|GjM$UA-p#GPBy%@__p{4{R`w4HZ#RBCqTj9om7(f0D*5qsA_6Jp_MO@@p9oe-o<4mK zSAdZ$RSgbJFuaq8hB%`E9rLRLg*>0NgeBr?8l=dLr8H{Mh!@WKO(M-~JEDfJ}ySl92b z*BOI9;iaX&kI6{MkY&|uM?}5lR*&~Q>><~+%N|1u?034vIM$!8@4MGu4gxLHuL)iM zIFE{_dP6Jy_X&WebIY|dXm*xdu;a$BI;$1ZnQnoDPM50Pr2@!k-+<7kk9nZO_rG`O z+*c}GYZ*#!eN)tc-Gki$QE!VB-}F?$dJHJOE}8;E{Xd}Be?|+>!y&2+YYL4D9m!n1 zzt=Be=+EpE78W)J5;j|d>uGmC+2et03qf@1!pS81uUiehHQXPrQ{k2PJ2qtl=FwEjaGNb2L!=XienVT(S}#Xc=I_31T9^Vw(RmSnjPov^z!U#%WH{>!S%h zH=o;a=YeM28$Z=;QWSiQWMoO2=c-v+=+Zv=J$?`G03L(R5PkfUX%)cqJM_a`?AKPo zi-XmJK<+1ZiF{@69ea^|gwO#nFs;JI27`P465Q97$$b79PHXL0$EmnO7hcvFn&^9n z3h@>g-)hp_V%kkdbPrP|)0Ml;KQ8uWW0d?5ggH!KqyELarN16>6Y>~|YeeRl1MxoLMXpTS- zs59?GGArgcXjTz3IRs<=RcEZ5kOjyF|1cUUhj<>V+^-=>7ftZ;)-$g6)~7annwg&c zZxjXG$`Y6bK_p*(pwipGZ--7LQQW1KvsDyRbFPfS;%`LtOuJSX;HeEzKvuOWjm8CY za}~ooo>JTU+qtUbP~voW9Jy|jHuS$%4YEJ0_!M7V#F;&awLZZ~7imfc>6EMol|C~3 zcXhCTz}cZm@4G=MH4Q`L9?yPItP@Xaw3KtG#>RnIee?IitH1@g>-g;!P*c(G-F6F` zO_~3fTmobT*%(?WsC4q5=c8`N<`cMOY4Q?+1GjAOBWGB+&bR7xLx*(0ZGV8I#c28j zF^M9oO*FD4I=DChdXVe+#07JT<)>&;@aA+ zSc1tvfY~`Z-qpN&v9dq&m<70X!40dbxBE7a{om*LT|$iEw$HLN?pbPL%@!AFF-uE^ zn8f{JQ$&$X!}Zs^TK4Q}5Jgln{?8mDnZbs+l@VWm90UJJtuRyc<6?Cn`;4$O%MrO6 z0tjFP8Q_p!WO&Op9G&}HYt2cA^Y#?Fe+UhOYo%2|goS`>pH}qAzGG%AG2Df#d<3(} zWfW81bV= z!%J#6N&tNU&M_m14^!&NSP>h9>7O~kxjhG0h=FaPzU@ldkWTYx3|;=kO9U~s0SdER@%mdgDQXW}-s)De9-BOjzV-q%BKdZ!#e zFmNY)l4fq+xGG{>&xe8nQu@~FK%#N@?y&F$%L;)MfYh`hcfi-&jRSf$UeF8m6!Fl~ zCed8ihziIU;h<}Jhx@7c!4b?#gB09W$iBt)iA^HppSrUaSsueGX>3yTCa}QnBg>DO z!u=b8H4ISlijn4kFljFkuVpt(KC03`ahD1H&$h(*_8yzOMr;ts%ao>bPf*E}I#y9t zB*Hy#W-ZI4<E&{|~B*v2G7oKhZooza9@GK|@#))R%0?q`z8nT2qufzJ| z*diGqS~p=ZdSPN~^9+~cF_4}8R}7ou(rSahM1p2px2nc52W9`YD|F=GL3-{g_i&;) zw~EM{4*ieMOB24H>);yrmyU%0&Kp!S27dd3zM`7Sru)nNe{n@T$EP5sVx-Q910V_* z0MgDB?NVTq*3!im{>6QjH^)WH>hdSX-dMPMr?c7_vSizVy_(~^X|AfqDcAL{m?7#3 zBE4?tO@OrReV%0gqHPvUg+xw{Hv-)+D#w2~Tiiyt($Zh&k*5z|pui@&u@YuV|Bf-3 z1xE@LXyR`CZ10Mz>ZCER-T0OE+ZQl*Ng#4?bJ@<$OY}7xKhO_H>8yE!srFCruc@mX z2^!Q$YwQ>a475|uF}{a;Qrcqw7iGZVBH3zN_kSn>5EdQSLN}63b1KeGEMh=`8O>Yk6T~srRDHXP=a)7P}rOJLKCtYn|u7vR;(S&V|C~hE?IZzf*W~%xuEqYMwf!N>dLGQWtxJ83=^!6U=g@H z(Njd6<{ETep@(bDI%QETkfp#m<^U>l5lt?N5WxXsz85rWM=i~omI0Fi=#oV85RGpbm;+=XTPp(M-1{7npK7^ z+`&|s7kk{n`5OA61a$;oM~E)=_HEKCSQ0@_Y5AaM%BHAwXYWKyP0ZHX45$C1bt=s3 zOGE)Dtb3qx*UuU2jU$K%NvLg*nIMBF1D!MRm{hh?jrTiwZqL}rQ|sENMqeVugYd`B zg!ncOzleK1O-+I=yC~rSl=WiQ#p7;!wbAFkigmFo=X85LhKvClv0w)ioCqON&okHFK~Q`i8$A+y;+@(r=dwVclX?gPvC90Bd7e2|9R$rFaE#wk5qq{ zG~swUgqeXV7NGsV66gX${q+5yH^awxxCX4~vGTnDhP6NdaJ(UnGy3nBN3#K(LCre~ z%KjICAZ4xfDY{Awgpg`r%YFI>B_+Rx>U{Xv_`mKththNlY*hua@POO_($uk?pw?Cv z%?PKv1AKBmKOr4%zdd<|+gB0Z;Fuaa_7D@5dORxLE!{JM`X_xFGj1$%DG;=uJs1yC zONcm}kluuUx}?C+0oE}ZENZMKo|p3wq>e#-0La%G+HO|X$5DdHSr5dohQX%8fMp(Z zUioR%R0ZcIT^A!f^(vw?fR6-AbX!KCX6!Qbgc{Ubk>lnTa8>Fg;O|0K?E5&C?H9Ks z5&YcE$L=ub5IjT(@LM~o9sB{cRR;iDwSoiAMX{XBWOh4a@B79- zQ_E>urKSc~>Ihj&IqHKNY*V6i=7uLKrQaBw9&(4-#qTV zpa{4NE>qglgPq!OU;1v3>Z$n!D@X@(fs7mS-{KgoRD+vT8$YPu-SybhhUC>3j;*;1 z1L2MY0|vVlz}r%#5PbIpwQ7O?nf(NQJDaH4Inr3oQS?}f9ZVjCxjU=i0vB^S9tLcF zh(~?x0@@j@3oW9_^D!|#;w`StYbxyv*gy<6`@iH5{8sK-?Qkpx&5~SIX-x?x;|%0W zUL>ZTRiA$V>KNVyQ|2&|M_Eo_?P+6A?iw_-zrXoi%&KyhgAbMW07 z&cQPO-3#D10z~BRydOMjz>1lN$>==*K5r1s&ji+5hz;PaODby#20h2p2C@B4Q9XMG2k1P>nRC~iFy zB4}EVDX`7D`jWZV-@&%_V>GhrLNR)EN^SjI(&D*BjWEIPJo4!$ud3--8;)v;L1L|X zcx@_0(geZl5}MpujqKdLXKA_IXn~EcU&t5(;Ds8go!$-`jXka|q~3Z{PWvP7!gg%@ zT+^7JY5Bq4*!UBt^0$uLn<7CLFPp`A#L>509b z?B2eJP2z5_U~kYYi@_YVKOfWaF^@<+vAI8#WCUjQ{%-Av)tF~}j!5X`v=%9e-ZEdM6B2i&BwEI5B{V5&b zX?jCeP5X$JI>0w+rt^VN_$9;!UixQO+n1FlzN&n-+js>D-jmA>N4oLHr{{+~uDb^E zYfj^fcONU*x?eQRdokd2JT6HT6L~Ak3r0b2gSD# zgF^O;JcXXfH;yfj>(n2o3L}2y?w?><4BgB7WsGzXCvy&q8%?bky9rQKv4JVa9l;(X zi^uV#5fAk`J8#Dx@z7$=^=UG4HRj0?II>)fn0eLEeW=?QiRWzsqSg1RBSA7~_4v;oYf^=oK0~+zLlbR!!2hr3Ex3s8x znqqApCK%ch$pm7zMg;J16js(L|_;hhuWF7slZjEQS7NjWFT^diqMjX<;WLg=94aC0KH}gLApBc zz~%$6mg{%qcH%RX-E7V)ifp%S`^Nj+?e13zYwm1X|DX20JD%$Hjla&9vMM7~X33s~ zc>vN8t=lT8j`}g;HJ^j_| z_>B8=-Pe8H*Lc6Ln-0bSCv*TTck0!v#6+GV?<>y? zekEZ{@(ms21-2KIHQC=;x{Bry<7Pa78E_f%SFfNP@^e3({6>v6K!U0A>{>@(&#R;T zPFH&)lrm8KZ=V@GKU3qH@r5c?nNv9P@iP&R5j!f0N}?n#B9izduxf+pteiPM@O$kX z0dZd?QP`1_A!=B&&f~{A0LL$;@oD+7QW2efeC^MMs7$L$e-$Uh(K-i{!tT9cpsaKG z;h^nhDx4Sm?UD8&njp5KF4k2dcWBqE*jnZUX3 z`^dfs?6$=L+f?I@1z3XyoOzi~vnc@nQYgLmQ&qhw)&Y{s2_0kjhAnb_q^|;GMj%lt zg?q}C&8VJXadI)+5Mi6l(w4iCsmjVI3;J_%KJC7((<1hv{gbEXlxM4KT-0yQ#MCu`|a?aeT8N9kB|@M-jypc01JE_D=voX2y@bbAGN z&ls^hg|zUwcg0qVV*;W|ul{7Jop4yCP68a{IWDo&)B4|wwT4&QJu}w(ySUB7<7ypq ze*EQpD(hw243Rpt2=moEK0Xl+<>V8FB|hzqc%-`ANXEk@7HB$cQs&^wON5pxFRSqO zdz=VHRKcyp$qxT{ra*efDdOG)w#sbiuW__ zL*4R=u$V^VAtDYHDjbHD+4lAq!|bU++`k}E)Kumc&(OQ3Q>h~M2CzQ{9SDX#)K8QO$UC?~zyRXT z(8^)_$OiT#18CZXSv}*eynp|SRRs7dRVmVdA^4yD&6mEsfy)u2qYx<#B$M8 z4tv4&qdF-wS#GJ!Pi%NOuFNGW`7eD-##&BG&LU-j7swQMSqi((bO%fq-CQ*vP}W9b z8sInXP5VTs*=RC4fw3UpIpT6xAn=Kk?~fDnM%G=)*cNicOp|C1g9>rm*MI5+q;8nM zLcjta-o{)tXyto&@lY^BxrMc-oAATjye6Mt{7?;?tDKD0zD$K=S$DyiUWI2z)LL>y zWqNLClhCCOneEf<>6!Sg$C?wE+KFpYst*2<>|Q0bLsaFHvzHJz`Oowk7G<=%7W`lo z0;ww;R%b}l9i!WxXHaC|bQgG}I{x(8$fdd=9Nj%BTyt4p5}t_z4Gi%N*O zT^>}|L_d`AZ`~%68suWT?C0NAqEEIlV>Ue=47{FyQRP?KIRFw@I6`c1^{vz&URV^>{8cX(252yJNiLf}uvOo(TTYD=C4(n{1 z9wpyww91EtJI&joZe*uf}ep_lY{92xJ!GRT=ZoyHO5v4qRmcK~xk(XgT8gyzDJ_4KKsisAwS^ z{M9-f$I0dEtDe{5$vf`t&T#Fw~in zb>~Ob2mu*2C>4*dL&GZQ^xB*ae&;#1u-mhB)T;}7F#}`|9x;8G7+Db@`^|Jgrh4Of z6mRX_Q>hBxvIBFyB{mC9cX^O}b}On{Ypb_Tml?juQhnrhIJrMaU;2tM+uhgF2h-(P zE7z3K3zOd&AU(o#q(08ACQ=Z+V`JX2dX+o%=Lux{^7V{aohqF?cKmQy`n_(-^v8uY zQv-to=HZne6f-^zWhBfW=<*LNxEy8s8%;lQuyrJL$643s%m%|Nb);f<1m><@di

j?(uvAoJz5HrVlgu07L?Tt}6q z|d9E+-oU!KR;*g-`K~iJwJhD6w>TKjpe83 z-`26&`t6OO_nSm*`?_)<425ACl;N`9+V(ZYIhpd7xs~H>aAHQRQ|O7v0a2rU^nTPb z)VxwM9fZbhX~Kl+kqB>_8-#H3uIdEGj+(sy$a9?%3N=TV2awqnfXuG*MUSjcd7jYO zXguNLrk3vpr)4I`IQX~$+GFxqx8naM9uVfjy#hyiT#q4z34O` z)od#FG+-9{h#vcwORV40jR)#N$l@)uhDjm6?Nd?V#d|7Bjl-&*T%?*(*LzO==gp0W zUwu)7%z!GY&%~!~V(#6l-H*!9*POT+z;an|D+mkio;o%FzaN$)IPHOd&mn%FPp8|$ z>-XkLi&?Ht%_phYs+{|ACY-oIC; z_g`5r8b=v6#xn9h9XCt2ll--=MBD>-GxOzm<9C=2el2f#)MZao|cwMn28Q1 z&juP4)cuaS&~LXw+=Nw;P54T4ahrb0x89FBv3^F6XPlWGr7>T~jp{zxOFug)zo>M# zn;8=+a#fFMh~;TF#!~_wgEnyMB5WN@c1nb*35E%_#gcN*zV70yc|k4}s^J|cKSRsJ zYk0}R8Rc8G9b_H3VFhYoTG-3=WK;A#1Ljz4PW_XMTlBGhmEn08UBsz>KKj~pMJDN~ zY#Rod8nFV<-l`CsOm&7&zp>Gr`q=W+c}5{9#b#!L`Kz1Tmo^F=zMa^-?onTlyM3^< za!C8xg^Z5xXqLR?%KxblH|s?xqBm!Bzp&|~Dzh8_Dn_!O<&3loPn#2%|Iz+ID{6}B zew5*U<8tBfAi*J@rD845sVudu%C~tp-}IUhEA%c1NcEhkSNZ|Vz>}QKNvqfFYN)IF zkdIcRe3(nPYT!2iVs%R?O%SCr(WhN&{5`f~S=qRyV6pEhdz{Y2S6(jI_x|09uW-m` zwIQ_Ql_ix*^V2euef546z;$xHln2{6(z9-gS8&Mc$4JHsm6xzaH0+IbWw`Oqo90HZ zX!0waoK~5Ebni^X4fd>ZD zexyPs%E2n=c;YnG;jX@$J}&Rjtr0CwXGOnu-I=reo%fBgf=D#lWpgd|o|x+x5qFrA z%UHZVZ3itD+Y~UxzYxyE=CN!QG7;LG_jb&I9SvovWkvdZ5*bRoYLm@JuyrtA1TsSJ zk5eSir)vMjA3M3}yu!?+qwi-p27;AD~loH%NF`+O`!i%Xrx?0ep| zh_P=wM$)sA*d;Q@p;~v})$uG>c;u`1l70g#<>Xfrk#)8~4wS`HFQsy7thwoPw5{_> zV-iJjgbpUL^1tQKW?t8oMqB~T|z<81S%^h~Qr zHoIE47m??^4SPjcpgBS#d3?h&!g1R)VV6cS_2>vPew>wZNfmKYZKM%W9N}W|Bz4b&X6>G(=Zo?S9Ws&*T{hzT9)d#L;>s9^3b_WN+FdrnlP=G##!MEIRYB} z^$ytkNC5K$K=Wl}UWR8*>M=GRh>v4xaQs!cn5gy*#JDie9Rgq7c%u z_Ueex&oK0TD|BL6L_JN6%JXaoi3Y_DF@-RtRmlO0@_ziD+!K`7PR={{@ph^e&Narl z`G`;Prvn04=$mZ&)^iDeECZXQ8rSjytM5S~9!Lb1{LS?EV&q&nvN2|LPl3G0w@uox z>(oxBlo?Z%fXOccY-xFqhBk89txxW1ZNc%Ex+BJVKTKV)M7 z82Q?DsG>}-bNC`1b&yYMV}mc7TZ(&P#cdrjjlB~H*^V%jE(gsoi}g~VcLhmriCKV0 zPD?I8eN~!RtN`tw1EYSk=8%fJ0Ng}mX^TYwFNmu()2f^UxY~)K@2iP|Bb64s&VeGb zY-b`AOwP8)weFj?Cj9%0*0y+b3vzLV>wNXsNeF1-J^vt);A*i9rDNX%Y;0{BGWvsh za{3NkCghb>Mw|V8b|KhD30Nsa-xWUT7o)lc?)4f^-5%q*q}V!uMnAdYjKsr#zE=yr z*UGyx4OyJS7Ql_Ua$zbcc+PGR?J0Q)Og}KfUBl9s|26uPdnx6|iHKQRX+ihGH!Q({ zfh&1JR>p{%obVM&J^wu251!uQla8E;sg&l8d2wi;Uw)u@5FM!Zx4A4OqR2^CGa(gD zJ=ZwoZZKl5PgwkTmfvr?6WWdJHqM?yhPONBHTB^JHG=OhP?F*bkPq_@${rErqkHdY zbP^IeXE<;)4lPO$EW)Vm%@D|Qry*aek}9e(zy0)7^S*P@ZBDet?L_H&AlA1#faTQ7 z)gf8-PmRqShMT8KGaf<9ZRCw`U{>tJx`J#LB<6hv1<#56XN?quM1p0U}&-K zUFd^-`U7%Kf8V0S08^-)BS37%^os$wei3KoTSN+TH{`b1WB;&wh}X*?n6sz(9S9Jc z)}*4gbN_8Q3gGX=&tdoeYvTUZzzE*tM*c4uKSA$u@`)3*4R4<%a0wGTZJeP5 z3m6Lg#iXTN?dIGpVUV!e)F3qYz5CCcaJD6YQM4&WdUfo90%phOGAW}orz6~sRO8KC zCC>a)m%-<#BFFVMfR~yvRu4S*Eb~ug4+z z3it&`L=Bnv)uYOdEJw-@CHLLP08dQQB{mXdX5rXiO@6uZ$dm6zLU zW8l_fvQ8Y`?xU>{bk);IRw9yx3{NE&B=+&fXg^fOMPg2UMQGH26s{QhJ{4GQr%NKg zLCPp;RP~7lj&?2#+6&}+hyUxu?~nTMX{0C|KFtcD#l8ZYx`3@W#=A!VDO1{jpi@`E zw+lBWj?@W>vlxgQIV?a;L>mE7Ex0;8c9570luF7+EZgp2egWjB39G0=%(pi&5!d$h z-e&u>ov!(@51-2p)Cv%ljCezBF=7ZF^pcXh7TiGNd#HgU6!hiYPAzDNbK_o?>G4P; zrl*iMJc@@YwA$t;a)WroYP7AI|dwaF|0b*&zf4Q@_*Kr(B=^yQ|m*Pec*{*LYmlvum?3jIgc@SWDj zVbloO3z?`Tqg^2$`Hh{S0b-;_CO&262R*`pB?$%d1aYXVZc7kZzo%){1&8n^y&pMa z7L|dTxcaSivo_!#`B6w9%jF@~fM`!@Q^^es3WTcH7n4l4ieV2jSw9n=Ptr_8;s7Rv zDoV%2J|bdjka<`A1`qwrpgH7>*hXo_>gPBoRQH;5&n=@In&pN|ABDJiyr{z&lK zY36^6?_<^Koqw!9^xUBL*BT`@-S~f!9;}*@OfCtcHTCCvWK@kSdL8ZXlc;;yMU=!B zlC;SHR^pS-1vijEP2j-ijDxLP=2d8H?D!QZpw;!B_Wfx zG=_mOR0@;6dDeiSn=-rqkIWzw2AZ+ki~{iVHOPkClxZcoamHEU*w;hZ=l{8K8-O0u zms7)$-d1FNLeMn$)fDevY<>$zAHgmNU-f2b^1`=&%TRVvV?&S~Ie#Nvp68sx4vH4u!#N<{)9 z#WY!vd1X;iRAuL|Q)zLo!l9Z}ll7HE3jmt@nI(54fR2GBCB8B(0`YQQTdbeCv-ur= zD8}DKZoHW2t|9|U>q1GH4a!99-pqrNYKmB}$#uA9u47IVs0`KQ0`Vk5ifaOTTQLsS z?@#E}DCx6yUCyD0#-wdcMaK2S`Cdo1lZLJ<`@z^>p>dVO?osQ~z2ZrbW_5ni1Bqy` zLrJxrDG>w8^uRI#l<9DEzwPR+4U%fyBySKL${%<;H%HF1maJ5BiVTw2(F; z^i__e>o1@j4x5_>igy;xD%eXVf5^mxv-k&hNfN{ps3w$cDYTIeixo>zN_5NT3r?O( zJ2+!`x3yuBOmpgH+8YU?n~c1~`YB9&(^q4pFCHKt4TnDsmHkMMvXieWY0OelL@V~X zxok=x2UC;Aq(lu9Z`MYMgh}w*b^0|gTfxKi1>$V|bGPTh0uam{#OJEBopw`nqy4ED^OH}#d5Nv`4K24gW9`1;S*Ap^aW zpkdJ0K;pom49gol^gvN@r!(NMEj`23u*ySWf89B;5AxvLdQT&5^}kLLBZj-M@`aNv z5Kac@?iGx#ajCNYR-e0Y6WlI>hD4i(GhPmKi75@2GDeQ6rw{@p zq+9xc0BNC6)58uOxA3{Ffa%i6kKCig2-jo4@0)~KlemaJj^R;pklJ^0;f#eF9BH~)M(l=sZV%BPMoK|>1r@_qHlNRm*xJJpOVJLO3c zHJM#dPhR~#A0r=l9vIJEprhXS{rINywGsFWG6qMGxpR*O7Xyl5gq&M(uCjd|iQ2bn zPmn2C_EJIAb|Tlzoo$ubB6aEpZH}tX4T^I#;}ioyJt@_*Emg7ON&&>Z>j_dIxv(wL zH5ey)YwW{hhiMj2MTE@$Syt_a*eE4x@-t>VJleTxX|j~K{4cVmx;1=6B)%gUFD#w- z^z+>L*DMQ$mlHT~Eb>_pxd~~2>uLn%sM^ec`chI^t%u!vY_6!KxL0;rwv#>GnQYlw zJV^lqVATvxiwjr7L2FTM7AikIAx*Mq%B08vIMwPtvODWNRum~B z&uzJwCL85hdHv%w%>_Z`7iup_cmG-UR-w`|N0&~!o`uN-906~zZbl-oMH99uErj&E z#(Au%u1fUbq?uB^G$CzKQaz*dtMVdmNCQ&u<^UmVPmHf;uo@0lNFVx+Uh{Vg+Nq6$ zb%$Yx-mI?~D_$r19jZ8YFP!Nfwd2v=8vCV<=_HHQ!GfA$9<3RZUzHkENDs1GwO`>; z7h{)~ZrvEQ9X}B)-bb)Vl0^3ICZhW%B&AG;HdkGq`f>sCFDcyP1YPT)2f_rTI2)<1_N^8ood}Nx`XCq^b2Md)2g^Gy8@z(@>wV zJ*+zH?BAs57>Hvo*sLhMd1~EaiSo*xJuEXC=g(dml(ZohAsb+DM}1uL(%GCjy3O#< zsj#`0QFsw5b9tn^ISh>$(ph2$v8P-x{L!k56R|HX4XVlUC| z4zL^meG6~?b{&R8Yaa&Qv+PDXOWwrTmL~T5H3=GU7Y3ESX~JKHOoy#E#Q>14<$8Cj zQrLaq``DpDiWxmZ)^sJfW<~W_Hpk`7Y^KrnO%9}!Du}5Q5=YwOU8}e#SxUr;0s~v8 z)G`B%c_9sw0pR=05wBk&BThRpm9s;+4TyppN0>jEG^O$WI(VFWv18fN-=YHB&wEz6 z02}mT5E&r`Mo2A_F0Rcd6W9(7C;)>YWl$h)mlO&NBxj=8*7mKMxt>##ff{7(3Vwh) zrpl|PI+b#xc%I<%smeE~dvMlJ-7|i-3E)GJqWJse#lpyz`<{KKhRdUCI{A%mx++@; z=c|bvu>pfRUo6;Db(0u!a`U6)WY}JowX?>=*wL$dj^QFHyS?6&cAB>@|5lU9D*$K# z?Z>kaorPIhSkN?vV{_9JJL-oByp0R`i4mcWdPvRn7oB>B8U)4Z6g8s^kJXt@=v|9` zrOvgy!*+&aR^-D4Ze!}qF6U0Jc1!e^6$wqjfoDJ?2XR9A6Ug#(`SD>{e|h{`Gmv_# zRI^%Ft>zx!$3qQ$I351pj~x!aacd>NkvJ0!U8r8nO5YH7zd!Dk*f~F!k?;|_a#gV6 z?Vg6Pz>JottJ`8HAk75I9s+JR6AgZQ>UBAsUJF>U*=xmCRf}_{2If)|Pr$5GYVV}D<`(#AgSnOz^J3(@Rr&9QgKWXP@(UfaU1_rTy@?3^SdPr~ zCtWBX6Hg&MbAzwv>%u7}llGHE%sL%5k~IzfVaMweRkIL81{{WkxCN_dlS2-7-b6qz zNQcNm{f|zUx+)VIGwQ4FX}nnC+gMyk)ipktXSQ+BeuJ6+zVTz0;}7Sqol?Wwq71i! z>qvb7#*j&2DD(+?LDv2Ahh)^cR?Bqlr(B1Ckq@>HO85?r3}8+bF*5|(`tpDBVNYCz zpeCXg`ryi$?hml)QuV#TTL`Af|t>V9R39^=Bkvy7K(f|5&*;f6#B#;uD7b-j>{ppXJ=unOO} zv04SiWE1n-F5mQZ+p3FOqib3k6)jbp^Da@>*ZK6(cGIU%XkulvGs7a3@=>Yz&fx1W zscbD;oI7lM05y4PcEAmV{wT2%{A2bvv*CsLZFV2^?gNu_O}WxL?yFYY7MD(8m=#!f z6^6*IZ~n2l=8gqgit}66P7;~S6qK_2dw41K*?{T zJ38@mc0CRs+O6HVsuceEywhHeUU5&+ue`3F$REv^yY`|nDVSx*8(npLph-U|KPg}< zxTfs|_O_J_dRBnu@I4wc6mHazXC-T4Udz0|wFDtT zGS%UoROzgFq6hv3`szugUJj1(_9?0f5=ElZWT3HRLU3v~^eYiw^C{zQ)X??}ImU|m zL!--~(x?D!PG7{V=4eA==gjA4j9!o!p$qtuYd0ujf!r_nXh$1tAhG>Th#E}_8Ce6$ z_DBqApf|yIc5(N%-jGx6Y(+C8Zn^?f!mAnQliwOo<*L~xR>B%;P=LLMpa6@*t z;7~8l-TVhm02+6ocOf1W79vp5HcGZx?gl)GgDClft36HSn3|GvDs7( zz!D3rTG4S&c+MU25TPZdHPulL)y2?JqTNI%EQ(sS}tR?-O?n4ysJL0dPcDzw@H!-rS%(XEL4{9Z{e>lGXhJ&onKIS(vD*^HKCC1+I<|uVE=)ch^I?S33kh zEv_^Vw@P2O-Xfe^A6e({F9RCzB+!5Z*oxczkgi3DBdGx^iRb3#C2xJ#Wqu3j!v%&? zlKk10{Pw2xT(Q#)+nOYO|6ZS>J*^an>syaU7?qN;x%-eBuF|Y+^hh|PAb#aF0U;M- zu!u`}I%ZQKlRfBJOBk(CVn>Du!6nDlceQky9Qc|T6^O-!mEVfqd_2k-I)%cCZVT(c zCt4W)?MBX4g!PEpV7wF(f~7_dGWD6H2~|gBEJiwjQG*9$!;2GRW^LY1KF<HX?Vu~&taunvtHx(T< znMEg0G?0v(!r`^X6@9)&4csBc1y2t0hcg75f>o}uxP^;?+xHCNAaF1{5+JOsb~_6X zef<6QqnKz9W@;oaAx@q7mvPgNBwDb*7qIr)Jt2=w|n!@uR$Bl8P=BlKr-XdhoQe z=*^;t$tFM<^weiNAtY%EAtgxJV9vLok}LJ zLvu=a#Rgv`RB5CKFR(`vmPrA;VWlZ()7Y;~=~DH`G;WZ0)G*NhwOr|4^kG5Zu`Ts_Tx^1|J_K_4;l@fF3!ex0^00|x*a!(C^e_qHC@3P#3!MtbF z#!lReyO|`2TOhg6!{2*G!$7n@pAl&*=SZi1Kbe-j+u(_Eh47;m@~Epmm4_Bxwy}Eo zTWSeg)t{v_qmk91G>zOlr1Dg9UgG6AwfS{6K~@;X*ON#hQY3rHQ#*@4y9xDz+BPAq ztO=K3+#f#QFWv6kQdPBKC;>8>$N?Ft$>w)9>uBIUF_+HjG^Qht76PPgKFz(1cFA_n z^40`jx7QJi!EA!?vt$0QRIaa|3`c-e$l+~>3y)t6iQWNS`)=AQB z9ddls*qN}tml~(W^@ZDIf95sZZ=HR+8a;HuI{HF}fzo z@aVhVVxQoqDC)}}JcUx6Vu#Lc$I&9q1fXFU%x8&ZXI*F(WoW9LiDxvvuA2EY{7Hn~ zcVpOZ%jbJixWWor7tmoZPe;y|eKgY5y`@@*mQyHu_}S^O>32kyVl`llw?Z{@%sDNU zf+}8*of@dP5(f!iOe7U7LYpQIpW@}jK`3voEciy}K{Fxcd(=!l6koV$ThqNnvhMbG zytO4MrZCdv%Wwa3sULx(ZabVV04GmPhFG^%RBTs!F#30>F%&{F>2@66g*<*(bS%H~ zsu{+s3<5>#jEyJo)>b@yL9I}D?xkZL-6p=V1o1dfN} zKN@RPCv3b!uNchwyGq7K(TzSKnPsxQujXOv(fe}a#QKky-mvQa{#T!Z4y$vmDEDyu z?nSy+#-0rf;@vTg2qxwO+xBCY+}?5Sun;>_cN2aqEUgQj(qWHh{opxjgq$((u;aZz z7xSCLqX}QgI_#@X$Q??3+*PyZB|`YxSZdFY}6VJS+~ z=j~Dv0HYw!ptM21bMwL!4myrjuHk~CV^{0??=*`U(A16L&2p~ZDA4Sti3z~T$n!*9 z;b?gKG&PB(z*t@sNj&a`l6LIYX4_&PWb?rJUVYCOiKkw0W1hZG1nUZsBgJtjdVc76 zW_vU>ZHhVJVPAg~IU!07_R-gLmxu0Wl$^O5LwK_xcRZ%2jOR4Hu4mTtg^Q`RKtBLI@XSRpe6Qbz~O> z*gF6&#RM|rP#ipK23))vK)`bpwpy#N2`|z6P&1ekbrM-}Tfb)q-)Yy09o}c%Xd&%Q zrfN-AI!qy3i=wGL$VzunOj-3KMM~QDUOIhhb;IZ!=OxnzQ)ljPtS)l&bk} zwD*wW@7c=J46`+*r|U#6J9nr0%p|(V>%E}H$jRM|zNn6Jp}64k;nBa!yvUj-ZubBE zhv+l@Ck@y){u9D~LO=q5|1{x0A^f*H{I?4JTLu5Eg8x>*|EH?}lS;0zN1*SsxtnCn R>pk#KLq+F&zOr@5{{e@yhEo6l literal 0 HcmV?d00001 diff --git a/templates/backstage/argo-workflows/skeleton/docs/index.md b/templates/backstage/argo-workflows/skeleton/docs/index.md new file mode 100644 index 000000000..6e3003a3e --- /dev/null +++ b/templates/backstage/argo-workflows/skeleton/docs/index.md @@ -0,0 +1,9 @@ +![cnoe logo](./images/cnoe-logo.png) + +# Example Spark Application + +Thanks for trying out this demo! In this example, we deployed a simple Apache Spark job through Argo Workflows. + +To learn more about Spark Operators, check out [this link](https://github.com/kubeflow/spark-operator) + +To learn more about Argo Workflows, see [this link](https://argoproj.github.io/workflows/) diff --git a/templates/backstage/argo-workflows/skeleton/docs/spark-operator.md b/templates/backstage/argo-workflows/skeleton/docs/spark-operator.md new file mode 100644 index 000000000..c7ead4e1a --- /dev/null +++ b/templates/backstage/argo-workflows/skeleton/docs/spark-operator.md @@ -0,0 +1,86 @@ +# Kubeflow Spark Operator + +[![Go Report Card](https://goreportcard.com/badge/github.com/kubeflow/spark-operator)](https://goreportcard.com/report/github.com/kubeflow/spark-operator) + +## What is Spark Operator? + +The Kubernetes Operator for Apache Spark aims to make specifying and running [Spark](https://github.com/apache/spark) applications as easy and idiomatic as running other workloads on Kubernetes. It uses +[Kubernetes custom resources](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) for specifying, running, and surfacing status of Spark applications. + +## Overview + +For a complete reference of the custom resource definitions, please refer to the [API Definition](docs/api-docs.md). For details on its design, please refer to the [Architecture](https://www.kubeflow.org/docs/components/spark-operator/overview/#architecture). It requires Spark 2.3 and above that supports Kubernetes as a native scheduler backend. + +The Kubernetes Operator for Apache Spark currently supports the following list of features: + +* Supports Spark 2.3 and up. +* Enables declarative application specification and management of applications through custom resources. +* Automatically runs `spark-submit` on behalf of users for each `SparkApplication` eligible for submission. +* Provides native [cron](https://en.wikipedia.org/wiki/Cron) support for running scheduled applications. +* Supports customization of Spark pods beyond what Spark natively is able to do through the mutating admission webhook, e.g., mounting ConfigMaps and volumes, and setting pod affinity/anti-affinity. +* Supports automatic application re-submission for updated `SparkApplication` objects with updated specification. +* Supports automatic application restart with a configurable restart policy. +* Supports automatic retries of failed submissions with optional linear back-off. +* Supports mounting local Hadoop configuration as a Kubernetes ConfigMap automatically via `sparkctl`. +* Supports automatically staging local application dependencies to Google Cloud Storage (GCS) via `sparkctl`. +* Supports collecting and exporting application-level metrics and driver/executor metrics to Prometheus. + +## Project Status + +**Project status:** *beta* + +**Current API version:** *`v1beta2`* + +**If you are currently using the `v1beta1` version of the APIs in your manifests, please update them to use the `v1beta2` version by changing `apiVersion: "sparkoperator.k8s.io/"` to `apiVersion: "sparkoperator.k8s.io/v1beta2"`. You will also need to delete the `previous` version of the CustomResourceDefinitions named `sparkapplications.sparkoperator.k8s.io` and `scheduledsparkapplications.sparkoperator.k8s.io`, and replace them with the `v1beta2` version either by installing the latest version of the operator or by running `kubectl create -f config/crd/bases`.** + +## Prerequisites + +* Version >= 1.13 of Kubernetes to use the [`subresource` support for CustomResourceDefinitions](https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#subresources), which became beta in 1.13 and is enabled by default in 1.13 and higher. + +* Version >= 1.16 of Kubernetes to use the `MutatingWebhook` and `ValidatingWebhook` of `apiVersion: admissionregistration.k8s.io/v1`. + +## Getting Started + +For getting started with Spark operator, please refer to [Getting Started](https://www.kubeflow.org/docs/components/spark-operator/getting-started/). + +## User Guide + +For detailed user guide and API documentation, please refer to [User Guide](https://www.kubeflow.org/docs/components/spark-operator/user-guide/) and [API Specification](docs/api-docs.md). + +If you are running Spark operator on Google Kubernetes Engine (GKE) and want to use Google Cloud Storage (GCS) and/or BigQuery for reading/writing data, also refer to the [GCP guide](https://www.kubeflow.org/docs/components/spark-operator/user-guide/gcp/). + +## Version Matrix + +The following table lists the most recent few versions of the operator. + +| Operator Version | API Version | Kubernetes Version | Base Spark Version | +| ------------- | ------------- | ------------- | ------------- | +| `v1beta2-1.6.x-3.5.0` | `v1beta2` | 1.16+ | `3.5.0` | +| `v1beta2-1.5.x-3.5.0` | `v1beta2` | 1.16+ | `3.5.0` | +| `v1beta2-1.4.x-3.5.0` | `v1beta2` | 1.16+ | `3.5.0` | +| `v1beta2-1.3.x-3.1.1` | `v1beta2` | 1.16+ | `3.1.1` | +| `v1beta2-1.2.3-3.1.1` | `v1beta2` | 1.13+ | `3.1.1` | +| `v1beta2-1.2.2-3.0.0` | `v1beta2` | 1.13+ | `3.0.0` | +| `v1beta2-1.2.1-3.0.0` | `v1beta2` | 1.13+ | `3.0.0` | +| `v1beta2-1.2.0-3.0.0` | `v1beta2` | 1.13+ | `3.0.0` | +| `v1beta2-1.1.x-2.4.5` | `v1beta2` | 1.13+ | `2.4.5` | +| `v1beta2-1.0.x-2.4.4` | `v1beta2` | 1.13+ | `2.4.4` | + +## Developer Guide + +For developing with Spark Operator, please refer to [Developer Guide](https://www.kubeflow.org/docs/components/spark-operator/developer-guide/). + +## Contributor Guide + +For contributing to Spark Operator, please refer to [Contributor Guide](CONTRIBUTING.md). + +## Community + +* Join the [CNCF Slack Channel](https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels) and then join `#kubeflow-spark-operator` Channel. +* Check out our blog post [Announcing the Kubeflow Spark Operator: Building a Stronger Spark on Kubernetes Community](https://blog.kubeflow.org/operators/2024/04/15/kubeflow-spark-operator.html). +* Join our monthly community meeting [Kubeflow Spark Operator Meeting Notes](https://bit.ly/3VGzP4n). + +## Adopters + +Check out [adopters of Spark Operator](ADOPTERS.md). + diff --git a/templates/backstage/argo-workflows/skeleton/manifests/deployment.yaml b/templates/backstage/argo-workflows/skeleton/manifests/deployment.yaml new file mode 100644 index 000000000..962bc6a93 --- /dev/null +++ b/templates/backstage/argo-workflows/skeleton/manifests/deployment.yaml @@ -0,0 +1,109 @@ +# apiVersion: argoproj.io/v1alpha1 +# kind: Workflow +# metadata: +# name: ${{values.name}} +# namespace: argo +# labels: +# env: dev +# entity-id: ${{values.name}} +# spec: +# serviceAccountName: admin +# entrypoint: whalesay +# templates: +# - name: whalesay +# container: +# image: docker/whalesay:latest +# command: [cowsay] +# args: ["hello world"] +--- +apiVersion: argoproj.io/v1alpha1 +kind: Workflow +metadata: + name: ${{values.name}} + namespace: argo + labels: + env: dev + entity-id: ${{values.name}} +spec: + serviceAccountName: admin + entrypoint: main + action: create + templates: + - name: main + steps: + - - name: spark-job + template: spark-job + - - name: wait + template: wait + arguments: + parameters: + - name: spark-job-name + value: '{{steps.spark-job.outputs.parameters.spark-job-name}}' + + - name: wait + inputs: + parameters: + - name: spark-job-name + resource: + action: get + successCondition: status.applicationState.state == COMPLETED + failureCondition: status.applicationState.state == FAILED + manifest: | + apiVersion: "sparkoperator.k8s.io/v1beta2" + kind: SparkApplication + metadata: + name: {{inputs.parameters.spark-job-name}} + namespace: argo + + - name: spark-job + outputs: + parameters: + - name: spark-job-name + valueFrom: + jsonPath: '{.metadata.name}' + resource: + action: create + setOwnerReference: true + manifest: | + apiVersion: "sparkoperator.k8s.io/v1beta2" + kind: SparkApplication + metadata: + name: spark-pi-${{values.name}} + namespace: argo + labels: + env: dev + entity-id: ${{values.name}} + spec: + type: Scala + mode: cluster + image: "docker.io/apache/spark:v3.1.3" + imagePullPolicy: IfNotPresent + mainClass: org.apache.spark.examples.SparkPi + mainApplicationFile: "local:///opt/spark/examples/jars/spark-examples_2.12-3.1.3.jar" + sparkVersion: "3.1.1" + restartPolicy: + type: Never + volumes: + - name: "test-volume" + hostPath: + path: "/tmp" + type: Directory + driver: + cores: 1 + coreLimit: "1200m" + memory: "512m" + labels: + version: 3.1.1 + serviceAccount: admin + volumeMounts: + - name: "test-volume" + mountPath: "/tmp" + executor: + cores: 1 + instances: 1 + memory: "512m" + labels: + version: 3.1.1 + volumeMounts: + - name: "test-volume" + mountPath: "/tmp" diff --git a/templates/backstage/argo-workflows/skeleton/mkdocs.yml b/templates/backstage/argo-workflows/skeleton/mkdocs.yml new file mode 100644 index 000000000..ba91633ce --- /dev/null +++ b/templates/backstage/argo-workflows/skeleton/mkdocs.yml @@ -0,0 +1,8 @@ +site_name: 'Argo Spark Example' +nav: + - Home: index.md + - Argo-Workflows: argo-workflows.md + - Apache Spark Operator: spark-operator.md +plugins: + - techdocs-core + diff --git a/templates/backstage/argo-workflows/template.yaml b/templates/backstage/argo-workflows/template.yaml new file mode 100644 index 000000000..e0110d033 --- /dev/null +++ b/templates/backstage/argo-workflows/template.yaml @@ -0,0 +1,62 @@ +apiVersion: scaffolder.backstage.io/v1beta3 +kind: Template +metadata: + description: Creates a Basic Kubernetes Deployment + name: argo-workflows-basic + title: Basic Argo Workflow with a Spark Job +spec: + owner: guests + type: service + parameters: + - title: Configuration Options + required: + - name + properties: + name: + type: string + description: name of this application + mainApplicationFile: + type: string + default: 'local:///opt/spark/examples/jars/spark-examples_2.12-3.1.3.jar' + description: Path to the main application file + + steps: + - id: template + name: Generating component + action: fetch:template + input: + url: ./skeleton + values: + name: ${{parameters.name}} + + - id: publish + name: Publishing to a gitea git repository + action: publish:gitea + input: + description: This is an example app + # Hard coded value for this demo purposes only. + repoUrl: https://github.com/cnoe-punkwalker/${{parameters.name}} + defaultBranch: main + - id: create-argocd-app + name: Create ArgoCD App + action: cnoe:create-argocd-app + input: + appName: ${{parameters.name}} + appNamespace: ${{parameters.name}} + argoInstance: in-cluster + projectName: default + # necessary until we generate our own cert + repoUrl: https://github.com/cnoe-punkwalker/${{parameters.name}} + path: "manifests" + - id: register + name: Register + action: catalog:register + input: + repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }} + catalogInfoPath: 'catalog-info.yaml' + + output: + links: + - title: Open in catalog + icon: catalog + entityRef: ${{ steps['register'].output.entityRef }} diff --git a/templates/backstage/basic/mkdocs.yml b/templates/backstage/basic/mkdocs.yml new file mode 100644 index 000000000..c8ae22317 --- /dev/null +++ b/templates/backstage/basic/mkdocs.yml @@ -0,0 +1,6 @@ +site_name: 'Argo Spark Example' +nav: + - Home: index.md + - idpBuilder: idpbuilder.md +plugins: + - techdocs-core diff --git a/templates/backstage/basic/skeleton/catalog-info.yaml b/templates/backstage/basic/skeleton/catalog-info.yaml new file mode 100644 index 000000000..c4dec95b4 --- /dev/null +++ b/templates/backstage/basic/skeleton/catalog-info.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: backstage.io/v1alpha1 +kind: Component +metadata: + name: ${{values.name | dump}} + description: This is a basic example application + annotations: + backstage.io/techdocs-ref: dir:. + backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}' + backstage.io/kubernetes-namespace: default + argocd/app-name: ${{values.name | dump}} + links: + - url: https://cnoe.localtest.me:8443/gitea + title: Repo URL + icon: github +spec: + owner: guests + lifecycle: experimental + type: service + system: ${{values.name | dump}} +--- +apiVersion: backstage.io/v1alpha1 +kind: System +metadata: + name: ${{values.name | dump}} + description: An example system for demonstration purposes + annotations: + backstage.io/techdocs-ref: dir:. + links: + - url: https://github.com/cnoe-io/stacks/tree/main/ref-implementation + title: CNOE Repo + icon: github +spec: + owner: guests + lifecycle: experimental + type: service diff --git a/templates/backstage/basic/skeleton/docs/idpbuilder.md b/templates/backstage/basic/skeleton/docs/idpbuilder.md new file mode 100644 index 000000000..3ec74fb94 --- /dev/null +++ b/templates/backstage/basic/skeleton/docs/idpbuilder.md @@ -0,0 +1,46 @@ +[![Codespell][codespell-badge]][codespell-link] +[![E2E][e2e-badge]][e2e-link] +[![Go Report Card][report-badge]][report-link] +[![Commit Activity][commit-activity-badge]][commit-activity-link] + +# IDP Builder + +Internal development platform binary launcher. + +> **WORK IN PROGRESS**: This tool is in a pre-release stage and is under active development. + +## About + +Spin up a complete internal developer platform using industry standard technologies like Kubernetes, Argo, and backstage with only Docker required as a dependency. + +This can be useful in several ways: +* Create a single binary which can demonstrate an IDP reference implementation. +* Use within CI to perform integration testing. +* Use as a local development environment for platform engineers. + +## Getting Started + +Checkout our [documentation website](https://cnoe.io/docs/reference-implementation/installations/idpbuilder) for getting started with idpbuilder. + +## Community + +- If you have questions or concerns about this tool, please feel free to reach out to us on the [CNCF Slack Channel](https://cloud-native.slack.com/archives/C05TN9WFN5S). +- You can also join our community meetings to meet the team and ask any questions. Checkout [this calendar](https://calendar.google.com/calendar/embed?src=064a2adfce866ccb02e61663a09f99147f22f06374e7a8994066bdc81e066986%40group.calendar.google.com&ctz=America%2FLos_Angeles) for more information. + +## Contribution + +Checkout the [contribution doc](./CONTRIBUTING.md) for contribution guidelines and more information on how to set up your local environment. + + + +[codespell-badge]: https://github.com/cnoe-io/idpbuilder/actions/workflows/codespell.yaml/badge.svg +[codespell-link]: https://github.com/cnoe-io/idpbuilder/actions/workflows/codespell.yaml + +[e2e-badge]: https://github.com/cnoe-io/idpbuilder/actions/workflows/e2e.yaml/badge.svg +[e2e-link]: https://github.com/cnoe-io/idpbuilder/actions/workflows/e2e.yaml + +[report-badge]: https://goreportcard.com/badge/github.com/cnoe-io/idpbuilder +[report-link]: https://goreportcard.com/report/github.com/cnoe-io/idpbuilder + +[commit-activity-badge]: https://img.shields.io/github.amrom.workers.devmit-activity/m/cnoe-io/idpbuilder +[commit-activity-link]: https://github.com/cnoe-io/idpbuilder/pulse diff --git a/templates/backstage/basic/skeleton/docs/images/cnoe-logo.png b/templates/backstage/basic/skeleton/docs/images/cnoe-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..63b8f228ef58a42a758e570331053afc547df964 GIT binary patch literal 58052 zcmeFZ`9G9v{68*{rH~?`;&6(H5g|JjN+C3sFl5PYWFKpjQ_5N?`&L5P_pyzovSr`* zv9E)%jeYoDw@$s!`F`G?Kj8Ctocf`=d%2d^@_en=yt=QZOh?N`OGZXUcjxvkO)@fy zbuzM}CDg~jo%lXaEpUV0>gLV+HaC@TB5je5S`Lp)&6UmV%^j^wHI;9WkzEfCh8tR* zgEPs-l;rdO+2YrglJb^*U-Vspt!DdQ1GD?)`F2BB!fXo^UN%;21s zaK~R4U(pZ8T_nH4mL)LNIi6oP{r$V7bG3IHop+l6f5>~j_m_^aPkgN$SR`=P;(9kQ zn+F#7tozDGUJgI+%eel7Yuub{pSdQ_@F|7DZaqz}$rjCbDce}i@l)Rl$#hub8J6=} zquvO=G*Z06n-;YHeefmK4EM%E3M!}N!4PTD&zYCG8WkJF(xcV5JF$MdzD0_|Hs1&R z)I;-yyqQLh7H>rGIfjq7ums`ctXC9M#F9}#!N%po$BtH&NxUv*DvC62OD*IjMOMJu)l92$0srI7G z3qrh5PFxiA_*)5<<7`0}VcLZ&H|l+L3VA-AG%9lT4ILkc3D6%tFSeZ@uPZu=3J3PD-U^o3;Efn{4@Et9x`|-~ECY`f5nlmqVNwzRJVOE`D=2_KYYx=S0)V+Zc8t9M{`-ui8w;|iM;I{QZw z=UbizEwdoAc1aa_(YkOhC$qJZ_Ab;BZp{So!1BOZH-*}L3$w`4g4P<91o4x7t$nRF zKi>D+BP6};bpp$jv=hpDoaUVWv|zIqaIPQdigRo|_-ZuMn`1O1{_w;;mCsRM{Gc{Q z6o0Kro7TG&ssCMhO-9X3Hdz2}`zSx@qn@bt4mn37nRkhM8MVbR{k_S}2D!I34V!N{ zF8NO2CS}K3oDv)po{T)LHyjmoG;%b0!r_#lY~6(-T(eoqPRga7wu;agO1SZ`Pe7X2 z?77U>Z(q&ss?RdN_>1Nd%)?bY{d6#kVcD^|9Hd#gcg9neFHQ^g8Tmb9au1ZkkMVe= zOb|qls@YHc#eGNaEZ1|pGLOF&i7Bo=cVz~$(X~!1w$hX)UPfNmWSQi?I{2L(39Qgq zSm|<{%WI?`53-6YD2$#D_|`BvVM3cN%y;I*R8=A`zI3+iTzd+AVT9!rS&pah^{>b~ z`y`e@RI<5K!m;anJW`tvizFCEGmf_HS~iM3wV1#X$TDP8+&47cdA^&BkYDfi`&O-^ z&eodFfhX#_+h4?y^?6|t2fHK>@3o^{BV@&i2S*Psx*xAG?P&x6am!ry&SO!T&m!vb|GN$?7#)dO8; zUDbP%rbs)%M`lP9b3u1I2j~SdX?IC*X=m>Ih|}H9*4|0dU54xM4M}hf-G*^-9=_si zBg3VudY|(q($Sn#Oi)Nrh)b51lao{0(d@CL<}IbaKL`Jl;j(mgc94X@+}zv*-9!YD zjux=15)u+HAz_%XumE^NzzJpV{K#Fv-iiC?Aiu`BW$t9^XyxE+g|z2{#(iXhba9s9 z;({jn{paU8ovj}K&rJ4Ce{TzH5C%PgT@@69{coR{yIcKVK7*e8{OoXFKc|z129s2G zv@!<^hL$CJRr+v(f8G0^?{xT$u-J8J*#G+IfBjVNe?FBE z75V3v|9JBEm(nnZQ2!v@Pp%x^1#FR}m4^Lhu`I3Z(#0AwGI_E)w-g?@A6XcdvpuI% z%Dbhddc;P;JzQ+K%B$)a`xQ>y7Ugt};If#A%+cFl{~Z4m6Uina9(R|U&AsHy_tz9n zFX<5l$A{u=!~FS8#VegR#B^_~{3$1ISU57L9r*6M+;BI1xO=#g+)}J8O)YLM{Zi)s zj?~QE2BoKDN60CtPjbrtckv$){*#3NwBSE2_)iP|(}MrB;6E++PYeFjg8wJAfdAtC zj4sO)FaG7)mvZOqEgZDnM2g8w2=q~@qP1E#~+;a%GL)J2O56&?8mx~lZee=Q=6y30_UFj16ly*rV*cMp0tbDU|0kmvu;*(s=FxnK7- zdrHmL;m)QE#9NnPRtSKhb*b?yub~%P7+-&IqYp~`CoSYh&!LrinsAm{H%EK?u+-Du z-nH@l@o9WVu>BNqs!yxfXsBm1+ndE6{PXRmKOJ_*Tq)Krv~<;$@aP!Dl{L~s&$r~| z57#2rsra|5ZN5Q04YkoMgPy3wJQ4fBo`|@$`952 zpg<-x{|e=LOa6*9po1EXfdsMd=0Dc}1o2B1zFI-L-O18|^>CXEtWbLh4#Q893|2 z73Nk*d`*Fvg)08!;_pE(Pmwd*u~c7g)O!?^|3F&#DH)mp3@1CfeDt5AQGYU^Fui}_ z#jP?$p_Y%@zsEcZ#$>p@_fH)4G#;U8f9d7An*eXOVTt=}X77m;d- z4FN@pD>ggjnA6qeGo3EuUG0^rnObtF+mO(60P*pr7+3!1nlj#3<$PQm<*gmMr8uZ# zm4uOM%EB|(6`oJml+PB6KTUH|mkP~~7rJfw8)7UqIH``xHl;|Yg%U1c+!a+%bGE&c z-zRx%ZD_r(u>IUHyuLQ<7KOt4sQ3}^h5EKVQmuMmdAbaM%*5hWr8|FXrzL_@y`BBt z?i_Kn(>fBfbP%pd;Ds~tZh0jk1u~|$3vVYfqI>=PEN7Is?T7&!9TT1soyhX@p&a)} z*fg_Q)!=Cga*Cci@)|)drGvGmj z)1+^fM75g&aw_VTgQQQHF`Mb?@i7apblP!+4fHNdKwf&(<>is2r4q)|e=Ee}(~;Oy z)9JHS8uQGg`f+?rywu>LgBbcDxfazFtXM_x*^@$y_v1@T%~Yg!Y1x9;clQkWhU1Z@ z3`fXqV8%Zd2P!GZesMU3>GLsvt@xFdG1M4I>dhESl!D(odzmfKWa_1*47b5=MFC%P<|!7J~T=q?~C5wdRa9|o`1zbZX13{W)*&~b+N9R^x)P84xo8h{Oomdn~R60 z`?Spi`c#a#@M=E)Kzy(BunMN6uQtq6e?}CK0tC*;2iC-;Vz*Z9Z-LddN5i<}uSUn~ z(_N@Yh>zi)^{HqVmvJjWX5qyDY;zaN-ct7PK)R*jrm76$j7{R4QsyK50C41#lVhhA zOXGhD6!ppL7lq>EV>ClhX0UNzE~l?M&O6oe z4EYpG_{>T{jEDtzDwVtZ^4Cs{-%~ics=v4Y(rT9teD(x?(_9(xatZqd=X;!QaHQN-wZbv zpj7H~O8*=mgM+uK<}M+a@c~isW#O=w?>W|+cO@btQa_33Vu4FCPr0_*ZPCz{{v-C$ zU~6+9 z#^>8q?Ia?_8wrZ-p7Cj0GU@rua}VP>V}V6S!&!jP5T$Ir{uY`eY)`9rfKQb0+Wpxt)+RndbCJ%x$5ku+>uJl0vUiTun@;Rd@2F!v14n4QsK^yc8B`4Z6A@abT4T>uv?yMfC z3$!VZiQn~D?%bU#QGCK=Lm^nct?%wS$7jYHt;xDqbMBO86JDt{aZWMoaD>`n7J`@E78L~s8dU0|lZXWUH z_|0!gexc}iPgYW+5f2#XNpK1|)wdTcs|oGvLwq&YCStKH-A-C&OK|g%^`YlOq4tP^ zIb(!Mc1LZkT2iNN{!nJ+h3__-YT}H<03fF6f85Wg6$<(-vBrYr;vDOE%GLniTki)K zwRhdue3*J>Yecn;J(hUxk45Bfig9@Y?NoQ}8Gj}A3RlcCblD-aq zaJ*UTtPx#ZeVqEK89d_F7fPZFyM2Kc`*l{ixq!jHsYAFD&s}xf~VS zc^@I<=2+o+X-!l4W;WV!jdb%cYUB*>Im9byf7+^}1lYdTi8Nm7wC$J^xBSk_i&dVi`V=rNe;VRJD%bx5`}AZA*nNGYBW5&FeBUhSvFJ=mm@bX zrFbyp-_ozp!;br}Z{d6zb=sj=BV5Ti&v#O=*}?hUPkQRwpe1^Hl#JN!^#Og|h z(kA6vOGPNTheertI2pQ-85ov9edOpNkb_7h9$S0{9ZsU2^d4OLOtIZjO1UoUqcHXS zfJ#Hg?V60Zx}9NM=54^v63yiqcJEH787~{BihyKR{On|Hw8 zX*si;F_Wzf6j?Z{+S+`iq6>0#{U+;DX{WufIBv8`_^mg%#aIy5A;kK(lZ>7^6FIm( zP#fha|7UgsW=KKy2)4n972qM9e#zzPvh?~qcvaeFzBZpq^wW;*oUb;uhdxP;9QQ52cROuzA^36o$O6=Cb z$EwBkbVS2N1N(E3*SM|tQk93q#Fk~PosIO#KNvdXNxx`jjte=fTlU~F2rfj*;81Jd%Gx$w6ESUbb2nl1BEyv(R| zw}amai?YBswBa}I@=%!`JA^5>LZ58l@ivEevgwznObRH*rFjd_4wmP3mJ zYMmZydiE3Pasjp&toF00=FO7rA7$`Tu@{F)6}%wGH!fw9P4FDT*V>uc@$~@{UDQ?b zpj=%~Mx)CW;R0J4@R5|XzB{dm$wK1JT1947uLe47uEgrP%;qMbvyuZ$z1?ubc!xLA zo16BEmt1UojL4=3`|k0C=otR~it~G2U-`#1Ja&fdk1wWlc?rRi^M%)H<2cOqeI)kV z-JpOa5&<#*9wHWhyU8vTwVgJNA!^y@DXVulPS`Pd8GPh4BAQcNJh)gGm8rwj%H6l! zO{M0eOAna-*uTAhPn32X*j5030wkH{s0uf(VoaF5TwkEdXMfa7rxAO(`lz}QjKlC0 z?KCk!&L~n;kGXCoIz~28=Ru4>pY>ayJa;bxV!Xqs{!BPly``DV$jy^{iGcO4517-f zf{7#2L#LlncG{z?KV|BZbEvmsQF634>qXpcrxYrZ z=?z=$U78uy)j#q>On7Zzfsn`IZM9ePK>=`I56Ywbj&`U25TczXT?@TiBkB{H-I`LN z9q+j7j~~=Z5SJb656pCD?Q|Yd?$6*%tldBS#SuL=?y^%PDijsZlkQO5zeVu1sc4m0H^;Nb3z&H5rS5cH1_z$~+D({j#xzdx*qUR+ z+Cklqt~dr+YhlS?z^p)~<+)leqT$bkw!tNbevf+~6Q`mm2RHX!>TDFmd*TxK`%|=g z!X!&}J}1^7n4Y;`u&H~l7+hHOxVcSguDK>u_QdM&s|rNf)?Y6+&(tLG?!3uFv<$6& zI)WAx33`0tuVdCUlMH7O3`HOc;I8lW5=z&`$jV$6Mke3}_t&>y#5dHy2J}=Cx94+G z{iWv!OLIMb*@ zgstlr(D^Ep=C<=CUkM!-d!+ER5r+j{X8u-9yVfu<=OP-4^d2)Jm0x>EWv#B*d`LcS z)M1q{0bj~h?Ds07z?^Ou*ne?P_M>iZ>go@Wi| zuDzww@fypQsa)4|RDcX8JoL@39m##fpMQ`V&}-T`c>U$D(n{dDrm}%Sdpi#gooA@+ z_y;R)Uk|H4A|TV+{C&pkF!|B;Ox{PtfWE>maVqwrlf?sVxfCAX z{@vw+4cvZ+6OuL7fZ_6pSqNNJq8 zDvGH`mU=eBTbu1#c2b7d2R4jGRW0y^Bc?jK+URzFs@9}ks&9Wx%Im=wKRuWth_jv7 z)(FbFYLkSyuuwD7;GZw%G`;=p<5gb?X(yx8>RARt$d`Hj6v1MUcrSpEzR`z@2)RcT z+RB{js-7Z!Mr}_kSdZb-n9hpOfh^Uy>TXUmTN0Zfy_~^>K;<^35XPyW?QN>Fr8{co zVGnW^q@O;sR9V}PI*WvZwVe6+pywBB@l){bxHZ@VPj$2N$jNaQ(tv=0tI7V;*+ot& z(U>N_*b1^*b5gu2!wWyEi& ziWUl{%$?bt3++v9&HAD*A(q{|39vYVF1ejV+}#nA9^AiQv@c`HbjQ?2;B|f@a1Qx& zG(v*L8!-KTYDqR6V)3Gpb+6M2_P2zxvB~rwh3-(S{g_W}Xt*Tl=-S&EQG%+JBu#t| z^{*cA+&#@fkcU|HS$^<<)j&h+8`q&VraL}a)6-au_?9WwYY{J& zj%N~W#EcQYj;89jFPJC$7xguy1H{WbMc@eRu%; zKw63CjCM0=dZ+QaCqD`JHsy@13XSS@5^0Ds4s?>w0><#q`%IO}Vq#w)KBofa`7!OK73D%R{@9N%9C8z_O(S z7|y3e4M=SZfxNhfBf)s}wDq|X+v@UCEqkpiZGAcR^Hp0vVOA!JciY=h1MF`XoG*>ZE1(y$ognbzDP4!S&6wYNjtO<-jx)i%x>DZ_*C&OH(o)4Z=!`+!qxW9IMO{}pbe_+lZUGpuru3Tso0V^4W!cwacOHgIeYrO%VCMMU z-1hDtLTP`Mv7oU@?gHm(Z9W7yePUGfNis|ZLCVdY2_h+ZxxJyA#S#->w?)_6I9QVN z)$Q~TRNC^Of?Txq#Jh%8`_i(CFfHSlmAI6O7q*oyJ}ZHkHI%JEN8tk?}?Wc+@;q|d}@oO94}k{N&!6mP=@;z z$i0g|@?CMdJrIue3}hm7tU;}0p4=uLh!$LV6y-`_Rp zn;kLQJEcXtX`_C*2`}C(Y4};^+$~q!%5&15`;6t2jU;zT-^JvW^&!XWqHa9#HewSK z6ZqW{cJj5>9(L7jfN)R5$<|HmC{{;``BGBC--r&hg!A7aC_UESj~Q5U1yyLXX;Rmg z;*08XPyb+yl$D?2N_pYswy=%rClE-P98tXbD~9e-bc+d-OX=9=skaVM#L*A|{g9qn|Mrbf4n z&j=s)iM?A;#sv0dn2S)n7F(jeWbL?lyFawuxUK#_~sfwfl47@MXn3Gs6pTUzwl- z9j{@NR*vL!ELMA;-gjs&W^+w<$!l-DNe(6{f}B2Ld6?79d-^oK_XvbNSNyAZ8!d{A zbvwDwpJBZnb6PYe)%U$0l1Fl5$j@Yq7z-B<&77@y@VQz#YmzMxH2)-vC%vxmVQSi{ zc)#>c1BEJ&H|1w(n;kel`IQBE%s(@WK{8vu&$795Z%hSLKyef z1qY$T=tQK1)1S@fUVFVWgJ-O!m$RETcA6YGc=MmZ?0jH9-*KFrg?jQwHs-=Du_qFy z8*7xkya7fX-NBh9d!*(Gl-9e!N@rWN2;cF#>58*`(Gste*ldfn+8NU&pP`v_ksYDmFMK}Q+raGfA(3a(bvh4$ zpr6K`zsAwjcou_|p!`#PQW|no&=S?OmJ>+?S4Rsk8o25A9es0xDiFd2bAMkHKie@f2&V}sNuC8E7cSD`X&_xtx_`-|n z!&a25RDVv5qK@8WjrE;EspU3fi%G_EeEqbbcS?Byv~rN4oxrHSTY!Y#$iE3`ky#>+ za&9zhM`2VzC(?1-x*>|%ehRn8L=t|^`+MOPB|gs6@~a-VMRYD-*?$x7 zgWFA7SI zM{NYNuX6f4Ub_yy?sHFvTZ91G;Iy+v?7egwTtTPXwZVb3i48Sh4(63e(t%9s;QAp_ zO7e3i_V(*1nL_&C_6V)>MQ1_D6}Kh=%1rw$O*Ya~;!$!VGG!zY*!&$JS{W~^c=?fX zN+N@ADOsG#1BT1y8jL~&WizU=66p(e6l(*lI@w!J85oZ~W2ETe%FlxeGk%M%Lk2Pl zv+v{)rgOZ^R&vi!bu$|ox8J}WmvDDn%h?_W-E;h83ZW1m`I;U-tiVLVuhmn^sqshS zrUla{ufDID0Su8Jxd;eWKh@?~y3ly(p7fWFZS8HucwiLTnRswat6&{#5g(iDLF3Llw zA*_2*Oc&bjhpImnic@q~Z_H#WbFf9#Y(F9r3PiBLE3^Jnw=sIp^+O9ahd zA0#XT&p`96Wax}F($h|EZ~KbgTayZNIm~0wiEesooF$v8E|X$y_1ze#bx!RH1d{S}uq3cJ zG>{L`;)WN8jYv)>>jUE={G{>?FXKMxQCW%IumC+o-srteVVxX-boNYFF$?J#hC96BzFv_?1!CpqgS=tna0?~G4dcsDC3akF?kA%j za$1(&t=UR9^@^xAY!5sQUdRr~g1Y&$Phh9RCU!oP7Z?UOwGTm8}Z*Txi zpJPp4GOHMm(1#l-3uO=6Y3QL)*m7~dbMm&_x?kSfm1VPKLV#}t<+V3@=B^(~lM-j8 zMw~f6SEL1+phppR_o+M!rII3SM!z%xkAwS z`c>qygzXcXsVT%vqPc|o^+qzm>znX-yM>Hye`)hV6x!bqT80DE!*Nj_>VP@KE^ur4 zO_f(_Z%E#1R_#MnATQ^;x}6m1bK3Kymml76tUXL)zgm<)$m;i(u6b;YU4O#ucAFc5 zi%+0F%YzJ5`#U`k-TGW5o!XmH(3epzCo|;1(qzMP^r|`s;z43w5)3wcXs;T;MlLxy zLbYQ^77wWe>NMvk?-jyk$Tc8D>B=GUvGC-L^>)Z z9R@{jpT@HsdL@U0Kpn22YbYvBSSOpbv**V)r1fb;GdH&^hd7B-=gC^Sc0H|AwZ;Rb z$VA*~9Gl~jiNBwy0^^bHcm$TAYXyRn_Z8STj2A1fV*H;FL`((#l!9&=;wRS6G72;(S7-nW zY!KmmCUNDUdhyUDuzw)IgdOgY8L`>WERYuYgVc~8e@ILkFv_LB99h92J({Eafs1GA zykmj+8#39A2926z=sT3Fk|=W&Yo|?R^!mGFA)fDKNBZ|I=`{GM zxa7A9=?_KZ2m$dB@~S|{`*%2fjdOWHasRuQTpBCx)rsI^Y~_isKv_+IIR0?NK(2h0 zw+z})q5wKJZX;zNR33-1GaL_dWiebg8Tz2lu<yAf_I4c1L`yoIqk$GI2H|5-v~sQwLLm1lE(;)ZjV>sc!Vwt>Gq-DKap;2kv$rm7oJ*CS zCevY5gk2bsLGZdDxPhhy*m){6DeBA{^5z6WT2)mJb}@Z%Q4-RKyeg3F;EHrBZWEkN zM6{f|MsodtsjdNSrjO8%ssj}=!dUv-*9J<3v0|Z{Jw{1=%IR8x+()07@;nPCp;iPJ zU0&FT(T5l9N`j_5v><4+br}}cf9nj|?e9}pXP+Vw}q5Ul;UG!WM)L^>@>tYg^@dj!=xJy9slqNw9&AN}#v6S%l68xFi!g1h=|5zUw!f1>IlH9v+ z{@RL!y7ftz=eA>!1ogZ3zT8dd{)=F+3V;%ugf|x;_Ff?GoqqC$Cc8bk;$EM*KUi(z zP4c9uh*N8^~&%1UK-=t4dQx9CfMKzyqfVIn7$quKm--IfCL>7 zKwH6>^?RBlCt*;6VFu0@KmwWI>ey`0jVXKF$g8g`{<--z8Rd~CWsGoJ--_M61vMa0 zps!<`v;pPPtIWZ85j6dWCTs1?a>H(UjbSJmsO;CH%SRfq)Fz8H@&m_B;xgBHy(@Af z=m~=RNHj@i{hfTcnyOCu!gK_{hMZIeEkiSz=H8#)CP7P%clB&3lq5y~a7L!vqLmr<~bV?oBu@T&B zU%F-rw~Z+?$}jp;#8F#e<}_yx7uY7hBR8ENpxIs6>yay@v7P;n&~H$|sVxN@ZP+~? z{V*oKlb%b;uCjSdwR;2VbW=dFzV|}jbHNo*rJG1)_D$7ASnaO*ojVLOSirIjKbdlX z{Zcn68%KiP#?7^AS7y+^qB#m2m5kj)<52j(vZjjO}M1~^Y#mR za9j2y+l&uh>W9tvCn2^TgV>sL8@=U^GV`i$(w~%Zu!D%1(Ka!Y{wqaN%TBcWtt+&k ze;(Utrk+eRsEkS}xB(PVl!cXQ6~VAdbobgabO{Gf%bnSxP?X6nG=?*^GzNHoRS$gM+ML6_wRMSuY-D= zp_VO+a{>?67DnWe={n3(xB$3u@O!cF*j)=~9N#Y8v(LL3kKANe~ zhl@o4xV3>9$v1#h{Fi_SX(Ha`@LSm>F9}7Purk}QoUO+@hz(rl&yKyRjmT=LV6>Sc zdFdEiYE)hVy^Lw%u=#l?@I$|cI*+3CtvG*^JMI+gvDF_?lT%@_58Y9e1b232v8;i^ zRLrKE$^6QrbM5-)Ulcr0Rb*@0pW!<1HglhFgXK3TMcWE1baf&+v%dkk)_=ipM16Lmu)^H|$ni7w`14X9)|sJo2GF&7|RabTQEwsmo+`K@W9VMny+T zcW;6#0Y0LWY?Cf~YXZtYOGAd{!vfpyEv8?7Ez+E34ND1LswEpt5c7yPX}OW!f$;Dk z%$DCgv%hz!+Ge0=6D+Yl1vfAimmy`9U2u}0oxB*p=VLLyekD)M4jOJ5bOaD&p8o@G zFEP#D`VcsacaXHoIKH`s8~aNp;o#B4M;7GF{dKO;EMA{Gz;kgklR^u)OL|sHaPjn$!CRlHmWt4}brMmW>`0sq=2PD!h29ESsB%1y=3!PQK zX$$I6=8{u*oj^kGTZ&cT2d}VIGerGTBPL^_0c8lYi`X>_LD1?YKsJlWWTpOY}?TSOiC4!{(XQ3xH{6J*Axo}9Cb5Y zs}%)tQZPME!kFuW?BN7`;y_auzt3%uPc@su`Zix7_@$Ly9si(Ca=EV?DbUw#_HjU=L35g+83`_WRV{ijZe4Q==^nLJxf&Fjb}m3!>@-(@xK29i zflcuz3)Fxm2+_K6W18kM!#+72)#X^$;qp8-BSkV-IhhhShgYA68~>FOw;uo@X_7I1T7TLr$j~8WGWX^gNuEgGcT9rl%JpcJP(O(BO<=M$42ABE+ zuW8)R*4dNDTida7Htl|q%_)^K?mba3i{9I5oBXo0X>B&SUrr%gld)f1BRD_cu4@`;a zY>TeLPB~NN9TdePCM0Q|m z)$2BA80$Sz^E3S%A>?XO-!4ZXsl*>6bE?m*K4>?ndeq-j$9{V9N}U1LHO+;wj;D7& z-Y+3n4fi(lvaV;b+Buq7#=V5UF6l@WL7e$Njyo8epf#4WJ$b9

d(w5}BKBAr{wrzd*>V2kjkOcueVOl_vEG7B`N4Za1mCi(JQ%LO+x) z%LR9-%EYJbi4B+g3doS`-R7O*pvV_RJrqJ5OdESQfTD`J#BM0KqyhJzYj9Hzi)*V+ zQsQ7*WRRPUa@%~69fxsu%hu73Axia1W%*`_K$=_%SsqVha1e;XXeY0{>-Afl9cWp` zFLGLR6_yO&!Eme#NaHT$7SWuHR530WMC?oHYTF&q#irR1=tF|?>c8`IaU=CoyQk5y z53)!V^j~dfJ|m=JM)=|lZEL9_h{rbcmxX6S^E#T+h*)vU)5%Y=rs>LXi0MdAj+;g_ zHbAWxkp=)R9Ql=@cuW#4-F&$w`aZn;mEq*qrR{<3=Ji%L@2@h$=bf*iizq`T$c+lU z-#jn$-9e5Hx;4^V$q)gj>K;sv|ER6*I0!Z{@2aW?q*5s zf2}mM{vi=ehVF*WFp)fM{{lXbzVRD8bDVgO!5_U!PvtQb0iTC-6&YjZFiREH&Ata| zpVbDt$IqDJ;k=GlFWlYtk?P^{0<9|b{>rGhY7OGRM5p0uWYuMKvsP%Tr!MuZD%G?l zNORl)8;V;h%00!|mQ`ixU2dR|)55;)x|`wxtRb%hQ=H_>?70-hGvAy_MdHnA#)H3K zNXFGZ$_VZy(2t&wX+W2kXWY>9mbl3;svhjJ3c`Z-xfx$Z3+_-n{^Fp2Ufq%M(2F?_ zEJn{t7Q4t1^5(;{5jBDvNn>-kNb!-=0w9Teg?z-oHwq*Xf{mN<8_Ep!UW2rY^!AFt zd5LJ;Sw#WOb>Fr{t8eMy!4b$g5We*^*vv&(KaYt^{%Y5bw^v%F9TA4qN&?D(Ovuh% zJVI{BTpx8A;_JC`Q>A+|LX)W`Y26>c8*!nx=g2m} zFyLMcUs`9y1+U>Ab2e)?m!4WFy1aV%c$ZbR5t`6cM&5wTEw_$q7P05>Be0*nwWHiX zokHdJpk&G`N^mSHr0Jcsc@|y|6?#QecE!+z6TN+W@9Hz>R)ln@Ehf^(bGoa6T8(*^ zu?ZX*n<<;(#0h7-64ySflSayLE70`aJi}h!SbBKipWj^4r+EukArBw^jACTAxA_VQ z1rZ$m*ALybeMdokP2ly2!F#`iX#1k)8y{CkYkiI{f^JasB}&H>go-j_-(Wx$&Q-cX z%(jB%xkyC`jzc!S*Ed|?WrRpw0PYdr#~<^cV7_J&-RN@WLOpv{7^ciI%c%q~Kl;$=XhFra8o)6=!PA9?H;(!a>+DVmkX33cXTQb%j7u^DHCqtk}cyodMDFAfuv zE#Pp4R75RwCO!6#oNLwPZhFkmP!>bC)EPO2m{^akqz&t`AbGIoy-Jw)B--9}JSt^7 zivng*P%$BOZu09<)EuVXIp{~>CVlE$ktt0q?7nTSCix7Z!ctwY`QTe{;Lc&>EeS%1 z-dy&NQc$hM_?q3PyHO~VVP?CWYv2~*0c>KV31&Lq|7K3(ywCYLHnbv?&OaT&;f+1- z>`iLT?Xpx^RC>aCwl011nD2wD?yx*MZmHEKQKmY2J0FG#>Pg_!v`s4(U|*2K3*nw! zpxft{4L}1Mz&2!d^G~R*v-bi|%pp@c8mu~a%WN=t{yH&W;++SnD==}Gui{Hwc+Cn$ zG_x*NUSs1dWuWVe_f{Y$_qgGqz1{oNuK1xC?3QmMVz2n~sC7m@n+=0ckCbjhP+hpu z$LNGxi96PBlUk%}D_vU5R-jr%Ex=$?nh^lU4sWXPtGuq5gBR&9=hWaCXTwC6#JJpN zIPzJBnRlsUFTOtN)LDtXawf-qSPzRFFX_aOVG(bM%eYV}7|Tg5Yn@D$#od(}zd;R& z>+j2s(@!csb0gF_i{`CrKbc>(LWZ*N2MsBq?joLPqzs=92YcsklL<)MMtFBO9U8RaS>|ZRt4`Q$z7o@;`Pm(8* zDdaQZSC19xiDohu8;r)_>*feBpCDrWC5Cxoz;Gk`QXiwl^#_Vq1DTGLcWPOshY;7w zmrfiUtMy1oFBQbiJqgWwXW}i5F7Lc@AsbADpJApo$*AW4eiE204FIA_@~I$SG)^vo zPgXG!6aOI{m%+kJLD-0~(Ygzrty}iTdop&Fok3?cihS^>N#K@(sed8-f9!qrTa;bb zwvM2Lq9`RuE8U1R3@V|5bT^`ufOLZ+jXk&Mf zL2EkPk=S{B-r&F#%sfsGDIrn4O%YV`b(Fh3IgV+zEzuaa!Pz+uUYX4p7H20c zV&fJscy%r0gR5}(!7g$hFR`1z^+f9YLWbxMr_d5xxZrAm^WtGv5nK4ID zWozUGy?@bwiWO8{5QLob9`BWBdD(jw9ny=}S6%$t0pNP7K0?w!@+0BBbbyMg-c?nV z9q$165#Z23t%dbXB~J9T{R}?m5~JIF`S#d$mHa1_`WOqt$_0)JG7op{0q}wjhPlTe0V#?ZxEq%mQzB4fC}R*2KNhb}cV0L+N%AwB zeNhZNTplcKmreD|Z8{!*xIvy}^s@B_H&r9i$i{fQ)8!cr%Ii~0EmJXUW;2{Zcn>2^ z^3+JqjH5PszBM+3&J_NNN_pl*_*?aj=CcIxV2=em!arT|*@y+)m!;pbY>{jy11W#5 zL#|;8Pz%SC4vc`?LIn|*TejydA9i6cw48AdG&cni{JCD3h|rYT;!@1;LjJy7=NU1? ze}_9v%(iI{qeAp&l0v+s?SkMBr^-|X_nqt&#hP_%v4(u76UaNKdvIC22#S&unU&NM zcyAPeOx7ByFN+v%A&4 zFyT8j8-e5imm&B_?eb2o7Ru0dLwMmv^b$aIl8Ccay8OH5x`sp)#8*3S41AWsrI}jK zN;q(!GpoJSQj5BaWO=W7a0MY_YueSa?Iq6}`bg1BH)f@rR(0N@VxA7><||6Osngj5 za|^a}8O*_z=^&8z8e8&v>};SQoJCAm>?OoL?s?HZ_Y48f0>e8J%{Z=D zWs*RL<N$vR*$26BRVHvcQ;Zo68X9=^N@ZHt?C|_uurWFVy#e*%NlyQ?@miqd2j~B z|3!OV7Cjmr)&ze(NIF%0tE#7E`Yqr9s#^XRbYQNSdYm$DrQ3n6)BAM6nn_(xy*rmn zeoc6rq$?D?(XS}jGr$oj&7tBMcFADUDHWEVHh!#;DZUy2*{8UF+;rB5&DISX9n$s) zaJR|en_oilI!nC`HsA&u-?97V4p=jVpMU7UN6SChl9YEU_r-VArc*>sgsx=_`zE@% zpm)b*mn}_qILF663$y3ldn@fc=8Ush$@pYd=5%5nsa#|`)O6Bo4YhlE+#Pitv>}l= z=BxLq_TiO8JqNWju`{)A8)Snq_Jf54ot55b$yyPPGmyRnNoSnhT35~8e=Z?D;gN99 zDV$g2h^l7vs2KQy^k7p?j}r`p2O+TQ$mRW}Gvj@o=Lt0MZFp$|TWUKnN zIgUYk@p)CU1vY6HTs*z(&p<6bWI8owwYjlY-PXKXNK*6Bd)~;(z=cmyoxDxA!0`JX zb(iz{*Ms~N&2gxnJwF3lY_zj4*lP?322|);sJm{IcSuf959)Ja>tg;Vf{-CC(KYi; zi8YPneRY|wLN;(<3c+lqixXxC_%BH~$ z^1~K=Q<^6(X<927MepsXcwREb;yO^L8B?Y`9awReEkl#ei;|)0yp^dN!_*zCVFk_= zZEYsy#9GCTt}Ac3Ke)`dT1^dxwsX76N9akAm$zxVqVT2*_NU^WJ(Lj33?6lDqLEoJ zEs7!3-<4b|PJt@r_jWXJOp6QHAfmA`+o_xE+t<}`DfpQ=gbsN*+$dQ_nt zC7RUHLglot3@AY8w%iwzcK+nzX-V3uZ=~CS`0hT~nlJ3r93w6vaPfBCFN8DAy#(i? z98zbru_5fBNkiGdbdcjM#0T3f8Y}Kn-&)kX#mAkIZ6_J2jGV$Z?tT7xtM}?WZocBI zJ0MvUUoyxTvr|m__HL7Bs7>@^NZlMJqW%uR!q&%Lm3bRjivaq7VhDy`_1Fwe1f3l? z5-)lNRy&B|-}$I}C!o`lSfcy71R_8bk$8SS+nT*EB&`Gt()`Xs$$X=6Tz$&1iZpN0 z`&aedNvtOa?d3>SlR1G+6_N=G#RUDBPNeE};?pAm70mHxiy^}go#+Aal+8KgM+W)9 zn)7=YhFEmy^9n{^WAz!lS^ZF>jPy|YT9ljR zB%V!dRoqdv%p*b6an-+>we`p)!ZGQo_e$2cL-f@~U8s0ODmLuYm;a^f(F9F`f2p+) zzi@JQi|nQ~BdEoe0ochKbzsnlcsyu!>77F>U`fs5*_L7(`{~IXqx9-NR>N(sC9N!>_m={-0d#9=E5cEN-wKLYfHbzHO7j_ZEwgD zsJeH(3LD**gEb!r5>AHT7?z;Kl6`e{-@^WwzJ0~zg)`q7kr!0W#>`~$7q4(ulTkt; z7Ga_#co%O%#7lEbj_p8CU}n9y!`W-kl#6{RTq*kX;Z5_q$r4nJGpNRE!dsC(W#e7Uk?UfvUQ8##S6O^{u00^H2p!%(=DEd7utI`axWG)Ff2(~o z;MA)6I?tZH^dX~>rgethv`uD!=7#Czy4otoLu5qW?}fJ$TrYFFt_0sCbjJvaT-yRE zi4dF>4pF zqPP}O8J=q0uZ)6r28woD7b^L8Uv53G))k`N36pr0R;y zEOMJ297tEw9AD2hPR)`<383mAI+K_6e||DId6KTaY`HMQrY`@dlH2GE#|B*_!n4#z z)ox(m!JfIU?UHw;%JdnMr@Nf}T3V_;m;C3T!=Mmka27$UjV{ip4`I%X?J1UVGOBNNN;l)s3vO^x3ClKM+Sgo;HDob zOwJC!J7$R7{K-6B!s40#BAU=L#Fs#N^QiyjoE|2o`$vGF-T;>&YJz6}t9;s~@W94i zj?;R(UB3INmuvY&B3WBpsrsH6AKA%=9;ebpw8+s5d#r+vPfT3Azq^CkhM(A z_VBXNq{iuP^R=i~Q)VMK!gfe2>yPON@Ad~j|< zlgT_q?N!$S8t3Kj7xVWin^8ydr{ebZe8B*=85}0S@s#lKmlQD1Rq*p&*R3-Z$`Jme z_T9nki_bNCA~chADS6)|!uA>sS~Q8YS`OM)R-0XLh2l|zo4$@Uqb{mOd7v_$*#142 z&69j%!Q_7Z_I#@N@|~1ED+zMN&tAiITPnC1le_-kghFl#na&AZJnx;Y#V09Af1>Wv z>&AKoo6PtP@Q1v=p1&-eS@}HOh^2Ljw|e(duvBQ-O$QCbyOKAvHd_v6#*CZZPq8cs zQeI$qI=CebvZkl1!+*BXC89|qT`zX3i=T=qKUE*et>s1UNy$u}Fe{=?g!i`2Y;IEC zauviywXIG`7we?fULFXG*UF?b*r!evnEt@uHag&g*8%_{3}IdhX7bUFQ*v$>OK;J%^b z&_DNb^7Fhai>u(piDRwE`nZ(ofwOn;^5C*u##r|hGqs*O!rm-^{$AI+LRD;B0>Z|+ z>tH+b#K9$rPTWhMP)omu^TV<-yB0ohfd-QV3r%)%g6mnatyFuZW1r@>srFyv%}NW- z?e)J1TrNX@{vr9@m=Tm=3KMHn9 zQX+wk*I`+Cyo<{t0GBCn6ZADpQni(wxJPE4!|?vVy;zLa;Lq?U7`f9%wF5{t^SEmM z$+2NivE5xwUI8&7-Yp7zttUO~2rw%V02ng#@m?6%3~~gG68TM42U6eto)xVN!PptM zxK_E;TbuSa?EB&X*_q}W*N%tbiN>ljOa?@=Ndm9yk*|0&Dv<{=Jwwt!Umd3Is9nys zXh|acEmjj#=7UWo^Z0^V*t=Va&)+x3OhuT91 zbR!zdbTAiT^I`T+Y4`0VWn!~BTV9Pn#%)=hA+_+xT!{>(cuE8#;Z^8~9Ftx`G9m6D z68m(CR?a+Fs=oMy{e4*(@QgeCD1p1;g%jkB!(w@U#aT$;L3h|X#ADRp(Nu&Xl?nx3v}=wVH3zjyfvh<4|WTR+>mB+5tWw-v-LecQZQ{b7A1|oN?VCt!O0B|(q3;>G zwjGJ)6?IP?*z{z7Fq8BidqMkV5HvLz{)`EQd%&`Moz-zR?dd57OviU@O6S8a3?hAB zpL$@}3>*S2(uCA*W&9!!ti*fB!DHp5J77&!PY?RsjFNCknza^@wrfD|alczVw_9JU zLAOZCRzCAN4sN;I2kM0ee|C~g;9K|I@a&^UZ(28N;u>uIn6%k z5|$Mv?|`km1r^9L--pU68*yPMmJnr)J(&AqL7L0=`R+*p9iL3vlbvC6s%uBNd@#@E z1)c=%Ysd1#)JGf#K8hclq%mTogB=vzb~tOF7+nwgNt);DYs~h~=Pb%?W9%u{UClqZ zLKr4T8QdVH>|SSS%jOK=gh&eBmVV89h984kkR8)9keS=I)ucRK1-?nvb91 z3sB$!`;yS~-jI0e^#k`Q{|)3q^sM!)c+S?Bc$)SjNHGWJ~1&Wyg*20Yve z**3`BqU&?utq9<~5dL%l9JJADM$t~Y_DtQSHq5H-t&B?$)uy=O<>Z5XZ8c}=P-C>F zGs=miEv{(ZXw~Z~dIe`|n`&puPIZJmQjS;oyA^cKKxk6us0jt zXKqCaT%|@4ybyHuh3@)S?|M6Zqnt`WG3uylB;+Jss?lmST`+bWDI6>yt(+PS}8bD?xY*c+uirz@J#79PI@64 z2%!;wI0lTRmsyOIr5CK-atW*lKTC8^glgU4Q;c9|D0}lzz-NI>01SwaAQH*HSDQ;@ zCNlL4C=a@KnLyy$8GP8TymK|a23`*)q{*XWF?#D^XmHd}Ppgx5~0M#Th&q3sp zdiRy0&PMdPQ)Axf1ulH^9tEJ_8Z4^}1gsuz;uNpvqS+(dT}&P(KerOEyK^TDP(~70 zyZL18hxjS8e{f@thiG6@mB9{?5f%W6-!VMT`o1v1Bd5R<>EnSW&Q+zsc?TNARov}O z6K$J}+>b?iIc~4ZHedE`yKB^pRpyj4Gl56EOK$9T6J>Hg2N}$#t-@Gd$xKkDpAg@P z4<-W-Ax65s;OldJ>U8)rYvAgVc#%UcU~tZ6iPf4c zs!l4poj|=@3}GT^9Tj<@R&!1nZE)L<6Rn?+f5{F?!35V?X=x1Gx=(KXR0Lx)R|6e2 z$}dB)9xoNj+w|Z!mA(3;obYt2y{WjQ8L<%O)^ho1tjr15jt%t(mr;{CGJt*z6kQJk zFp9KMr3nSA{yKHHz1t$T{W=?9{nl4_ z^7)=eP{qb}yo(zOY2qNXe&%K5<)78%%|iSnEa$CyzHbbBf9B!4?}1ln36J6~A+&Mc za0YxX^HXn6o+lE5IJN%==El>b3!hTTQgiW&TNl!VbKiQ4BSB1IHknZ#*Iu3!WVz#2 zF?w*VNcj>diTvz89QO46O-+uQBaW73MY_GmAo0**HwZEKI^} zyjUsz1V6_S%`jVBL!B=72o|2;oY*tT<`=_>CQ#IGWiqu*C#CoGiKgdSmn(0voPTyd zdg5z*)xZ;q$&H9$X##Q=1^ZF@x>_82QBmorQAEH zfE#`1`3Y`kguW3uPY*NCl&N63Cl?*@%ZJ^M_}#K69J%6lnYUPkQ*ja*g(nj3iHxuH zYw1nD;ZCwH|8lznA%s%r|Mv97sUZI(|KyU+FGa(3+S?1dkWbb z`dc#s=<`>nBkNm~9%KISDqODT6G;+W<1sZGTL0yfcspgXl zmdaG`1^n@*j=VF}9D)n8@Q(Ee^ZvvbR9|Nl)-jcw?<`v9$((X~>0{%l@J7(P)ycF{ z^~1GE7~gFdGZ9tT=JkLWFxgUcXEYaQ_r<+rG4OM+RY6O4%(AIXb>bat^Y9RtmKxUNg&Jl_zS7zg~{s6%~It~I-hJeBAaBv zuageW14Y)XxCUWYF&_t6!$goLuT=j@oZo^-;k)qVmITc5Okp_gjDWYAXXjN_9(`BS z!S44R^gI0WGnmDBdSpJ5&0_dmE_(FGL9iCdyt1DE{=2wPWkDbhh0IFU`nC;(`)ry4 zyrJLOf0kGN z0o_+Y(wHR31w_D=TikYEzEN0mTib_e*!s}D6Dj3Fof((f)LA9Aa#?4ww`LA+esRP! zBZrr-j91{kl$|1NR@V9_Y=p|o#acuZ6ipB#x=^7)A}2e-Iwx$Nw~PF-Cajp}GCs;* zIq%~oL_Y3<*IFgZ)xK8$cSFp-9(+&wlufnCHx_%k=d3n)7GWc3L9?JFZ!Oqf=1Ef8d)HMiLv;?op z`E?HxFhbk_OvI?nvie{QeQ5pm2-?3o>1cZL!|g0i?}XGBlJ&a8&ZkZHpT!s?Q!B@K zdsjXCjY>0LllF9c6k3-jW4D2fDtB$Rd!^0_^-x-q$O%TF6Fqqi2ij*mTSc)44`h;t z_aA$UW-{@*Y}ZY0x#=`Nz1#zN6|S?xte+Eyp$CS394w#VI<+VT zG^rh0lu)z0JnUicC4@g=o$zRUS$C^VKqu?cJ0NO+nd7VAmG~!+O)YG!3!BvVI_hT- zPn$()-8?8SXmX-C)f}#ok@us+MKX(guJy*nZug(S@=NfV?M1Ji(e+8)GKs?2F_FD} zss8mfOjhvYL@#a>*X*kT3-#f$1iuOG(879&osqXf(RHhqf|fwyLkZIpw9+C@90na; zz4j@bqsA7{@#B;5Q-gdI_(CDWX>?j7Pr`c1xSC1LcFfqOeU_}7VOT(kzG3o|`R47V zVz^E*LzkQ8&zcP;e6z4F=W0=bBmjaFPIw802y}n$4Q5P9*?7xQJ(!El0}6%OQGw9kCJQ&8+pD^vG3Pcyn|~p%k^NreO8D_ zS3Kn8-mrxI-f0jDGFaz$AupX52_A)pJHL9(^%yHfG(d{ncJKYQX91Y?Q5vKI<8r^H z!^Mb%NW&5fa?x>`7=~Q0CFBqwG{9>WI#ZUcL-2@O3{vNL7 z-J~l1I&c4dtir6ty}!FcrVjOfGlfl_i|sIw44U5}UQ}F)YIfJV5BIsH6%LP|;wp?z zB+HTuYYX5LXY!~{ZCA(klMR#dh-}uX>_eDa9(a<@q&TJQd$<{H(3Y6mOvl~v2FgdY zH+~>Qr}&SB^Y0?67}q7_#=LIdacx=`+U~}t%aU&Kh!owKO#ckY`*UC#*yvNBO-F`M zY+tlHuRU{JdK*^vsU`T;b+eq~NnUmNx)D5iMnDYH^3?I(YfX8YFlu$#uX=74>5~sX z?n6r%jN31UvVFPHGx*qHv8#CzY-_yVKrLy;q}xNnuR#~8ReQ4K=4sUuys#1+PV>*R zu+8q;g2+J3H?N^I>X;0;jvs>!Ez?>^X-8=lF2uGCx`e_3U7@}jDH+{u%mw`vbo-Ztnl4FFZh}4KHb+UI`csgb3H*sKCL;}s*2S* zdYiels&y}o!)31dq`@qAN{W+Mh*~{{#-Ey7hu~W&2yIRV~pCNQ~F86Tj@ z{REG{X6v|}vgm2wRW-YmpCw8)JaIHT+5hU%;IDTJeILkUCKeUZ%nL09wzN)O%(oYL zJR6?%qN=vA43%V@?>3F&gJ#O&@;HCk&iwMNhzoO}!@h(IyhJny1_rQ&Xhg~OJW=;L z`i>mFz_hd*T6yI271#(;PTtj&$Q_!!RdTqv7JcODk(F1Sd_x!|p?`mN?IbI#BDsDM zGo*^|10?J{JO*b&d@N{~-ors)bg8c95KD#6gmZrvlpI2Qpxp!$Ua_~$d%Eid=2u&1 zmVLiRw*E$XP|mmvJ`$-RC4Z&WU|AI>alupLtWB@+7A4?znDps1pU_{3ZO2CnNeDHLLEhzNkgYX4Rl3*P9tX};!(I)Tj z|3rhICvS!KuF6PSfI7V-a+W{`f1cd?y9+Q!tPgf;DX!7{VWQ}4=|mFpIxe)Na7Lh2 zLW|j;hC*7rdv9r5U1)r^HXceA26V~#S`Zau*`2`GsUk3^s2wiHD49iT+I=;p5$MxU z@BIu`k#bk?Z?(y!>fP-oeWAYI?NkSm?L*r16u18|h4e^@Xm9DgPW=EFB%!IiKq0o6 zlR}Aun>hXY8{ZE1d|iqzUXe-=Mvyub`Gko7d$%`!x|_>@K$GYAoRG+-Ydym~z} zSQyVki;&-Fno+H3HWk0&lz7w3!S+?{t2OMCaqxB@r$+np1fB6rc#jftOM!qSwF%4* z^@f-NGdwj7_PS0f*^DaGc~N)*%YOpqF90^zT(+QxmxkBi@0&Dv-N_HC;8+9VRJy8i z8Mt@uK%*VqcK^ugmOz=Hj99J8$w6j zLgq1VuQiCbv!MP8DfqzB+pgl2Ev_1i!8wNy#JsjV>-ql9O7QLQUfsxYcW5tar0R`| zpUmwRh4v?)JBh*P1FY%^;$fAIx|gtv>1*NGe;2>;2N))qOaTLUVIr~6hy;-|W+%=i z)5jtbz5C`9G}Oy5Vf=Ji>%54W3Hqq!1A6_0zj+RRFfB>TY&Raj=|mA=1xELB-b3$s z-^hS#poz3YBYPHd`8fS}4^HbHDjL5-g8-1LANsmE5$NoMbHc8T2h#sMvRoJq=}(aD z`8%DdNZ6dLwd_VgfuHw*vXiIY80{(02+Au6`;&JJM6MR^Twbb>OiU= zj8Yr#_g=Pj{CU%33hl((AHc%-fDxXpI)LLtdYLY#?T-DX8UsCYU=C~Pm0Hs(>FWrj zYX(E#S3o46I1(h`y(dagjC)I~98R6KyCG3mw)6%B1z4%l`T#!`Y{;Ea9{)B{ajWI_ zv0@asGW!`2DkiyR@YzOh5F#?mq{coA$JAJI1yKI@gihR&>c_i{7P97|nO~o*0&D0= zp~asE;RI)oK^J&}D>u(33#$CbBuZ9ylW_MhS?{g3m(zRZ6t8rWL<^(rd0g%iU}Yu) z$USG2;XHI3yHYC)DtGKggy@0Rzq@4ur#}>#du+c^+&+7<6}FyM)1izVJcl~`v2D&N z8`Lj-7vUzmoFTgJ6B5!d`eX$t3GlSG$J48*z1Yt2B+=;I?Dg;6r}LeYx3Jowu?|e) z4uMEAc#;$TZ{Fv&YF^}z4u)1Nzd$Ax`WiC4MAzSyxTsVJs4$NL3L&rd31H<|LN$ik zpA$Q$VWfRFSug*+m;-0yte94I(M!UGgQg-WLFqDdQ$*wQ1j;l{@F%$GV#nvKVaDfd z>f$!_&|qig)L&`e7&R?#?977#>v1YorNyKX6~6^FKaW4AtwU<2Fz=mQ#R-% zY-hxWQWSp;JP_y@HMWTv5fO=Otch z9#o{*4Ows}yw^%U#vJOD>;}4Slv?t!L$|DI-F)9TYw_COV~Z%sfn$aTyrK9Nw|hj+ z0RmAOSf)Pn8t};-qH@T-s0gb=qq*45n?#U{Gl;+Qun;ax}{xYD0MTP71 zRVIISvmg%HY#O-MlVFwq1zM}r0vNlsb*wYi_r-->%r%_#Y&D$G`h=#O#}MvUZ;W3& zh~8m44ZGO)F+8|*0$m5@!T~Sc)Bx{bk!9xWt2D;JwRFd)-lvHjTA`(g_r&gAE7qVj zB0Q|I%l?*c+(qAb?iitkiVYV22f~w&75>yhQ*@EBJ!kLRgedIkKLsF2wz3{JhlnJ& zh_hGw#?}0fcDWGyfKLxRIa`YE!H&$JqCjM1kSnRiY$)ni1zbUz4SQl>E$~){D`*Cw zBu*khy0AmgcIyDG*|}&}*1<{JsVM&y5$pkTczO))4rY=lBi!uJby1=kxeY(ZWuamJ z1MiCv@&{Cb2r=CL=M_bYpB_JN??Pt$nT}|%?a~dwG74ffkA+UKAafulYfwkNeKz4; zF@JtWzFJ!uxs@@A<}c14GS;uzvJ+tHLf2nY1QglOy6|5rVCt0wd*Xbr2GG;ADHv_P zo@p4qtubjxVrdci7*cwG3j%lL<%0i~P@%bKw)E_1urB7!w2hwi!MIMls+jTNifOr9 zhBNU$!SV|?f?tZMEZ)>%W0Ai*ifpALquvYemae?~4(`xJ04L|xY_m7DuKPn4FXI2~ z)&aubNu4i#MJaZO4ha7Fz?gfem0^m;6++VxrtdH&F@wFU!wD8(Wus3BEPy;cPtAyr zKr=DtRMEH?jdGN>&F{)@>t*Dtym1Hf4~P#xHa?|GVqW$H@9Wh8 zGd1KK8UQJ<=ZKm84otg?Dvk5ThQ;U5;k2f3vPrCx1yZO<`0#TlvP8v@k6T))8JFiR zP9giWXH8+`86Jl;FpI2fY*6I*1kz$(St_kq#l>wte*wT4G&}HVd&F^so3Ura2JN_P zjHcLLmW-Z)!qDoKL~hiE_xCD&VE)&|)4jmOu^Q9Ay1nIB&cxP@7dKMAxVz92^_+Dk zV4w3IPSGQpu#j@YxZ=?#OzsYbDe3Qi)dSFs%jJ+Nu+Mre5DD{iOncr1tN|xq+y$Qf z7256F=BB0w7zLq`y9>AvAQN>fTNk|6MtL55ed-OEg#;=p_Vc% z%$y;P{Kp*d1+3LF@S0>gG+hl~-7$5?st-qjt$RJ30fX?{yNGf*nfSo0dIgmti5Cx` zEe~o?l+oTBmg>pL&tLf}I7 zSQzPG)g>9qxT-cE)f7}UX%YF&Cpw4iGSgy+hc_LFAI%CZbnHm%1B_!G#6(uIlIFOG zBS5F3bu(>C%x|Uah``>F8JCG%-`BOz$#cj(4tb zXEW2zODf4{E8=0#P~0!4wgnL-aLPE%pO;}@++O0r3dq3=yvQx+5bQWDzv@H>#O?m_+u8c8zG*g@=qeWKmbBCF9Hxlmg{<#v1r~1U+$hTEF5-;}Zg@vyt zcu=WQn?dJm0*QTtaJ;jIPFpPb$EjP2J#KhGVi?*uj&eXgpCo1E;7Ht-+tD4tOC*iu z2(sT#3Ny?~N4Gy0aWU{Zo$1`n59s^V@Fd=_?eARIa&37(J&CCZ_(D@Ape|jIP5{A6 zhPYz(804!S;}l-tImhp8w6x3Q*LHt)XZ>Qu|3t9K;jZ$9fdeL%;6exWyC`4N`7f&k_M|zs?Si$QS}tq!&=|Nk+}Vy zZWg9)>gxi%O26u^Dv@HDXzAsagbDE+wNvp<^lj=Z1?hNJh5O`HYz4ffY6swvK@f&_ z8McS_cB8-_C_F7K6yUTUBApKdV1<;s#ov!{0>R`UCz!HelEamK9*T@AIgInLI!S{c zFge{5Z3F2B#F-v%4@wC-OwLNfy#6jjG*fX+6|ttdWDw(yL=o!7Ym9>HwhQB+RiHW@ zWMdOS6q5A(FafTK8^rTbp~yqox6pF8YLc}?*Y8NSDI*=-73K8L?0NEY1`u$-xpBY; zrbYO)YON-7b4y$yjc@~4g@F(OHtLE7Cb{aNJL#S5XVZD(vX~#d4~)EXa-KFjDx|W| zw3?!2?j;?RMrYovG7LzV4@fuQj3>alu$A}|C&mq5kG2i`?dK)$?~D!2j6rA9iQxu` zHQgpfB!g3GN@!&4A~l|GjM$UA-p#GPBy%@__p{4{R`w4HZ#RBCqTj9om7(f0D*5qsA_6Jp_MO@@p9oe-o<4mK zSAdZ$RSgbJFuaq8hB%`E9rLRLg*>0NgeBr?8l=dLr8H{Mh!@WKO(M-~JEDfJ}ySl92b z*BOI9;iaX&kI6{MkY&|uM?}5lR*&~Q>><~+%N|1u?034vIM$!8@4MGu4gxLHuL)iM zIFE{_dP6Jy_X&WebIY|dXm*xdu;a$BI;$1ZnQnoDPM50Pr2@!k-+<7kk9nZO_rG`O z+*c}GYZ*#!eN)tc-Gki$QE!VB-}F?$dJHJOE}8;E{Xd}Be?|+>!y&2+YYL4D9m!n1 zzt=Be=+EpE78W)J5;j|d>uGmC+2et03qf@1!pS81uUiehHQXPrQ{k2PJ2qtl=FwEjaGNb2L!=XienVT(S}#Xc=I_31T9^Vw(RmSnjPov^z!U#%WH{>!S%h zH=o;a=YeM28$Z=;QWSiQWMoO2=c-v+=+Zv=J$?`G03L(R5PkfUX%)cqJM_a`?AKPo zi-XmJK<+1ZiF{@69ea^|gwO#nFs;JI27`P465Q97$$b79PHXL0$EmnO7hcvFn&^9n z3h@>g-)hp_V%kkdbPrP|)0Ml;KQ8uWW0d?5ggH!KqyELarN16>6Y>~|YeeRl1MxoLMXpTS- zs59?GGArgcXjTz3IRs<=RcEZ5kOjyF|1cUUhj<>V+^-=>7ftZ;)-$g6)~7annwg&c zZxjXG$`Y6bK_p*(pwipGZ--7LQQW1KvsDyRbFPfS;%`LtOuJSX;HeEzKvuOWjm8CY za}~ooo>JTU+qtUbP~voW9Jy|jHuS$%4YEJ0_!M7V#F;&awLZZ~7imfc>6EMol|C~3 zcXhCTz}cZm@4G=MH4Q`L9?yPItP@Xaw3KtG#>RnIee?IitH1@g>-g;!P*c(G-F6F` zO_~3fTmobT*%(?WsC4q5=c8`N<`cMOY4Q?+1GjAOBWGB+&bR7xLx*(0ZGV8I#c28j zF^M9oO*FD4I=DChdXVe+#07JT<)>&;@aA+ zSc1tvfY~`Z-qpN&v9dq&m<70X!40dbxBE7a{om*LT|$iEw$HLN?pbPL%@!AFF-uE^ zn8f{JQ$&$X!}Zs^TK4Q}5Jgln{?8mDnZbs+l@VWm90UJJtuRyc<6?Cn`;4$O%MrO6 z0tjFP8Q_p!WO&Op9G&}HYt2cA^Y#?Fe+UhOYo%2|goS`>pH}qAzGG%AG2Df#d<3(} zWfW81bV= z!%J#6N&tNU&M_m14^!&NSP>h9>7O~kxjhG0h=FaPzU@ldkWTYx3|;=kO9U~s0SdER@%mdgDQXW}-s)De9-BOjzV-q%BKdZ!#e zFmNY)l4fq+xGG{>&xe8nQu@~FK%#N@?y&F$%L;)MfYh`hcfi-&jRSf$UeF8m6!Fl~ zCed8ihziIU;h<}Jhx@7c!4b?#gB09W$iBt)iA^HppSrUaSsueGX>3yTCa}QnBg>DO z!u=b8H4ISlijn4kFljFkuVpt(KC03`ahD1H&$h(*_8yzOMr;ts%ao>bPf*E}I#y9t zB*Hy#W-ZI4<E&{|~B*v2G7oKhZooza9@GK|@#))R%0?q`z8nT2qufzJ| z*diGqS~p=ZdSPN~^9+~cF_4}8R}7ou(rSahM1p2px2nc52W9`YD|F=GL3-{g_i&;) zw~EM{4*ieMOB24H>);yrmyU%0&Kp!S27dd3zM`7Sru)nNe{n@T$EP5sVx-Q910V_* z0MgDB?NVTq*3!im{>6QjH^)WH>hdSX-dMPMr?c7_vSizVy_(~^X|AfqDcAL{m?7#3 zBE4?tO@OrReV%0gqHPvUg+xw{Hv-)+D#w2~Tiiyt($Zh&k*5z|pui@&u@YuV|Bf-3 z1xE@LXyR`CZ10Mz>ZCER-T0OE+ZQl*Ng#4?bJ@<$OY}7xKhO_H>8yE!srFCruc@mX z2^!Q$YwQ>a475|uF}{a;Qrcqw7iGZVBH3zN_kSn>5EdQSLN}63b1KeGEMh=`8O>Yk6T~srRDHXP=a)7P}rOJLKCtYn|u7vR;(S&V|C~hE?IZzf*W~%xuEqYMwf!N>dLGQWtxJ83=^!6U=g@H z(Njd6<{ETep@(bDI%QETkfp#m<^U>l5lt?N5WxXsz85rWM=i~omI0Fi=#oV85RGpbm;+=XTPp(M-1{7npK7^ z+`&|s7kk{n`5OA61a$;oM~E)=_HEKCSQ0@_Y5AaM%BHAwXYWKyP0ZHX45$C1bt=s3 zOGE)Dtb3qx*UuU2jU$K%NvLg*nIMBF1D!MRm{hh?jrTiwZqL}rQ|sENMqeVugYd`B zg!ncOzleK1O-+I=yC~rSl=WiQ#p7;!wbAFkigmFo=X85LhKvClv0w)ioCqON&okHFK~Q`i8$A+y;+@(r=dwVclX?gPvC90Bd7e2|9R$rFaE#wk5qq{ zG~swUgqeXV7NGsV66gX${q+5yH^awxxCX4~vGTnDhP6NdaJ(UnGy3nBN3#K(LCre~ z%KjICAZ4xfDY{Awgpg`r%YFI>B_+Rx>U{Xv_`mKththNlY*hua@POO_($uk?pw?Cv z%?PKv1AKBmKOr4%zdd<|+gB0Z;Fuaa_7D@5dORxLE!{JM`X_xFGj1$%DG;=uJs1yC zONcm}kluuUx}?C+0oE}ZENZMKo|p3wq>e#-0La%G+HO|X$5DdHSr5dohQX%8fMp(Z zUioR%R0ZcIT^A!f^(vw?fR6-AbX!KCX6!Qbgc{Ubk>lnTa8>Fg;O|0K?E5&C?H9Ks z5&YcE$L=ub5IjT(@LM~o9sB{cRR;iDwSoiAMX{XBWOh4a@B79- zQ_E>urKSc~>Ihj&IqHKNY*V6i=7uLKrQaBw9&(4-#qTV zpa{4NE>qglgPq!OU;1v3>Z$n!D@X@(fs7mS-{KgoRD+vT8$YPu-SybhhUC>3j;*;1 z1L2MY0|vVlz}r%#5PbIpwQ7O?nf(NQJDaH4Inr3oQS?}f9ZVjCxjU=i0vB^S9tLcF zh(~?x0@@j@3oW9_^D!|#;w`StYbxyv*gy<6`@iH5{8sK-?Qkpx&5~SIX-x?x;|%0W zUL>ZTRiA$V>KNVyQ|2&|M_Eo_?P+6A?iw_-zrXoi%&KyhgAbMW07 z&cQPO-3#D10z~BRydOMjz>1lN$>==*K5r1s&ji+5hz;PaODby#20h2p2C@B4Q9XMG2k1P>nRC~iFy zB4}EVDX`7D`jWZV-@&%_V>GhrLNR)EN^SjI(&D*BjWEIPJo4!$ud3--8;)v;L1L|X zcx@_0(geZl5}MpujqKdLXKA_IXn~EcU&t5(;Ds8go!$-`jXka|q~3Z{PWvP7!gg%@ zT+^7JY5Bq4*!UBt^0$uLn<7CLFPp`A#L>509b z?B2eJP2z5_U~kYYi@_YVKOfWaF^@<+vAI8#WCUjQ{%-Av)tF~}j!5X`v=%9e-ZEdM6B2i&BwEI5B{V5&b zX?jCeP5X$JI>0w+rt^VN_$9;!UixQO+n1FlzN&n-+js>D-jmA>N4oLHr{{+~uDb^E zYfj^fcONU*x?eQRdokd2JT6HT6L~Ak3r0b2gSD# zgF^O;JcXXfH;yfj>(n2o3L}2y?w?><4BgB7WsGzXCvy&q8%?bky9rQKv4JVa9l;(X zi^uV#5fAk`J8#Dx@z7$=^=UG4HRj0?II>)fn0eLEeW=?QiRWzsqSg1RBSA7~_4v;oYf^=oK0~+zLlbR!!2hr3Ex3s8x znqqApCK%ch$pm7zMg;J16js(L|_;hhuWF7slZjEQS7NjWFT^diqMjX<;WLg=94aC0KH}gLApBc zz~%$6mg{%qcH%RX-E7V)ifp%S`^Nj+?e13zYwm1X|DX20JD%$Hjla&9vMM7~X33s~ zc>vN8t=lT8j`}g;HJ^j_| z_>B8=-Pe8H*Lc6Ln-0bSCv*TTck0!v#6+GV?<>y? zekEZ{@(ms21-2KIHQC=;x{Bry<7Pa78E_f%SFfNP@^e3({6>v6K!U0A>{>@(&#R;T zPFH&)lrm8KZ=V@GKU3qH@r5c?nNv9P@iP&R5j!f0N}?n#B9izduxf+pteiPM@O$kX z0dZd?QP`1_A!=B&&f~{A0LL$;@oD+7QW2efeC^MMs7$L$e-$Uh(K-i{!tT9cpsaKG z;h^nhDx4Sm?UD8&njp5KF4k2dcWBqE*jnZUX3 z`^dfs?6$=L+f?I@1z3XyoOzi~vnc@nQYgLmQ&qhw)&Y{s2_0kjhAnb_q^|;GMj%lt zg?q}C&8VJXadI)+5Mi6l(w4iCsmjVI3;J_%KJC7((<1hv{gbEXlxM4KT-0yQ#MCu`|a?aeT8N9kB|@M-jypc01JE_D=voX2y@bbAGN z&ls^hg|zUwcg0qVV*;W|ul{7Jop4yCP68a{IWDo&)B4|wwT4&QJu}w(ySUB7<7ypq ze*EQpD(hw243Rpt2=moEK0Xl+<>V8FB|hzqc%-`ANXEk@7HB$cQs&^wON5pxFRSqO zdz=VHRKcyp$qxT{ra*efDdOG)w#sbiuW__ zL*4R=u$V^VAtDYHDjbHD+4lAq!|bU++`k}E)Kumc&(OQ3Q>h~M2CzQ{9SDX#)K8QO$UC?~zyRXT z(8^)_$OiT#18CZXSv}*eynp|SRRs7dRVmVdA^4yD&6mEsfy)u2qYx<#B$M8 z4tv4&qdF-wS#GJ!Pi%NOuFNGW`7eD-##&BG&LU-j7swQMSqi((bO%fq-CQ*vP}W9b z8sInXP5VTs*=RC4fw3UpIpT6xAn=Kk?~fDnM%G=)*cNicOp|C1g9>rm*MI5+q;8nM zLcjta-o{)tXyto&@lY^BxrMc-oAATjye6Mt{7?;?tDKD0zD$K=S$DyiUWI2z)LL>y zWqNLClhCCOneEf<>6!Sg$C?wE+KFpYst*2<>|Q0bLsaFHvzHJz`Oowk7G<=%7W`lo z0;ww;R%b}l9i!WxXHaC|bQgG}I{x(8$fdd=9Nj%BTyt4p5}t_z4Gi%N*O zT^>}|L_d`AZ`~%68suWT?C0NAqEEIlV>Ue=47{FyQRP?KIRFw@I6`c1^{vz&URV^>{8cX(252yJNiLf}uvOo(TTYD=C4(n{1 z9wpyww91EtJI&joZe*uf}ep_lY{92xJ!GRT=ZoyHO5v4qRmcK~xk(XgT8gyzDJ_4KKsisAwS^ z{M9-f$I0dEtDe{5$vf`t&T#Fw~in zb>~Ob2mu*2C>4*dL&GZQ^xB*ae&;#1u-mhB)T;}7F#}`|9x;8G7+Db@`^|Jgrh4Of z6mRX_Q>hBxvIBFyB{mC9cX^O}b}On{Ypb_Tml?juQhnrhIJrMaU;2tM+uhgF2h-(P zE7z3K3zOd&AU(o#q(08ACQ=Z+V`JX2dX+o%=Lux{^7V{aohqF?cKmQy`n_(-^v8uY zQv-to=HZne6f-^zWhBfW=<*LNxEy8s8%;lQuyrJL$643s%m%|Nb);f<1m><@di

j?(uvAoJz5HrVlgu07L?Tt}6q z|d9E+-oU!KR;*g-`K~iJwJhD6w>TKjpe83 z-`26&`t6OO_nSm*`?_)<425ACl;N`9+V(ZYIhpd7xs~H>aAHQRQ|O7v0a2rU^nTPb z)VxwM9fZbhX~Kl+kqB>_8-#H3uIdEGj+(sy$a9?%3N=TV2awqnfXuG*MUSjcd7jYO zXguNLrk3vpr)4I`IQX~$+GFxqx8naM9uVfjy#hyiT#q4z34O` z)od#FG+-9{h#vcwORV40jR)#N$l@)uhDjm6?Nd?V#d|7Bjl-&*T%?*(*LzO==gp0W zUwu)7%z!GY&%~!~V(#6l-H*!9*POT+z;an|D+mkio;o%FzaN$)IPHOd&mn%FPp8|$ z>-XkLi&?Ht%_phYs+{|ACY-oIC; z_g`5r8b=v6#xn9h9XCt2ll--=MBD>-GxOzm<9C=2el2f#)MZao|cwMn28Q1 z&juP4)cuaS&~LXw+=Nw;P54T4ahrb0x89FBv3^F6XPlWGr7>T~jp{zxOFug)zo>M# zn;8=+a#fFMh~;TF#!~_wgEnyMB5WN@c1nb*35E%_#gcN*zV70yc|k4}s^J|cKSRsJ zYk0}R8Rc8G9b_H3VFhYoTG-3=WK;A#1Ljz4PW_XMTlBGhmEn08UBsz>KKj~pMJDN~ zY#Rod8nFV<-l`CsOm&7&zp>Gr`q=W+c}5{9#b#!L`Kz1Tmo^F=zMa^-?onTlyM3^< za!C8xg^Z5xXqLR?%KxblH|s?xqBm!Bzp&|~Dzh8_Dn_!O<&3loPn#2%|Iz+ID{6}B zew5*U<8tBfAi*J@rD845sVudu%C~tp-}IUhEA%c1NcEhkSNZ|Vz>}QKNvqfFYN)IF zkdIcRe3(nPYT!2iVs%R?O%SCr(WhN&{5`f~S=qRyV6pEhdz{Y2S6(jI_x|09uW-m` zwIQ_Ql_ix*^V2euef546z;$xHln2{6(z9-gS8&Mc$4JHsm6xzaH0+IbWw`Oqo90HZ zX!0waoK~5Ebni^X4fd>ZD zexyPs%E2n=c;YnG;jX@$J}&Rjtr0CwXGOnu-I=reo%fBgf=D#lWpgd|o|x+x5qFrA z%UHZVZ3itD+Y~UxzYxyE=CN!QG7;LG_jb&I9SvovWkvdZ5*bRoYLm@JuyrtA1TsSJ zk5eSir)vMjA3M3}yu!?+qwi-p27;AD~loH%NF`+O`!i%Xrx?0ep| zh_P=wM$)sA*d;Q@p;~v})$uG>c;u`1l70g#<>Xfrk#)8~4wS`HFQsy7thwoPw5{_> zV-iJjgbpUL^1tQKW?t8oMqB~T|z<81S%^h~Qr zHoIE47m??^4SPjcpgBS#d3?h&!g1R)VV6cS_2>vPew>wZNfmKYZKM%W9N}W|Bz4b&X6>G(=Zo?S9Ws&*T{hzT9)d#L;>s9^3b_WN+FdrnlP=G##!MEIRYB} z^$ytkNC5K$K=Wl}UWR8*>M=GRh>v4xaQs!cn5gy*#JDie9Rgq7c%u z_Ueex&oK0TD|BL6L_JN6%JXaoi3Y_DF@-RtRmlO0@_ziD+!K`7PR={{@ph^e&Narl z`G`;Prvn04=$mZ&)^iDeECZXQ8rSjytM5S~9!Lb1{LS?EV&q&nvN2|LPl3G0w@uox z>(oxBlo?Z%fXOccY-xFqhBk89txxW1ZNc%Ex+BJVKTKV)M7 z82Q?DsG>}-bNC`1b&yYMV}mc7TZ(&P#cdrjjlB~H*^V%jE(gsoi}g~VcLhmriCKV0 zPD?I8eN~!RtN`tw1EYSk=8%fJ0Ng}mX^TYwFNmu()2f^UxY~)K@2iP|Bb64s&VeGb zY-b`AOwP8)weFj?Cj9%0*0y+b3vzLV>wNXsNeF1-J^vt);A*i9rDNX%Y;0{BGWvsh za{3NkCghb>Mw|V8b|KhD30Nsa-xWUT7o)lc?)4f^-5%q*q}V!uMnAdYjKsr#zE=yr z*UGyx4OyJS7Ql_Ua$zbcc+PGR?J0Q)Og}KfUBl9s|26uPdnx6|iHKQRX+ihGH!Q({ zfh&1JR>p{%obVM&J^wu251!uQla8E;sg&l8d2wi;Uw)u@5FM!Zx4A4OqR2^CGa(gD zJ=ZwoZZKl5PgwkTmfvr?6WWdJHqM?yhPONBHTB^JHG=OhP?F*bkPq_@${rErqkHdY zbP^IeXE<;)4lPO$EW)Vm%@D|Qry*aek}9e(zy0)7^S*P@ZBDet?L_H&AlA1#faTQ7 z)gf8-PmRqShMT8KGaf<9ZRCw`U{>tJx`J#LB<6hv1<#56XN?quM1p0U}&-K zUFd^-`U7%Kf8V0S08^-)BS37%^os$wei3KoTSN+TH{`b1WB;&wh}X*?n6sz(9S9Jc z)}*4gbN_8Q3gGX=&tdoeYvTUZzzE*tM*c4uKSA$u@`)3*4R4<%a0wGTZJeP5 z3m6Lg#iXTN?dIGpVUV!e)F3qYz5CCcaJD6YQM4&WdUfo90%phOGAW}orz6~sRO8KC zCC>a)m%-<#BFFVMfR~yvRu4S*Eb~ug4+z z3it&`L=Bnv)uYOdEJw-@CHLLP08dQQB{mXdX5rXiO@6uZ$dm6zLU zW8l_fvQ8Y`?xU>{bk);IRw9yx3{NE&B=+&fXg^fOMPg2UMQGH26s{QhJ{4GQr%NKg zLCPp;RP~7lj&?2#+6&}+hyUxu?~nTMX{0C|KFtcD#l8ZYx`3@W#=A!VDO1{jpi@`E zw+lBWj?@W>vlxgQIV?a;L>mE7Ex0;8c9570luF7+EZgp2egWjB39G0=%(pi&5!d$h z-e&u>ov!(@51-2p)Cv%ljCezBF=7ZF^pcXh7TiGNd#HgU6!hiYPAzDNbK_o?>G4P; zrl*iMJc@@YwA$t;a)WroYP7AI|dwaF|0b*&zf4Q@_*Kr(B=^yQ|m*Pec*{*LYmlvum?3jIgc@SWDj zVbloO3z?`Tqg^2$`Hh{S0b-;_CO&262R*`pB?$%d1aYXVZc7kZzo%){1&8n^y&pMa z7L|dTxcaSivo_!#`B6w9%jF@~fM`!@Q^^es3WTcH7n4l4ieV2jSw9n=Ptr_8;s7Rv zDoV%2J|bdjka<`A1`qwrpgH7>*hXo_>gPBoRQH;5&n=@In&pN|ABDJiyr{z&lK zY36^6?_<^Koqw!9^xUBL*BT`@-S~f!9;}*@OfCtcHTCCvWK@kSdL8ZXlc;;yMU=!B zlC;SHR^pS-1vijEP2j-ijDxLP=2d8H?D!QZpw;!B_Wfx zG=_mOR0@;6dDeiSn=-rqkIWzw2AZ+ki~{iVHOPkClxZcoamHEU*w;hZ=l{8K8-O0u zms7)$-d1FNLeMn$)fDevY<>$zAHgmNU-f2b^1`=&%TRVvV?&S~Ie#Nvp68sx4vH4u!#N<{)9 z#WY!vd1X;iRAuL|Q)zLo!l9Z}ll7HE3jmt@nI(54fR2GBCB8B(0`YQQTdbeCv-ur= zD8}DKZoHW2t|9|U>q1GH4a!99-pqrNYKmB}$#uA9u47IVs0`KQ0`Vk5ifaOTTQLsS z?@#E}DCx6yUCyD0#-wdcMaK2S`Cdo1lZLJ<`@z^>p>dVO?osQ~z2ZrbW_5ni1Bqy` zLrJxrDG>w8^uRI#l<9DEzwPR+4U%fyBySKL${%<;H%HF1maJ5BiVTw2(F; z^i__e>o1@j4x5_>igy;xD%eXVf5^mxv-k&hNfN{ps3w$cDYTIeixo>zN_5NT3r?O( zJ2+!`x3yuBOmpgH+8YU?n~c1~`YB9&(^q4pFCHKt4TnDsmHkMMvXieWY0OelL@V~X zxok=x2UC;Aq(lu9Z`MYMgh}w*b^0|gTfxKi1>$V|bGPTh0uam{#OJEBopw`nqy4ED^OH}#d5Nv`4K24gW9`1;S*Ap^aW zpkdJ0K;pom49gol^gvN@r!(NMEj`23u*ySWf89B;5AxvLdQT&5^}kLLBZj-M@`aNv z5Kac@?iGx#ajCNYR-e0Y6WlI>hD4i(GhPmKi75@2GDeQ6rw{@p zq+9xc0BNC6)58uOxA3{Ffa%i6kKCig2-jo4@0)~KlemaJj^R;pklJ^0;f#eF9BH~)M(l=sZV%BPMoK|>1r@_qHlNRm*xJJpOVJLO3c zHJM#dPhR~#A0r=l9vIJEprhXS{rINywGsFWG6qMGxpR*O7Xyl5gq&M(uCjd|iQ2bn zPmn2C_EJIAb|Tlzoo$ubB6aEpZH}tX4T^I#;}ioyJt@_*Emg7ON&&>Z>j_dIxv(wL zH5ey)YwW{hhiMj2MTE@$Syt_a*eE4x@-t>VJleTxX|j~K{4cVmx;1=6B)%gUFD#w- z^z+>L*DMQ$mlHT~Eb>_pxd~~2>uLn%sM^ec`chI^t%u!vY_6!KxL0;rwv#>GnQYlw zJV^lqVATvxiwjr7L2FTM7AikIAx*Mq%B08vIMwPtvODWNRum~B z&uzJwCL85hdHv%w%>_Z`7iup_cmG-UR-w`|N0&~!o`uN-906~zZbl-oMH99uErj&E z#(Au%u1fUbq?uB^G$CzKQaz*dtMVdmNCQ&u<^UmVPmHf;uo@0lNFVx+Uh{Vg+Nq6$ zb%$Yx-mI?~D_$r19jZ8YFP!Nfwd2v=8vCV<=_HHQ!GfA$9<3RZUzHkENDs1GwO`>; z7h{)~ZrvEQ9X}B)-bb)Vl0^3ICZhW%B&AG;HdkGq`f>sCFDcyP1YPT)2f_rTI2)<1_N^8ood}Nx`XCq^b2Md)2g^Gy8@z(@>wV zJ*+zH?BAs57>Hvo*sLhMd1~EaiSo*xJuEXC=g(dml(ZohAsb+DM}1uL(%GCjy3O#< zsj#`0QFsw5b9tn^ISh>$(ph2$v8P-x{L!k56R|HX4XVlUC| z4zL^meG6~?b{&R8Yaa&Qv+PDXOWwrTmL~T5H3=GU7Y3ESX~JKHOoy#E#Q>14<$8Cj zQrLaq``DpDiWxmZ)^sJfW<~W_Hpk`7Y^KrnO%9}!Du}5Q5=YwOU8}e#SxUr;0s~v8 z)G`B%c_9sw0pR=05wBk&BThRpm9s;+4TyppN0>jEG^O$WI(VFWv18fN-=YHB&wEz6 z02}mT5E&r`Mo2A_F0Rcd6W9(7C;)>YWl$h)mlO&NBxj=8*7mKMxt>##ff{7(3Vwh) zrpl|PI+b#xc%I<%smeE~dvMlJ-7|i-3E)GJqWJse#lpyz`<{KKhRdUCI{A%mx++@; z=c|bvu>pfRUo6;Db(0u!a`U6)WY}JowX?>=*wL$dj^QFHyS?6&cAB>@|5lU9D*$K# z?Z>kaorPIhSkN?vV{_9JJL-oByp0R`i4mcWdPvRn7oB>B8U)4Z6g8s^kJXt@=v|9` zrOvgy!*+&aR^-D4Ze!}qF6U0Jc1!e^6$wqjfoDJ?2XR9A6Ug#(`SD>{e|h{`Gmv_# zRI^%Ft>zx!$3qQ$I351pj~x!aacd>NkvJ0!U8r8nO5YH7zd!Dk*f~F!k?;|_a#gV6 z?Vg6Pz>JottJ`8HAk75I9s+JR6AgZQ>UBAsUJF>U*=xmCRf}_{2If)|Pr$5GYVV}D<`(#AgSnOz^J3(@Rr&9QgKWXP@(UfaU1_rTy@?3^SdPr~ zCtWBX6Hg&MbAzwv>%u7}llGHE%sL%5k~IzfVaMweRkIL81{{WkxCN_dlS2-7-b6qz zNQcNm{f|zUx+)VIGwQ4FX}nnC+gMyk)ipktXSQ+BeuJ6+zVTz0;}7Sqol?Wwq71i! z>qvb7#*j&2DD(+?LDv2Ahh)^cR?Bqlr(B1Ckq@>HO85?r3}8+bF*5|(`tpDBVNYCz zpeCXg`ryi$?hml)QuV#TTL`Af|t>V9R39^=Bkvy7K(f|5&*;f6#B#;uD7b-j>{ppXJ=unOO} zv04SiWE1n-F5mQZ+p3FOqib3k6)jbp^Da@>*ZK6(cGIU%XkulvGs7a3@=>Yz&fx1W zscbD;oI7lM05y4PcEAmV{wT2%{A2bvv*CsLZFV2^?gNu_O}WxL?yFYY7MD(8m=#!f z6^6*IZ~n2l=8gqgit}66P7;~S6qK_2dw41K*?{T zJ38@mc0CRs+O6HVsuceEywhHeUU5&+ue`3F$REv^yY`|nDVSx*8(npLph-U|KPg}< zxTfs|_O_J_dRBnu@I4wc6mHazXC-T4Udz0|wFDtT zGS%UoROzgFq6hv3`szugUJj1(_9?0f5=ElZWT3HRLU3v~^eYiw^C{zQ)X??}ImU|m zL!--~(x?D!PG7{V=4eA==gjA4j9!o!p$qtuYd0ujf!r_nXh$1tAhG>Th#E}_8Ce6$ z_DBqApf|yIc5(N%-jGx6Y(+C8Zn^?f!mAnQliwOo<*L~xR>B%;P=LLMpa6@*t z;7~8l-TVhm02+6ocOf1W79vp5HcGZx?gl)GgDClft36HSn3|GvDs7( zz!D3rTG4S&c+MU25TPZdHPulL)y2?JqTNI%EQ(sS}tR?-O?n4ysJL0dPcDzw@H!-rS%(XEL4{9Z{e>lGXhJ&onKIS(vD*^HKCC1+I<|uVE=)ch^I?S33kh zEv_^Vw@P2O-Xfe^A6e({F9RCzB+!5Z*oxczkgi3DBdGx^iRb3#C2xJ#Wqu3j!v%&? zlKk10{Pw2xT(Q#)+nOYO|6ZS>J*^an>syaU7?qN;x%-eBuF|Y+^hh|PAb#aF0U;M- zu!u`}I%ZQKlRfBJOBk(CVn>Du!6nDlceQky9Qc|T6^O-!mEVfqd_2k-I)%cCZVT(c zCt4W)?MBX4g!PEpV7wF(f~7_dGWD6H2~|gBEJiwjQG*9$!;2GRW^LY1KF<HX?Vu~&taunvtHx(T< znMEg0G?0v(!r`^X6@9)&4csBc1y2t0hcg75f>o}uxP^;?+xHCNAaF1{5+JOsb~_6X zef<6QqnKz9W@;oaAx@q7mvPgNBwDb*7qIr)Jt2=w|n!@uR$Bl8P=BlKr-XdhoQe z=*^;t$tFM<^weiNAtY%EAtgxJV9vLok}LJ zLvu=a#Rgv`RB5CKFR(`vmPrA;VWlZ()7Y;~=~DH`G;WZ0)G*NhwOr|4^kG5Zu`Ts_Tx^1|J_K_4;l@fF3!ex0^00|x*a!(C^e_qHC@3P#3!MtbF z#!lReyO|`2TOhg6!{2*G!$7n@pAl&*=SZi1Kbe-j+u(_Eh47;m@~Epmm4_Bxwy}Eo zTWSeg)t{v_qmk91G>zOlr1Dg9UgG6AwfS{6K~@;X*ON#hQY3rHQ#*@4y9xDz+BPAq ztO=K3+#f#QFWv6kQdPBKC;>8>$N?Ft$>w)9>uBIUF_+HjG^Qht76PPgKFz(1cFA_n z^40`jx7QJi!EA!?vt$0QRIaa|3`c-e$l+~>3y)t6iQWNS`)=AQB z9ddls*qN}tml~(W^@ZDIf95sZZ=HR+8a;HuI{HF}fzo z@aVhVVxQoqDC)}}JcUx6Vu#Lc$I&9q1fXFU%x8&ZXI*F(WoW9LiDxvvuA2EY{7Hn~ zcVpOZ%jbJixWWor7tmoZPe;y|eKgY5y`@@*mQyHu_}S^O>32kyVl`llw?Z{@%sDNU zf+}8*of@dP5(f!iOe7U7LYpQIpW@}jK`3voEciy}K{Fxcd(=!l6koV$ThqNnvhMbG zytO4MrZCdv%Wwa3sULx(ZabVV04GmPhFG^%RBTs!F#30>F%&{F>2@66g*<*(bS%H~ zsu{+s3<5>#jEyJo)>b@yL9I}D?xkZL-6p=V1o1dfN} zKN@RPCv3b!uNchwyGq7K(TzSKnPsxQujXOv(fe}a#QKky-mvQa{#T!Z4y$vmDEDyu z?nSy+#-0rf;@vTg2qxwO+xBCY+}?5Sun;>_cN2aqEUgQj(qWHh{opxjgq$((u;aZz z7xSCLqX}QgI_#@X$Q??3+*PyZB|`YxSZdFY}6VJS+~ z=j~Dv0HYw!ptM21bMwL!4myrjuHk~CV^{0??=*`U(A16L&2p~ZDA4Sti3z~T$n!*9 z;b?gKG&PB(z*t@sNj&a`l6LIYX4_&PWb?rJUVYCOiKkw0W1hZG1nUZsBgJtjdVc76 zW_vU>ZHhVJVPAg~IU!07_R-gLmxu0Wl$^O5LwK_xcRZ%2jOR4Hu4mTtg^Q`RKtBLI@XSRpe6Qbz~O> z*gF6&#RM|rP#ipK23))vK)`bpwpy#N2`|z6P&1ekbrM-}Tfb)q-)Yy09o}c%Xd&%Q zrfN-AI!qy3i=wGL$VzunOj-3KMM~QDUOIhhb;IZ!=OxnzQ)ljPtS)l&bk} zwD*wW@7c=J46`+*r|U#6J9nr0%p|(V>%E}H$jRM|zNn6Jp}64k;nBa!yvUj-ZubBE zhv+l@Ck@y){u9D~LO=q5|1{x0A^f*H{I?4JTLu5Eg8x>*|EH?}lS;0zN1*SsxtnCn R>pk#KLq+F&zOr@5{{e@yhEo6l literal 0 HcmV?d00001 diff --git a/templates/backstage/basic/skeleton/docs/index.md b/templates/backstage/basic/skeleton/docs/index.md new file mode 100644 index 000000000..6f9f96b78 --- /dev/null +++ b/templates/backstage/basic/skeleton/docs/index.md @@ -0,0 +1,11 @@ +![cnoe logo](./images/cnoe-logo.png) + +# Example Basic Application + +Thanks for trying out this demo! In this example, we deployed a simple application. + +### idpbuilder + +Checkout idpbuilder website: https://cnoe.io/docs/reference-implementation/installations/idpbuilder + +Checkout idpbuilder repository: https://github.com/cnoe-io/idpbuilder diff --git a/templates/backstage/basic/skeleton/manifests/deployment.yaml b/templates/backstage/basic/skeleton/manifests/deployment.yaml new file mode 100644 index 000000000..77b517804 --- /dev/null +++ b/templates/backstage/basic/skeleton/manifests/deployment.yaml @@ -0,0 +1,24 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ${{values.name | dump}} + namespace: default + labels: + entity-id: ${{values.name}} + app: nginx +spec: + replicas: 1 + selector: + matchLabels: + app: nginx + template: + metadata: + labels: + app: nginx + entity-id: ${{values.name}} + spec: + containers: + - name: nginx + image: nginx:1.14.2 + ports: + - containerPort: 80 diff --git a/templates/backstage/basic/template.yaml b/templates/backstage/basic/template.yaml new file mode 100644 index 000000000..f75743ba2 --- /dev/null +++ b/templates/backstage/basic/template.yaml @@ -0,0 +1,58 @@ +apiVersion: scaffolder.backstage.io/v1beta3 +kind: Template +metadata: + description: Creates a Basic Kubernetes Deployment + name: basic + title: Create a Basic Deployment +spec: + owner: guests + type: service + parameters: + - title: Configuration Options + required: + - name + properties: + name: + type: string + description: name of this application + + steps: + - id: template + name: Generating component + action: fetch:template + input: + url: ./skeleton + values: + name: ${{parameters.name}} + + - id: publish + name: Publishing to a gitea git repository + action: publish:gitea + input: + description: This is an example app + # Hard coded value for this demo purposes only. + repoUrl: cnoe.localtest.me:8443/gitea?repo=${{parameters.name}} + defaultBranch: main + - id: create-argocd-app + name: Create ArgoCD App + action: cnoe:create-argocd-app + input: + appName: ${{parameters.name}} + appNamespace: ${{parameters.name}} + argoInstance: in-cluster + projectName: default + # necessary until we generate our own cert + repoUrl: https://cnoe.localtest.me:8443/gitea/giteaAdmin/${{parameters.name}} + path: "manifests" + - id: register + name: Register + action: catalog:register + input: + repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }} + catalogInfoPath: 'catalog-info.yaml' + + output: + links: + - title: Open in catalog + icon: catalog + entityRef: ${{ steps['register'].output.entityRef }} diff --git a/templates/backstage/catalog-info.yaml b/templates/backstage/catalog-info.yaml new file mode 100644 index 000000000..65bfbaf64 --- /dev/null +++ b/templates/backstage/catalog-info.yaml @@ -0,0 +1,20 @@ +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-example-templates + description: A collection of example templates +spec: + targets: + - ./basic/template.yaml + - ./argo-workflows/template.yaml + - ./app-with-bucket/template.yaml + - ./ray-serve/template-ray-serve.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/templates/backstage/organization/guests.yaml b/templates/backstage/organization/guests.yaml new file mode 100644 index 000000000..b1dddfc51 --- /dev/null +++ b/templates/backstage/organization/guests.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: backstage.io/v1alpha1 +kind: User +metadata: + name: guest +spec: + memberOf: [guests] +--- +apiVersion: backstage.io/v1alpha1 +kind: Group +metadata: + name: guests +spec: + type: team + children: [] diff --git a/templates/backstage/ray-serve/sample/pytorch-sample.py b/templates/backstage/ray-serve/sample/pytorch-sample.py new file mode 100644 index 000000000..f37716c62 --- /dev/null +++ b/templates/backstage/ray-serve/sample/pytorch-sample.py @@ -0,0 +1,154 @@ +import os +from typing import Dict + +import torch +from filelock import FileLock +from torch import nn +from torch.utils.data import DataLoader +from torchvision import datasets, transforms +from torchvision.transforms import Normalize, ToTensor +from tqdm import tqdm + +import ray.train +from ray.train import ScalingConfig +from ray.train.torch import TorchTrainer +import ray + + +def get_dataloaders(batch_size): + # Transform to normalize the input images + transform = transforms.Compose([ToTensor(), Normalize((0.5,), (0.5,))]) + + with FileLock(os.path.expanduser("~/data.lock")): + # Download training data from open datasets + training_data = datasets.FashionMNIST( + root="~/data", + train=True, + download=True, + transform=transform, + ) + + # Download test data from open datasets + test_data = datasets.FashionMNIST( + root="~/data", + train=False, + download=True, + transform=transform, + ) + + # Create data loaders + train_dataloader = DataLoader(training_data, batch_size=batch_size, shuffle=True) + test_dataloader = DataLoader(test_data, batch_size=batch_size) + + return train_dataloader, test_dataloader + + +# Model Definition +class NeuralNetwork(nn.Module): + def __init__(self): + super(NeuralNetwork, self).__init__() + self.flatten = nn.Flatten() + self.linear_relu_stack = nn.Sequential( + nn.Linear(28 * 28, 512), + nn.ReLU(), + nn.Dropout(0.25), + nn.Linear(512, 512), + nn.ReLU(), + nn.Dropout(0.25), + nn.Linear(512, 10), + nn.ReLU(), + ) + + def forward(self, x): + x = self.flatten(x) + logits = self.linear_relu_stack(x) + return logits + + +def train_func_per_worker(config: Dict): + lr = config["lr"] + epochs = config["epochs"] + batch_size = config["batch_size_per_worker"] + + # Get dataloaders inside the worker training function + train_dataloader, test_dataloader = get_dataloaders(batch_size=batch_size) + + # [1] Prepare Dataloader for distributed training + # Shard the datasets among workers and move batches to the correct device + # ======================================================================= + train_dataloader = ray.train.torch.prepare_data_loader(train_dataloader) + test_dataloader = ray.train.torch.prepare_data_loader(test_dataloader) + + model = NeuralNetwork() + + # [2] Prepare and wrap your model with DistributedDataParallel + # Move the model to the correct GPU/CPU device + # ============================================================ + model = ray.train.torch.prepare_model(model) + + loss_fn = nn.CrossEntropyLoss() + optimizer = torch.optim.SGD(model.parameters(), lr=lr, momentum=0.9) + + # Model training loop + for epoch in range(epochs): + if ray.train.get_context().get_world_size() > 1: + # Required for the distributed sampler to shuffle properly across epochs. + train_dataloader.sampler.set_epoch(epoch) + + model.train() + for X, y in tqdm(train_dataloader, desc=f"Train Epoch {epoch}"): + pred = model(X) + loss = loss_fn(pred, y) + + optimizer.zero_grad() + loss.backward() + optimizer.step() + + model.eval() + test_loss, num_correct, num_total = 0, 0, 0 + with torch.no_grad(): + for X, y in tqdm(test_dataloader, desc=f"Test Epoch {epoch}"): + pred = model(X) + loss = loss_fn(pred, y) + + test_loss += loss.item() + num_total += y.shape[0] + num_correct += (pred.argmax(1) == y).sum().item() + + test_loss /= len(test_dataloader) + accuracy = num_correct / num_total + + # [3] Report metrics to Ray Train + # =============================== + ray.train.report(metrics={"loss": test_loss, "accuracy": accuracy}) + + +def train_fashion_mnist(num_workers=5, use_gpu=False): + global_batch_size = 32 + + train_config = { + "lr": 1e-3, + "epochs": 1, # artificially set low to finish quickly + "batch_size_per_worker": global_batch_size // num_workers, + } + + # Configure computation resources + scaling_config = ScalingConfig(num_workers=num_workers, use_gpu=use_gpu) + + # Initialize a Ray TorchTrainer + trainer = TorchTrainer( + train_loop_per_worker=train_func_per_worker, + train_loop_config=train_config, + scaling_config=scaling_config, + ) + + # [4] Start distributed training + # Run `train_func_per_worker` on all workers + # ============================================= + result = trainer.fit() + print(f"Training result: {result}") + + +if __name__ == "__main__": + ray.init("auto") + train_fashion_mnist(num_workers=10, use_gpu=False) \ No newline at end of file diff --git a/templates/backstage/ray-serve/skeleton/catalog-info.yaml b/templates/backstage/ray-serve/skeleton/catalog-info.yaml new file mode 100644 index 000000000..c3e56469b --- /dev/null +++ b/templates/backstage/ray-serve/skeleton/catalog-info.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: backstage.io/v1alpha1 +kind: Component +metadata: + name: ${{values.name | dump}} + description: This is for Ray Serve + annotations: + backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}' + backstage.io/kubernetes-namespace: argo + argocd/app-name: ${{values.name | dump}} + argo-workflows.cnoe.io/label-selector: env=dev,entity-id=${{values.name}} + argo-workflows.cnoe.io/cluster-name: local + apache-ray.cnoe.io/label-selector: env=dev,entity-id=${{values.name}} + apache-ray.cnoe.io/cluster-name: local +spec: + owner: guest + lifecycle: experimental + type: service \ No newline at end of file diff --git a/templates/backstage/ray-serve/skeleton/manifests/ray-serve.yaml b/templates/backstage/ray-serve/skeleton/manifests/ray-serve.yaml new file mode 100644 index 000000000..0004f00c9 --- /dev/null +++ b/templates/backstage/ray-serve/skeleton/manifests/ray-serve.yaml @@ -0,0 +1,92 @@ +# Make sure to increase resource requests and limits before using this example in production. +apiVersion: ray.io/v1 +kind: RayService +metadata: + name: "ray-service-${{values.name}}" +spec: + # serveConfigV2 takes a yaml multi-line scalar, which should be a Ray Serve multi-application config. See https://docs.ray.io/en/latest/serve/multi-app.html. + serveConfigV2: | + applications: + - name: text_ml_app + import_path: text_ml.app + route_prefix: /summarize_translate + runtime_env: + working_dir: "${{values.rayServeFile}}" + pip: + - torch + - transformers + deployments: + - name: Translator + num_replicas: 4 + ray_actor_options: + num_cpus: 0.2 + user_config: + language: french + - name: Summarizer + num_replicas: 4 + ray_actor_options: + num_cpus: 0.2 + rayClusterConfig: + rayVersion: '2.34.0' # should match the Ray version in the image of the containers + enableInTreeAutoscaling: true + autoscalerOptions: + upscalingMode: Conservative + idleTimeoutSeconds: 120 + ######################headGroupSpecs################################# + # Ray head pod template. + headGroupSpec: + # The `rayStartParams` are used to configure the `ray start` command. + # See https://github.com/ray-project/kuberay/blob/master/docs/guidance/rayStartParams.md for the default settings of `rayStartParams` in KubeRay. + # See https://docs.ray.io/en/latest/cluster/cli.html#ray-start for all available options in `rayStartParams`. + rayStartParams: + dashboard-host: '0.0.0.0' + #pod template + template: + spec: + containers: + - name: ray-head + image: rayproject/ray:2.34.0 + resources: + limits: + cpu: 1 + memory: 1Gi + requests: + cpu: 1 + memory: 1Gi + ports: + - containerPort: 6379 + name: gcs-server + - containerPort: 8265 # Ray dashboard + name: dashboard + - containerPort: 10001 + name: client + - containerPort: 8000 + name: serve + workerGroupSpecs: + # the pod replicas in this group typed worker + - replicas: 1 + minReplicas: 1 + maxReplicas: 5 + # logical group name, for this called small-group, also can be functional + groupName: small-group + # The `rayStartParams` are used to configure the `ray start` command. + # See https://github.com/ray-project/kuberay/blob/master/docs/guidance/rayStartParams.md for the default settings of `rayStartParams` in KubeRay. + # See https://docs.ray.io/en/latest/cluster/cli.html#ray-start for all available options in `rayStartParams`. + rayStartParams: {} + #pod template + template: + spec: + containers: + - name: ray-worker # must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc' + image: rayproject/ray:2.34.0 + lifecycle: + preStop: + exec: + command: ["/bin/sh","-c","ray stop"] + resources: + limits: + cpu: "1" + memory: "4Gi" + requests: + cpu: "500m" + memory: "2Gi" \ No newline at end of file diff --git a/templates/backstage/ray-serve/template-ray-serve.yaml b/templates/backstage/ray-serve/template-ray-serve.yaml new file mode 100644 index 000000000..f9f619aa3 --- /dev/null +++ b/templates/backstage/ray-serve/template-ray-serve.yaml @@ -0,0 +1,58 @@ +apiVersion: scaffolder.backstage.io/v1beta3 +kind: Template +metadata: + description: Creates Ray Service on Kubernetes + name: ray-serve-kubernetes + title: Ray Service on Kubernetes +spec: + owner: guest + type: service + parameters: + - title: Configuration Options + required: + - name + properties: + name: + type: string + description: Name of this Ray Service + rayServeFile: + type: string + default: "https://github.com/mlops-on-kubernetes/Book/raw/main/Chapter%206/serve-config.zip" + description: Path to your Ray Service Multi-application config zip file + steps: + - id: template + name: Generating component + action: fetch:template + input: + url: ./skeleton + values: + name: ${{parameters.name}} + rayServeFile: ${{parameters.rayServeFile}} + - id: publish + name: Publishing to a gitea git repository + action: publish:gitea + input: + description: This is an Ray Serve app Repo + repoUrl: cnoe.localtest.me:8443/gitea?repo=${{parameters.name}} + defaultBranch: main + - id: create-argocd-app + name: Create ArgoCD App + action: cnoe:create-argocd-app + input: + appName: ${{parameters.name}} + appNamespace: ray + argoInstance: in-cluster + projectName: default + repoUrl: https://cnoe.localtest.me:8443/gitea/giteaAdmin/${{parameters.name}} + path: "manifests" + - id: register + name: Register + action: catalog:register + input: + repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }} + catalogInfoPath: 'catalog-info.yaml' + output: + links: + - title: Open in catalog + icon: catalog + entityRef: ${{ steps['register'].output.entityRef }} \ No newline at end of file diff --git a/terraform/argo-workflows.tf b/terraform/argo-workflows.tf deleted file mode 100644 index 017d6d58c..000000000 --- a/terraform/argo-workflows.tf +++ /dev/null @@ -1,135 +0,0 @@ -#--------------------------------------------------------------- -# Setups to run Data on EKS demo -#--------------------------------------------------------------- -module "data_on_eks_runner_role" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "~> 5.14" - - role_policy_arns = { - policy = "arn:aws:iam::aws:policy/AdministratorAccess" - } - role_name_prefix = "cnoe-external-dns" - oidc_providers = { - main = { - provider_arn = data.aws_iam_openid_connect_provider.eks_oidc.arn - namespace_service_accounts = ["data-on-eks:data-on-eks"] - } - } - tags = var.tags -} - -resource "kubernetes_manifest" "namespace_data_on_eks" { - manifest = { - "apiVersion" = "v1" - "kind" = "Namespace" - "metadata" = { - "name" = "data-on-eks" - } - } -} - -resource "kubernetes_manifest" "serviceaccount_data_on_eks" { - depends_on = [ - kubernetes_manifest.namespace_data_on_eks - ] - manifest = { - "apiVersion" = "v1" - "kind" = "ServiceAccount" - "metadata" = { - "annotations" = { - "eks.amazonaws.com/role-arn" = tostring(module.data_on_eks_runner_role.iam_role_arn) - } - "labels" = { - "app" = "data-on-eks" - } - "name" = "data-on-eks" - "namespace" = "data-on-eks" - } - } -} - - -#--------------------------------------------------------------- -# Argo Workflows -#--------------------------------------------------------------- - -resource "kubernetes_manifest" "namespace_argo_workflows" { - manifest = { - "apiVersion" = "v1" - "kind" = "Namespace" - "metadata" = { - "name" = "argo" - } - } -} - -resource "terraform_data" "argo_workflows_keycloak_setup" { - depends_on = [ - kubectl_manifest.application_argocd_keycloak, - kubernetes_manifest.namespace_argo_workflows - ] - - provisioner "local-exec" { - command = "./install.sh" - - working_dir = "${path.module}/scripts/argo-workflows" - environment = { - "ARGO_WORKFLOWS_REDIRECT_URL" = "${local.argo_redirect_url}" - } - interpreter = ["/bin/bash", "-c"] - } - - provisioner "local-exec" { - when = destroy - - command = "./uninstall.sh" - working_dir = "${path.module}/scripts/argo-workflows" - interpreter = ["/bin/bash", "-c"] - } -} - -resource "kubectl_manifest" "application_argocd_argo_workflows" { - depends_on = [ - terraform_data.argo_workflows_keycloak_setup - ] - - yaml_body = templatefile("${path.module}/templates/argocd-apps/argo-workflows.yaml", { - GITHUB_URL = local.repo_url - KEYCLOAK_CNOE_URL = local.kc_cnoe_url - ARGO_REDIRECT_URL = local.argo_redirect_url - } - ) -} - -resource "kubectl_manifest" "application_argocd_argo_workflows_templates" { - depends_on = [ - terraform_data.argo_workflows_keycloak_setup - ] - - yaml_body = templatefile("${path.module}/templates/argocd-apps/argo-workflows-templates.yaml", { - GITHUB_URL = local.repo_url - } - ) -} - -resource "kubectl_manifest" "application_argocd_argo_workflows_sso_config" { - depends_on = [ - terraform_data.argo_workflows_keycloak_setup - ] - - yaml_body = templatefile("${path.module}/templates/argocd-apps/argo-workflows-sso-config.yaml", { - GITHUB_URL = local.repo_url - } - ) -} - -resource "kubectl_manifest" "ingress_argo_workflows" { - depends_on = [ - kubectl_manifest.application_argocd_argo_workflows, - ] - - yaml_body = templatefile("${path.module}/templates/manifests/ingress-argo-workflows.yaml", { - ARGO_WORKFLOWS_DOMAIN_NAME = local.argo_domain_name - } - ) -} diff --git a/terraform/argocd-ingress.tf b/terraform/argocd-ingress.tf deleted file mode 100644 index dfd01d025..000000000 --- a/terraform/argocd-ingress.tf +++ /dev/null @@ -1,6 +0,0 @@ -resource "kubectl_manifest" "ingress_argocd" { - yaml_body = templatefile("${path.module}/templates/manifests/ingress-argocd.yaml", { - ARGOCD_DOMAIN_NAME = local.argocd_domain_name - } - ) -} diff --git a/terraform/aws-load-balancer.tf b/terraform/aws-load-balancer.tf deleted file mode 100644 index 262ad51d4..000000000 --- a/terraform/aws-load-balancer.tf +++ /dev/null @@ -1,39 +0,0 @@ -module "aws_load_balancer_role" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "~> 5.14" - - role_name_prefix = "cnoe-aws-load-balancer-controller-" - - attach_load_balancer_controller_policy = true - - oidc_providers = { - main = { - provider_arn = data.aws_iam_openid_connect_provider.eks_oidc.arn - namespace_service_accounts = ["aws-load-balancer-controller:aws-load-balancer-controller"] - } - } - tags = var.tags -} - -resource "kubectl_manifest" "application_argocd_aws_load_balancer_controller" { - depends_on = [ module.aws_load_balancer_role ] - yaml_body = templatefile("${path.module}/templates/argocd-apps/aws-load-balancer.yaml", { - CLUSTER_NAME = local.cluster_name - ROLE_ARN = module.aws_load_balancer_role.iam_role_arn - } - ) - - provisioner "local-exec" { - command = "kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/aws-load-balancer-controller" - - interpreter = ["/bin/bash", "-c"] - } - - provisioner "local-exec" { - when = destroy - - command = "kubectl wait --for=delete svc ingress-nginx-controller -n ingress-nginx --timeout=300s" - - interpreter = ["/bin/bash", "-c"] - } -} diff --git a/terraform/backstage.tf b/terraform/backstage.tf deleted file mode 100644 index 24f494f1b..000000000 --- a/terraform/backstage.tf +++ /dev/null @@ -1,80 +0,0 @@ -resource "random_password" "backstage_postgres_password" { - length = 48 - special = true - override_special = "!#" -} - -resource "kubernetes_manifest" "namespace_backstage" { - manifest = { - "apiVersion" = "v1" - "kind" = "Namespace" - "metadata" = { - "name" = "backstage" - } - } -} - -resource "kubernetes_manifest" "secret_backstage_postgresql_config" { - depends_on = [ - kubernetes_manifest.namespace_backstage - ] - - manifest = { - "apiVersion" = "v1" - "kind" = "Secret" - "metadata" = { - "name" = "postgresql-config" - "namespace" = "backstage" - } - "data" = { - "POSTGRES_DB" = "${base64encode("backstage")}" - "POSTGRES_PASSWORD" = "${base64encode(random_password.backstage_postgres_password.result)}" - "POSTGRES_USER" = "${base64encode("backstage")}" - } - } -} - -resource "terraform_data" "backstage_keycloak_setup" { - depends_on = [ - kubectl_manifest.application_argocd_keycloak, - kubernetes_manifest.namespace_backstage - ] - - provisioner "local-exec" { - command = "./install.sh ${random_password.backstage_postgres_password.result} ${local.backstage_domain_name} ${local.kc_domain_name} ${local.argo_domain_name}" - - working_dir = "${path.module}/scripts/backstage" - interpreter = ["/bin/bash", "-c"] - } - - provisioner "local-exec" { - when = destroy - - command = "./uninstall.sh" - - working_dir = "${path.module}/scripts/backstage" - interpreter = ["/bin/bash", "-c"] - } -} - -resource "kubectl_manifest" "application_argocd_backstage" { - depends_on = [ - terraform_data.backstage_keycloak_setup - ] - - yaml_body = templatefile("${path.module}/templates/argocd-apps/backstage.yaml", { - GITHUB_URL = local.repo_url - } - ) -} - -resource "kubectl_manifest" "ingress_backstage" { - depends_on = [ - kubectl_manifest.application_argocd_backstage, - ] - - yaml_body = templatefile("${path.module}/templates/manifests/ingress-backstage.yaml", { - BACKSTAGE_DOMAIN_NAME = local.backstage_domain_name - } - ) -} diff --git a/terraform/cert-manager.tf b/terraform/cert-manager.tf deleted file mode 100644 index b4159b744..000000000 --- a/terraform/cert-manager.tf +++ /dev/null @@ -1,23 +0,0 @@ -resource "kubectl_manifest" "application_argocd_cert_manager" { - yaml_body = templatefile("${path.module}/templates/argocd-apps/cert-manager.yaml", { - REPO_URL = local.repo_url - }) -} - -resource "terraform_data" "wait_for_cert_manager" { - provisioner "local-exec" { - command = "kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/cert-manager && kubectl wait --for=jsonpath=.status.sync.status=Synced --timeout=300s -n argocd application/cert-manager" - } - - depends_on = [kubectl_manifest.application_argocd_cert_manager] -} - -resource "kubectl_manifest" "cluster_issuer_prod" { - depends_on = [ - terraform_data.wait_for_cert_manager, - kubectl_manifest.application_argocd_ingress_nginx - ] - yaml_body = templatefile("${path.module}/templates/manifests/cluster-issuer.yaml", { - REPO_URL = local.repo_url - }) -} diff --git a/terraform/crossplane.tf b/terraform/crossplane.tf deleted file mode 100644 index 78ec1ece9..000000000 --- a/terraform/crossplane.tf +++ /dev/null @@ -1,69 +0,0 @@ -module "crossplane_aws_provider_role" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "~> 5.14" - - role_name_prefix = "cnoe-crossplane-provider-aws" - role_policy_arns = { - policy = "arn:aws:iam::aws:policy/AdministratorAccess" - } - - assume_role_condition_test = "StringLike" - oidc_providers = { - main = { - provider_arn = data.aws_iam_openid_connect_provider.eks_oidc.arn - namespace_service_accounts = ["crossplane-system:provider-aws*"] - } - } - tags = var.tags -} - -resource "kubectl_manifest" "application_argocd_crossplane" { - yaml_body = templatefile("${path.module}/templates/argocd-apps/crossplane.yaml", { - GITHUB_URL = local.repo_url - } - ) - - provisioner "local-exec" { - command = "kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/crossplane --timeout=300s && kubectl wait --for=jsonpath=.status.sync.status=Synced --timeout=300s -n argocd application/crossplane" - - interpreter = ["/bin/bash", "-c"] - } - - provisioner "local-exec" { - when = destroy - - command = "./uninstall.sh" - working_dir = "${path.module}/scripts/crossplane" - interpreter = ["/bin/bash", "-c"] - } -} - -resource "kubectl_manifest" "crossplane_provider_controller_config" { - depends_on = [ - kubectl_manifest.application_argocd_crossplane, - ] - yaml_body = templatefile("${path.module}/templates/manifests/crossplane-aws-controller-config.yaml", { - ROLE_ARN = module.crossplane_aws_provider_role.iam_role_arn - } - ) -} - -resource "kubectl_manifest" "application_argocd_crossplane_provider" { - depends_on = [ - kubectl_manifest.application_argocd_crossplane, - ] - yaml_body = templatefile("${path.module}/templates/argocd-apps/crossplane-provider.yaml", { - GITHUB_URL = local.repo_url - } - ) -} - -resource "kubectl_manifest" "application_argocd_crossplane_compositions" { - depends_on = [ - kubectl_manifest.application_argocd_crossplane, - ] - yaml_body = templatefile("${path.module}/templates/argocd-apps/crossplane-compositions.yaml", { - GITHUB_URL = local.repo_url - } - ) -} diff --git a/terraform/data.tf b/terraform/data.tf deleted file mode 100644 index 58480c2e4..000000000 --- a/terraform/data.tf +++ /dev/null @@ -1,14 +0,0 @@ -data "aws_eks_cluster" "target" { - name = var.cluster_name -} - -data "aws_iam_openid_connect_provider" "eks_oidc" { - url = data.aws_eks_cluster.target.identity[0].oidc[0].issuer -} - -data "aws_route53_zone" "selected" { - count = local.dns_count - zone_id = local.hosted_zone_id -} - -data "aws_caller_identity" "current" {} diff --git a/terraform/external-dns.tf b/terraform/external-dns.tf deleted file mode 100644 index 7ecc2a710..000000000 --- a/terraform/external-dns.tf +++ /dev/null @@ -1,71 +0,0 @@ - -resource "aws_iam_policy" "external-dns" { - count = local.dns_count - - name_prefix = "cnoe-external-dns-" - description = "For use with External DNS Controller" - policy = jsonencode( - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "route53:ChangeResourceRecordSets", - "route53:ListResourceRecordSets", - "route53:ListTagsForResource" - ], - "Resource": [ - "arn:aws:route53:::hostedzone/${local.hosted_zone_id}" - ] - }, - { - "Effect": "Allow", - "Action": [ - "route53:ListHostedZones" - ], - "Resource": [ - "*" - ] - } - ] - } - ) -} - -resource "aws_iam_role_policy_attachment" "external_dns_role_attach" { - count = local.dns_count - - role = module.external_dns_role[0].iam_role_name - policy_arn = aws_iam_policy.external-dns[0].arn -} - -module "external_dns_role" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "~> 5.14" - count = local.dns_count - - role_name_prefix = "cnoe-external-dns" - oidc_providers = { - main = { - provider_arn = data.aws_iam_openid_connect_provider.eks_oidc.arn - namespace_service_accounts = ["external-dns:external-dns"] - } - } - tags = var.tags -} - -resource "kubectl_manifest" "application_argocd_external_dns" { - yaml_body = templatefile("${path.module}/templates/argocd-apps/external-dns.yaml", { - GITHUB_URL = local.repo_url - ROLE_ARN = module.external_dns_role[0].iam_role_arn - DOMAIN_NAME = data.aws_route53_zone.selected[0].name - } - ) - - provisioner "local-exec" { - command = "kubectl wait --for=jsonpath=.status.health.status=Healthy --timeout=300s -n argocd application/external-dns" - - interpreter = ["/bin/bash", "-c"] - } -} diff --git a/terraform/external-secrets.tf b/terraform/external-secrets.tf deleted file mode 100644 index a4631a7d6..000000000 --- a/terraform/external-secrets.tf +++ /dev/null @@ -1,12 +0,0 @@ -resource "kubectl_manifest" "application_argocd_external_secrets" { - yaml_body = templatefile("${path.module}/templates/argocd-apps/external-secrets.yaml", { - GITHUB_URL = local.repo_url - } - ) - - provisioner "local-exec" { - command = "kubectl wait --for=jsonpath=.status.health.status=Healthy --timeout=300s -n argocd application/external-secrets" - - interpreter = ["/bin/bash", "-c"] - } -} diff --git a/terraform/ingress-nginx.tf b/terraform/ingress-nginx.tf deleted file mode 100644 index e77e62621..000000000 --- a/terraform/ingress-nginx.tf +++ /dev/null @@ -1,15 +0,0 @@ -resource "kubectl_manifest" "application_argocd_ingress_nginx" { - depends_on = [ - kubectl_manifest.application_argocd_aws_load_balancer_controller - ] - yaml_body = templatefile("${path.module}/templates/argocd-apps/ingress-nginx.yaml", { - GITHUB_URL = local.repo_url - } - ) - - provisioner "local-exec" { - command = "kubectl wait --for=jsonpath=.status.health.status=Healthy --timeout=300s -n argocd application/ingress-nginx" - - interpreter = ["/bin/bash", "-c"] - } -} diff --git a/terraform/keycloak.tf b/terraform/keycloak.tf deleted file mode 100644 index 66abdd4c6..000000000 --- a/terraform/keycloak.tf +++ /dev/null @@ -1,239 +0,0 @@ - -#--------------------------------------------------------------- -# External Secrets for Keycloak if enabled -#--------------------------------------------------------------- -resource "aws_iam_policy" "external-secrets" { - count = local.secret_count - - name_prefix = "cnoe-external-secrets-" - description = "For use with External Secrets Controller for Keycloak" - policy = jsonencode( - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "secretsmanager:GetResourcePolicy", - "secretsmanager:GetSecretValue", - "secretsmanager:DescribeSecret", - "secretsmanager:ListSecretVersionIds" - ], - "Resource": [ - "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:cnoe/keycloak/*" - ] - } - ] - } - ) -} - -module "external_secrets_role_keycloak" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "~> 5.14" - count = local.secret_count - - role_name_prefix = "cnoe-external-secrets-" - - oidc_providers = { - main = { - provider_arn = data.aws_iam_openid_connect_provider.eks_oidc.arn - namespace_service_accounts = ["keycloak:external-secret-keycloak"] - } - } - tags = var.tags -} - -resource "aws_iam_role_policy_attachment" "external_secrets_role_attach" { - count = local.dns_count - - role = module.external_secrets_role_keycloak[0].iam_role_name - policy_arn = aws_iam_policy.external-secrets[0].arn -} - -# should use gitops really. -resource "kubernetes_manifest" "namespace_keycloak" { - count = local.secret_count - - manifest = { - "apiVersion" = "v1" - "kind" = "Namespace" - "metadata" = { - "name" = "keycloak" - } - } -} - -resource "kubernetes_manifest" "serviceaccount_external_secret_keycloak" { - count = local.secret_count - depends_on = [ - kubernetes_manifest.namespace_keycloak, - kubectl_manifest.application_argocd_external_secrets - ] - - manifest = { - "apiVersion" = "v1" - "kind" = "ServiceAccount" - "metadata" = { - "annotations" = { - "eks.amazonaws.com/role-arn" = tostring(module.external_secrets_role_keycloak[0].iam_role_arn) - } - "name" = "external-secret-keycloak" - "namespace" = "keycloak" - } - } -} - -resource "aws_secretsmanager_secret" "keycloak_config" { - count = local.secret_count - - description = "for use with cnoe keycloak installation" - name = "cnoe/keycloak/config" - recovery_window_in_days = 0 -} - -resource "aws_secretsmanager_secret_version" "keycloak_config" { - count = local.secret_count - - secret_id = aws_secretsmanager_secret.keycloak_config[0].id - secret_string = jsonencode({ - KC_HOSTNAME = local.kc_domain_name - KEYCLOAK_ADMIN_PASSWORD = random_password.keycloak_admin_password.result - POSTGRES_PASSWORD = random_password.keycloak_postgres_password.result - POSTGRES_DB = "keycloak" - POSTGRES_USER = "keycloak" - "user1-password" = random_password.keycloak_user_password.result - }) -} - -resource "kubectl_manifest" "keycloak_secret_store" { - depends_on = [ - kubectl_manifest.application_argocd_aws_load_balancer_controller, - kubectl_manifest.application_argocd_external_secrets, - kubernetes_manifest.serviceaccount_external_secret_keycloak - ] - - yaml_body = templatefile("${path.module}/templates/manifests/keycloak-secret-store.yaml", { - REGION = local.region - } - ) -} - -#--------------------------------------------------------------- -# Keycloak secrets if external secrets is not enabled -#--------------------------------------------------------------- - -resource "kubernetes_manifest" "secret_keycloak_keycloak_config" { - count = local.secret_count == 1 ? 0 : 1 - - manifest = { - "apiVersion" = "v1" - "kind" = "Secret" - "metadata" = { - "name" = "keycloak-config" - "namespace" = "keycloak" - } - "data" = { - "KC_HOSTNAME" = "${base64encode(local.kc_domain_name)}" - "KEYCLOAK_ADMIN_PASSWORD" = "${base64encode(random_password.keycloak_admin_password.result)}" - } - } -} - -resource "kubernetes_manifest" "secret_keycloak_postgresql_config" { - count = local.secret_count == 1 ? 0 : 1 - - manifest = { - "apiVersion" = "v1" - "kind" = "Secret" - "metadata" = { - "name" = "postgresql-config" - "namespace" = "keycloak" - } - "data" = { - "POSTGRES_DB" = "${base64encode("keycloak")}" - "POSTGRES_PASSWORD" = "${base64encode(random_password.keycloak_postgres_password.result)}" - "POSTGRES_USER" = "${base64encode("keycloak")}" - } - } -} - -resource "kubernetes_manifest" "secret_keycloak_keycloak_user_config" { - count = local.secret_count == 1 ? 0 : 1 - - manifest = { - "apiVersion" = "v1" - "kind" = "Secret" - "metadata" = { - "name" = "keycloak-user-config" - "namespace" = "keycloak" - } - "data" = { - "user1-password" = "${base64encode(random_password.keycloak_user_password.result)}" - } - } -} - -#--------------------------------------------------------------- -# Keycloak passwords -#--------------------------------------------------------------- - -resource "random_password" "keycloak_admin_password" { - length = 48 - special = false - override_special = "!#?" -} - -resource "random_password" "keycloak_user_password" { - length = 48 - special = false - override_special = "!#?" -} - -resource "random_password" "keycloak_postgres_password" { - length = 48 - special = false - override_special = "!#?" -} - -#--------------------------------------------------------------- -# Keycloak installation -#--------------------------------------------------------------- - -resource "kubectl_manifest" "application_argocd_keycloak" { - depends_on = [ - kubectl_manifest.keycloak_secret_store, - kubectl_manifest.application_argocd_ingress_nginx - ] - - yaml_body = templatefile("${path.module}/templates/argocd-apps/keycloak.yaml", { - GITHUB_URL = local.repo_url - PATH = "${local.secret_count == 1 ? "packages/keycloak/dev-external-secrets/" : "packages/keycloak/dev/"}" - } - ) - - provisioner "local-exec" { - command = "./install.sh '${random_password.keycloak_user_password.result}' '${random_password.keycloak_admin_password.result}'" - - working_dir = "${path.module}/scripts/keycloak" - interpreter = ["/bin/bash", "-c"] - } - provisioner "local-exec" { - when = destroy - command = "./uninstall.sh" - - working_dir = "${path.module}/scripts/keycloak" - interpreter = ["/bin/bash", "-c"] - } -} - -resource "kubectl_manifest" "ingress_keycloak" { - depends_on = [ - kubectl_manifest.application_argocd_keycloak, - ] - - yaml_body = templatefile("${path.module}/templates/manifests/ingress-keycloak.yaml", { - KEYCLOAK_DOMAIN_NAME = local.kc_domain_name - } - ) -} diff --git a/terraform/main.tf b/terraform/main.tf deleted file mode 100644 index 8babc0f03..000000000 --- a/terraform/main.tf +++ /dev/null @@ -1,36 +0,0 @@ - -locals { - repo_url = trimsuffix(var.repo_url, "/") - region = var.region - tags = var.tags - cluster_name = var.cluster_name - hosted_zone_id = var.hosted_zone_id - dns_count = var.enable_dns_management ? 1 : 0 - secret_count = var.enable_external_secret ? 1 : 0 - - domain_name = var.enable_dns_management ? "${trimsuffix(data.aws_route53_zone.selected[0].name, ".")}" : "${var.domain_name}" - kc_domain_name = "keycloak.${local.domain_name}" - kc_cnoe_url = "https://${local.kc_domain_name}/realms/cnoe" - argo_domain_name = "argo.${local.domain_name}" - argo_redirect_url = "https://${local.argo_domain_name}/oauth2/callback" - argocd_domain_name = "argocd.${local.domain_name}" - backstage_domain_name = "backstage.${local.domain_name}" -} - - -provider "aws" { - region = local.region - default_tags { - tags = local.tags - } -} - -provider "kubernetes" { - config_path = "~/.kube/config" -} - -provider "helm" { - kubernetes { - config_path = "~/.kube/config" - } -} diff --git a/terraform/scripts/argo-workflows/config-payloads/client-payload.json b/terraform/scripts/argo-workflows/config-payloads/client-payload.json deleted file mode 100644 index 2dff8b98d..000000000 --- a/terraform/scripts/argo-workflows/config-payloads/client-payload.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "protocol": "openid-connect", - "clientId": "argo-workflows", - "name": "Argo Workflows Client", - "description": "Used for Argo Workflows SSO", - "publicClient": false, - "authorizationServicesEnabled": false, - "serviceAccountsEnabled": false, - "implicitFlowEnabled": false, - "directAccessGrantsEnabled": true, - "standardFlowEnabled": true, - "frontchannelLogout": true, - "attributes": { - "saml_idp_initiated_sso_url_name": "", - "oauth2.device.authorization.grant.enabled": false, - "oidc.ciba.grant.enabled": false - }, - "alwaysDisplayInConsole": false, - "rootUrl": "", - "baseUrl": "", - "redirectUris": [ - "${ARGO_WORKFLOWS_REDIRECT_URL}" - ], - "webOrigins": [ - "/*" - ] - } - \ No newline at end of file diff --git a/terraform/scripts/argo-workflows/install.sh b/terraform/scripts/argo-workflows/install.sh deleted file mode 100755 index 5a8536172..000000000 --- a/terraform/scripts/argo-workflows/install.sh +++ /dev/null @@ -1,56 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -REPO_ROOT=$(git rev-parse --show-toplevel) - -kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/keycloak -kubectl wait --for=condition=ready pod -l app=keycloak -n keycloak --timeout=30s -echo "Creating keycloak client for Argo Workflows" - -ADMIN_PASSWORD=$(kubectl get secret -n keycloak keycloak-config -o go-template='{{index .data "KEYCLOAK_ADMIN_PASSWORD" | base64decode}}') -kubectl port-forward -n keycloak svc/keycloak 8090:8080 > /dev/null 2>&1 & -pid=$! -trap '{ - rm config-payloads/*-to-be-applied.json || true - kill $pid -}' EXIT -echo "waiting for port forward to be ready" -while ! nc -vz localhost 8090 > /dev/null 2>&1 ; do - sleep 2 -done - -KEYCLOAK_TOKEN=$(curl -sS --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \ ---data-urlencode "username=cnoe-admin" \ ---data-urlencode "password=${ADMIN_PASSWORD}" \ ---data-urlencode "grant_type=password" \ ---data-urlencode "client_id=admin-cli" \ -localhost:8090/realms/master/protocol/openid-connect/token | jq -e -r '.access_token') - -envsubst < config-payloads/client-payload.json > config-payloads/client-payload-to-be-applied.json - -curl -sS -H "Content-Type: application/json" \ --H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ --X POST --data @config-payloads/client-payload-to-be-applied.json \ -localhost:8090/admin/realms/cnoe/clients - -CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \ --H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ --X GET localhost:8090/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "argo-workflows") | .id') - -export CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \ --H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ --X GET localhost:8090/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret') - -CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET localhost:8090/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') - -curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT localhost:8090/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID} - -echo 'storing client secrets to argo namespace' - -envsubst < secret-sso.yaml | kubectl apply -f - - -# If TLS secret is available in /private, use it. Could be empty... -if ls ${REPO_ROOT}/private/argo-workflows-tls-backup-* 1> /dev/null 2>&1; then - TLS_FILE=$(ls -t ${REPO_ROOT}/private/argo-workflows-tls-backup-* | head -n1) - kubectl apply -f ${TLS_FILE} -fi diff --git a/terraform/scripts/argo-workflows/secret-sso.yaml b/terraform/scripts/argo-workflows/secret-sso.yaml deleted file mode 100644 index bfabf6123..000000000 --- a/terraform/scripts/argo-workflows/secret-sso.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: keycloak-oidc - namespace: argo -type: Opaque -stringData: - secret-key: ${CLIENT_SECRET} - client-id: argo-workflows diff --git a/terraform/scripts/argo-workflows/uninstall.sh b/terraform/scripts/argo-workflows/uninstall.sh deleted file mode 100755 index c6266a462..000000000 --- a/terraform/scripts/argo-workflows/uninstall.sh +++ /dev/null @@ -1,49 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -REPO_ROOT=$(git rev-parse --show-toplevel) -NAMESPACE="argo" -LABEL_SELECTOR="controller.cert-manager.io/fao=true" -NAME=argo-workflows - - -echo "backing up TLS secrets to ${REPO_ROOT}/private" - -mkdir -p ${REPO_ROOT}/private -secrets=$(kubectl get secrets -n ${NAMESPACE} -l ${LABEL_SELECTOR} --ignore-not-found) - -if [[ ! -z "${secrets}" ]]; then - kubectl get secrets -n ${NAMESPACE} -l ${LABEL_SELECTOR} -o yaml > ${REPO_ROOT}/private/${NAME}-tls-backup-$(date +%s).yaml -fi - -kubectl delete -f secret-sso.yaml || true - -ADMIN_PASSWORD=$(kubectl get secret -n keycloak keycloak-config -o go-template='{{index .data "KEYCLOAK_ADMIN_PASSWORD" | base64decode}}') - -kubectl port-forward -n keycloak svc/keycloak 8090:8080 > /dev/null 2>&1 & -pid=$! -trap '{ -kill $pid -}' EXIT - -echo "waiting for port forward to be ready" -while ! nc -vz localhost 8090 > /dev/null 2>&1 ; do - sleep 2 -done - -echo 'deleting Keycloak client' -KEYCLOAK_TOKEN=$(curl -sS --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \ - --data-urlencode "username=cnoe-admin" \ - --data-urlencode "password=${ADMIN_PASSWORD}" \ - --data-urlencode "grant_type=password" \ - --data-urlencode "client_id=admin-cli" \ - localhost:8090/realms/master/protocol/openid-connect/token | jq -e -r '.access_token') - -CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X GET localhost:8090/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "argo-workflows") | .id') - -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X DELETE localhost:8090/admin/realms/cnoe/clients/${CLIENT_ID} - diff --git a/terraform/scripts/backstage/config-payloads/client-payload.json b/terraform/scripts/backstage/config-payloads/client-payload.json deleted file mode 100644 index 3363a7a42..000000000 --- a/terraform/scripts/backstage/config-payloads/client-payload.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "protocol": "openid-connect", - "clientId": "backstage", - "name": "Backstage Client", - "description": "Used for Backstage SSO", - "publicClient": false, - "authorizationServicesEnabled": false, - "serviceAccountsEnabled": false, - "implicitFlowEnabled": false, - "directAccessGrantsEnabled": true, - "standardFlowEnabled": true, - "frontchannelLogout": true, - "attributes": { - "saml_idp_initiated_sso_url_name": "", - "oauth2.device.authorization.grant.enabled": false, - "oidc.ciba.grant.enabled": false - }, - "alwaysDisplayInConsole": false, - "rootUrl": "", - "baseUrl": "", - "redirectUris": [ - "https://${BACKSTAGE_DOMAIN_NAME}/api/auth/keycloak-oidc/handler/frame" - ], - "webOrigins": [ - "/*" - ] - } - \ No newline at end of file diff --git a/terraform/scripts/backstage/install.sh b/terraform/scripts/backstage/install.sh deleted file mode 100755 index 65ae0d3c0..000000000 --- a/terraform/scripts/backstage/install.sh +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -REPO_ROOT=$(git rev-parse --show-toplevel) - -export POSTGRES_PASSWORD=${1} -export BACKSTAGE_DOMAIN_NAME=${2} -export KEYCLOAK_DOMAIN_NAME=${3} -export ARGO_WORKFLOWS_DOMAIN_NAME=${4} -export GITHUB_APP_YAML_INDENTED=$(cat ${REPO_ROOT}/private/github-integration.yaml | base64 | sed 's/^/ /') - -kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/keycloak -kubectl wait --for=condition=ready pod -l app=keycloak -n keycloak --timeout=30s -echo "Creating keycloak client for Backstage" - -ADMIN_PASSWORD=$(kubectl get secret -n keycloak keycloak-config -o go-template='{{index .data "KEYCLOAK_ADMIN_PASSWORD" | base64decode}}') - -kubectl port-forward -n keycloak svc/keycloak 8080:8080 > /dev/null 2>&1 & -pid=$! -trap '{ - rm config-payloads/*-to-be-applied.json || true - kill $pid -}' EXIT -echo "waiting for port forward to be ready" -while ! nc -vz localhost 8080 > /dev/null 2>&1 ; do - sleep 2 -done - -KEYCLOAK_TOKEN=$(curl -sS --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \ ---data-urlencode "username=cnoe-admin" \ ---data-urlencode "password=${ADMIN_PASSWORD}" \ ---data-urlencode "grant_type=password" \ ---data-urlencode "client_id=admin-cli" \ -localhost:8080/realms/master/protocol/openid-connect/token | jq -e -r '.access_token') - -envsubst < config-payloads/client-payload.json > config-payloads/client-payload-to-be-applied.json - -curl -sS -H "Content-Type: application/json" \ --H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ --X POST --data @config-payloads/client-payload-to-be-applied.json \ -localhost:8080/admin/realms/cnoe/clients - -CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \ --H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ --X GET localhost:8080/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "backstage") | .id') - -export CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \ --H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ --X GET localhost:8080/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret') - -CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET localhost:8080/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') - -curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT localhost:8080/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID} - -# Get ArgoCD token for Backstage -kubectl port-forward svc/argocd-server -n argocd 8085:80 > /dev/null 2>&1 & -pid=$! -trap '{ - rm config-payloads/*-to-be-applied.json || true - kill $pid -}' EXIT -echo "waiting for port forward to be ready" -while ! nc -vz localhost 8085 > /dev/null 2>&1 ; do - sleep 2 -done - -pass=$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d) - -token=$(curl -sS localhost:8085/api/v1/session -d "{\"username\":\"admin\",\"password\":\"${pass}\"}" | yq .token) - -# THIS DOES NOT EXPIRE. Has read all permissions. -argocdToken=$(curl -sS http://localhost:8085/api/v1/account/backstage/token -X POST -H "Authorization: Bearer ${token}" | yq .token) - -echo 'storing client secrets to backstage namespace' -envsubst < secret-env-var.yaml | kubectl apply -f - -envsubst < secret-integrations.yaml | kubectl apply -f - - -#If TLS secret is available in /private, use it. Could be empty... -if ls ${REPO_ROOT}/private/backstage-tls-backup-* 1> /dev/null 2>&1; then - TLS_FILE=$(ls -t ${REPO_ROOT}/private/backstage-tls-backup-* | head -n1) - kubectl apply -f ${TLS_FILE} -fi diff --git a/terraform/scripts/backstage/secret-env-var.yaml b/terraform/scripts/backstage/secret-env-var.yaml deleted file mode 100644 index 3fe7a4c73..000000000 --- a/terraform/scripts/backstage/secret-env-var.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: backstage-env-vars - namespace: backstage -stringData: - BACKSTAGE_FRONTEND_URL: https://${BACKSTAGE_DOMAIN_NAME} - POSTGRES_HOST: postgresql.backstage.svc.cluster.local - POSTGRES_PORT: '5432' - POSTGRES_USER: backstage - POSTGRES_PASSWORD: '${POSTGRES_PASSWORD}' - ARGO_WORKFLOWS_URL: https://${ARGO_WORKFLOWS_DOMAIN_NAME} - KEYCLOAK_NAME_METADATA: https://${KEYCLOAK_DOMAIN_NAME}/realms/cnoe/.well-known/openid-configuration - KEYCLOAK_CLIENT_SECRET: '${CLIENT_SECRET}' - ARGOCD_AUTH_TOKEN: 'argocd.token=${argocdToken}' - ARGO_CD_URL: 'http://argocd-server.argocd.svc.cluster.local/api/v1/' diff --git a/terraform/scripts/backstage/secret-integrations.yaml b/terraform/scripts/backstage/secret-integrations.yaml deleted file mode 100644 index d192f1f98..000000000 --- a/terraform/scripts/backstage/secret-integrations.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: integrations - namespace: backstage -data: - github-integration.yaml: | -${GITHUB_APP_YAML_INDENTED} diff --git a/terraform/scripts/backstage/uninstall.sh b/terraform/scripts/backstage/uninstall.sh deleted file mode 100755 index 801ef8a33..000000000 --- a/terraform/scripts/backstage/uninstall.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -REPO_ROOT=$(git rev-parse --show-toplevel) -NAMESPACE="backstage" -LABEL_SELECTOR="controller.cert-manager.io/fao=true" -NAME=backstage - -echo "backing up TLS secrets to ${REPO_ROOT}/private" - -mkdir -p ${REPO_ROOT}/private -secrets=$(kubectl get secrets -n ${NAMESPACE} -l ${LABEL_SELECTOR} --ignore-not-found) - -if [[ ! -z "${secrets}" ]]; then - kubectl get secrets -n ${NAMESPACE} -l ${LABEL_SELECTOR} -o yaml > ${REPO_ROOT}/private/${NAME}-tls-backup-$(date +%s).yaml -fi - -ADMIN_PASSWORD=$(kubectl get secret -n keycloak keycloak-config -o go-template='{{index .data "KEYCLOAK_ADMIN_PASSWORD" | base64decode}}') -kubectl port-forward -n keycloak svc/keycloak 8080:8080 > /dev/null 2>&1 & -pid=$! -trap '{ -kill $pid -}' EXIT - -echo "waiting for port forward to be ready" -while ! nc -vz localhost 8080 > /dev/null 2>&1 ; do - sleep 2 -done - -echo 'deleting Keycloak client' -KEYCLOAK_TOKEN=$(curl -sS --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \ - --data-urlencode "username=cnoe-admin" \ - --data-urlencode "password=${ADMIN_PASSWORD}" \ - --data-urlencode "grant_type=password" \ - --data-urlencode "client_id=admin-cli" \ - localhost:8080/realms/master/protocol/openid-connect/token | jq -e -r '.access_token') - -CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X GET localhost:8080/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "backstage") | .id') - -curl -sS --fail-with-body -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X DELETE localhost:8080/admin/realms/cnoe/clients/${CLIENT_ID} diff --git a/terraform/scripts/crossplane/uninstall.sh b/terraform/scripts/crossplane/uninstall.sh deleted file mode 100755 index c872f0b95..000000000 --- a/terraform/scripts/crossplane/uninstall.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -while true; do - provider_count=$(kubectl get --ignore-not-found=true Provider.pkg.crossplane.io | wc -l) - if [ "$provider_count" -eq 0 ]; then - exit 0 - fi - echo "waiting for $provider_count providers to be deleted" - sleep 10 -done diff --git a/terraform/scripts/keycloak/config-payloads/client-scope-groups-payload.json b/terraform/scripts/keycloak/config-payloads/client-scope-groups-payload.json deleted file mode 100644 index 2c11e588e..000000000 --- a/terraform/scripts/keycloak/config-payloads/client-scope-groups-payload.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "name": "groups", - "description": "groups a user belongs to", - "attributes": { - "consent.screen.text": "Access to groups a user belongs to.", - "display.on.consent.screen": "true", - "include.in.token.scope": "true", - "gui.order": "" - }, - "type": "default", - "protocol": "openid-connect" -} \ No newline at end of file diff --git a/terraform/scripts/keycloak/config-payloads/group-admin-payload.json b/terraform/scripts/keycloak/config-payloads/group-admin-payload.json deleted file mode 100644 index 54e6be251..000000000 --- a/terraform/scripts/keycloak/config-payloads/group-admin-payload.json +++ /dev/null @@ -1 +0,0 @@ -{"name":"admin"} \ No newline at end of file diff --git a/terraform/scripts/keycloak/config-payloads/group-base-user-payload.json b/terraform/scripts/keycloak/config-payloads/group-base-user-payload.json deleted file mode 100644 index c56b3aaca..000000000 --- a/terraform/scripts/keycloak/config-payloads/group-base-user-payload.json +++ /dev/null @@ -1 +0,0 @@ -{"name":"base-user"} \ No newline at end of file diff --git a/terraform/scripts/keycloak/config-payloads/group-mapper-payload.json b/terraform/scripts/keycloak/config-payloads/group-mapper-payload.json deleted file mode 100644 index aba916851..000000000 --- a/terraform/scripts/keycloak/config-payloads/group-mapper-payload.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "protocol": "openid-connect", - "protocolMapper": "oidc-group-membership-mapper", - "name": "groups", - "config": { - "claim.name": "groups", - "full.path": "false", - "id.token.claim": "true", - "access.token.claim": "true", - "userinfo.token.claim": "true" - } -} \ No newline at end of file diff --git a/terraform/scripts/keycloak/config-payloads/realm-payload.json b/terraform/scripts/keycloak/config-payloads/realm-payload.json deleted file mode 100644 index 56dd08f6e..000000000 --- a/terraform/scripts/keycloak/config-payloads/realm-payload.json +++ /dev/null @@ -1 +0,0 @@ -{"realm":"cnoe","enabled":true} \ No newline at end of file diff --git a/terraform/scripts/keycloak/config-payloads/user-password.json b/terraform/scripts/keycloak/config-payloads/user-password.json deleted file mode 100644 index fd20bb54f..000000000 --- a/terraform/scripts/keycloak/config-payloads/user-password.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "temporary": false, - "type": "password", - "value": "${USER1_PASSWORD}" -} diff --git a/terraform/scripts/keycloak/config-payloads/user-user1.json b/terraform/scripts/keycloak/config-payloads/user-user1.json deleted file mode 100644 index 105cca483..000000000 --- a/terraform/scripts/keycloak/config-payloads/user-user1.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "username": "user1", - "email": "", - "firstName": "user", - "lastName": "one", - "requiredActions": [], - "emailVerified": false, - "groups": [ - "/admin" - ], - "enabled": true -} diff --git a/terraform/scripts/keycloak/config-payloads/user-user2.json b/terraform/scripts/keycloak/config-payloads/user-user2.json deleted file mode 100644 index b82417af6..000000000 --- a/terraform/scripts/keycloak/config-payloads/user-user2.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "username": "user2", - "email": "", - "firstName": "user", - "lastName": "two", - "requiredActions": [], - "emailVerified": false, - "groups": [ - "/base-user" - ], - "enabled": true -} diff --git a/terraform/scripts/keycloak/install.sh b/terraform/scripts/keycloak/install.sh deleted file mode 100755 index ad47d68a2..000000000 --- a/terraform/scripts/keycloak/install.sh +++ /dev/null @@ -1,97 +0,0 @@ -#!/bin/bash -set -e -o pipefail - -export USER1_PASSWORD=${1} -ADMIN_PASSWORD=${2} -REPO_ROOT=$(git rev-parse --show-toplevel) - -echo "waiting for keycloak to be ready. may take a few minutes" -kubectl wait --for=jsonpath=.status.health.status=Healthy -n argocd application/keycloak --timeout=300s -kubectl wait --for=condition=ready pod -l app=keycloak -n keycloak --timeout=30s - -# Configure keycloak. Might be better to just import -kubectl port-forward -n keycloak svc/keycloak 8080:8080 > /dev/null 2>&1 & -pid=$! - -envsubst < config-payloads/user-password.json > config-payloads/user-password-to-be-applied.json - -# ensure port-forward is killed -trap '{ - rm config-payloads/user-password-to-be-applied.json || true - kill $pid -}' EXIT - -echo "waiting for port forward to be ready" -while ! nc -vz localhost 8080 > /dev/null 2>&1 ; do - sleep 2 -done - -# Default token expires in one minute. May need to extend. very ugly -KEYCLOAK_TOKEN=$(curl -sS --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \ - --data-urlencode "username=cnoe-admin" \ - --data-urlencode "password=${ADMIN_PASSWORD}" \ - --data-urlencode "grant_type=password" \ - --data-urlencode "client_id=admin-cli" \ - localhost:8080/realms/master/protocol/openid-connect/token | jq -e -r '.access_token') -echo "creating cnoe realm and groups" -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @config-payloads/realm-payload.json \ - localhost:8080/admin/realms - -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @config-payloads/client-scope-groups-payload.json \ - localhost:8080/admin/realms/cnoe/client-scopes - -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @config-payloads/group-admin-payload.json \ - localhost:8080/admin/realms/cnoe/groups - -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @config-payloads/group-base-user-payload.json \ - localhost:8080/admin/realms/cnoe/groups - -# Create scope mapper -echo 'adding group claim to tokens' -CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET localhost:8080/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') - -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @config-payloads/group-mapper-payload.json \ - localhost:8080/admin/realms/cnoe/client-scopes/${CLIENT_SCOPE_GROUPS_ID}/protocol-mappers/models - -echo "creating test users" -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @config-payloads/user-user1.json \ - localhost:8080/admin/realms/cnoe/users - -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @config-payloads/user-user2.json \ - localhost:8080/admin/realms/cnoe/users - -USER1ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" 'localhost:8080/admin/realms/cnoe/users?lastName=one' | jq -r '.[0].id') -USER2ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" 'localhost:8080/admin/realms/cnoe/users?lastName=two' | jq -r '.[0].id') - -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X PUT --data @config-payloads/user-password-to-be-applied.json \ - localhost:8080/admin/realms/cnoe/users/${USER1ID}/reset-password - -curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X PUT --data @config-payloads/user-password-to-be-applied.json \ - localhost:8080/admin/realms/cnoe/users/${USER2ID}/reset-password - -# If TLS secret is available in /private, use it. Could be empty... - -if ls ${REPO_ROOT}/private/keycloak-tls-backup-* 1> /dev/null 2>&1; then - TLS_FILE=$(ls -t ${REPO_ROOT}/private/keycloak-tls-backup-* | head -n1) - kubectl apply -f ${TLS_FILE} -fi diff --git a/terraform/scripts/keycloak/uninstall.sh b/terraform/scripts/keycloak/uninstall.sh deleted file mode 100755 index ebf7b72f6..000000000 --- a/terraform/scripts/keycloak/uninstall.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash - -LABEL_SELECTOR="controller.cert-manager.io/fao=true" -APP_NAME=keycloak -NAMESPACE=keycloak -REPO_ROOT=$(git rev-parse --show-toplevel) - -echo "backing up TLS secrets to ${REPO_ROOT}/private" - -mkdir -p ${REPO_ROOT}/private -secrets=$(kubectl get secrets -n ${NAMESPACE} -l ${LABEL_SELECTOR} --ignore-not-found) - -if [[ ! -z "${secrets}" ]]; then - kubectl get secrets -n ${NAMESPACE} -l ${LABEL_SELECTOR} -o yaml > ${REPO_ROOT}/private/${APP_NAME}-tls-backup-$(date +%s).yaml -fi diff --git a/terraform/templates/argocd-apps/argo-workflows-sso-config.yaml b/terraform/templates/argocd-apps/argo-workflows-sso-config.yaml deleted file mode 100644 index 3e5ad584b..000000000 --- a/terraform/templates/argocd-apps/argo-workflows-sso-config.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argo-workflows-sso-config - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - path: packages/argo-workflows-sso-config/dev - destination: - server: "https://kubernetes.default.svc" - namespace: argo - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/argocd-apps/argo-workflows-templates.yaml b/terraform/templates/argocd-apps/argo-workflows-templates.yaml deleted file mode 100644 index 7f54232c4..000000000 --- a/terraform/templates/argocd-apps/argo-workflows-templates.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argo-workflows-templates - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - path: packages/argo-workflows-templates/dev/ - destination: - server: "https://kubernetes.default.svc" - namespace: argo - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/argocd-apps/argo-workflows.yaml b/terraform/templates/argocd-apps/argo-workflows.yaml deleted file mode 100644 index 8033ae0ee..000000000 --- a/terraform/templates/argocd-apps/argo-workflows.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argo-workflows - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - chart: argo-workflows - repoURL: https://argoproj.github.io/argo-helm - targetRevision: 0.31.0 - helm: - releaseName: argo-workflows - valueFiles: - - $values/packages/argo-workflows/dev/values.yaml - parameters: - - name: server.sso.issuer - value: ${KEYCLOAK_CNOE_URL} - - name: server.sso.redirectUrl - value: ${ARGO_REDIRECT_URL} - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - ref: values - destination: - server: "https://kubernetes.default.svc" - namespace: argo - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/argocd-apps/aws-load-balancer.yaml b/terraform/templates/argocd-apps/aws-load-balancer.yaml deleted file mode 100644 index 182af9889..000000000 --- a/terraform/templates/argocd-apps/aws-load-balancer.yaml +++ /dev/null @@ -1,51 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: aws-load-balancer-controller - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - chart: aws-load-balancer-controller - repoURL: https://aws.github.io/eks-charts - targetRevision: 1.5.4 - helm: - releaseName: aws-load-balancer-controller - parameters: - - name: serviceAccount.name - value: aws-load-balancer-controller - - name: clusterName - value: ${CLUSTER_NAME} - - name: serviceAccount.annotations.eks\.amazonaws\.com/role-arn - value: ${ROLE_ARN} - destination: - server: "https://kubernetes.default.svc" - namespace: aws-load-balancer-controller - ignoreDifferences: - - group: "" - kind: Secret - name: aws-load-balancer-webhook - namespace: aws-load-balancer-controller - jsonPointers: - - /data - - group: "admissionregistration.k8s.io" - kind: MutatingWebhookConfiguration - name: aws-load-balancer-webhook - namespace: aws-load-balancer-controller - jsonPointers: - - /webhooks[]/clientConfig/caBundle - - group: "admissionregistration.k8s.io" - kind: ValidatingWebhookConfiguration - name: aws-load-balancer-webhook - namespace: aws-load-balancer-controller - jsonPointers: - - /webhooks[]/clientConfig/caBundle - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true - - RespectIgnoreDifferences=true diff --git a/terraform/templates/argocd-apps/backstage.yaml b/terraform/templates/argocd-apps/backstage.yaml deleted file mode 100644 index 8fe3c9f05..000000000 --- a/terraform/templates/argocd-apps/backstage.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: backstage - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - ignoreDifferences: - - jsonPointers: - - /data/k8s-config.yaml - kind: Secret - name: k8s-config - namespace: backstage - project: cnoe - sources: - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - path: packages/backstage/dev/ - destination: - server: "https://kubernetes.default.svc" - namespace: backstage - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true - - RespectIgnoreDifferences=true diff --git a/terraform/templates/argocd-apps/cert-manager.yaml b/terraform/templates/argocd-apps/cert-manager.yaml deleted file mode 100644 index 4061620d1..000000000 --- a/terraform/templates/argocd-apps/cert-manager.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: cert-manager - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - chart: cert-manager - repoURL: https://charts.jetstack.io - targetRevision: 1.12.2 - helm: - releaseName: cert-manager - valueFiles: - - $values/packages/cert-manager/dev/values.yaml - - repoURL: ${REPO_URL} - targetRevision: HEAD - ref: values - destination: - server: "https://kubernetes.default.svc" - namespace: cert-manager - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/argocd-apps/crossplane-compositions.yaml b/terraform/templates/argocd-apps/crossplane-compositions.yaml deleted file mode 100644 index 6246ee42d..000000000 --- a/terraform/templates/argocd-apps/crossplane-compositions.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: crossplane-compositions - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - source: - repoURL: ${GITHUB_URL} - targetRevision: HEAD - path: packages/crossplane-compositions/dev/ - destination: - server: "https://kubernetes.default.svc" - namespace: crossplane-system - syncPolicy: - automated: {} - syncOptions: [] diff --git a/terraform/templates/argocd-apps/crossplane-provider.yaml b/terraform/templates/argocd-apps/crossplane-provider.yaml deleted file mode 100644 index 71bf4b922..000000000 --- a/terraform/templates/argocd-apps/crossplane-provider.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: crossplane-provider - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - source: - repoURL: ${GITHUB_URL} - targetRevision: HEAD - path: packages/crossplane/dev/ - destination: - server: "https://kubernetes.default.svc" - namespace: crossplane-system - syncPolicy: - automated: {} - syncOptions: [] diff --git a/terraform/templates/argocd-apps/crossplane.yaml b/terraform/templates/argocd-apps/crossplane.yaml deleted file mode 100644 index fc3943ee0..000000000 --- a/terraform/templates/argocd-apps/crossplane.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: crossplane - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - chart: crossplane - repoURL: https://charts.crossplane.io/stable - targetRevision: 1.13.2 - helm: - releaseName: crossplane - valueFiles: - - $values/packages/crossplane/dev/values.yaml - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - ref: values - destination: - server: "https://kubernetes.default.svc" - namespace: crossplane-system - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/argocd-apps/external-dns.yaml b/terraform/templates/argocd-apps/external-dns.yaml deleted file mode 100644 index d3e4917d2..000000000 --- a/terraform/templates/argocd-apps/external-dns.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: external-dns - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - chart: external-dns - repoURL: https://kubernetes-sigs.github.io/external-dns/ - targetRevision: 1.13.0 - helm: - releaseName: external-dns - valueFiles: - - $values/packages/external-dns/dev/values.yaml - parameters: - - name: serviceAccount.annotations.eks\.amazonaws\.com/role-arn - value: ${ROLE_ARN} - - name: domainFilters[0] - value: ${DOMAIN_NAME} - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - ref: values - destination: - server: "https://kubernetes.default.svc" - namespace: external-dns - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/argocd-apps/external-secrets.yaml b/terraform/templates/argocd-apps/external-secrets.yaml deleted file mode 100644 index e697f1ae2..000000000 --- a/terraform/templates/argocd-apps/external-secrets.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: external-secrets - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - chart: external-secrets - repoURL: https://charts.external-secrets.io - targetRevision: "0.9.2" - helm: - releaseName: external-secrets - valueFiles: - - $values/packages/external-secrets/dev/values.yaml - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - ref: values - destination: - server: "https://kubernetes.default.svc" - namespace: external-secrets - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/argocd-apps/ingress-nginx.yaml b/terraform/templates/argocd-apps/ingress-nginx.yaml deleted file mode 100644 index 225411870..000000000 --- a/terraform/templates/argocd-apps/ingress-nginx.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: ingress-nginx - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - chart: ingress-nginx - repoURL: https://kubernetes.github.io/ingress-nginx - targetRevision: 4.7.0 - helm: - releaseName: ingress-nginx - valueFiles: - - $values/packages/ingress-nginx/dev/values.yaml - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - ref: values - destination: - server: "https://kubernetes.default.svc" - namespace: ingress-nginx - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/argocd-apps/keycloak.yaml b/terraform/templates/argocd-apps/keycloak.yaml deleted file mode 100644 index ad4e198c9..000000000 --- a/terraform/templates/argocd-apps/keycloak.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: keycloak - namespace: argocd - labels: - env: dev - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: cnoe - sources: - - repoURL: ${GITHUB_URL} - targetRevision: HEAD - path: ${PATH} - destination: - server: "https://kubernetes.default.svc" - namespace: keycloak - syncPolicy: - automated: {} - syncOptions: - - CreateNamespace=true diff --git a/terraform/templates/manifests/cluster-issuer.yaml b/terraform/templates/manifests/cluster-issuer.yaml deleted file mode 100644 index e2a80c166..000000000 --- a/terraform/templates/manifests/cluster-issuer.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-prod -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-prod - solvers: - - http01: - ingress: - ingressClassName: nginx diff --git a/terraform/templates/manifests/crossplane-aws-controller-config.yaml b/terraform/templates/manifests/crossplane-aws-controller-config.yaml deleted file mode 100644 index 7ca005fa7..000000000 --- a/terraform/templates/manifests/crossplane-aws-controller-config.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: pkg.crossplane.io/v1alpha1 -kind: ControllerConfig -metadata: - name: provider-aws-config - annotations: - eks.amazonaws.com/role-arn: ${ROLE_ARN} -spec: - podSecurityContext: - fsGroup: 2000 - args: - - --debug - - --enable-management-policies diff --git a/terraform/templates/manifests/ingress-argo-workflows.yaml b/terraform/templates/manifests/ingress-argo-workflows.yaml deleted file mode 100644 index 9bcacb072..000000000 --- a/terraform/templates/manifests/ingress-argo-workflows.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argo-workflows - namespace: argo - annotations: - cert-manager.io/cluster-issuer: 'letsencrypt-prod' -spec: - ingressClassName: nginx - tls: - - hosts: - - ${ARGO_WORKFLOWS_DOMAIN_NAME} - secretName: argo-workflows-prod-tls - rules: - - host: ${ARGO_WORKFLOWS_DOMAIN_NAME} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argo-workflows-server - port: - number: 2746 diff --git a/terraform/templates/manifests/ingress-argocd.yaml b/terraform/templates/manifests/ingress-argocd.yaml deleted file mode 100644 index 9ffba3675..000000000 --- a/terraform/templates/manifests/ingress-argocd.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argocd-server-ingress - namespace: argocd - annotations: - cert-manager.io/cluster-issuer: 'letsencrypt-prod' -spec: - ingressClassName: nginx - tls: - - hosts: - - ${ARGOCD_DOMAIN_NAME} - secretName: argocd-prod-tls - rules: - - host: ${ARGOCD_DOMAIN_NAME} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argocd-server - port: - name: https diff --git a/terraform/templates/manifests/ingress-backstage.yaml b/terraform/templates/manifests/ingress-backstage.yaml deleted file mode 100644 index 7a05bdc72..000000000 --- a/terraform/templates/manifests/ingress-backstage.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: backstage - namespace: backstage - annotations: - cert-manager.io/cluster-issuer: 'letsencrypt-prod' -spec: - ingressClassName: nginx - tls: - - hosts: - - ${BACKSTAGE_DOMAIN_NAME} - secretName: backstage-prod-tls - rules: - - host: ${BACKSTAGE_DOMAIN_NAME} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: backstage - port: - number: 7007 diff --git a/terraform/templates/manifests/ingress-keycloak.yaml b/terraform/templates/manifests/ingress-keycloak.yaml deleted file mode 100644 index e33fa9efc..000000000 --- a/terraform/templates/manifests/ingress-keycloak.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: keycloak - namespace: keycloak - annotations: - cert-manager.io/cluster-issuer: 'letsencrypt-prod' -spec: - ingressClassName: nginx - tls: - - hosts: - - ${KEYCLOAK_DOMAIN_NAME} - secretName: keycloak-prod-tls - rules: - - host: ${KEYCLOAK_DOMAIN_NAME} - http: - paths: - - path: /realms/master - pathType: Prefix - backend: - service: - name: keycloak - port: - number: 8081 - - path: / - pathType: Exact - backend: - service: - name: keycloak - port: - number: 8081 - - path: /realms - pathType: Prefix - backend: - service: - name: keycloak - port: - number: 8080 - - path: /resources - pathType: Prefix - backend: - service: - name: keycloak - port: - number: 8080 diff --git a/terraform/templates/manifests/keycloak-secret-store.yaml b/terraform/templates/manifests/keycloak-secret-store.yaml deleted file mode 100644 index c2827a66d..000000000 --- a/terraform/templates/manifests/keycloak-secret-store.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: SecretStore -metadata: - name: keycloak - namespace: keycloak -spec: - provider: - aws: - service: SecretsManager - region: ${REGION} - auth: - jwt: - serviceAccountRef: - name: external-secret-keycloak diff --git a/terraform/variables.tf b/terraform/variables.tf deleted file mode 100644 index 1845ac81f..000000000 --- a/terraform/variables.tf +++ /dev/null @@ -1,56 +0,0 @@ -variable "repo_url" { - description = "Repository URL where application definitions are stored" - default = "https://github.com/manabuOrg/ref-impl" - type = string -} - -variable "tags" { - description = "Tags to apply to AWS resources" - default = { - env = "dev" - project = "cnoe" - } - type = map(string) -} - -variable "region" { - description = "Region" - type = string - default = "us-west-2" -} - -variable "cluster_name" { - description = "EKS Cluster name" - default = "cnoe-ref-impl" - type = string -} - -variable "hosted_zone_id" { - description = "If using external DNS, specify the Route53 hosted zone ID. Required if enable_dns_management is set to true." - default = "Z0202147IFM0KVTW2P35" - type = string -} - -variable "domain_name" { - description = "if external DNS is not used, this value must be provided." - default = "svc.cluster.local" - type = string -} - -variable "organization_url" { - description = "github organization url" - default = "https://github.com/cnoe-io" - type = string -} - -variable "enable_dns_management" { - description = "Do you want to use external dns to manage dns records in Route53?" - default = true - type = bool -} - -variable "enable_external_secret" { - description = "Do you want to use external secret to manage dns records in Route53?" - default = true - type = bool -} diff --git a/terraform/versions.tf b/terraform/versions.tf deleted file mode 100644 index c295c5dac..000000000 --- a/terraform/versions.tf +++ /dev/null @@ -1,22 +0,0 @@ -terraform { - required_version = ">= 1.5.5" - - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 5.17" - } - kubernetes = { - source = "hashicorp/kubernetes" - version = ">= 2.23" - } - random = { - source = "hashicorp/random" - version = ">= 3.5.1" - } - kubectl = { - source = "alekc/kubectl" - version = ">= 2.0.0" - } - } -} From 32beb991b67b3c6943dbd91a24368c088b8eea23 Mon Sep 17 00:00:00 2001 From: Carlos Santana Date: Fri, 25 Jul 2025 15:29:20 -0400 Subject: [PATCH 20/30] Update readme order the steps (#56) update readme order the steps --------- Signed-off-by: Carlos Santana --- README.md | 145 ++++++++++++++++++++++++++++++------------------------ 1 file changed, 80 insertions(+), 65 deletions(-) diff --git a/README.md b/README.md index 2e1ac8c44..cb6927cc1 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,9 @@ -# CNOE AWS Reference Implementation +# AWS Reference Implementation -This project contains a [CNOE](https://cnoe.io) reference implementation for AWS. This project can bring up an Internal Developer Platform on EKS with all the tools configured and ready to use. It will install addons on an EKS cluster as Argo CD apps using GitOps Bridge App of ApplicationSets pattern. Check out the [Getting Started](#getting-started) guide for installing this solution on an EKS cluster. +This project contains an Internal Developer Platform (IDP) reference implementation for AWS. This project can bring up an IDP on EKS with all the tools configured and ready to use in production. It will install addons on an EKS cluster as Argo CD apps using GitOps Bridge App of ApplicationSets pattern. Check out the [Getting Started](#getting-started) guide for installing this solution on an EKS cluster. > [!NOTE] -> Applications deployed in this repository are not meant or configured for production. +> Applications deployed in this repository are a starting point to get environment into production. ## Architecture Overview @@ -20,6 +20,7 @@ All the addons are helm charts with static values configured in `packages/(When not using Auto Mode) | kube-system | aws-load-balancer-controller | [Permissions](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) | -| AWS EBS CSI Controller
(When not using Auto Mode) | kube-system | ebs-csi-controller-sa | [Permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) | +#### 🔐 Configure AWS Credentials +Configure the AWS CLI with credentials of an IAM role which has access to the EKS cluster. Follow the instructions in the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-quickstart.html#getting-started-quickstart-new) to configure the AWS CLI. +If the installation steps are being executed on an EC2 instance, ensure that the EC2 IAM instance role has permissions to access the EKS cluster or the AWS CLI is configured as mentioned above. -> [!NOTE] -> **Using Existing EKS Cluster** -> -> The reference implementation can be installed on an existing EKS Cluster only if the above prerequisites are completed. ### Step 2. 🏢 Create GitHub Organization @@ -162,33 +154,17 @@ Argo CD requires `url` and `installationId` of the GitHub app. The `url` is the > [!NOTE] > The rest of the installation process assumes the GitHub apps credentials are available in `private/backstage-github.yaml` and `private/argocd-github.yaml` -### Step 5. ⚙️ Prepare Environment for Installation - -#### 📦 Install Binaries +#### Step 5. ⚙️ Configure Reference Implementation -The installation requires the following binaries in the local environment: - -+ [**AWS CLI**](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) -+ [**kubectl**](https://kubernetes.io/docs/tasks/tools/) -+ [**yq**](https://mikefarah.gitbook.io/yq/v3.x) -+ [**helm**](https://helm.sh/docs/intro/install/) - -#### 🔐 Configure AWS Credentials -Configure the AWS CLI with credentials of an IAM role which has access to the EKS cluster. Follow the instructions in the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-quickstart.html#getting-started-quickstart-new) to configure the AWS CLI. - -If the installation steps are being executed on an EC2 instance, ensure that the EC2 IAM instance role has permissions to access the EKS cluster or the AWS CLI is configured as mentioned above. - -#### ⚙️ Configure Reference Implementation - -The reference implementation uses **`config.yaml`** file in the repository root directory to configure the installation values. The **`config.yaml`** should be updated with appropriate values before proceeding. Refer to the following table and update all the values appropriately. All the values are required. +The reference implementation uses [config.yaml](config.yaml) file in the repository root directory to configure the installation values. The **`config.yaml`** should be updated with appropriate values before proceeding. Refer to the following table and update all the values appropriately. All the values are required. | Parameter | Description | Type | |-----------|-------------|------| +| `cluster_name` | Name of the EKS cluster for reference implementation
**(The name should satisfy criteria of a valid [kubernetes resource name](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/))** | string | +| `auto_mode` | Set to "true" if EKS cluster is Auto Mode, otherwise "false" | string | | `repo.url` | GitHub URL of the fork in the Github Org | string | | `repo.revision` | Branch or tag which should be used for Argo CD Apps | string | | `repo.basepath` | Directory in which the configuration of addons is stored | string | -| `cluster_name` | Name of the EKS cluster for reference implementation
**(The name should satisfy criteria of a valid [kubernetes resource name](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/))** | string | -| `auto_mode` | Set to "true" if EKS cluster is Auto Mode, otherwise "false" | string | | `region` | AWS Region of the EKS cluster and config secret | string | | `domain` | Base Domain name for exposing services
**(This should be base domain or sub domain of the Route53 Hosted Zone)** | string | | `route53_hosted_zone_id` | Route53 hosted zone ID for configuring external-dns | string | @@ -198,7 +174,8 @@ The reference implementation uses **`config.yaml`** file in the repository root > [!TIP] > If these values are updated after installation, ensure to run the command in the next step to update the values in AWS Secret Manager. Otherwise, the updated values will not reflect in the live installation. -#### 🔒 Create Secrets in AWS Secret Manager + +#### Step 6. 🔒 Create Secrets in AWS Secret Manager The values required for the installation are stored in AWS Secret Manager in two secrets: @@ -214,39 +191,55 @@ Run the command below to create new secrets or update the existing secrets if th > [!WARNING] > **DO NOT** move to next steps without completing all the instructions in this step -### Step 6. 🚀 Installation -> [!NOTE] -> Before moving forward, ensure that the kubectl context is set to the EKS cluster and the configured AWS IAM role has access to the cluster. +### Step 7. ☸️ Create EKS Cluster -#### ▶️ Start the Installation Process +The reference implementation can be installed on a new EKS cluster which can be created like this: -All the addons are installed as Argo CD apps. At the start of the installation, Argo CD and External Secret Operator are installed on the EKS cluster as a helm chart. Once Argo CD on EKS is up, other addons are installed through it and finally the Argo CD on EKS also manages itself and External Secret Operator. Check out more details about the [installation flow](docs/installation_flow.md). Run the following command to start the installation. - ```bash - scripts/install.sh - ``` +```bash +export REPO_ROOT=$(git rev-parse --show-toplevel) +$REPO_ROOT/scripts/create-cluster.sh +``` +You will be prompted to select `eksctl` or `terraform` -#### 📊 Monitor Installation Process +For more details on each type of tools check the corresponding guides: ++ **eksctl**: Follow the [instructions](cluster/eksctl) ++ **terraform**: Follow the [instructions](cluster/terraform/) -The installation script will continue to run until all the Argo CD apps for addons are healthy. To monitor the process, use the instructions below to access the instance of Argo CD running on EKS. +This will create all the prerequisite AWS Resources required for the reference implementation, which includes: -Check if the kubectl context is set to the EKS cluster and it can access the EKS cluster. Then, start the kubernetes port-forward session for the Argo CD service and access the Argo CD UI in a browser. In the Argo CD UI, monitor the health of all Argo CD Apps ++ EKS cluster with Auto Mode or Without Auto Mode (Managed Node Group with 4 nodes) ++ Pod Identity Associations for following Addons: - ```bash - kubectl port-forward -n argocd svc/argocd-server 8080:80 - ``` +| Name | Namespace | Service Account Name | Permissions | +| ----- | --------- | -------------------- | ---------- | +| Crossplane | crossplane-system | provider-aws | Admin Permissions but with [permission boundary](cluster/iam-policies/crossplane-permissions-boundry.json) | +| External Secrets | external-secrets | external-secrets | [Permissions](https://external-secrets.io/latest/provider/aws-secrets-manager/#iam-policy) | +| External DNS | external-dns | external-dns | [Permissions](https://kubernetes-sigs.github.io/external-dns/latest/docs/tutorials/aws/#iam-policy) | +| AWS Load Balancer Controller
(When not using Auto Mode) | kube-system | aws-load-balancer-controller | [Permissions](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) | +| AWS EBS CSI Controller
(When not using Auto Mode) | kube-system | ebs-csi-controller-sa | [Permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) | -Depending upon the configuration, Argo CD will be accessible at http://localhost:8080 or http://localhost:8080/argocd. +> [!NOTE] +> **Using Existing EKS Cluster** +> +> The reference implementation can be installed on an existing EKS Cluster only if the above prerequisites are completed. + + +### Step 8. 🚀 Deployment +> [!NOTE] +> Before moving forward, ensure that the kubectl context is set to the EKS cluster and the configured AWS IAM role has access to the cluster. + +#### ▶️ Start the Installation Process -The credentials for Argo CD can be retrieved with the following command: +All the addons are installed as Argo CD apps. At the start of the installation, Argo CD and External Secret Operator are installed on the EKS cluster as a helm chart. Once Argo CD on EKS is up, other addons are installed through it and finally the Argo CD on EKS also manages itself and External Secret Operator. Check out more details about the [installation flow](docs/installation_flow.md). Run the following command to start the installation. ```bash -kubectl get secrets -n argocd argocd-initial-admin-secret -oyaml | yq '.data.password' | base64 -d && echo +scripts/install.sh ``` -### Step 7. 🌐 Accessing the Platform +### Step 9. 🌐 Accessing the Platform The addons with Web UI are exposed using the base domain configured in [Step 5](#️-configure-reference-implementation). The URLs can be retrieved by running the following command: -``` +```bash scripts/get-urls.sh ``` The URL depends on the setting for `path_routing`. Refer to following table for URLs: @@ -257,7 +250,29 @@ The URL depends on the setting for `path_routing`. Refer to following table for | Argo CD | https://[domain]/argocd | https://argocd.[domain] | | Argo Workflows | https://[domain]/argo-workflows | https://argo-workflows.[domain] | -All the addons are configured with Keycloak SSO USER1 and the user password for it can be retrieved using the following command: + +#### 📊 Monitor Deployment Process + +The installation script will continue to run until all the Argo CD apps for addons are healthy. To monitor the process, use the instructions below to access the instance of Argo CD running on EKS. + +Check if the kubectl context is set to the EKS cluster and it can access the EKS cluster. + +You can use `kubectl` to check the status of the Argo CD applications + +```bash +kubectl get applications -n argocd --watch +``` + +Get the credentials for Argo CD and start a port-forward with this command: + +```bash +kubectl get secrets -n argocd argocd-initial-admin-secret -oyaml | yq '.data.password' | base64 -d && echo +kubectl port-forward -n argocd svc/argocd-server 8080:80 +``` + +Depending upon the configuration, Argo CD will be accessible at http://localhost:8080 or http://localhost:8080/argocd. + +All the addons are configured with Keycloak SSO `user1` and the user password for it can be retrieved using the following command: ```bash kubectl get secret -n keycloak keycloak-config -o jsonpath='{.data.USER1_PASSWORD}' | base64 -d && echo @@ -271,12 +286,12 @@ For troubleshooting, refer to the [troubleshooting guide](docs/troubleshooting.m Run the following command to remove all the addons created by this installation: -``` +```bash scripts/uninstall.sh ``` This script will only remove resources other than CRDs from the EKS cluster so that the same cluster can be used for re-installation which is useful during development. To remove CRDs, use the following command: -``` +```bash scripts/cleanup-crds.sh ``` From b410e88108f29df9fc83c20fd74d2ae25d4c4680 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 14:22:25 -0700 Subject: [PATCH 21/30] Restructure docs (#62) N/A --- README.md | 21 +++++++------- docs/installation_with_idpbuilder.md | 21 +++++++------- examples/app-with-aws-resources.md | 0 examples/demo.md | 43 ++++++++++++++++++++++++++++ 4 files changed, 65 insertions(+), 20 deletions(-) create mode 100644 examples/app-with-aws-resources.md create mode 100644 examples/demo.md diff --git a/README.md b/README.md index cb6927cc1..976a3f381 100644 --- a/README.md +++ b/README.md @@ -134,8 +134,8 @@ Create the following apps and store them in the corresponding file path. | App Name | Purpose | Required Permissions | File Path | Expected Content | | -------- | ------- | -------------------- | --------- | ---------------- | -| Backstage | Used for automatically importing Backstage configuration such as Organization information, templates and creating new repositories for developer applications. | For All Repositories
- Read access to members, metadata, and organization administration
- Read and write access to administration and code | **`private/backstage-github.yaml`** | ![backstage-github-app](docs/images/backstage-github-app.png) | -| Argo CD | Used for deploying resources to cluster specified by Argo CD applications.| For All Repositories
- Read access to checks, code, members, and metadata| **`private/argocd-github.yaml`** | ![argocd-github-app](docs/images/argocd-github-app.png) | +| Backstage | Used for automatically importing Backstage configuration such as Organization information, templates and creating new repositories for developer applications. | For All Repositories - Read access to members, metadata, and organization administration - Read and write access to administration and code | **`private/backstage-github.yaml`** | ![backstage-github-app](docs/images/backstage-github-app.png) | +| Argo CD | Used for deploying resources to cluster specified by Argo CD applications.| For All Repositories - Read access to checks, code, members, and metadata| **`private/argocd-github.yaml`** | ![argocd-github-app](docs/images/argocd-github-app.png) | The template files for both these Github Apps are available in `private` directory. Copy these template files to above mentioned file path by running following command: @@ -160,13 +160,13 @@ The reference implementation uses [config.yaml](config.yaml) file in the reposit | Parameter | Description | Type | |-----------|-------------|------| -| `cluster_name` | Name of the EKS cluster for reference implementation
**(The name should satisfy criteria of a valid [kubernetes resource name](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/))** | string | +| `cluster_name` | Name of the EKS cluster for reference implementation **(The name should satisfy criteria of a valid [kubernetes resource name](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/))** | string | | `auto_mode` | Set to "true" if EKS cluster is Auto Mode, otherwise "false" | string | | `repo.url` | GitHub URL of the fork in the Github Org | string | | `repo.revision` | Branch or tag which should be used for Argo CD Apps | string | | `repo.basepath` | Directory in which the configuration of addons is stored | string | | `region` | AWS Region of the EKS cluster and config secret | string | -| `domain` | Base Domain name for exposing services
**(This should be base domain or sub domain of the Route53 Hosted Zone)** | string | +| `domain` | Base Domain name for exposing services **(This should be base domain or sub domain of the Route53 Hosted Zone)** | string | | `route53_hosted_zone_id` | Route53 hosted zone ID for configuring external-dns | string | | `path_routing` | Enable path routing ("true") vs domain-based routing ("false") | string | | `tags` | Arbitrary key-value pairs for AWS resource tagging | object | @@ -215,8 +215,8 @@ This will create all the prerequisite AWS Resources required for the reference i | Crossplane | crossplane-system | provider-aws | Admin Permissions but with [permission boundary](cluster/iam-policies/crossplane-permissions-boundry.json) | | External Secrets | external-secrets | external-secrets | [Permissions](https://external-secrets.io/latest/provider/aws-secrets-manager/#iam-policy) | | External DNS | external-dns | external-dns | [Permissions](https://kubernetes-sigs.github.io/external-dns/latest/docs/tutorials/aws/#iam-policy) | -| AWS Load Balancer Controller
(When not using Auto Mode) | kube-system | aws-load-balancer-controller | [Permissions](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) | -| AWS EBS CSI Controller
(When not using Auto Mode) | kube-system | ebs-csi-controller-sa | [Permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) | +| AWS Load Balancer Controller (When not using Auto Mode) | kube-system | aws-load-balancer-controller | [Permissions](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) | +| AWS EBS CSI Controller (When not using Auto Mode) | kube-system | ebs-csi-controller-sa | [Permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) | > [!NOTE] > **Using Existing EKS Cluster** @@ -246,9 +246,9 @@ The URL depends on the setting for `path_routing`. Refer to following table for | App Name | URL (w/ Path Routing) | URL (w/o Path Routing) | | --------- | --------- | --------- | -| Backstage | https://[domain] | https://backstage.[domain] | -| Argo CD | https://[domain]/argocd | https://argocd.[domain] | -| Argo Workflows | https://[domain]/argo-workflows | https://argo-workflows.[domain] | +| Backstage | `https://[domain]` | `https://backstage.[domain]` | +| Argo CD | `https://[domain]/argocd` | `https://argocd.[domain]` | +| Argo Workflows | `https://[domain]/argo-workflows` | `https://argo-workflows.[domain]` | #### 📊 Monitor Deployment Process @@ -277,7 +277,8 @@ All the addons are configured with Keycloak SSO `user1` and the user password fo ```bash kubectl get secret -n keycloak keycloak-config -o jsonpath='{.data.USER1_PASSWORD}' | base64 -d && echo ``` -Once all the Argo CD apps on the EKS cluster are reporting healthy status, try out the [examples](docs/examples/) to create a new application through Backstage. + +Once all the Argo CD apps on the EKS cluster are reporting healthy status, try out the [examples](examples/) to create a new application through Backstage. For troubleshooting, refer to the [troubleshooting guide](docs/troubleshooting.md). ## Cleanup diff --git a/docs/installation_with_idpbuilder.md b/docs/installation_with_idpbuilder.md index bbfecb9bc..ea1499632 100644 --- a/docs/installation_with_idpbuilder.md +++ b/docs/installation_with_idpbuilder.md @@ -95,8 +95,8 @@ This will create all the pre-requisite AWS Resources required for the reference | Crossplane | crossplane-system | provider-aws | Admin Permissions but with [permission boundary](cluster/iam-policies/crossplane-permissions-boundry.json) | | External Secrets | external-secrets | external-secrets | [Permissions](https://external-secrets.io/latest/provider/aws-secrets-manager/#iam-policy) | | External DNS | external-dns | external-dns | [Permissions](https://kubernetes-sigs.github.io/external-dns/latest/docs/tutorials/aws/#iam-policy) | -| AWS Load Balancer Controller
(When not using Auto Mode) | kube-system | aws-load-balancer-controller | [Permissions](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) | -| AWS EBS CSI Controller
(When not using Auto Mode) | kube-system | ebs-csi-controller-sa | [Permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) | +| AWS Load Balancer Controller (When not using Auto Mode) | kube-system | aws-load-balancer-controller | [Permissions](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) | +| AWS EBS CSI Controller (When not using Auto Mode) | kube-system | ebs-csi-controller-sa | [Permissions](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEBSCSIDriverPolicy.html) | > [!NOTE] @@ -120,8 +120,8 @@ Create following apps and store it in corresponding file path. | App Name | Purpose | Required Permissions | File Path | Expected Content | | -------- | ------- | -------------------- | --------- | ---------------- | -| Backstage | Used for automatically importing Backstage configuration such as Organization information, templates and creating new repositories for developer applications. | For All Repositories
- Read access to members, metadata, and organization administration
- Read and write access to administration and code | **`private/backstage-github.yaml`** | ![backstage-github-app](docs/images/backstage-github-app.png) | -| Argo CD | Used for deploying resources to cluster specified by Argo CD applications.| For All Repositories
- Read access to checks, code, members, and metadata| **`private/argocd-github.yaml`** | ![argocd-github-app](docs/images/argocd-github-app.png) | +| Backstage | Used for automatically importing Backstage configuration such as Organization information, templates and creating new repositories for developer applications. | For All Repositories - Read access to members, metadata, and organization administration - Read and write access to administration and code | **`private/backstage-github.yaml`** | ![backstage-github-app](images/backstage-github-app.png) | +| Argo CD | Used for deploying resources to cluster specified by Argo CD applications.| For All Repositories - Read access to checks, code, members, and metadata| **`private/argocd-github.yaml`** | ![argocd-github-app](images/argocd-github-app.png) | Argo CD requires `url` and `installationId` of the GitHub app. The `url` is the GitHub URL of the organization. The `installationId` can be captured by navigating to the app installation page with URL `https://github.com/organizations//settings/installations/`. You can find more information [on this page](https://stackoverflow.com/questions/74462420/where-can-we-find-github-apps-installation-id). @@ -172,10 +172,10 @@ The reference implementation uses **`config.yaml`** file in the repository root | `repo.url` | GitHub URL of the fork in Github Org | string | | `repo.revision` | Branch or Tag which should be used for Argo CD Apps | string | | `repo.basepath` | Directory in which configuration of addons is stored | string | -| `cluster_name` | Name of the EKS cluster for reference implementation
**(The name should satisfy criteria of a valid [kubernetes resource name](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/))** | string | +| `cluster_name` | Name of the EKS cluster for reference implementation **(The name should satisfy criteria of a valid [kubernetes resource name](https://kubernetes.io/docs/concepts/overview/working-with-objects/names/))** | string | | `auto_mode` | Set to "true" if EKS cluster is Auto Mode, otherwise "false" | string | | `region` | AWS Region of the EKS cluster and config secret | string | -| `domain` | Base Domain name for exposing services
**(This should be base domain or sub domain of the Route53 Hosted Zone)** | string | +| `domain` | Base Domain name for exposing services **(This should be base domain or sub domain of the Route53 Hosted Zone)** | string | | `route53_hosted_zone_id` | Route53 hosted zone ID for configuring external-dns | string | | `path_routing` | Enable path routing ("true") vs domain-based routing ("false") | string | | `tags` | Arbitrary key-value pairs for AWS resource tagging | object | @@ -242,16 +242,17 @@ The addons are exposed using the base domain configured in [Step 5](#️-configu | App Name | URL (w/ Path Routing) | URL (w/o Path Routing) | | --------- | --------- | --------- | -| Backstage | https://[domain] | https://backstage.[domain] | -| Argo CD | https://[domain]/argocd | https://argocd.[domain] | -| Argo Workflows | https://[domain]/argo-workflows | https://argo-workflows.[domain] | +| Backstage | `https://[domain]` | `https://backstage.[domain]` | +| Argo CD | `https://[domain]/argocd` | `https://argocd.[domain]` | +| Argo Workflows | `https://[domain]/argo-workflows` | `https://argo-workflows.[domain]` | All the addons are configured with Keycloak SSO USER1 and the user password for it can be retrieved using following command: ```bash kubectl get secrets -n keycloak keycloak-config -o go-template='{{range $k,$v := .data}}{{printf "%s: " $k}}{{if not $v}}{{$v}}{{else}}{{$v | base64decode}}{{end}}{{"\n"}}{{end}}' ``` -Once, all the Argo CD apps on EKS cluster are reporting healthy status, try out [examples](docs/examples/) to create new application through Backstage. + +Once, all the Argo CD apps on EKS cluster are reporting healthy status, try out [examples](../examples/) to create new application through Backstage. For troubleshooting, refer to the [troubleshooting guide](docs/troubleshooting.md). ## Cleanup diff --git a/examples/app-with-aws-resources.md b/examples/app-with-aws-resources.md new file mode 100644 index 000000000..e69de29bb diff --git a/examples/demo.md b/examples/demo.md new file mode 100644 index 000000000..4bfe86704 --- /dev/null +++ b/examples/demo.md @@ -0,0 +1,43 @@ +## Backstage template generation + +Using the CNOE CLI, you can generate Backstage template input fields from Terraform modules, Kubernetes CRDs, and Crossplane XRDs. + +### Terraform (imperative) + +For example, to generate input field from a terraform module in the Data on EKS repository: + +```bash +git clone https://github.com/awslabs/data-on-eks.git /tmp/data-on-eks + +cnoe template tf -i /tmp/data-on-eks/analytics/terraform/spark-k8s-operator -o examples/template-generation -t examples/template-generation/data-on-eks.yaml -p '.spec.parameters[0].properties.tfVars' + +``` +The above command takes the terraform module available at `/tmp/data-on-eks/analytics/terraform/spark-k8s-operator` then inserts generated backstage fields into a partially configured template at `examples/template-generation/data-on-eks.yaml`. This partially configure template contains fields that are common to all modules in the Data on EKS repository. + +You can view what fields are generated by using `diff` and `yq`: + +```bash +diff <(yq -P 'sort_keys(..)' -o=props examples/template-generation/spark-k8s-operator.yaml) <(yq -P 'sort_keys(..)' -o=props examples/template-generation/data-on-eks.yaml) +``` + +The rest of this document assumes you've used the spark-k8s-operator module to generate input fields. + +Once the template is hydrated, it is ready to use. You can push it to a private git repository within your organization or push it to a public repository. +You can then register the template in the Backstage UI (`Create...` > `Register Existing Component`) or update your Backstage configuration. The main configuration file is a ConfigMap in the backstage namespace with the name `backstage-config`. + +You can use the template to create a EKS cluster with optimization for data workload using terraform. The example uses a custom Argo Workflows template to run the install script, add a IAM role to the admin group in the cluster, create a Backstage service account, then registers the cluster to Backstage for use. + +The Argo Workflows run is associated with the Backstage entity. So you can check on its status within Backstage. If you'd like to see detailed information about the run, you can click on it to go to the Argo Workflows UI. + +Once the new cluster is ready, you can submit a Spark Job to the new cluster through Backstage. + +### Terraform (declarative) + +You can also use the terraform controller or Crossplane terraform provider to deploy terraform modules. Examples of this will be included in the future. + + +### Crossplane and ACK + +When using Crossplane, the bulk of work is done by Crossplane providers. You can use GitOps tools like ArgoCD to deploy these manifests to the cluster using Backstage scaffolder templates. Examples of this will be included in the future. + + From 1647346288600959cadcd155a0abd80bbdd8e661 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 14:33:17 -0700 Subject: [PATCH 22/30] update readmes (#63) N/A Signed-off-by: Pankaj Walke --- docs/examples/app-with-aws-resources.md | 0 docs/examples/demo.md | 43 --------- docs/examples/spark/pi.yaml | 45 --------- .../template-generation/data-on-eks.yaml | 94 ------------------- docs/installation_with_idpbuilder.md | 1 + 5 files changed, 1 insertion(+), 182 deletions(-) delete mode 100644 docs/examples/app-with-aws-resources.md delete mode 100644 docs/examples/demo.md delete mode 100644 docs/examples/spark/pi.yaml delete mode 100644 docs/examples/template-generation/data-on-eks.yaml diff --git a/docs/examples/app-with-aws-resources.md b/docs/examples/app-with-aws-resources.md deleted file mode 100644 index e69de29bb..000000000 diff --git a/docs/examples/demo.md b/docs/examples/demo.md deleted file mode 100644 index 4bfe86704..000000000 --- a/docs/examples/demo.md +++ /dev/null @@ -1,43 +0,0 @@ -## Backstage template generation - -Using the CNOE CLI, you can generate Backstage template input fields from Terraform modules, Kubernetes CRDs, and Crossplane XRDs. - -### Terraform (imperative) - -For example, to generate input field from a terraform module in the Data on EKS repository: - -```bash -git clone https://github.com/awslabs/data-on-eks.git /tmp/data-on-eks - -cnoe template tf -i /tmp/data-on-eks/analytics/terraform/spark-k8s-operator -o examples/template-generation -t examples/template-generation/data-on-eks.yaml -p '.spec.parameters[0].properties.tfVars' - -``` -The above command takes the terraform module available at `/tmp/data-on-eks/analytics/terraform/spark-k8s-operator` then inserts generated backstage fields into a partially configured template at `examples/template-generation/data-on-eks.yaml`. This partially configure template contains fields that are common to all modules in the Data on EKS repository. - -You can view what fields are generated by using `diff` and `yq`: - -```bash -diff <(yq -P 'sort_keys(..)' -o=props examples/template-generation/spark-k8s-operator.yaml) <(yq -P 'sort_keys(..)' -o=props examples/template-generation/data-on-eks.yaml) -``` - -The rest of this document assumes you've used the spark-k8s-operator module to generate input fields. - -Once the template is hydrated, it is ready to use. You can push it to a private git repository within your organization or push it to a public repository. -You can then register the template in the Backstage UI (`Create...` > `Register Existing Component`) or update your Backstage configuration. The main configuration file is a ConfigMap in the backstage namespace with the name `backstage-config`. - -You can use the template to create a EKS cluster with optimization for data workload using terraform. The example uses a custom Argo Workflows template to run the install script, add a IAM role to the admin group in the cluster, create a Backstage service account, then registers the cluster to Backstage for use. - -The Argo Workflows run is associated with the Backstage entity. So you can check on its status within Backstage. If you'd like to see detailed information about the run, you can click on it to go to the Argo Workflows UI. - -Once the new cluster is ready, you can submit a Spark Job to the new cluster through Backstage. - -### Terraform (declarative) - -You can also use the terraform controller or Crossplane terraform provider to deploy terraform modules. Examples of this will be included in the future. - - -### Crossplane and ACK - -When using Crossplane, the bulk of work is done by Crossplane providers. You can use GitOps tools like ArgoCD to deploy these manifests to the cluster using Backstage scaffolder templates. Examples of this will be included in the future. - - diff --git a/docs/examples/spark/pi.yaml b/docs/examples/spark/pi.yaml deleted file mode 100644 index 39b7202ae..000000000 --- a/docs/examples/spark/pi.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: sparkoperator.k8s.io/v1beta2 -kind: SparkApplication -metadata: - name: pyspark-pi-karpenter -spec: - type: Python - pythonVersion: "3" - mode: cluster - image: public.ecr.aws/r1l5w1y9/spark-operator:3.2.1-hadoop-3.3.1-java-11-scala-2.12-python-3.8-latest - imagePullPolicy: Always - mainApplicationFile: local:///opt/spark/examples/src/main/python/pi.py - sparkVersion: 3.1.1 - restartPolicy: - type: OnFailure - onFailureRetries: 1 - onFailureRetryInterval: 10 - onSubmissionFailureRetries: 5 - onSubmissionFailureRetryInterval: 20 - driver: - cores: 1 - coreLimit: 1200m - memory: 512m - labels: - version: 3.1.1 - serviceAccount: spark - nodeSelector: - NodeGroupType: spark-spot-ca - tolerations: - - key: spark-spot-ca - operator: Exists - effect: NoSchedule - executor: - cores: 1 - instances: 2 - memory: 512m - serviceAccount: spark - labels: - version: 3.1.1 - nodeSelector: - NodeGroupType: spark-spot-ca - tolerations: - - key: spark-spot-ca - operator: Exists - effect: NoSchedule - diff --git a/docs/examples/template-generation/data-on-eks.yaml b/docs/examples/template-generation/data-on-eks.yaml deleted file mode 100644 index c994c3b52..000000000 --- a/docs/examples/template-generation/data-on-eks.yaml +++ /dev/null @@ -1,94 +0,0 @@ -apiVersion: scaffolder.backstage.io/v1beta3 -kind: Template -metadata: - description: Creates a EKS cluster with Spark Operator + extra enabled through Terraform - name: data-on-eks-spark - title: Data on EKS - Spark Operator -spec: - owner: guest - type: service - parameters: - - title: Terraform config options - properties: - tfVars: # this field is to be generated. - title: Terraform variables - type: object - - title: Configuration Options - properties: - name: - title: name of this entry - type: string - namespace: - title: namespace within the kubernetes cluster to deploy this - type: string - default: data-on-eks - adminRoleName: # update the aws-config cm to give admin access to this group. - title: Admin Role Name - description: Name of the role to give the administrative rights on the EKS cluster. - default: Admin - type: string - clusterName: - title: Cluster to run - description: The cluster to run this workflow in. - type: string - ui:field: KubernetesClusterPicker - repoUrl: # need a place to store this entity information. - title: Repository Location - type: string - ui:field: RepoUrlPicker - ui:options: - allowedHosts: - - github.com - steps: - - id: create-repo - name: Create Repository - action: github:repo:create - input: - repoUrl: ${{ parameters.repoUrl }} - - id: fetch-base - name: Fetch Base - action: fetch:template - input: - url: ./data-on-eks - values: - name: ${{ parameters.name }} - namespace: ${{ parameters.namespace }} - tfVars: ${{ parameters.tfVars }} - adminRoleName: ${{parameters.adminRoleName}} - clusterName: ${{ parameters.clusterName }} - - id: init-repo - name: Initialize Repository - action: github:repo:push - input: - repoUrl: ${{ parameters.repoUrl }} - defaultBranch: main - - id: wait - name: Waiting for the repo to be ready - action: "roadiehq:utils:sleep" - input: - amount: 5 - - id: register - name: Register - action: catalog:register - input: - repoContentsUrl: ${{ steps['init-repo'].output.repoContentsUrl }} - catalogInfoPath: '/catalog-info.yaml' - - id: apply-cm - name: Apply TF variables CM - action: cnoe:kubernetes:apply - input: - manifestPath: cm.yaml # this contains tfvar json file. - namespaced: true - clusterName: ${{ parameters.clusterName }} - - id: apply-workflow - name: Start TF workflow - action: cnoe:kubernetes:apply - input: - manifestPath: workflow.yaml # initiates an argo workflows run. - namespaced: true - clusterName: ${{ parameters.clusterName }} - output: - links: - - title: Open in catalog - icon: catalog - entityRef: ${{ steps['register'].output.entityRef }} diff --git a/docs/installation_with_idpbuilder.md b/docs/installation_with_idpbuilder.md index ea1499632..641502ba0 100644 --- a/docs/installation_with_idpbuilder.md +++ b/docs/installation_with_idpbuilder.md @@ -1,3 +1,4 @@ +# IDPBuilder installation ## Installation Flow Diagram This diagram illustrates the high-level installation flow for the CNOE AWS Reference Implementation using **`idpbuilder`**. It shows how the **`idpbuilder`** and local environment interact with AWS resources to deploy and configure the platform on an EKS cluster. From 8bb304074078c5683e3d90c5e6b853e8a0f9a18b Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 14:37:23 -0700 Subject: [PATCH 23/30] Update docs (#64) N/A --------- Signed-off-by: Pankaj Walke --- examples/spark/pi.yaml | 44 +++++++++ examples/template-generation/data-on-eks.yaml | 94 +++++++++++++++++++ 2 files changed, 138 insertions(+) create mode 100644 examples/spark/pi.yaml create mode 100644 examples/template-generation/data-on-eks.yaml diff --git a/examples/spark/pi.yaml b/examples/spark/pi.yaml new file mode 100644 index 000000000..448b01aa1 --- /dev/null +++ b/examples/spark/pi.yaml @@ -0,0 +1,44 @@ +apiVersion: sparkoperator.k8s.io/v1beta2 +kind: SparkApplication +metadata: + name: pyspark-pi-karpenter +spec: + type: Python + pythonVersion: "3" + mode: cluster + image: public.ecr.aws/r1l5w1y9/spark-operator:3.2.1-hadoop-3.3.1-java-11-scala-2.12-python-3.8-latest + imagePullPolicy: Always + mainApplicationFile: local:///opt/spark/examples/src/main/python/pi.py + sparkVersion: 3.1.1 + restartPolicy: + type: OnFailure + onFailureRetries: 1 + onFailureRetryInterval: 10 + onSubmissionFailureRetries: 5 + onSubmissionFailureRetryInterval: 20 + driver: + cores: 1 + coreLimit: 1200m + memory: 512m + labels: + version: 3.1.1 + serviceAccount: spark + nodeSelector: + NodeGroupType: spark-spot-ca + tolerations: + - key: spark-spot-ca + operator: Exists + effect: NoSchedule + executor: + cores: 1 + instances: 2 + memory: 512m + serviceAccount: spark + labels: + version: 3.1.1 + nodeSelector: + NodeGroupType: spark-spot-ca + tolerations: + - key: spark-spot-ca + operator: Exists + effect: NoSchedule diff --git a/examples/template-generation/data-on-eks.yaml b/examples/template-generation/data-on-eks.yaml new file mode 100644 index 000000000..c994c3b52 --- /dev/null +++ b/examples/template-generation/data-on-eks.yaml @@ -0,0 +1,94 @@ +apiVersion: scaffolder.backstage.io/v1beta3 +kind: Template +metadata: + description: Creates a EKS cluster with Spark Operator + extra enabled through Terraform + name: data-on-eks-spark + title: Data on EKS - Spark Operator +spec: + owner: guest + type: service + parameters: + - title: Terraform config options + properties: + tfVars: # this field is to be generated. + title: Terraform variables + type: object + - title: Configuration Options + properties: + name: + title: name of this entry + type: string + namespace: + title: namespace within the kubernetes cluster to deploy this + type: string + default: data-on-eks + adminRoleName: # update the aws-config cm to give admin access to this group. + title: Admin Role Name + description: Name of the role to give the administrative rights on the EKS cluster. + default: Admin + type: string + clusterName: + title: Cluster to run + description: The cluster to run this workflow in. + type: string + ui:field: KubernetesClusterPicker + repoUrl: # need a place to store this entity information. + title: Repository Location + type: string + ui:field: RepoUrlPicker + ui:options: + allowedHosts: + - github.com + steps: + - id: create-repo + name: Create Repository + action: github:repo:create + input: + repoUrl: ${{ parameters.repoUrl }} + - id: fetch-base + name: Fetch Base + action: fetch:template + input: + url: ./data-on-eks + values: + name: ${{ parameters.name }} + namespace: ${{ parameters.namespace }} + tfVars: ${{ parameters.tfVars }} + adminRoleName: ${{parameters.adminRoleName}} + clusterName: ${{ parameters.clusterName }} + - id: init-repo + name: Initialize Repository + action: github:repo:push + input: + repoUrl: ${{ parameters.repoUrl }} + defaultBranch: main + - id: wait + name: Waiting for the repo to be ready + action: "roadiehq:utils:sleep" + input: + amount: 5 + - id: register + name: Register + action: catalog:register + input: + repoContentsUrl: ${{ steps['init-repo'].output.repoContentsUrl }} + catalogInfoPath: '/catalog-info.yaml' + - id: apply-cm + name: Apply TF variables CM + action: cnoe:kubernetes:apply + input: + manifestPath: cm.yaml # this contains tfvar json file. + namespaced: true + clusterName: ${{ parameters.clusterName }} + - id: apply-workflow + name: Start TF workflow + action: cnoe:kubernetes:apply + input: + manifestPath: workflow.yaml # initiates an argo workflows run. + namespaced: true + clusterName: ${{ parameters.clusterName }} + output: + links: + - title: Open in catalog + icon: catalog + entityRef: ${{ steps['register'].output.entityRef }} From 72a3a20e59ab267a6ac162abe83f1b7e0cd29efa Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 15:32:23 -0700 Subject: [PATCH 24/30] Add contributing.md (#66) N/A Signed-off-by: Pankaj Walke --- CONTRIBUTING.md | 147 +++++++++++++++++++++++++++ docs/installation_with_idpbuilder.md | 2 +- 2 files changed, 148 insertions(+), 1 deletion(-) create mode 100644 CONTRIBUTING.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 000000000..7cec353e9 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,147 @@ +# AWS Reference Implementation + +Thank you for your interest in contributing to the AWS Reference Implementation! This guide will help you get started with contributing to this Internal Developer Platform (IDP) reference implementation for AWS. + +## Getting Started + +### Prerequisites + +Before contributing, ensure you have the following tools installed: + +- [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) +- [kubectl](https://kubernetes.io/docs/tasks/tools/) +- [yq](https://mikefarah.gitbook.io/yq/v3.x) +- [helm](https://helm.sh/docs/intro/install/) +- [Git](https://git-scm.com/downloads) + +### Development Environment Setup + +1. Fork the repository to your GitHub organization +2. Clone your fork locally: + ```bash + git clone https://github.com/your-org/reference-implementation-aws.git + cd reference-implementation-aws + ``` +3. Set up your development environment following the [Getting Started](README.md#getting-started) guide + +## How to Contribute + +### Reporting Issues + +- Use GitHub Issues to report bugs or request features +- Search existing issues before creating new ones +- Provide detailed information including: + - Steps to reproduce + - Expected vs actual behavior + - Environment details (AWS region, EKS version, etc.) + - Relevant logs or error messages + +### Making Changes + +1. Create a feature branch: + ```bash + git checkout -b feature/your-feature-name + ``` + +2. Make your changes following the project structure: + - **Addons**: Add new addons in `packages/` directory + - **Scripts**: Update installation/management scripts in `scripts/` + - **Documentation**: Update docs in `docs/` directory + - **Templates**: Add Backstage templates in `templates/` + - **Examples**: Add usage examples in `examples/` + +3. Test your changes: + ```bash + # Test installation + ./scripts/install.sh + + # Verify addons are healthy + kubectl get applications -n argocd + ``` + +4. Commit your changes: + ```bash + git add . + git commit -m "feat: add new addon for X" + ``` + +5. Push and create a pull request: + ```bash + git push origin feature/your-feature-name + ``` + +## Project Structure + +``` +├── cluster/ # EKS cluster configurations (eksctl/terraform) +├── docs/ # Documentation and images +├── examples/ # Usage examples and demos +├── packages/ # Helm charts and addon configurations +├── private/ # GitHub App credentials (templates) +├── scripts/ # Installation and management scripts +├── templates/ # Backstage templates +└── config.yaml # Main configuration file +``` + +## Adding New Addons + +To add a new addon: + +1. Create a directory in `packages/your-addon/` +2. Add `values.yaml` with Helm chart configuration +3. Update `packages/addons/values.yaml` to include your addon +4. Add documentation in `docs/` if needed +5. Test the addon installation + +## Code Standards + +- Follow existing code style and patterns +- Use meaningful commit messages (conventional commits preferred) +- Update documentation for any user-facing changes +- Ensure scripts are executable and include proper error handling +- Test changes in a real EKS environment when possible + +## Pull Request Guidelines + +- Keep PRs focused on a single feature or fix +- Include tests or validation steps +- Update relevant documentation +- Reference related issues in PR description +- Ensure CI checks pass + +## Testing + +Before submitting: + +1. Test the full installation flow: + ```bash + ./scripts/install.sh + ``` + +2. Verify all addons are healthy: + ```bash + kubectl get applications -n argocd + ``` + +3. Test cleanup process: + ```bash + ./scripts/uninstall.sh + ``` + +## Documentation + +- Update README.md for user-facing changes +- Add or update documentation in `docs/` directory +- Include examples in `examples/` directory when applicable +- Update configuration tables and addon lists as needed + +## Getting Help + +- Check existing [documentation](docs/) +- Review [troubleshooting guide](docs/troubleshooting.md) +- Open an issue for questions or problems +- Join community discussions in GitHub Discussions + +## License + +By contributing, you agree that your contributions will be licensed under the same license as the project. \ No newline at end of file diff --git a/docs/installation_with_idpbuilder.md b/docs/installation_with_idpbuilder.md index 641502ba0..ef0d6126d 100644 --- a/docs/installation_with_idpbuilder.md +++ b/docs/installation_with_idpbuilder.md @@ -1,4 +1,4 @@ -# IDPBuilder installation +# Installation using IDPBuilder ## Installation Flow Diagram This diagram illustrates the high-level installation flow for the CNOE AWS Reference Implementation using **`idpbuilder`**. It shows how the **`idpbuilder`** and local environment interact with AWS resources to deploy and configure the platform on an EKS cluster. From 41c8152695d63584bc04f306e076d699bd07b438 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 15:55:00 -0700 Subject: [PATCH 25/30] Delete examples/demo.md --- examples/demo.md | 43 ------------------------------------------- 1 file changed, 43 deletions(-) delete mode 100644 examples/demo.md diff --git a/examples/demo.md b/examples/demo.md deleted file mode 100644 index 4bfe86704..000000000 --- a/examples/demo.md +++ /dev/null @@ -1,43 +0,0 @@ -## Backstage template generation - -Using the CNOE CLI, you can generate Backstage template input fields from Terraform modules, Kubernetes CRDs, and Crossplane XRDs. - -### Terraform (imperative) - -For example, to generate input field from a terraform module in the Data on EKS repository: - -```bash -git clone https://github.com/awslabs/data-on-eks.git /tmp/data-on-eks - -cnoe template tf -i /tmp/data-on-eks/analytics/terraform/spark-k8s-operator -o examples/template-generation -t examples/template-generation/data-on-eks.yaml -p '.spec.parameters[0].properties.tfVars' - -``` -The above command takes the terraform module available at `/tmp/data-on-eks/analytics/terraform/spark-k8s-operator` then inserts generated backstage fields into a partially configured template at `examples/template-generation/data-on-eks.yaml`. This partially configure template contains fields that are common to all modules in the Data on EKS repository. - -You can view what fields are generated by using `diff` and `yq`: - -```bash -diff <(yq -P 'sort_keys(..)' -o=props examples/template-generation/spark-k8s-operator.yaml) <(yq -P 'sort_keys(..)' -o=props examples/template-generation/data-on-eks.yaml) -``` - -The rest of this document assumes you've used the spark-k8s-operator module to generate input fields. - -Once the template is hydrated, it is ready to use. You can push it to a private git repository within your organization or push it to a public repository. -You can then register the template in the Backstage UI (`Create...` > `Register Existing Component`) or update your Backstage configuration. The main configuration file is a ConfigMap in the backstage namespace with the name `backstage-config`. - -You can use the template to create a EKS cluster with optimization for data workload using terraform. The example uses a custom Argo Workflows template to run the install script, add a IAM role to the admin group in the cluster, create a Backstage service account, then registers the cluster to Backstage for use. - -The Argo Workflows run is associated with the Backstage entity. So you can check on its status within Backstage. If you'd like to see detailed information about the run, you can click on it to go to the Argo Workflows UI. - -Once the new cluster is ready, you can submit a Spark Job to the new cluster through Backstage. - -### Terraform (declarative) - -You can also use the terraform controller or Crossplane terraform provider to deploy terraform modules. Examples of this will be included in the future. - - -### Crossplane and ACK - -When using Crossplane, the bulk of work is done by Crossplane providers. You can use GitOps tools like ArgoCD to deploy these manifests to the cluster using Backstage scaffolder templates. Examples of this will be included in the future. - - From 9f9b6d22a93558dfef0a93210144dd5ce2e1c722 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 15:55:12 -0700 Subject: [PATCH 26/30] Update app-with-aws-resources.md --- examples/app-with-aws-resources.md | 1 + 1 file changed, 1 insertion(+) diff --git a/examples/app-with-aws-resources.md b/examples/app-with-aws-resources.md index e69de29bb..bd8227d6b 100644 --- a/examples/app-with-aws-resources.md +++ b/examples/app-with-aws-resources.md @@ -0,0 +1 @@ +# Create GO App with S3 Bucket From 541f4d93d19e9abc05f3873ce4336b03c870c374 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 16:16:48 -0700 Subject: [PATCH 27/30] Update installation_with_idpbuilder.md --- docs/installation_with_idpbuilder.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/installation_with_idpbuilder.md b/docs/installation_with_idpbuilder.md index ef0d6126d..f708fe1de 100644 --- a/docs/installation_with_idpbuilder.md +++ b/docs/installation_with_idpbuilder.md @@ -1,3 +1,8 @@ +--- +title: "Using IDPBuilder (Optional)" +sidebar_position: 3 +--- + # Installation using IDPBuilder ## Installation Flow Diagram From cfad69671e24a73bdf736524372e4f6d322eb594 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 16:17:12 -0700 Subject: [PATCH 28/30] Update installation_flow.md --- docs/installation_flow.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/installation_flow.md b/docs/installation_flow.md index 49e97cc46..b7fc0c9a8 100644 --- a/docs/installation_flow.md +++ b/docs/installation_flow.md @@ -1,3 +1,7 @@ +--- +sidebar_position: 1 +--- + # Installation Flow This document describes the installation flow for the CNOE AWS Reference Implementation. From d41e2bc39412c28be236b4e3300d21a61c601510 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 16:18:45 -0700 Subject: [PATCH 29/30] Update installation_with_idpbuilder.md --- docs/installation_with_idpbuilder.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/installation_with_idpbuilder.md b/docs/installation_with_idpbuilder.md index f708fe1de..a9d56acbd 100644 --- a/docs/installation_with_idpbuilder.md +++ b/docs/installation_with_idpbuilder.md @@ -2,6 +2,8 @@ title: "Using IDPBuilder (Optional)" sidebar_position: 3 --- +> [!WARNING] +> This installation method is currently experimental and might not support all installation options as the primary method but is a good method to test deploying a new target cluster from a kind cluster for testing purposes! # Installation using IDPBuilder From 40eedbece7fdd0b9c6093e14f6c0d902cef383e9 Mon Sep 17 00:00:00 2001 From: Pankaj Walke Date: Tue, 29 Jul 2025 16:19:10 -0700 Subject: [PATCH 30/30] Update troubleshooting.md --- docs/troubleshooting.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 9b1dc038b..75ec17b90 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -1,3 +1,6 @@ +--- +sidebar_position: 2 +--- # Troubleshooting The installation process would take 30-35 minutes depending upon path_routing configuration. If the installation is not complete within this time, cancel the `install.sh` script execution and follow instruction in this document to troubleshoot the issues.]